xref: /btstack/src/classic/rfcomm.c (revision a7a98a14513a32bb8a1b7d8f69d92f3c9f0b8988)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h> // memcpy
47 #include <stdint.h>
48 
49 #include "bluetooth_sdp.h"
50 #include "btstack_debug.h"
51 #include "btstack_event.h"
52 #include "btstack_memory.h"
53 #include "btstack_util.h"
54 #include "classic/core.h"
55 #include "classic/rfcomm.h"
56 #include "hci.h"
57 #include "hci_cmd.h"
58 #include "hci_dump.h"
59 #include "l2cap.h"
60 
61 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
62 #ifndef PRIxPTR
63 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
64 #define PRIxPTR "lx"
65 #else
66 #define PRIxPTR "x"
67 #endif
68 #endif
69 
70 // L2CAP ERTM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE and ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
71 #if defined(ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE) && defined(ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM)
72 #define RFCOMM_USE_OUTGOING_BUFFER
73 #define RFCOMM_USE_ERTM
74 #endif
75 
76 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
77 
78 #define RFCOMM_CREDITS 10
79 
80 // FCS calc
81 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
82 #define BT_RFCOMM_CRC_CHECK_LEN     3
83 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
84 
85 
86 typedef enum {
87     CH_EVT_RCVD_SABM = 1,
88     CH_EVT_RCVD_UA,
89     CH_EVT_RCVD_PN,
90     CH_EVT_RCVD_PN_RSP,
91     CH_EVT_RCVD_DISC,
92     CH_EVT_RCVD_DM,
93     CH_EVT_RCVD_MSC_CMD,
94     CH_EVT_RCVD_MSC_RSP,
95     CH_EVT_RCVD_NSC_RSP,
96     CH_EVT_RCVD_RLS_CMD,
97     CH_EVT_RCVD_RLS_RSP,
98     CH_EVT_RCVD_RPN_CMD,
99     CH_EVT_RCVD_RPN_REQ,
100     CH_EVT_RCVD_CREDITS,
101     CH_EVT_MULTIPLEXER_READY,
102     CH_EVT_READY_TO_SEND,
103 } RFCOMM_CHANNEL_EVENT;
104 
105 typedef struct rfcomm_channel_event {
106     RFCOMM_CHANNEL_EVENT type;
107     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
108 } rfcomm_channel_event_t;
109 
110 typedef struct rfcomm_channel_event_pn {
111     rfcomm_channel_event_t super;
112     uint16_t max_frame_size;
113     uint8_t  priority;
114     uint8_t  credits_outgoing;
115 } rfcomm_channel_event_pn_t;
116 
117 typedef struct rfcomm_channel_event_rpn {
118     rfcomm_channel_event_t super;
119     rfcomm_rpn_data_t data;
120 } rfcomm_channel_event_rpn_t;
121 
122 typedef struct rfcomm_channel_event_rls {
123     rfcomm_channel_event_t super;
124     uint8_t line_status;
125 } rfcomm_channel_event_rls_t;
126 
127 typedef struct rfcomm_channel_event_msc {
128     rfcomm_channel_event_t super;
129     uint8_t modem_status;
130 } rfcomm_channel_event_msc_t;
131 
132 
133 // global rfcomm data
134 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
135 
136 // linked lists for all
137 static btstack_linked_list_t rfcomm_multiplexers = NULL;
138 static btstack_linked_list_t rfcomm_channels = NULL;
139 static btstack_linked_list_t rfcomm_services = NULL;
140 
141 static gap_security_level_t rfcomm_security_level;
142 
143 #ifdef RFCOMM_USE_ERTM
144 static uint16_t ertm_id;
145 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
146 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
147 #endif
148 
149 #ifdef RFCOMM_USE_OUTGOING_BUFFER
150 static uint8_t outgoing_buffer[1030];
151 #endif
152 
153 static int  rfcomm_channel_can_send(rfcomm_channel_t * channel);
154 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
155 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
156 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
157 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
158 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
159 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
160 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
161 
162 // MARK: RFCOMM CLIENT EVENTS
163 
164 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
165 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
166     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
167              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
168     uint8_t event[11];
169     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
170     event[1] = sizeof(event) - 2;
171     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
172     event[8] = channel->dlci >> 1;
173     little_endian_store_16(event, 9, channel->rfcomm_cid);
174     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
175 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
176 }
177 
178 // API Change: BTstack-0.3.50x uses
179 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
180 // next Cydia release will use SVN version of this
181 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
182 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
183     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
184              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
185              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
186     uint8_t event[18];
187     uint8_t pos = 0;
188     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
189     event[pos++] = sizeof(event) - 2;                   // 1
190     event[pos++] = status;                              // 2
191     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
192     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
193 	event[pos++] = channel->dlci >> 1;                                      // 11
194 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
195 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
196     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
197     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
198 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
199 
200     // if channel opened successfully, also send can send now if possible
201     if (status) return;
202     if (rfcomm_channel_can_send(channel)){
203         rfcomm_emit_can_send_now(channel);
204     }
205 }
206 
207 // data: event(8), len(8), rfcomm_cid(16)
208 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
209     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
210     uint8_t event[4];
211     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
212     event[1] = sizeof(event) - 2;
213     little_endian_store_16(event, 2, channel->rfcomm_cid);
214     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
215 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
216 }
217 
218 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
219     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
220     uint8_t event[5];
221     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
222     event[1] = sizeof(event) - 2;
223     little_endian_store_16(event, 2, channel->rfcomm_cid);
224     event[4] = line_status;
225     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
226     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
227 }
228 
229 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel){
230     // notify client about new settings
231     uint8_t event[2+sizeof(rfcomm_rpn_data_t)];
232     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
233     event[1] = sizeof(rfcomm_rpn_data_t);
234     memcpy(&event[2], (uint8_t*) &channel->rpn_data, sizeof(rfcomm_rpn_data_t));
235     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
236     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
237 }
238 
239 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
240     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
241     uint8_t event[4];
242     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
243     event[1] = sizeof(event) - 2;
244     little_endian_store_16(event, 2, channel->rfcomm_cid);
245     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
246     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
247 }
248 
249 // MARK RFCOMM RPN DATA HELPER
250 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
251         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
252         rpn_data->flags = 0x03;               /* 8-n-1 */
253         rpn_data->flow_control = 0;           /* no flow control */
254         rpn_data->xon  = 0xd1;                /* XON */
255         rpn_data->xoff = 0xd3;                /* XOFF */
256         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
257         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
258 }
259 
260 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
261     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
262         dest->baud_rate = src->baud_rate;
263     }
264     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
265         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
266     }
267     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
268         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
269     }
270     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
271         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
272     }
273     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
274         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x30);
275     }
276     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
277         dest->xon = src->xon;
278     }
279     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
280         dest->xoff = src->xoff;
281     }
282     int i;
283     for (i=0; i < 6 ; i++){
284         uint8_t mask = 1 << i;
285         if (src->parameter_mask_1 & mask){
286             dest->flags = (dest->flags & ~mask) | (src->flags & mask);
287         }
288     }
289     // always copy parameter mask, too. informative for client, needed for response
290     dest->parameter_mask_0 = src->parameter_mask_0;
291     dest->parameter_mask_1 = src->parameter_mask_1;
292 }
293 // MARK: RFCOMM MULTIPLEXER HELPER
294 
295 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
296     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
297     uint16_t max_frame_size = l2cap_mtu - 5;
298     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
299     return max_frame_size;
300 }
301 
302 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
303     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
304     multiplexer->fcon = 1;
305     multiplexer->send_dm_for_dlci = 0;
306     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
307     multiplexer->test_data_len = 0;
308     multiplexer->nsc_command = 0;
309 }
310 
311 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
312 
313     // alloc structure
314     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
315     if (!multiplexer) return NULL;
316 
317     // fill in
318     rfcomm_multiplexer_initialize(multiplexer);
319     bd_addr_copy(multiplexer->remote_addr, addr);
320 
321     // add to services list
322     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
323 
324     return multiplexer;
325 }
326 
327 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
328     btstack_linked_item_t *it;
329     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
330         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
331         // ignore multiplexer in shutdown
332         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
333         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
334             return multiplexer;
335         };
336     }
337     return NULL;
338 }
339 
340 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
341     btstack_linked_item_t *it;
342     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
343         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
344         if (multiplexer->l2cap_cid == l2cap_cid) {
345             return multiplexer;
346         };
347     }
348     return NULL;
349 }
350 
351 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
352     btstack_linked_item_t *it;
353     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
354         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
355         if (channel->multiplexer == multiplexer) {
356             return 1;
357         }
358     }
359     return 0;
360 }
361 
362 // MARK: RFCOMM CHANNEL HELPER
363 
364 static void rfcomm_dump_channels(void){
365     btstack_linked_item_t * it;
366     int channels = 0;
367     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
368         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
369         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
370         channels++;
371     }
372 }
373 
374 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
375                                rfcomm_service_t *service, uint8_t server_channel){
376 
377     // don't use 0 as channel id
378     if (rfcomm_client_cid_generator == 0) ++rfcomm_client_cid_generator;
379 
380     // set defaults for port configuration (even for services)
381     rfcomm_rpn_data_set_defaults(&channel->rpn_data);
382 
383     channel->state            = RFCOMM_CHANNEL_CLOSED;
384     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
385 
386     channel->multiplexer      = multiplexer;
387     channel->rfcomm_cid       = rfcomm_client_cid_generator++;
388     channel->max_frame_size   = multiplexer->max_frame_size;
389 
390     channel->credits_incoming = 0;
