xref: /btstack/src/classic/rfcomm.c (revision 5393bc3bd1457c8100ee47ad0bc4bfec8160622e)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <inttypes.h>
45 #include <string.h> // memcpy
46 #include <stdint.h>
47 
48 #include "bluetooth_sdp.h"
49 #include "btstack_debug.h"
50 #include "btstack_event.h"
51 #include "btstack_memory.h"
52 #include "btstack_util.h"
53 #include "classic/core.h"
54 #include "classic/rfcomm.h"
55 #include "hci.h"
56 #include "hci_cmd.h"
57 #include "hci_dump.h"
58 #include "l2cap.h"
59 
60 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
61 #ifndef PRIxPTR
62 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
63 #define PRIxPTR "lx"
64 #else
65 #define PRIxPTR "x"
66 #endif
67 #endif
68 
69 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
70 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
71 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
72 #define RFCOMM_USE_OUTGOING_BUFFER
73 #define RFCOMM_USE_ERTM
74 #else
75 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
76 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
77 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
78 #endif
79 #endif
80 
81 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
82 
83 #define RFCOMM_CREDITS 10
84 
85 // FCS calc
86 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
87 #define BT_RFCOMM_CRC_CHECK_LEN     3
88 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
89 
90 // Control field values      bit no.       1 2 3 4 PF 6 7 8
91 #define BT_RFCOMM_SABM       0x3F       // 1 1 1 1  1 1 0 0
92 #define BT_RFCOMM_UA         0x73       // 1 1 0 0  1 1 1 0
93 #define BT_RFCOMM_DM         0x0F       // 1 1 1 1  0 0 0 0
94 #define BT_RFCOMM_DM_PF      0x1F       // 1 1 1 1  1 0 0 0
95 #define BT_RFCOMM_DISC       0x53       // 1 1 0 0  1 0 1 0
96 #define BT_RFCOMM_UIH        0xEF       // 1 1 1 1  0 1 1 1
97 #define BT_RFCOMM_UIH_PF     0xFF       // 1 1 1 1  0 1 1 1
98 
99 // Multiplexer message types
100 #define BT_RFCOMM_CLD_CMD    0xC3
101 #define BT_RFCOMM_FCON_CMD   0xA3
102 #define BT_RFCOMM_FCON_RSP   0xA1
103 #define BT_RFCOMM_FCOFF_CMD  0x63
104 #define BT_RFCOMM_FCOFF_RSP  0x61
105 #define BT_RFCOMM_MSC_CMD    0xE3
106 #define BT_RFCOMM_MSC_RSP    0xE1
107 #define BT_RFCOMM_NSC_RSP    0x11
108 #define BT_RFCOMM_PN_CMD     0x83
109 #define BT_RFCOMM_PN_RSP     0x81
110 #define BT_RFCOMM_RLS_CMD    0x53
111 #define BT_RFCOMM_RLS_RSP    0x51
112 #define BT_RFCOMM_RPN_CMD    0x93
113 #define BT_RFCOMM_RPN_RSP    0x91
114 #define BT_RFCOMM_TEST_CMD   0x23
115 #define BT_RFCOMM_TEST_RSP   0x21
116 
117 typedef enum {
118     CH_EVT_RCVD_SABM = 1,
119     CH_EVT_RCVD_UA,
120     CH_EVT_RCVD_PN,
121     CH_EVT_RCVD_PN_RSP,
122     CH_EVT_RCVD_DISC,
123     CH_EVT_RCVD_DM,
124     CH_EVT_RCVD_MSC_CMD,
125     CH_EVT_RCVD_MSC_RSP,
126     CH_EVT_RCVD_NSC_RSP,
127     CH_EVT_RCVD_RLS_CMD,
128     CH_EVT_RCVD_RLS_RSP,
129     CH_EVT_RCVD_RPN_CMD,
130     CH_EVT_RCVD_RPN_REQ,
131     CH_EVT_RCVD_RPN_RSP,
132     CH_EVT_RCVD_CREDITS,
133     CH_EVT_MULTIPLEXER_READY,
134     CH_EVT_READY_TO_SEND,
135 } RFCOMM_CHANNEL_EVENT;
136 
137 typedef struct rfcomm_channel_event {
138     RFCOMM_CHANNEL_EVENT type;
139     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
140 } rfcomm_channel_event_t;
141 
142 typedef struct rfcomm_channel_event_pn {
143     rfcomm_channel_event_t super;
144     uint16_t max_frame_size;
145     uint8_t  priority;
146     uint8_t  credits_outgoing;
147 } rfcomm_channel_event_pn_t;
148 
149 typedef struct rfcomm_channel_event_rpn {
150     rfcomm_channel_event_t super;
151     rfcomm_rpn_data_t data;
152 } rfcomm_channel_event_rpn_t;
153 
154 typedef struct rfcomm_channel_event_rls {
155     rfcomm_channel_event_t super;
156     uint8_t line_status;
157 } rfcomm_channel_event_rls_t;
158 
159 typedef struct rfcomm_channel_event_msc {
160     rfcomm_channel_event_t super;
161     uint8_t modem_status;
162 } rfcomm_channel_event_msc_t;
163 
164 
165 // global rfcomm data
166 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
167 
168 // linked lists for all
169 static btstack_linked_list_t rfcomm_multiplexers;
170 static btstack_linked_list_t rfcomm_channels;
171 static btstack_linked_list_t rfcomm_services;
172 
173 static gap_security_level_t rfcomm_security_level;
174 
175 #ifdef RFCOMM_USE_ERTM
176 static uint16_t rfcomm_ertm_id;
177 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
178 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
179 #endif
180 
181 #ifdef RFCOMM_USE_OUTGOING_BUFFER
182 static uint8_t outgoing_buffer[1030];
183 #endif
184 
185 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel);
186 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
187 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
188 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
189 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
190 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
191 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
192 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
193 
194 // MARK: RFCOMM CLIENT EVENTS
195 
196 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
197     btstack_linked_item_t *it;
198     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
199         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
200         if (channel->rfcomm_cid == rfcomm_cid) {
201             return channel;
202         };
203     }
204     return NULL;
205 }
206 
207 static uint16_t rfcomm_next_client_cid(void){
208     do {
209         if (rfcomm_client_cid_generator == 0xffff) {
210             // don't use 0 as channel id
211             rfcomm_client_cid_generator = 1;
212         } else {
213             rfcomm_client_cid_generator++;
214         }
215     } while (rfcomm_channel_for_rfcomm_cid(rfcomm_client_cid_generator) != NULL);
216     return rfcomm_client_cid_generator;
217 }
218 
219 #ifdef RFCOMM_USE_ERTM
220 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_ertm_id(uint16_t ertm_id) {
221     btstack_linked_item_t *it;
222     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
223         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
224         if (multiplexer->ertm_id == ertm_id) {
225             return multiplexer;
226         };
227     }
228     return NULL;
229 }
230 
231 static uint16_t rfcomm_next_ertm_id(void){
232     do {
233         if (rfcomm_ertm_id == 0xffff) {
234             // don't use 0 as channel id
235             rfcomm_ertm_id = 1;
236         } else {
237             rfcomm_ertm_id++;
238         }
239     } while (rfcomm_multiplexer_for_ertm_id(rfcomm_ertm_id) != NULL);
240     return rfcomm_ertm_id;
241 }
242 
243 #endif
244 
245 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
246 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
247     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
248              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
249     uint8_t event[13];
250     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
251     event[1] = sizeof(event) - 2;
252     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
253     event[8] = channel->dlci >> 1;
254     little_endian_store_16(event, 9, channel->rfcomm_cid);
255     little_endian_store_16(event, 11, channel->multiplexer->con_handle);
256     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
257 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
258 }
259 
260 // API Change: BTstack-0.3.50x uses
261 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
262 // next Cydia release will use SVN version of this
263 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
264 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
265     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
266              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
267              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
268     uint8_t event[18];
269     uint8_t pos = 0;
270     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
271     event[pos++] = sizeof(event) - 2;                   // 1
272     event[pos++] = status;                              // 2
273     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
274     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
275 	event[pos++] = channel->dlci >> 1;                                      // 11
276 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
277 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
278     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
279     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
280 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
281 
282     // if channel opened successfully, also send can send now if possible
283     if (status) return;
284     if (rfcomm_channel_can_send(channel)){
285         rfcomm_emit_can_send_now(channel);
286     }
287 }
288 
289 // data: event(8), len(8), rfcomm_cid(16)
290 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
291     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
292     uint8_t event[4];
293     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
294     event[1] = sizeof(event) - 2;
295     little_endian_store_16(event, 2, channel->rfcomm_cid);
296     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
297 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
298 }
299 
300 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
301     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
302     uint8_t event[5];
303     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
304     event[1] = sizeof(event) - 2;
305     little_endian_store_16(event, 2, channel->rfcomm_cid);
306     event[4] = line_status;
307     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
308     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
309 }
310 
311 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel, bool remote) {
312     // notify client about new settings
313     uint8_t event[2+2+1+sizeof(rfcomm_rpn_data_t)];
314     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
315     event[1] = sizeof(event) - 2;
316     little_endian_store_16(event, 2, channel->rfcomm_cid);
317     if (remote){
318         event[4] = 1;
319         (void)memcpy(&event[5], (uint8_t *) &channel->remote_rpn_data, sizeof(rfcomm_rpn_data_t));
320     } else {
321         event[4] = 0;
322         (void)memcpy(&event[5], (uint8_t *) &channel->local_rpn_data, sizeof(rfcomm_rpn_data_t));
323     }
324     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
325     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
326 }
327 
328 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
329     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
330     uint8_t event[4];
331     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
332     event[1] = sizeof(event) - 2;
333     little_endian_store_16(event, 2, channel->rfcomm_cid);
334     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
335     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
336 }
337 
338 // MARK RFCOMM RPN DATA HELPER
339 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
340         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
341         rpn_data->flags = 0x03;               /* 8-n-1 */
342         rpn_data->flow_control = 0;           /* no flow control */
343         rpn_data->xon  = 0xd1;                /* XON */
344         rpn_data->xoff = 0xd3;                /* XOFF */
