xref: /btstack/src/classic/rfcomm.c (revision da8e14c5aa3783b6bb7dd63e71572a901bcf168b)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <string.h> // memcpy
45 #include <stdint.h>
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_memory.h"
51 #include "btstack_util.h"
52 #include "classic/core.h"
53 #include "classic/rfcomm.h"
54 #include "hci.h"
55 #include "hci_cmd.h"
56 #include "hci_dump.h"
57 #include "l2cap.h"
58 
59 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
60 #ifndef PRIxPTR
61 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
62 #define PRIxPTR "lx"
63 #else
64 #define PRIxPTR "x"
65 #endif
66 #endif
67 
68 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
69 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
70 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
71 #define RFCOMM_USE_OUTGOING_BUFFER
72 #define RFCOMM_USE_ERTM
73 #else
74 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
75 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
76 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
77 #endif
78 #endif
79 
80 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
81 
82 #define RFCOMM_CREDITS 10
83 
84 // FCS calc
85 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
86 #define BT_RFCOMM_CRC_CHECK_LEN     3
87 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
88 
89 // Control field values      bit no.       1 2 3 4 PF 6 7 8
90 #define BT_RFCOMM_SABM       0x3F       // 1 1 1 1  1 1 0 0
91 #define BT_RFCOMM_UA         0x73       // 1 1 0 0  1 1 1 0
92 #define BT_RFCOMM_DM         0x0F       // 1 1 1 1  0 0 0 0
93 #define BT_RFCOMM_DM_PF      0x1F       // 1 1 1 1  1 0 0 0
94 #define BT_RFCOMM_DISC       0x53       // 1 1 0 0  1 0 1 0
95 #define BT_RFCOMM_UIH        0xEF       // 1 1 1 1  0 1 1 1
96 #define BT_RFCOMM_UIH_PF     0xFF       // 1 1 1 1  0 1 1 1
97 
98 // Multiplexer message types
99 #define BT_RFCOMM_CLD_CMD    0xC3
100 #define BT_RFCOMM_FCON_CMD   0xA3
101 #define BT_RFCOMM_FCON_RSP   0xA1
102 #define BT_RFCOMM_FCOFF_CMD  0x63
103 #define BT_RFCOMM_FCOFF_RSP  0x61
104 #define BT_RFCOMM_MSC_CMD    0xE3
105 #define BT_RFCOMM_MSC_RSP    0xE1
106 #define BT_RFCOMM_NSC_RSP    0x11
107 #define BT_RFCOMM_PN_CMD     0x83
108 #define BT_RFCOMM_PN_RSP     0x81
109 #define BT_RFCOMM_RLS_CMD    0x53
110 #define BT_RFCOMM_RLS_RSP    0x51
111 #define BT_RFCOMM_RPN_CMD    0x93
112 #define BT_RFCOMM_RPN_RSP    0x91
113 #define BT_RFCOMM_TEST_CMD   0x23
114 #define BT_RFCOMM_TEST_RSP   0x21
115 
116 typedef enum {
117     CH_EVT_RCVD_SABM = 1,
118     CH_EVT_RCVD_UA,
119     CH_EVT_RCVD_PN,
120     CH_EVT_RCVD_PN_RSP,
121     CH_EVT_RCVD_DISC,
122     CH_EVT_RCVD_DM,
123     CH_EVT_RCVD_MSC_CMD,
124     CH_EVT_RCVD_MSC_RSP,
125     CH_EVT_RCVD_NSC_RSP,
126     CH_EVT_RCVD_RLS_CMD,
127     CH_EVT_RCVD_RLS_RSP,
128     CH_EVT_RCVD_RPN_CMD,
129     CH_EVT_RCVD_RPN_REQ,
130     CH_EVT_RCVD_RPN_RSP,
131     CH_EVT_RCVD_CREDITS,
132     CH_EVT_MULTIPLEXER_READY,
133     CH_EVT_READY_TO_SEND,
134 } RFCOMM_CHANNEL_EVENT;
135 
136 typedef struct rfcomm_channel_event {
137     RFCOMM_CHANNEL_EVENT type;
138     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
139 } rfcomm_channel_event_t;
140 
141 typedef struct rfcomm_channel_event_pn {
142     rfcomm_channel_event_t super;
143     uint16_t max_frame_size;
144     uint8_t  priority;
145     uint8_t  credits_outgoing;
146 } rfcomm_channel_event_pn_t;
147 
148 typedef struct rfcomm_channel_event_rpn {
149     rfcomm_channel_event_t super;
150     rfcomm_rpn_data_t data;
151 } rfcomm_channel_event_rpn_t;
152 
153 typedef struct rfcomm_channel_event_rls {
154     rfcomm_channel_event_t super;
155     uint8_t line_status;
156 } rfcomm_channel_event_rls_t;
157 
158 typedef struct rfcomm_channel_event_msc {
159     rfcomm_channel_event_t super;
160     uint8_t modem_status;
161 } rfcomm_channel_event_msc_t;
162 
163 
164 // global rfcomm data
165 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
166 
167 // linked lists for all
168 static btstack_linked_list_t rfcomm_multiplexers;
169 static btstack_linked_list_t rfcomm_channels;
170 static btstack_linked_list_t rfcomm_services;
171 
172 static gap_security_level_t rfcomm_security_level;
173 
174 #ifdef RFCOMM_USE_ERTM
175 static uint16_t rfcomm_ertm_id;
176 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
177 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
178 #endif
179 
180 #ifdef RFCOMM_USE_OUTGOING_BUFFER
181 static uint8_t outgoing_buffer[1030];
182 #endif
183 
184 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel);
185 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
186 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
187 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
188 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
189 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
190 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
191 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
192 
193 // MARK: RFCOMM CLIENT EVENTS
194 
195 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
196     btstack_linked_item_t *it;
197     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
198         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
199         if (channel->rfcomm_cid == rfcomm_cid) {
200             return channel;
201         };
202     }
203     return NULL;
204 }
205 
206 static uint16_t rfcomm_next_client_cid(void){
207     do {
208         if (rfcomm_client_cid_generator == 0xffff) {
209             // don't use 0 as channel id
210             rfcomm_client_cid_generator = 1;
211         } else {
212             rfcomm_client_cid_generator++;
213         }
214     } while (rfcomm_channel_for_rfcomm_cid(rfcomm_client_cid_generator) != NULL);
215     return rfcomm_client_cid_generator;
216 }
217 
218 #ifdef RFCOMM_USE_ERTM
219 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_ertm_id(uint16_t ertm_id) {
220     btstack_linked_item_t *it;
221     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
222         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
223         if (multiplexer->ertm_id == ertm_id) {
224             return multiplexer;
225         };
226     }
227     return NULL;
228 }
229 
230 static uint16_t rfcomm_next_ertm_id(void){
231     do {
232         if (rfcomm_ertm_id == 0xffff) {
233             // don't use 0 as channel id
234             rfcomm_ertm_id = 1;
235         } else {
236             rfcomm_ertm_id++;
237         }
238     } while (rfcomm_multiplexer_for_ertm_id(rfcomm_ertm_id) != NULL);
239     return rfcomm_ertm_id;
240 }
241 
242 #endif
243 
244 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
245 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
246     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
247              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
248     uint8_t event[13];
249     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
250     event[1] = sizeof(event) - 2;
251     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
252     event[8] = channel->dlci >> 1;
253     little_endian_store_16(event, 9, channel->rfcomm_cid);
254     little_endian_store_16(event, 11, channel->multiplexer->con_handle);
255     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
256 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
257 }
258 
259 // API Change: BTstack-0.3.50x uses
260 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
261 // next Cydia release will use SVN version of this
262 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
263 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
264     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
265              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
266              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
267     uint8_t event[18];
268     uint8_t pos = 0;
269     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
270     event[pos++] = sizeof(event) - 2;                   // 1
271     event[pos++] = status;                              // 2
272     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
273     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
274 	event[pos++] = channel->dlci >> 1;                                      // 11
275 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
276 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
277     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
278     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
279 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
280 
281     // if channel opened successfully, also send can send now if possible
282     if (status) return;
283     if (rfcomm_channel_can_send(channel)){
284         rfcomm_emit_can_send_now(channel);
285     }
286 }
287 
288 // data: event(8), len(8), rfcomm_cid(16)
289 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
290     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
291     uint8_t event[4];
292     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
293     event[1] = sizeof(event) - 2;
294     little_endian_store_16(event, 2, channel->rfcomm_cid);
295     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
296 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
297 }
298 
299 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
300     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
301     uint8_t event[5];
302     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
303     event[1] = sizeof(event) - 2;
304     little_endian_store_16(event, 2, channel->rfcomm_cid);
305     event[4] = line_status;
306     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
307     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
308 }
309 
310 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel, bool remote) {
311     // notify client about new settings
312     uint8_t event[2+2+1+sizeof(rfcomm_rpn_data_t)];
313     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
314     event[1] = sizeof(event) - 2;
315     little_endian_store_16(event, 2, channel->rfcomm_cid);
316     if (remote){
317         event[4] = 1;
318         (void)memcpy(&event[5], (uint8_t *) &channel->remote_rpn_data, sizeof(rfcomm_rpn_data_t));
319     } else {
320         event[4] = 0;
321         (void)memcpy(&event[5], (uint8_t *) &channel->local_rpn_data, sizeof(rfcomm_rpn_data_t));
322     }
323     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