391     channel->credits_outgoing = 0;
392 
393     // incoming flow control not active
394     channel->new_credits_incoming  = RFCOMM_CREDITS;
395     channel->incoming_flow_control = 0;
396 
397     channel->rls_line_status       = RFCOMM_RLS_STATUS_INVALID;
398 
399     channel->service = service;
400 	if (service) {
401 		// incoming connection
402     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
403         if (channel->max_frame_size > service->max_frame_size) {
404             channel->max_frame_size = service->max_frame_size;
405         }
406         channel->incoming_flow_control = service->incoming_flow_control;
407         channel->new_credits_incoming  = service->incoming_initial_credits;
408         channel->packet_handler        = service->packet_handler;
409 	} else {
410 		// outgoing connection
411 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
412 	}
413 }
414 
415 // service == NULL -> outgoing channel
416 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
417                                                 rfcomm_service_t * service, uint8_t server_channel){
418 
419     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
420     rfcomm_dump_channels();
421 
422     // alloc structure
423     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
424     if (!channel) return NULL;
425 
426     // fill in
427     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
428 
429     // add to services list
430     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
431 
432     return channel;
433 }
434 
435 static void rfcomm_notify_channel_can_send(void){
436     btstack_linked_list_iterator_t it;
437     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
438     while (btstack_linked_list_iterator_has_next(&it)){
439         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
440         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
441         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
442 
443         channel->waiting_for_can_send_now = 0;
444         rfcomm_emit_can_send_now(channel);
445     }
446 }
447 
448 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
449     btstack_linked_item_t *it;
450     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
451         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
452         if (channel->rfcomm_cid == rfcomm_cid) {
453             return channel;
454         };
455     }
456     return NULL;
457 }
458 
459 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
460     btstack_linked_item_t *it;
461     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
462         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
463         if (channel->dlci == dlci && channel->multiplexer == multiplexer) {
464             return channel;
465         };
466     }
467     return NULL;
468 }
469 
470 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
471     btstack_linked_item_t *it;
472     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
473         rfcomm_service_t * service = ((rfcomm_service_t *) it);
474         if ( service->server_channel == server_channel){
475             return service;
476         };
477     }
478     return NULL;
479 }
480 
481 // MARK: RFCOMM SEND
482 
483 /**
484  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
485  */
486 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
487 
488     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
489 
490 #ifdef RFCOMM_USE_OUTGOING_BUFFER
491     uint8_t * rfcomm_out_buffer = outgoing_buffer;
492 #else
493     l2cap_reserve_packet_buffer();
494     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
495 #endif
496 
497 	uint16_t pos = 0;
498 	uint8_t crc_fields = 3;
499 
500 	rfcomm_out_buffer[pos++] = address;
501 	rfcomm_out_buffer[pos++] = control;
502 
503 	// length field can be 1 or 2 octets
504 	if (len < 128){
505 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
506 	} else {
507 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
508 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
509 		crc_fields++;
510 	}
511 
512 	// add credits for UIH frames when PF bit is set
513 	if (control == BT_RFCOMM_UIH_PF){
514 		rfcomm_out_buffer[pos++] = credits;
515 	}
516 
517 	// copy actual data
518 	if (len) {
519 		memcpy(&rfcomm_out_buffer[pos], data, len);
520 		pos += len;
521 	}
522 
523 	// UIH frames only calc FCS over address + control (5.1.1)
524 	if ((control & 0xef) == BT_RFCOMM_UIH){
525 		crc_fields = 2;
526 	}
527 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
528 
529 #ifdef RFCOMM_USE_OUTGOING_BUFFER
530     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
531 #else
532     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
533 #endif
534 
535     return err;
536 }
537 
538 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
539 static int rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
540 
541     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
542     uint8_t control = BT_RFCOMM_UIH;
543 
544 #ifdef RFCOMM_USE_OUTGOING_BUFFER
545     uint8_t * rfcomm_out_buffer = outgoing_buffer;
546 #else
547     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
548 #endif
549 
550     uint16_t pos = 0;
551     rfcomm_out_buffer[pos++] = address;
552     rfcomm_out_buffer[pos++] = control;
553     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
554     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
555 
556     // actual data is already in place
557     pos += len;
558 
559     // UIH frames only calc FCS over address + control (5.1.1)
560     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
561 
562 #ifdef RFCOMM_USE_OUTGOING_BUFFER
563     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
564 #else
565     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
566 #endif
567 
568     return err;
569 }
570 
571 // C/R Flag in Address
572 // - terms: initiator = station that creates multiplexer with SABM
573 // - terms: responder = station that responds to multiplexer setup with UA
574 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
575 //    - command initiator = 1 /response responder = 1
576 //    - command responder = 0 /response initiator = 0
577 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
578 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
579 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
580 
581 // C/R Flag in Message
582 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
583 //   - If the C/R bit is set to 1 the message is a command
584 //   - if it is set to 0 the message is a response.
585 
586 // temp/old messge construction
587 
588 // new object oriented version
589 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
590 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
591     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
592 }
593 
594 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
595 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
596     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
597 }
598 
599 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
600 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
601     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
602 }
603 
604 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
605 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
606     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
607 }
608 
609 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
610     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
611     uint8_t payload[2];
612     uint8_t pos = 0;
613     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
614     payload[pos++] = (0 << 1) | 1;  // len
615     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
616 }
617 
618 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
619 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
620 //     uint8_t payload[2+len];
621 //     uint8_t pos = 0;
622 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
623 //     payload[pos++] = (len + 1) << 1 | 1;  // len
624 //     memcpy(&payload[pos], data, len);
625 //     pos += len;
626 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
627 // }
628 
629 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
630     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
631     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
632     uint8_t pos = 0;
633     payload[pos++] = BT_RFCOMM_TEST_RSP;
634     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
635         len = RFCOMM_TEST_DATA_MAX_LEN;
636     }
637     payload[pos++] = (len << 1) | 1;  // len
638     memcpy(&payload[pos], data, len);
639     pos += len;
640     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
641 }
642 
643 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
644 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
645 	uint8_t payload[4];
646 	uint8_t pos = 0;
647 	payload[pos++] = BT_RFCOMM_MSC_CMD;
648 	payload[pos++] = (2 << 1) | 1;  // len
649 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
650 	payload[pos++] = signals;
651 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
652 }
653 
654 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
655 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
656 	uint8_t payload[4];
657 	uint8_t pos = 0;
658 	payload[pos++] = BT_RFCOMM_MSC_RSP;
659 	payload[pos++] = (2 << 1) | 1;  // len
660 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
661 	payload[pos++] = signals;
662 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
663 }
664 
665 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
666     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
667     uint8_t payload[3];
668     uint8_t pos = 0;
669     payload[pos++] = BT_RFCOMM_NSC_RSP;
670     payload[pos++] = (1 << 1) | 1;  // len
671     payload[pos++] = command;
672     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
673 }
674 
675 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
676 	uint8_t payload[10];
677 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
678 	uint8_t pos = 0;
679 	payload[pos++] = BT_RFCOMM_PN_CMD;
680 	payload[pos++] = (8 << 1) | 1;  // len
681 	payload[pos++] = dlci;
682 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
683 	payload[pos++] = 0; // priority
684 	payload[pos++] = 0; // max 60 seconds ack
685 	payload[pos++] = max_frame_size & 0xff; // max framesize low
686 	payload[pos++] = max_frame_size >> 8;   // max framesize high
687 	payload[pos++] = 0x00; // number of retransmissions
688 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
689 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
690 }
691 
692 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
693 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
694                                        uint8_t priority, uint16_t max_frame_size){
695 	uint8_t payload[10];
696 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
697 	uint8_t pos = 0;
698 	payload[pos++] = BT_RFCOMM_PN_RSP;
699 	payload[pos++] = (8 << 1) | 1;  // len
700 	payload[pos++] = dlci;
701 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
702 	payload[pos++] = priority; // priority
703 	payload[pos++] = 0; // max 60 seconds ack
704 	payload[pos++] = max_frame_size & 0xff; // max framesize low
705 	payload[pos++] = max_frame_size >> 8;   // max framesize high
706 	payload[pos++] = 0x00; // number of retransmissions
707 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
708 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
709 }
710 
711 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
712     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
713     uint8_t payload[4];
714     uint8_t pos = 0;
715     payload[pos++] = BT_RFCOMM_RLS_CMD;
716     payload[pos++] = (2 << 1) | 1;  // len
717     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
718     payload[pos++] = line_status;
719     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
720 }
721 
722 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
723     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
724     uint8_t payload[4];
725     uint8_t pos = 0;
726     payload[pos++] = BT_RFCOMM_RLS_RSP;
727     payload[pos++] = (2 << 1) | 1;  // len
728     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
729     payload[pos++] = line_status;
730     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
731 }
732 
733 static int rfcomm_send_uih_rpn_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
734     uint8_t payload[10];
735     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
736     uint8_t pos = 0;
737     payload[pos++] = BT_RFCOMM_RPN_CMD;
738     payload[pos++] = (8 << 1) | 1;  // len
739     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
740     payload[pos++] = rpn_data->baud_rate;
741     payload[pos++] = rpn_data->flags;
742     payload[pos++] = rpn_data->flow_control;
743     payload[pos++] = rpn_data->xon;
744     payload[pos++] = rpn_data->xoff;
745     payload[pos++] = rpn_data->parameter_mask_0;
746     payload[pos++] = rpn_data->parameter_mask_1;
747     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
