xref: /btstack/src/classic/rfcomm.c (revision 5bf1bddfcfe518534d4f7b85c47f7626eff7906d)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <string.h> // memcpy
45 #include <stdint.h>
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_memory.h"
51 #include "btstack_util.h"
52 #include "classic/core.h"
53 #include "classic/rfcomm.h"
54 #include "hci.h"
55 #include "hci_cmd.h"
56 #include "hci_dump.h"
57 #include "l2cap.h"
58 
59 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
60 #ifndef PRIxPTR
61 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
62 #define PRIxPTR "lx"
63 #else
64 #define PRIxPTR "x"
65 #endif
66 #endif
67 
68 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
69 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
70 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
71 #define RFCOMM_USE_OUTGOING_BUFFER
72 #define RFCOMM_USE_ERTM
73 #else
74 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
75 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
76 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
77 #endif
78 #endif
79 
80 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
81 
82 #define RFCOMM_CREDITS 10
83 
84 // FCS calc
85 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
86 #define BT_RFCOMM_CRC_CHECK_LEN     3
87 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
88 
89 // Control field values      bit no.       1 2 3 4 PF 6 7 8
90 #define BT_RFCOMM_SABM       0x3F       // 1 1 1 1  1 1 0 0
91 #define BT_RFCOMM_UA         0x73       // 1 1 0 0  1 1 1 0
92 #define BT_RFCOMM_DM         0x0F       // 1 1 1 1  0 0 0 0
93 #define BT_RFCOMM_DM_PF      0x1F       // 1 1 1 1  1 0 0 0
94 #define BT_RFCOMM_DISC       0x53       // 1 1 0 0  1 0 1 0
95 #define BT_RFCOMM_UIH        0xEF       // 1 1 1 1  0 1 1 1
96 #define BT_RFCOMM_UIH_PF     0xFF       // 1 1 1 1  0 1 1 1
97 
98 // Multiplexer message types
99 #define BT_RFCOMM_CLD_CMD    0xC3
100 #define BT_RFCOMM_FCON_CMD   0xA3
101 #define BT_RFCOMM_FCON_RSP   0xA1
102 #define BT_RFCOMM_FCOFF_CMD  0x63
103 #define BT_RFCOMM_FCOFF_RSP  0x61
104 #define BT_RFCOMM_MSC_CMD    0xE3
105 #define BT_RFCOMM_MSC_RSP    0xE1
106 #define BT_RFCOMM_NSC_RSP    0x11
107 #define BT_RFCOMM_PN_CMD     0x83
108 #define BT_RFCOMM_PN_RSP     0x81
109 #define BT_RFCOMM_RLS_CMD    0x53
110 #define BT_RFCOMM_RLS_RSP    0x51
111 #define BT_RFCOMM_RPN_CMD    0x93
112 #define BT_RFCOMM_RPN_RSP    0x91
113 #define BT_RFCOMM_TEST_CMD   0x23
114 #define BT_RFCOMM_TEST_RSP   0x21
115 
116 typedef enum {
117     CH_EVT_RCVD_SABM = 1,
118     CH_EVT_RCVD_UA,
119     CH_EVT_RCVD_PN,
120     CH_EVT_RCVD_PN_RSP,
121     CH_EVT_RCVD_DISC,
122     CH_EVT_RCVD_DM,
123     CH_EVT_RCVD_MSC_CMD,
124     CH_EVT_RCVD_MSC_RSP,
125     CH_EVT_RCVD_NSC_RSP,
126     CH_EVT_RCVD_RLS_CMD,
127     CH_EVT_RCVD_RLS_RSP,
128     CH_EVT_RCVD_RPN_CMD,
129     CH_EVT_RCVD_RPN_REQ,
130     CH_EVT_RCVD_CREDITS,
131     CH_EVT_MULTIPLEXER_READY,
132     CH_EVT_READY_TO_SEND,
133 } RFCOMM_CHANNEL_EVENT;
134 
135 typedef struct rfcomm_channel_event {
136     RFCOMM_CHANNEL_EVENT type;
137     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
138 } rfcomm_channel_event_t;
139 
140 typedef struct rfcomm_channel_event_pn {
141     rfcomm_channel_event_t super;
142     uint16_t max_frame_size;
143     uint8_t  priority;
144     uint8_t  credits_outgoing;
145 } rfcomm_channel_event_pn_t;
146 
147 typedef struct rfcomm_channel_event_rpn {
148     rfcomm_channel_event_t super;
149     rfcomm_rpn_data_t data;
150 } rfcomm_channel_event_rpn_t;
151 
152 typedef struct rfcomm_channel_event_rls {
153     rfcomm_channel_event_t super;
154     uint8_t line_status;
155 } rfcomm_channel_event_rls_t;
156 
157 typedef struct rfcomm_channel_event_msc {
158     rfcomm_channel_event_t super;
159     uint8_t modem_status;
160 } rfcomm_channel_event_msc_t;
161 
162 
163 // global rfcomm data
164 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
165 
166 // linked lists for all
167 static btstack_linked_list_t rfcomm_multiplexers;
168 static btstack_linked_list_t rfcomm_channels;
169 static btstack_linked_list_t rfcomm_services;
170 
171 static gap_security_level_t rfcomm_security_level;
172 
173 #ifdef RFCOMM_USE_ERTM
174 static uint16_t rfcomm_ertm_id;
175 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
176 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
177 #endif
178 
179 #ifdef RFCOMM_USE_OUTGOING_BUFFER
180 static uint8_t outgoing_buffer[1030];
181 #endif
182 
183 static int  rfcomm_channel_can_send(rfcomm_channel_t * channel);
184 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
185 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
186 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
187 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
188 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
189 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
190 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
191 
192 // MARK: RFCOMM CLIENT EVENTS
193 
194 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
195     btstack_linked_item_t *it;
196     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
197         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
198         if (channel->rfcomm_cid == rfcomm_cid) {
199             return channel;
200         };
201     }
202     return NULL;
203 }
204 
205 static uint16_t rfcomm_next_client_cid(void){
206     do {
207         if (rfcomm_client_cid_generator == 0xffff) {
208             // don't use 0 as channel id
209             rfcomm_client_cid_generator = 1;
210         } else {
211             rfcomm_client_cid_generator++;
212         }
213     } while (rfcomm_channel_for_rfcomm_cid(rfcomm_client_cid_generator) != NULL);
214     return rfcomm_client_cid_generator;
215 }
216 
217 #ifdef RFCOMM_USE_ERTM
218 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_ertm_id(uint16_t ertm_id) {
219     btstack_linked_item_t *it;
220     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
221         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
222         if (multiplexer->ertm_id == ertm_id) {
223             return multiplexer;
224         };
225     }
226     return NULL;
227 }
228 
229 static uint16_t rfcomm_next_ertm_id(void){
230     do {
231         if (rfcomm_ertm_id == 0xffff) {
232             // don't use 0 as channel id
233             rfcomm_ertm_id = 1;
234         } else {
235             rfcomm_ertm_id++;
236         }
237     } while (rfcomm_multiplexer_for_ertm_id(rfcomm_ertm_id) != NULL);
238     return rfcomm_ertm_id;
239 }
240 
241 #endif
242 
243 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
244 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
245     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
246              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
247     uint8_t event[13];
248     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
249     event[1] = sizeof(event) - 2;
250     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
251     event[8] = channel->dlci >> 1;
252     little_endian_store_16(event, 9, channel->rfcomm_cid);
253     little_endian_store_16(event, 11, channel->multiplexer->con_handle);
254     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
255 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
256 }
257 
258 // API Change: BTstack-0.3.50x uses
259 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
260 // next Cydia release will use SVN version of this
261 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
262 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
263     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
264              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
265              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
266     uint8_t event[18];
267     uint8_t pos = 0;
268     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
269     event[pos++] = sizeof(event) - 2;                   // 1
270     event[pos++] = status;                              // 2
271     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
272     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
273 	event[pos++] = channel->dlci >> 1;                                      // 11
274 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
275 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
276     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
277     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
278 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
279 
280     // if channel opened successfully, also send can send now if possible
281     if (status) return;
282     if (rfcomm_channel_can_send(channel)){
283         rfcomm_emit_can_send_now(channel);
284     }
285 }
286 
287 // data: event(8), len(8), rfcomm_cid(16)
288 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
289     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
290     uint8_t event[4];
291     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
292     event[1] = sizeof(event) - 2;
293     little_endian_store_16(event, 2, channel->rfcomm_cid);
294     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
295 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
296 }
297 
298 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
299     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
300     uint8_t event[5];
301     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
302     event[1] = sizeof(event) - 2;
303     little_endian_store_16(event, 2, channel->rfcomm_cid);
304     event[4] = line_status;
305     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
306     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
307 }
308 
309 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel){
310     // notify client about new settings
311     uint8_t event[2+sizeof(rfcomm_rpn_data_t)];
312     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
313     event[1] = sizeof(rfcomm_rpn_data_t);
314     (void)memcpy(&event[2], (uint8_t *)&channel->rpn_data,
315                  sizeof(rfcomm_rpn_data_t));
316     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
317     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
318 }
319 
320 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
321     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
322     uint8_t event[4];
323     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
324     event[1] = sizeof(event) - 2;
325     little_endian_store_16(event, 2, channel->rfcomm_cid);
326     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
327     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
328 }
329 
330 // MARK RFCOMM RPN DATA HELPER
331 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
332         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
333         rpn_data->flags = 0x03;               /* 8-n-1 */
334         rpn_data->flow_control = 0;           /* no flow control */
335         rpn_data->xon  = 0xd1;                /* XON */
336         rpn_data->xoff = 0xd3;                /* XOFF */