324     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
325 }
326 
327 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
328     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
329     uint8_t event[4];
330     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
331     event[1] = sizeof(event) - 2;
332     little_endian_store_16(event, 2, channel->rfcomm_cid);
333     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
334     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
335 }
336 
337 // MARK RFCOMM RPN DATA HELPER
338 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
339         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
340         rpn_data->flags = 0x03;               /* 8-n-1 */
341         rpn_data->flow_control = 0;           /* no flow control */
342         rpn_data->xon  = 0xd1;                /* XON */
343         rpn_data->xoff = 0xd3;                /* XOFF */
344         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
345         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
346 }
347 
348 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
349     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
350         dest->baud_rate = src->baud_rate;
351     }
352     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
353         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
354     }
355     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
356         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
357     }
358     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
359         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
360     }
361     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
362         dest->flags = (dest->flags & 0xcf) | (src->flags & 0x30);
363     }
364     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
365         dest->xon = src->xon;
366     }
367     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
368         dest->xoff = src->xoff;
369     }
370     uint8_t mask = src->parameter_mask_1 & 0x3f;
371     dest->flow_control = (dest->flow_control & ~mask) | (src->flow_control & mask);
372    // always copy parameter mask, too. informative for client, needed for response
373     dest->parameter_mask_0 = src->parameter_mask_0;
374     dest->parameter_mask_1 = src->parameter_mask_1;
375 }
376 // MARK: RFCOMM MULTIPLEXER HELPER
377 
378 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
379     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
380     uint16_t max_frame_size = l2cap_mtu - 5;
381     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
382     return max_frame_size;
383 }
384 
385 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
386     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
387     multiplexer->fcon = 1;
388     multiplexer->send_dm_for_dlci = 0;
389     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
390     multiplexer->test_data_len = 0;
391     multiplexer->nsc_command = 0;
392 }
393 
394 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
395 
396     // alloc structure
397     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
398     if (!multiplexer) return NULL;
399 
400     // fill in
401     rfcomm_multiplexer_initialize(multiplexer);
402     bd_addr_copy(multiplexer->remote_addr, addr);
403 
404     // add to services list
405     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
406 
407     return multiplexer;
408 }
409 
410 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
411     btstack_linked_item_t *it;
412     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
413         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
414         // ignore multiplexer in shutdown
415         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
416         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
417             return multiplexer;
418         };
419     }
420     return NULL;
421 }
422 
423 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
424     btstack_linked_item_t *it;
425     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
426         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
427         if (multiplexer->l2cap_cid == l2cap_cid) {
428             return multiplexer;
429         };
430     }
431     return NULL;
432 }
433 
434 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
435     btstack_linked_item_t *it;
436     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
437         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
438         if (channel->multiplexer == multiplexer) {
439             return 1;
440         }
441     }
442     return 0;
443 }
444 
445 // MARK: RFCOMM CHANNEL HELPER
446 
447 static void rfcomm_dump_channels(void){
448 #ifdef ENABLE_LOG_INFO
449     btstack_linked_item_t * it;
450     int channels = 0;
451     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
452         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
453         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
454         channels++;
455     }
456 #endif
457 }
458 
459 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
460                                rfcomm_service_t *service, uint8_t server_channel){
461 
462     // set defaults for port configuration (even for services)
463     rfcomm_rpn_data_set_defaults(&channel->local_rpn_data);
464     rfcomm_rpn_data_set_defaults(&channel->remote_rpn_data);
465 
466     channel->state            = RFCOMM_CHANNEL_CLOSED;
467     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
468 
469     channel->multiplexer      = multiplexer;
470     channel->rfcomm_cid       = rfcomm_next_client_cid();
471     channel->max_frame_size   = multiplexer->max_frame_size;
472 
473     channel->credits_incoming = 0;
474     channel->credits_outgoing = 0;
475 
476     // incoming flow control not active
477     channel->new_credits_incoming  = RFCOMM_CREDITS;
478     channel->incoming_flow_control = 0;
479 
480     // nothing to send
481     channel->local_line_status  = RFCOMM_RLS_STATUS_INVALID;
482     channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
483 
484     // modem status - ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
485     channel->local_modem_status  = 0x8d;
486     channel->remote_modem_status = 0x8d;
487 
488     channel->service = service;
489 	if (service) {
490 		// incoming connection
491     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
492         if (channel->max_frame_size > service->max_frame_size) {
493             channel->max_frame_size = service->max_frame_size;
494         }
495         channel->incoming_flow_control = service->incoming_flow_control;
496         channel->new_credits_incoming  = service->incoming_initial_credits;
497         channel->packet_handler        = service->packet_handler;
498 	} else {
499 		// outgoing connection
500 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
501 	}
502 }
503 
504 // service == NULL -> outgoing channel
505 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
506                                                 rfcomm_service_t * service, uint8_t server_channel){
507 
508     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
509     rfcomm_dump_channels();
510 
511     // alloc structure
512     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
513     if (!channel) return NULL;
514 
515     // fill in
516     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
517 
518     // add to services list
519     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
520 
521     return channel;
522 }
523 
524 static void rfcomm_notify_channel_can_send(void){
525     btstack_linked_list_iterator_t it;
526     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
527     while (btstack_linked_list_iterator_has_next(&it)){
528         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
529         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
530         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
531 
532         channel->waiting_for_can_send_now = 0;
533         rfcomm_emit_can_send_now(channel);
534     }
535 }
536 
537 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
538     btstack_linked_item_t *it;
539     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
540         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
541         if ((channel->dlci == dlci) && (channel->multiplexer == multiplexer)) {
542             return channel;
543         };
544     }
545     return NULL;
546 }
547 
548 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
549     btstack_linked_item_t *it;
550     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
551         rfcomm_service_t * service = ((rfcomm_service_t *) it);
552         if ( service->server_channel == server_channel){
553             return service;
554         };
555     }
556     return NULL;
557 }
558 
559 // MARK: RFCOMM SEND
560 
561 /**
562  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
563  */
564 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
565 
566     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
567 
568 #ifdef RFCOMM_USE_OUTGOING_BUFFER
569     uint8_t * rfcomm_out_buffer = outgoing_buffer;
570 #else
571     l2cap_reserve_packet_buffer();
572     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
573 #endif
574 
575 	uint16_t pos = 0;
576 	uint8_t crc_fields = 3;
577 
578 	rfcomm_out_buffer[pos++] = address;
579 	rfcomm_out_buffer[pos++] = control;
580 
581 	// length field can be 1 or 2 octets
582 	if (len < 128){
583 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
584 	} else {
585 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
586 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
587 		crc_fields++;
588 	}
589 
590 	// add credits for UIH frames when PF bit is set
591 	if (control == BT_RFCOMM_UIH_PF){
592 		rfcomm_out_buffer[pos++] = credits;
593 	}
594 
595 	// copy actual data
596 	if (len) {
597 		(void)memcpy(&rfcomm_out_buffer[pos], data, len);
598 		pos += len;
599 	}
600 
601 	// UIH frames only calc FCS over address + control (5.1.1)
602 	if ((control & 0xef) == BT_RFCOMM_UIH){
603 		crc_fields = 2;
604 	}
605 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
606 
607 #ifdef RFCOMM_USE_OUTGOING_BUFFER
608     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
609 #else
610     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
611 #endif
612 
613     return err;
614 }
615 