345         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
346         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
347 }
348 
349 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
350     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
351         dest->baud_rate = src->baud_rate;
352     }
353     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
354         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
355     }
356     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
357         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
358     }
359     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
360         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
361     }
362     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
363         dest->flags = (dest->flags & 0xcf) | (src->flags & 0x30);
364     }
365     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
366         dest->xon = src->xon;
367     }
368     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
369         dest->xoff = src->xoff;
370     }
371     uint8_t mask = src->parameter_mask_1 & 0x3f;
372     dest->flow_control = (dest->flow_control & ~mask) | (src->flow_control & mask);
373    // always copy parameter mask, too. informative for client, needed for response
374     dest->parameter_mask_0 = src->parameter_mask_0;
375     dest->parameter_mask_1 = src->parameter_mask_1;
376 }
377 // MARK: RFCOMM MULTIPLEXER HELPER
378 
379 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
380     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
381     uint16_t max_frame_size = l2cap_mtu - 5;
382     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
383     return max_frame_size;
384 }
385 
386 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
387     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
388     multiplexer->fcon = 1;
389     multiplexer->send_dm_for_dlci = 0;
390     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
391     multiplexer->test_data_len = 0;
392     multiplexer->nsc_command = 0;
393 }
394 
395 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
396 
397     // alloc structure
398     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
399     if (!multiplexer) return NULL;
400 
401     // fill in
402     rfcomm_multiplexer_initialize(multiplexer);
403     bd_addr_copy(multiplexer->remote_addr, addr);
404 
405     // add to services list
406     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
407 
408     return multiplexer;
409 }
410 
411 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
412     btstack_linked_item_t *it;
413     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
414         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
415         // ignore multiplexer in shutdown
416         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
417         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
418             return multiplexer;
419         };
420     }
421     return NULL;
422 }
423 
424 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
425     btstack_linked_item_t *it;
426     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
427         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
428         if (multiplexer->l2cap_cid == l2cap_cid) {
429             return multiplexer;
430         };
431     }
432     return NULL;
433 }
434 
435 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
436     btstack_linked_item_t *it;
437     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
438         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
439         if (channel->multiplexer == multiplexer) {
440             return 1;
441         }
442     }
443     return 0;
444 }
445 
446 // MARK: RFCOMM CHANNEL HELPER
447 
448 static void rfcomm_dump_channels(void){
449 #ifdef ENABLE_LOG_INFO
450     btstack_linked_item_t * it;
451     int channels = 0;
452     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
453         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
454         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
455         channels++;
456     }
457 #endif
458 }
459 
460 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
461                                rfcomm_service_t *service, uint8_t server_channel){
462 
463     // set defaults for port configuration (even for services)
464     rfcomm_rpn_data_set_defaults(&channel->local_rpn_data);
465     rfcomm_rpn_data_set_defaults(&channel->remote_rpn_data);
466 
467     channel->state            = RFCOMM_CHANNEL_CLOSED;
468     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
469 
470     channel->multiplexer      = multiplexer;
471     channel->rfcomm_cid       = rfcomm_next_client_cid();
472     channel->max_frame_size   = multiplexer->max_frame_size;
473 
474     channel->credits_incoming = 0;
475     channel->credits_outgoing = 0;
476 
477     // incoming flow control not active
478     channel->new_credits_incoming  = RFCOMM_CREDITS;
479     channel->incoming_flow_control = 0;
480 
481     // nothing to send
482     channel->local_line_status  = RFCOMM_RLS_STATUS_INVALID;
483     channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
484 
485     // modem status - ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
486     channel->local_modem_status  = 0x8d;
487     channel->remote_modem_status = 0x8d;
488 
489     channel->service = service;
490 	if (service) {
491 		// incoming connection
492     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
493         if (channel->max_frame_size > service->max_frame_size) {
494             channel->max_frame_size = service->max_frame_size;
495         }
496         channel->incoming_flow_control = service->incoming_flow_control;
497         channel->new_credits_incoming  = service->incoming_initial_credits;
498         channel->packet_handler        = service->packet_handler;
499 	} else {
500 		// outgoing connection
501 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
502 	}
503 }
504 
505 // service == NULL -> outgoing channel
506 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
507                                                 rfcomm_service_t * service, uint8_t server_channel){
508 
509     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
510     rfcomm_dump_channels();
511 
512     // alloc structure
513     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
514     if (!channel) return NULL;
515 
516     // fill in
517     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
518 
519     // add to services list
520     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
521 
522     return channel;
523 }
524 
525 static void rfcomm_notify_channel_can_send(void){
526     btstack_linked_list_iterator_t it;
527     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
528     while (btstack_linked_list_iterator_has_next(&it)){
529         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
530         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
531         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
532 
533         channel->waiting_for_can_send_now = 0;
534         rfcomm_emit_can_send_now(channel);
535     }
536 }
537 
538 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
539     btstack_linked_item_t *it;
540     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
541         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
542         if ((channel->dlci == dlci) && (channel->multiplexer == multiplexer)) {
543             return channel;
544         };
545     }
546     return NULL;
547 }
548 
549 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
550     btstack_linked_item_t *it;
551     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
552         rfcomm_service_t * service = ((rfcomm_service_t *) it);
553         if ( service->server_channel == server_channel){
554             return service;
555         };
556     }
557     return NULL;
558 }
559 
560 // MARK: RFCOMM SEND
561 
562 /**
563  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
564  */
565 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
566 
567     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
568 
569 #ifdef RFCOMM_USE_OUTGOING_BUFFER
570     uint8_t * rfcomm_out_buffer = outgoing_buffer;
571 #else
572     l2cap_reserve_packet_buffer();
573     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
574 #endif
575 
576 	uint16_t pos = 0;
577 	uint8_t crc_fields = 3;
578 
579 	rfcomm_out_buffer[pos++] = address;
580 	rfcomm_out_buffer[pos++] = control;
581 
582 	// length field can be 1 or 2 octets
583 	if (len < 128){
584 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
585 	} else {
586 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
587 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
588 		crc_fields++;
589 	}
590 
591 	// add credits for UIH frames when PF bit is set
592 	if (control == BT_RFCOMM_UIH_PF){
593 		rfcomm_out_buffer[pos++] = credits;
594 	}
595 
596 	// copy actual data
597 	if (len) {
598 		(void)memcpy(&rfcomm_out_buffer[pos], data, len);
599 		pos += len;
600 	}
601 
602 	// UIH frames only calc FCS over address + control (5.1.1)
603 	if ((control & 0xef) == BT_RFCOMM_UIH){
604 		crc_fields = 2;
605 	}
606 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
607 
608 #ifdef RFCOMM_USE_OUTGOING_BUFFER
609     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
610 #else
611     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
612 #endif
613 
614     return err;
615 }
616 
617 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
618 static uint8_t rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
619 
620     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
621     uint8_t control = BT_RFCOMM_UIH;
622 
623 #ifdef RFCOMM_USE_OUTGOING_BUFFER
624     uint8_t * rfcomm_out_buffer = outgoing_buffer;
625 #else
626     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
627 #endif
628 
629     uint16_t pos = 0;
630     rfcomm_out_buffer[pos++] = address;
631     rfcomm_out_buffer[pos++] = control;
632     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
633     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
634 
635     // actual data is already in place
636     pos += len;
637 
638     // UIH frames only calc FCS over address + control (5.1.1)
639     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
640 
641 #ifdef RFCOMM_USE_OUTGOING_BUFFER
642     uint8_t status = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
643 #else
644     uint8_t status = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
645 #endif
646 
647     return status;
648 }
649 
650 // C/R Flag in Address
651 // - terms: initiator = station that creates multiplexer with SABM
652 // - terms: responder = station that responds to multiplexer setup with UA
653 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
654 //    - command initiator = 1 /response responder = 1
655 //    - command responder = 0 /response initiator = 0
656 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
657 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
658 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
659 
660 // C/R Flag in Message
661 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
662 //   - If the C/R bit is set to 1 the message is a command
663 //   - if it is set to 0 the message is a response.