337         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
338         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
339 }
340 
341 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
342     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
343         dest->baud_rate = src->baud_rate;
344     }
345     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
346         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
347     }
348     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
349         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
350     }
351     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
352         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
353     }
354     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
355         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x30);
356     }
357     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
358         dest->xon = src->xon;
359     }
360     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
361         dest->xoff = src->xoff;
362     }
363     int i;
364     for (i=0; i < 6 ; i++){
365         uint8_t mask = 1 << i;
366         if (src->parameter_mask_1 & mask){
367             dest->flags = (dest->flags & ~mask) | (src->flags & mask);
368         }
369     }
370     // always copy parameter mask, too. informative for client, needed for response
371     dest->parameter_mask_0 = src->parameter_mask_0;
372     dest->parameter_mask_1 = src->parameter_mask_1;
373 }
374 // MARK: RFCOMM MULTIPLEXER HELPER
375 
376 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
377     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
378     uint16_t max_frame_size = l2cap_mtu - 5;
379     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
380     return max_frame_size;
381 }
382 
383 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
384     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
385     multiplexer->fcon = 1;
386     multiplexer->send_dm_for_dlci = 0;
387     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
388     multiplexer->test_data_len = 0;
389     multiplexer->nsc_command = 0;
390 }
391 
392 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
393 
394     // alloc structure
395     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
396     if (!multiplexer) return NULL;
397 
398     // fill in
399     rfcomm_multiplexer_initialize(multiplexer);
400     bd_addr_copy(multiplexer->remote_addr, addr);
401 
402     // add to services list
403     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
404 
405     return multiplexer;
406 }
407 
408 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
409     btstack_linked_item_t *it;
410     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
411         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
412         // ignore multiplexer in shutdown
413         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
414         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
415             return multiplexer;
416         };
417     }
418     return NULL;
419 }
420 
421 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
422     btstack_linked_item_t *it;
423     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
424         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
425         if (multiplexer->l2cap_cid == l2cap_cid) {
426             return multiplexer;
427         };
428     }
429     return NULL;
430 }
431 
432 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
433     btstack_linked_item_t *it;
434     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
435         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
436         if (channel->multiplexer == multiplexer) {
437             return 1;
438         }
439     }
440     return 0;
441 }
442 
443 // MARK: RFCOMM CHANNEL HELPER
444 
445 static void rfcomm_dump_channels(void){
446 #ifdef ENABLE_LOG_INFO
447     btstack_linked_item_t * it;
448     int channels = 0;
449     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
450         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
451         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
452         channels++;
453     }
454 #endif
455 }
456 
457 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
458                                rfcomm_service_t *service, uint8_t server_channel){
459 
460     // set defaults for port configuration (even for services)
461     rfcomm_rpn_data_set_defaults(&channel->rpn_data);
462 
463     channel->state            = RFCOMM_CHANNEL_CLOSED;
464     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
465 
466     channel->multiplexer      = multiplexer;
467     channel->rfcomm_cid       = rfcomm_next_client_cid();
468     channel->max_frame_size   = multiplexer->max_frame_size;
469 
470     channel->credits_incoming = 0;
471     channel->credits_outgoing = 0;
472 
473     // incoming flow control not active
474     channel->new_credits_incoming  = RFCOMM_CREDITS;
475     channel->incoming_flow_control = 0;
476 
477     channel->rls_line_status       = RFCOMM_RLS_STATUS_INVALID;
478 
479     channel->service = service;
480 	if (service) {
481 		// incoming connection
482     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
483         if (channel->max_frame_size > service->max_frame_size) {
484             channel->max_frame_size = service->max_frame_size;
485         }
486         channel->incoming_flow_control = service->incoming_flow_control;
487         channel->new_credits_incoming  = service->incoming_initial_credits;
488         channel->packet_handler        = service->packet_handler;
489 	} else {
490 		// outgoing connection
491 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
492 	}
493 }
494 
495 // service == NULL -> outgoing channel
496 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
497                                                 rfcomm_service_t * service, uint8_t server_channel){
498 
499     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
500     rfcomm_dump_channels();
501 
502     // alloc structure
503     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
504     if (!channel) return NULL;
505 
506     // fill in
507     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
508 
509     // add to services list
510     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
511 
512     return channel;
513 }
514 
515 static void rfcomm_notify_channel_can_send(void){
516     btstack_linked_list_iterator_t it;
517     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
518     while (btstack_linked_list_iterator_has_next(&it)){
519         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
520         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
521         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
522 
523         channel->waiting_for_can_send_now = 0;
524         rfcomm_emit_can_send_now(channel);
525     }
526 }
527 
528 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
529     btstack_linked_item_t *it;
530     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
531         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
532         if ((channel->dlci == dlci) && (channel->multiplexer == multiplexer)) {
533             return channel;
534         };
535     }
536     return NULL;
537 }
538 
539 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
540     btstack_linked_item_t *it;
541     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
542         rfcomm_service_t * service = ((rfcomm_service_t *) it);
543         if ( service->server_channel == server_channel){
544             return service;
545         };
546     }
547     return NULL;
548 }
549 
550 // MARK: RFCOMM SEND
551 
552 /**
553  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
554  */
555 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
556 
557     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
558 
559 #ifdef RFCOMM_USE_OUTGOING_BUFFER
560     uint8_t * rfcomm_out_buffer = outgoing_buffer;
561 #else
562     l2cap_reserve_packet_buffer();
563     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
564 #endif
565 
566 	uint16_t pos = 0;
567 	uint8_t crc_fields = 3;
568 
569 	rfcomm_out_buffer[pos++] = address;
570 	rfcomm_out_buffer[pos++] = control;
571 
572 	// length field can be 1 or 2 octets
573 	if (len < 128){
574 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
575 	} else {
576 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
577 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
578 		crc_fields++;
579 	}
580 
581 	// add credits for UIH frames when PF bit is set
582 	if (control == BT_RFCOMM_UIH_PF){
583 		rfcomm_out_buffer[pos++] = credits;
584 	}
585 
586 	// copy actual data
587 	if (len) {
588 		(void)memcpy(&rfcomm_out_buffer[pos], data, len);
589 		pos += len;
590 	}
591 
592 	// UIH frames only calc FCS over address + control (5.1.1)
593 	if ((control & 0xef) == BT_RFCOMM_UIH){
594 		crc_fields = 2;
595 	}
596 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
597 
598 #ifdef RFCOMM_USE_OUTGOING_BUFFER
599     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
600 #else
601     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
602 #endif
603 
604     return err;
605 }
606 
607 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
608 static int rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
609 
610     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
611     uint8_t control = BT_RFCOMM_UIH;
612 
613 #ifdef RFCOMM_USE_OUTGOING_BUFFER
614     uint8_t * rfcomm_out_buffer = outgoing_buffer;
615 #else
616     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
617 #endif
618 
619     uint16_t pos = 0;
620     rfcomm_out_buffer[pos++] = address;
621     rfcomm_out_buffer[pos++] = control;
622     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
623     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
624 
625     // actual data is already in place
626     pos += len;
627 
628     // UIH frames only calc FCS over address + control (5.1.1)
629     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
630 
631 #ifdef RFCOMM_USE_OUTGOING_BUFFER
632     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
633 #else
634     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
635 #endif
636 
637     return err;
638 }
639 
640 // C/R Flag in Address
641 // - terms: initiator = station that creates multiplexer with SABM
642 // - terms: responder = station that responds to multiplexer setup with UA
643 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
644 //    - command initiator = 1 /response responder = 1
645 //    - command responder = 0 /response initiator = 0
646 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
647 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
648 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
649 
650 // C/R Flag in Message
651 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
652 //   - If the C/R bit is set to 1 the message is a command
653 //   - if it is set to 0 the message is a response.