616 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
617 static uint8_t rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
618 
619     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
620     uint8_t control = BT_RFCOMM_UIH;
621 
622 #ifdef RFCOMM_USE_OUTGOING_BUFFER
623     uint8_t * rfcomm_out_buffer = outgoing_buffer;
624 #else
625     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
626 #endif
627 
628     uint16_t pos = 0;
629     rfcomm_out_buffer[pos++] = address;
630     rfcomm_out_buffer[pos++] = control;
631     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
632     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
633 
634     // actual data is already in place
635     pos += len;
636 
637     // UIH frames only calc FCS over address + control (5.1.1)
638     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
639 
640 #ifdef RFCOMM_USE_OUTGOING_BUFFER
641     uint8_t status = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
642 #else
643     uint8_t status = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
644 #endif
645 
646     return status;
647 }
648 
649 // C/R Flag in Address
650 // - terms: initiator = station that creates multiplexer with SABM
651 // - terms: responder = station that responds to multiplexer setup with UA
652 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
653 //    - command initiator = 1 /response responder = 1
654 //    - command responder = 0 /response initiator = 0
655 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
656 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
657 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
658 
659 // C/R Flag in Message
660 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
661 //   - If the C/R bit is set to 1 the message is a command
662 //   - if it is set to 0 the message is a response.
663 
664 // temp/old messge construction
665 
666 // new object oriented version
667 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
668 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
669     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
670 }
671 
672 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
673 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
674     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
675 }
676 
677 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
678 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
679     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
680 }
681 
682 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
683 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
684     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
685 }
686 
687 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
688     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
689     uint8_t payload[2];
690     uint8_t pos = 0;
691     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
692     payload[pos++] = (0 << 1) | 1;  // len
693     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
694 }
695 
696 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
697 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
698 //     uint8_t payload[2+len];
699 //     uint8_t pos = 0;
700 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
701 //     payload[pos++] = (len + 1) << 1 | 1;  // len
702 //     memcpy(&payload[pos], data, len);
703 //     pos += len;
704 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
705 // }
706 
707 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
708     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
709     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
710     uint8_t pos = 0;
711     payload[pos++] = BT_RFCOMM_TEST_RSP;
712     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
713         len = RFCOMM_TEST_DATA_MAX_LEN;
714     }
715     payload[pos++] = (len << 1) | 1;  // len
716     (void)memcpy(&payload[pos], data, len);
717     pos += len;
718     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
719 }
720 
721 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
722 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
723 	uint8_t payload[4];
724 	uint8_t pos = 0;
725 	payload[pos++] = BT_RFCOMM_MSC_CMD;
726 	payload[pos++] = (2 << 1) | 1;  // len
727 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
728 	payload[pos++] = signals;
729 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
730 }
731 
732 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
733 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
734 	uint8_t payload[4];
735 	uint8_t pos = 0;
736 	payload[pos++] = BT_RFCOMM_MSC_RSP;
737 	payload[pos++] = (2 << 1) | 1;  // len
738 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
739 	payload[pos++] = signals;
740 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
741 }
742 
743 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
744     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
745     uint8_t payload[3];
746     uint8_t pos = 0;
747     payload[pos++] = BT_RFCOMM_NSC_RSP;
748     payload[pos++] = (1 << 1) | 1;  // len
749     payload[pos++] = command;
750     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
751 }
752 
753 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
754 	uint8_t payload[10];
755 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
756 	uint8_t pos = 0;
757 	payload[pos++] = BT_RFCOMM_PN_CMD;
758 	payload[pos++] = (8 << 1) | 1;  // len
759 	payload[pos++] = dlci;
760 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
761 	payload[pos++] = 0; // priority
762 	payload[pos++] = 0; // max 60 seconds ack
763 	payload[pos++] = max_frame_size & 0xff; // max framesize low
764 	payload[pos++] = max_frame_size >> 8;   // max framesize high
765 	payload[pos++] = 0x00; // number of retransmissions
766 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
767 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
768 }
769 
770 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
771 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
772                                        uint8_t priority, uint16_t max_frame_size){
773 	uint8_t payload[10];
774 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
775 	uint8_t pos = 0;
776 	payload[pos++] = BT_RFCOMM_PN_RSP;
777 	payload[pos++] = (8 << 1) | 1;  // len
778 	payload[pos++] = dlci;
779 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
780 	payload[pos++] = priority; // priority
781 	payload[pos++] = 0; // max 60 seconds ack
782 	payload[pos++] = max_frame_size & 0xff; // max framesize low
783 	payload[pos++] = max_frame_size >> 8;   // max framesize high
784 	payload[pos++] = 0x00; // number of retransmissions
785 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
786 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
787 }
788 
789 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
790     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
791     uint8_t payload[4];
792     uint8_t pos = 0;
793     payload[pos++] = BT_RFCOMM_RLS_CMD;
794     payload[pos++] = (2 << 1) | 1;  // len
795     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
796     payload[pos++] = line_status;
797     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
798 }
799 
800 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
801     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
802     uint8_t payload[4];
803     uint8_t pos = 0;
804     payload[pos++] = BT_RFCOMM_RLS_RSP;
805     payload[pos++] = (2 << 1) | 1;  // len
806     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
807     payload[pos++] = line_status;
808     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
809 }
810 
811 static int rfcomm_send_uih_rpn_config(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
812     uint8_t payload[10];
813     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
814     uint8_t pos = 0;
815     payload[pos++] = BT_RFCOMM_RPN_CMD;
816     payload[pos++] = (8 << 1) | 1;  // len
817     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
818     payload[pos++] = rpn_data->baud_rate;
819     payload[pos++] = rpn_data->flags;
820     payload[pos++] = rpn_data->flow_control;
821     payload[pos++] = rpn_data->xon;
822     payload[pos++] = rpn_data->xoff;
823     payload[pos++] = rpn_data->parameter_mask_0;
824     payload[pos++] = rpn_data->parameter_mask_1;
825     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
826 }
827 
828 static int rfcomm_send_uih_rpn_query(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
829     uint8_t payload[3];
830     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
831     uint8_t pos = 0;
832     payload[pos++] = BT_RFCOMM_RPN_CMD;
833     payload[pos++] = (1 << 1) | 1;  // len
834     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
835     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
836 }
837 
838 static int rfcomm_send_uih_rpn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
839 	uint8_t payload[10];
840 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
841 	uint8_t pos = 0;
842 	payload[pos++] = BT_RFCOMM_RPN_RSP;
843 	payload[pos++] = (8 << 1) | 1;  // len
844 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
845 	payload[pos++] = rpn_data->baud_rate;
846 	payload[pos++] = rpn_data->flags;
847 	payload[pos++] = rpn_data->flow_control;
848 	payload[pos++] = rpn_data->xon;
849 	payload[pos++] = rpn_data->xoff;
850 	payload[pos++] = rpn_data->parameter_mask_0;
851 	payload[pos++] = rpn_data->parameter_mask_1;
852 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
853 }
854 
855 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
856     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
857     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
858 }
859 
860 // depending on channel state emit channel opened with status or channel closed
861 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
862     // emit appropriate events
863     switch(channel->state){
864         case RFCOMM_CHANNEL_OPEN:
865         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
866             rfcomm_emit_channel_closed(channel);
867             break;
868         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
869             // remote didn't wait until we send the UA disc
870             // close event already emitted
871             break;
872         default:
873             rfcomm_emit_channel_opened(channel, status);
874             break;
875     }
