xref: /btstack/src/classic/rfcomm.c (revision a0ecb5f3e03de203431a83bfb88217ac1247ef71)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h> // memcpy
47 #include <stdint.h>
48 
49 #include "bluetooth_sdp.h"
50 #include "btstack_debug.h"
51 #include "btstack_event.h"
52 #include "btstack_memory.h"
53 #include "btstack_util.h"
54 #include "classic/core.h"
55 #include "classic/rfcomm.h"
56 #include "hci.h"
57 #include "hci_cmd.h"
58 #include "hci_dump.h"
59 #include "l2cap.h"
60 
61 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
62 #ifndef PRIxPTR
63 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
64 #define PRIxPTR "lx"
65 #else
66 #define PRIxPTR "x"
67 #endif
68 #endif
69 
70 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
71 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
72 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
73 #define RFCOMM_USE_OUTGOING_BUFFER
74 #define RFCOMM_USE_ERTM
75 #else
76 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
77 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
78 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
79 #endif
80 #endif
81 
82 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
83 
84 #define RFCOMM_CREDITS 10
85 
86 // FCS calc
87 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
88 #define BT_RFCOMM_CRC_CHECK_LEN     3
89 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
90 
91 
92 typedef enum {
93     CH_EVT_RCVD_SABM = 1,
94     CH_EVT_RCVD_UA,
95     CH_EVT_RCVD_PN,
96     CH_EVT_RCVD_PN_RSP,
97     CH_EVT_RCVD_DISC,
98     CH_EVT_RCVD_DM,
99     CH_EVT_RCVD_MSC_CMD,
100     CH_EVT_RCVD_MSC_RSP,
101     CH_EVT_RCVD_NSC_RSP,
102     CH_EVT_RCVD_RLS_CMD,
103     CH_EVT_RCVD_RLS_RSP,
104     CH_EVT_RCVD_RPN_CMD,
105     CH_EVT_RCVD_RPN_REQ,
106     CH_EVT_RCVD_CREDITS,
107     CH_EVT_MULTIPLEXER_READY,
108     CH_EVT_READY_TO_SEND,
109 } RFCOMM_CHANNEL_EVENT;
110 
111 typedef struct rfcomm_channel_event {
112     RFCOMM_CHANNEL_EVENT type;
113     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
114 } rfcomm_channel_event_t;
115 
116 typedef struct rfcomm_channel_event_pn {
117     rfcomm_channel_event_t super;
118     uint16_t max_frame_size;
119     uint8_t  priority;
120     uint8_t  credits_outgoing;
121 } rfcomm_channel_event_pn_t;
122 
123 typedef struct rfcomm_channel_event_rpn {
124     rfcomm_channel_event_t super;
125     rfcomm_rpn_data_t data;
126 } rfcomm_channel_event_rpn_t;
127 
128 typedef struct rfcomm_channel_event_rls {
129     rfcomm_channel_event_t super;
130     uint8_t line_status;
131 } rfcomm_channel_event_rls_t;
132 
133 typedef struct rfcomm_channel_event_msc {
134     rfcomm_channel_event_t super;
135     uint8_t modem_status;
136 } rfcomm_channel_event_msc_t;
137 
138 
139 // global rfcomm data
140 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
141 
142 // linked lists for all
143 static btstack_linked_list_t rfcomm_multiplexers = NULL;
144 static btstack_linked_list_t rfcomm_channels = NULL;
145 static btstack_linked_list_t rfcomm_services = NULL;
146 
147 static gap_security_level_t rfcomm_security_level;
148 
149 #ifdef RFCOMM_USE_ERTM
150 static uint16_t ertm_id;
151 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
152 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
153 #endif
154 
155 #ifdef RFCOMM_USE_OUTGOING_BUFFER
156 static uint8_t outgoing_buffer[1030];
157 #endif
158 
159 static int  rfcomm_channel_can_send(rfcomm_channel_t * channel);
160 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
161 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
162 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
163 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
164 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
165 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
166 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
167 
168 // MARK: RFCOMM CLIENT EVENTS
169 
170 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
171 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
172     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
173              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
174     uint8_t event[11];
175     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
176     event[1] = sizeof(event) - 2;
177     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
178     event[8] = channel->dlci >> 1;
179     little_endian_store_16(event, 9, channel->rfcomm_cid);
180     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
181 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
182 }
183 
184 // API Change: BTstack-0.3.50x uses
185 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
186 // next Cydia release will use SVN version of this
187 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
188 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
189     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
190              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
191              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
192     uint8_t event[18];
193     uint8_t pos = 0;
194     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
195     event[pos++] = sizeof(event) - 2;                   // 1
196     event[pos++] = status;                              // 2
197     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
198     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
199 	event[pos++] = channel->dlci >> 1;                                      // 11
200 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
201 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
202     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
203     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
204 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
205 
206     // if channel opened successfully, also send can send now if possible
207     if (status) return;
208     if (rfcomm_channel_can_send(channel)){
209         rfcomm_emit_can_send_now(channel);
210     }
211 }
212 
213 // data: event(8), len(8), rfcomm_cid(16)
214 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
215     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
216     uint8_t event[4];
217     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
218     event[1] = sizeof(event) - 2;
219     little_endian_store_16(event, 2, channel->rfcomm_cid);
220     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
221 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
222 }
223 
224 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
225     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
226     uint8_t event[5];
227     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
228     event[1] = sizeof(event) - 2;
229     little_endian_store_16(event, 2, channel->rfcomm_cid);
230     event[4] = line_status;
231     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
232     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
233 }
234 
235 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel){
236     // notify client about new settings
237     uint8_t event[2+sizeof(rfcomm_rpn_data_t)];
238     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
239     event[1] = sizeof(rfcomm_rpn_data_t);
240     memcpy(&event[2], (uint8_t*) &channel->rpn_data, sizeof(rfcomm_rpn_data_t));
241     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
242     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
243 }
244 
245 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
246     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
247     uint8_t event[4];
248     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
249     event[1] = sizeof(event) - 2;
250     little_endian_store_16(event, 2, channel->rfcomm_cid);
251     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
252     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
253 }
254 
255 // MARK RFCOMM RPN DATA HELPER
256 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
257         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
258         rpn_data->flags = 0x03;               /* 8-n-1 */
259         rpn_data->flow_control = 0;           /* no flow control */
260         rpn_data->xon  = 0xd1;                /* XON */
261         rpn_data->xoff = 0xd3;                /* XOFF */
262         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
263         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
264 }
265 
266 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
267     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
268         dest->baud_rate = src->baud_rate;
269     }
270     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
271         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
272     }
273     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
274         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
275     }
276     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
277         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
278     }
279     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
280         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x30);
281     }
282     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
283         dest->xon = src->xon;
284     }
285     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
286         dest->xoff = src->xoff;
287     }
288     int i;
289     for (i=0; i < 6 ; i++){
290         uint8_t mask = 1 << i;
291         if (src->parameter_mask_1 & mask){
292             dest->flags = (dest->flags & ~mask) | (src->flags & mask);
293         }
294     }
295     // always copy parameter mask, too. informative for client, needed for response
296     dest->parameter_mask_0 = src->parameter_mask_0;
297     dest->parameter_mask_1 = src->parameter_mask_1;
298 }
299 // MARK: RFCOMM MULTIPLEXER HELPER
300 
301 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
302     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
303     uint16_t max_frame_size = l2cap_mtu - 5;
304     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
305     return max_frame_size;
306 }
307 
308 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
309     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
310     multiplexer->fcon = 1;
311     multiplexer->send_dm_for_dlci = 0;
312     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
313     multiplexer->test_data_len = 0;
314     multiplexer->nsc_command = 0;
315 }
316 
317 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
318 
319     // alloc structure
320     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
321     if (!multiplexer) return NULL;
322 
323     // fill in
324     rfcomm_multiplexer_initialize(multiplexer);
325     bd_addr_copy(multiplexer->remote_addr, addr);
326 
327     // add to services list
328     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
329 
330     return multiplexer;
331 }
332 
333 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
334     btstack_linked_item_t *it;
335     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
336         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
337         // ignore multiplexer in shutdown
338         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
339         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
340             return multiplexer;
341         };
342     }
343     return NULL;
344 }
345 
346 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
347     btstack_linked_item_t *it;
348     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
349         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
350         if (multiplexer->l2cap_cid == l2cap_cid) {
351             return multiplexer;
352         };
353     }
354     return NULL;
355 }
356 
357 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
358     btstack_linked_item_t *it;
359     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
360         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
361         if (channel->multiplexer == multiplexer) {
362             return 1;
363         }
364     }
365     return 0;
366 }
367 
368 // MARK: RFCOMM CHANNEL HELPER
369 
370 static void rfcomm_dump_channels(void){
371     btstack_linked_item_t * it;
372     int channels = 0;
373     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
374         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
375         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
376         channels++;
377     }
378 }
379 
380 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
381                                rfcomm_service_t *service, uint8_t server_channel){
382 
383     // don't use 0 as channel id
384     if (rfcomm_client_cid_generator == 0) ++rfcomm_client_cid_generator;
385 
386     // set defaults for port configuration (even for services)
387     rfcomm_rpn_data_set_defaults(&channel->rpn_data);
388 
389     channel->state            = RFCOMM_CHANNEL_CLOSED;
390     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
391 
392     channel->multiplexer      = multiplexer;
393     channel->rfcomm_cid       = rfcomm_client_cid_generator++;
