xref: /btstack/src/classic/rfcomm.c (revision 6897da5c53aac5b1f90f41b5b15d0bd43d61dfff)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <inttypes.h>
45 #include <string.h> // memcpy
46 #include <stdint.h>
47 
48 #include "bluetooth_sdp.h"
49 #include "btstack_debug.h"
50 #include "btstack_event.h"
51 #include "btstack_memory.h"
52 #include "btstack_util.h"
53 #include "classic/core.h"
54 #include "classic/rfcomm.h"
55 #include "hci.h"
56 #include "hci_cmd.h"
57 #include "hci_dump.h"
58 #include "l2cap.h"
59 
60 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
61 #ifndef PRIxPTR
62 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
63 #define PRIxPTR "lx"
64 #else
65 #define PRIxPTR "x"
66 #endif
67 #endif
68 
69 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
70 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
71 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
72 #define RFCOMM_USE_OUTGOING_BUFFER
73 #define RFCOMM_USE_ERTM
74 #else
75 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
76 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
77 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
78 #endif
79 #endif
80 
81 #define RFCOMM_CREDITS 10
82 
83 // FCS calc
84 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
85 #define BT_RFCOMM_CRC_CHECK_LEN     3
86 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
87 
88 // Control field values      bit no.       1 2 3 4 PF 6 7 8
89 #define BT_RFCOMM_SABM       0x3F       // 1 1 1 1  1 1 0 0
90 #define BT_RFCOMM_UA         0x73       // 1 1 0 0  1 1 1 0
91 #define BT_RFCOMM_DM         0x0F       // 1 1 1 1  0 0 0 0
92 #define BT_RFCOMM_DM_PF      0x1F       // 1 1 1 1  1 0 0 0
93 #define BT_RFCOMM_DISC       0x53       // 1 1 0 0  1 0 1 0
94 #define BT_RFCOMM_UIH        0xEF       // 1 1 1 1  0 1 1 1
95 #define BT_RFCOMM_UIH_PF     0xFF       // 1 1 1 1  0 1 1 1
96 
97 // Multiplexer message types
98 #define BT_RFCOMM_CLD_CMD    0xC3
99 #define BT_RFCOMM_FCON_CMD   0xA3
100 #define BT_RFCOMM_FCON_RSP   0xA1
101 #define BT_RFCOMM_FCOFF_CMD  0x63
102 #define BT_RFCOMM_FCOFF_RSP  0x61
103 #define BT_RFCOMM_MSC_CMD    0xE3
104 #define BT_RFCOMM_MSC_RSP    0xE1
105 #define BT_RFCOMM_NSC_RSP    0x11
106 #define BT_RFCOMM_PN_CMD     0x83
107 #define BT_RFCOMM_PN_RSP     0x81
108 #define BT_RFCOMM_RLS_CMD    0x53
109 #define BT_RFCOMM_RLS_RSP    0x51
110 #define BT_RFCOMM_RPN_CMD    0x93
111 #define BT_RFCOMM_RPN_RSP    0x91
112 #define BT_RFCOMM_TEST_CMD   0x23
113 #define BT_RFCOMM_TEST_RSP   0x21
114 
115 typedef enum {
116     CH_EVT_RCVD_SABM = 1,
117     CH_EVT_RCVD_UA,
118     CH_EVT_RCVD_PN,
119     CH_EVT_RCVD_PN_RSP,
120     CH_EVT_RCVD_DISC,
121     CH_EVT_RCVD_DM,
122     CH_EVT_RCVD_MSC_CMD,
123     CH_EVT_RCVD_MSC_RSP,
124     CH_EVT_RCVD_NSC_RSP,
125     CH_EVT_RCVD_RLS_CMD,
126     CH_EVT_RCVD_RLS_RSP,
127     CH_EVT_RCVD_RPN_CMD,
128     CH_EVT_RCVD_RPN_REQ,
129     CH_EVT_RCVD_RPN_RSP,
130     CH_EVT_RCVD_CREDITS,
131     CH_EVT_MULTIPLEXER_READY,
132     CH_EVT_READY_TO_SEND,
133 } RFCOMM_CHANNEL_EVENT;
134 
135 typedef struct rfcomm_channel_event {
136     RFCOMM_CHANNEL_EVENT type;
137     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
138 } rfcomm_channel_event_t;
139 
140 typedef struct rfcomm_channel_event_pn {
141     rfcomm_channel_event_t super;
142     uint16_t max_frame_size;
143     uint8_t  priority;
144     uint8_t  credits_outgoing;
145 } rfcomm_channel_event_pn_t;
146 
147 typedef struct rfcomm_channel_event_rpn {
148     rfcomm_channel_event_t super;
149     rfcomm_rpn_data_t data;
150 } rfcomm_channel_event_rpn_t;
151 
152 typedef struct rfcomm_channel_event_rls {
153     rfcomm_channel_event_t super;
154     uint8_t line_status;
155 } rfcomm_channel_event_rls_t;
156 
157 typedef struct rfcomm_channel_event_msc {
158     rfcomm_channel_event_t super;
159     uint8_t modem_status;
160 } rfcomm_channel_event_msc_t;
161 
162 
163 // global rfcomm data
164 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
165 
166 // linked lists for all
167 static btstack_linked_list_t rfcomm_multiplexers;
168 static btstack_linked_list_t rfcomm_channels;
169 static btstack_linked_list_t rfcomm_services;
170 
171 static gap_security_level_t rfcomm_security_level;
172 
173 #ifdef RFCOMM_USE_ERTM
174 static uint16_t rfcomm_ertm_id;
175 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
176 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
177 #endif
178 
179 #ifdef RFCOMM_USE_OUTGOING_BUFFER
180 static uint8_t outgoing_buffer[1030];
181 #endif
182 
183 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel);
184 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
185 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
186 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
187 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
188 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
189 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
190 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
191 
192 // MARK: RFCOMM CLIENT EVENTS
193 
194 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
195     btstack_linked_item_t *it;
196     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
197         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
198         if (channel->rfcomm_cid == rfcomm_cid) {
199             return channel;
200         };
201     }
202     return NULL;
203 }
204 
205 static uint16_t rfcomm_next_client_cid(void){
206     do {
207         if (rfcomm_client_cid_generator == 0xffff) {
208             // don't use 0 as channel id
209             rfcomm_client_cid_generator = 1;
210         } else {
211             rfcomm_client_cid_generator++;
212         }
213     } while (rfcomm_channel_for_rfcomm_cid(rfcomm_client_cid_generator) != NULL);
214     return rfcomm_client_cid_generator;
215 }
216 
217 #ifdef RFCOMM_USE_ERTM
218 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_ertm_id(uint16_t ertm_id) {
219     btstack_linked_item_t *it;
220     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
221         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
222         if (multiplexer->ertm_id == ertm_id) {
223             return multiplexer;
224         };
225     }
226     return NULL;
227 }
228 
229 static uint16_t rfcomm_next_ertm_id(void){
230     do {
231         if (rfcomm_ertm_id == 0xffff) {
232             // don't use 0 as channel id
233             rfcomm_ertm_id = 1;
234         } else {
235             rfcomm_ertm_id++;
236         }
237     } while (rfcomm_multiplexer_for_ertm_id(rfcomm_ertm_id) != NULL);
238     return rfcomm_ertm_id;
239 }
240 
241 #endif
242 
243 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
244 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
245     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
246              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
247     uint8_t event[13];
248     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
249     event[1] = sizeof(event) - 2;
250     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
251     event[8] = channel->dlci >> 1;
252     little_endian_store_16(event, 9, channel->rfcomm_cid);
253     little_endian_store_16(event, 11, channel->multiplexer->con_handle);
254     hci_dump_btstack_event( event, sizeof(event));
255 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
256 }
257 
258 // API Change: BTstack-0.3.50x uses
259 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
260 // next Cydia release will use SVN version of this
261 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
262 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
263     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
264              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
265              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
266     uint8_t event[18];
267     uint8_t pos = 0;
268     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
269     event[pos++] = sizeof(event) - 2;                   // 1
270     event[pos++] = status;                              // 2
271     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
272     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
273 	event[pos++] = channel->dlci >> 1;                                      // 11
274 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
275 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
276     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
277     hci_dump_btstack_event( event, sizeof(event));
278 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
279 
280     // if channel opened successfully, also send can send now if possible
281     if (status) return;
282     if (rfcomm_channel_can_send(channel)){
283         rfcomm_emit_can_send_now(channel);
284     }
285 }
286 
287 // data: event(8), len(8), rfcomm_cid(16)
288 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
289     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
290     uint8_t event[4];
291     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
292     event[1] = sizeof(event) - 2;
293     little_endian_store_16(event, 2, channel->rfcomm_cid);
294     hci_dump_btstack_event( event, sizeof(event));
295 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
296 }
297 
298 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
299     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
300     uint8_t event[5];
301     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
302     event[1] = sizeof(event) - 2;
303     little_endian_store_16(event, 2, channel->rfcomm_cid);
304     event[4] = line_status;
305     hci_dump_btstack_event( event, sizeof(event));
306     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
307 }
308 
309 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel, bool remote) {
310     // notify client about new settings
311     uint8_t event[2+2+1+sizeof(rfcomm_rpn_data_t)];
312     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
313     event[1] = sizeof(event) - 2;
314     little_endian_store_16(event, 2, channel->rfcomm_cid);
315     if (remote){
316         event[4] = 1;
317         (void)memcpy(&event[5], (uint8_t *) &channel->remote_rpn_data, sizeof(rfcomm_rpn_data_t));
318     } else {
319         event[4] = 0;
320         (void)memcpy(&event[5], (uint8_t *) &channel->local_rpn_data, sizeof(rfcomm_rpn_data_t));
321     }
322     hci_dump_btstack_event( event, sizeof(event));
323     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
324 }
325 
326 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
327     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
328     uint8_t event[4];
329     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
330     event[1] = sizeof(event) - 2;
331     little_endian_store_16(event, 2, channel->rfcomm_cid);
332     hci_dump_btstack_event( event, sizeof(event));
333     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
334 }
335 
336 // MARK RFCOMM RPN DATA HELPER
337 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
338         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
339         rpn_data->flags = 0x03;               /* 8-n-1 */
340         rpn_data->flow_control = 0;           /* no flow control */
341         rpn_data->xon  = 0xd1;                /* XON */
342         rpn_data->xoff = 0xd3;                /* XOFF */