876 }
877 
878 // MARK: RFCOMM MULTIPLEXER
879 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
880     if (multiplexer->timer_active) {
881         btstack_run_loop_remove_timer(&multiplexer->timer);
882         multiplexer->timer_active = 0;
883     }
884 }
885 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
886     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
887     btstack_memory_rfcomm_multiplexer_free(multiplexer);
888 }
889 
890 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
891     // remove (potential) timer
892     rfcomm_multiplexer_stop_timer(multiplexer);
893 
894     // close and remove all channels
895     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
896     while (it->next){
897         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
898         if (channel->multiplexer == multiplexer) {
899             // emit open with status or closed
900             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
901             // remove from list
902             it->next = it->next->next;
903             // free channel struct
904             btstack_memory_rfcomm_channel_free(channel);
905         } else {
906             it = it->next;
907         }
908     }
909 
910     // remove mutliplexer
911     rfcomm_multiplexer_free(multiplexer);
912 }
913 
914 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
915     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
916     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
917 
918     log_info("handler timeout: shutting down multiplexer! (no channels)");
919     uint16_t l2cap_cid = multiplexer->l2cap_cid;
920     rfcomm_multiplexer_finalize(multiplexer);
921     l2cap_disconnect(l2cap_cid);
922 }
923 
924 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
925     if (multiplexer->timer_active) {
926         btstack_run_loop_remove_timer(&multiplexer->timer);
927         multiplexer->timer_active = 0;
928     }
929     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
930 
931     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
932     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
933     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
934     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
935     btstack_run_loop_add_timer(&multiplexer->timer);
936     multiplexer->timer_active = 1;
937 }
938 
939 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
940     log_info("Multiplexer up and running");
941     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
942 
943     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
944 
945     // transition of channels that wait for multiplexer
946     btstack_linked_item_t *it;
947     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
948         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
949         if (channel->multiplexer != multiplexer) continue;
950         int rfcomm_channel_valid = 1;
951         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
952         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
953             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
954         }
955     }
956     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
957 
958     // request can send now for multiplexer if ready
959     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
960         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
961     }
962 }
963 
964 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
965 
966     log_debug("can_send_now enter: %u", l2cap_cid);
967 
968     btstack_linked_list_iterator_t it;
969     int token_consumed = 0;
970 
971     // forward token to multiplexer
972     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
973     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
974         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
975         if (multiplexer->l2cap_cid != l2cap_cid) continue;
976         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
977             log_debug("can_send_now enter: multiplexer token");
978             token_consumed = 1;
979             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
980         }
981     }
982 
983     // forward token to channel state machine
984     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
985     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
986         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
987         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
988         // channel state machine
989         if (rfcomm_channel_ready_to_send(channel)){
990             log_debug("can_send_now enter: channel token");
991             token_consumed = 1;
992             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
993             int rfcomm_channel_valid = 1;
994             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
995         }
996     }
997 
998     // forward token to client
999     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
1000     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
1001         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
1002         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
1003         // client waiting for can send now
1004         if (!channel->waiting_for_can_send_now)    continue;
1005         if ((channel->multiplexer->fcon & 1) == 0) continue;
1006         if (!channel->credits_outgoing){
1007             log_debug("can_send_now waiting to send but no credits (ignore)");
1008             continue;
1009         }
1010 
1011         log_debug("can_send_now enter: client token");
1012         token_consumed = 1;
1013         channel->waiting_for_can_send_now = 0;
1014         rfcomm_emit_can_send_now(channel);
1015     }
1016 
1017     // if token was consumed, request another one
1018     if (token_consumed) {
1019         l2cap_request_can_send_now_event(l2cap_cid);
1020     }
1021 
1022     log_debug("can_send_now exit");
1023 }
1024 
1025 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
1026     multiplexer->state = state;
1027     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1028 }
1029 
1030 /**
1031  * @return handled packet
1032  */
1033 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
1034 
1035     UNUSED(size);   // ok: handling own l2cap events
1036 
1037     bd_addr_t event_addr;
1038     uint16_t l2cap_cid;
1039     hci_con_handle_t con_handle;
1040     rfcomm_multiplexer_t *multiplexer = NULL;
1041     uint8_t status;
1042 
1043     switch (hci_event_packet_get_type(packet)) {
1044 
1045         // accept incoming rfcomm connection if no multiplexer exists yet
1046         case L2CAP_EVENT_INCOMING_CONNECTION:
1047             l2cap_event_incoming_connection_get_address(packet, event_addr);
1048             con_handle = l2cap_event_incoming_connection_get_handle(packet);
1049             l2cap_cid  = l2cap_event_incoming_connection_get_local_cid(packet);
1050 
1051             btstack_assert(l2cap_event_incoming_connection_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1052 
1053             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1054 
1055             if (multiplexer) {
1056                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - multiplexer already exists", l2cap_cid);
1057                 l2cap_decline_connection(l2cap_cid);
1058                 return 1;
1059             }
1060 
1061             // create and inititialize new multiplexer instance (incoming)
1062             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
1063             if (!multiplexer){
1064                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - no memory left", l2cap_cid);
1065                 l2cap_decline_connection(l2cap_cid);
1066                 return 1;
1067             }
1068 
1069             multiplexer->con_handle = con_handle;
1070             multiplexer->l2cap_cid = l2cap_cid;
1071             //
1072             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1073             log_info("RFCOMM incoming (l2cap_cid 0x%02x) => accept", l2cap_cid);
1074 
1075 #ifdef RFCOMM_USE_ERTM
1076             // request
1077             rfcomm_ertm_request_t request;
1078             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1079             (void)memcpy(request.addr, event_addr, 6);
1080             request.ertm_id = rfcomm_next_ertm_id();
1081             if (rfcomm_ertm_request_callback){
1082                 (*rfcomm_ertm_request_callback)(&request);
1083             }
1084             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1085                 multiplexer->ertm_id = request.ertm_id;
1086                 l2cap_ertm_accept_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1087                 return 1;
1088             }
1089 #endif
1090 
1091             l2cap_accept_connection(l2cap_cid);
1092             return 1;
1093 
1094         // l2cap connection opened -> store l2cap_cid, remote_addr
1095         case L2CAP_EVENT_CHANNEL_OPENED:
1096 
1097             btstack_assert(l2cap_event_channel_opened_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1098 
1099             status = l2cap_event_channel_opened_get_status(packet);
1100             log_info("channel opened, status %u", status);
1101 
1102             // get multiplexer for remote addr
1103             con_handle = l2cap_event_channel_opened_get_handle(packet);
1104             l2cap_cid = l2cap_event_channel_opened_get_local_cid(packet);
1105             l2cap_event_channel_opened_get_address(packet, event_addr);
1106             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1107             if (!multiplexer) {
1108                 log_error("channel opened but no multiplexer prepared");
1109                 return 1;
1110             }
1111 
1112             // set con handle for outgoing (already set for incoming)
1113             multiplexer->con_handle = con_handle;
1114 
1115             // on l2cap open error discard everything
1116             if (status){
1117 
1118                 // remove (potential) timer
1119                 rfcomm_multiplexer_stop_timer(multiplexer);
1120 
1121                 // mark multiplexer as shutting down
1122                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1123 
1124                 // emit rfcomm_channel_opened with status and free channel
1125                 // note: repeatedly go over list until full iteration causes no further change