394     channel->max_frame_size   = multiplexer->max_frame_size;
395 
396     channel->credits_incoming = 0;
397     channel->credits_outgoing = 0;
398 
399     // incoming flow control not active
400     channel->new_credits_incoming  = RFCOMM_CREDITS;
401     channel->incoming_flow_control = 0;
402 
403     channel->rls_line_status       = RFCOMM_RLS_STATUS_INVALID;
404 
405     channel->service = service;
406 	if (service) {
407 		// incoming connection
408     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
409         if (channel->max_frame_size > service->max_frame_size) {
410             channel->max_frame_size = service->max_frame_size;
411         }
412         channel->incoming_flow_control = service->incoming_flow_control;
413         channel->new_credits_incoming  = service->incoming_initial_credits;
414         channel->packet_handler        = service->packet_handler;
415 	} else {
416 		// outgoing connection
417 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
418 	}
419 }
420 
421 // service == NULL -> outgoing channel
422 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
423                                                 rfcomm_service_t * service, uint8_t server_channel){
424 
425     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
426     rfcomm_dump_channels();
427 
428     // alloc structure
429     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
430     if (!channel) return NULL;
431 
432     // fill in
433     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
434 
435     // add to services list
436     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
437 
438     return channel;
439 }
440 
441 static void rfcomm_notify_channel_can_send(void){
442     btstack_linked_list_iterator_t it;
443     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
444     while (btstack_linked_list_iterator_has_next(&it)){
445         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
446         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
447         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
448 
449         channel->waiting_for_can_send_now = 0;
450         rfcomm_emit_can_send_now(channel);
451     }
452 }
453 
454 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
455     btstack_linked_item_t *it;
456     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
457         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
458         if (channel->rfcomm_cid == rfcomm_cid) {
459             return channel;
460         };
461     }
462     return NULL;
463 }
464 
465 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
466     btstack_linked_item_t *it;
467     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
468         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
469         if (channel->dlci == dlci && channel->multiplexer == multiplexer) {
470             return channel;
471         };
472     }
473     return NULL;
474 }
475 
476 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
477     btstack_linked_item_t *it;
478     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
479         rfcomm_service_t * service = ((rfcomm_service_t *) it);
480         if ( service->server_channel == server_channel){
481             return service;
482         };
483     }
484     return NULL;
485 }
486 
487 // MARK: RFCOMM SEND
488 
489 /**
490  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
491  */
492 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
493 
494     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
495 
496 #ifdef RFCOMM_USE_OUTGOING_BUFFER
497     uint8_t * rfcomm_out_buffer = outgoing_buffer;
498 #else
499     l2cap_reserve_packet_buffer();
500     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
501 #endif
502 
503 	uint16_t pos = 0;
504 	uint8_t crc_fields = 3;
505 
506 	rfcomm_out_buffer[pos++] = address;
507 	rfcomm_out_buffer[pos++] = control;
508 
509 	// length field can be 1 or 2 octets
510 	if (len < 128){
511 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
512 	} else {
513 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
514 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
515 		crc_fields++;
516 	}
517 
518 	// add credits for UIH frames when PF bit is set
519 	if (control == BT_RFCOMM_UIH_PF){
520 		rfcomm_out_buffer[pos++] = credits;
521 	}
522 
523 	// copy actual data
524 	if (len) {
525 		memcpy(&rfcomm_out_buffer[pos], data, len);
526 		pos += len;
527 	}
528 
529 	// UIH frames only calc FCS over address + control (5.1.1)
530 	if ((control & 0xef) == BT_RFCOMM_UIH){
531 		crc_fields = 2;
532 	}
533 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
534 
535 #ifdef RFCOMM_USE_OUTGOING_BUFFER
536     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
537 #else
538     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
539 #endif
540 
541     return err;
542 }
543 
544 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
545 static int rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
546 
547     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
548     uint8_t control = BT_RFCOMM_UIH;
549 
550 #ifdef RFCOMM_USE_OUTGOING_BUFFER
551     uint8_t * rfcomm_out_buffer = outgoing_buffer;
552 #else
553     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
554 #endif
555 
556     uint16_t pos = 0;
557     rfcomm_out_buffer[pos++] = address;
558     rfcomm_out_buffer[pos++] = control;
559     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
560     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
561 
562     // actual data is already in place
563     pos += len;
564 
565     // UIH frames only calc FCS over address + control (5.1.1)
566     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
567 
568 #ifdef RFCOMM_USE_OUTGOING_BUFFER
569     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
570 #else
571     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
572 #endif
573 
574     return err;
575 }
576 
577 // C/R Flag in Address
578 // - terms: initiator = station that creates multiplexer with SABM
579 // - terms: responder = station that responds to multiplexer setup with UA
580 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
581 //    - command initiator = 1 /response responder = 1
582 //    - command responder = 0 /response initiator = 0
583 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
584 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
585 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
586 
587 // C/R Flag in Message
588 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
589 //   - If the C/R bit is set to 1 the message is a command
590 //   - if it is set to 0 the message is a response.
591 
592 // temp/old messge construction
593 
594 // new object oriented version
595 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
596 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
597     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
598 }
599 
600 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
601 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
602     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
603 }
604 
605 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
606 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
607     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
608 }
609 
610 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
611 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
612     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
613 }
614 
615 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
616     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
617     uint8_t payload[2];
618     uint8_t pos = 0;
619     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
620     payload[pos++] = (0 << 1) | 1;  // len
621     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
622 }
623 
624 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
625 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
626 //     uint8_t payload[2+len];
627 //     uint8_t pos = 0;
628 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
629 //     payload[pos++] = (len + 1) << 1 | 1;  // len
630 //     memcpy(&payload[pos], data, len);
631 //     pos += len;
632 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
633 // }
634 
635 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
636     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
637     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
638     uint8_t pos = 0;
639     payload[pos++] = BT_RFCOMM_TEST_RSP;
640     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
641         len = RFCOMM_TEST_DATA_MAX_LEN;
642     }
643     payload[pos++] = (len << 1) | 1;  // len
644     memcpy(&payload[pos], data, len);
645     pos += len;
646     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
647 }
648 
649 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
650 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
651 	uint8_t payload[4];
652 	uint8_t pos = 0;
653 	payload[pos++] = BT_RFCOMM_MSC_CMD;
654 	payload[pos++] = (2 << 1) | 1;  // len
655 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
656 	payload[pos++] = signals;
657 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
658 }
659 
660 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
661 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
662 	uint8_t payload[4];
663 	uint8_t pos = 0;
664 	payload[pos++] = BT_RFCOMM_MSC_RSP;
665 	payload[pos++] = (2 << 1) | 1;  // len
666 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
667 	payload[pos++] = signals;
668 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
669 }
670 
671 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
672     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
673     uint8_t payload[3];
674     uint8_t pos = 0;
675     payload[pos++] = BT_RFCOMM_NSC_RSP;
676     payload[pos++] = (1 << 1) | 1;  // len
677     payload[pos++] = command;
678     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
679 }
680 
681 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
682 	uint8_t payload[10];
683 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
684 	uint8_t pos = 0;
685 	payload[pos++] = BT_RFCOMM_PN_CMD;
686 	payload[pos++] = (8 << 1) | 1;  // len
687 	payload[pos++] = dlci;
688 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
689 	payload[pos++] = 0; // priority
690 	payload[pos++] = 0; // max 60 seconds ack
691 	payload[pos++] = max_frame_size & 0xff; // max framesize low
692 	payload[pos++] = max_frame_size >> 8;   // max framesize high
693 	payload[pos++] = 0x00; // number of retransmissions
694 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
695 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
696 }
697 
698 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
699 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
700                                        uint8_t priority, uint16_t max_frame_size){
701 	uint8_t payload[10];
702 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
703 	uint8_t pos = 0;
704 	payload[pos++] = BT_RFCOMM_PN_RSP;
705 	payload[pos++] = (8 << 1) | 1;  // len
706 	payload[pos++] = dlci;
707 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
708 	payload[pos++] = priority; // priority
709 	payload[pos++] = 0; // max 60 seconds ack
710 	payload[pos++] = max_frame_size & 0xff; // max framesize low
711 	payload[pos++] = max_frame_size >> 8;   // max framesize high
712 	payload[pos++] = 0x00; // number of retransmissions
713 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
714 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
715 }
716 
717 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
718     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
719     uint8_t payload[4];
720     uint8_t pos = 0;
721     payload[pos++] = BT_RFCOMM_RLS_CMD;
722     payload[pos++] = (2 << 1) | 1;  // len
723     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
724     payload[pos++] = line_status;
725     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
726 }
727 
728 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
729     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
730     uint8_t payload[4];
731     uint8_t pos = 0;
732     payload[pos++] = BT_RFCOMM_RLS_RSP;
733     payload[pos++] = (2 << 1) | 1;  // len
734     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
735     payload[pos++] = line_status;
736     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
737 }
738 
739 static int rfcomm_send_uih_rpn_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
740     uint8_t payload[10];
741     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
742     uint8_t pos = 0;
743     payload[pos++] = BT_RFCOMM_RPN_CMD;
744     payload[pos++] = (8 << 1) | 1;  // len
745     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
746     payload[pos++] = rpn_data->baud_rate;
747     payload[pos++] = rpn_data->flags;
748     payload[pos++] = rpn_data->flow_control;
749     payload[pos++] = rpn_data->xon;
750     payload[pos++] = rpn_data->xoff;
751     payload[pos++] = rpn_data->parameter_mask_0;