654 
655 // temp/old messge construction
656 
657 // new object oriented version
658 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
659 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
660     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
661 }
662 
663 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
664 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
665     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
666 }
667 
668 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
669 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
670     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
671 }
672 
673 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
674 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
675     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
676 }
677 
678 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
679     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
680     uint8_t payload[2];
681     uint8_t pos = 0;
682     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
683     payload[pos++] = (0 << 1) | 1;  // len
684     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
685 }
686 
687 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
688 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
689 //     uint8_t payload[2+len];
690 //     uint8_t pos = 0;
691 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
692 //     payload[pos++] = (len + 1) << 1 | 1;  // len
693 //     memcpy(&payload[pos], data, len);
694 //     pos += len;
695 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
696 // }
697 
698 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
699     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
700     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
701     uint8_t pos = 0;
702     payload[pos++] = BT_RFCOMM_TEST_RSP;
703     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
704         len = RFCOMM_TEST_DATA_MAX_LEN;
705     }
706     payload[pos++] = (len << 1) | 1;  // len
707     (void)memcpy(&payload[pos], data, len);
708     pos += len;
709     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
710 }
711 
712 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
713 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
714 	uint8_t payload[4];
715 	uint8_t pos = 0;
716 	payload[pos++] = BT_RFCOMM_MSC_CMD;
717 	payload[pos++] = (2 << 1) | 1;  // len
718 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
719 	payload[pos++] = signals;
720 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
721 }
722 
723 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
724 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
725 	uint8_t payload[4];
726 	uint8_t pos = 0;
727 	payload[pos++] = BT_RFCOMM_MSC_RSP;
728 	payload[pos++] = (2 << 1) | 1;  // len
729 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
730 	payload[pos++] = signals;
731 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
732 }
733 
734 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
735     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
736     uint8_t payload[3];
737     uint8_t pos = 0;
738     payload[pos++] = BT_RFCOMM_NSC_RSP;
739     payload[pos++] = (1 << 1) | 1;  // len
740     payload[pos++] = command;
741     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
742 }
743 
744 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
745 	uint8_t payload[10];
746 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
747 	uint8_t pos = 0;
748 	payload[pos++] = BT_RFCOMM_PN_CMD;
749 	payload[pos++] = (8 << 1) | 1;  // len
750 	payload[pos++] = dlci;
751 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
752 	payload[pos++] = 0; // priority
753 	payload[pos++] = 0; // max 60 seconds ack
754 	payload[pos++] = max_frame_size & 0xff; // max framesize low
755 	payload[pos++] = max_frame_size >> 8;   // max framesize high
756 	payload[pos++] = 0x00; // number of retransmissions
757 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
758 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
759 }
760 
761 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
762 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
763                                        uint8_t priority, uint16_t max_frame_size){
764 	uint8_t payload[10];
765 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
766 	uint8_t pos = 0;
767 	payload[pos++] = BT_RFCOMM_PN_RSP;
768 	payload[pos++] = (8 << 1) | 1;  // len
769 	payload[pos++] = dlci;
770 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
771 	payload[pos++] = priority; // priority
772 	payload[pos++] = 0; // max 60 seconds ack
773 	payload[pos++] = max_frame_size & 0xff; // max framesize low
774 	payload[pos++] = max_frame_size >> 8;   // max framesize high
775 	payload[pos++] = 0x00; // number of retransmissions
776 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
777 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
778 }
779 
780 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
781     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
782     uint8_t payload[4];
783     uint8_t pos = 0;
784     payload[pos++] = BT_RFCOMM_RLS_CMD;
785     payload[pos++] = (2 << 1) | 1;  // len
786     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
787     payload[pos++] = line_status;
788     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
789 }
790 
791 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
792     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
793     uint8_t payload[4];
794     uint8_t pos = 0;
795     payload[pos++] = BT_RFCOMM_RLS_RSP;
796     payload[pos++] = (2 << 1) | 1;  // len
797     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
798     payload[pos++] = line_status;
799     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
800 }
801 
802 static int rfcomm_send_uih_rpn_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
803     uint8_t payload[10];
804     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
805     uint8_t pos = 0;
806     payload[pos++] = BT_RFCOMM_RPN_CMD;
807     payload[pos++] = (8 << 1) | 1;  // len
808     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
809     payload[pos++] = rpn_data->baud_rate;
810     payload[pos++] = rpn_data->flags;
811     payload[pos++] = rpn_data->flow_control;
812     payload[pos++] = rpn_data->xon;
813     payload[pos++] = rpn_data->xoff;
814     payload[pos++] = rpn_data->parameter_mask_0;
815     payload[pos++] = rpn_data->parameter_mask_1;
816     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
817 }
818 
819 static int rfcomm_send_uih_rpn_req(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
820     uint8_t payload[3];
821     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
822     uint8_t pos = 0;
823     payload[pos++] = BT_RFCOMM_RPN_CMD;
824     payload[pos++] = (1 << 1) | 1;  // len
825     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
826     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
827 }
828 
829 static int rfcomm_send_uih_rpn_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
830 	uint8_t payload[10];
831 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
832 	uint8_t pos = 0;
833 	payload[pos++] = BT_RFCOMM_RPN_RSP;
834 	payload[pos++] = (8 << 1) | 1;  // len
835 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
836 	payload[pos++] = rpn_data->baud_rate;
837 	payload[pos++] = rpn_data->flags;
838 	payload[pos++] = rpn_data->flow_control;
839 	payload[pos++] = rpn_data->xon;
840 	payload[pos++] = rpn_data->xoff;
841 	payload[pos++] = rpn_data->parameter_mask_0;
842 	payload[pos++] = rpn_data->parameter_mask_1;
843 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
844 }
845 
846 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
847     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
848     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
849 }
850 
851 // depending on channel state emit channel opened with status or channel closed
852 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
853     // emit appropriate events
854     switch(channel->state){
855         case RFCOMM_CHANNEL_OPEN:
856         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
857             rfcomm_emit_channel_closed(channel);
858             break;
859         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
860             // remote didn't wait until we send the UA disc
861             // close event already emitted
862             break;
863         default:
864             rfcomm_emit_channel_opened(channel, status);
865             break;
866     }
867 }
868 
869 // MARK: RFCOMM MULTIPLEXER
870 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
871     if (multiplexer->timer_active) {
872         btstack_run_loop_remove_timer(&multiplexer->timer);
873         multiplexer->timer_active = 0;
874     }
875 }
876 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
877     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
878     btstack_memory_rfcomm_multiplexer_free(multiplexer);
879 }
880 
881 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
882     // remove (potential) timer
883     rfcomm_multiplexer_stop_timer(multiplexer);
884 
885     // close and remove all channels
886     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
887     while (it->next){
888         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
889         if (channel->multiplexer == multiplexer) {
890             // emit open with status or closed
891             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
892             // remove from list
893             it->next = it->next->next;
894             // free channel struct
895             btstack_memory_rfcomm_channel_free(channel);
896         } else {
897             it = it->next;
898         }
899     }
900 
901     // remove mutliplexer
902     rfcomm_multiplexer_free(multiplexer);
903 }
904 
905 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
906     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
907     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
908 
909     log_info("handler timeout: shutting down multiplexer! (no channels)");
910     uint16_t l2cap_cid = multiplexer->l2cap_cid;
911     rfcomm_multiplexer_finalize(multiplexer);
912     l2cap_disconnect(l2cap_cid, 0x13);
913 }
914 
915 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
916     if (multiplexer->timer_active) {
917         btstack_run_loop_remove_timer(&multiplexer->timer);
918         multiplexer->timer_active = 0;
919     }
920     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
921 
922     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
923     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
924     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
925     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
926     btstack_run_loop_add_timer(&multiplexer->timer);
927     multiplexer->timer_active = 1;
928 }
929 
930 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
931     log_info("Multiplexer up and running");
932     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
933 
934     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
935 
936     // transition of channels that wait for multiplexer
937     btstack_linked_item_t *it;
938     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
939         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
940         if (channel->multiplexer != multiplexer) continue;
941         int rfcomm_channel_valid = 1;
942         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
943         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
944             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
945         }
946     }
947     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
948 
949     // request can send now for multiplexer if ready
950     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
951         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
952     }
953 }
954 
955 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
956 
957     log_debug("can_send_now enter: %u", l2cap_cid);
958 
959     btstack_linked_list_iterator_t it;
960     int token_consumed = 0;
961 
962     // forward token to multiplexer
963     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
964     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
965         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
966         if (multiplexer->l2cap_cid != l2cap_cid) continue;