343         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
344         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
345 }
346 
347 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
348     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
349         dest->baud_rate = src->baud_rate;
350     }
351     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
352         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
353     }
354     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
355         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
356     }
357     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
358         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
359     }
360     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
361         dest->flags = (dest->flags & 0xcf) | (src->flags & 0x30);
362     }
363     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
364         dest->xon = src->xon;
365     }
366     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
367         dest->xoff = src->xoff;
368     }
369     uint8_t mask = src->parameter_mask_1 & 0x3f;
370     dest->flow_control = (dest->flow_control & ~mask) | (src->flow_control & mask);
371    // always copy parameter mask, too. informative for client, needed for response
372     dest->parameter_mask_0 = src->parameter_mask_0;
373     dest->parameter_mask_1 = src->parameter_mask_1;
374 }
375 // MARK: RFCOMM MULTIPLEXER HELPER
376 
377 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
378     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
379     uint16_t max_frame_size = l2cap_mtu - 5;
380     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
381     return max_frame_size;
382 }
383 
384 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
385     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
386     multiplexer->fcon = 1;
387     multiplexer->send_dm_for_dlci = 0;
388     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
389     multiplexer->test_data_len = 0;
390     multiplexer->nsc_command = 0;
391 }
392 
393 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
394 
395     // alloc structure
396     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
397     if (!multiplexer) return NULL;
398 
399     // fill in
400     rfcomm_multiplexer_initialize(multiplexer);
401     bd_addr_copy(multiplexer->remote_addr, addr);
402 
403     // add to services list
404     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
405 
406     return multiplexer;
407 }
408 
409 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
410     btstack_linked_item_t *it;
411     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
412         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
413         // ignore multiplexer in shutdown
414         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
415         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
416             return multiplexer;
417         };
418     }
419     return NULL;
420 }
421 
422 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
423     btstack_linked_item_t *it;
424     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
425         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
426         if (multiplexer->l2cap_cid == l2cap_cid) {
427             return multiplexer;
428         };
429     }
430     return NULL;
431 }
432 
433 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
434     btstack_linked_item_t *it;
435     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
436         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
437         if (channel->multiplexer == multiplexer) {
438             return 1;
439         }
440     }
441     return 0;
442 }
443 
444 // MARK: RFCOMM CHANNEL HELPER
445 
446 static void rfcomm_dump_channels(void){
447 #ifdef ENABLE_LOG_INFO
448     btstack_linked_item_t * it;
449     int channels = 0;
450     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
451         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
452         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
453         channels++;
454     }
455 #endif
456 }
457 
458 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
459                                rfcomm_service_t *service, uint8_t server_channel){
460 
461     // set defaults for port configuration (even for services)
462     rfcomm_rpn_data_set_defaults(&channel->local_rpn_data);
463     rfcomm_rpn_data_set_defaults(&channel->remote_rpn_data);
464 
465     channel->state            = RFCOMM_CHANNEL_CLOSED;
466     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
467 
468     channel->multiplexer      = multiplexer;
469     channel->rfcomm_cid       = rfcomm_next_client_cid();
470     channel->max_frame_size   = multiplexer->max_frame_size;
471 
472     channel->credits_incoming = 0;
473     channel->credits_outgoing = 0;
474 
475     // incoming flow control not active
476     channel->new_credits_incoming  = RFCOMM_CREDITS;
477     channel->incoming_flow_control = 0;
478 
479     // nothing to send
480     channel->local_line_status  = RFCOMM_RLS_STATUS_INVALID;
481     channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
482 
483     // modem status - ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
484     channel->local_modem_status  = 0x8d;
485     channel->remote_modem_status = 0x8d;
486 
487     channel->service = service;
488 	if (service) {
489 		// incoming connection
490     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
491         if (channel->max_frame_size > service->max_frame_size) {
492             channel->max_frame_size = service->max_frame_size;
493         }
494         channel->incoming_flow_control = service->incoming_flow_control;
495         channel->new_credits_incoming  = service->incoming_initial_credits;
496         channel->packet_handler        = service->packet_handler;
497 	} else {
498 		// outgoing connection
499 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
500 	}
501 }
502 
503 // service == NULL -> outgoing channel
504 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
505                                                 rfcomm_service_t * service, uint8_t server_channel){
506 
507     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
508     rfcomm_dump_channels();
509 
510     // alloc structure
511     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
512     if (!channel) return NULL;
513 
514     // fill in
515     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
516 
517     // add to services list
518     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
519 
520     return channel;
521 }
522 
523 static void rfcomm_notify_channel_can_send(void){
524     btstack_linked_list_iterator_t it;
525     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
526     while (btstack_linked_list_iterator_has_next(&it)){
527         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
528         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
529         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
530 
531         channel->waiting_for_can_send_now = 0;
532         rfcomm_emit_can_send_now(channel);
533     }
534 }
535 
536 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
537     btstack_linked_item_t *it;
538     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
539         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
540         if ((channel->dlci == dlci) && (channel->multiplexer == multiplexer)) {
541             return channel;
542         };
543     }
544     return NULL;
545 }
546 
547 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
548     btstack_linked_item_t *it;
549     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
550         rfcomm_service_t * service = ((rfcomm_service_t *) it);
551         if ( service->server_channel == server_channel){
552             return service;
553         };
554     }
555     return NULL;
556 }
557 
558 // MARK: RFCOMM SEND
559 
560 /**
561  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
562  */
563 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
564 
565     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
566 
567 #ifdef RFCOMM_USE_OUTGOING_BUFFER
568     uint8_t * rfcomm_out_buffer = outgoing_buffer;
569 #else
570     l2cap_reserve_packet_buffer();
571     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
572 #endif
573 
574 	uint16_t pos = 0;
575 	uint8_t crc_fields = 3;
576 
577 	rfcomm_out_buffer[pos++] = address;
578 	rfcomm_out_buffer[pos++] = control;
579 
580 	// length field can be 1 or 2 octets
581 	if (len < 128){
582 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
583 	} else {
584 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
585 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
586 		crc_fields++;
587 	}
588 
589 	// add credits for UIH frames when PF bit is set
590 	if (control == BT_RFCOMM_UIH_PF){
591 		rfcomm_out_buffer[pos++] = credits;
592 	}
593 
594 	// copy actual data
595 	if (len) {
596 		(void)memcpy(&rfcomm_out_buffer[pos], data, len);
597 		pos += len;
598 	}
599 
600 	// UIH frames only calc FCS over address + control (5.1.1)
601 	if ((control & 0xef) == BT_RFCOMM_UIH){
602 		crc_fields = 2;
603 	}
604 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
605 
606 #ifdef RFCOMM_USE_OUTGOING_BUFFER
607     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
608 #else
609     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
610 #endif
611 
612     return err;
613 }
614 
615 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
616 static uint8_t rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
617 
618     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
619     uint8_t control = BT_RFCOMM_UIH;
620 
621 #ifdef RFCOMM_USE_OUTGOING_BUFFER
622     uint8_t * rfcomm_out_buffer = outgoing_buffer;
623 #else
624     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
625 #endif
626 
627     uint16_t pos = 0;
628     rfcomm_out_buffer[pos++] = address;
629     rfcomm_out_buffer[pos++] = control;
630     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
631     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
632 
633     // actual data is already in place
634     pos += len;
635 
636     // UIH frames only calc FCS over address + control (5.1.1)
637     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
638 
639 #ifdef RFCOMM_USE_OUTGOING_BUFFER
640     uint8_t status = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
641 #else
642     uint8_t status = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
643 #endif
644 
645     return status;
646 }
647 
648 // C/R Flag in Address
649 // - terms: initiator = station that creates multiplexer with SABM
650 // - terms: responder = station that responds to multiplexer setup with UA
651 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
652 //    - command initiator = 1 /response responder = 1
653 //    - command responder = 0 /response initiator = 0
654 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
655 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
656 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
657 
658 // C/R Flag in Message
659 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
660 //   - If the C/R bit is set to 1 the message is a command
661 //   - if it is set to 0 the message is a response.