752     payload[pos++] = rpn_data->parameter_mask_1;
753     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
754 }
755 
756 static int rfcomm_send_uih_rpn_req(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
757     uint8_t payload[3];
758     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
759     uint8_t pos = 0;
760     payload[pos++] = BT_RFCOMM_RPN_CMD;
761     payload[pos++] = (1 << 1) | 1;  // len
762     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
763     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
764 }
765 
766 static int rfcomm_send_uih_rpn_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
767 	uint8_t payload[10];
768 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
769 	uint8_t pos = 0;
770 	payload[pos++] = BT_RFCOMM_RPN_RSP;
771 	payload[pos++] = (8 << 1) | 1;  // len
772 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
773 	payload[pos++] = rpn_data->baud_rate;
774 	payload[pos++] = rpn_data->flags;
775 	payload[pos++] = rpn_data->flow_control;
776 	payload[pos++] = rpn_data->xon;
777 	payload[pos++] = rpn_data->xoff;
778 	payload[pos++] = rpn_data->parameter_mask_0;
779 	payload[pos++] = rpn_data->parameter_mask_1;
780 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
781 }
782 
783 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
784     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
785     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
786 }
787 
788 // depending on channel state emit channel opened with status or channel closed
789 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
790     // emit appropriate events
791     switch(channel->state){
792         case RFCOMM_CHANNEL_OPEN:
793         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
794             rfcomm_emit_channel_closed(channel);
795             break;
796         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
797             // remote didn't wait until we send the UA disc
798             // close event already emitted
799             break;
800         default:
801             rfcomm_emit_channel_opened(channel, status);
802             break;
803     }
804 }
805 
806 // MARK: RFCOMM MULTIPLEXER
807 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
808     if (multiplexer->timer_active) {
809         btstack_run_loop_remove_timer(&multiplexer->timer);
810         multiplexer->timer_active = 0;
811     }
812 }
813 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
814     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
815     btstack_memory_rfcomm_multiplexer_free(multiplexer);
816 }
817 
818 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
819     // remove (potential) timer
820     rfcomm_multiplexer_stop_timer(multiplexer);
821 
822     // close and remove all channels
823     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
824     while (it->next){
825         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
826         if (channel->multiplexer == multiplexer) {
827             // emit open with status or closed
828             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
829             // remove from list
830             it->next = it->next->next;
831             // free channel struct
832             btstack_memory_rfcomm_channel_free(channel);
833         } else {
834             it = it->next;
835         }
836     }
837 
838     // remove mutliplexer
839     rfcomm_multiplexer_free(multiplexer);
840 }
841 
842 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
843     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
844     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
845 
846     log_info("rfcomm_multiplexer_timer_handler timeout: shutting down multiplexer! (no channels)");
847     uint16_t l2cap_cid = multiplexer->l2cap_cid;
848     rfcomm_multiplexer_finalize(multiplexer);
849     l2cap_disconnect(l2cap_cid, 0x13);
850 }
851 
852 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
853     if (multiplexer->timer_active) {
854         btstack_run_loop_remove_timer(&multiplexer->timer);
855         multiplexer->timer_active = 0;
856     }
857     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
858 
859     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
860     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
861     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
862     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
863     btstack_run_loop_add_timer(&multiplexer->timer);
864     multiplexer->timer_active = 1;
865 }
866 
867 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
868     log_info("Multiplexer up and running");
869     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
870 
871     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
872 
873     // transition of channels that wait for multiplexer
874     btstack_linked_item_t *it;
875     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
876         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
877         if (channel->multiplexer != multiplexer) continue;
878         int rfcomm_channel_valid = 1;
879         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
880         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
881             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
882         }
883     }
884     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
885 
886     // request can send now for multiplexer if ready
887     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
888         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
889     }
890 }
891 
892 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
893 
894     log_debug("rfcomm_handle_can_send_now enter: %u", l2cap_cid);
895 
896     btstack_linked_list_iterator_t it;
897     int token_consumed = 0;
898 
899     // forward token to multiplexer
900     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
901     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
902         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
903         if (multiplexer->l2cap_cid != l2cap_cid) continue;
904         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
905             log_debug("rfcomm_handle_can_send_now enter: multiplexer token");
906             token_consumed = 1;
907             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
908         }
909     }
910 
911     // forward token to channel state machine
912     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
913     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
914         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
915         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
916         // channel state machine
917         if (rfcomm_channel_ready_to_send(channel)){
918             log_debug("rfcomm_handle_can_send_now enter: channel token");
919             token_consumed = 1;
920             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
921             int rfcomm_channel_valid = 1;
922             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
923         }
924     }
925 
926     // forward token to client
927     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
928     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
929         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
930         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
931         // client waiting for can send now
932         if (!channel->waiting_for_can_send_now)    continue;
933         if ((channel->multiplexer->fcon & 1) == 0) continue;
934         if (!channel->credits_outgoing){
935             log_debug("rfcomm_handle_can_send_now waiting to send but no credits (ignore)");
936             continue;
937         }
938 
939         log_debug("rfcomm_handle_can_send_now enter: client token");
940         token_consumed = 1;
941         channel->waiting_for_can_send_now = 0;
942         rfcomm_emit_can_send_now(channel);
943     }
944 
945     // if token was consumed, request another one
946     if (token_consumed) {
947         l2cap_request_can_send_now_event(l2cap_cid);
948     }
949 
950     log_debug("rfcomm_handle_can_send_now exit");
951 }
952 
953 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
954     multiplexer->state = state;
955     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
956 }
957 
958 /**
959  * @return handled packet
960  */
961 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
962 
963     UNUSED(size);   // ok: handling own l2cap events
964 
965     bd_addr_t event_addr;
966     uint16_t  psm;
967     uint16_t l2cap_cid;
968     hci_con_handle_t con_handle;
969     rfcomm_multiplexer_t *multiplexer = NULL;
970     uint8_t status;
971 
972     switch (hci_event_packet_get_type(packet)) {
973 
974         // accept incoming rfcomm connection if no multiplexer exists yet
975         case L2CAP_EVENT_INCOMING_CONNECTION:
976             // data: event(8), len(8), address(48), handle (16),  psm (16), source cid(16) dest cid(16)
977             reverse_bd_addr(&packet[2], event_addr);
978             con_handle = little_endian_read_16(packet,  8);
979             psm        = little_endian_read_16(packet, 10);
980             l2cap_cid  = little_endian_read_16(packet, 12);
981 
982             if (psm != BLUETOOTH_PROTOCOL_RFCOMM) break;
983 
984             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
985 
986             if (multiplexer) {
987                 log_info("INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => decline - multiplexer already exists", l2cap_cid);
988                 l2cap_decline_connection(l2cap_cid);
989                 return 1;
990             }
991 
992             // create and inititialize new multiplexer instance (incoming)
993             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
994             if (!multiplexer){
995                 log_info("INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => decline - no memory left", l2cap_cid);
996                 l2cap_decline_connection(l2cap_cid);
997                 return 1;
998             }
999 
1000             multiplexer->con_handle = con_handle;
1001             multiplexer->l2cap_cid = l2cap_cid;
1002             //
1003             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1004             log_info("L2CAP_EVENT_INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => accept", l2cap_cid);
1005 
1006 #ifdef RFCOMM_USE_ERTM
1007             // request
1008             rfcomm_ertm_request_t request;
1009             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1010             memcpy(request.addr, event_addr, 6);
1011             request.ertm_id = ++ertm_id;
1012             if (rfcomm_ertm_request_callback){
1013                 (*rfcomm_ertm_request_callback)(&request);
1014             }
1015             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1016                 multiplexer->ertm_id = request.ertm_id;
1017                 l2cap_accept_ertm_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1018                 return 1;
1019             }
1020 #endif
1021 
1022             l2cap_accept_connection(l2cap_cid);
1023             return 1;
1024 
1025         // l2cap connection opened -> store l2cap_cid, remote_addr
1026         case L2CAP_EVENT_CHANNEL_OPENED:
1027 
1028             if (little_endian_read_16(packet, 11) != BLUETOOTH_PROTOCOL_RFCOMM) break;
1029 
1030             status = packet[2];
1031             log_info("L2CAP_EVENT_CHANNEL_OPENED for BLUETOOTH_PROTOCOL_RFCOMM, status %u", status);
1032 
1033             // get multiplexer for remote addr
1034             con_handle = little_endian_read_16(packet, 9);
1035             l2cap_cid = little_endian_read_16(packet, 13);
1036             reverse_bd_addr(&packet[3], event_addr);
1037             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1038             if (!multiplexer) {
1039                 log_error("L2CAP_EVENT_CHANNEL_OPENED but no multiplexer prepared");
1040                 return 1;
1041             }
1042 
1043             // on l2cap open error discard everything
1044             if (status){
1045 
1046                 // remove (potential) timer
1047                 rfcomm_multiplexer_stop_timer(multiplexer);
1048 
1049                 // mark multiplexer as shutting down
1050                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1051 
1052                 // emit rfcomm_channel_opened with status and free channel
1053                 // note: repeatedly go over list until full iteration causes no further change
1054                 int done;
1055                 do {
1056                     done = 1;
1057                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1058                     while (it->next) {
1059                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1060                         if (channel->multiplexer == multiplexer){
1061                             done = 0;
1062                             rfcomm_emit_channel_opened(channel, status);
1063                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1064                             btstack_memory_rfcomm_channel_free(channel);