748 }
749 
750 static int rfcomm_send_uih_rpn_req(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
751     uint8_t payload[3];
752     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
753     uint8_t pos = 0;
754     payload[pos++] = BT_RFCOMM_RPN_CMD;
755     payload[pos++] = (1 << 1) | 1;  // len
756     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
757     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
758 }
759 
760 static int rfcomm_send_uih_rpn_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
761 	uint8_t payload[10];
762 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
763 	uint8_t pos = 0;
764 	payload[pos++] = BT_RFCOMM_RPN_RSP;
765 	payload[pos++] = (8 << 1) | 1;  // len
766 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
767 	payload[pos++] = rpn_data->baud_rate;
768 	payload[pos++] = rpn_data->flags;
769 	payload[pos++] = rpn_data->flow_control;
770 	payload[pos++] = rpn_data->xon;
771 	payload[pos++] = rpn_data->xoff;
772 	payload[pos++] = rpn_data->parameter_mask_0;
773 	payload[pos++] = rpn_data->parameter_mask_1;
774 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
775 }
776 
777 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
778     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
779     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
780 }
781 
782 // depending on channel state emit channel opened with status or channel closed
783 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
784     // emit appropriate events
785     switch(channel->state){
786         case RFCOMM_CHANNEL_OPEN:
787         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
788             rfcomm_emit_channel_closed(channel);
789             break;
790         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
791             // remote didn't wait until we send the UA disc
792             // close event already emitted
793             break;
794         default:
795             rfcomm_emit_channel_opened(channel, status);
796             break;
797     }
798 }
799 
800 // MARK: RFCOMM MULTIPLEXER
801 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
802     if (multiplexer->timer_active) {
803         btstack_run_loop_remove_timer(&multiplexer->timer);
804         multiplexer->timer_active = 0;
805     }
806 }
807 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
808     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
809     btstack_memory_rfcomm_multiplexer_free(multiplexer);
810 }
811 
812 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
813     // remove (potential) timer
814     rfcomm_multiplexer_stop_timer(multiplexer);
815 
816     // close and remove all channels
817     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
818     while (it->next){
819         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
820         if (channel->multiplexer == multiplexer) {
821             // emit open with status or closed
822             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
823             // remove from list
824             it->next = it->next->next;
825             // free channel struct
826             btstack_memory_rfcomm_channel_free(channel);
827         } else {
828             it = it->next;
829         }
830     }
831 
832     // remove mutliplexer
833     rfcomm_multiplexer_free(multiplexer);
834 }
835 
836 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
837     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
838     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
839 
840     log_info("rfcomm_multiplexer_timer_handler timeout: shutting down multiplexer! (no channels)");
841     uint16_t l2cap_cid = multiplexer->l2cap_cid;
842     rfcomm_multiplexer_finalize(multiplexer);
843     l2cap_disconnect(l2cap_cid, 0x13);
844 }
845 
846 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
847     if (multiplexer->timer_active) {
848         btstack_run_loop_remove_timer(&multiplexer->timer);
849         multiplexer->timer_active = 0;
850     }
851     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
852 
853     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
854     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
855     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
856     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
857     btstack_run_loop_add_timer(&multiplexer->timer);
858     multiplexer->timer_active = 1;
859 }
860 
861 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
862     log_info("Multiplexer up and running");
863     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
864 
865     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
866 
867     // transition of channels that wait for multiplexer
868     btstack_linked_item_t *it;
869     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
870         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
871         if (channel->multiplexer != multiplexer) continue;
872         int rfcomm_channel_valid = 1;
873         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
874         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
875             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
876         }
877     }
878     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
879 
880     // request can send now for multiplexer if ready
881     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
882         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
883     }
884 }
885 
886 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
887 
888     log_debug("rfcomm_handle_can_send_now enter: %u", l2cap_cid);
889 
890     btstack_linked_list_iterator_t it;
891     int token_consumed = 0;
892 
893     // forward token to multiplexer
894     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
895     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
896         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
897         if (multiplexer->l2cap_cid != l2cap_cid) continue;
898         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
899             log_debug("rfcomm_handle_can_send_now enter: multiplexer token");
900             token_consumed = 1;
901             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
902         }
903     }
904 
905     // forward token to channel state machine
906     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
907     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
908         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
909         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
910         // channel state machine
911         if (rfcomm_channel_ready_to_send(channel)){
912             log_debug("rfcomm_handle_can_send_now enter: channel token");
913             token_consumed = 1;
914             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
915             int rfcomm_channel_valid = 1;
916             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
917         }
918     }
919 
920     // forward token to client
921     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
922     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
923         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
924         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
925         // client waiting for can send now
926         if (!channel->waiting_for_can_send_now)    continue;
927         if ((channel->multiplexer->fcon & 1) == 0) continue;
928         if (!channel->credits_outgoing){
929             log_debug("rfcomm_handle_can_send_now waiting to send but no credits (ignore)");
930             continue;
931         }
932 
933         log_debug("rfcomm_handle_can_send_now enter: client token");
934         token_consumed = 1;
935         channel->waiting_for_can_send_now = 0;
936         rfcomm_emit_can_send_now(channel);
937     }
938 
939     // if token was consumed, request another one
940     if (token_consumed) {
941         l2cap_request_can_send_now_event(l2cap_cid);
942     }
943 
944     log_debug("rfcomm_handle_can_send_now exit");
945 }
946 
947 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
948     multiplexer->state = state;
949     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
950 }
951 
952 /**
953  * @return handled packet
954  */
955 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
956 
957     UNUSED(size);   // ok: handling own l2cap events
958 
959     bd_addr_t event_addr;
960     uint16_t  psm;
961     uint16_t l2cap_cid;
962     hci_con_handle_t con_handle;
963     rfcomm_multiplexer_t *multiplexer = NULL;
964     uint8_t status;
965 
966     switch (hci_event_packet_get_type(packet)) {
967 
968         // accept incoming rfcomm connection if no multiplexer exists yet
969         case L2CAP_EVENT_INCOMING_CONNECTION:
970             // data: event(8), len(8), address(48), handle (16),  psm (16), source cid(16) dest cid(16)
971             reverse_bd_addr(&packet[2], event_addr);
972             con_handle = little_endian_read_16(packet,  8);
973             psm        = little_endian_read_16(packet, 10);
974             l2cap_cid  = little_endian_read_16(packet, 12);
975 
976             if (psm != BLUETOOTH_PROTOCOL_RFCOMM) break;
977 
978             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
979 
980             if (multiplexer) {
981                 log_info("INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => decline - multiplexer already exists", l2cap_cid);
982                 l2cap_decline_connection(l2cap_cid);
983                 return 1;
984             }
985 
986             // create and inititialize new multiplexer instance (incoming)
987             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
988             if (!multiplexer){
989                 log_info("INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => decline - no memory left", l2cap_cid);
990                 l2cap_decline_connection(l2cap_cid);
991                 return 1;
992             }
993 
994             multiplexer->con_handle = con_handle;
995             multiplexer->l2cap_cid = l2cap_cid;
996             //
997             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
998             log_info("L2CAP_EVENT_INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => accept", l2cap_cid);
999 
1000 #ifdef RFCOMM_USE_ERTM
1001             // request
1002             rfcomm_ertm_request_t request;
1003             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1004             memcpy(request.addr, event_addr, 6);
1005             request.ertm_id = ++ertm_id;
1006             if (rfcomm_ertm_request_callback){
1007                 (*rfcomm_ertm_request_callback)(&request);
1008             }
1009             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1010                 multiplexer->ertm_id = request.ertm_id;
1011                 l2cap_accept_ertm_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1012             }
1013             return 1;
1014 #endif
1015 
1016             l2cap_accept_connection(l2cap_cid);
1017             return 1;
1018 
1019         // l2cap connection opened -> store l2cap_cid, remote_addr
1020         case L2CAP_EVENT_CHANNEL_OPENED:
1021 
1022             if (little_endian_read_16(packet, 11) != BLUETOOTH_PROTOCOL_RFCOMM) break;
1023 
1024             status = packet[2];
1025             log_info("L2CAP_EVENT_CHANNEL_OPENED for BLUETOOTH_PROTOCOL_RFCOMM, status %u", status);
1026 
1027             // get multiplexer for remote addr
1028             con_handle = little_endian_read_16(packet, 9);
1029             l2cap_cid = little_endian_read_16(packet, 13);
1030             reverse_bd_addr(&packet[3], event_addr);
1031             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1032             if (!multiplexer) {
1033                 log_error("L2CAP_EVENT_CHANNEL_OPENED but no multiplexer prepared");
1034                 return 1;
1035             }
1036 
1037             // on l2cap open error discard everything
1038             if (status){
1039 
1040                 // remove (potential) timer
1041                 rfcomm_multiplexer_stop_timer(multiplexer);
1042 
1043                 // mark multiplexer as shutting down
1044                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1045 
1046                 // emit rfcomm_channel_opened with status and free channel
1047                 // note: repeatedly go over list until full iteration causes no further change
1048                 int done;
1049                 do {
1050                     done = 1;
1051                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1052                     while (it->next) {
1053                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1054                         if (channel->multiplexer == multiplexer){
1055                             done = 0;
1056                             rfcomm_emit_channel_opened(channel, status);
1057                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1058                             btstack_memory_rfcomm_channel_free(channel);
1059                             break;