664 
665 // temp/old messge construction
666 
667 // new object oriented version
668 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
669 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
670     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
671 }
672 
673 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
674 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
675     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
676 }
677 
678 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
679 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
680     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
681 }
682 
683 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
684 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
685     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
686 }
687 
688 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
689     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
690     uint8_t payload[2];
691     uint8_t pos = 0;
692     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
693     payload[pos++] = (0 << 1) | 1;  // len
694     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
695 }
696 
697 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
698 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
699 //     uint8_t payload[2+len];
700 //     uint8_t pos = 0;
701 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
702 //     payload[pos++] = (len + 1) << 1 | 1;  // len
703 //     memcpy(&payload[pos], data, len);
704 //     pos += len;
705 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
706 // }
707 
708 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
709     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
710     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
711     uint8_t pos = 0;
712     payload[pos++] = BT_RFCOMM_TEST_RSP;
713     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
714         len = RFCOMM_TEST_DATA_MAX_LEN;
715     }
716     payload[pos++] = (len << 1) | 1;  // len
717     (void)memcpy(&payload[pos], data, len);
718     pos += len;
719     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
720 }
721 
722 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
723 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
724 	uint8_t payload[4];
725 	uint8_t pos = 0;
726 	payload[pos++] = BT_RFCOMM_MSC_CMD;
727 	payload[pos++] = (2 << 1) | 1;  // len
728 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
729 	payload[pos++] = signals;
730 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
731 }
732 
733 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
734 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
735 	uint8_t payload[4];
736 	uint8_t pos = 0;
737 	payload[pos++] = BT_RFCOMM_MSC_RSP;
738 	payload[pos++] = (2 << 1) | 1;  // len
739 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
740 	payload[pos++] = signals;
741 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
742 }
743 
744 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
745     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
746     uint8_t payload[3];
747     uint8_t pos = 0;
748     payload[pos++] = BT_RFCOMM_NSC_RSP;
749     payload[pos++] = (1 << 1) | 1;  // len
750     payload[pos++] = command;
751     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
752 }
753 
754 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
755 	uint8_t payload[10];
756 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
757 	uint8_t pos = 0;
758 	payload[pos++] = BT_RFCOMM_PN_CMD;
759 	payload[pos++] = (8 << 1) | 1;  // len
760 	payload[pos++] = dlci;
761 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
762 	payload[pos++] = 0; // priority
763 	payload[pos++] = 0; // max 60 seconds ack
764 	payload[pos++] = max_frame_size & 0xff; // max framesize low
765 	payload[pos++] = max_frame_size >> 8;   // max framesize high
766 	payload[pos++] = 0x00; // number of retransmissions
767 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
768 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
769 }
770 
771 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
772 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
773                                        uint8_t priority, uint16_t max_frame_size){
774 	uint8_t payload[10];
775 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
776 	uint8_t pos = 0;
777 	payload[pos++] = BT_RFCOMM_PN_RSP;
778 	payload[pos++] = (8 << 1) | 1;  // len
779 	payload[pos++] = dlci;
780 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
781 	payload[pos++] = priority; // priority
782 	payload[pos++] = 0; // max 60 seconds ack
783 	payload[pos++] = max_frame_size & 0xff; // max framesize low
784 	payload[pos++] = max_frame_size >> 8;   // max framesize high
785 	payload[pos++] = 0x00; // number of retransmissions
786 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
787 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
788 }
789 
790 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
791     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
792     uint8_t payload[4];
793     uint8_t pos = 0;
794     payload[pos++] = BT_RFCOMM_RLS_CMD;
795     payload[pos++] = (2 << 1) | 1;  // len
796     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
797     payload[pos++] = line_status;
798     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
799 }
800 
801 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
802     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
803     uint8_t payload[4];
804     uint8_t pos = 0;
805     payload[pos++] = BT_RFCOMM_RLS_RSP;
806     payload[pos++] = (2 << 1) | 1;  // len
807     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
808     payload[pos++] = line_status;
809     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
810 }
811 
812 static int rfcomm_send_uih_rpn_config(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
813     uint8_t payload[10];
814     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
815     uint8_t pos = 0;
816     payload[pos++] = BT_RFCOMM_RPN_CMD;
817     payload[pos++] = (8 << 1) | 1;  // len
818     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
819     payload[pos++] = rpn_data->baud_rate;
820     payload[pos++] = rpn_data->flags;
821     payload[pos++] = rpn_data->flow_control;
822     payload[pos++] = rpn_data->xon;
823     payload[pos++] = rpn_data->xoff;
824     payload[pos++] = rpn_data->parameter_mask_0;
825     payload[pos++] = rpn_data->parameter_mask_1;
826     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
827 }
828 
829 static int rfcomm_send_uih_rpn_query(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
830     uint8_t payload[3];
831     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
832     uint8_t pos = 0;
833     payload[pos++] = BT_RFCOMM_RPN_CMD;
834     payload[pos++] = (1 << 1) | 1;  // len
835     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
836     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
837 }
838 
839 static int rfcomm_send_uih_rpn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
840 	uint8_t payload[10];
841 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
842 	uint8_t pos = 0;
843 	payload[pos++] = BT_RFCOMM_RPN_RSP;
844 	payload[pos++] = (8 << 1) | 1;  // len
845 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
846 	payload[pos++] = rpn_data->baud_rate;
847 	payload[pos++] = rpn_data->flags;
848 	payload[pos++] = rpn_data->flow_control;
849 	payload[pos++] = rpn_data->xon;
850 	payload[pos++] = rpn_data->xoff;
851 	payload[pos++] = rpn_data->parameter_mask_0;
852 	payload[pos++] = rpn_data->parameter_mask_1;
853 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
854 }
855 
856 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
857     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
858     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
859 }
860 
861 // depending on channel state emit channel opened with status or channel closed
862 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
863     // emit appropriate events
864     switch(channel->state){
865         case RFCOMM_CHANNEL_OPEN:
866         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
867             rfcomm_emit_channel_closed(channel);
868             break;
869         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
870             // remote didn't wait until we send the UA disc
871             // close event already emitted
872             break;
873         default:
874             rfcomm_emit_channel_opened(channel, status);
875             break;
876     }
877 }
878 
879 // MARK: RFCOMM MULTIPLEXER
880 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
881     if (multiplexer->timer_active) {
882         btstack_run_loop_remove_timer(&multiplexer->timer);
883         multiplexer->timer_active = 0;
884     }
885 }
886 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
887     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
888     btstack_memory_rfcomm_multiplexer_free(multiplexer);
889 }
890 
891 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
892     // remove (potential) timer
893     rfcomm_multiplexer_stop_timer(multiplexer);
894 
895     // close and remove all channels
896     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
897     while (it->next){
898         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
899         if (channel->multiplexer == multiplexer) {
900             // emit open with status or closed
901             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
902             // remove from list
903             it->next = it->next->next;
904             // free channel struct
905             btstack_memory_rfcomm_channel_free(channel);
906         } else {
907             it = it->next;
908         }
909     }
910 
911     // remove mutliplexer
912     rfcomm_multiplexer_free(multiplexer);
913 }
914 
915 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
916     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
917     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
918 
919     log_info("handler timeout: shutting down multiplexer! (no channels)");
920     uint16_t l2cap_cid = multiplexer->l2cap_cid;
921     rfcomm_multiplexer_finalize(multiplexer);
922     l2cap_disconnect(l2cap_cid);
923 }
924 
925 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
926     if (multiplexer->timer_active) {
927         btstack_run_loop_remove_timer(&multiplexer->timer);
928         multiplexer->timer_active = 0;
929     }
930     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
931 
932     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
933     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
934     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
935     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
936     btstack_run_loop_add_timer(&multiplexer->timer);
937     multiplexer->timer_active = 1;
938 }
939 
940 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
941     log_info("Multiplexer up and running");
942     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
943 
944     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
945 
946     // transition of channels that wait for multiplexer
947     btstack_linked_item_t *it;
948     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
949         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
950         if (channel->multiplexer != multiplexer) continue;
951         int rfcomm_channel_valid = 1;
952         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
953         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
954             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
955         }
956     }
957     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
958 
959     // request can send now for multiplexer if ready
960     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
961         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
962     }
963 }
964 
965 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
966 
967     log_debug("can_send_now enter: %u", l2cap_cid);
968 
969     btstack_linked_list_iterator_t it;
970     int token_consumed = 0;
971 
972     // forward token to multiplexer
973     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
974     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
975         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
976         if (multiplexer->l2cap_cid != l2cap_cid) continue;
977         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
978             log_debug("can_send_now enter: multiplexer token");
979             token_consumed = 1;
980             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
981         }
982     }
983 
984     // forward token to channel state machine
985     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
986     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
987         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
988         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
989         // channel state machine
990         if (rfcomm_channel_ready_to_send(channel)){
991             log_debug("can_send_now enter: channel token");
992             token_consumed = 1;
993             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
994             int rfcomm_channel_valid = 1;
995             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
996         }
997     }
998 
999     // forward token to client
1000     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
1001     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
1002         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
1003         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
1004         // client waiting for can send now
1005         if (!channel->waiting_for_can_send_now)    continue;
1006         if ((channel->multiplexer->fcon & 1) == 0) continue;
1007         if (!channel->credits_outgoing){
1008             log_debug("can_send_now waiting to send but no credits (ignore)");
1009             continue;
1010         }
1011 
1012         log_debug("can_send_now enter: client token");
1013         token_consumed = 1;
1014         channel->waiting_for_can_send_now = 0;
1015         rfcomm_emit_can_send_now(channel);
1016     }
1017 
1018     // if token was consumed, request another one
1019     if (token_consumed) {
1020         l2cap_request_can_send_now_event(l2cap_cid);
1021     }
1022 
1023     log_debug("can_send_now exit");
1024 }
1025 
1026 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
1027     multiplexer->state = state;
1028     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1029 }
1030 
1031 /**
1032  * @return handled packet
1033  */
1034 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
1035 
1036     UNUSED(size);   // ok: handling own l2cap events
1037 
1038     bd_addr_t event_addr;