662 
663 // temp/old messge construction
664 
665 // new object oriented version
666 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
667 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
668     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
669 }
670 
671 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
672 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
673     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
674 }
675 
676 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
677 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
678     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
679 }
680 
681 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
682 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
683     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
684 }
685 
686 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
687     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
688     uint8_t payload[2];
689     uint8_t pos = 0;
690     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
691     payload[pos++] = (0 << 1) | 1;  // len
692     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
693 }
694 
695 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
696 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
697 //     uint8_t payload[2+len];
698 //     uint8_t pos = 0;
699 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
700 //     payload[pos++] = (len + 1) << 1 | 1;  // len
701 //     memcpy(&payload[pos], data, len);
702 //     pos += len;
703 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
704 // }
705 
706 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
707     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
708     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
709     uint8_t pos = 0;
710     payload[pos++] = BT_RFCOMM_TEST_RSP;
711     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
712         len = RFCOMM_TEST_DATA_MAX_LEN;
713     }
714     payload[pos++] = (len << 1) | 1;  // len
715     (void)memcpy(&payload[pos], data, len);
716     pos += len;
717     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
718 }
719 
720 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
721 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
722 	uint8_t payload[4];
723 	uint8_t pos = 0;
724 	payload[pos++] = BT_RFCOMM_MSC_CMD;
725 	payload[pos++] = (2 << 1) | 1;  // len
726 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
727 	payload[pos++] = signals;
728 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
729 }
730 
731 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
732 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
733 	uint8_t payload[4];
734 	uint8_t pos = 0;
735 	payload[pos++] = BT_RFCOMM_MSC_RSP;
736 	payload[pos++] = (2 << 1) | 1;  // len
737 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
738 	payload[pos++] = signals;
739 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
740 }
741 
742 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
743     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
744     uint8_t payload[3];
745     uint8_t pos = 0;
746     payload[pos++] = BT_RFCOMM_NSC_RSP;
747     payload[pos++] = (1 << 1) | 1;  // len
748     payload[pos++] = command;
749     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
750 }
751 
752 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
753 	uint8_t payload[10];
754 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
755 	uint8_t pos = 0;
756 	payload[pos++] = BT_RFCOMM_PN_CMD;
757 	payload[pos++] = (8 << 1) | 1;  // len
758 	payload[pos++] = dlci;
759 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
760 	payload[pos++] = 0; // priority
761 	payload[pos++] = 0; // max 60 seconds ack
762 	payload[pos++] = max_frame_size & 0xff; // max framesize low
763 	payload[pos++] = max_frame_size >> 8;   // max framesize high
764 	payload[pos++] = 0x00; // number of retransmissions
765 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
766 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
767 }
768 
769 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
770 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
771                                        uint8_t priority, uint16_t max_frame_size){
772 	uint8_t payload[10];
773 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
774 	uint8_t pos = 0;
775 	payload[pos++] = BT_RFCOMM_PN_RSP;
776 	payload[pos++] = (8 << 1) | 1;  // len
777 	payload[pos++] = dlci;
778 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
779 	payload[pos++] = priority; // priority
780 	payload[pos++] = 0; // max 60 seconds ack
781 	payload[pos++] = max_frame_size & 0xff; // max framesize low
782 	payload[pos++] = max_frame_size >> 8;   // max framesize high
783 	payload[pos++] = 0x00; // number of retransmissions
784 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
785 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
786 }
787 
788 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
789     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
790     uint8_t payload[4];
791     uint8_t pos = 0;
792     payload[pos++] = BT_RFCOMM_RLS_CMD;
793     payload[pos++] = (2 << 1) | 1;  // len
794     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
795     payload[pos++] = line_status;
796     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
797 }
798 
799 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
800     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
801     uint8_t payload[4];
802     uint8_t pos = 0;
803     payload[pos++] = BT_RFCOMM_RLS_RSP;
804     payload[pos++] = (2 << 1) | 1;  // len
805     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
806     payload[pos++] = line_status;
807     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
808 }
809 
810 static int rfcomm_send_uih_rpn_config(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
811     uint8_t payload[10];
812     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
813     uint8_t pos = 0;
814     payload[pos++] = BT_RFCOMM_RPN_CMD;
815     payload[pos++] = (8 << 1) | 1;  // len
816     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
817     payload[pos++] = rpn_data->baud_rate;
818     payload[pos++] = rpn_data->flags;
819     payload[pos++] = rpn_data->flow_control;
820     payload[pos++] = rpn_data->xon;
821     payload[pos++] = rpn_data->xoff;
822     payload[pos++] = rpn_data->parameter_mask_0;
823     payload[pos++] = rpn_data->parameter_mask_1;
824     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
825 }
826 
827 static int rfcomm_send_uih_rpn_query(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
828     uint8_t payload[3];
829     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
830     uint8_t pos = 0;
831     payload[pos++] = BT_RFCOMM_RPN_CMD;
832     payload[pos++] = (1 << 1) | 1;  // len
833     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
834     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
835 }
836 
837 static int rfcomm_send_uih_rpn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
838 	uint8_t payload[10];
839 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
840 	uint8_t pos = 0;
841 	payload[pos++] = BT_RFCOMM_RPN_RSP;
842 	payload[pos++] = (8 << 1) | 1;  // len
843 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
844 	payload[pos++] = rpn_data->baud_rate;
845 	payload[pos++] = rpn_data->flags;
846 	payload[pos++] = rpn_data->flow_control;
847 	payload[pos++] = rpn_data->xon;
848 	payload[pos++] = rpn_data->xoff;
849 	payload[pos++] = rpn_data->parameter_mask_0;
850 	payload[pos++] = rpn_data->parameter_mask_1;
851 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
852 }
853 
854 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
855     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
856     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
857 }
858 
859 // depending on channel state emit channel opened with status or channel closed
860 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
861     // emit appropriate events
862     switch(channel->state){
863         case RFCOMM_CHANNEL_OPEN:
864         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
865             rfcomm_emit_channel_closed(channel);
866             break;
867         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
868             // remote didn't wait until we send the UA disc
869             // close event already emitted
870             break;
871         default:
872             rfcomm_emit_channel_opened(channel, status);
873             break;
874     }
875 }
876 
877 // MARK: RFCOMM MULTIPLEXER
878 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
879     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
880     btstack_memory_rfcomm_multiplexer_free(multiplexer);
881 }
882 
883 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
884     // close and remove all channels
885     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
886     while (it->next){
887         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
888         if (channel->multiplexer == multiplexer) {
889             // emit open with status or closed
890             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
891             // remove from list
892             it->next = it->next->next;
893             // free channel struct
894             btstack_memory_rfcomm_channel_free(channel);
895         } else {
896             it = it->next;
897         }
898     }
899 
900     // remove mutliplexer
901     rfcomm_multiplexer_free(multiplexer);
902 }
903 
904 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
905     log_info("Multiplexer up and running");
906     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
907 
908     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
909 
910     // transition of channels that wait for multiplexer
911     btstack_linked_item_t *it;
912     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
913         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
914         if (channel->multiplexer != multiplexer) continue;
915         int rfcomm_channel_valid = 1;
916         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
917         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
918             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
919         }
920     }
921 
922     // request can send now for multiplexer if ready
923     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
924         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
925     }
926 }
927 
928 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
929 
930     log_debug("can_send_now enter: %u", l2cap_cid);
931 
932     btstack_linked_list_iterator_t it;
933     int token_consumed = 0;
934 
935     // forward token to multiplexer
936     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
937     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
938         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
939         if (multiplexer->l2cap_cid != l2cap_cid) continue;
940         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
941             log_debug("can_send_now enter: multiplexer token");
942             token_consumed = 1;
943             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
944         }
945     }
946 
947     // forward token to channel state machine
948     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
949     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
950         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
951         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
952         // channel state machine
953         if (rfcomm_channel_ready_to_send(channel)){
954             log_debug("can_send_now enter: channel token");
955             token_consumed = 1;
956             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
957             int rfcomm_channel_valid = 1;
958             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
959         }
960     }
961 
962     // forward token to client
963     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
964     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
965         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
966         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
967         // client waiting for can send now
968         if (!channel->waiting_for_can_send_now)    continue;
969         if ((channel->multiplexer->fcon & 1) == 0) continue;
970         if (!channel->credits_outgoing){
971             log_debug("can_send_now waiting to send but no credits (ignore)");
972             continue;
973         }
974 
975         log_debug("can_send_now enter: client token");
976         token_consumed = 1;
977         channel->waiting_for_can_send_now = 0;
978         rfcomm_emit_can_send_now(channel);
979     }
980 
981     // if token was consumed, request another one
982     if (token_consumed) {
983         l2cap_request_can_send_now_event(l2cap_cid);
984     }
985 
986     log_debug("can_send_now exit");
987 }
988 
989 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
990     multiplexer->state = state;
991     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
992 }
993 
994 /**
995  * @return handled packet
996  */
997 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
998 
999     UNUSED(size);   // ok: handling own l2cap events
1000 
1001     bd_addr_t event_addr;
1002     uint16_t l2cap_cid;
1003     hci_con_handle_t con_handle;
1004     rfcomm_multiplexer_t *multiplexer = NULL;
1005     uint8_t status;
1006 
1007     switch (hci_event_packet_get_type(packet)) {
1008 
1009         // accept incoming rfcomm connection if no multiplexer exists yet
1010         case L2CAP_EVENT_INCOMING_CONNECTION:
1011             l2cap_event_incoming_connection_get_address(packet, event_addr);
1012             con_handle = l2cap_event_incoming_connection_get_handle(packet);
1013             l2cap_cid  = l2cap_event_incoming_connection_get_local_cid(packet);
1014 
1015             btstack_assert(l2cap_event_incoming_connection_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1016 
1017             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1018 
1019             if (multiplexer) {
1020                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - multiplexer already exists", l2cap_cid);
1021                 l2cap_decline_connection(l2cap_cid);
1022                 return 1;
1023             }
1024 
1025             // create and inititialize new multiplexer instance (incoming)
1026             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
1027             if (!multiplexer){
1028                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - no memory left", l2cap_cid);
1029                 l2cap_decline_connection(l2cap_cid);
1030                 return 1;
1031             }
1032 
1033             multiplexer->con_handle = con_handle;
1034             multiplexer->l2cap_cid = l2cap_cid;
1035             //
1036             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1037             log_info("RFCOMM incoming (l2cap_cid 0x%02x) => accept", l2cap_cid);
1038 
1039 #ifdef RFCOMM_USE_ERTM
1040             // request
1041             rfcomm_ertm_request_t request;
1042             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1043             (void)memcpy(request.addr, event_addr, 6);
1044             request.ertm_id = rfcomm_next_ertm_id();