1060                         } else {
1061                             it = it->next;
1062                         }
1063                     }
1064                 } while (!done);
1065 
1066                 // free multiplexer
1067                 rfcomm_multiplexer_free(multiplexer);
1068                 return 1;
1069             }
1070 
1071             // following could be: rfcom_multiplexer_state_machein(..., EVENT_L2CAP_OPENED)
1072 
1073             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1074                 log_info("L2CAP_EVENT_CHANNEL_OPENED: outgoing connection");
1075                 // wrong remote addr
1076                 if (bd_addr_cmp(event_addr, multiplexer->remote_addr)) break;
1077                 multiplexer->l2cap_cid = l2cap_cid;
1078                 multiplexer->con_handle = con_handle;
1079                 // send SABM #0
1080                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1081 
1082             } else { // multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0
1083 
1084                 // set max frame size based on l2cap MTU
1085                 multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1086             }
1087             return 1;
1088 
1089             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1090 
1091         // Notify channel packet handler if they can send now
1092         case L2CAP_EVENT_CAN_SEND_NOW:
1093             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1094             rfcomm_handle_can_send_now(l2cap_cid);
1095             return 1;
1096 
1097         case L2CAP_EVENT_CHANNEL_CLOSED:
1098             // data: event (8), len(8), channel (16)
1099             l2cap_cid = little_endian_read_16(packet, 2);
1100             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1101             log_info("L2CAP_EVENT_CHANNEL_CLOSED cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1102             if (!multiplexer) break;
1103             log_info("L2CAP_EVENT_CHANNEL_CLOSED state %u", multiplexer->state);
1104             // no need to call l2cap_disconnect here, as it's already closed
1105             rfcomm_multiplexer_finalize(multiplexer);
1106             return 1;
1107 
1108 #ifdef RFCOMM_USE_ERTM
1109         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1110             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1111             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1112             if (multiplexer) {
1113                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1114                 if (rfcomm_ertm_released_callback){
1115                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1116                 }
1117             }
1118             break;
1119 #endif
1120 
1121         default:
1122             break;
1123     }
1124     return 0;
1125 }
1126 
1127 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1128     // get or create a multiplexer for a certain device
1129     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1130     if (!multiplexer) return 0;
1131 
1132     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1133 
1134 	// but only care for multiplexer control channel
1135     uint8_t frame_dlci = packet[0] >> 2;
1136     if (frame_dlci) return 0;
1137     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1138     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1139     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1140     switch (packet[1]){
1141 
1142         case BT_RFCOMM_SABM:
1143             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1144                 log_info("Received SABM #0");
1145                 multiplexer->outgoing = 0;
1146                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1147                 return 1;
1148             }
1149             break;
1150 
1151         case BT_RFCOMM_UA:
1152             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1153                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1154                 log_info("Received UA #0 ");
1155                 rfcomm_multiplexer_opened(multiplexer);
1156                 return 1;
1157             }
1158             break;
1159 
1160         case BT_RFCOMM_DISC:
1161             // DISC #0 -> send UA #0, close multiplexer
1162             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1163             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1164             return 1;
1165 
1166         case BT_RFCOMM_DM:
1167             // DM #0 - we shouldn't get this, just give up
1168             log_info("Received DM #0");
1169             log_info("-> Closing down multiplexer");
1170             rfcomm_multiplexer_finalize(multiplexer);
1171             l2cap_disconnect(l2cap_cid, 0x13);
1172             return 1;
1173 
1174         case BT_RFCOMM_UIH:
1175             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1176                 // Multiplexer close down (CLD) -> close mutliplexer
1177                 log_info("Received Multiplexer close down command");
1178                 log_info("-> Closing down multiplexer");
1179                 rfcomm_multiplexer_finalize(multiplexer);
1180                 l2cap_disconnect(l2cap_cid, 0x13);
1181                 return 1;
1182             }
1183             switch (packet[payload_offset]){
1184                 case BT_RFCOMM_CLD_CMD:
1185                      // Multiplexer close down (CLD) -> close mutliplexer
1186                     log_info("Received Multiplexer close down command");
1187                     log_info("-> Closing down multiplexer");
1188                     rfcomm_multiplexer_finalize(multiplexer);
1189                     l2cap_disconnect(l2cap_cid, 0x13);
1190                     return 1;
1191 
1192                 case BT_RFCOMM_FCON_CMD:
1193                     multiplexer->fcon = 0x81;
1194                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1195                     return 1;
1196 
1197                 case BT_RFCOMM_FCOFF_CMD:
1198                     multiplexer->fcon = 0x80;
1199                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1200                     return 1;
1201 
1202                 case BT_RFCOMM_TEST_CMD: {
1203                     log_info("Received test command");
1204                     int len = packet[payload_offset+1] >> 1; // length < 125
1205                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1206                         len = RFCOMM_TEST_DATA_MAX_LEN;
1207                     }
1208                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1209                     multiplexer->test_data_len = len;
1210                     memcpy(multiplexer->test_data, &packet[payload_offset + 2], len);
1211                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1212                     return 1;
1213                 }
1214                 default:
1215                     break;
1216             }
1217             break;
1218 
1219         default:
1220             break;
1221 
1222     }
1223     return 0;
1224 }
1225 
1226 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1227     if (multiplexer->send_dm_for_dlci) return 1;
1228     if (multiplexer->nsc_command) return 1;
1229     if (multiplexer->fcon & 0x80) return 1;
1230     switch (multiplexer->state){
1231         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1232         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1233         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1234             return 1;
1235         case RFCOMM_MULTIPLEXER_OPEN:
1236             if (multiplexer->test_data_len) {
1237                 return 1;
1238             }
1239             break;
1240         default:
1241             break;
1242     }
1243     return 0;
1244 }
1245 
1246 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1247 
1248     if (event != MULT_EV_READY_TO_SEND) return;
1249 
1250     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1251 
1252     // process stored DM responses
1253     if (multiplexer->send_dm_for_dlci){
1254         uint8_t dlci = multiplexer->send_dm_for_dlci;
1255         multiplexer->send_dm_for_dlci = 0;
1256         rfcomm_send_dm_pf(multiplexer, dlci);
1257         return;
1258     }
1259 
1260     if (multiplexer->nsc_command){
1261         uint8_t command = multiplexer->nsc_command;
1262         multiplexer->nsc_command = 0;
1263         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1264         return;
1265     }
1266 
1267     if (multiplexer->fcon & 0x80){
1268         multiplexer->fcon &= 0x01;
1269         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1270 
1271         if (multiplexer->fcon == 0) return;
1272         // trigger client to send again after sending FCon Response
1273         rfcomm_notify_channel_can_send();
1274         return;
1275     }
1276 
1277     switch (multiplexer->state) {
1278         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1279             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1280             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1281             rfcomm_send_sabm(multiplexer, 0);
1282             break;
1283         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1284             log_info("Sending UA #0");
1285             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1286             rfcomm_send_ua(multiplexer, 0);
1287 
1288             rfcomm_multiplexer_opened(multiplexer);
1289             break;
1290         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1291             log_info("Sending UA #0");
1292             log_info("Closing down multiplexer");
1293             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1294             rfcomm_send_ua(multiplexer, 0);
1295 
1296             rfcomm_multiplexer_finalize(multiplexer);
1297             l2cap_disconnect(l2cap_cid, 0x13);
1298             break;
1299         case RFCOMM_MULTIPLEXER_OPEN:
1300             // respond to test command
1301             if (multiplexer->test_data_len){
1302                 int len = multiplexer->test_data_len;
1303                 log_info("Sending TEST Response with %u bytes", len);
1304                 multiplexer->test_data_len = 0;
1305                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1306                 return;
1307             }
1308             break;
1309         default:
1310             break;
1311     }
1312 }
1313 
1314 // MARK: RFCOMM CHANNEL
1315 
1316 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1317     channel->credits_incoming += credits;
1318     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1319 }
1320 
1321 static int rfcomm_channel_can_send(rfcomm_channel_t * channel){
1322     if (!channel->credits_outgoing) return 0;
1323     if ((channel->multiplexer->fcon & 1) == 0) return 0;
1324     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid);
1325 }
1326 
1327 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1328 
1329     log_info("rfcomm_channel_opened!");
1330 
1331     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1332     rfcomm_emit_channel_opened(rfChannel, 0);
1333     rfcomm_emit_port_configuration(rfChannel);
1334 
1335     // remove (potential) timer
1336     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1337     if (multiplexer->timer_active) {
1338         btstack_run_loop_remove_timer(&multiplexer->timer);
1339         multiplexer->timer_active = 0;
1340     }
1341     // hack for problem detecting authentication failure
1342     multiplexer->at_least_one_connection = 1;
1343 
1344     // request can send now if channel ready
1345     if (rfcomm_channel_ready_to_send(rfChannel)){
1346         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1347     }
1348 }
1349 
1350 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1351     const uint8_t frame_dlci = packet[0] >> 2;
1352     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1353     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1354     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1355     int request_can_send_now = 0;
1356 
1357     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1358     if (!channel) return;
1359 
1360     // handle new outgoing credits
1361     if (packet[1] == BT_RFCOMM_UIH_PF) {
1362 
1363         // add them
1364         uint16_t new_credits = packet[3+length_offset];
1365         channel->credits_outgoing += new_credits;
1366         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1367 
1368         // notify channel statemachine
1369         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1370         log_debug("rfcomm_channel_state_machine_with_channel, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1371         int rfcomm_channel_valid = 1;
1372         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1373         if (rfcomm_channel_valid){
1374             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1375                 request_can_send_now = 1;
1376             }
1377         }
1378     }
1379 
1380     // contains payload?