1039     uint16_t l2cap_cid;
1040     hci_con_handle_t con_handle;
1041     rfcomm_multiplexer_t *multiplexer = NULL;
1042     uint8_t status;
1043 
1044     switch (hci_event_packet_get_type(packet)) {
1045 
1046         // accept incoming rfcomm connection if no multiplexer exists yet
1047         case L2CAP_EVENT_INCOMING_CONNECTION:
1048             l2cap_event_incoming_connection_get_address(packet, event_addr);
1049             con_handle = l2cap_event_incoming_connection_get_handle(packet);
1050             l2cap_cid  = l2cap_event_incoming_connection_get_local_cid(packet);
1051 
1052             btstack_assert(l2cap_event_incoming_connection_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1053 
1054             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1055 
1056             if (multiplexer) {
1057                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - multiplexer already exists", l2cap_cid);
1058                 l2cap_decline_connection(l2cap_cid);
1059                 return 1;
1060             }
1061 
1062             // create and inititialize new multiplexer instance (incoming)
1063             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
1064             if (!multiplexer){
1065                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - no memory left", l2cap_cid);
1066                 l2cap_decline_connection(l2cap_cid);
1067                 return 1;
1068             }
1069 
1070             multiplexer->con_handle = con_handle;
1071             multiplexer->l2cap_cid = l2cap_cid;
1072             //
1073             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1074             log_info("RFCOMM incoming (l2cap_cid 0x%02x) => accept", l2cap_cid);
1075 
1076 #ifdef RFCOMM_USE_ERTM
1077             // request
1078             rfcomm_ertm_request_t request;
1079             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1080             (void)memcpy(request.addr, event_addr, 6);
1081             request.ertm_id = rfcomm_next_ertm_id();
1082             if (rfcomm_ertm_request_callback){
1083                 (*rfcomm_ertm_request_callback)(&request);
1084             }
1085             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1086                 multiplexer->ertm_id = request.ertm_id;
1087                 l2cap_ertm_accept_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1088                 return 1;
1089             }
1090 #endif
1091 
1092             l2cap_accept_connection(l2cap_cid);
1093             return 1;
1094 
1095         // l2cap connection opened -> store l2cap_cid, remote_addr
1096         case L2CAP_EVENT_CHANNEL_OPENED:
1097 
1098             btstack_assert(l2cap_event_channel_opened_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1099 
1100             status = l2cap_event_channel_opened_get_status(packet);
1101             log_info("channel opened, status %u", status);
1102 
1103             // get multiplexer for remote addr
1104             con_handle = l2cap_event_channel_opened_get_handle(packet);
1105             l2cap_cid = l2cap_event_channel_opened_get_local_cid(packet);
1106             l2cap_event_channel_opened_get_address(packet, event_addr);
1107             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1108             if (!multiplexer) {
1109                 log_error("channel opened but no multiplexer prepared");
1110                 return 1;
1111             }
1112 
1113             // set con handle for outgoing (already set for incoming)
1114             multiplexer->con_handle = con_handle;
1115 
1116             // on l2cap open error discard everything
1117             if (status){
1118 
1119                 // remove (potential) timer
1120                 rfcomm_multiplexer_stop_timer(multiplexer);
1121 
1122                 // mark multiplexer as shutting down
1123                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1124 
1125                 // emit rfcomm_channel_opened with status and free channel
1126                 // note: repeatedly go over list until full iteration causes no further change
1127                 int done;
1128                 do {
1129                     done = 1;
1130                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1131                     while (it->next) {
1132                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1133                         if (channel->multiplexer == multiplexer){
1134                             done = 0;
1135                             rfcomm_emit_channel_opened(channel, status);
1136                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1137                             btstack_memory_rfcomm_channel_free(channel);
1138                             break;
1139                         } else {
1140                             it = it->next;
1141                         }
1142                     }
1143                 } while (!done);
1144 
1145                 // free multiplexer
1146                 rfcomm_multiplexer_free(multiplexer);
1147                 return 1;
1148             }
1149 
1150             // following could be: rfcomm_multiplexer_state_machine(..., EVENT_L2CAP_OPENED)
1151 
1152             // set max frame size based on l2cap MTU
1153             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1154 
1155             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1156                 log_info("channel opened: outgoing connection");
1157                 multiplexer->l2cap_cid = l2cap_cid;
1158                 // send SABM #0
1159                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1160             }
1161             return 1;
1162 
1163             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1164 
1165         // Notify channel packet handler if they can send now
1166         case L2CAP_EVENT_CAN_SEND_NOW:
1167             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1168             rfcomm_handle_can_send_now(l2cap_cid);
1169             return 1;
1170 
1171         case L2CAP_EVENT_CHANNEL_CLOSED:
1172             l2cap_cid = l2cap_event_channel_closed_get_local_cid(packet);
1173             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1174             log_info("channel closed cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1175             if (!multiplexer) break;
1176             log_info("channel closed state %u", multiplexer->state);
1177             // no need to call l2cap_disconnect here, as it's already closed
1178             rfcomm_multiplexer_finalize(multiplexer);
1179             return 1;
1180 
1181 #ifdef RFCOMM_USE_ERTM
1182         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1183             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1184             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1185             if (multiplexer) {
1186                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1187                 if (rfcomm_ertm_released_callback){
1188                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1189                 }
1190             }
1191             break;
1192 #endif
1193 
1194         default:
1195             break;
1196     }
1197     return 0;
1198 }
1199 
1200 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1201     // get or create a multiplexer for a certain device
1202     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1203     if (!multiplexer) return 0;
1204 
1205     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1206 
1207     if (size < 3) return 0;
1208 
1209 	// but only care for multiplexer control channel
1210     uint8_t frame_dlci = packet[0] >> 2;
1211     if (frame_dlci) return 0;
1212     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1213     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1214     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1215     switch (packet[1]){
1216 
1217         case BT_RFCOMM_SABM:
1218             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1219                 log_info("Received SABM #0");
1220                 multiplexer->outgoing = 0;
1221                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1222                 return 1;
1223             }
1224             break;
1225 
1226         case BT_RFCOMM_UA:
1227             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1228                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1229                 log_info("Received UA #0 ");
1230                 rfcomm_multiplexer_opened(multiplexer);
1231                 return 1;
1232             }
1233             break;
1234 
1235         case BT_RFCOMM_DISC:
1236             // DISC #0 -> send UA #0, close multiplexer
1237             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1238             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1239             return 1;
1240 
1241         case BT_RFCOMM_DM:
1242             // DM #0 - we shouldn't get this, just give up
1243             log_info("Received DM #0");
1244             log_info("-> Closing down multiplexer");
1245             rfcomm_multiplexer_finalize(multiplexer);
1246             l2cap_disconnect(l2cap_cid);
1247             return 1;
1248 
1249         case BT_RFCOMM_UIH:
1250             if (payload_offset >= size) return 0;
1251 
1252             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1253                 // Multiplexer close down (CLD) -> close mutliplexer
1254                 log_info("Received Multiplexer close down command");
1255                 log_info("-> Closing down multiplexer");
1256                 rfcomm_multiplexer_finalize(multiplexer);
1257                 l2cap_disconnect(l2cap_cid);
1258                 return 1;
1259             }
1260             switch (packet[payload_offset]){
1261                 case BT_RFCOMM_CLD_CMD:
1262                      // Multiplexer close down (CLD) -> close mutliplexer
1263                     log_info("Received Multiplexer close down command");
1264                     log_info("-> Closing down multiplexer");
1265                     rfcomm_multiplexer_finalize(multiplexer);
1266                     l2cap_disconnect(l2cap_cid);
1267                     return 1;
1268 
1269                 case BT_RFCOMM_FCON_CMD:
1270                     multiplexer->fcon = 0x81;
1271                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1272                     return 1;
1273 
1274                 case BT_RFCOMM_FCOFF_CMD:
1275                     multiplexer->fcon = 0x80;
1276                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1277                     return 1;
1278 
1279                 case BT_RFCOMM_TEST_CMD: {
1280                     if ((payload_offset + 1) >= size) return 0; // (1)
1281                     log_info("Received test command");
1282                     int len = packet[payload_offset+1] >> 1; // length < 125
1283                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1284                         len = RFCOMM_TEST_DATA_MAX_LEN;
1285                     }
1286                     // from (1) => (size - 1 - payload_offset) > 0
1287                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1288                     multiplexer->test_data_len = len;
1289                     (void)memcpy(multiplexer->test_data,
1290                                  &packet[payload_offset + 2], len);
1291                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1292                     return 1;
1293                 }
1294                 default:
1295                     break;
1296             }
1297             break;
1298 
1299         default:
1300             break;
1301 
1302     }
1303     return 0;
1304 }
1305 
1306 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1307     if (multiplexer->send_dm_for_dlci) return 1;
1308     if (multiplexer->nsc_command) return 1;
1309     if (multiplexer->fcon & 0x80) return 1;
1310     switch (multiplexer->state){
1311         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1312         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1313         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1314             return 1;
1315         case RFCOMM_MULTIPLEXER_OPEN:
1316             if (multiplexer->test_data_len) {
1317                 return 1;
1318             }
1319             break;
1320         default:
1321             break;
1322     }
1323     return 0;
1324 }
1325 
1326 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1327 
1328     if (event != MULT_EV_READY_TO_SEND) return;
1329 
1330     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1331 
1332     // process stored DM responses
1333     if (multiplexer->send_dm_for_dlci){
1334         uint8_t dlci = multiplexer->send_dm_for_dlci;
1335         multiplexer->send_dm_for_dlci = 0;
1336         rfcomm_send_dm_pf(multiplexer, dlci);
1337         return;
1338     }
1339 
1340     if (multiplexer->nsc_command){
1341         uint8_t command = multiplexer->nsc_command;
1342         multiplexer->nsc_command = 0;
1343         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1344         return;
1345     }
1346 
1347     if (multiplexer->fcon & 0x80){
1348         multiplexer->fcon &= 0x01;
1349         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1350 
1351         if (multiplexer->fcon == 0) return;
1352         // trigger client to send again after sending FCon Response
1353         rfcomm_notify_channel_can_send();
1354         return;
1355     }
1356 
1357     switch (multiplexer->state) {
1358         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1359             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1360             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1361             rfcomm_send_sabm(multiplexer, 0);
1362             break;
1363         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1364             log_info("Sending UA #0");
1365             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1366             rfcomm_send_ua(multiplexer, 0);
1367 
1368             rfcomm_multiplexer_opened(multiplexer);
1369             break;
1370         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1371             log_info("Sending UA #0");
1372             log_info("Closing down multiplexer");
1373             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1374             rfcomm_send_ua(multiplexer, 0);
1375 
1376             rfcomm_multiplexer_finalize(multiplexer);
1377             l2cap_disconnect(l2cap_cid);
1378             break;
1379         case RFCOMM_MULTIPLEXER_OPEN:
1380             // respond to test command
1381             if (multiplexer->test_data_len){
1382                 int len = multiplexer->test_data_len;
1383                 log_info("Sending TEST Response with %u bytes", len);
1384                 multiplexer->test_data_len = 0;