1045             if (rfcomm_ertm_request_callback){
1046                 (*rfcomm_ertm_request_callback)(&request);
1047             }
1048             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1049                 multiplexer->ertm_id = request.ertm_id;
1050                 l2cap_ertm_accept_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1051                 return 1;
1052             }
1053 #endif
1054 
1055             l2cap_accept_connection(l2cap_cid);
1056             return 1;
1057 
1058         // l2cap connection opened -> store l2cap_cid, remote_addr
1059         case L2CAP_EVENT_CHANNEL_OPENED:
1060 
1061             btstack_assert(l2cap_event_channel_opened_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1062 
1063             status = l2cap_event_channel_opened_get_status(packet);
1064             log_info("channel opened, status %u", status);
1065 
1066             // get multiplexer for remote addr
1067             con_handle = l2cap_event_channel_opened_get_handle(packet);
1068             l2cap_cid = l2cap_event_channel_opened_get_local_cid(packet);
1069             l2cap_event_channel_opened_get_address(packet, event_addr);
1070             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1071             if (!multiplexer) {
1072                 log_error("channel opened but no multiplexer prepared");
1073                 return 1;
1074             }
1075 
1076             // set con handle for outgoing (already set for incoming)
1077             multiplexer->con_handle = con_handle;
1078 
1079             // on l2cap open error discard everything
1080             if (status){
1081 
1082                 // mark multiplexer as shutting down
1083                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1084 
1085                 // emit rfcomm_channel_opened with status and free channel
1086                 // note: repeatedly go over list until full iteration causes no further change
1087                 int done;
1088                 do {
1089                     done = 1;
1090                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1091                     while (it->next) {
1092                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1093                         if (channel->multiplexer == multiplexer){
1094                             done = 0;
1095                             rfcomm_emit_channel_opened(channel, status);
1096                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1097                             btstack_memory_rfcomm_channel_free(channel);
1098                             break;
1099                         } else {
1100                             it = it->next;
1101                         }
1102                     }
1103                 } while (!done);
1104 
1105                 // free multiplexer
1106                 rfcomm_multiplexer_free(multiplexer);
1107                 return 1;
1108             }
1109 
1110             // following could be: rfcomm_multiplexer_state_machine(..., EVENT_L2CAP_OPENED)
1111 
1112             // set max frame size based on l2cap MTU
1113             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1114 
1115             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1116                 log_info("channel opened: outgoing connection");
1117                 multiplexer->l2cap_cid = l2cap_cid;
1118                 // send SABM #0
1119                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1120             }
1121             return 1;
1122 
1123             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1124 
1125         // Notify channel packet handler if they can send now
1126         case L2CAP_EVENT_CAN_SEND_NOW:
1127             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1128             rfcomm_handle_can_send_now(l2cap_cid);
1129             return 1;
1130 
1131         case L2CAP_EVENT_CHANNEL_CLOSED:
1132             l2cap_cid = l2cap_event_channel_closed_get_local_cid(packet);
1133             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1134             log_info("channel closed cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1135             if (!multiplexer) break;
1136             log_info("channel closed state %u", multiplexer->state);
1137             // no need to call l2cap_disconnect here, as it's already closed
1138             rfcomm_multiplexer_finalize(multiplexer);
1139             return 1;
1140 
1141 #ifdef RFCOMM_USE_ERTM
1142         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1143             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1144             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1145             if (multiplexer) {
1146                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1147                 if (rfcomm_ertm_released_callback){
1148                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1149                 }
1150             }
1151             break;
1152 #endif
1153 
1154         default:
1155             break;
1156     }
1157     return 0;
1158 }
1159 
1160 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1161     // get or create a multiplexer for a certain device
1162     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1163     if (!multiplexer) return 0;
1164 
1165     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1166 
1167     if (size < 3) return 0;
1168 
1169 	// but only care for multiplexer control channel
1170     uint8_t frame_dlci = packet[0] >> 2;
1171     if (frame_dlci) return 0;
1172     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1173     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1174     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1175     switch (packet[1]){
1176 
1177         case BT_RFCOMM_SABM:
1178             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1179                 log_info("Received SABM #0");
1180                 multiplexer->outgoing = 0;
1181                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1182                 return 1;
1183             }
1184             break;
1185 
1186         case BT_RFCOMM_UA:
1187             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1188                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1189                 log_info("Received UA #0 ");
1190                 rfcomm_multiplexer_opened(multiplexer);
1191                 return 1;
1192             }
1193             break;
1194 
1195         case BT_RFCOMM_DISC:
1196             // DISC #0 -> send UA #0, close multiplexer
1197             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1198             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1199             return 1;
1200 
1201         case BT_RFCOMM_DM:
1202             // DM #0 - we shouldn't get this, just give up
1203             log_info("Received DM #0");
1204             log_info("-> Closing down multiplexer");
1205             rfcomm_multiplexer_finalize(multiplexer);
1206             l2cap_disconnect(l2cap_cid);
1207             return 1;
1208 
1209         case BT_RFCOMM_UIH:
1210             if (payload_offset >= size) return 0;
1211 
1212             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1213                 // Multiplexer close down (CLD) -> close mutliplexer
1214                 log_info("Received Multiplexer close down command");
1215                 log_info("-> Closing down multiplexer");
1216                 rfcomm_multiplexer_finalize(multiplexer);
1217                 l2cap_disconnect(l2cap_cid);
1218                 return 1;
1219             }
1220             switch (packet[payload_offset]){
1221                 case BT_RFCOMM_CLD_CMD:
1222                      // Multiplexer close down (CLD) -> close mutliplexer
1223                     log_info("Received Multiplexer close down command");
1224                     log_info("-> Closing down multiplexer");
1225                     rfcomm_multiplexer_finalize(multiplexer);
1226                     l2cap_disconnect(l2cap_cid);
1227                     return 1;
1228 
1229                 case BT_RFCOMM_FCON_CMD:
1230                     multiplexer->fcon = 0x81;
1231                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1232                     return 1;
1233 
1234                 case BT_RFCOMM_FCOFF_CMD:
1235                     multiplexer->fcon = 0x80;
1236                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1237                     return 1;
1238 
1239                 case BT_RFCOMM_TEST_CMD: {
1240                     if ((payload_offset + 1) >= size) return 0; // (1)
1241                     log_info("Received test command");
1242                     int len = packet[payload_offset+1] >> 1; // length < 125
1243                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1244                         len = RFCOMM_TEST_DATA_MAX_LEN;
1245                     }
1246                     // from (1) => (size - 1 - payload_offset) > 0
1247                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1248                     multiplexer->test_data_len = len;
1249                     (void)memcpy(multiplexer->test_data,
1250                                  &packet[payload_offset + 2], len);
1251                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1252                     return 1;
1253                 }
1254                 default:
1255                     break;
1256             }
1257             break;
1258 
1259         default:
1260             break;
1261 
1262     }
1263     return 0;
1264 }
1265 
1266 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1267     if (multiplexer->send_dm_for_dlci) return 1;
1268     if (multiplexer->nsc_command) return 1;
1269     if (multiplexer->fcon & 0x80) return 1;
1270     switch (multiplexer->state){
1271         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1272         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1273         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1274             return 1;
1275         case RFCOMM_MULTIPLEXER_OPEN:
1276             if (multiplexer->test_data_len) {
1277                 return 1;
1278             }
1279             break;
1280         default:
1281             break;
1282     }
1283     return 0;
1284 }
1285 
1286 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1287 
1288     if (event != MULT_EV_READY_TO_SEND) return;
1289 
1290     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1291 
1292     // process stored DM responses
1293     if (multiplexer->send_dm_for_dlci){
1294         uint8_t dlci = multiplexer->send_dm_for_dlci;
1295         multiplexer->send_dm_for_dlci = 0;
1296         rfcomm_send_dm_pf(multiplexer, dlci);
1297         return;
1298     }
1299 
1300     if (multiplexer->nsc_command){
1301         uint8_t command = multiplexer->nsc_command;
1302         multiplexer->nsc_command = 0;
1303         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1304         return;
1305     }
1306 
1307     if (multiplexer->fcon & 0x80){
1308         multiplexer->fcon &= 0x01;
1309         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1310 
1311         if (multiplexer->fcon == 0) return;
1312         // trigger client to send again after sending FCon Response
1313         rfcomm_notify_channel_can_send();
1314         return;
1315     }
1316 
1317     switch (multiplexer->state) {
1318         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1319             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1320             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1321             rfcomm_send_sabm(multiplexer, 0);
1322             break;
1323         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1324             log_info("Sending UA #0");
1325             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1326             rfcomm_send_ua(multiplexer, 0);
1327 
1328             rfcomm_multiplexer_opened(multiplexer);
1329             break;
1330         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1331             log_info("Sending UA #0");
1332             log_info("Closing down multiplexer");
1333             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1334             rfcomm_send_ua(multiplexer, 0);
1335 
1336             rfcomm_multiplexer_finalize(multiplexer);
1337             l2cap_disconnect(l2cap_cid);
1338             break;
1339         case RFCOMM_MULTIPLEXER_OPEN:
1340             // respond to test command
1341             if (multiplexer->test_data_len){
1342                 int len = multiplexer->test_data_len;
1343                 log_info("Sending TEST Response with %u bytes", len);
1344                 multiplexer->test_data_len = 0;
1345                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1346                 return;
1347             }
1348             break;
1349         default:
1350             break;
1351     }
1352 }
1353 
1354 // MARK: RFCOMM CHANNEL
1355 
1356 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1357     channel->credits_incoming += credits;
1358     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1359 }
1360 
1361 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel){
1362     log_debug("cid 0x%04x, outgoing credits %u", channel->rfcomm_cid, channel->credits_outgoing);
1363     if (!channel->credits_outgoing) return false;
1364     if ((channel->multiplexer->fcon & 1) == 0) return false;
1365     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid) != 0;
1366 }
1367 
1368 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1369 
1370     log_info("opened");
1371 
1372     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1373     rfcomm_emit_channel_opened(rfChannel, 0);
1374     rfcomm_emit_port_configuration(rfChannel, false);
1375 
1376     // hack for problem detecting authentication failure
1377     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1378     multiplexer->at_least_one_connection = 1;
1379 
1380     // request can send now if channel ready
1381     if (rfcomm_channel_ready_to_send(rfChannel)){
1382         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1383     }
1384 }
1385 
1386 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1387     const uint8_t frame_dlci = packet[0] >> 2;
1388     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1389     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1390     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1391     int request_can_send_now = 0;
1392 
1393     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1394     if (!channel) return;
1395 
1396     // handle new outgoing credits
1397     if (packet[1] == BT_RFCOMM_UIH_PF) {
1398 
1399         // add them
1400         uint16_t new_credits = packet[3+length_offset];
1401         channel->credits_outgoing += new_credits;
1402         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1403 
1404         // notify channel statemachine
1405         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1406         log_debug("state machine, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1407         int rfcomm_channel_valid = 1;
1408         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1409         if (rfcomm_channel_valid){
1410             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1411                 request_can_send_now = 1;
1412             }
1413         }
1414     }
1415 
1416     // contains payload?