1381     if (size - 1 > payload_offset){
1382 
1383         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1384 
1385         // decrease incoming credit counter
1386         if (channel->credits_incoming > 0){
1387             channel->credits_incoming--;
1388         }
1389 
1390         // deliver payload
1391         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1392                               &packet[payload_offset], size-payload_offset-1);
1393     }
1394 
1395     // automatically provide new credits to remote device, if no incoming flow control
1396     if (!channel->incoming_flow_control && channel->credits_incoming < 5){
1397         channel->new_credits_incoming = RFCOMM_CREDITS;
1398         request_can_send_now = 1;
1399     }
1400 
1401     if (request_can_send_now){
1402         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1403     }
1404 }
1405 
1406 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1407     // priority of client request
1408     channel->pn_priority = event->priority;
1409 
1410     // new credits
1411     channel->credits_outgoing = event->credits_outgoing;
1412 
1413     // negotiate max frame size
1414     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1415         channel->max_frame_size = channel->multiplexer->max_frame_size;
1416     }
1417     if (channel->max_frame_size > event->max_frame_size) {
1418         channel->max_frame_size = event->max_frame_size;
1419     }
1420 
1421 }
1422 
1423 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1424 
1425     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1426 
1427     // remove from list
1428     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1429 
1430     // free channel
1431     btstack_memory_rfcomm_channel_free(channel);
1432 
1433     // update multiplexer timeout after channel was removed from list
1434     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1435 }
1436 
1437 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1438 
1439     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1440 
1441 
1442     // lookup existing channel
1443     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1444 
1445     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1446 
1447     if (channel) {
1448         int rfcomm_channel_valid = 1;
1449         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1450         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1451             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1452         }
1453         return;
1454     }
1455 
1456     // service registered?
1457     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1458     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1459     if (!service) {
1460         // discard request by sending disconnected mode
1461         multiplexer->send_dm_for_dlci = dlci;
1462         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1463         return;
1464     }
1465 
1466     // create channel for some events
1467     switch (event->type) {
1468         case CH_EVT_RCVD_SABM:
1469         case CH_EVT_RCVD_PN:
1470         case CH_EVT_RCVD_RPN_REQ:
1471         case CH_EVT_RCVD_RPN_CMD:
1472             // setup incoming channel
1473             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1474             if (!channel){
1475                 // discard request by sending disconnected mode
1476                 multiplexer->send_dm_for_dlci = dlci;
1477                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1478             }
1479             break;
1480         default:
1481             break;
1482     }
1483 
1484     if (!channel) {
1485         // discard request by sending disconnected mode
1486         multiplexer->send_dm_for_dlci = dlci;
1487         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1488         return;
1489     }
1490 
1491     int rfcomm_channel_valid = 1;
1492     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1493     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1494         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1495     }
1496 }
1497 
1498 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1499 
1500     UNUSED(size);   // ok: fixed format messages
1501 
1502     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1503     const uint8_t frame_dlci = packet[0] >> 2;
1504     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1505 	uint8_t message_len;  //   "
1506 
1507     // rfcomm: (1) command/control
1508     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1509     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1510     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1511     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1512     // rfcomm: (3+length_offset) credits if credits_offset == 1
1513     // rfcomm: (3+length_offest+credits_offset)
1514     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1515 
1516     rfcomm_channel_event_t event;
1517     rfcomm_channel_event_pn_t event_pn;
1518     rfcomm_channel_event_rpn_t event_rpn;
1519     rfcomm_channel_event_msc_t event_msc;
1520 
1521     // switch by rfcomm message type
1522     switch(packet[1]) {
1523 
1524         case BT_RFCOMM_SABM:
1525             event.type = CH_EVT_RCVD_SABM;
1526             log_info("Received SABM #%u", frame_dlci);
1527             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1528             break;
1529 
1530         case BT_RFCOMM_UA:
1531             event.type = CH_EVT_RCVD_UA;
1532             log_info("Received UA #%u",frame_dlci);
1533             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1534             break;
1535 
1536         case BT_RFCOMM_DISC:
1537             event.type = CH_EVT_RCVD_DISC;
1538             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1539             break;
1540 
1541         case BT_RFCOMM_DM:
1542         case BT_RFCOMM_DM_PF:
1543             event.type = CH_EVT_RCVD_DM;
1544             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1545             break;
1546 
1547         case BT_RFCOMM_UIH_PF:
1548         case BT_RFCOMM_UIH:
1549 
1550             message_len  = packet[payload_offset+1] >> 1;
1551 
1552             switch (packet[payload_offset]) {
1553                 case BT_RFCOMM_PN_CMD:
1554                     message_dlci = packet[payload_offset+2];
1555                     event_pn.super.type = CH_EVT_RCVD_PN;
1556                     event_pn.priority = packet[payload_offset+4];
1557                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1558                     event_pn.credits_outgoing = packet[payload_offset+9];
1559                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1560                         message_dlci, event_pn.credits_outgoing);
1561                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1562                     break;
1563 
1564                 case BT_RFCOMM_PN_RSP:
1565                     message_dlci = packet[payload_offset+2];
1566                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1567                     event_pn.priority = packet[payload_offset+4];
1568                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1569                     event_pn.credits_outgoing = packet[payload_offset+9];
1570                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1571                             event_pn.max_frame_size, event_pn.credits_outgoing);
1572                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1573                     break;
1574 
1575                 case BT_RFCOMM_MSC_CMD:
1576                     message_dlci = packet[payload_offset+2] >> 2;
1577                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1578                     event_msc.modem_status = packet[payload_offset+3];
1579                     log_info("Received MSC CMD for #%u, ", message_dlci);
1580                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1581                     break;
1582 
1583                 case BT_RFCOMM_MSC_RSP:
1584                     message_dlci = packet[payload_offset+2] >> 2;
1585                     event.type = CH_EVT_RCVD_MSC_RSP;
1586                     log_info("Received MSC RSP for #%u", message_dlci);
1587                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1588                     break;
1589 
1590                 case BT_RFCOMM_RPN_CMD:
1591                     message_dlci = packet[payload_offset+2] >> 2;
1592                     switch (message_len){
1593                         case 1:
1594                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1595                             event.type = CH_EVT_RCVD_RPN_REQ;
1596                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1597                             break;
1598                         case 8:
1599                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1600                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1601                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1602                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1603                             break;
1604                         default:
1605                             break;
1606                     }
1607                     break;
1608 
1609                 case BT_RFCOMM_RPN_RSP:
1610                     log_info("Received RPN response");
1611                     break;
1612 
1613                 case BT_RFCOMM_RLS_CMD: {
1614                     log_info("Received RLS command");
1615                     message_dlci = packet[payload_offset+2] >> 2;
1616                     rfcomm_channel_event_rls_t event_rls;
1617                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1618                     event_rls.line_status = packet[payload_offset+3];
1619                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1620                     break;
1621                 }
1622 
1623                 case BT_RFCOMM_RLS_RSP:
1624                     log_info("Received RLS response");
1625                     break;
1626 
1627                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1628                 // case BT_RFCOMM_TEST_CMD:
1629                 // case BT_RFCOMM_FCOFF_CMD:
1630                 // case BT_RFCOMM_FCON_CMD:
1631                 // everything else is an not supported command
1632                 default: {
1633                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1634                     multiplexer->nsc_command = packet[payload_offset];
1635                     break;
1636                 }
1637             }
1638             break;
1639 
1640         default:
1641             log_error("Received unknown RFCOMM message type %x", packet[1]);
1642             break;
1643     }
1644 
1645     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1646     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1647         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1648     }
1649 }
1650 
1651 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1652 
1653     if (packet_type == HCI_EVENT_PACKET){
1654         rfcomm_hci_event_handler(packet, size);
1655         return;
1656     }
1657 
1658     // we only handle l2cap packets for:
1659     if (packet_type != L2CAP_DATA_PACKET) return;
1660 
1661     //  - multiplexer itself
1662     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1663 
1664     if (handled) return;
1665 
1666     // - channel over open mutliplexer
1667     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1668     if (!multiplexer || multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) return;
1669 
1670     // channel data ?