1065                             break;
1066                         } else {
1067                             it = it->next;
1068                         }
1069                     }
1070                 } while (!done);
1071 
1072                 // free multiplexer
1073                 rfcomm_multiplexer_free(multiplexer);
1074                 return 1;
1075             }
1076 
1077             // following could be: rfcom_multiplexer_state_machein(..., EVENT_L2CAP_OPENED)
1078 
1079             // set max frame size based on l2cap MTU
1080             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1081 
1082             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1083                 log_info("L2CAP_EVENT_CHANNEL_OPENED: outgoing connection");
1084                 // wrong remote addr
1085                 if (bd_addr_cmp(event_addr, multiplexer->remote_addr)) break;
1086                 multiplexer->l2cap_cid = l2cap_cid;
1087                 multiplexer->con_handle = con_handle;
1088                 // send SABM #0
1089                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1090 
1091             }
1092             return 1;
1093 
1094             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1095 
1096         // Notify channel packet handler if they can send now
1097         case L2CAP_EVENT_CAN_SEND_NOW:
1098             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1099             rfcomm_handle_can_send_now(l2cap_cid);
1100             return 1;
1101 
1102         case L2CAP_EVENT_CHANNEL_CLOSED:
1103             // data: event (8), len(8), channel (16)
1104             l2cap_cid = little_endian_read_16(packet, 2);
1105             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1106             log_info("L2CAP_EVENT_CHANNEL_CLOSED cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1107             if (!multiplexer) break;
1108             log_info("L2CAP_EVENT_CHANNEL_CLOSED state %u", multiplexer->state);
1109             // no need to call l2cap_disconnect here, as it's already closed
1110             rfcomm_multiplexer_finalize(multiplexer);
1111             return 1;
1112 
1113 #ifdef RFCOMM_USE_ERTM
1114         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1115             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1116             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1117             if (multiplexer) {
1118                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1119                 if (rfcomm_ertm_released_callback){
1120                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1121                 }
1122             }
1123             break;
1124 #endif
1125 
1126         default:
1127             break;
1128     }
1129     return 0;
1130 }
1131 
1132 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1133     // get or create a multiplexer for a certain device
1134     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1135     if (!multiplexer) return 0;
1136 
1137     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1138 
1139 	// but only care for multiplexer control channel
1140     uint8_t frame_dlci = packet[0] >> 2;
1141     if (frame_dlci) return 0;
1142     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1143     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1144     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1145     switch (packet[1]){
1146 
1147         case BT_RFCOMM_SABM:
1148             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1149                 log_info("Received SABM #0");
1150                 multiplexer->outgoing = 0;
1151                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1152                 return 1;
1153             }
1154             break;
1155 
1156         case BT_RFCOMM_UA:
1157             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1158                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1159                 log_info("Received UA #0 ");
1160                 rfcomm_multiplexer_opened(multiplexer);
1161                 return 1;
1162             }
1163             break;
1164 
1165         case BT_RFCOMM_DISC:
1166             // DISC #0 -> send UA #0, close multiplexer
1167             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1168             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1169             return 1;
1170 
1171         case BT_RFCOMM_DM:
1172             // DM #0 - we shouldn't get this, just give up
1173             log_info("Received DM #0");
1174             log_info("-> Closing down multiplexer");
1175             rfcomm_multiplexer_finalize(multiplexer);
1176             l2cap_disconnect(l2cap_cid, 0x13);
1177             return 1;
1178 
1179         case BT_RFCOMM_UIH:
1180             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1181                 // Multiplexer close down (CLD) -> close mutliplexer
1182                 log_info("Received Multiplexer close down command");
1183                 log_info("-> Closing down multiplexer");
1184                 rfcomm_multiplexer_finalize(multiplexer);
1185                 l2cap_disconnect(l2cap_cid, 0x13);
1186                 return 1;
1187             }
1188             switch (packet[payload_offset]){
1189                 case BT_RFCOMM_CLD_CMD:
1190                      // Multiplexer close down (CLD) -> close mutliplexer
1191                     log_info("Received Multiplexer close down command");
1192                     log_info("-> Closing down multiplexer");
1193                     rfcomm_multiplexer_finalize(multiplexer);
1194                     l2cap_disconnect(l2cap_cid, 0x13);
1195                     return 1;
1196 
1197                 case BT_RFCOMM_FCON_CMD:
1198                     multiplexer->fcon = 0x81;
1199                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1200                     return 1;
1201 
1202                 case BT_RFCOMM_FCOFF_CMD:
1203                     multiplexer->fcon = 0x80;
1204                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1205                     return 1;
1206 
1207                 case BT_RFCOMM_TEST_CMD: {
1208                     log_info("Received test command");
1209                     int len = packet[payload_offset+1] >> 1; // length < 125
1210                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1211                         len = RFCOMM_TEST_DATA_MAX_LEN;
1212                     }
1213                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1214                     multiplexer->test_data_len = len;
1215                     memcpy(multiplexer->test_data, &packet[payload_offset + 2], len);
1216                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1217                     return 1;
1218                 }
1219                 default:
1220                     break;
1221             }
1222             break;
1223 
1224         default:
1225             break;
1226 
1227     }
1228     return 0;
1229 }
1230 
1231 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1232     if (multiplexer->send_dm_for_dlci) return 1;
1233     if (multiplexer->nsc_command) return 1;
1234     if (multiplexer->fcon & 0x80) return 1;
1235     switch (multiplexer->state){
1236         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1237         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1238         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1239             return 1;
1240         case RFCOMM_MULTIPLEXER_OPEN:
1241             if (multiplexer->test_data_len) {
1242                 return 1;
1243             }
1244             break;
1245         default:
1246             break;
1247     }
1248     return 0;
1249 }
1250 
1251 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1252 
1253     if (event != MULT_EV_READY_TO_SEND) return;
1254 
1255     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1256 
1257     // process stored DM responses
1258     if (multiplexer->send_dm_for_dlci){
1259         uint8_t dlci = multiplexer->send_dm_for_dlci;
1260         multiplexer->send_dm_for_dlci = 0;
1261         rfcomm_send_dm_pf(multiplexer, dlci);
1262         return;
1263     }
1264 
1265     if (multiplexer->nsc_command){
1266         uint8_t command = multiplexer->nsc_command;
1267         multiplexer->nsc_command = 0;
1268         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1269         return;
1270     }
1271 
1272     if (multiplexer->fcon & 0x80){
1273         multiplexer->fcon &= 0x01;
1274         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1275 
1276         if (multiplexer->fcon == 0) return;
1277         // trigger client to send again after sending FCon Response
1278         rfcomm_notify_channel_can_send();
1279         return;
1280     }
1281 
1282     switch (multiplexer->state) {
1283         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1284             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1285             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1286             rfcomm_send_sabm(multiplexer, 0);
1287             break;
1288         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1289             log_info("Sending UA #0");
1290             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1291             rfcomm_send_ua(multiplexer, 0);
1292 
1293             rfcomm_multiplexer_opened(multiplexer);
1294             break;
1295         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1296             log_info("Sending UA #0");
1297             log_info("Closing down multiplexer");
1298             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1299             rfcomm_send_ua(multiplexer, 0);
1300 
1301             rfcomm_multiplexer_finalize(multiplexer);
1302             l2cap_disconnect(l2cap_cid, 0x13);
1303             break;
1304         case RFCOMM_MULTIPLEXER_OPEN:
1305             // respond to test command
1306             if (multiplexer->test_data_len){
1307                 int len = multiplexer->test_data_len;
1308                 log_info("Sending TEST Response with %u bytes", len);
1309                 multiplexer->test_data_len = 0;
1310                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1311                 return;
1312             }
1313             break;
1314         default:
1315             break;
1316     }
1317 }
1318 
1319 // MARK: RFCOMM CHANNEL
1320 
1321 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1322     channel->credits_incoming += credits;
1323     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1324 }
1325 
1326 static int rfcomm_channel_can_send(rfcomm_channel_t * channel){
1327     if (!channel->credits_outgoing) return 0;
1328     if ((channel->multiplexer->fcon & 1) == 0) return 0;
1329     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid);
1330 }
1331 
1332 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1333 
1334     log_info("rfcomm_channel_opened!");
1335 
1336     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1337     rfcomm_emit_channel_opened(rfChannel, 0);
1338     rfcomm_emit_port_configuration(rfChannel);
1339 
1340     // remove (potential) timer
1341     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1342     if (multiplexer->timer_active) {
1343         btstack_run_loop_remove_timer(&multiplexer->timer);
1344         multiplexer->timer_active = 0;
1345     }
1346     // hack for problem detecting authentication failure
1347     multiplexer->at_least_one_connection = 1;
1348 
1349     // request can send now if channel ready
1350     if (rfcomm_channel_ready_to_send(rfChannel)){
1351         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1352     }
1353 }
1354 
1355 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1356     const uint8_t frame_dlci = packet[0] >> 2;
1357     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1358     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1359     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1360     int request_can_send_now = 0;
1361 
1362     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1363     if (!channel) return;
1364 
1365     // handle new outgoing credits
1366     if (packet[1] == BT_RFCOMM_UIH_PF) {
1367 
1368         // add them
1369         uint16_t new_credits = packet[3+length_offset];
1370         channel->credits_outgoing += new_credits;
1371         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1372 
1373         // notify channel statemachine
1374         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1375         log_debug("rfcomm_channel_state_machine_with_channel, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1376         int rfcomm_channel_valid = 1;
1377         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1378         if (rfcomm_channel_valid){
1379             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1380                 request_can_send_now = 1;
1381             }
1382         }
1383     }
1384 
1385     // contains payload?