1385                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1386                 return;
1387             }
1388             break;
1389         default:
1390             break;
1391     }
1392 }
1393 
1394 // MARK: RFCOMM CHANNEL
1395 
1396 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1397     channel->credits_incoming += credits;
1398     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1399 }
1400 
1401 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel){
1402     log_debug("cid 0x%04x, outgoing credits %u", channel->rfcomm_cid, channel->credits_outgoing);
1403     if (!channel->credits_outgoing) return false;
1404     if ((channel->multiplexer->fcon & 1) == 0) return false;
1405     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid) != 0;
1406 }
1407 
1408 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1409 
1410     log_info("opened");
1411 
1412     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1413     rfcomm_emit_channel_opened(rfChannel, 0);
1414     rfcomm_emit_port_configuration(rfChannel, false);
1415 
1416     // remove (potential) timer
1417     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1418     if (multiplexer->timer_active) {
1419         btstack_run_loop_remove_timer(&multiplexer->timer);
1420         multiplexer->timer_active = 0;
1421     }
1422     // hack for problem detecting authentication failure
1423     multiplexer->at_least_one_connection = 1;
1424 
1425     // request can send now if channel ready
1426     if (rfcomm_channel_ready_to_send(rfChannel)){
1427         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1428     }
1429 }
1430 
1431 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1432     const uint8_t frame_dlci = packet[0] >> 2;
1433     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1434     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1435     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1436     int request_can_send_now = 0;
1437 
1438     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1439     if (!channel) return;
1440 
1441     // handle new outgoing credits
1442     if (packet[1] == BT_RFCOMM_UIH_PF) {
1443 
1444         // add them
1445         uint16_t new_credits = packet[3+length_offset];
1446         channel->credits_outgoing += new_credits;
1447         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1448 
1449         // notify channel statemachine
1450         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1451         log_debug("state machine, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1452         int rfcomm_channel_valid = 1;
1453         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1454         if (rfcomm_channel_valid){
1455             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1456                 request_can_send_now = 1;
1457             }
1458         }
1459     }
1460 
1461     // contains payload?
1462     if ((size - 1) > payload_offset){
1463 
1464         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1465 
1466         // decrease incoming credit counter
1467         if (channel->credits_incoming > 0){
1468             channel->credits_incoming--;
1469         }
1470 
1471         // deliver payload
1472         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1473                               &packet[payload_offset], size-payload_offset-1);
1474     }
1475 
1476     // automatically provide new credits to remote device, if no incoming flow control
1477     if (!channel->incoming_flow_control && (channel->credits_incoming < 5)){
1478         channel->new_credits_incoming = RFCOMM_CREDITS;
1479         request_can_send_now = 1;
1480     }
1481 
1482     if (request_can_send_now){
1483         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1484     }
1485 }
1486 
1487 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1488     // priority of client request
1489     channel->pn_priority = event->priority;
1490 
1491     // new credits
1492     channel->credits_outgoing = event->credits_outgoing;
1493 
1494     // negotiate max frame size
1495     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1496         channel->max_frame_size = channel->multiplexer->max_frame_size;
1497     }
1498     if (channel->max_frame_size > event->max_frame_size) {
1499         channel->max_frame_size = event->max_frame_size;
1500     }
1501 
1502 }
1503 
1504 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1505 
1506     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1507 
1508     // remove from list
1509     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1510 
1511     // free channel
1512     btstack_memory_rfcomm_channel_free(channel);
1513 
1514     // update multiplexer timeout after channel was removed from list
1515     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1516 }
1517 
1518 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1519 
1520     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1521 
1522 
1523     // lookup existing channel
1524     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1525 
1526     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1527 
1528     if (channel) {
1529         int rfcomm_channel_valid = 1;
1530         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1531         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1532             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1533         }
1534         return;
1535     }
1536 
1537     // service registered?
1538     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1539     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1540     if (!service) {
1541         // discard request by sending disconnected mode
1542         multiplexer->send_dm_for_dlci = dlci;
1543         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1544         return;
1545     }
1546 
1547     // create channel for some events
1548     switch (event->type) {
1549         case CH_EVT_RCVD_SABM:
1550         case CH_EVT_RCVD_PN:
1551         case CH_EVT_RCVD_RPN_REQ:
1552         case CH_EVT_RCVD_RPN_CMD:
1553             // setup incoming channel
1554             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1555             if (!channel){
1556                 // discard request by sending disconnected mode
1557                 multiplexer->send_dm_for_dlci = dlci;
1558                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1559             }
1560             break;
1561         default:
1562             break;
1563     }
1564 
1565     if (!channel) {
1566         // discard request by sending disconnected mode
1567         multiplexer->send_dm_for_dlci = dlci;
1568         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1569         return;
1570     }
1571 
1572     int rfcomm_channel_valid = 1;
1573     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1574     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1575         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1576     }
1577 }
1578 
1579 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1580 
1581     UNUSED(size);   // ok: fixed format messages
1582 
1583     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1584     const uint8_t frame_dlci = packet[0] >> 2;
1585     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1586 	uint8_t message_len;  //   "
1587 
1588     // rfcomm: (1) command/control
1589     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1590     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1591     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1592     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1593     // rfcomm: (3+length_offset) credits if credits_offset == 1
1594     // rfcomm: (3+length_offest+credits_offset)
1595     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1596 
1597     rfcomm_channel_event_t event;
1598     rfcomm_channel_event_pn_t event_pn;
1599     rfcomm_channel_event_rpn_t event_rpn;
1600     rfcomm_channel_event_msc_t event_msc;
1601 
1602     // switch by rfcomm message type
1603     switch(packet[1]) {
1604 
1605         case BT_RFCOMM_SABM:
1606             event.type = CH_EVT_RCVD_SABM;
1607             log_info("Received SABM #%u", frame_dlci);
1608             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1609             break;
1610 
1611         case BT_RFCOMM_UA:
1612             event.type = CH_EVT_RCVD_UA;
1613             log_info("Received UA #%u",frame_dlci);
1614             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1615             break;
1616 
1617         case BT_RFCOMM_DISC:
1618             event.type = CH_EVT_RCVD_DISC;
1619             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1620             break;
1621 
1622         case BT_RFCOMM_DM:
1623         case BT_RFCOMM_DM_PF:
1624             event.type = CH_EVT_RCVD_DM;
1625             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1626             break;
1627 
1628         case BT_RFCOMM_UIH_PF:
1629         case BT_RFCOMM_UIH:
1630 
1631             message_len  = packet[payload_offset+1] >> 1;
1632 
1633             switch (packet[payload_offset]) {
1634                 case BT_RFCOMM_PN_CMD:
1635                     message_dlci = packet[payload_offset+2];
1636                     event_pn.super.type = CH_EVT_RCVD_PN;
1637                     event_pn.priority = packet[payload_offset+4];
1638                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1639                     event_pn.credits_outgoing = packet[payload_offset+9];
1640                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1641                         message_dlci, event_pn.credits_outgoing);
1642                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1643                     break;
1644 
1645                 case BT_RFCOMM_PN_RSP:
1646                     message_dlci = packet[payload_offset+2];
1647                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1648                     event_pn.priority = packet[payload_offset+4];
1649                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1650                     event_pn.credits_outgoing = packet[payload_offset+9];
1651                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1652                             event_pn.max_frame_size, event_pn.credits_outgoing);
1653                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1654                     break;
1655 
1656                 case BT_RFCOMM_MSC_CMD:
1657                     message_dlci = packet[payload_offset+2] >> 2;
1658                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1659                     event_msc.modem_status = packet[payload_offset+3];
1660                     log_info("Received MSC CMD for #%u, ", message_dlci);
1661                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1662                     break;
1663 
1664                 case BT_RFCOMM_MSC_RSP:
1665                     message_dlci = packet[payload_offset+2] >> 2;
1666                     event.type = CH_EVT_RCVD_MSC_RSP;
1667                     log_info("Received MSC RSP for #%u", message_dlci);
1668                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1669                     break;
1670 
1671                 case BT_RFCOMM_RPN_CMD:
1672                     message_dlci = packet[payload_offset+2] >> 2;
1673                     switch (message_len){
1674                         case 1:
1675                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1676                             event.type = CH_EVT_RCVD_RPN_REQ;
1677                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1678                             break;
1679                         case 8:
1680                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1681                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1682                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1683                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1684                             break;
1685                         default:
1686                             break;
1687                     }
1688                     break;
1689 
1690                 case BT_RFCOMM_RPN_RSP:
1691                     message_dlci = packet[payload_offset+2] >> 2;
1692                     if (message_len != 8) break;
1693                     event_rpn.super.type = CH_EVT_RCVD_RPN_RSP;
1694                     event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1695                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1696                     break;
1697 
1698                 case BT_RFCOMM_RLS_CMD: {
1699                     log_info("Received RLS command");
1700                     message_dlci = packet[payload_offset+2] >> 2;
1701                     rfcomm_channel_event_rls_t event_rls;
1702                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1703                     event_rls.line_status = packet[payload_offset+3];
1704                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1705                     break;
1706                 }
1707 
1708                 case BT_RFCOMM_RLS_RSP:
1709                     log_info("Received RLS response");
1710                     break;
1711 
1712                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1713                 // case BT_RFCOMM_TEST_CMD:
1714                 // case BT_RFCOMM_FCOFF_CMD:
1715                 // case BT_RFCOMM_FCON_CMD:
1716                 // everything else is an not supported command
1717                 default: {
1718                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1719                     multiplexer->nsc_command = packet[payload_offset];
1720                     break;
1721                 }
1722             }
1723             break;
1724 
1725         default:
1726             log_error("Received unknown RFCOMM message type %x", packet[1]);
1727             break;
1728     }
1729 
1730     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1731     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1732         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1733     }
1734 }
1735 
1736 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1737 
1738     if (packet_type == HCI_EVENT_PACKET){
1739         rfcomm_hci_event_handler(packet, size);
1740         return;
1741     }
1742 
1743     // we only handle l2cap packets for:
1744     if (packet_type != L2CAP_DATA_PACKET) return;
1745 
1746     //  - multiplexer itself
1747     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1748 
1749     if (handled) return;
1750 
1751     // - channel over open multiplexer
1752     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1753     if ( (multiplexer == NULL) || (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN)) return;
1754 
1755     // channel data ?