1126                 int done;
1127                 do {
1128                     done = 1;
1129                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1130                     while (it->next) {
1131                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1132                         if (channel->multiplexer == multiplexer){
1133                             done = 0;
1134                             rfcomm_emit_channel_opened(channel, status);
1135                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1136                             btstack_memory_rfcomm_channel_free(channel);
1137                             break;
1138                         } else {
1139                             it = it->next;
1140                         }
1141                     }
1142                 } while (!done);
1143 
1144                 // free multiplexer
1145                 rfcomm_multiplexer_free(multiplexer);
1146                 return 1;
1147             }
1148 
1149             // following could be: rfcomm_multiplexer_state_machine(..., EVENT_L2CAP_OPENED)
1150 
1151             // set max frame size based on l2cap MTU
1152             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1153 
1154             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1155                 log_info("channel opened: outgoing connection");
1156                 multiplexer->l2cap_cid = l2cap_cid;
1157                 // send SABM #0
1158                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1159             }
1160             return 1;
1161 
1162             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1163 
1164         // Notify channel packet handler if they can send now
1165         case L2CAP_EVENT_CAN_SEND_NOW:
1166             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1167             rfcomm_handle_can_send_now(l2cap_cid);
1168             return 1;
1169 
1170         case L2CAP_EVENT_CHANNEL_CLOSED:
1171             l2cap_cid = l2cap_event_channel_closed_get_local_cid(packet);
1172             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1173             log_info("channel closed cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1174             if (!multiplexer) break;
1175             log_info("channel closed state %u", multiplexer->state);
1176             // no need to call l2cap_disconnect here, as it's already closed
1177             rfcomm_multiplexer_finalize(multiplexer);
1178             return 1;
1179 
1180 #ifdef RFCOMM_USE_ERTM
1181         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1182             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1183             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1184             if (multiplexer) {
1185                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1186                 if (rfcomm_ertm_released_callback){
1187                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1188                 }
1189             }
1190             break;
1191 #endif
1192 
1193         default:
1194             break;
1195     }
1196     return 0;
1197 }
1198 
1199 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1200     // get or create a multiplexer for a certain device
1201     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1202     if (!multiplexer) return 0;
1203 
1204     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1205 
1206     if (size < 3) return 0;
1207 
1208 	// but only care for multiplexer control channel
1209     uint8_t frame_dlci = packet[0] >> 2;
1210     if (frame_dlci) return 0;
1211     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1212     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1213     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1214     switch (packet[1]){
1215 
1216         case BT_RFCOMM_SABM:
1217             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1218                 log_info("Received SABM #0");
1219                 multiplexer->outgoing = 0;
1220                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1221                 return 1;
1222             }
1223             break;
1224 
1225         case BT_RFCOMM_UA:
1226             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1227                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1228                 log_info("Received UA #0 ");
1229                 rfcomm_multiplexer_opened(multiplexer);
1230                 return 1;
1231             }
1232             break;
1233 
1234         case BT_RFCOMM_DISC:
1235             // DISC #0 -> send UA #0, close multiplexer
1236             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1237             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1238             return 1;
1239 
1240         case BT_RFCOMM_DM:
1241             // DM #0 - we shouldn't get this, just give up
1242             log_info("Received DM #0");
1243             log_info("-> Closing down multiplexer");
1244             rfcomm_multiplexer_finalize(multiplexer);
1245             l2cap_disconnect(l2cap_cid);
1246             return 1;
1247 
1248         case BT_RFCOMM_UIH:
1249             if (payload_offset >= size) return 0;
1250 
1251             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1252                 // Multiplexer close down (CLD) -> close mutliplexer
1253                 log_info("Received Multiplexer close down command");
1254                 log_info("-> Closing down multiplexer");
1255                 rfcomm_multiplexer_finalize(multiplexer);
1256                 l2cap_disconnect(l2cap_cid);
1257                 return 1;
1258             }
1259             switch (packet[payload_offset]){
1260                 case BT_RFCOMM_CLD_CMD:
1261                      // Multiplexer close down (CLD) -> close mutliplexer
1262                     log_info("Received Multiplexer close down command");
1263                     log_info("-> Closing down multiplexer");
1264                     rfcomm_multiplexer_finalize(multiplexer);
1265                     l2cap_disconnect(l2cap_cid);
1266                     return 1;
1267 
1268                 case BT_RFCOMM_FCON_CMD:
1269                     multiplexer->fcon = 0x81;
1270                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1271                     return 1;
1272 
1273                 case BT_RFCOMM_FCOFF_CMD:
1274                     multiplexer->fcon = 0x80;
1275                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1276                     return 1;
1277 
1278                 case BT_RFCOMM_TEST_CMD: {
1279                     if ((payload_offset + 1) >= size) return 0; // (1)
1280                     log_info("Received test command");
1281                     int len = packet[payload_offset+1] >> 1; // length < 125
1282                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1283                         len = RFCOMM_TEST_DATA_MAX_LEN;
1284                     }
1285                     // from (1) => (size - 1 - payload_offset) > 0
1286                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1287                     multiplexer->test_data_len = len;
1288                     (void)memcpy(multiplexer->test_data,
1289                                  &packet[payload_offset + 2], len);
1290                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1291                     return 1;
1292                 }
1293                 default:
1294                     break;
1295             }
1296             break;
1297 
1298         default:
1299             break;
1300 
1301     }
1302     return 0;
1303 }
1304 
1305 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1306     if (multiplexer->send_dm_for_dlci) return 1;
1307     if (multiplexer->nsc_command) return 1;
1308     if (multiplexer->fcon & 0x80) return 1;
1309     switch (multiplexer->state){
1310         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1311         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1312         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1313             return 1;
1314         case RFCOMM_MULTIPLEXER_OPEN:
1315             if (multiplexer->test_data_len) {
1316                 return 1;
1317             }
1318             break;
1319         default:
1320             break;
1321     }
1322     return 0;
1323 }
1324 
1325 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1326 
1327     if (event != MULT_EV_READY_TO_SEND) return;
1328 
1329     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1330 
1331     // process stored DM responses
1332     if (multiplexer->send_dm_for_dlci){
1333         uint8_t dlci = multiplexer->send_dm_for_dlci;
1334         multiplexer->send_dm_for_dlci = 0;
1335         rfcomm_send_dm_pf(multiplexer, dlci);
1336         return;
1337     }
1338 
1339     if (multiplexer->nsc_command){
1340         uint8_t command = multiplexer->nsc_command;
1341         multiplexer->nsc_command = 0;
1342         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1343         return;
1344     }
1345 
1346     if (multiplexer->fcon & 0x80){
1347         multiplexer->fcon &= 0x01;
1348         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1349 
1350         if (multiplexer->fcon == 0) return;
1351         // trigger client to send again after sending FCon Response
1352         rfcomm_notify_channel_can_send();
1353         return;
1354     }
1355 
1356     switch (multiplexer->state) {
1357         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1358             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1359             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1360             rfcomm_send_sabm(multiplexer, 0);
1361             break;
1362         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1363             log_info("Sending UA #0");
1364             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1365             rfcomm_send_ua(multiplexer, 0);
1366 
1367             rfcomm_multiplexer_opened(multiplexer);
1368             break;
1369         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1370             log_info("Sending UA #0");
1371             log_info("Closing down multiplexer");
1372             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1373             rfcomm_send_ua(multiplexer, 0);
1374 
1375             rfcomm_multiplexer_finalize(multiplexer);