1417     if ((size - 1) > payload_offset){
1418 
1419         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1420 
1421         // decrease incoming credit counter
1422         if (channel->credits_incoming > 0){
1423             channel->credits_incoming--;
1424         }
1425 
1426         // deliver payload
1427         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1428                               &packet[payload_offset], size-payload_offset-1);
1429     }
1430 
1431     // automatically provide new credits to remote device, if no incoming flow control
1432     if (!channel->incoming_flow_control && (channel->credits_incoming < 5)){
1433         channel->new_credits_incoming = RFCOMM_CREDITS;
1434         request_can_send_now = 1;
1435     }
1436 
1437     if (request_can_send_now){
1438         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1439     }
1440 }
1441 
1442 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1443     // priority of client request
1444     channel->pn_priority = event->priority;
1445 
1446     // new credits
1447     channel->credits_outgoing = event->credits_outgoing;
1448 
1449     // negotiate max frame size
1450     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1451         channel->max_frame_size = channel->multiplexer->max_frame_size;
1452     }
1453     if (channel->max_frame_size > event->max_frame_size) {
1454         channel->max_frame_size = event->max_frame_size;
1455     }
1456 
1457 }
1458 
1459 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1460     // remove from list
1461     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1462 
1463     // free channel
1464     btstack_memory_rfcomm_channel_free(channel);
1465 }
1466 
1467 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1468 
1469     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1470 
1471 
1472     // lookup existing channel
1473     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1474 
1475     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1476 
1477     if (channel) {
1478         int rfcomm_channel_valid = 1;
1479         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1480         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1481             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1482         }
1483         return;
1484     }
1485 
1486     // service registered?
1487     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1488     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1489     if (!service) {
1490         // discard request by sending disconnected mode
1491         multiplexer->send_dm_for_dlci = dlci;
1492         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1493         return;
1494     }
1495 
1496     // create channel for some events
1497     switch (event->type) {
1498         case CH_EVT_RCVD_SABM:
1499         case CH_EVT_RCVD_PN:
1500         case CH_EVT_RCVD_RPN_REQ:
1501         case CH_EVT_RCVD_RPN_CMD:
1502             // setup incoming channel
1503             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1504             if (!channel){
1505                 // discard request by sending disconnected mode
1506                 multiplexer->send_dm_for_dlci = dlci;
1507                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1508             }
1509             break;
1510         default:
1511             break;
1512     }
1513 
1514     if (!channel) {
1515         // discard request by sending disconnected mode
1516         multiplexer->send_dm_for_dlci = dlci;
1517         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1518         return;
1519     }
1520 
1521     int rfcomm_channel_valid = 1;
1522     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1523     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1524         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1525     }
1526 }
1527 
1528 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1529 
1530     UNUSED(size);   // ok: fixed format messages
1531 
1532     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1533     const uint8_t frame_dlci = packet[0] >> 2;
1534     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1535 	uint8_t message_len;  //   "
1536 
1537     // rfcomm: (1) command/control
1538     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1539     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1540     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1541     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1542     // rfcomm: (3+length_offset) credits if credits_offset == 1
1543     // rfcomm: (3+length_offest+credits_offset)
1544     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1545 
1546     rfcomm_channel_event_t event;
1547     rfcomm_channel_event_pn_t event_pn;
1548     rfcomm_channel_event_rpn_t event_rpn;
1549     rfcomm_channel_event_msc_t event_msc;
1550 
1551     // switch by rfcomm message type
1552     switch(packet[1]) {
1553 
1554         case BT_RFCOMM_SABM:
1555             event.type = CH_EVT_RCVD_SABM;
1556             log_info("Received SABM #%u", frame_dlci);
1557             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1558             break;
1559 
1560         case BT_RFCOMM_UA:
1561             event.type = CH_EVT_RCVD_UA;
1562             log_info("Received UA #%u",frame_dlci);
1563             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1564             break;
1565 
1566         case BT_RFCOMM_DISC:
1567             event.type = CH_EVT_RCVD_DISC;
1568             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1569             break;
1570 
1571         case BT_RFCOMM_DM:
1572         case BT_RFCOMM_DM_PF:
1573             event.type = CH_EVT_RCVD_DM;
1574             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1575             break;
1576 
1577         case BT_RFCOMM_UIH_PF:
1578         case BT_RFCOMM_UIH:
1579 
1580             message_len  = packet[payload_offset+1] >> 1;
1581 
1582             switch (packet[payload_offset]) {
1583                 case BT_RFCOMM_PN_CMD:
1584                     message_dlci = packet[payload_offset+2];
1585                     event_pn.super.type = CH_EVT_RCVD_PN;
1586                     event_pn.priority = packet[payload_offset+4];
1587                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1588                     event_pn.credits_outgoing = packet[payload_offset+9];
1589                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1590                         message_dlci, event_pn.credits_outgoing);
1591                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1592                     break;
1593 
1594                 case BT_RFCOMM_PN_RSP:
1595                     message_dlci = packet[payload_offset+2];
1596                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1597                     event_pn.priority = packet[payload_offset+4];
1598                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1599                     event_pn.credits_outgoing = packet[payload_offset+9];
1600                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1601                             event_pn.max_frame_size, event_pn.credits_outgoing);
1602                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1603                     break;
1604 
1605                 case BT_RFCOMM_MSC_CMD:
1606                     message_dlci = packet[payload_offset+2] >> 2;
1607                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1608                     event_msc.modem_status = packet[payload_offset+3];
1609                     log_info("Received MSC CMD for #%u, ", message_dlci);
1610                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1611                     break;
1612 
1613                 case BT_RFCOMM_MSC_RSP:
1614                     message_dlci = packet[payload_offset+2] >> 2;
1615                     event.type = CH_EVT_RCVD_MSC_RSP;
1616                     log_info("Received MSC RSP for #%u", message_dlci);
1617                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1618                     break;
1619 
1620                 case BT_RFCOMM_RPN_CMD:
1621                     message_dlci = packet[payload_offset+2] >> 2;
1622                     switch (message_len){
1623                         case 1:
1624                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1625                             event.type = CH_EVT_RCVD_RPN_REQ;
1626                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1627                             break;
1628                         case 8:
1629                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1630                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1631                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1632                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1633                             break;
1634                         default:
1635                             break;
1636                     }
1637                     break;
1638 
1639                 case BT_RFCOMM_RPN_RSP:
1640                     message_dlci = packet[payload_offset+2] >> 2;
1641                     if (message_len != 8) break;
1642                     event_rpn.super.type = CH_EVT_RCVD_RPN_RSP;
1643                     event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1644                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1645                     break;
1646 
1647                 case BT_RFCOMM_RLS_CMD: {
1648                     log_info("Received RLS command");
1649                     message_dlci = packet[payload_offset+2] >> 2;
1650                     rfcomm_channel_event_rls_t event_rls;
1651                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1652                     event_rls.line_status = packet[payload_offset+3];
1653                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1654                     break;
1655                 }
1656 
1657                 case BT_RFCOMM_RLS_RSP:
1658                     log_info("Received RLS response");
1659                     break;
1660 
1661                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1662                 // case BT_RFCOMM_TEST_CMD:
1663                 // case BT_RFCOMM_FCOFF_CMD:
1664                 // case BT_RFCOMM_FCON_CMD:
1665                 // everything else is an not supported command
1666                 default: {
1667                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1668                     multiplexer->nsc_command = packet[payload_offset];
1669                     break;
1670                 }
1671             }
1672             break;
1673 
1674         default:
1675             log_error("Received unknown RFCOMM message type %x", packet[1]);
1676             break;
1677     }
1678 
1679     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1680     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1681         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1682     }
1683 }
1684 
1685 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1686 
1687     if (packet_type == HCI_EVENT_PACKET){
1688         rfcomm_hci_event_handler(packet, size);
1689         return;
1690     }
1691 
1692     // we only handle l2cap packets for:
1693     if (packet_type != L2CAP_DATA_PACKET) return;
1694 
1695     //  - multiplexer itself
1696     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1697 
1698     if (handled) return;
1699 
1700     // - channel over open multiplexer
1701     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1702     if ( (multiplexer == NULL) || (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN)) return;
1703 
1704     // channel data ?