1386     if (size - 1 > payload_offset){
1387 
1388         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1389 
1390         // decrease incoming credit counter
1391         if (channel->credits_incoming > 0){
1392             channel->credits_incoming--;
1393         }
1394 
1395         // deliver payload
1396         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1397                               &packet[payload_offset], size-payload_offset-1);
1398     }
1399 
1400     // automatically provide new credits to remote device, if no incoming flow control
1401     if (!channel->incoming_flow_control && channel->credits_incoming < 5){
1402         channel->new_credits_incoming = RFCOMM_CREDITS;
1403         request_can_send_now = 1;
1404     }
1405 
1406     if (request_can_send_now){
1407         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1408     }
1409 }
1410 
1411 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1412     // priority of client request
1413     channel->pn_priority = event->priority;
1414 
1415     // new credits
1416     channel->credits_outgoing = event->credits_outgoing;
1417 
1418     // negotiate max frame size
1419     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1420         channel->max_frame_size = channel->multiplexer->max_frame_size;
1421     }
1422     if (channel->max_frame_size > event->max_frame_size) {
1423         channel->max_frame_size = event->max_frame_size;
1424     }
1425 
1426 }
1427 
1428 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1429 
1430     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1431 
1432     // remove from list
1433     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1434 
1435     // free channel
1436     btstack_memory_rfcomm_channel_free(channel);
1437 
1438     // update multiplexer timeout after channel was removed from list
1439     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1440 }
1441 
1442 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1443 
1444     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1445 
1446 
1447     // lookup existing channel
1448     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1449 
1450     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1451 
1452     if (channel) {
1453         int rfcomm_channel_valid = 1;
1454         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1455         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1456             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1457         }
1458         return;
1459     }
1460 
1461     // service registered?
1462     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1463     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1464     if (!service) {
1465         // discard request by sending disconnected mode
1466         multiplexer->send_dm_for_dlci = dlci;
1467         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1468         return;
1469     }
1470 
1471     // create channel for some events
1472     switch (event->type) {
1473         case CH_EVT_RCVD_SABM:
1474         case CH_EVT_RCVD_PN:
1475         case CH_EVT_RCVD_RPN_REQ:
1476         case CH_EVT_RCVD_RPN_CMD:
1477             // setup incoming channel
1478             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1479             if (!channel){
1480                 // discard request by sending disconnected mode
1481                 multiplexer->send_dm_for_dlci = dlci;
1482                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1483             }
1484             break;
1485         default:
1486             break;
1487     }
1488 
1489     if (!channel) {
1490         // discard request by sending disconnected mode
1491         multiplexer->send_dm_for_dlci = dlci;
1492         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1493         return;
1494     }
1495 
1496     int rfcomm_channel_valid = 1;
1497     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1498     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1499         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1500     }
1501 }
1502 
1503 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1504 
1505     UNUSED(size);   // ok: fixed format messages
1506 
1507     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1508     const uint8_t frame_dlci = packet[0] >> 2;
1509     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1510 	uint8_t message_len;  //   "
1511 
1512     // rfcomm: (1) command/control
1513     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1514     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1515     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1516     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1517     // rfcomm: (3+length_offset) credits if credits_offset == 1
1518     // rfcomm: (3+length_offest+credits_offset)
1519     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1520 
1521     rfcomm_channel_event_t event;
1522     rfcomm_channel_event_pn_t event_pn;
1523     rfcomm_channel_event_rpn_t event_rpn;
1524     rfcomm_channel_event_msc_t event_msc;
1525 
1526     // switch by rfcomm message type
1527     switch(packet[1]) {
1528 
1529         case BT_RFCOMM_SABM:
1530             event.type = CH_EVT_RCVD_SABM;
1531             log_info("Received SABM #%u", frame_dlci);
1532             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1533             break;
1534 
1535         case BT_RFCOMM_UA:
1536             event.type = CH_EVT_RCVD_UA;
1537             log_info("Received UA #%u",frame_dlci);
1538             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1539             break;
1540 
1541         case BT_RFCOMM_DISC:
1542             event.type = CH_EVT_RCVD_DISC;
1543             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1544             break;
1545 
1546         case BT_RFCOMM_DM:
1547         case BT_RFCOMM_DM_PF:
1548             event.type = CH_EVT_RCVD_DM;
1549             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1550             break;
1551 
1552         case BT_RFCOMM_UIH_PF:
1553         case BT_RFCOMM_UIH:
1554 
1555             message_len  = packet[payload_offset+1] >> 1;
1556 
1557             switch (packet[payload_offset]) {
1558                 case BT_RFCOMM_PN_CMD:
1559                     message_dlci = packet[payload_offset+2];
1560                     event_pn.super.type = CH_EVT_RCVD_PN;
1561                     event_pn.priority = packet[payload_offset+4];
1562                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1563                     event_pn.credits_outgoing = packet[payload_offset+9];
1564                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1565                         message_dlci, event_pn.credits_outgoing);
1566                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1567                     break;
1568 
1569                 case BT_RFCOMM_PN_RSP:
1570                     message_dlci = packet[payload_offset+2];
1571                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1572                     event_pn.priority = packet[payload_offset+4];
1573                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1574                     event_pn.credits_outgoing = packet[payload_offset+9];
1575                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1576                             event_pn.max_frame_size, event_pn.credits_outgoing);
1577                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1578                     break;
1579 
1580                 case BT_RFCOMM_MSC_CMD:
1581                     message_dlci = packet[payload_offset+2] >> 2;
1582                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1583                     event_msc.modem_status = packet[payload_offset+3];
1584                     log_info("Received MSC CMD for #%u, ", message_dlci);
1585                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1586                     break;
1587 
1588                 case BT_RFCOMM_MSC_RSP:
1589                     message_dlci = packet[payload_offset+2] >> 2;
1590                     event.type = CH_EVT_RCVD_MSC_RSP;
1591                     log_info("Received MSC RSP for #%u", message_dlci);
1592                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1593                     break;
1594 
1595                 case BT_RFCOMM_RPN_CMD:
1596                     message_dlci = packet[payload_offset+2] >> 2;
1597                     switch (message_len){
1598                         case 1:
1599                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1600                             event.type = CH_EVT_RCVD_RPN_REQ;
1601                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1602                             break;
1603                         case 8:
1604                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1605                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1606                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1607                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1608                             break;
1609                         default:
1610                             break;
1611                     }
1612                     break;
1613 
1614                 case BT_RFCOMM_RPN_RSP:
1615                     log_info("Received RPN response");
1616                     break;
1617 
1618                 case BT_RFCOMM_RLS_CMD: {
1619                     log_info("Received RLS command");
1620                     message_dlci = packet[payload_offset+2] >> 2;
1621                     rfcomm_channel_event_rls_t event_rls;
1622                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1623                     event_rls.line_status = packet[payload_offset+3];
1624                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1625                     break;
1626                 }
1627 
1628                 case BT_RFCOMM_RLS_RSP:
1629                     log_info("Received RLS response");
1630                     break;
1631 
1632                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1633                 // case BT_RFCOMM_TEST_CMD:
1634                 // case BT_RFCOMM_FCOFF_CMD:
1635                 // case BT_RFCOMM_FCON_CMD:
1636                 // everything else is an not supported command
1637                 default: {
1638                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1639                     multiplexer->nsc_command = packet[payload_offset];
1640                     break;
1641                 }
1642             }
1643             break;
1644 
1645         default:
1646             log_error("Received unknown RFCOMM message type %x", packet[1]);
1647             break;
1648     }
1649 
1650     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1651     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1652         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1653     }
1654 }
1655 
1656 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1657 
1658     if (packet_type == HCI_EVENT_PACKET){
1659         rfcomm_hci_event_handler(packet, size);
1660         return;
1661     }
1662 
1663     // we only handle l2cap packets for:
1664     if (packet_type != L2CAP_DATA_PACKET) return;
1665 
1666     //  - multiplexer itself
1667     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1668 
1669     if (handled) return;
1670 
1671     // - channel over open mutliplexer
1672     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1673     if (!multiplexer || multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) return;
1674 
1675     // channel data ?