1671     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1672     const uint8_t frame_dlci = packet[0] >> 2;
1673 
1674     if (frame_dlci && (packet[1] == BT_RFCOMM_UIH || packet[1] == BT_RFCOMM_UIH_PF)) {
1675         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1676         return;
1677     }
1678 
1679     rfcomm_channel_packet_handler(multiplexer, packet, size);
1680 }
1681 
1682 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1683     // note: exchanging MSC isn't neccessary to consider channel open
1684     // note: having outgoing credits is also not necessary to consider channel open
1685     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1686     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1687     // if (channel->credits_outgoing == 0) return 0;
1688     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u",
1689          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1690     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1691     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1692 
1693     return 1;
1694 }
1695 
1696 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1697     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %04x", channel->state_var);
1698     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1699     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1700     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1701     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1702     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1703     return 1;
1704 }
1705 
1706 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1707     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var | event);
1708 }
1709 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1710     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var & ~event);
1711 }
1712 
1713 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1714     switch (channel->state){
1715         case RFCOMM_CHANNEL_SEND_UIH_PN:
1716             log_debug("ch-ready: state %u", channel->state);
1717             return 1;
1718         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1719             log_debug("ch-ready: state %u", channel->state);
1720             return 1;
1721         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1722             log_debug("ch-ready: state %u", channel->state);
1723             return 1;
1724         case RFCOMM_CHANNEL_SEND_DISC:
1725             log_debug("ch-ready: state %u", channel->state);
1726             return 1;
1727         case RFCOMM_CHANNEL_SEND_DM:
1728             log_debug("ch-ready: state %u", channel->state);
1729             return 1;
1730         case RFCOMM_CHANNEL_OPEN:
1731             if (channel->new_credits_incoming) {
1732                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1733                 return 1;
1734             }
1735             break;
1736         case RFCOMM_CHANNEL_DLC_SETUP:
1737             if (channel->state_var & (
1738                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1739                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1740              )) {
1741                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1742                 return 1;
1743             }
1744             break;
1745 
1746         default:
1747             break;
1748     }
1749 
1750     if (channel->state_var & (
1751         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP   |
1752         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_INFO |
1753         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP  |
1754         RFCOMM_CHANNEL_STATE_VAR_SEND_UA       |
1755         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1756                              )){
1757         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1758         return 1;
1759     }
1760 
1761     if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID) {
1762         log_debug("ch-ready: rls_line_status");
1763         return 1;
1764     }
1765 
1766     return 0;
1767 }
1768 
1769 
1770 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1771 
1772     // log_info("rfcomm_channel_state_machine_with_channel: state %u, state_var %04x, event %u", channel->state, channel->state_var ,event->type);
1773 
1774     // channel != NULL -> channel valid
1775     *out_channel_valid = 1;
1776 
1777     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1778 
1779     // TODO: integrate in common switch
1780     if (event->type == CH_EVT_RCVD_DISC){
1781         rfcomm_emit_channel_closed(channel);
1782         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1783         return;
1784     }
1785 
1786     // TODO: integrate in common switch
1787     if (event->type == CH_EVT_RCVD_DM){
1788         log_info("Received DM message for #%u", channel->dlci);
1789         log_info("-> Closing channel locally for #%u", channel->dlci);
1790         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1791         rfcomm_channel_finalize(channel);
1792         *out_channel_valid = 0;
1793         return;
1794     }
1795 
1796     // remote port negotiation command - just accept everything for now
1797     //
1798     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1799     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1800     //   (Although the handling of individual settings are implementation-dependent.)"
1801     //
1802 
1803     // TODO: integrate in common switch
1804     if (event->type == CH_EVT_RCVD_RPN_CMD){
1805         // control port parameters
1806         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1807         rfcomm_rpn_data_update(&channel->rpn_data, &event_rpn->data);
1808         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1809         // notify client about new settings
1810         rfcomm_emit_port_configuration(channel);
1811         return;
1812     }
1813 
1814     // TODO: integrate in common switch
1815     if (event->type == CH_EVT_RCVD_RPN_REQ){
1816         // no values got accepted (no values have beens sent)
1817         channel->rpn_data.parameter_mask_0 = 0x00;
1818         channel->rpn_data.parameter_mask_1 = 0x00;
1819         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1820         return;
1821     }
1822 
1823     if (event->type == CH_EVT_RCVD_RLS_CMD){
1824         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1825         channel->rls_line_status = event_rls->line_status & 0x0f;
1826         log_info("CH_EVT_RCVD_RLS_CMD setting line status to 0x%0x", channel->rls_line_status);
1827         rfcomm_emit_remote_line_status(channel, event_rls->line_status);
1828         return;
1829     }
1830 
1831     // TODO: integrate in common switch
1832     if (event->type == CH_EVT_READY_TO_SEND){
1833         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP){
1834             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1835             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1836             rfcomm_send_uih_rpn_rsp(multiplexer, channel->dlci, &channel->rpn_data);
1837             return;
1838         }
1839         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1840             log_info("Sending MSC RSP for #%u", channel->dlci);
1841             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1842             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1843             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
1844             return;
1845         }
1846         if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID){
1847             log_info("Sending RLS RSP 0x%0x", channel->rls_line_status);
1848             uint8_t line_status = channel->rls_line_status;
1849             channel->rls_line_status = RFCOMM_RLS_STATUS_INVALID;
1850             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1851             return;
1852         }
1853     }
1854 
1855     // emit MSC status to app
1856     if (event->type == CH_EVT_RCVD_MSC_CMD){
1857         // notify client about new settings
1858         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1859         uint8_t modem_status_event[2+1];
1860         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1861         modem_status_event[1] = 1;
1862         modem_status_event[2] = event_msc->modem_status;
1863         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1864         // no return, MSC_CMD will be handled by state machine below
1865     }
1866 
1867     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1868 
1869     switch (channel->state) {
1870         case RFCOMM_CHANNEL_CLOSED:
1871             switch (event->type){
1872                 case CH_EVT_RCVD_SABM:
1873                     log_info("-> Inform app");
1874                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1875                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1876                     rfcomm_emit_connection_request(channel);
1877                     break;
1878                 case CH_EVT_RCVD_PN:
1879                     rfcomm_channel_accept_pn(channel, event_pn);
1880                     log_info("-> Inform app");
1881                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1882                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1883                     rfcomm_emit_connection_request(channel);
1884                     break;
1885                 default:
1886                     break;
1887             }
1888             break;
1889 
1890         case RFCOMM_CHANNEL_INCOMING_SETUP:
1891             switch (event->type){
1892                 case CH_EVT_RCVD_SABM:
1893                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1894                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1895                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1896                     }
1897                     break;
1898                 case CH_EVT_RCVD_PN:
1899                     rfcomm_channel_accept_pn(channel, event_pn);
1900                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1901                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1902                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1903                     }
1904                     break;
1905                 case CH_EVT_READY_TO_SEND:
1906                     // if / else if is used to check for state transition after sending
1907                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
1908                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
1909                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1910                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
1911                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
1912                         log_info("Sending UA #%u", channel->dlci);
1913                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1914                         rfcomm_send_ua(multiplexer, channel->dlci);
1915                     }
1916                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
1917                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
1918                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1919                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1920                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1921                      }
1922                     break;
1923                 default:
1924                     break;
1925             }
1926             break;
1927 
1928         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
1929             switch (event->type) {
1930                 case CH_EVT_MULTIPLEXER_READY:
1931                     log_info("Muliplexer opened, sending UIH PN next");
1932                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
1933                     break;
1934                 default:
1935                     break;
1936             }
1937             break;
1938 
1939         case RFCOMM_CHANNEL_SEND_UIH_PN:
1940             switch (event->type) {
1941                 case CH_EVT_READY_TO_SEND:
1942                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p)", channel->dlci, channel );
1943                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
1944                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
1945                     break;
1946                 default:
1947                     break;
1948             }
1949             break;
1950 
1951         case RFCOMM_CHANNEL_W4_PN_RSP:
1952             switch (event->type){