1376             l2cap_disconnect(l2cap_cid);
1377             break;
1378         case RFCOMM_MULTIPLEXER_OPEN:
1379             // respond to test command
1380             if (multiplexer->test_data_len){
1381                 int len = multiplexer->test_data_len;
1382                 log_info("Sending TEST Response with %u bytes", len);
1383                 multiplexer->test_data_len = 0;
1384                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1385                 return;
1386             }
1387             break;
1388         default:
1389             break;
1390     }
1391 }
1392 
1393 // MARK: RFCOMM CHANNEL
1394 
1395 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1396     channel->credits_incoming += credits;
1397     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1398 }
1399 
1400 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel){
1401     log_debug("cid 0x%04x, outgoing credits %u", channel->credits_outgoing);
1402     if (!channel->credits_outgoing) return false;
1403     if ((channel->multiplexer->fcon & 1) == 0) return false;
1404     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid) != 0;
1405 }
1406 
1407 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1408 
1409     log_info("opened");
1410 
1411     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1412     rfcomm_emit_channel_opened(rfChannel, 0);
1413     rfcomm_emit_port_configuration(rfChannel, false);
1414 
1415     // remove (potential) timer
1416     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1417     if (multiplexer->timer_active) {
1418         btstack_run_loop_remove_timer(&multiplexer->timer);
1419         multiplexer->timer_active = 0;
1420     }
1421     // hack for problem detecting authentication failure
1422     multiplexer->at_least_one_connection = 1;
1423 
1424     // request can send now if channel ready
1425     if (rfcomm_channel_ready_to_send(rfChannel)){
1426         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1427     }
1428 }
1429 
1430 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1431     const uint8_t frame_dlci = packet[0] >> 2;
1432     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1433     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1434     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1435     int request_can_send_now = 0;
1436 
1437     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1438     if (!channel) return;
1439 
1440     // handle new outgoing credits
1441     if (packet[1] == BT_RFCOMM_UIH_PF) {
1442 
1443         // add them
1444         uint16_t new_credits = packet[3+length_offset];
1445         channel->credits_outgoing += new_credits;
1446         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1447 
1448         // notify channel statemachine
1449         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1450         log_debug("state machine, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1451         int rfcomm_channel_valid = 1;
1452         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1453         if (rfcomm_channel_valid){
1454             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1455                 request_can_send_now = 1;
1456             }
1457         }
1458     }
1459 
1460     // contains payload?
1461     if ((size - 1) > payload_offset){
1462 
1463         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1464 
1465         // decrease incoming credit counter
1466         if (channel->credits_incoming > 0){
1467             channel->credits_incoming--;
1468         }
1469 
1470         // deliver payload
1471         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1472                               &packet[payload_offset], size-payload_offset-1);
1473     }
1474 
1475     // automatically provide new credits to remote device, if no incoming flow control
1476     if (!channel->incoming_flow_control && (channel->credits_incoming < 5)){
1477         channel->new_credits_incoming = RFCOMM_CREDITS;
1478         request_can_send_now = 1;
1479     }
1480 
1481     if (request_can_send_now){
1482         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1483     }
1484 }
1485 
1486 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1487     // priority of client request
1488     channel->pn_priority = event->priority;
1489 
1490     // new credits
1491     channel->credits_outgoing = event->credits_outgoing;
1492 
1493     // negotiate max frame size
1494     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1495         channel->max_frame_size = channel->multiplexer->max_frame_size;
1496     }
1497     if (channel->max_frame_size > event->max_frame_size) {
1498         channel->max_frame_size = event->max_frame_size;
1499     }
1500 
1501 }
1502 
1503 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1504 
1505     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1506 
1507     // remove from list
1508     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1509 
1510     // free channel
1511     btstack_memory_rfcomm_channel_free(channel);
1512 
1513     // update multiplexer timeout after channel was removed from list
1514     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1515 }
1516 
1517 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1518 
1519     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1520 
1521 
1522     // lookup existing channel
1523     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1524 
1525     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1526 
1527     if (channel) {
1528         int rfcomm_channel_valid = 1;
1529         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1530         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1531             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1532         }
1533         return;
1534     }
1535 
1536     // service registered?
1537     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1538     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1539     if (!service) {
1540         // discard request by sending disconnected mode
1541         multiplexer->send_dm_for_dlci = dlci;
1542         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1543         return;
1544     }
1545 
1546     // create channel for some events
1547     switch (event->type) {
1548         case CH_EVT_RCVD_SABM:
1549         case CH_EVT_RCVD_PN:
1550         case CH_EVT_RCVD_RPN_REQ:
1551         case CH_EVT_RCVD_RPN_CMD:
1552             // setup incoming channel
1553             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1554             if (!channel){
1555                 // discard request by sending disconnected mode
1556                 multiplexer->send_dm_for_dlci = dlci;
1557                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1558             }
1559             break;
1560         default:
1561             break;
1562     }
1563 
1564     if (!channel) {
1565         // discard request by sending disconnected mode
1566         multiplexer->send_dm_for_dlci = dlci;
1567         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1568         return;
1569     }
1570 
1571     int rfcomm_channel_valid = 1;
1572     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1573     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1574         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1575     }
1576 }
1577 
1578 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1579 
1580     UNUSED(size);   // ok: fixed format messages
1581 
1582     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1583     const uint8_t frame_dlci = packet[0] >> 2;
1584     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1585 	uint8_t message_len;  //   "
1586 
1587     // rfcomm: (1) command/control
1588     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1589     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1590     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1591     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1592     // rfcomm: (3+length_offset) credits if credits_offset == 1
1593     // rfcomm: (3+length_offest+credits_offset)
1594     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1595 
1596     rfcomm_channel_event_t event;
1597     rfcomm_channel_event_pn_t event_pn;
1598     rfcomm_channel_event_rpn_t event_rpn;
1599     rfcomm_channel_event_msc_t event_msc;
1600 
1601     // switch by rfcomm message type
1602     switch(packet[1]) {
1603 
1604         case BT_RFCOMM_SABM:
1605             event.type = CH_EVT_RCVD_SABM;
1606             log_info("Received SABM #%u", frame_dlci);
1607             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1608             break;
1609 
1610         case BT_RFCOMM_UA:
1611             event.type = CH_EVT_RCVD_UA;
1612             log_info("Received UA #%u",frame_dlci);
1613             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1614             break;
1615 
1616         case BT_RFCOMM_DISC:
1617             event.type = CH_EVT_RCVD_DISC;
1618             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1619             break;
1620 
1621         case BT_RFCOMM_DM:
1622         case BT_RFCOMM_DM_PF:
1623             event.type = CH_EVT_RCVD_DM;
1624             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1625             break;
1626 
1627         case BT_RFCOMM_UIH_PF:
1628         case BT_RFCOMM_UIH:
1629 
1630             message_len  = packet[payload_offset+1] >> 1;
1631 
1632             switch (packet[payload_offset]) {
1633                 case BT_RFCOMM_PN_CMD:
1634                     message_dlci = packet[payload_offset+2];
1635                     event_pn.super.type = CH_EVT_RCVD_PN;
1636                     event_pn.priority = packet[payload_offset+4];
1637                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1638                     event_pn.credits_outgoing = packet[payload_offset+9];
1639                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1640                         message_dlci, event_pn.credits_outgoing);
1641                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1642                     break;
1643 
1644                 case BT_RFCOMM_PN_RSP:
1645                     message_dlci = packet[payload_offset+2];
1646                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1647                     event_pn.priority = packet[payload_offset+4];