967         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
968             log_debug("can_send_now enter: multiplexer token");
969             token_consumed = 1;
970             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
971         }
972     }
973 
974     // forward token to channel state machine
975     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
976     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
977         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
978         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
979         // channel state machine
980         if (rfcomm_channel_ready_to_send(channel)){
981             log_debug("can_send_now enter: channel token");
982             token_consumed = 1;
983             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
984             int rfcomm_channel_valid = 1;
985             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
986         }
987     }
988 
989     // forward token to client
990     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
991     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
992         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
993         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
994         // client waiting for can send now
995         if (!channel->waiting_for_can_send_now)    continue;
996         if ((channel->multiplexer->fcon & 1) == 0) continue;
997         if (!channel->credits_outgoing){
998             log_debug("can_send_now waiting to send but no credits (ignore)");
999             continue;
1000         }
1001 
1002         log_debug("can_send_now enter: client token");
1003         token_consumed = 1;
1004         channel->waiting_for_can_send_now = 0;
1005         rfcomm_emit_can_send_now(channel);
1006     }
1007 
1008     // if token was consumed, request another one
1009     if (token_consumed) {
1010         l2cap_request_can_send_now_event(l2cap_cid);
1011     }
1012 
1013     log_debug("can_send_now exit");
1014 }
1015 
1016 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
1017     multiplexer->state = state;
1018     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1019 }
1020 
1021 /**
1022  * @return handled packet
1023  */
1024 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
1025 
1026     UNUSED(size);   // ok: handling own l2cap events
1027 
1028     bd_addr_t event_addr;
1029     uint16_t  psm;
1030     uint16_t l2cap_cid;
1031     hci_con_handle_t con_handle;
1032     rfcomm_multiplexer_t *multiplexer = NULL;
1033     uint8_t status;
1034 
1035     switch (hci_event_packet_get_type(packet)) {
1036 
1037         // accept incoming rfcomm connection if no multiplexer exists yet
1038         case L2CAP_EVENT_INCOMING_CONNECTION:
1039             // data: event(8), len(8), address(48), handle (16),  psm (16), source cid(16) dest cid(16)
1040             reverse_bd_addr(&packet[2], event_addr);
1041             con_handle = little_endian_read_16(packet,  8);
1042             psm        = little_endian_read_16(packet, 10);
1043             l2cap_cid  = little_endian_read_16(packet, 12);
1044 
1045             if (psm != BLUETOOTH_PROTOCOL_RFCOMM) break;
1046 
1047             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1048 
1049             if (multiplexer) {
1050                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - multiplexer already exists", l2cap_cid);
1051                 l2cap_decline_connection(l2cap_cid);
1052                 return 1;
1053             }
1054 
1055             // create and inititialize new multiplexer instance (incoming)
1056             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
1057             if (!multiplexer){
1058                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - no memory left", l2cap_cid);
1059                 l2cap_decline_connection(l2cap_cid);
1060                 return 1;
1061             }
1062 
1063             multiplexer->con_handle = con_handle;
1064             multiplexer->l2cap_cid = l2cap_cid;
1065             //
1066             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1067             log_info("RFCOMM incoming (l2cap_cid 0x%02x) => accept", l2cap_cid);
1068 
1069 #ifdef RFCOMM_USE_ERTM
1070             // request
1071             rfcomm_ertm_request_t request;
1072             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1073             (void)memcpy(request.addr, event_addr, 6);
1074             request.ertm_id = rfcomm_next_ertm_id();
1075             if (rfcomm_ertm_request_callback){
1076                 (*rfcomm_ertm_request_callback)(&request);
1077             }
1078             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1079                 multiplexer->ertm_id = request.ertm_id;
1080                 l2cap_accept_ertm_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1081                 return 1;
1082             }
1083 #endif
1084 
1085             l2cap_accept_connection(l2cap_cid);
1086             return 1;
1087 
1088         // l2cap connection opened -> store l2cap_cid, remote_addr
1089         case L2CAP_EVENT_CHANNEL_OPENED:
1090 
1091             if (little_endian_read_16(packet, 11) != BLUETOOTH_PROTOCOL_RFCOMM) break;
1092 
1093             status = packet[2];
1094             log_info("channel opened, status %u", status);
1095 
1096             // get multiplexer for remote addr
1097             con_handle = little_endian_read_16(packet, 9);
1098             l2cap_cid = little_endian_read_16(packet, 13);
1099             reverse_bd_addr(&packet[3], event_addr);
1100             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1101             if (!multiplexer) {
1102                 log_error("channel opened but no multiplexer prepared");
1103                 return 1;
1104             }
1105 
1106             // on l2cap open error discard everything
1107             if (status){
1108 
1109                 // remove (potential) timer
1110                 rfcomm_multiplexer_stop_timer(multiplexer);
1111 
1112                 // mark multiplexer as shutting down
1113                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1114 
1115                 // emit rfcomm_channel_opened with status and free channel
1116                 // note: repeatedly go over list until full iteration causes no further change
1117                 int done;
1118                 do {
1119                     done = 1;
1120                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1121                     while (it->next) {
1122                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1123                         if (channel->multiplexer == multiplexer){
1124                             done = 0;
1125                             rfcomm_emit_channel_opened(channel, status);
1126                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1127                             btstack_memory_rfcomm_channel_free(channel);
1128                             break;
1129                         } else {
1130                             it = it->next;
1131                         }
1132                     }
1133                 } while (!done);
1134 
1135                 // free multiplexer
1136                 rfcomm_multiplexer_free(multiplexer);
1137                 return 1;
1138             }
1139 
1140             // following could be: rfcom_multiplexer_state_machein(..., EVENT_L2CAP_OPENED)
1141 
1142             // set max frame size based on l2cap MTU
1143             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1144 
1145             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1146                 log_info("channel opened: outgoing connection");
1147                 // wrong remote addr
1148                 if (bd_addr_cmp(event_addr, multiplexer->remote_addr)) break;
1149                 multiplexer->l2cap_cid = l2cap_cid;
1150                 multiplexer->con_handle = con_handle;
1151                 // send SABM #0
1152                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1153 
1154             }
1155             return 1;
1156 
1157             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1158 
1159         // Notify channel packet handler if they can send now
1160         case L2CAP_EVENT_CAN_SEND_NOW:
1161             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1162             rfcomm_handle_can_send_now(l2cap_cid);
1163             return 1;
1164 
1165         case L2CAP_EVENT_CHANNEL_CLOSED:
1166             // data: event (8), len(8), channel (16)
1167             l2cap_cid = little_endian_read_16(packet, 2);
1168             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1169             log_info("channel closed cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1170             if (!multiplexer) break;
1171             log_info("channel closed state %u", multiplexer->state);
1172             // no need to call l2cap_disconnect here, as it's already closed
1173             rfcomm_multiplexer_finalize(multiplexer);
1174             return 1;
1175 
1176 #ifdef RFCOMM_USE_ERTM
1177         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1178             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1179             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1180             if (multiplexer) {
1181                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1182                 if (rfcomm_ertm_released_callback){
1183                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1184                 }
1185             }
1186             break;
1187 #endif
1188 
1189         default:
1190             break;
1191     }
1192     return 0;
1193 }
1194 
1195 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1196     // get or create a multiplexer for a certain device
1197     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1198     if (!multiplexer) return 0;
1199 
1200     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1201 
1202     if (size < 3) return 0;
1203 
1204 	// but only care for multiplexer control channel
1205     uint8_t frame_dlci = packet[0] >> 2;
1206     if (frame_dlci) return 0;
1207     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1208     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1209     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1210     switch (packet[1]){
1211 
1212         case BT_RFCOMM_SABM:
1213             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1214                 log_info("Received SABM #0");
1215                 multiplexer->outgoing = 0;
1216                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1217                 return 1;
1218             }
1219             break;
1220 
1221         case BT_RFCOMM_UA:
1222             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1223                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1224                 log_info("Received UA #0 ");
1225                 rfcomm_multiplexer_opened(multiplexer);
1226                 return 1;
1227             }
1228             break;
1229 
1230         case BT_RFCOMM_DISC:
1231             // DISC #0 -> send UA #0, close multiplexer
1232             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1233             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1234             return 1;
1235 
1236         case BT_RFCOMM_DM:
1237             // DM #0 - we shouldn't get this, just give up
1238             log_info("Received DM #0");
1239             log_info("-> Closing down multiplexer");
1240             rfcomm_multiplexer_finalize(multiplexer);
1241             l2cap_disconnect(l2cap_cid, 0x13);
1242             return 1;
1243 
1244         case BT_RFCOMM_UIH:
1245             if (payload_offset >= size) return 0;
1246 
1247             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1248                 // Multiplexer close down (CLD) -> close mutliplexer
1249                 log_info("Received Multiplexer close down command");
1250                 log_info("-> Closing down multiplexer");
1251                 rfcomm_multiplexer_finalize(multiplexer);
1252                 l2cap_disconnect(l2cap_cid, 0x13);
1253                 return 1;
1254             }
1255             switch (packet[payload_offset]){
1256                 case BT_RFCOMM_CLD_CMD:
1257                      // Multiplexer close down (CLD) -> close mutliplexer