1953                 case CH_EVT_RCVD_PN_RSP:
1954                     // update max frame size
1955                     if (channel->max_frame_size > event_pn->max_frame_size) {
1956                         channel->max_frame_size = event_pn->max_frame_size;
1957                     }
1958                     // new credits
1959                     channel->credits_outgoing = event_pn->credits_outgoing;
1960                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
1961                     break;
1962                 default:
1963                     break;
1964             }
1965             break;
1966 
1967         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1968             switch (event->type) {
1969                 case CH_EVT_READY_TO_SEND:
1970                     log_info("Sending SABM #%u", channel->dlci);
1971                     channel->state = RFCOMM_CHANNEL_W4_UA;
1972                     rfcomm_send_sabm(multiplexer, channel->dlci);
1973                     break;
1974                 default:
1975                     break;
1976             }
1977             break;
1978 
1979         case RFCOMM_CHANNEL_W4_UA:
1980             switch (event->type){
1981                 case CH_EVT_RCVD_UA:
1982                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1983                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1984                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1985                     break;
1986                 default:
1987                     break;
1988             }
1989             break;
1990 
1991         case RFCOMM_CHANNEL_DLC_SETUP:
1992             switch (event->type){
1993                 case CH_EVT_RCVD_MSC_CMD:
1994                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
1995                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1996                     break;
1997                 case CH_EVT_RCVD_MSC_RSP:
1998                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
1999                     break;
2000 
2001                 case CH_EVT_READY_TO_SEND:
2002                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
2003                         log_info("Sending MSC CMD for #%u", channel->dlci);
2004                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2005                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
2006                         rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
2007                         break;
2008                     }
2009                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2010                         log_info("Providing credits for #%u", channel->dlci);
2011                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2012                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2013 
2014                         if (channel->new_credits_incoming) {
2015                             uint8_t new_credits = channel->new_credits_incoming;
2016                             channel->new_credits_incoming = 0;
2017                             rfcomm_channel_send_credits(channel, new_credits);
2018                         }
2019                         break;
2020 
2021                     }
2022                     break;
2023                 default:
2024                     break;
2025             }
2026             // finally done?
2027             if (rfcomm_channel_ready_for_open(channel)){
2028                 channel->state = RFCOMM_CHANNEL_OPEN;
2029                 rfcomm_channel_opened(channel);
2030             }
2031             break;
2032 
2033         case RFCOMM_CHANNEL_OPEN:
2034             switch (event->type){
2035                 case CH_EVT_RCVD_MSC_CMD:
2036                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2037                     break;
2038                 case CH_EVT_READY_TO_SEND:
2039                     if (channel->new_credits_incoming) {
2040                         uint8_t new_credits = channel->new_credits_incoming;
2041                         channel->new_credits_incoming = 0;
2042                         rfcomm_channel_send_credits(channel, new_credits);
2043                         break;
2044                     }
2045                     break;
2046                 case CH_EVT_RCVD_CREDITS:
2047                     rfcomm_notify_channel_can_send();
2048                     break;
2049                 default:
2050                     break;
2051             }
2052             break;
2053 
2054         case RFCOMM_CHANNEL_SEND_DM:
2055             switch (event->type) {
2056                 case CH_EVT_READY_TO_SEND:
2057                     log_info("Sending DM_PF for #%u", channel->dlci);
2058                     // don't emit channel closed - channel was never open
2059                     channel->state = RFCOMM_CHANNEL_CLOSED;
2060                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2061                     rfcomm_channel_finalize(channel);
2062                     *out_channel_valid = 0;
2063                     break;
2064                 default:
2065                     break;
2066             }
2067             break;
2068 
2069         case RFCOMM_CHANNEL_SEND_DISC:
2070             switch (event->type) {
2071                 case CH_EVT_READY_TO_SEND:
2072                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2073                     rfcomm_send_disc(multiplexer, channel->dlci);
2074                     break;
2075                 default:
2076                     break;
2077             }
2078             break;
2079 
2080         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2081             switch (event->type){
2082                 case CH_EVT_RCVD_UA:
2083                     channel->state = RFCOMM_CHANNEL_CLOSED;
2084                     rfcomm_emit_channel_closed(channel);
2085                     rfcomm_channel_finalize(channel);
2086                     *out_channel_valid = 0;
2087                     break;
2088                 default:
2089                     break;
2090             }
2091             break;
2092 
2093         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2094             switch (event->type) {
2095                 case CH_EVT_READY_TO_SEND:
2096                     log_info("Sending UA after DISC for #%u", channel->dlci);
2097                     channel->state = RFCOMM_CHANNEL_CLOSED;
2098                     rfcomm_send_ua(multiplexer, channel->dlci);
2099                     rfcomm_channel_finalize(channel);
2100                     *out_channel_valid = 0;
2101                     break;
2102                 default:
2103                     break;
2104             }
2105             break;
2106 
2107         default:
2108             break;
2109     }
2110 }
2111 
2112 // MARK: RFCOMM BTstack API
2113 
2114 void rfcomm_init(void){
2115     rfcomm_client_cid_generator = 0;
2116     rfcomm_multiplexers = NULL;
2117     rfcomm_services     = NULL;
2118     rfcomm_channels     = NULL;
2119     rfcomm_security_level = LEVEL_2;
2120 }
2121 
2122 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2123     rfcomm_security_level = security_level;
2124 }
2125 
2126 int rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2127     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2128     if (!channel){
2129         log_error("rfcomm_send cid 0x%02x doesn't exist!", rfcomm_cid);
2130         return 0;
2131     }
2132     return rfcomm_channel_can_send(channel);
2133 }
2134 
2135 void rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2136     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2137     if (!channel){
2138         log_error("rfcomm_send cid 0x%02x doesn't exist!", rfcomm_cid);
2139         return;
2140     }
2141     channel->waiting_for_can_send_now = 1;
2142     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2143 }
2144 
2145 static int rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2146     if (len > channel->max_frame_size){
2147         log_error("rfcomm_send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2148         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2149     }
2150 
2151 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2152     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2153         log_error("rfcomm_send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2154         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2155     }
2156 #endif
2157 
2158     if (!channel->credits_outgoing){
2159         log_info("rfcomm_send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2160         return RFCOMM_NO_OUTGOING_CREDITS;
2161     }
2162 
2163     if ((channel->multiplexer->fcon & 1) == 0){
2164         log_info("rfcomm_send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2165         return RFCOMM_AGGREGATE_FLOW_OFF;
2166     }
2167     return 0;
2168 }
2169 
2170 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2171     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2172     if (!channel){
2173         log_error("rfcomm_get_max_frame_size cid 0x%02x doesn't exist!", rfcomm_cid);
2174         return 0;
2175     }
2176     return channel->max_frame_size;
2177 }
2178 
2179 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2180 int rfcomm_reserve_packet_buffer(void){
2181 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2182     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2183     return 0;
2184 #else
2185     return l2cap_reserve_packet_buffer();
2186 #endif
2187 }
2188 
2189 void rfcomm_release_packet_buffer(void){
2190 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2191     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2192 #else
2193     l2cap_release_packet_buffer();
2194 #endif
2195 }
2196 
2197 uint8_t * rfcomm_get_outgoing_buffer(void){
2198 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2199     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2200 #else
2201     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2202 #endif
2203     // address + control + length (16) + no credit field
2204     return &rfcomm_out_buffer[4];
2205 }
2206 
2207 int rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2208     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2209     if (!channel){
2210         log_error("rfcomm_send_prepared cid 0x%02x doesn't exist!", rfcomm_cid);
2211         return 0;
2212     }
2213 
2214     int err = rfcomm_assert_send_valid(channel, len);
2215     if (err) return err;
2216 
2217 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2218     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2219         log_error("rfcomm_send_prepared: l2cap cannot send now");
2220         return BTSTACK_ACL_BUFFERS_FULL;
2221     }
2222 #else
2223     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2224         log_error("rfcomm_send_prepared: l2cap cannot send now");
2225         return BTSTACK_ACL_BUFFERS_FULL;
2226     }
2227 #endif
2228 
2229     // send might cause l2cap to emit new credits, update counters first
2230     if (len){
2231         channel->credits_outgoing--;
2232     } else {
2233         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2234     }
2235 
2236     int result = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2237 
2238     if (result != 0) {
2239         if (len) {
2240             channel->credits_outgoing++;
2241         }
2242         log_error("rfcomm_send_prepared: error %d", result);
2243         return result;
2244     }
2245 
2246     return result;
2247 }
2248 
2249 int rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2250     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2251     if (!channel){
2252         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2253         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2254     }
2255 
2256     int err = rfcomm_assert_send_valid(channel, len);
2257     if (err) return err;
2258     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2259         log_error("rfcomm_send_internal: l2cap cannot send now");
2260         return BTSTACK_ACL_BUFFERS_FULL;
2261     }
2262 
2263 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2264 #else
2265     rfcomm_reserve_packet_buffer();
2266 #endif
2267     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2268 
2269     memcpy(rfcomm_payload, data, len);
2270     err = rfcomm_send_prepared(rfcomm_cid, len);
2271 
2272 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2273 #else
2274     if (err){
2275         rfcomm_release_packet_buffer();
2276     }
2277 #endif
2278 
2279     return err;
2280 }
2281 
2282 // Sends Local Lnie Status, see LINE_STATUS_..