1756     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1757     const uint8_t frame_dlci = packet[0] >> 2;
1758 
1759     if (frame_dlci && ((packet[1] == BT_RFCOMM_UIH) || (packet[1] == BT_RFCOMM_UIH_PF))) {
1760         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1761         return;
1762     }
1763 
1764     rfcomm_channel_packet_handler(multiplexer, packet, size);
1765 }
1766 
1767 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1768     // note: exchanging MSC isn't neccessary to consider channel open
1769     // note: having outgoing credits is also not necessary to consider channel open
1770     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1771     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1772     // if (channel->credits_outgoing == 0) return 0;
1773     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %08" PRIx32 ", rf credits %u",
1774          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1775     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1776     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1777 
1778     return 1;
1779 }
1780 
1781 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1782     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %08" PRIx32, channel->state_var);
1783     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1784     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1785     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1786     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1787     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1788     return 1;
1789 }
1790 
1791 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, uint32_t flag){
1792     channel->state_var |= flag;
1793 }
1794 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, uint32_t flag){
1795     channel->state_var &= ~flag;
1796 }
1797 
1798 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1799     switch (channel->state){
1800         case RFCOMM_CHANNEL_SEND_UIH_PN:
1801             log_debug("ch-ready: state %u", channel->state);
1802             return 1;
1803         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1804             log_debug("ch-ready: state %u", channel->state);
1805             return 1;
1806         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1807             log_debug("ch-ready: state %u", channel->state);
1808             return 1;
1809         case RFCOMM_CHANNEL_SEND_DISC:
1810             log_debug("ch-ready: state %u", channel->state);
1811             return 1;
1812         case RFCOMM_CHANNEL_SEND_DM:
1813             log_debug("ch-ready: state %u", channel->state);
1814             return 1;
1815         case RFCOMM_CHANNEL_OPEN:
1816             if (channel->new_credits_incoming) {
1817                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1818                 return 1;
1819             }
1820             break;
1821         case RFCOMM_CHANNEL_DLC_SETUP:
1822             if (channel->state_var & (
1823                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1824                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1825              )) {
1826                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1827                 return 1;
1828             }
1829             break;
1830 
1831         default:
1832             break;
1833     }
1834 
1835     if (channel->state_var & (
1836         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP       |
1837         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY    |
1838         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG   |
1839         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE |
1840         RFCOMM_CHANNEL_STATE_VAR_SEND_UA           |
1841         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD      |
1842         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1843                              )){
1844         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1845         return 1;
1846     }
1847 
1848     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) {
1849         log_debug("ch-ready: rls_line_status");
1850         return 1;
1851     }
1852 
1853     if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID) {
1854         log_debug("ch-ready: rls_line_status");
1855         return 1;
1856     }
1857 
1858     return 0;
1859 }
1860 
1861 
1862 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1863 
1864     // channel != NULL -> channel valid
1865     *out_channel_valid = 1;
1866 
1867     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1868 
1869     // TODO: integrate in common switch
1870     if (event->type == CH_EVT_RCVD_DISC){
1871         rfcomm_emit_channel_closed(channel);
1872         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1873         return;
1874     }
1875 
1876     // TODO: integrate in common switch
1877     if (event->type == CH_EVT_RCVD_DM){
1878         log_info("Received DM message for #%u", channel->dlci);
1879         log_info("-> Closing channel locally for #%u", channel->dlci);
1880         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1881         rfcomm_channel_finalize(channel);
1882         *out_channel_valid = 0;
1883         return;
1884     }
1885 
1886     // remote port negotiation command - just accept everything for now
1887     //
1888     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1889     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1890     //   (Although the handling of individual settings are implementation-dependent.)"
1891     //
1892 
1893     // TODO: integrate in common switch
1894     if (event->type == CH_EVT_RCVD_RPN_CMD){
1895         // control port parameters
1896         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1897         rfcomm_rpn_data_update(&channel->local_rpn_data, &event_rpn->data);
1898         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1899         // notify client about new settings
1900         rfcomm_emit_port_configuration(channel, false);
1901         return;
1902     }
1903 
1904     // TODO: integrate in common switch
1905     if (event->type == CH_EVT_RCVD_RPN_REQ){
1906         // no values got accepted (no values have beens sent)
1907         channel->local_rpn_data.parameter_mask_0 = 0x00;
1908         channel->local_rpn_data.parameter_mask_1 = 0x00;
1909         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1910         return;
1911     }
1912 
1913     if (event->type == CH_EVT_RCVD_RLS_CMD){
1914         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1915         channel->remote_line_status = event_rls->line_status & 0x0f;
1916         log_info("CH_EVT_RCVD_RLS_CMD remote line status 0x%0x", channel->remote_line_status);
1917         rfcomm_emit_remote_line_status(channel, channel->remote_line_status);
1918         return;
1919     }
1920 
1921     // TODO: integrate in common switch
1922     if (event->type == CH_EVT_READY_TO_SEND){
1923         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY){
1924             log_info("Sending Remote Port Configuration Query for #%u", channel->dlci);
1925             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY);
1926             rfcomm_send_uih_rpn_query(channel->multiplexer, channel->dlci);
1927             return;
1928         }
1929         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG){
1930             log_info("Sending Remote Port Configuration for #%u", channel->dlci);
1931             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
1932             rfcomm_send_uih_rpn_config(channel->multiplexer, channel->dlci, &channel->remote_rpn_data);
1933             return;
1934         }
1935         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE){
1936             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1937             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1938             rfcomm_send_uih_rpn_response(multiplexer, channel->dlci, &channel->local_rpn_data);
1939             return;
1940         }
1941         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
1942             log_info("Sending MSC CMD for #%u", channel->dlci);
1943             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1944             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
1945             rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , channel->local_modem_status);
1946             return;
1947         }
1948         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1949             log_info("Sending MSC RSP for #%u", channel->dlci);
1950             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1951             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1952             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, channel->remote_modem_status);
1953             return;
1954         }
1955         if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID){
1956             log_info("Sending RLS CMD 0x%0x", channel->local_line_status);
1957             uint8_t line_status = channel->local_line_status;
1958             channel->local_line_status = RFCOMM_RLS_STATUS_INVALID;
1959             rfcomm_send_uih_rls_cmd(multiplexer, channel->dlci, line_status);
1960             return;
1961         }
1962         if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID){
1963             log_info("Sending RLS RSP 0x%0x", channel->remote_line_status);
1964             uint8_t line_status = channel->remote_line_status;
1965             channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
1966             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1967             return;
1968         }
1969     }
1970 
1971     // emit MSC status to app
1972     if (event->type == CH_EVT_RCVD_MSC_CMD){
1973         // notify client about new settings
1974         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1975         uint8_t modem_status_event[5];
1976         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1977         modem_status_event[1] = sizeof(event) - 2;
1978         little_endian_store_16(modem_status_event, 2, channel->rfcomm_cid);
1979         modem_status_event[4] = event_msc->modem_status;
1980         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1981         // no return, MSC_CMD will be handled by state machine below
1982     }
1983 
1984     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1985 
1986     switch (channel->state) {
1987         case RFCOMM_CHANNEL_CLOSED:
1988             switch (event->type){
1989                 case CH_EVT_RCVD_SABM:
1990                     log_info("-> Inform app");
1991                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1992                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1993                     rfcomm_emit_connection_request(channel);
1994                     break;
1995                 case CH_EVT_RCVD_PN:
1996                     rfcomm_channel_accept_pn(channel, event_pn);
1997                     log_info("-> Inform app");
1998                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1999                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
2000                     rfcomm_emit_connection_request(channel);
2001                     break;
2002                 default:
2003                     break;
2004             }
2005             break;
2006 
2007         case RFCOMM_CHANNEL_INCOMING_SETUP:
2008             switch (event->type){
2009                 case CH_EVT_RCVD_SABM:
2010                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
2011                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
2012                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2013                     }
2014                     break;
2015                 case CH_EVT_RCVD_PN:
2016                     rfcomm_channel_accept_pn(channel, event_pn);
2017                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
2018                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
2019                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2020                     }
2021                     break;
2022                 case CH_EVT_READY_TO_SEND:
2023                     // if / else if is used to check for state transition after sending
2024                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
2025                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
2026                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2027                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
2028                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
2029                         log_info("Sending UA #%u", channel->dlci);
2030                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2031                         rfcomm_send_ua(multiplexer, channel->dlci);
2032                     }
2033                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
2034                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
2035                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2036                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2037                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2038                      }
2039                     break;
2040                 default:
2041                     break;
2042             }
2043             break;
2044 
2045         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
2046             switch (event->type) {
2047                 case CH_EVT_MULTIPLEXER_READY:
2048                     log_info("Muliplexer opened, sending UIH PN next");
2049                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2050                     break;