1258                     log_info("Received Multiplexer close down command");
1259                     log_info("-> Closing down multiplexer");
1260                     rfcomm_multiplexer_finalize(multiplexer);
1261                     l2cap_disconnect(l2cap_cid, 0x13);
1262                     return 1;
1263 
1264                 case BT_RFCOMM_FCON_CMD:
1265                     multiplexer->fcon = 0x81;
1266                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1267                     return 1;
1268 
1269                 case BT_RFCOMM_FCOFF_CMD:
1270                     multiplexer->fcon = 0x80;
1271                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1272                     return 1;
1273 
1274                 case BT_RFCOMM_TEST_CMD: {
1275                     if ((payload_offset + 1) >= size) return 0; // (1)
1276                     log_info("Received test command");
1277                     int len = packet[payload_offset+1] >> 1; // length < 125
1278                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1279                         len = RFCOMM_TEST_DATA_MAX_LEN;
1280                     }
1281                     // from (1) => (size - 1 - payload_offset) > 0
1282                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1283                     multiplexer->test_data_len = len;
1284                     (void)memcpy(multiplexer->test_data,
1285                                  &packet[payload_offset + 2], len);
1286                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1287                     return 1;
1288                 }
1289                 default:
1290                     break;
1291             }
1292             break;
1293 
1294         default:
1295             break;
1296 
1297     }
1298     return 0;
1299 }
1300 
1301 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1302     if (multiplexer->send_dm_for_dlci) return 1;
1303     if (multiplexer->nsc_command) return 1;
1304     if (multiplexer->fcon & 0x80) return 1;
1305     switch (multiplexer->state){
1306         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1307         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1308         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1309             return 1;
1310         case RFCOMM_MULTIPLEXER_OPEN:
1311             if (multiplexer->test_data_len) {
1312                 return 1;
1313             }
1314             break;
1315         default:
1316             break;
1317     }
1318     return 0;
1319 }
1320 
1321 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1322 
1323     if (event != MULT_EV_READY_TO_SEND) return;
1324 
1325     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1326 
1327     // process stored DM responses
1328     if (multiplexer->send_dm_for_dlci){
1329         uint8_t dlci = multiplexer->send_dm_for_dlci;
1330         multiplexer->send_dm_for_dlci = 0;
1331         rfcomm_send_dm_pf(multiplexer, dlci);
1332         return;
1333     }
1334 
1335     if (multiplexer->nsc_command){
1336         uint8_t command = multiplexer->nsc_command;
1337         multiplexer->nsc_command = 0;
1338         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1339         return;
1340     }
1341 
1342     if (multiplexer->fcon & 0x80){
1343         multiplexer->fcon &= 0x01;
1344         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1345 
1346         if (multiplexer->fcon == 0) return;
1347         // trigger client to send again after sending FCon Response
1348         rfcomm_notify_channel_can_send();
1349         return;
1350     }
1351 
1352     switch (multiplexer->state) {
1353         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1354             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1355             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1356             rfcomm_send_sabm(multiplexer, 0);
1357             break;
1358         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1359             log_info("Sending UA #0");
1360             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1361             rfcomm_send_ua(multiplexer, 0);
1362 
1363             rfcomm_multiplexer_opened(multiplexer);
1364             break;
1365         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1366             log_info("Sending UA #0");
1367             log_info("Closing down multiplexer");
1368             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1369             rfcomm_send_ua(multiplexer, 0);
1370 
1371             rfcomm_multiplexer_finalize(multiplexer);
1372             l2cap_disconnect(l2cap_cid, 0x13);
1373             break;
1374         case RFCOMM_MULTIPLEXER_OPEN:
1375             // respond to test command
1376             if (multiplexer->test_data_len){
1377                 int len = multiplexer->test_data_len;
1378                 log_info("Sending TEST Response with %u bytes", len);
1379                 multiplexer->test_data_len = 0;
1380                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1381                 return;
1382             }
1383             break;
1384         default:
1385             break;
1386     }
1387 }
1388 
1389 // MARK: RFCOMM CHANNEL
1390 
1391 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1392     channel->credits_incoming += credits;
1393     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1394 }
1395 
1396 static int rfcomm_channel_can_send(rfcomm_channel_t * channel){
1397     if (!channel->credits_outgoing) return 0;
1398     if ((channel->multiplexer->fcon & 1) == 0) return 0;
1399     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid);
1400 }
1401 
1402 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1403 
1404     log_info("opened");
1405 
1406     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1407     rfcomm_emit_channel_opened(rfChannel, 0);
1408     rfcomm_emit_port_configuration(rfChannel);
1409 
1410     // remove (potential) timer
1411     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1412     if (multiplexer->timer_active) {
1413         btstack_run_loop_remove_timer(&multiplexer->timer);
1414         multiplexer->timer_active = 0;
1415     }
1416     // hack for problem detecting authentication failure
1417     multiplexer->at_least_one_connection = 1;
1418 
1419     // request can send now if channel ready
1420     if (rfcomm_channel_ready_to_send(rfChannel)){
1421         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1422     }
1423 }
1424 
1425 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1426     const uint8_t frame_dlci = packet[0] >> 2;
1427     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1428     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1429     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1430     int request_can_send_now = 0;
1431 
1432     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1433     if (!channel) return;
1434 
1435     // handle new outgoing credits
1436     if (packet[1] == BT_RFCOMM_UIH_PF) {
1437 
1438         // add them
1439         uint16_t new_credits = packet[3+length_offset];
1440         channel->credits_outgoing += new_credits;
1441         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1442 
1443         // notify channel statemachine
1444         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1445         log_debug("state machine, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1446         int rfcomm_channel_valid = 1;
1447         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1448         if (rfcomm_channel_valid){
1449             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1450                 request_can_send_now = 1;
1451             }
1452         }
1453     }
1454 
1455     // contains payload?
1456     if ((size - 1) > payload_offset){
1457 
1458         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1459 
1460         // decrease incoming credit counter
1461         if (channel->credits_incoming > 0){
1462             channel->credits_incoming--;
1463         }
1464 
1465         // deliver payload
1466         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1467                               &packet[payload_offset], size-payload_offset-1);
1468     }
1469 
1470     // automatically provide new credits to remote device, if no incoming flow control
1471     if (!channel->incoming_flow_control && (channel->credits_incoming < 5)){
1472         channel->new_credits_incoming = RFCOMM_CREDITS;
1473         request_can_send_now = 1;
1474     }
1475 
1476     if (request_can_send_now){
1477         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1478     }
1479 }
1480 
1481 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1482     // priority of client request
1483     channel->pn_priority = event->priority;
1484 
1485     // new credits
1486     channel->credits_outgoing = event->credits_outgoing;
1487 
1488     // negotiate max frame size
1489     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1490         channel->max_frame_size = channel->multiplexer->max_frame_size;
1491     }
1492     if (channel->max_frame_size > event->max_frame_size) {
1493         channel->max_frame_size = event->max_frame_size;
1494     }
1495 
1496 }
1497 
1498 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1499 
1500     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1501 
1502     // remove from list
1503     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1504 
1505     // free channel
1506     btstack_memory_rfcomm_channel_free(channel);
1507 
1508     // update multiplexer timeout after channel was removed from list
1509     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1510 }
1511 
1512 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1513 
1514     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1515 
1516 
1517     // lookup existing channel
1518     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1519 
1520     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1521 
1522     if (channel) {
1523         int rfcomm_channel_valid = 1;
1524         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1525         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1526             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1527         }
1528         return;
1529     }
1530 
1531     // service registered?
1532     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1533     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1534     if (!service) {
1535         // discard request by sending disconnected mode
1536         multiplexer->send_dm_for_dlci = dlci;
1537         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1538         return;
1539     }
1540 
1541     // create channel for some events
1542     switch (event->type) {
1543         case CH_EVT_RCVD_SABM:
1544         case CH_EVT_RCVD_PN:
1545         case CH_EVT_RCVD_RPN_REQ:
1546         case CH_EVT_RCVD_RPN_CMD:
1547             // setup incoming channel
1548             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1549             if (!channel){
1550                 // discard request by sending disconnected mode
1551                 multiplexer->send_dm_for_dlci = dlci;
1552                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1553             }
1554             break;
1555         default:
1556             break;
1557     }
1558 
1559     if (!channel) {
1560         // discard request by sending disconnected mode
1561         multiplexer->send_dm_for_dlci = dlci;
1562         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1563         return;
1564     }
1565 
1566     int rfcomm_channel_valid = 1;
1567     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1568     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1569         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1570     }
1571 }
1572 
1573 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1574 
1575     UNUSED(size);   // ok: fixed format messages
1576 
1577     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1578     const uint8_t frame_dlci = packet[0] >> 2;
1579     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1580 	uint8_t message_len;  //   "
1581 
1582     // rfcomm: (1) command/control
1583     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1584     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1585     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1586     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1587     // rfcomm: (3+length_offset) credits if credits_offset == 1