2283 int rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2284     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2285     if (!channel){
2286         log_error("rfcomm_send_local_line_status cid 0x%02x doesn't exist!", rfcomm_cid);
2287         return 0;
2288     }
2289     return rfcomm_send_uih_rls_cmd(channel->multiplexer, channel->dlci, line_status);
2290 }
2291 
2292 // Sned local modem status. see MODEM_STAUS_..
2293 int rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2294     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2295     if (!channel){
2296         log_error("rfcomm_send_modem_status cid 0x%02x doesn't exist!", rfcomm_cid);
2297         return 0;
2298     }
2299     return rfcomm_send_uih_msc_cmd(channel->multiplexer, channel->dlci, modem_status);
2300 }
2301 
2302 // Configure remote port
2303 int rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, rpn_flow_control_t flow_control){
2304     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2305     if (!channel){
2306         log_error("rfcomm_send_port_configuration cid 0x%02x doesn't exist!", rfcomm_cid);
2307         return 0;
2308     }
2309     rfcomm_rpn_data_t rpn_data;
2310     rpn_data.baud_rate = baud_rate;
2311     rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2312     rpn_data.flow_control = flow_control;
2313     rpn_data.xon = 0;
2314     rpn_data.xoff = 0;
2315     rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2316     rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2317     return rfcomm_send_uih_rpn_cmd(channel->multiplexer, channel->dlci, &rpn_data);
2318 }
2319 
2320 // Query remote port
2321 int rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2322     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2323     if (!channel){
2324         log_error("rfcomm_query_port_configuration cid 0x%02x doesn't exist!", rfcomm_cid);
2325         return 0;
2326     }
2327     return rfcomm_send_uih_rpn_req(channel->multiplexer, channel->dlci);
2328 }
2329 
2330 
2331 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2332     log_info("RFCOMM_CREATE_CHANNEL addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2333 
2334     // create new multiplexer if necessary
2335     uint8_t status = 0;
2336     uint8_t dlci = 0;
2337     int new_multiplexer = 0;
2338     rfcomm_channel_t * channel = NULL;
2339     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2340     if (!multiplexer) {
2341         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2342         if (!multiplexer){
2343             status = BTSTACK_MEMORY_ALLOC_FAILED;
2344             goto fail;
2345         }
2346         multiplexer->outgoing = 1;
2347         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2348         new_multiplexer = 1;
2349     }
2350 
2351     // check if channel for this remote service already exists
2352     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2353     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2354     if (channel){
2355         status = RFCOMM_CHANNEL_ALREADY_REGISTERED;
2356         goto fail;
2357     }
2358 
2359     // prepare channel
2360     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2361     if (!channel){
2362         status = BTSTACK_MEMORY_ALLOC_FAILED;
2363         goto fail;
2364     }
2365 
2366     // rfcomm_cid is already assigned by rfcomm_channel_create
2367     channel->incoming_flow_control = incoming_flow_control;
2368     channel->new_credits_incoming  = initial_credits;
2369     channel->packet_handler = packet_handler;
2370 
2371     // return rfcomm_cid
2372     if (out_rfcomm_cid){
2373         *out_rfcomm_cid = channel->rfcomm_cid;
2374     }
2375 
2376     // start multiplexer setup
2377     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2378         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2379         uint16_t l2cap_cid = 0;
2380 #ifdef RFCOMM_USE_ERTM
2381         // request
2382         rfcomm_ertm_request_t request;
2383         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2384         memcpy(request.addr, addr, 6);
2385         request.ertm_id = ++ertm_id;
2386         if (rfcomm_ertm_request_callback){
2387             (*rfcomm_ertm_request_callback)(&request);
2388         }
2389         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2390             multiplexer->ertm_id = request.ertm_id;
2391             status = l2cap_create_ertm_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2392                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2393         }
2394         else
2395 #endif
2396         {
2397             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2398         }
2399         if (status) goto fail;
2400         multiplexer->l2cap_cid = l2cap_cid;
2401         return 0;
2402     }
2403 
2404     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2405 
2406     // start connecting, if multiplexer is already up and running
2407     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2408     return 0;
2409 
2410 fail:
2411     if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2412     if (channel)         btstack_memory_rfcomm_channel_free(channel);
2413     return status;
2414 }
2415 
2416 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2417     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2418 }
2419 
2420 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2421     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2422 }
2423 
2424 void rfcomm_disconnect(uint16_t rfcomm_cid){
2425     log_info("RFCOMM_DISCONNECT cid 0x%02x", rfcomm_cid);
2426     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2427     if (!channel) return;
2428 
2429     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2430     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2431 }
2432 
2433 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2434     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2435 
2436     log_info("RFCOMM_REGISTER_SERVICE channel #%u mtu %u flow_control %u credits %u",
2437              channel, max_frame_size, incoming_flow_control, initial_credits);
2438 
2439     // check if already registered
2440     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2441     if (service){
2442         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2443     }
2444 
2445     // alloc structure
2446     service = btstack_memory_rfcomm_service_get();
2447     if (!service) {
2448         return BTSTACK_MEMORY_ALLOC_FAILED;
2449     }
2450 
2451     // register with l2cap if not registered before, max MTU
2452     if (btstack_linked_list_empty(&rfcomm_services)){
2453         l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2454     }
2455 
2456     // fill in
2457     service->packet_handler = packet_handler;
2458     service->server_channel = channel;
2459     service->max_frame_size = max_frame_size;
2460     service->incoming_flow_control = incoming_flow_control;
2461     service->incoming_initial_credits = initial_credits;
2462 
2463     // add to services list
2464     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2465 
2466     return 0;
2467 }
2468 
2469 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2470     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2471 
2472     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2473 }
2474 
2475 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2476     uint16_t max_frame_size){
2477 
2478     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2479 }
2480 
2481 void rfcomm_unregister_service(uint8_t service_channel){
2482     log_info("RFCOMM_UNREGISTER_SERVICE #%u", service_channel);
2483     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2484     if (!service) return;
2485     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2486     btstack_memory_rfcomm_service_free(service);
2487 
2488     // unregister if no services active
2489     if (btstack_linked_list_empty(&rfcomm_services)){
2490         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2491         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2492     }
2493 }
2494 
2495 void rfcomm_accept_connection(uint16_t rfcomm_cid){
2496     log_info("RFCOMM_ACCEPT_CONNECTION cid 0x%02x", rfcomm_cid);
2497     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2498     if (!channel) return;
2499     switch (channel->state) {
2500         case RFCOMM_CHANNEL_INCOMING_SETUP:
2501             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2502             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2503                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2504                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2505             }
2506             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2507                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2508                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2509             }
2510             // at least one of { PN RSP, UA } needs to be sent
2511             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2512             break;
2513         default:
2514             break;
2515     }
2516 
2517 }
2518 
2519 void rfcomm_decline_connection(uint16_t rfcomm_cid){
2520     log_info("RFCOMM_DECLINE_CONNECTION cid 0x%02x", rfcomm_cid);
2521     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2522     if (!channel) return;
2523     switch (channel->state) {
2524         case RFCOMM_CHANNEL_INCOMING_SETUP:
2525             channel->state = RFCOMM_CHANNEL_SEND_DM;
2526             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2527             break;
2528         default:
2529             break;
2530     }
2531 }
2532 
2533 void rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2534     log_info("RFCOMM_GRANT_CREDITS cid 0x%02x credits %u", rfcomm_cid, credits);
2535     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2536     if (!channel) return;
2537     if (!channel->incoming_flow_control) return;
2538     channel->new_credits_incoming += credits;
2539 
2540     // process
2541     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2542 }
2543 
2544 #ifdef RFCOMM_USE_ERTM
2545 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2546     rfcomm_ertm_request_callback  = request_callback;
2547     rfcomm_ertm_released_callback = released_callback;
2548 }
2549 #endif
2550