2051                 default:
2052                     break;
2053             }
2054             break;
2055 
2056         case RFCOMM_CHANNEL_SEND_UIH_PN:
2057             switch (event->type) {
2058                 case CH_EVT_READY_TO_SEND:
2059                     // update mtu
2060                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
2061                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
2062                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
2063                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
2064                     break;
2065                 default:
2066                     break;
2067             }
2068             break;
2069 
2070         case RFCOMM_CHANNEL_W4_PN_RSP:
2071             switch (event->type){
2072                 case CH_EVT_RCVD_PN_RSP:
2073                     // update max frame size
2074                     if (channel->max_frame_size > event_pn->max_frame_size) {
2075                         channel->max_frame_size = event_pn->max_frame_size;
2076                     }
2077                     // new credits
2078                     channel->credits_outgoing = event_pn->credits_outgoing;
2079                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
2080                     break;
2081                 default:
2082                     break;
2083             }
2084             break;
2085 
2086         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
2087             switch (event->type) {
2088                 case CH_EVT_READY_TO_SEND:
2089                     log_info("Sending SABM #%u", channel->dlci);
2090                     channel->state = RFCOMM_CHANNEL_W4_UA;
2091                     rfcomm_send_sabm(multiplexer, channel->dlci);
2092                     break;
2093                 default:
2094                     break;
2095             }
2096             break;
2097 
2098         case RFCOMM_CHANNEL_W4_UA:
2099             switch (event->type){
2100                 case CH_EVT_RCVD_UA:
2101                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2102                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2103                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2104                     break;
2105                 default:
2106                     break;
2107             }
2108             break;
2109 
2110         case RFCOMM_CHANNEL_DLC_SETUP:
2111             switch (event->type){
2112                 case CH_EVT_RCVD_MSC_CMD:
2113                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2114                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2115                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2116                     break;
2117                 case CH_EVT_RCVD_MSC_RSP:
2118                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2119                     break;
2120 
2121                 case CH_EVT_READY_TO_SEND:
2122                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2123                         log_info("Providing credits for #%u", channel->dlci);
2124                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2125                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2126                         if (channel->new_credits_incoming) {
2127                             uint8_t new_credits = channel->new_credits_incoming;
2128                             channel->new_credits_incoming = 0;
2129                             rfcomm_channel_send_credits(channel, new_credits);
2130                         }
2131                         break;
2132                     }
2133                     break;
2134                 default:
2135                     break;
2136             }
2137             // finally done?
2138             if (rfcomm_channel_ready_for_open(channel)){
2139                 channel->state = RFCOMM_CHANNEL_OPEN;
2140                 rfcomm_channel_opened(channel);
2141             }
2142             break;
2143 
2144         case RFCOMM_CHANNEL_OPEN:
2145             switch (event->type){
2146                 case CH_EVT_RCVD_MSC_CMD:
2147                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2148                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2149                     break;
2150                 case CH_EVT_RCVD_RPN_RSP:
2151                     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE) == 0) break;
2152                     rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2153                     memcpy(&channel->remote_rpn_data, &((rfcomm_channel_event_rpn_t*) event)->data, sizeof(rfcomm_rpn_data_t));
2154                     rfcomm_emit_port_configuration(channel, true);
2155                     break;
2156                 case CH_EVT_READY_TO_SEND:
2157                     if (channel->new_credits_incoming) {
2158                         uint8_t new_credits = channel->new_credits_incoming;
2159                         channel->new_credits_incoming = 0;
2160                         rfcomm_channel_send_credits(channel, new_credits);
2161                         break;
2162                     }
2163                     break;
2164                 case CH_EVT_RCVD_CREDITS:
2165                     rfcomm_notify_channel_can_send();
2166                     break;
2167                 default:
2168                     break;
2169             }
2170             break;
2171 
2172         case RFCOMM_CHANNEL_SEND_DM:
2173             switch (event->type) {
2174                 case CH_EVT_READY_TO_SEND:
2175                     log_info("Sending DM_PF for #%u", channel->dlci);
2176                     // don't emit channel closed - channel was never open
2177                     channel->state = RFCOMM_CHANNEL_CLOSED;
2178                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2179                     rfcomm_channel_finalize(channel);
2180                     *out_channel_valid = 0;
2181                     break;
2182                 default:
2183                     break;
2184             }
2185             break;
2186 
2187         case RFCOMM_CHANNEL_SEND_DISC:
2188             switch (event->type) {
2189                 case CH_EVT_READY_TO_SEND:
2190                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2191                     rfcomm_send_disc(multiplexer, channel->dlci);
2192                     break;
2193                 default:
2194                     break;
2195             }
2196             break;
2197 
2198         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2199             switch (event->type){
2200                 case CH_EVT_RCVD_UA:
2201                     channel->state = RFCOMM_CHANNEL_CLOSED;
2202                     rfcomm_emit_channel_closed(channel);
2203                     rfcomm_channel_finalize(channel);
2204                     *out_channel_valid = 0;
2205                     break;
2206                 default:
2207                     break;
2208             }
2209             break;
2210 
2211         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2212             switch (event->type) {
2213                 case CH_EVT_READY_TO_SEND:
2214                     log_info("Sending UA after DISC for #%u", channel->dlci);
2215                     channel->state = RFCOMM_CHANNEL_CLOSED;
2216                     rfcomm_send_ua(multiplexer, channel->dlci);
2217                     rfcomm_channel_finalize(channel);
2218                     *out_channel_valid = 0;
2219                     break;
2220                 default:
2221                     break;
2222             }
2223             break;
2224 
2225         default:
2226             break;
2227     }
2228 }
2229 
2230 // MARK: RFCOMM BTstack API
2231 
2232 void rfcomm_init(void){
2233     rfcomm_security_level = gap_get_security_level();
2234 #ifdef RFCOMM_USE_ERTM
2235     rfcomm_ertm_id = 0;
2236 #endif
2237 }
2238 
2239 void rfcomm_deinit(void){
2240     rfcomm_client_cid_generator = 0;
2241     rfcomm_multiplexers = NULL;
2242     rfcomm_services     = NULL;
2243     rfcomm_channels     = NULL;
2244 #ifdef RFCOMM_USE_ERTM
2245     rfcomm_ertm_request_callback  = NULL;
2246     rfcomm_ertm_released_callback = NULL;
2247 #endif
2248 }
2249 
2250 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2251     rfcomm_security_level = security_level;
2252 }
2253 
2254 bool rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2255     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2256     if (!channel){
2257         log_error("send cid 0x%02x doesn't exist!", rfcomm_cid);
2258         return false;
2259     }
2260     return rfcomm_channel_can_send(channel);
2261 }
2262 
2263 uint8_t rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2264     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2265     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2266     channel->waiting_for_can_send_now = 1;
2267     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2268     return ERROR_CODE_SUCCESS;
2269 }
2270 
2271 static uint8_t rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2272     if (len > channel->max_frame_size){
2273         log_error("send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2274         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2275     }
2276 
2277 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2278     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2279         log_error("send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2280         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2281     }
2282 #endif
2283 
2284     if (!channel->credits_outgoing){
2285         log_info("send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2286         return RFCOMM_NO_OUTGOING_CREDITS;
2287     }
2288 
2289     if ((channel->multiplexer->fcon & 1) == 0){
2290         log_info("send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2291         return RFCOMM_AGGREGATE_FLOW_OFF;
2292     }
2293     return ERROR_CODE_SUCCESS;
2294 }
2295 
2296 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2297     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2298     if (!channel){
2299         return 0;
2300     }
2301     return channel->max_frame_size;
2302 }
2303 
2304 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2305 bool rfcomm_reserve_packet_buffer(void){
2306 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2307     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2308     return false;
2309 #else
2310     return l2cap_reserve_packet_buffer();
2311 #endif
2312 }
2313 
2314 void rfcomm_release_packet_buffer(void){
2315 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2316     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2317 #else
2318     l2cap_release_packet_buffer();
2319 #endif
2320 }
2321 
2322 uint8_t * rfcomm_get_outgoing_buffer(void){
2323 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2324     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2325 #else
2326     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2327 #endif
2328     // address + control + length (16) + no credit field
2329     return &rfcomm_out_buffer[4];
2330 }
2331 
2332 uint8_t rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2333     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2334     if (!channel){
2335         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2336         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2337     }
2338 
2339     uint8_t status = rfcomm_assert_send_valid(channel, len);
2340     if (status != ERROR_CODE_SUCCESS) return status;
2341 
2342 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2343     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2344         log_error("l2cap cannot send now");
2345         return BTSTACK_ACL_BUFFERS_FULL;
2346     }
2347 #else
2348     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2349         log_error("l2cap cannot send now");
2350         return BTSTACK_ACL_BUFFERS_FULL;
2351     }
2352 #endif
2353 
2354     // send might cause l2cap to emit new credits, update counters first
2355     if (len){
2356         channel->credits_outgoing--;
2357     } else {
2358         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2359     }
2360 
2361     status = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2362 
2363     if (status != 0) {
2364         log_error("error %d", status);
2365         if (len) {
2366             channel->credits_outgoing++;
2367         }
2368     }
2369 
2370     return status;
2371 }
2372 
2373 uint8_t rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2374     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2375     if (!channel){
2376         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2377         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2378     }
2379 
2380     uint8_t status = rfcomm_assert_send_valid(channel, len);
2381     if (status != ERROR_CODE_SUCCESS) return status;
2382     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2383         log_error("rfcomm_send_internal: l2cap cannot send now");
2384         return BTSTACK_ACL_BUFFERS_FULL;
2385     }
2386 
2387 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2388 #else
2389     rfcomm_reserve_packet_buffer();
2390 #endif
2391     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2392 
2393     (void)memcpy(rfcomm_payload, data, len);
2394     status = rfcomm_send_prepared(rfcomm_cid, len);
2395 
2396 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2397 #else
2398     if (status != ERROR_CODE_SUCCESS){
2399         rfcomm_release_packet_buffer();
2400     }
2401 #endif
2402 
2403     return ERROR_CODE_SUCCESS;
2404 }
2405 
2406 // Sends Local Line Status, see LINE_STATUS_..