1676     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1677     const uint8_t frame_dlci = packet[0] >> 2;
1678 
1679     if (frame_dlci && (packet[1] == BT_RFCOMM_UIH || packet[1] == BT_RFCOMM_UIH_PF)) {
1680         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1681         return;
1682     }
1683 
1684     rfcomm_channel_packet_handler(multiplexer, packet, size);
1685 }
1686 
1687 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1688     // note: exchanging MSC isn't neccessary to consider channel open
1689     // note: having outgoing credits is also not necessary to consider channel open
1690     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1691     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1692     // if (channel->credits_outgoing == 0) return 0;
1693     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u",
1694          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1695     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1696     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1697 
1698     return 1;
1699 }
1700 
1701 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1702     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %04x", channel->state_var);
1703     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1704     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1705     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1706     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1707     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1708     return 1;
1709 }
1710 
1711 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1712     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var | event);
1713 }
1714 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1715     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var & ~event);
1716 }
1717 
1718 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1719     switch (channel->state){
1720         case RFCOMM_CHANNEL_SEND_UIH_PN:
1721             log_debug("ch-ready: state %u", channel->state);
1722             return 1;
1723         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1724             log_debug("ch-ready: state %u", channel->state);
1725             return 1;
1726         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1727             log_debug("ch-ready: state %u", channel->state);
1728             return 1;
1729         case RFCOMM_CHANNEL_SEND_DISC:
1730             log_debug("ch-ready: state %u", channel->state);
1731             return 1;
1732         case RFCOMM_CHANNEL_SEND_DM:
1733             log_debug("ch-ready: state %u", channel->state);
1734             return 1;
1735         case RFCOMM_CHANNEL_OPEN:
1736             if (channel->new_credits_incoming) {
1737                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1738                 return 1;
1739             }
1740             break;
1741         case RFCOMM_CHANNEL_DLC_SETUP:
1742             if (channel->state_var & (
1743                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1744                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1745              )) {
1746                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1747                 return 1;
1748             }
1749             break;
1750 
1751         default:
1752             break;
1753     }
1754 
1755     if (channel->state_var & (
1756         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP   |
1757         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_INFO |
1758         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP  |
1759         RFCOMM_CHANNEL_STATE_VAR_SEND_UA       |
1760         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1761                              )){
1762         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1763         return 1;
1764     }
1765 
1766     if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID) {
1767         log_debug("ch-ready: rls_line_status");
1768         return 1;
1769     }
1770 
1771     return 0;
1772 }
1773 
1774 
1775 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1776 
1777     // log_info("rfcomm_channel_state_machine_with_channel: state %u, state_var %04x, event %u", channel->state, channel->state_var ,event->type);
1778 
1779     // channel != NULL -> channel valid
1780     *out_channel_valid = 1;
1781 
1782     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1783 
1784     // TODO: integrate in common switch
1785     if (event->type == CH_EVT_RCVD_DISC){
1786         rfcomm_emit_channel_closed(channel);
1787         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1788         return;
1789     }
1790 
1791     // TODO: integrate in common switch
1792     if (event->type == CH_EVT_RCVD_DM){
1793         log_info("Received DM message for #%u", channel->dlci);
1794         log_info("-> Closing channel locally for #%u", channel->dlci);
1795         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1796         rfcomm_channel_finalize(channel);
1797         *out_channel_valid = 0;
1798         return;
1799     }
1800 
1801     // remote port negotiation command - just accept everything for now
1802     //
1803     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1804     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1805     //   (Although the handling of individual settings are implementation-dependent.)"
1806     //
1807 
1808     // TODO: integrate in common switch
1809     if (event->type == CH_EVT_RCVD_RPN_CMD){
1810         // control port parameters
1811         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1812         rfcomm_rpn_data_update(&channel->rpn_data, &event_rpn->data);
1813         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1814         // notify client about new settings
1815         rfcomm_emit_port_configuration(channel);
1816         return;
1817     }
1818 
1819     // TODO: integrate in common switch
1820     if (event->type == CH_EVT_RCVD_RPN_REQ){
1821         // no values got accepted (no values have beens sent)
1822         channel->rpn_data.parameter_mask_0 = 0x00;
1823         channel->rpn_data.parameter_mask_1 = 0x00;
1824         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1825         return;
1826     }
1827 
1828     if (event->type == CH_EVT_RCVD_RLS_CMD){
1829         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1830         channel->rls_line_status = event_rls->line_status & 0x0f;
1831         log_info("CH_EVT_RCVD_RLS_CMD setting line status to 0x%0x", channel->rls_line_status);
1832         rfcomm_emit_remote_line_status(channel, event_rls->line_status);
1833         return;
1834     }
1835 
1836     // TODO: integrate in common switch
1837     if (event->type == CH_EVT_READY_TO_SEND){
1838         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP){
1839             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1840             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1841             rfcomm_send_uih_rpn_rsp(multiplexer, channel->dlci, &channel->rpn_data);
1842             return;
1843         }
1844         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1845             log_info("Sending MSC RSP for #%u", channel->dlci);
1846             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1847             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1848             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
1849             return;
1850         }
1851         if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID){
1852             log_info("Sending RLS RSP 0x%0x", channel->rls_line_status);
1853             uint8_t line_status = channel->rls_line_status;
1854             channel->rls_line_status = RFCOMM_RLS_STATUS_INVALID;
1855             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1856             return;
1857         }
1858     }
1859 
1860     // emit MSC status to app
1861     if (event->type == CH_EVT_RCVD_MSC_CMD){
1862         // notify client about new settings
1863         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1864         uint8_t modem_status_event[2+1];
1865         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1866         modem_status_event[1] = 1;
1867         modem_status_event[2] = event_msc->modem_status;
1868         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1869         // no return, MSC_CMD will be handled by state machine below
1870     }
1871 
1872     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1873 
1874     switch (channel->state) {
1875         case RFCOMM_CHANNEL_CLOSED:
1876             switch (event->type){
1877                 case CH_EVT_RCVD_SABM:
1878                     log_info("-> Inform app");
1879                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1880                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1881                     rfcomm_emit_connection_request(channel);
1882                     break;
1883                 case CH_EVT_RCVD_PN:
1884                     rfcomm_channel_accept_pn(channel, event_pn);
1885                     log_info("-> Inform app");
1886                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1887                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1888                     rfcomm_emit_connection_request(channel);
1889                     break;
1890                 default:
1891                     break;
1892             }
1893             break;
1894 
1895         case RFCOMM_CHANNEL_INCOMING_SETUP:
1896             switch (event->type){
1897                 case CH_EVT_RCVD_SABM:
1898                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1899                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1900                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1901                     }
1902                     break;
1903                 case CH_EVT_RCVD_PN:
1904                     rfcomm_channel_accept_pn(channel, event_pn);
1905                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1906                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1907                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1908                     }
1909                     break;
1910                 case CH_EVT_READY_TO_SEND:
1911                     // if / else if is used to check for state transition after sending
1912                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
1913                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
1914                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1915                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
1916                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
1917                         log_info("Sending UA #%u", channel->dlci);
1918                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1919                         rfcomm_send_ua(multiplexer, channel->dlci);
1920                     }
1921                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
1922                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
1923                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1924                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1925                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1926                      }
1927                     break;
1928                 default:
1929                     break;
1930             }
1931             break;
1932 
1933         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
1934             switch (event->type) {
1935                 case CH_EVT_MULTIPLEXER_READY:
1936                     log_info("Muliplexer opened, sending UIH PN next");
1937                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
1938                     break;
1939                 default:
1940                     break;
1941             }
1942             break;
1943 
1944         case RFCOMM_CHANNEL_SEND_UIH_PN:
1945             switch (event->type) {
1946                 case CH_EVT_READY_TO_SEND:
1947                     // update mtu
1948                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
1949                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
1950                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
1951                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
1952                     break;
1953                 default:
1954                     break;
1955             }
1956             break;
1957 
1958         case RFCOMM_CHANNEL_W4_PN_RSP:
1959             switch (event->type){
1960                 case CH_EVT_RCVD_PN_RSP:
1961                     // update max frame size
1962                     if (channel->max_frame_size > event_pn->max_frame_size) {
1963                         channel->max_frame_size = event_pn->max_frame_size;
1964                     }
1965                     // new credits
1966                     channel->credits_outgoing = event_pn->credits_outgoing;
1967                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
1968                     break;
1969                 default:
1970                     break;
1971             }
1972             break;
1973 
1974         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1975             switch (event->type) {
1976                 case CH_EVT_READY_TO_SEND:
1977                     log_info("Sending SABM #%u", channel->dlci);
1978                     channel->state = RFCOMM_CHANNEL_W4_UA;
1979                     rfcomm_send_sabm(multiplexer, channel->dlci);
1980                     break;
1981                 default:
1982                     break;
1983             }
1984             break;
1985 
1986         case RFCOMM_CHANNEL_W4_UA:
1987             switch (event->type){
1988                 case CH_EVT_RCVD_UA:
1989                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1990                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1991                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1992                     break;
1993                 default:
1994                     break;
1995             }
1996             break;
1997 
1998         case RFCOMM_CHANNEL_DLC_SETUP:
1999             switch (event->type){
2000                 case CH_EVT_RCVD_MSC_CMD:
2001                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2002                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2003                     break;
2004                 case CH_EVT_RCVD_MSC_RSP:
2005                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2006                     break;
2007 
2008                 case CH_EVT_READY_TO_SEND:
2009                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
2010                         log_info("Sending MSC CMD for #%u", channel->dlci);
2011                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2012                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
2013                         rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
2014                         break;
2015                     }
2016                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2017                         log_info("Providing credits for #%u", channel->dlci);
2018                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2019                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2020 
2021                         if (channel->new_credits_incoming) {
2022                             uint8_t new_credits = channel->new_credits_incoming;
2023                             channel->new_credits_incoming = 0;
2024                             rfcomm_channel_send_credits(channel, new_credits);
2025                         }
2026                         break;
2027 
2028                     }
2029                     break;
2030                 default:
2031                     break;
2032             }
2033             // finally done?
2034             if (rfcomm_channel_ready_for_open(channel)){
2035                 channel->state = RFCOMM_CHANNEL_OPEN;
2036                 rfcomm_channel_opened(channel);
2037             }
2038             break;
2039 
2040         case RFCOMM_CHANNEL_OPEN:
2041             switch (event->type){
2042                 case CH_EVT_RCVD_MSC_CMD:
2043                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2044                     break;
2045                 case CH_EVT_READY_TO_SEND:
2046                     if (channel->new_credits_incoming) {
2047                         uint8_t new_credits = channel->new_credits_incoming;
2048                         channel->new_credits_incoming = 0;
2049                         rfcomm_channel_send_credits(channel, new_credits);
2050                         break;
2051                     }
2052                     break;
2053                 case CH_EVT_RCVD_CREDITS:
2054                     rfcomm_notify_channel_can_send();
2055                     break;
2056                 default:
2057                     break;
2058             }
2059             break;
2060 
2061         case RFCOMM_CHANNEL_SEND_DM:
2062             switch (event->type) {
2063                 case CH_EVT_READY_TO_SEND:
2064                     log_info("Sending DM_PF for #%u", channel->dlci);
2065                     // don't emit channel closed - channel was never open
2066                     channel->state = RFCOMM_CHANNEL_CLOSED;
2067                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2068                     rfcomm_channel_finalize(channel);
2069                     *out_channel_valid = 0;
2070                     break;
2071                 default:
2072                     break;
2073             }
2074             break;
2075 
2076         case RFCOMM_CHANNEL_SEND_DISC:
2077             switch (event->type) {
2078                 case CH_EVT_READY_TO_SEND:
2079                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2080                     rfcomm_send_disc(multiplexer, channel->dlci);
2081                     break;
2082                 default:
2083                     break;
2084             }
2085             break;
2086 
2087         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2088             switch (event->type){
2089                 case CH_EVT_RCVD_UA:
2090                     channel->state = RFCOMM_CHANNEL_CLOSED;
2091                     rfcomm_emit_channel_closed(channel);
2092                     rfcomm_channel_finalize(channel);
2093                     *out_channel_valid = 0;
2094                     break;
2095                 default:
2096                     break;
2097             }
2098             break;
2099 
2100         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2101             switch (event->type) {
2102                 case CH_EVT_READY_TO_SEND:
2103                     log_info("Sending UA after DISC for #%u", channel->dlci);
2104                     channel->state = RFCOMM_CHANNEL_CLOSED;
2105                     rfcomm_send_ua(multiplexer, channel->dlci);
2106                     rfcomm_channel_finalize(channel);
2107                     *out_channel_valid = 0;
2108                     break;
2109                 default:
2110                     break;
2111             }
2112             break;
2113 
2114         default:
2115             break;
2116     }
2117 }
2118 
2119 // MARK: RFCOMM BTstack API
2120 
2121 void rfcomm_init(void){
2122     rfcomm_client_cid_generator = 0;
2123     rfcomm_multiplexers = NULL;
2124     rfcomm_services     = NULL;
2125     rfcomm_channels     = NULL;
2126     rfcomm_security_level = LEVEL_2;
2127 }
2128 
2129 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2130     rfcomm_security_level = security_level;
2131 }
2132 
2133 int rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2134     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2135     if (!channel){
2136         log_error("rfcomm_send cid 0x%02x doesn't exist!", rfcomm_cid);
2137         return 0;
2138     }
2139     return rfcomm_channel_can_send(channel);
2140 }
2141 
2142 void rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2143     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2144     if (!channel){
2145         log_error("rfcomm_send cid 0x%02x doesn't exist!", rfcomm_cid);
2146         return;
2147     }
2148     channel->waiting_for_can_send_now = 1;
2149     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2150 }
2151 
2152 static int rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2153     if (len > channel->max_frame_size){
2154         log_error("rfcomm_send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2155         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2156     }
2157 
2158 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2159     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2160         log_error("rfcomm_send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2161         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2162     }
2163 #endif
2164 
2165     if (!channel->credits_outgoing){
2166         log_info("rfcomm_send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2167         return RFCOMM_NO_OUTGOING_CREDITS;
2168     }
2169 
2170     if ((channel->multiplexer->fcon & 1) == 0){
2171         log_info("rfcomm_send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2172         return RFCOMM_AGGREGATE_FLOW_OFF;
2173     }
2174     return 0;
2175 }
2176 
2177 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2178     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2179     if (!channel){
2180         log_error("rfcomm_get_max_frame_size cid 0x%02x doesn't exist!", rfcomm_cid);
2181         return 0;
2182     }
2183     return channel->max_frame_size;
2184 }
2185 
2186 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2187 int rfcomm_reserve_packet_buffer(void){
2188 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2189     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2190     return 0;
2191 #else
2192     return l2cap_reserve_packet_buffer();
2193 #endif
2194 }
2195 
2196 void rfcomm_release_packet_buffer(void){
2197 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2198     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2199 #else
2200     l2cap_release_packet_buffer();
2201 #endif
2202 }
2203 
2204 uint8_t * rfcomm_get_outgoing_buffer(void){
2205 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2206     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2207 #else
2208     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2209 #endif
2210     // address + control + length (16) + no credit field
2211     return &rfcomm_out_buffer[4];
2212 }
2213 
2214 int rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2215     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2216     if (!channel){
2217         log_error("rfcomm_send_prepared cid 0x%02x doesn't exist!", rfcomm_cid);
2218         return 0;
2219     }
2220 
2221     int err = rfcomm_assert_send_valid(channel, len);
2222     if (err) return err;
2223 
2224 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2225     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2226         log_error("rfcomm_send_prepared: l2cap cannot send now");
2227         return BTSTACK_ACL_BUFFERS_FULL;
2228     }
2229 #else
2230     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2231         log_error("rfcomm_send_prepared: l2cap cannot send now");
2232         return BTSTACK_ACL_BUFFERS_FULL;
2233     }
2234 #endif
2235 
2236     // send might cause l2cap to emit new credits, update counters first
2237     if (len){
2238         channel->credits_outgoing--;
2239     } else {
2240         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2241     }
2242 
2243     int result = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2244 
2245     if (result != 0) {
2246         if (len) {
2247             channel->credits_outgoing++;
2248         }
2249         log_error("rfcomm_send_prepared: error %d", result);
2250         return result;
2251     }
2252 
2253     return result;
2254 }
2255 
2256 int rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2257     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2258     if (!channel){
2259         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2260         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2261     }
2262 
2263     int err = rfcomm_assert_send_valid(channel, len);
2264     if (err) return err;
2265     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2266         log_error("rfcomm_send_internal: l2cap cannot send now");
2267         return BTSTACK_ACL_BUFFERS_FULL;
2268     }
2269 
2270 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2271 #else
2272     rfcomm_reserve_packet_buffer();
2273 #endif
2274     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2275 
2276     memcpy(rfcomm_payload, data, len);
2277     err = rfcomm_send_prepared(rfcomm_cid, len);
2278 
2279 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2280 #else
2281     if (err){
2282         rfcomm_release_packet_buffer();
2283     }
2284 #endif
2285 
2286     return err;
2287 }
2288 
2289 // Sends Local Lnie Status, see LINE_STATUS_..