1588     // rfcomm: (3+length_offest+credits_offset)
1589     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1590 
1591     rfcomm_channel_event_t event;
1592     rfcomm_channel_event_pn_t event_pn;
1593     rfcomm_channel_event_rpn_t event_rpn;
1594     rfcomm_channel_event_msc_t event_msc;
1595 
1596     // switch by rfcomm message type
1597     switch(packet[1]) {
1598 
1599         case BT_RFCOMM_SABM:
1600             event.type = CH_EVT_RCVD_SABM;
1601             log_info("Received SABM #%u", frame_dlci);
1602             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1603             break;
1604 
1605         case BT_RFCOMM_UA:
1606             event.type = CH_EVT_RCVD_UA;
1607             log_info("Received UA #%u",frame_dlci);
1608             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1609             break;
1610 
1611         case BT_RFCOMM_DISC:
1612             event.type = CH_EVT_RCVD_DISC;
1613             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1614             break;
1615 
1616         case BT_RFCOMM_DM:
1617         case BT_RFCOMM_DM_PF:
1618             event.type = CH_EVT_RCVD_DM;
1619             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1620             break;
1621 
1622         case BT_RFCOMM_UIH_PF:
1623         case BT_RFCOMM_UIH:
1624 
1625             message_len  = packet[payload_offset+1] >> 1;
1626 
1627             switch (packet[payload_offset]) {
1628                 case BT_RFCOMM_PN_CMD:
1629                     message_dlci = packet[payload_offset+2];
1630                     event_pn.super.type = CH_EVT_RCVD_PN;
1631                     event_pn.priority = packet[payload_offset+4];
1632                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1633                     event_pn.credits_outgoing = packet[payload_offset+9];
1634                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1635                         message_dlci, event_pn.credits_outgoing);
1636                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1637                     break;
1638 
1639                 case BT_RFCOMM_PN_RSP:
1640                     message_dlci = packet[payload_offset+2];
1641                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1642                     event_pn.priority = packet[payload_offset+4];
1643                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1644                     event_pn.credits_outgoing = packet[payload_offset+9];
1645                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1646                             event_pn.max_frame_size, event_pn.credits_outgoing);
1647                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1648                     break;
1649 
1650                 case BT_RFCOMM_MSC_CMD:
1651                     message_dlci = packet[payload_offset+2] >> 2;
1652                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1653                     event_msc.modem_status = packet[payload_offset+3];
1654                     log_info("Received MSC CMD for #%u, ", message_dlci);
1655                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1656                     break;
1657 
1658                 case BT_RFCOMM_MSC_RSP:
1659                     message_dlci = packet[payload_offset+2] >> 2;
1660                     event.type = CH_EVT_RCVD_MSC_RSP;
1661                     log_info("Received MSC RSP for #%u", message_dlci);
1662                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1663                     break;
1664 
1665                 case BT_RFCOMM_RPN_CMD:
1666                     message_dlci = packet[payload_offset+2] >> 2;
1667                     switch (message_len){
1668                         case 1:
1669                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1670                             event.type = CH_EVT_RCVD_RPN_REQ;
1671                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1672                             break;
1673                         case 8:
1674                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1675                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1676                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1677                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1678                             break;
1679                         default:
1680                             break;
1681                     }
1682                     break;
1683 
1684                 case BT_RFCOMM_RPN_RSP:
1685                     log_info("Received RPN response");
1686                     break;
1687 
1688                 case BT_RFCOMM_RLS_CMD: {
1689                     log_info("Received RLS command");
1690                     message_dlci = packet[payload_offset+2] >> 2;
1691                     rfcomm_channel_event_rls_t event_rls;
1692                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1693                     event_rls.line_status = packet[payload_offset+3];
1694                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1695                     break;
1696                 }
1697 
1698                 case BT_RFCOMM_RLS_RSP:
1699                     log_info("Received RLS response");
1700                     break;
1701 
1702                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1703                 // case BT_RFCOMM_TEST_CMD:
1704                 // case BT_RFCOMM_FCOFF_CMD:
1705                 // case BT_RFCOMM_FCON_CMD:
1706                 // everything else is an not supported command
1707                 default: {
1708                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1709                     multiplexer->nsc_command = packet[payload_offset];
1710                     break;
1711                 }
1712             }
1713             break;
1714 
1715         default:
1716             log_error("Received unknown RFCOMM message type %x", packet[1]);
1717             break;
1718     }
1719 
1720     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1721     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1722         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1723     }
1724 }
1725 
1726 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1727 
1728     if (packet_type == HCI_EVENT_PACKET){
1729         rfcomm_hci_event_handler(packet, size);
1730         return;
1731     }
1732 
1733     // we only handle l2cap packets for:
1734     if (packet_type != L2CAP_DATA_PACKET) return;
1735 
1736     //  - multiplexer itself
1737     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1738 
1739     if (handled) return;
1740 
1741     // - channel over open multiplexer
1742     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1743     if ( (multiplexer == NULL) || (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN)) return;
1744 
1745     // channel data ?
1746     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1747     const uint8_t frame_dlci = packet[0] >> 2;
1748 
1749     if (frame_dlci && ((packet[1] == BT_RFCOMM_UIH) || (packet[1] == BT_RFCOMM_UIH_PF))) {
1750         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1751         return;
1752     }
1753 
1754     rfcomm_channel_packet_handler(multiplexer, packet, size);
1755 }
1756 
1757 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1758     // note: exchanging MSC isn't neccessary to consider channel open
1759     // note: having outgoing credits is also not necessary to consider channel open
1760     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1761     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1762     // if (channel->credits_outgoing == 0) return 0;
1763     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u",
1764          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1765     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1766     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1767 
1768     return 1;
1769 }
1770 
1771 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1772     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %04x", channel->state_var);
1773     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1774     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1775     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1776     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1777     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1778     return 1;
1779 }
1780 
1781 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1782     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var | event);
1783 }
1784 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1785     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var & ~event);
1786 }
1787 
1788 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1789     switch (channel->state){
1790         case RFCOMM_CHANNEL_SEND_UIH_PN:
1791             log_debug("ch-ready: state %u", channel->state);
1792             return 1;
1793         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1794             log_debug("ch-ready: state %u", channel->state);
1795             return 1;
1796         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1797             log_debug("ch-ready: state %u", channel->state);
1798             return 1;
1799         case RFCOMM_CHANNEL_SEND_DISC:
1800             log_debug("ch-ready: state %u", channel->state);
1801             return 1;
1802         case RFCOMM_CHANNEL_SEND_DM:
1803             log_debug("ch-ready: state %u", channel->state);
1804             return 1;
1805         case RFCOMM_CHANNEL_OPEN:
1806             if (channel->new_credits_incoming) {
1807                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1808                 return 1;
1809             }
1810             break;
1811         case RFCOMM_CHANNEL_DLC_SETUP:
1812             if (channel->state_var & (
1813                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1814                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1815              )) {
1816                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1817                 return 1;
1818             }
1819             break;
1820 
1821         default:
1822             break;
1823     }
1824 
1825     if (channel->state_var & (
1826         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP   |
1827         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_INFO |
1828         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP  |
1829         RFCOMM_CHANNEL_STATE_VAR_SEND_UA       |
1830         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1831                              )){
1832         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1833         return 1;
1834     }
1835 
1836     if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID) {
1837         log_debug("ch-ready: rls_line_status");
1838         return 1;
1839     }
1840 
1841     return 0;
1842 }
1843 
1844 
1845 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1846 
1847     // log_info("rfcomm_channel_state_machine_with_channel: state %u, state_var %04x, event %u", channel->state, channel->state_var ,event->type);
1848 
1849     // channel != NULL -> channel valid
1850     *out_channel_valid = 1;
1851 
1852     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1853 
1854     // TODO: integrate in common switch
1855     if (event->type == CH_EVT_RCVD_DISC){
1856         rfcomm_emit_channel_closed(channel);
1857         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1858         return;
1859     }
1860 
1861     // TODO: integrate in common switch
1862     if (event->type == CH_EVT_RCVD_DM){
1863         log_info("Received DM message for #%u", channel->dlci);
1864         log_info("-> Closing channel locally for #%u", channel->dlci);
1865         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1866         rfcomm_channel_finalize(channel);
1867         *out_channel_valid = 0;
1868         return;
1869     }
1870 
1871     // remote port negotiation command - just accept everything for now
1872     //
1873     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1874     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1875     //   (Although the handling of individual settings are implementation-dependent.)"