1705     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1706     const uint8_t frame_dlci = packet[0] >> 2;
1707 
1708     if (frame_dlci && ((packet[1] == BT_RFCOMM_UIH) || (packet[1] == BT_RFCOMM_UIH_PF))) {
1709         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1710         return;
1711     }
1712 
1713     rfcomm_channel_packet_handler(multiplexer, packet, size);
1714 }
1715 
1716 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1717     // note: exchanging MSC isn't neccessary to consider channel open
1718     // note: having outgoing credits is also not necessary to consider channel open
1719     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1720     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1721     // if (channel->credits_outgoing == 0) return 0;
1722     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %08" PRIx32 ", rf credits %u",
1723          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1724     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1725     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1726 
1727     return 1;
1728 }
1729 
1730 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1731     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %08" PRIx32, channel->state_var);
1732     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1733     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1734     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1735     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1736     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1737     return 1;
1738 }
1739 
1740 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, uint32_t flag){
1741     channel->state_var |= flag;
1742 }
1743 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, uint32_t flag){
1744     channel->state_var &= ~flag;
1745 }
1746 
1747 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1748     switch (channel->state){
1749         case RFCOMM_CHANNEL_SEND_UIH_PN:
1750             log_debug("ch-ready: state %u", channel->state);
1751             return 1;
1752         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1753             log_debug("ch-ready: state %u", channel->state);
1754             return 1;
1755         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1756             log_debug("ch-ready: state %u", channel->state);
1757             return 1;
1758         case RFCOMM_CHANNEL_SEND_DISC:
1759             log_debug("ch-ready: state %u", channel->state);
1760             return 1;
1761         case RFCOMM_CHANNEL_SEND_DM:
1762             log_debug("ch-ready: state %u", channel->state);
1763             return 1;
1764         case RFCOMM_CHANNEL_OPEN:
1765             if (channel->new_credits_incoming) {
1766                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1767                 return 1;
1768             }
1769             break;
1770         case RFCOMM_CHANNEL_DLC_SETUP:
1771             if (channel->state_var & (
1772                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1773                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1774              )) {
1775                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1776                 return 1;
1777             }
1778             break;
1779 
1780         default:
1781             break;
1782     }
1783 
1784     if (channel->state_var & (
1785         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP       |
1786         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY    |
1787         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG   |
1788         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE |
1789         RFCOMM_CHANNEL_STATE_VAR_SEND_UA           |
1790         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD      |
1791         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1792                              )){
1793         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1794         return 1;
1795     }
1796 
1797     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) {
1798         log_debug("ch-ready: rls_line_status");
1799         return 1;
1800     }
1801 
1802     if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID) {
1803         log_debug("ch-ready: rls_line_status");
1804         return 1;
1805     }
1806 
1807     return 0;
1808 }
1809 
1810 
1811 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1812 
1813     // channel != NULL -> channel valid
1814     *out_channel_valid = 1;
1815 
1816     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1817 
1818     // TODO: integrate in common switch
1819     if (event->type == CH_EVT_RCVD_DISC){
1820         rfcomm_emit_channel_closed(channel);
1821         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1822         return;
1823     }
1824 
1825     // TODO: integrate in common switch
1826     if (event->type == CH_EVT_RCVD_DM){
1827         log_info("Received DM message for #%u", channel->dlci);
1828         log_info("-> Closing channel locally for #%u", channel->dlci);
1829         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1830         rfcomm_channel_finalize(channel);
1831         *out_channel_valid = 0;
1832         return;
1833     }
1834 
1835     // remote port negotiation command - just accept everything for now
1836     //
1837     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1838     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1839     //   (Although the handling of individual settings are implementation-dependent.)"
1840     //
1841 
1842     // TODO: integrate in common switch
1843     if (event->type == CH_EVT_RCVD_RPN_CMD){
1844         // control port parameters
1845         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1846         rfcomm_rpn_data_update(&channel->local_rpn_data, &event_rpn->data);
1847         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1848         // notify client about new settings
1849         rfcomm_emit_port_configuration(channel, false);
1850         return;
1851     }
1852 
1853     // TODO: integrate in common switch
1854     if (event->type == CH_EVT_RCVD_RPN_REQ){
1855         // no values got accepted (no values have beens sent)
1856         channel->local_rpn_data.parameter_mask_0 = 0x00;
1857         channel->local_rpn_data.parameter_mask_1 = 0x00;
1858         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1859         return;
1860     }
1861 
1862     if (event->type == CH_EVT_RCVD_RLS_CMD){
1863         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1864         channel->remote_line_status = event_rls->line_status & 0x0f;
1865         log_info("CH_EVT_RCVD_RLS_CMD remote line status 0x%0x", channel->remote_line_status);
1866         rfcomm_emit_remote_line_status(channel, channel->remote_line_status);
1867         return;
1868     }
1869 
1870     // TODO: integrate in common switch
1871     if (event->type == CH_EVT_READY_TO_SEND){
1872         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY){
1873             log_info("Sending Remote Port Configuration Query for #%u", channel->dlci);
1874             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY);
1875             rfcomm_send_uih_rpn_query(channel->multiplexer, channel->dlci);
1876             return;
1877         }
1878         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG){
1879             log_info("Sending Remote Port Configuration for #%u", channel->dlci);
1880             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
1881             rfcomm_send_uih_rpn_config(channel->multiplexer, channel->dlci, &channel->remote_rpn_data);
1882             return;
1883         }
1884         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE){
1885             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1886             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1887             rfcomm_send_uih_rpn_response(multiplexer, channel->dlci, &channel->local_rpn_data);
1888             return;
1889         }
1890         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
1891             log_info("Sending MSC CMD for #%u", channel->dlci);
1892             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1893             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
1894             rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , channel->local_modem_status);
1895             return;
1896         }
1897         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1898             log_info("Sending MSC RSP for #%u", channel->dlci);
1899             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1900             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1901             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, channel->remote_modem_status);
1902             return;
1903         }
1904         if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID){
1905             log_info("Sending RLS CMD 0x%0x", channel->local_line_status);
1906             uint8_t line_status = channel->local_line_status;
1907             channel->local_line_status = RFCOMM_RLS_STATUS_INVALID;
1908             rfcomm_send_uih_rls_cmd(multiplexer, channel->dlci, line_status);
1909             return;
1910         }
1911         if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID){
1912             log_info("Sending RLS RSP 0x%0x", channel->remote_line_status);
1913             uint8_t line_status = channel->remote_line_status;
1914             channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
1915             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1916             return;
1917         }
1918     }
1919 
1920     // emit MSC status to app
1921     if (event->type == CH_EVT_RCVD_MSC_CMD){
1922         // notify client about new settings
1923         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1924         uint8_t modem_status_event[5];
1925         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1926         modem_status_event[1] = sizeof(event) - 2;
1927         little_endian_store_16(modem_status_event, 2, channel->rfcomm_cid);
1928         modem_status_event[4] = event_msc->modem_status;
1929         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1930         // no return, MSC_CMD will be handled by state machine below
1931     }
1932 
1933     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1934 
1935     switch (channel->state) {
1936         case RFCOMM_CHANNEL_CLOSED:
1937             switch (event->type){
1938                 case CH_EVT_RCVD_SABM:
1939                     log_info("-> Inform app");
1940                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1941                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1942                     rfcomm_emit_connection_request(channel);
1943                     break;
1944                 case CH_EVT_RCVD_PN:
1945                     rfcomm_channel_accept_pn(channel, event_pn);
1946                     log_info("-> Inform app");
1947                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1948                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1949                     rfcomm_emit_connection_request(channel);
1950                     break;
1951                 default:
1952                     break;
1953             }
1954             break;
1955 
1956         case RFCOMM_CHANNEL_INCOMING_SETUP:
1957             switch (event->type){
1958                 case CH_EVT_RCVD_SABM:
1959                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1960                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1961                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1962                     }
1963                     break;
1964                 case CH_EVT_RCVD_PN:
1965                     rfcomm_channel_accept_pn(channel, event_pn);
1966                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1967                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1968                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1969                     }
1970                     break;
1971                 case CH_EVT_READY_TO_SEND:
1972                     // if / else if is used to check for state transition after sending
1973                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
1974                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
1975                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1976                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
1977                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
1978                         log_info("Sending UA #%u", channel->dlci);
1979                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1980                         rfcomm_send_ua(multiplexer, channel->dlci);
1981                     }
1982                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
1983                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
1984                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1985                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1986                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1987                      }
1988                     break;
1989                 default:
1990                     break;
1991             }
1992             break;
1993 
1994         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
1995             switch (event->type) {
1996                 case CH_EVT_MULTIPLEXER_READY:
1997                     log_info("Muliplexer opened, sending UIH PN next");
1998                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
1999                     break;
2000                 default:
2001                     break;
2002             }
2003             break;
2004 
2005         case RFCOMM_CHANNEL_SEND_UIH_PN:
2006             switch (event->type) {
2007                 case CH_EVT_READY_TO_SEND:
2008                     // update mtu