2290 int rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2291     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2292     if (!channel){
2293         log_error("rfcomm_send_local_line_status cid 0x%02x doesn't exist!", rfcomm_cid);
2294         return 0;
2295     }
2296     return rfcomm_send_uih_rls_cmd(channel->multiplexer, channel->dlci, line_status);
2297 }
2298 
2299 // Sned local modem status. see MODEM_STAUS_..
2300 int rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2301     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2302     if (!channel){
2303         log_error("rfcomm_send_modem_status cid 0x%02x doesn't exist!", rfcomm_cid);
2304         return 0;
2305     }
2306     return rfcomm_send_uih_msc_cmd(channel->multiplexer, channel->dlci, modem_status);
2307 }
2308 
2309 // Configure remote port
2310 int rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, rpn_flow_control_t flow_control){
2311     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2312     if (!channel){
2313         log_error("rfcomm_send_port_configuration cid 0x%02x doesn't exist!", rfcomm_cid);
2314         return 0;
2315     }
2316     rfcomm_rpn_data_t rpn_data;
2317     rpn_data.baud_rate = baud_rate;
2318     rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2319     rpn_data.flow_control = flow_control;
2320     rpn_data.xon = 0;
2321     rpn_data.xoff = 0;
2322     rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2323     rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2324     return rfcomm_send_uih_rpn_cmd(channel->multiplexer, channel->dlci, &rpn_data);
2325 }
2326 
2327 // Query remote port
2328 int rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2329     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2330     if (!channel){
2331         log_error("rfcomm_query_port_configuration cid 0x%02x doesn't exist!", rfcomm_cid);
2332         return 0;
2333     }
2334     return rfcomm_send_uih_rpn_req(channel->multiplexer, channel->dlci);
2335 }
2336 
2337 
2338 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2339     log_info("RFCOMM_CREATE_CHANNEL addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2340 
2341     // create new multiplexer if necessary
2342     uint8_t status = 0;
2343     uint8_t dlci = 0;
2344     int new_multiplexer = 0;
2345     rfcomm_channel_t * channel = NULL;
2346     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2347     if (!multiplexer) {
2348         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2349         if (!multiplexer){
2350             status = BTSTACK_MEMORY_ALLOC_FAILED;
2351             goto fail;
2352         }
2353         multiplexer->outgoing = 1;
2354         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2355         new_multiplexer = 1;
2356     }
2357 
2358     // check if channel for this remote service already exists
2359     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2360     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2361     if (channel){
2362         status = RFCOMM_CHANNEL_ALREADY_REGISTERED;
2363         goto fail;
2364     }
2365 
2366     // prepare channel
2367     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2368     if (!channel){
2369         status = BTSTACK_MEMORY_ALLOC_FAILED;
2370         goto fail;
2371     }
2372 
2373     // rfcomm_cid is already assigned by rfcomm_channel_create
2374     channel->incoming_flow_control = incoming_flow_control;
2375     channel->new_credits_incoming  = initial_credits;
2376     channel->packet_handler = packet_handler;
2377 
2378     // return rfcomm_cid
2379     if (out_rfcomm_cid){
2380         *out_rfcomm_cid = channel->rfcomm_cid;
2381     }
2382 
2383     // start multiplexer setup
2384     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2385         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2386         uint16_t l2cap_cid = 0;
2387 #ifdef RFCOMM_USE_ERTM
2388         // request
2389         rfcomm_ertm_request_t request;
2390         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2391         memcpy(request.addr, addr, 6);
2392         request.ertm_id = ++ertm_id;
2393         if (rfcomm_ertm_request_callback){
2394             (*rfcomm_ertm_request_callback)(&request);
2395         }
2396         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2397             multiplexer->ertm_id = request.ertm_id;
2398             status = l2cap_create_ertm_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2399                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2400         }
2401         else
2402 #endif
2403         {
2404             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2405         }
2406         if (status) goto fail;
2407         multiplexer->l2cap_cid = l2cap_cid;
2408         return 0;
2409     }
2410 
2411     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2412 
2413     // start connecting, if multiplexer is already up and running
2414     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2415     return 0;
2416 
2417 fail:
2418     if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2419     if (channel)         btstack_memory_rfcomm_channel_free(channel);
2420     return status;
2421 }
2422 
2423 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2424     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2425 }
2426 
2427 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2428     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2429 }
2430 
2431 void rfcomm_disconnect(uint16_t rfcomm_cid){
2432     log_info("RFCOMM_DISCONNECT cid 0x%02x", rfcomm_cid);
2433     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2434     if (!channel) return;
2435 
2436     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2437     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2438 }
2439 
2440 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2441     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2442 
2443     log_info("RFCOMM_REGISTER_SERVICE channel #%u mtu %u flow_control %u credits %u",
2444              channel, max_frame_size, incoming_flow_control, initial_credits);
2445 
2446     // check if already registered
2447     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2448     if (service){
2449         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2450     }
2451 
2452     // alloc structure
2453     service = btstack_memory_rfcomm_service_get();
2454     if (!service) {
2455         return BTSTACK_MEMORY_ALLOC_FAILED;
2456     }
2457 
2458     // register with l2cap if not registered before, max MTU
2459     if (btstack_linked_list_empty(&rfcomm_services)){
2460         l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2461     }
2462 
2463     // fill in
2464     service->packet_handler = packet_handler;
2465     service->server_channel = channel;
2466     service->max_frame_size = max_frame_size;
2467     service->incoming_flow_control = incoming_flow_control;
2468     service->incoming_initial_credits = initial_credits;
2469 
2470     // add to services list
2471     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2472 
2473     return 0;
2474 }
2475 
2476 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2477     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2478 
2479     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2480 }
2481 
2482 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2483     uint16_t max_frame_size){
2484 
2485     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2486 }
2487 
2488 void rfcomm_unregister_service(uint8_t service_channel){
2489     log_info("RFCOMM_UNREGISTER_SERVICE #%u", service_channel);
2490     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2491     if (!service) return;
2492     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2493     btstack_memory_rfcomm_service_free(service);
2494 
2495     // unregister if no services active
2496     if (btstack_linked_list_empty(&rfcomm_services)){
2497         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2498         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2499     }
2500 }
2501 
2502 void rfcomm_accept_connection(uint16_t rfcomm_cid){
2503     log_info("RFCOMM_ACCEPT_CONNECTION cid 0x%02x", rfcomm_cid);
2504     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2505     if (!channel) return;
2506     switch (channel->state) {
2507         case RFCOMM_CHANNEL_INCOMING_SETUP:
2508             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2509             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2510                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2511                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2512             }
2513             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2514                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2515                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2516             }
2517             // at least one of { PN RSP, UA } needs to be sent
2518             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2519             break;
2520         default:
2521             break;
2522     }
2523 
2524 }
2525 
2526 void rfcomm_decline_connection(uint16_t rfcomm_cid){
2527     log_info("RFCOMM_DECLINE_CONNECTION cid 0x%02x", rfcomm_cid);
2528     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2529     if (!channel) return;
2530     switch (channel->state) {
2531         case RFCOMM_CHANNEL_INCOMING_SETUP:
2532             channel->state = RFCOMM_CHANNEL_SEND_DM;
2533             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2534             break;
2535         default:
2536             break;
2537     }
2538 }
2539 
2540 void rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2541     log_info("RFCOMM_GRANT_CREDITS cid 0x%02x credits %u", rfcomm_cid, credits);
2542     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2543     if (!channel) return;
2544     if (!channel->incoming_flow_control) return;
2545     channel->new_credits_incoming += credits;
2546 
2547     // process
2548     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2549 }
2550 
2551 #ifdef RFCOMM_USE_ERTM
2552 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2553     rfcomm_ertm_request_callback  = request_callback;
2554     rfcomm_ertm_released_callback = released_callback;
2555 }
2556 #endif
2557