1876     //
1877 
1878     // TODO: integrate in common switch
1879     if (event->type == CH_EVT_RCVD_RPN_CMD){
1880         // control port parameters
1881         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1882         rfcomm_rpn_data_update(&channel->rpn_data, &event_rpn->data);
1883         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1884         // notify client about new settings
1885         rfcomm_emit_port_configuration(channel);
1886         return;
1887     }
1888 
1889     // TODO: integrate in common switch
1890     if (event->type == CH_EVT_RCVD_RPN_REQ){
1891         // no values got accepted (no values have beens sent)
1892         channel->rpn_data.parameter_mask_0 = 0x00;
1893         channel->rpn_data.parameter_mask_1 = 0x00;
1894         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1895         return;
1896     }
1897 
1898     if (event->type == CH_EVT_RCVD_RLS_CMD){
1899         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1900         channel->rls_line_status = event_rls->line_status & 0x0f;
1901         log_info("CH_EVT_RCVD_RLS_CMD setting line status to 0x%0x", channel->rls_line_status);
1902         rfcomm_emit_remote_line_status(channel, event_rls->line_status);
1903         return;
1904     }
1905 
1906     // TODO: integrate in common switch
1907     if (event->type == CH_EVT_READY_TO_SEND){
1908         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP){
1909             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1910             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1911             rfcomm_send_uih_rpn_rsp(multiplexer, channel->dlci, &channel->rpn_data);
1912             return;
1913         }
1914         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1915             log_info("Sending MSC RSP for #%u", channel->dlci);
1916             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1917             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1918             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
1919             return;
1920         }
1921         if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID){
1922             log_info("Sending RLS RSP 0x%0x", channel->rls_line_status);
1923             uint8_t line_status = channel->rls_line_status;
1924             channel->rls_line_status = RFCOMM_RLS_STATUS_INVALID;
1925             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1926             return;
1927         }
1928     }
1929 
1930     // emit MSC status to app
1931     if (event->type == CH_EVT_RCVD_MSC_CMD){
1932         // notify client about new settings
1933         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1934         uint8_t modem_status_event[5];
1935         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1936         modem_status_event[1] = sizeof(event) - 2;
1937         little_endian_store_16(modem_status_event, 2, channel->rfcomm_cid);
1938         modem_status_event[4] = event_msc->modem_status;
1939         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1940         // no return, MSC_CMD will be handled by state machine below
1941     }
1942 
1943     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1944 
1945     switch (channel->state) {
1946         case RFCOMM_CHANNEL_CLOSED:
1947             switch (event->type){
1948                 case CH_EVT_RCVD_SABM:
1949                     log_info("-> Inform app");
1950                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1951                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1952                     rfcomm_emit_connection_request(channel);
1953                     break;
1954                 case CH_EVT_RCVD_PN:
1955                     rfcomm_channel_accept_pn(channel, event_pn);
1956                     log_info("-> Inform app");
1957                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1958                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1959                     rfcomm_emit_connection_request(channel);
1960                     break;
1961                 default:
1962                     break;
1963             }
1964             break;
1965 
1966         case RFCOMM_CHANNEL_INCOMING_SETUP:
1967             switch (event->type){
1968                 case CH_EVT_RCVD_SABM:
1969                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1970                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1971                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1972                     }
1973                     break;
1974                 case CH_EVT_RCVD_PN:
1975                     rfcomm_channel_accept_pn(channel, event_pn);
1976                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1977                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1978                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1979                     }
1980                     break;
1981                 case CH_EVT_READY_TO_SEND:
1982                     // if / else if is used to check for state transition after sending
1983                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
1984                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
1985                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1986                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
1987                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
1988                         log_info("Sending UA #%u", channel->dlci);
1989                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1990                         rfcomm_send_ua(multiplexer, channel->dlci);
1991                     }
1992                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
1993                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
1994                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1995                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1996                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1997                      }
1998                     break;
1999                 default:
2000                     break;
2001             }
2002             break;
2003 
2004         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
2005             switch (event->type) {
2006                 case CH_EVT_MULTIPLEXER_READY:
2007                     log_info("Muliplexer opened, sending UIH PN next");
2008                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2009                     break;
2010                 default:
2011                     break;
2012             }
2013             break;
2014 
2015         case RFCOMM_CHANNEL_SEND_UIH_PN:
2016             switch (event->type) {
2017                 case CH_EVT_READY_TO_SEND:
2018                     // update mtu
2019                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
2020                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
2021                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
2022                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
2023                     break;
2024                 default:
2025                     break;
2026             }
2027             break;
2028 
2029         case RFCOMM_CHANNEL_W4_PN_RSP:
2030             switch (event->type){
2031                 case CH_EVT_RCVD_PN_RSP:
2032                     // update max frame size
2033                     if (channel->max_frame_size > event_pn->max_frame_size) {
2034                         channel->max_frame_size = event_pn->max_frame_size;
2035                     }
2036                     // new credits
2037                     channel->credits_outgoing = event_pn->credits_outgoing;
2038                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
2039                     break;
2040                 default:
2041                     break;
2042             }
2043             break;
2044 
2045         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
2046             switch (event->type) {
2047                 case CH_EVT_READY_TO_SEND:
2048                     log_info("Sending SABM #%u", channel->dlci);
2049                     channel->state = RFCOMM_CHANNEL_W4_UA;
2050                     rfcomm_send_sabm(multiplexer, channel->dlci);
2051                     break;
2052                 default:
2053                     break;
2054             }
2055             break;
2056 
2057         case RFCOMM_CHANNEL_W4_UA:
2058             switch (event->type){
2059                 case CH_EVT_RCVD_UA:
2060                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2061                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2062                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2063                     break;
2064                 default:
2065                     break;
2066             }
2067             break;
2068 
2069         case RFCOMM_CHANNEL_DLC_SETUP:
2070             switch (event->type){
2071                 case CH_EVT_RCVD_MSC_CMD:
2072                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2073                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2074                     break;
2075                 case CH_EVT_RCVD_MSC_RSP:
2076                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2077                     break;
2078 
2079                 case CH_EVT_READY_TO_SEND:
2080                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
2081                         log_info("Sending MSC CMD for #%u", channel->dlci);
2082                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2083                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
2084                         rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
2085                         break;
2086                     }
2087                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2088                         log_info("Providing credits for #%u", channel->dlci);
2089                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2090                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2091 
2092                         if (channel->new_credits_incoming) {
2093                             uint8_t new_credits = channel->new_credits_incoming;
2094                             channel->new_credits_incoming = 0;
2095                             rfcomm_channel_send_credits(channel, new_credits);
2096                         }
2097                         break;
2098 
2099                     }
2100                     break;
2101                 default:
2102                     break;
2103             }
2104             // finally done?
2105             if (rfcomm_channel_ready_for_open(channel)){
2106                 channel->state = RFCOMM_CHANNEL_OPEN;
2107                 rfcomm_channel_opened(channel);
2108             }
2109             break;
2110 
2111         case RFCOMM_CHANNEL_OPEN:
2112             switch (event->type){
2113                 case CH_EVT_RCVD_MSC_CMD:
2114                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2115                     break;
2116                 case CH_EVT_READY_TO_SEND:
2117                     if (channel->new_credits_incoming) {
2118                         uint8_t new_credits = channel->new_credits_incoming;
2119                         channel->new_credits_incoming = 0;
2120                         rfcomm_channel_send_credits(channel, new_credits);
2121                         break;
2122                     }
2123                     break;
2124                 case CH_EVT_RCVD_CREDITS:
2125                     rfcomm_notify_channel_can_send();
2126                     break;
2127                 default:
2128                     break;
2129             }
2130             break;
2131 
2132         case RFCOMM_CHANNEL_SEND_DM:
2133             switch (event->type) {
2134                 case CH_EVT_READY_TO_SEND:
2135                     log_info("Sending DM_PF for #%u", channel->dlci);
2136                     // don't emit channel closed - channel was never open
2137                     channel->state = RFCOMM_CHANNEL_CLOSED;
2138                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2139                     rfcomm_channel_finalize(channel);
2140                     *out_channel_valid = 0;
2141                     break;
2142                 default:
2143                     break;
2144             }
2145             break;
2146 
2147         case RFCOMM_CHANNEL_SEND_DISC:
2148             switch (event->type) {
2149                 case CH_EVT_READY_TO_SEND:
2150                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2151                     rfcomm_send_disc(multiplexer, channel->dlci);
2152                     break;
2153                 default:
2154                     break;
2155             }
2156             break;
2157 
2158         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2159             switch (event->type){
2160                 case CH_EVT_RCVD_UA:
2161                     channel->state = RFCOMM_CHANNEL_CLOSED;
2162                     rfcomm_emit_channel_closed(channel);
2163                     rfcomm_channel_finalize(channel);
2164                     *out_channel_valid = 0;
2165                     break;
2166                 default:
2167                     break;
2168             }
2169             break;
2170 
2171         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2172             switch (event->type) {
2173                 case CH_EVT_READY_TO_SEND:
2174                     log_info("Sending UA after DISC for #%u", channel->dlci);
2175                     channel->state = RFCOMM_CHANNEL_CLOSED;
2176                     rfcomm_send_ua(multiplexer, channel->dlci);
2177                     rfcomm_channel_finalize(channel);
2178                     *out_channel_valid = 0;
2179                     break;
2180                 default:
2181                     break;
2182             }
2183             break;
2184 
2185         default:
2186             break;
2187     }
2188 }
2189 
2190 // MARK: RFCOMM BTstack API
2191 
2192 void rfcomm_init(void){
2193     rfcomm_security_level = gap_get_security_level();
2194 #ifdef RFCOMM_USE_ERTM
2195     rfcomm_ertm_id = 0;
2196 #endif
2197 }
2198 
2199 void rfcomm_deinit(void){
2200     rfcomm_client_cid_generator = 0;
2201     rfcomm_multiplexers = NULL;
2202     rfcomm_services     = NULL;
2203     rfcomm_channels     = NULL;
2204 #ifdef RFCOMM_USE_ERTM
2205     rfcomm_ertm_request_callback  = NULL;
2206     rfcomm_ertm_released_callback = NULL;
2207 #endif
2208 }
2209 
2210 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2211     rfcomm_security_level = security_level;
2212 }
2213 
2214 int rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2215     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2216     if (!channel){
2217         log_error("send cid 0x%02x doesn't exist!", rfcomm_cid);
2218         return 0;
2219     }
2220     return rfcomm_channel_can_send(channel);
2221 }
2222 
2223 void rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2224     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2225     if (!channel){
2226         log_error("send cid 0x%02x doesn't exist!", rfcomm_cid);
2227         return;
2228     }
2229     channel->waiting_for_can_send_now = 1;
2230     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2231 }
2232 
2233 static int rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2234     if (len > channel->max_frame_size){
2235         log_error("send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2236         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2237     }
2238 
2239 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2240     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2241         log_error("send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2242         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2243     }
2244 #endif
2245 
2246     if (!channel->credits_outgoing){
2247         log_info("send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2248         return RFCOMM_NO_OUTGOING_CREDITS;
2249     }
2250 
2251     if ((channel->multiplexer->fcon & 1) == 0){
2252         log_info("send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2253         return RFCOMM_AGGREGATE_FLOW_OFF;
2254     }
2255     return 0;
2256 }
2257 
2258 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2259     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2260     if (!channel){
2261         return 0;
2262     }
2263     return channel->max_frame_size;
2264 }
2265 
2266 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2267 int rfcomm_reserve_packet_buffer(void){
2268 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2269     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2270     return 0;
2271 #else
2272     return l2cap_reserve_packet_buffer();
2273 #endif
2274 }
2275 
2276 void rfcomm_release_packet_buffer(void){
2277 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2278     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2279 #else
2280     l2cap_release_packet_buffer();
2281 #endif
2282 }
2283 
2284 uint8_t * rfcomm_get_outgoing_buffer(void){
2285 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2286     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2287 #else
2288     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2289 #endif
2290     // address + control + length (16) + no credit field
2291     return &rfcomm_out_buffer[4];
2292 }
2293 
2294 int rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2295     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2296     if (!channel){
2297         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2298         return 0;
2299     }
2300 
2301     int err = rfcomm_assert_send_valid(channel, len);
2302     if (err) return err;
2303 
2304 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2305     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2306         log_error("l2cap cannot send now");
2307         return BTSTACK_ACL_BUFFERS_FULL;
2308     }
2309 #else
2310     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2311         log_error("l2cap cannot send now");
2312         return BTSTACK_ACL_BUFFERS_FULL;
2313     }
2314 #endif
2315 
2316     // send might cause l2cap to emit new credits, update counters first
2317     if (len){
2318         channel->credits_outgoing--;
2319     } else {
2320         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2321     }
2322 
2323     int result = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2324 
2325     if (result != 0) {
2326         if (len) {
2327             channel->credits_outgoing++;
2328         }
2329         log_error("error %d", result);
2330         return result;
2331     }
2332 
2333     return result;
2334 }
2335 
2336 int rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2337     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2338     if (!channel){
2339         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2340         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2341     }
2342 
2343     int err = rfcomm_assert_send_valid(channel, len);
2344     if (err) return err;
2345     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2346         log_error("rfcomm_send_internal: l2cap cannot send now");
2347         return BTSTACK_ACL_BUFFERS_FULL;
2348     }
2349 
2350 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2351 #else
2352     rfcomm_reserve_packet_buffer();
2353 #endif
2354     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2355 
2356     (void)memcpy(rfcomm_payload, data, len);
2357     err = rfcomm_send_prepared(rfcomm_cid, len);
2358 
2359 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2360 #else
2361     if (err){
2362         rfcomm_release_packet_buffer();
2363     }
2364 #endif
2365 
2366     return err;
2367 }
2368 
2369 // Sends Local Lnie Status, see LINE_STATUS_..