2009                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
2010                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
2011                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
2012                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
2013                     break;
2014                 default:
2015                     break;
2016             }
2017             break;
2018 
2019         case RFCOMM_CHANNEL_W4_PN_RSP:
2020             switch (event->type){
2021                 case CH_EVT_RCVD_PN_RSP:
2022                     // update max frame size
2023                     if (channel->max_frame_size > event_pn->max_frame_size) {
2024                         channel->max_frame_size = event_pn->max_frame_size;
2025                     }
2026                     // new credits
2027                     channel->credits_outgoing = event_pn->credits_outgoing;
2028                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
2029                     break;
2030                 default:
2031                     break;
2032             }
2033             break;
2034 
2035         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
2036             switch (event->type) {
2037                 case CH_EVT_READY_TO_SEND:
2038                     log_info("Sending SABM #%u", channel->dlci);
2039                     channel->state = RFCOMM_CHANNEL_W4_UA;
2040                     rfcomm_send_sabm(multiplexer, channel->dlci);
2041                     break;
2042                 default:
2043                     break;
2044             }
2045             break;
2046 
2047         case RFCOMM_CHANNEL_W4_UA:
2048             switch (event->type){
2049                 case CH_EVT_RCVD_UA:
2050                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2051                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2052                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2053                     break;
2054                 default:
2055                     break;
2056             }
2057             break;
2058 
2059         case RFCOMM_CHANNEL_DLC_SETUP:
2060             switch (event->type){
2061                 case CH_EVT_RCVD_MSC_CMD:
2062                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2063                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2064                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2065                     break;
2066                 case CH_EVT_RCVD_MSC_RSP:
2067                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2068                     break;
2069 
2070                 case CH_EVT_READY_TO_SEND:
2071                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2072                         log_info("Providing credits for #%u", channel->dlci);
2073                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2074                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2075                         if (channel->new_credits_incoming) {
2076                             uint8_t new_credits = channel->new_credits_incoming;
2077                             channel->new_credits_incoming = 0;
2078                             rfcomm_channel_send_credits(channel, new_credits);
2079                         }
2080                         break;
2081                     }
2082                     break;
2083                 default:
2084                     break;
2085             }
2086             // finally done?
2087             if (rfcomm_channel_ready_for_open(channel)){
2088                 channel->state = RFCOMM_CHANNEL_OPEN;
2089                 rfcomm_channel_opened(channel);
2090             }
2091             break;
2092 
2093         case RFCOMM_CHANNEL_OPEN:
2094             switch (event->type){
2095                 case CH_EVT_RCVD_MSC_CMD:
2096                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2097                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2098                     break;
2099                 case CH_EVT_RCVD_RPN_RSP:
2100                     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE) == 0) break;
2101                     rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2102                     memcpy(&channel->remote_rpn_data, &((rfcomm_channel_event_rpn_t*) event)->data, sizeof(rfcomm_rpn_data_t));
2103                     rfcomm_emit_port_configuration(channel, true);
2104                     break;
2105                 case CH_EVT_READY_TO_SEND:
2106                     if (channel->new_credits_incoming) {
2107                         uint8_t new_credits = channel->new_credits_incoming;
2108                         channel->new_credits_incoming = 0;
2109                         rfcomm_channel_send_credits(channel, new_credits);
2110                         break;
2111                     }
2112                     break;
2113                 case CH_EVT_RCVD_CREDITS:
2114                     rfcomm_notify_channel_can_send();
2115                     break;
2116                 default:
2117                     break;
2118             }
2119             break;
2120 
2121         case RFCOMM_CHANNEL_SEND_DM:
2122             switch (event->type) {
2123                 case CH_EVT_READY_TO_SEND:
2124                     log_info("Sending DM_PF for #%u", channel->dlci);
2125                     // don't emit channel closed - channel was never open
2126                     channel->state = RFCOMM_CHANNEL_CLOSED;
2127                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2128                     rfcomm_channel_finalize(channel);
2129                     *out_channel_valid = 0;
2130                     break;
2131                 default:
2132                     break;
2133             }
2134             break;
2135 
2136         case RFCOMM_CHANNEL_SEND_DISC:
2137             switch (event->type) {
2138                 case CH_EVT_READY_TO_SEND:
2139                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2140                     rfcomm_send_disc(multiplexer, channel->dlci);
2141                     break;
2142                 default:
2143                     break;
2144             }
2145             break;
2146 
2147         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2148             switch (event->type){
2149                 case CH_EVT_RCVD_UA:
2150                     channel->state = RFCOMM_CHANNEL_CLOSED;
2151                     rfcomm_emit_channel_closed(channel);
2152                     rfcomm_channel_finalize(channel);
2153                     // RFCOMM v1.2, 5.2.2. Close-Down Procedure
2154                     // The device closing the last connection (DLC) on a particular session shall close the
2155                     // multiplexer by closing the corresponding L2CAP channel.
2156                     if (rfcomm_multiplexer_has_channels(multiplexer) == false){
2157                         log_info("Closed last DLC, shut-down multiplexer");
2158                         uint16_t l2cap_cid = multiplexer->l2cap_cid;
2159                         rfcomm_multiplexer_finalize(multiplexer);
2160                         l2cap_disconnect(l2cap_cid);
2161                     }
2162                     *out_channel_valid = 0;
2163                     break;
2164                 default:
2165                     break;
2166             }
2167             break;
2168 
2169         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2170             switch (event->type) {
2171                 case CH_EVT_READY_TO_SEND:
2172                     log_info("Sending UA after DISC for #%u", channel->dlci);
2173                     channel->state = RFCOMM_CHANNEL_CLOSED;
2174                     rfcomm_send_ua(multiplexer, channel->dlci);
2175                     rfcomm_channel_finalize(channel);
2176                     *out_channel_valid = 0;
2177                     break;
2178                 default:
2179                     break;
2180             }
2181             break;
2182 
2183         default:
2184             break;
2185     }
2186 }
2187 
2188 // MARK: RFCOMM BTstack API
2189 
2190 void rfcomm_init(void){
2191     rfcomm_security_level = gap_get_security_level();
2192 #ifdef RFCOMM_USE_ERTM
2193     rfcomm_ertm_id = 0;
2194 #endif
2195 }
2196 
2197 void rfcomm_deinit(void){
2198     rfcomm_client_cid_generator = 0;
2199     rfcomm_multiplexers = NULL;
2200     rfcomm_services     = NULL;
2201     rfcomm_channels     = NULL;
2202 #ifdef RFCOMM_USE_ERTM
2203     rfcomm_ertm_request_callback  = NULL;
2204     rfcomm_ertm_released_callback = NULL;
2205 #endif
2206 }
2207 
2208 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2209     rfcomm_security_level = security_level;
2210 }
2211 
2212 bool rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2213     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2214     if (!channel){
2215         log_error("send cid 0x%02x doesn't exist!", rfcomm_cid);
2216         return false;
2217     }
2218     return rfcomm_channel_can_send(channel);
2219 }
2220 
2221 uint8_t rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2222     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2223     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2224     channel->waiting_for_can_send_now = 1;
2225     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2226     return ERROR_CODE_SUCCESS;
2227 }
2228 
2229 static uint8_t rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2230     if (len > channel->max_frame_size){
2231         log_error("send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2232         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2233     }
2234 
2235 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2236     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2237         log_error("send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2238         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2239     }
2240 #endif
2241 
2242     if (!channel->credits_outgoing){
2243         log_info("send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2244         return RFCOMM_NO_OUTGOING_CREDITS;
2245     }
2246 
2247     if ((channel->multiplexer->fcon & 1) == 0){
2248         log_info("send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2249         return RFCOMM_AGGREGATE_FLOW_OFF;
2250     }
2251     return ERROR_CODE_SUCCESS;
2252 }
2253 
2254 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2255     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2256     if (!channel){
2257         return 0;
2258     }
2259     return channel->max_frame_size;
2260 }
2261 
2262 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2263 void rfcomm_reserve_packet_buffer(void){
2264 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2265     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2266 #else
2267     l2cap_reserve_packet_buffer();
2268 #endif
2269 }
2270 
2271 void rfcomm_release_packet_buffer(void){
2272 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2273     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2274 #else
2275     l2cap_release_packet_buffer();
2276 #endif
2277 }
2278 
2279 uint8_t * rfcomm_get_outgoing_buffer(void){
2280 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2281     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2282 #else
2283     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2284 #endif
2285     // address + control + length (16) + no credit field
2286     return &rfcomm_out_buffer[4];
2287 }
2288 
2289 uint8_t rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2290     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2291     if (!channel){
2292         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2293         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2294     }
2295 
2296     uint8_t status = rfcomm_assert_send_valid(channel, len);
2297     if (status != ERROR_CODE_SUCCESS) return status;
2298 
2299 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2300     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2301         log_error("l2cap cannot send now");
2302         return BTSTACK_ACL_BUFFERS_FULL;
2303     }
2304 #else
2305     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2306         log_error("l2cap cannot send now");
2307         return BTSTACK_ACL_BUFFERS_FULL;
2308     }
2309 #endif
2310 
2311     // send might cause l2cap to emit new credits, update counters first
2312     if (len){
2313         channel->credits_outgoing--;
2314     } else {
2315         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2316     }
2317 
2318     status = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2319 
2320     if (status != 0) {
2321         log_error("error %d", status);
2322         if (len) {
2323             channel->credits_outgoing++;
2324         }
2325     }
2326 
2327     return status;
2328 }
2329 
2330 uint8_t rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2331     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2332     if (!channel){
2333         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2334         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2335     }
2336 
2337     uint8_t status = rfcomm_assert_send_valid(channel, len);
2338     if (status != ERROR_CODE_SUCCESS) return status;
2339     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2340         log_error("rfcomm_send_internal: l2cap cannot send now");
2341         return BTSTACK_ACL_BUFFERS_FULL;
2342     }
2343 
2344 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2345 #else
2346     rfcomm_reserve_packet_buffer();
2347 #endif
2348     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2349 
2350     (void)memcpy(rfcomm_payload, data, len);
2351     status = rfcomm_send_prepared(rfcomm_cid, len);
2352 
2353 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2354 #else
2355     if (status != ERROR_CODE_SUCCESS){
2356         rfcomm_release_packet_buffer();
2357     }
2358 #endif
2359 
2360     return ERROR_CODE_SUCCESS;
2361 }
2362 
2363 // Sends Local Line Status, see LINE_STATUS_..