1648                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1649                     event_pn.credits_outgoing = packet[payload_offset+9];
1650                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1651                             event_pn.max_frame_size, event_pn.credits_outgoing);
1652                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1653                     break;
1654 
1655                 case BT_RFCOMM_MSC_CMD:
1656                     message_dlci = packet[payload_offset+2] >> 2;
1657                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1658                     event_msc.modem_status = packet[payload_offset+3];
1659                     log_info("Received MSC CMD for #%u, ", message_dlci);
1660                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1661                     break;
1662 
1663                 case BT_RFCOMM_MSC_RSP:
1664                     message_dlci = packet[payload_offset+2] >> 2;
1665                     event.type = CH_EVT_RCVD_MSC_RSP;
1666                     log_info("Received MSC RSP for #%u", message_dlci);
1667                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1668                     break;
1669 
1670                 case BT_RFCOMM_RPN_CMD:
1671                     message_dlci = packet[payload_offset+2] >> 2;
1672                     switch (message_len){
1673                         case 1:
1674                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1675                             event.type = CH_EVT_RCVD_RPN_REQ;
1676                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1677                             break;
1678                         case 8:
1679                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1680                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1681                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1682                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1683                             break;
1684                         default:
1685                             break;
1686                     }
1687                     break;
1688 
1689                 case BT_RFCOMM_RPN_RSP:
1690                     message_dlci = packet[payload_offset+2] >> 2;
1691                     if (message_len != 8) break;
1692                     event_rpn.super.type = CH_EVT_RCVD_RPN_RSP;
1693                     event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1694                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1695                     break;
1696 
1697                 case BT_RFCOMM_RLS_CMD: {
1698                     log_info("Received RLS command");
1699                     message_dlci = packet[payload_offset+2] >> 2;
1700                     rfcomm_channel_event_rls_t event_rls;
1701                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1702                     event_rls.line_status = packet[payload_offset+3];
1703                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1704                     break;
1705                 }
1706 
1707                 case BT_RFCOMM_RLS_RSP:
1708                     log_info("Received RLS response");
1709                     break;
1710 
1711                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1712                 // case BT_RFCOMM_TEST_CMD:
1713                 // case BT_RFCOMM_FCOFF_CMD:
1714                 // case BT_RFCOMM_FCON_CMD:
1715                 // everything else is an not supported command
1716                 default: {
1717                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1718                     multiplexer->nsc_command = packet[payload_offset];
1719                     break;
1720                 }
1721             }
1722             break;
1723 
1724         default:
1725             log_error("Received unknown RFCOMM message type %x", packet[1]);
1726             break;
1727     }
1728 
1729     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1730     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1731         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1732     }
1733 }
1734 
1735 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1736 
1737     if (packet_type == HCI_EVENT_PACKET){
1738         rfcomm_hci_event_handler(packet, size);
1739         return;
1740     }
1741 
1742     // we only handle l2cap packets for:
1743     if (packet_type != L2CAP_DATA_PACKET) return;
1744 
1745     //  - multiplexer itself
1746     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1747 
1748     if (handled) return;
1749 
1750     // - channel over open multiplexer
1751     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1752     if ( (multiplexer == NULL) || (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN)) return;
1753 
1754     // channel data ?
1755     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1756     const uint8_t frame_dlci = packet[0] >> 2;
1757 
1758     if (frame_dlci && ((packet[1] == BT_RFCOMM_UIH) || (packet[1] == BT_RFCOMM_UIH_PF))) {
1759         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1760         return;
1761     }
1762 
1763     rfcomm_channel_packet_handler(multiplexer, packet, size);
1764 }
1765 
1766 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1767     // note: exchanging MSC isn't neccessary to consider channel open
1768     // note: having outgoing credits is also not necessary to consider channel open
1769     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1770     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1771     // if (channel->credits_outgoing == 0) return 0;
1772     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u",
1773          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1774     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1775     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1776 
1777     return 1;
1778 }
1779 
1780 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1781     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %04x", channel->state_var);
1782     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1783     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1784     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1785     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1786     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1787     return 1;
1788 }
1789 
1790 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, uint32_t flag){
1791     channel->state_var |= flag;
1792 }
1793 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, uint32_t flag){
1794     channel->state_var &= ~flag;
1795 }
1796 
1797 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1798     switch (channel->state){
1799         case RFCOMM_CHANNEL_SEND_UIH_PN:
1800             log_debug("ch-ready: state %u", channel->state);
1801             return 1;
1802         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1803             log_debug("ch-ready: state %u", channel->state);
1804             return 1;
1805         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1806             log_debug("ch-ready: state %u", channel->state);
1807             return 1;
1808         case RFCOMM_CHANNEL_SEND_DISC:
1809             log_debug("ch-ready: state %u", channel->state);
1810             return 1;
1811         case RFCOMM_CHANNEL_SEND_DM:
1812             log_debug("ch-ready: state %u", channel->state);
1813             return 1;
1814         case RFCOMM_CHANNEL_OPEN:
1815             if (channel->new_credits_incoming) {
1816                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1817                 return 1;
1818             }
1819             break;
1820         case RFCOMM_CHANNEL_DLC_SETUP:
1821             if (channel->state_var & (
1822                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1823                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1824              )) {
1825                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1826                 return 1;
1827             }
1828             break;
1829 
1830         default:
1831             break;
1832     }
1833 
1834     if (channel->state_var & (
1835         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP       |
1836         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY    |
1837         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG   |
1838         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE |
1839         RFCOMM_CHANNEL_STATE_VAR_SEND_UA           |
1840         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD      |
1841         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1842                              )){
1843         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1844         return 1;
1845     }
1846 
1847     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) {
1848         log_debug("ch-ready: rls_line_status");
1849         return 1;
1850     }
1851 
1852     if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID) {
1853         log_debug("ch-ready: rls_line_status");
1854         return 1;
1855     }
1856 
1857     return 0;
1858 }
1859 
1860 
1861 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1862 
1863     // channel != NULL -> channel valid
1864     *out_channel_valid = 1;
1865 
1866     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1867 
1868     // TODO: integrate in common switch
1869     if (event->type == CH_EVT_RCVD_DISC){
1870         rfcomm_emit_channel_closed(channel);
1871         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1872         return;
1873     }
1874 
1875     // TODO: integrate in common switch
1876     if (event->type == CH_EVT_RCVD_DM){
1877         log_info("Received DM message for #%u", channel->dlci);
1878         log_info("-> Closing channel locally for #%u", channel->dlci);
1879         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1880         rfcomm_channel_finalize(channel);
1881         *out_channel_valid = 0;
1882         return;
1883     }
1884 
1885     // remote port negotiation command - just accept everything for now
1886     //
1887     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1888     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1889     //   (Although the handling of individual settings are implementation-dependent.)"