2370 int rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2371     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2372     if (!channel){
2373         return 0;
2374     }
2375     return rfcomm_send_uih_rls_cmd(channel->multiplexer, channel->dlci, line_status);
2376 }
2377 
2378 // Sned local modem status. see MODEM_STAUS_..
2379 int rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2380     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2381     if (!channel){
2382         return 0;
2383     }
2384     return rfcomm_send_uih_msc_cmd(channel->multiplexer, channel->dlci, modem_status);
2385 }
2386 
2387 // Configure remote port
2388 int rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, rpn_flow_control_t flow_control){
2389     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2390     if (!channel){
2391         return 0;
2392     }
2393     rfcomm_rpn_data_t rpn_data;
2394     rpn_data.baud_rate = baud_rate;
2395     rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2396     rpn_data.flow_control = flow_control;
2397     rpn_data.xon = 0;
2398     rpn_data.xoff = 0;
2399     rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2400     rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2401     return rfcomm_send_uih_rpn_cmd(channel->multiplexer, channel->dlci, &rpn_data);
2402 }
2403 
2404 // Query remote port
2405 int rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2406     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2407     if (!channel){
2408         return 0;
2409     }
2410     return rfcomm_send_uih_rpn_req(channel->multiplexer, channel->dlci);
2411 }
2412 
2413 
2414 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2415     log_info("create addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2416 
2417     // create new multiplexer if necessary
2418     uint8_t status = 0;
2419     uint8_t dlci = 0;
2420     int new_multiplexer = 0;
2421     rfcomm_channel_t * channel = NULL;
2422     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2423     if (!multiplexer) {
2424         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2425         if (!multiplexer) return BTSTACK_MEMORY_ALLOC_FAILED;
2426 
2427         multiplexer->outgoing = 1;
2428         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2429         new_multiplexer = 1;
2430     }
2431 
2432     // check if channel for this remote service already exists
2433     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2434     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2435     if (channel){
2436         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2437         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2438     }
2439 
2440     // prepare channel
2441     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2442     if (!channel){
2443         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2444         return BTSTACK_MEMORY_ALLOC_FAILED;
2445     }
2446 
2447     // rfcomm_cid is already assigned by rfcomm_channel_create
2448     channel->incoming_flow_control = incoming_flow_control;
2449     channel->new_credits_incoming  = initial_credits;
2450     channel->packet_handler = packet_handler;
2451 
2452     // return rfcomm_cid
2453     if (out_rfcomm_cid){
2454         *out_rfcomm_cid = channel->rfcomm_cid;
2455     }
2456 
2457     // start multiplexer setup
2458     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2459         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2460         uint16_t l2cap_cid = 0;
2461 #ifdef RFCOMM_USE_ERTM
2462         // request
2463         rfcomm_ertm_request_t request;
2464         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2465         (void)memcpy(request.addr, addr, 6);
2466         request.ertm_id = rfcomm_next_ertm_id();
2467         if (rfcomm_ertm_request_callback){
2468             (*rfcomm_ertm_request_callback)(&request);
2469         }
2470         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2471             multiplexer->ertm_id = request.ertm_id;
2472             status = l2cap_create_ertm_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2473                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2474         }
2475         else
2476 #endif
2477         {
2478             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2479         }
2480         if (status) {
2481             if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2482             btstack_memory_rfcomm_channel_free(channel);
2483             return status;
2484         }
2485         multiplexer->l2cap_cid = l2cap_cid;
2486         return ERROR_CODE_SUCCESS;
2487     }
2488 
2489     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2490 
2491     // start connecting, if multiplexer is already up and running
2492     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2493     return ERROR_CODE_SUCCESS;
2494 }
2495 
2496 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2497     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2498 }
2499 
2500 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2501     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2502 }
2503 
2504 void rfcomm_disconnect(uint16_t rfcomm_cid){
2505     log_info("disconnect cid 0x%02x", rfcomm_cid);
2506     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2507     if (!channel) return;
2508 
2509     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2510     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2511 }
2512 
2513 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2514     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2515 
2516     log_info("register channel #%u mtu %u flow_control %u credits %u",
2517              channel, max_frame_size, incoming_flow_control, initial_credits);
2518 
2519     // check if already registered
2520     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2521     if (service){
2522         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2523     }
2524 
2525     // alloc structure
2526     service = btstack_memory_rfcomm_service_get();
2527     if (!service) {
2528         return BTSTACK_MEMORY_ALLOC_FAILED;
2529     }
2530 
2531     // register with l2cap if not registered before, max MTU
2532     if (btstack_linked_list_empty(&rfcomm_services)){
2533         uint8_t status = l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2534         if (status != ERROR_CODE_SUCCESS){
2535             btstack_memory_rfcomm_service_free(service);
2536             return status;
2537         }
2538     }
2539 
2540     // fill in
2541     service->packet_handler = packet_handler;
2542     service->server_channel = channel;
2543     service->max_frame_size = max_frame_size;
2544     service->incoming_flow_control = incoming_flow_control;
2545     service->incoming_initial_credits = initial_credits;
2546 
2547     // add to services list
2548     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2549 
2550     return ERROR_CODE_SUCCESS;
2551 }
2552 
2553 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2554     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2555 
2556     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2557 }
2558 
2559 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2560     uint16_t max_frame_size){
2561 
2562     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2563 }
2564 
2565 void rfcomm_unregister_service(uint8_t service_channel){
2566     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2567     if (!service) return;
2568     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2569     btstack_memory_rfcomm_service_free(service);
2570 
2571     // unregister if no services active
2572     if (btstack_linked_list_empty(&rfcomm_services)){
2573         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2574         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2575     }
2576 }
2577 
2578 void rfcomm_accept_connection(uint16_t rfcomm_cid){
2579     log_info("accept cid 0x%02x", rfcomm_cid);
2580     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2581     if (!channel) return;
2582     switch (channel->state) {
2583         case RFCOMM_CHANNEL_INCOMING_SETUP:
2584             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2585             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2586                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2587                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2588             }
2589             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2590                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2591                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2592             }
2593             // at least one of { PN RSP, UA } needs to be sent
2594             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2595             break;
2596         default:
2597             break;
2598     }
2599 
2600 }
2601 
2602 void rfcomm_decline_connection(uint16_t rfcomm_cid){
2603     log_info("decline cid 0x%02x", rfcomm_cid);
2604     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2605     if (!channel) return;
2606     switch (channel->state) {
2607         case RFCOMM_CHANNEL_INCOMING_SETUP:
2608             channel->state = RFCOMM_CHANNEL_SEND_DM;
2609             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2610             break;
2611         default:
2612             break;
2613     }
2614 }
2615 
2616 void rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2617     log_info("grant cid 0x%02x credits %u", rfcomm_cid, credits);
2618     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2619     if (!channel) return;
2620     if (!channel->incoming_flow_control) return;
2621     channel->new_credits_incoming += credits;
2622 
2623     // process
2624     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2625 }
2626 
2627 #ifdef RFCOMM_USE_ERTM
2628 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2629     rfcomm_ertm_request_callback  = request_callback;
2630     rfcomm_ertm_released_callback = released_callback;
2631 }
2632 #endif
2633