2364 uint8_t rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2365     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2366     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2367     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) return ERROR_CODE_COMMAND_DISALLOWED;
2368     channel->local_line_status = line_status;
2369     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2370     return ERROR_CODE_SUCCESS;
2371 }
2372 
2373 // Sned local modem status. see MODEM_STAUS_..
2374 uint8_t rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2375     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2376     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2377     channel->local_modem_status = modem_status;
2378     // trigger send
2379     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2380     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2381     return ERROR_CODE_SUCCESS;
2382 }
2383 
2384 // Configure remote port
2385 uint8_t rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, uint8_t flow_control){
2386     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2387     if (!channel){
2388         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2389     }
2390 
2391     // store remote config
2392     channel->remote_rpn_data.baud_rate = baud_rate;
2393     channel->remote_rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2394     channel->remote_rpn_data.flow_control = flow_control;
2395     channel->remote_rpn_data.xon = 0;
2396     channel->remote_rpn_data.xoff = 0;
2397     channel->remote_rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2398     channel->remote_rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2399 
2400     // trigger send
2401     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
2402     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2403     return ERROR_CODE_SUCCESS;
2404 }
2405 
2406 // Query remote port
2407 uint8_t rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2408     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2409     if (!channel){
2410         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2411     }
2412     // trigger send
2413     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY | RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2414     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2415     return ERROR_CODE_SUCCESS;
2416 }
2417 
2418 
2419 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2420     log_info("create addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2421 
2422     // create new multiplexer if necessary
2423     uint8_t status = 0;
2424     uint8_t dlci = 0;
2425     int new_multiplexer = 0;
2426     rfcomm_channel_t * channel = NULL;
2427     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2428     if (!multiplexer) {
2429         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2430         if (!multiplexer) return BTSTACK_MEMORY_ALLOC_FAILED;
2431 
2432         multiplexer->outgoing = 1;
2433         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2434         new_multiplexer = 1;
2435     }
2436 
2437     // check if channel for this remote service already exists
2438     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2439     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2440     if (channel){
2441         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2442         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2443     }
2444 
2445     // prepare channel
2446     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2447     if (!channel){
2448         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2449         return BTSTACK_MEMORY_ALLOC_FAILED;
2450     }
2451 
2452     // rfcomm_cid is already assigned by rfcomm_channel_create
2453     channel->incoming_flow_control = incoming_flow_control;
2454     channel->new_credits_incoming  = initial_credits;
2455     channel->packet_handler = packet_handler;
2456 
2457     // return rfcomm_cid
2458     if (out_rfcomm_cid){
2459         *out_rfcomm_cid = channel->rfcomm_cid;
2460     }
2461 
2462     // start multiplexer setup
2463     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2464         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2465         uint16_t l2cap_cid = 0;
2466 #ifdef RFCOMM_USE_ERTM
2467         // request
2468         rfcomm_ertm_request_t request;
2469         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2470         (void)memcpy(request.addr, addr, 6);
2471         request.ertm_id = rfcomm_next_ertm_id();
2472         if (rfcomm_ertm_request_callback){
2473             (*rfcomm_ertm_request_callback)(&request);
2474         }
2475         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2476             multiplexer->ertm_id = request.ertm_id;
2477             status = l2cap_ertm_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2478                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2479         }
2480         else
2481 #endif
2482         {
2483             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2484         }
2485         if (status) {
2486             if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2487             btstack_memory_rfcomm_channel_free(channel);
2488             return status;
2489         }
2490         multiplexer->l2cap_cid = l2cap_cid;
2491         return ERROR_CODE_SUCCESS;
2492     }
2493 
2494     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2495 
2496     // start connecting, if multiplexer is already up and running
2497     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2498     return ERROR_CODE_SUCCESS;
2499 }
2500 
2501 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2502     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2503 }
2504 
2505 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2506     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2507 }
2508 
2509 uint8_t rfcomm_disconnect(uint16_t rfcomm_cid){
2510     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2511     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2512 
2513     if (channel->state != RFCOMM_CHANNEL_OPEN) return ERROR_CODE_COMMAND_DISALLOWED;
2514 
2515     log_info("disconnect cid 0x%02x", rfcomm_cid);
2516     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2517     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2518     return ERROR_CODE_SUCCESS;
2519 }
2520 
2521 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2522     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2523 
2524     log_info("register channel #%u mtu %u flow_control %u credits %u",
2525              channel, max_frame_size, incoming_flow_control, initial_credits);
2526 
2527     // check if already registered
2528     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2529     if (service){
2530         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2531     }
2532 
2533     // alloc structure
2534     service = btstack_memory_rfcomm_service_get();
2535     if (!service) {
2536         return BTSTACK_MEMORY_ALLOC_FAILED;
2537     }
2538 
2539     // register with l2cap if not registered before, max MTU
2540     if (btstack_linked_list_empty(&rfcomm_services)){
2541         uint8_t status = l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2542         if (status != ERROR_CODE_SUCCESS){
2543             btstack_memory_rfcomm_service_free(service);
2544             return status;
2545         }
2546     }
2547 
2548     // fill in
2549     service->packet_handler = packet_handler;
2550     service->server_channel = channel;
2551     service->max_frame_size = max_frame_size;
2552     service->incoming_flow_control = incoming_flow_control;
2553     service->incoming_initial_credits = initial_credits;
2554 
2555     // add to services list
2556     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2557 
2558     return ERROR_CODE_SUCCESS;
2559 }
2560 
2561 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2562     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2563 
2564     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2565 }
2566 
2567 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2568     uint16_t max_frame_size){
2569 
2570     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2571 }
2572 
2573 void rfcomm_unregister_service(uint8_t service_channel){
2574     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2575     if (!service) return;
2576     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2577     btstack_memory_rfcomm_service_free(service);
2578 
2579     // unregister if no services active
2580     if (btstack_linked_list_empty(&rfcomm_services)){
2581         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2582         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2583     }
2584 }
2585 
2586 uint8_t rfcomm_accept_connection(uint16_t rfcomm_cid){
2587     log_info("accept cid 0x%02x", rfcomm_cid);
2588     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2589     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2590 
2591     switch (channel->state) {
2592         case RFCOMM_CHANNEL_INCOMING_SETUP:
2593             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2594             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2595                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2596                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2597             }
2598             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2599                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2600                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2601             }
2602             // at least one of { PN RSP, UA } needs to be sent
2603             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2604             return ERROR_CODE_SUCCESS;
2605         default:
2606            return ERROR_CODE_COMMAND_DISALLOWED;
2607     }
2608 }
2609 
2610 uint8_t rfcomm_decline_connection(uint16_t rfcomm_cid){
2611     log_info("decline cid 0x%02x", rfcomm_cid);
2612     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2613     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2614 
2615     switch (channel->state) {
2616         case RFCOMM_CHANNEL_INCOMING_SETUP:
2617             channel->state = RFCOMM_CHANNEL_SEND_DM;
2618             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2619             return ERROR_CODE_SUCCESS;
2620         default:
2621             return ERROR_CODE_COMMAND_DISALLOWED;
2622     }
2623 }
2624 
2625 uint8_t rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2626     log_info("grant cid 0x%02x credits %u", rfcomm_cid, credits);
2627     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2628     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2629     if (!channel->incoming_flow_control) return ERROR_CODE_COMMAND_DISALLOWED;
2630     channel->new_credits_incoming += credits;
2631 
2632     // process
2633     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2634     return ERROR_CODE_SUCCESS;
2635 }
2636 
2637 #ifdef RFCOMM_USE_ERTM
2638 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2639     rfcomm_ertm_request_callback  = request_callback;
2640     rfcomm_ertm_released_callback = released_callback;
2641 }
2642 #endif
2643