2407 uint8_t rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2408     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2409     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2410     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) return ERROR_CODE_COMMAND_DISALLOWED;
2411     channel->local_line_status = line_status;
2412     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2413     return ERROR_CODE_SUCCESS;
2414 }
2415 
2416 // Sned local modem status. see MODEM_STAUS_..
2417 uint8_t rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2418     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2419     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2420     channel->local_modem_status = modem_status;
2421     // trigger send
2422     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2423     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2424     return ERROR_CODE_SUCCESS;
2425 }
2426 
2427 // Configure remote port
2428 uint8_t rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, uint8_t flow_control){
2429     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2430     if (!channel){
2431         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2432     }
2433 
2434     // store remote config
2435     channel->remote_rpn_data.baud_rate = baud_rate;
2436     channel->remote_rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2437     channel->remote_rpn_data.flow_control = flow_control;
2438     channel->remote_rpn_data.xon = 0;
2439     channel->remote_rpn_data.xoff = 0;
2440     channel->remote_rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2441     channel->remote_rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2442 
2443     // trigger send
2444     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
2445     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2446     return ERROR_CODE_SUCCESS;
2447 }
2448 
2449 // Query remote port
2450 uint8_t rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2451     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2452     if (!channel){
2453         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2454     }
2455     // trigger send
2456     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY | RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2457     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2458     return ERROR_CODE_SUCCESS;
2459 }
2460 
2461 
2462 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2463     log_info("create addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2464 
2465     // create new multiplexer if necessary
2466     uint8_t status = 0;
2467     uint8_t dlci = 0;
2468     int new_multiplexer = 0;
2469     rfcomm_channel_t * channel = NULL;
2470     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2471     if (!multiplexer) {
2472         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2473         if (!multiplexer) return BTSTACK_MEMORY_ALLOC_FAILED;
2474 
2475         multiplexer->outgoing = 1;
2476         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2477         new_multiplexer = 1;
2478     }
2479 
2480     // check if channel for this remote service already exists
2481     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2482     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2483     if (channel){
2484         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2485         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2486     }
2487 
2488     // prepare channel
2489     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2490     if (!channel){
2491         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2492         return BTSTACK_MEMORY_ALLOC_FAILED;
2493     }
2494 
2495     // rfcomm_cid is already assigned by rfcomm_channel_create
2496     channel->incoming_flow_control = incoming_flow_control;
2497     channel->new_credits_incoming  = initial_credits;
2498     channel->packet_handler = packet_handler;
2499 
2500     // return rfcomm_cid
2501     if (out_rfcomm_cid){
2502         *out_rfcomm_cid = channel->rfcomm_cid;
2503     }
2504 
2505     // start multiplexer setup
2506     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2507         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2508         uint16_t l2cap_cid = 0;
2509 #ifdef RFCOMM_USE_ERTM
2510         // request
2511         rfcomm_ertm_request_t request;
2512         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2513         (void)memcpy(request.addr, addr, 6);
2514         request.ertm_id = rfcomm_next_ertm_id();
2515         if (rfcomm_ertm_request_callback){
2516             (*rfcomm_ertm_request_callback)(&request);
2517         }
2518         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2519             multiplexer->ertm_id = request.ertm_id;
2520             status = l2cap_ertm_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2521                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2522         }
2523         else
2524 #endif
2525         {
2526             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2527         }
2528         if (status) {
2529             if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2530             btstack_memory_rfcomm_channel_free(channel);
2531             return status;
2532         }
2533         multiplexer->l2cap_cid = l2cap_cid;
2534         return ERROR_CODE_SUCCESS;
2535     }
2536 
2537     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2538 
2539     // start connecting, if multiplexer is already up and running
2540     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2541     return ERROR_CODE_SUCCESS;
2542 }
2543 
2544 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2545     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2546 }
2547 
2548 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2549     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2550 }
2551 
2552 uint8_t rfcomm_disconnect(uint16_t rfcomm_cid){
2553     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2554     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2555 
2556     if (channel->state != RFCOMM_CHANNEL_OPEN) return ERROR_CODE_COMMAND_DISALLOWED;
2557 
2558     log_info("disconnect cid 0x%02x", rfcomm_cid);
2559     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2560     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2561     return ERROR_CODE_SUCCESS;
2562 }
2563 
2564 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2565     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2566 
2567     log_info("register channel #%u mtu %u flow_control %u credits %u",
2568              channel, max_frame_size, incoming_flow_control, initial_credits);
2569 
2570     // check if already registered
2571     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2572     if (service){
2573         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2574     }
2575 
2576     // alloc structure
2577     service = btstack_memory_rfcomm_service_get();
2578     if (!service) {
2579         return BTSTACK_MEMORY_ALLOC_FAILED;
2580     }
2581 
2582     // register with l2cap if not registered before, max MTU
2583     if (btstack_linked_list_empty(&rfcomm_services)){
2584         uint8_t status = l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2585         if (status != ERROR_CODE_SUCCESS){
2586             btstack_memory_rfcomm_service_free(service);
2587             return status;
2588         }
2589     }
2590 
2591     // fill in
2592     service->packet_handler = packet_handler;
2593     service->server_channel = channel;
2594     service->max_frame_size = max_frame_size;
2595     service->incoming_flow_control = incoming_flow_control;
2596     service->incoming_initial_credits = initial_credits;
2597 
2598     // add to services list
2599     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2600 
2601     return ERROR_CODE_SUCCESS;
2602 }
2603 
2604 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2605     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2606 
2607     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2608 }
2609 
2610 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2611     uint16_t max_frame_size){
2612 
2613     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2614 }
2615 
2616 void rfcomm_unregister_service(uint8_t service_channel){
2617     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2618     if (!service) return;
2619     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2620     btstack_memory_rfcomm_service_free(service);
2621 
2622     // unregister if no services active
2623     if (btstack_linked_list_empty(&rfcomm_services)){
2624         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2625         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2626     }
2627 }
2628 
2629 uint8_t rfcomm_accept_connection(uint16_t rfcomm_cid){
2630     log_info("accept cid 0x%02x", rfcomm_cid);
2631     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2632     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2633 
2634     switch (channel->state) {
2635         case RFCOMM_CHANNEL_INCOMING_SETUP:
2636             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2637             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2638                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2639                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2640             }
2641             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2642                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2643                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2644             }
2645             // at least one of { PN RSP, UA } needs to be sent
2646             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2647             return ERROR_CODE_SUCCESS;
2648         default:
2649            return ERROR_CODE_COMMAND_DISALLOWED;
2650     }
2651 }
2652 
2653 uint8_t rfcomm_decline_connection(uint16_t rfcomm_cid){
2654     log_info("decline cid 0x%02x", rfcomm_cid);
2655     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2656     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2657 
2658     switch (channel->state) {
2659         case RFCOMM_CHANNEL_INCOMING_SETUP:
2660             channel->state = RFCOMM_CHANNEL_SEND_DM;
2661             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2662             return ERROR_CODE_SUCCESS;
2663         default:
2664             return ERROR_CODE_COMMAND_DISALLOWED;
2665     }
2666 }
2667 
2668 uint8_t rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2669     log_info("grant cid 0x%02x credits %u", rfcomm_cid, credits);
2670     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2671     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2672     if (!channel->incoming_flow_control) return ERROR_CODE_COMMAND_DISALLOWED;
2673     channel->new_credits_incoming += credits;
2674 
2675     // process
2676     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2677     return ERROR_CODE_SUCCESS;
2678 }
2679 
2680 #ifdef RFCOMM_USE_ERTM
2681 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2682     rfcomm_ertm_request_callback  = request_callback;
2683     rfcomm_ertm_released_callback = released_callback;
2684 }
2685 #endif
2686