1890     //
1891 
1892     // TODO: integrate in common switch
1893     if (event->type == CH_EVT_RCVD_RPN_CMD){
1894         // control port parameters
1895         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1896         rfcomm_rpn_data_update(&channel->local_rpn_data, &event_rpn->data);
1897         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1898         // notify client about new settings
1899         rfcomm_emit_port_configuration(channel, false);
1900         return;
1901     }
1902 
1903     // TODO: integrate in common switch
1904     if (event->type == CH_EVT_RCVD_RPN_REQ){
1905         // no values got accepted (no values have beens sent)
1906         channel->local_rpn_data.parameter_mask_0 = 0x00;
1907         channel->local_rpn_data.parameter_mask_1 = 0x00;
1908         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1909         return;
1910     }
1911 
1912     if (event->type == CH_EVT_RCVD_RLS_CMD){
1913         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1914         channel->remote_line_status = event_rls->line_status & 0x0f;
1915         log_info("CH_EVT_RCVD_RLS_CMD remote line status 0x%0x", channel->remote_line_status);
1916         rfcomm_emit_remote_line_status(channel, channel->remote_line_status);
1917         return;
1918     }
1919 
1920     // TODO: integrate in common switch
1921     if (event->type == CH_EVT_READY_TO_SEND){
1922         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY){
1923             log_info("Sending Remote Port Configuration Query for #%u", channel->dlci);
1924             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY);
1925             rfcomm_send_uih_rpn_query(channel->multiplexer, channel->dlci);
1926             return;
1927         }
1928         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG){
1929             log_info("Sending Remote Port Configuration for #%u", channel->dlci);
1930             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
1931             rfcomm_send_uih_rpn_config(channel->multiplexer, channel->dlci, &channel->remote_rpn_data);
1932             return;
1933         }
1934         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE){
1935             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1936             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1937             rfcomm_send_uih_rpn_response(multiplexer, channel->dlci, &channel->local_rpn_data);
1938             return;
1939         }
1940         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
1941             log_info("Sending MSC CMD for #%u", channel->dlci);
1942             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1943             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
1944             rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , channel->local_modem_status);
1945             return;
1946         }
1947         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1948             log_info("Sending MSC RSP for #%u", channel->dlci);
1949             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1950             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1951             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, channel->remote_modem_status);
1952             return;
1953         }
1954         if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID){
1955             log_info("Sending RLS CMD 0x%0x", channel->local_line_status);
1956             uint8_t line_status = channel->local_line_status;
1957             channel->local_line_status = RFCOMM_RLS_STATUS_INVALID;
1958             rfcomm_send_uih_rls_cmd(multiplexer, channel->dlci, line_status);
1959             return;
1960         }
1961         if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID){
1962             log_info("Sending RLS RSP 0x%0x", channel->remote_line_status);
1963             uint8_t line_status = channel->remote_line_status;
1964             channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
1965             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1966             return;
1967         }
1968     }
1969 
1970     // emit MSC status to app
1971     if (event->type == CH_EVT_RCVD_MSC_CMD){
1972         // notify client about new settings
1973         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1974         uint8_t modem_status_event[5];
1975         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1976         modem_status_event[1] = sizeof(event) - 2;
1977         little_endian_store_16(modem_status_event, 2, channel->rfcomm_cid);
1978         modem_status_event[4] = event_msc->modem_status;
1979         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1980         // no return, MSC_CMD will be handled by state machine below
1981     }
1982 
1983     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1984 
1985     switch (channel->state) {
1986         case RFCOMM_CHANNEL_CLOSED:
1987             switch (event->type){
1988                 case CH_EVT_RCVD_SABM:
1989                     log_info("-> Inform app");
1990                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1991                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1992                     rfcomm_emit_connection_request(channel);
1993                     break;
1994                 case CH_EVT_RCVD_PN:
1995                     rfcomm_channel_accept_pn(channel, event_pn);
1996                     log_info("-> Inform app");
1997                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1998                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1999                     rfcomm_emit_connection_request(channel);
2000                     break;
2001                 default:
2002                     break;
2003             }
2004             break;
2005 
2006         case RFCOMM_CHANNEL_INCOMING_SETUP:
2007             switch (event->type){
2008                 case CH_EVT_RCVD_SABM:
2009                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
2010                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
2011                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2012                     }
2013                     break;
2014                 case CH_EVT_RCVD_PN:
2015                     rfcomm_channel_accept_pn(channel, event_pn);
2016                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
2017                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
2018                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2019                     }
2020                     break;
2021                 case CH_EVT_READY_TO_SEND:
2022                     // if / else if is used to check for state transition after sending
2023                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
2024                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
2025                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2026                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
2027                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
2028                         log_info("Sending UA #%u", channel->dlci);
2029                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2030                         rfcomm_send_ua(multiplexer, channel->dlci);
2031                     }
2032                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
2033                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
2034                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2035                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2036                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2037                      }
2038                     break;
2039                 default:
2040                     break;
2041             }
2042             break;
2043 
2044         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
2045             switch (event->type) {
2046                 case CH_EVT_MULTIPLEXER_READY:
2047                     log_info("Muliplexer opened, sending UIH PN next");
2048                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2049                     break;
2050                 default:
2051                     break;
2052             }
2053             break;
2054 
2055         case RFCOMM_CHANNEL_SEND_UIH_PN:
2056             switch (event->type) {
2057                 case CH_EVT_READY_TO_SEND:
2058                     // update mtu
2059                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
2060                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
2061                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
2062                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
2063                     break;
2064                 default:
2065                     break;
2066             }
2067             break;
2068 
2069         case RFCOMM_CHANNEL_W4_PN_RSP:
2070             switch (event->type){
2071                 case CH_EVT_RCVD_PN_RSP:
2072                     // update max frame size
2073                     if (channel->max_frame_size > event_pn->max_frame_size) {
2074                         channel->max_frame_size = event_pn->max_frame_size;
2075                     }
2076                     // new credits
2077                     channel->credits_outgoing = event_pn->credits_outgoing;
2078                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
2079                     break;
2080                 default:
2081                     break;
2082             }
2083             break;
2084 
2085         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
2086             switch (event->type) {
2087                 case CH_EVT_READY_TO_SEND:
2088                     log_info("Sending SABM #%u", channel->dlci);
2089                     channel->state = RFCOMM_CHANNEL_W4_UA;
2090                     rfcomm_send_sabm(multiplexer, channel->dlci);
2091                     break;
2092                 default:
2093                     break;
2094             }
2095             break;
2096 
2097         case RFCOMM_CHANNEL_W4_UA:
2098             switch (event->type){
2099                 case CH_EVT_RCVD_UA:
2100                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2101                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2102                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2103                     break;
2104                 default:
2105                     break;
2106             }
2107             break;
2108 
2109         case RFCOMM_CHANNEL_DLC_SETUP:
2110             switch (event->type){
2111                 case CH_EVT_RCVD_MSC_CMD:
2112                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2113                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2114                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2115                     break;
2116                 case CH_EVT_RCVD_MSC_RSP:
2117                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2118                     break;
2119 
2120                 case CH_EVT_READY_TO_SEND:
2121                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2122                         log_info("Providing credits for #%u", channel->dlci);
2123                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2124                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2125                         if (channel->new_credits_incoming) {
2126                             uint8_t new_credits = channel->new_credits_incoming;
2127                             channel->new_credits_incoming = 0;
2128                             rfcomm_channel_send_credits(channel, new_credits);
2129                         }
2130                         break;
2131                     }
2132                     break;
2133                 default:
2134                     break;
2135             }
2136             // finally done?
2137             if (rfcomm_channel_ready_for_open(channel)){
2138                 channel->state = RFCOMM_CHANNEL_OPEN;
2139                 rfcomm_channel_opened(channel);
2140             }
2141             break;
2142 
2143         case RFCOMM_CHANNEL_OPEN:
2144             switch (event->type){
2145                 case CH_EVT_RCVD_MSC_CMD:
2146                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2147                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2148                     break;
2149                 case CH_EVT_RCVD_RPN_RSP:
2150                     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE) == 0) break;
2151                     rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2152                     memcpy(&channel->remote_rpn_data, &((rfcomm_channel_event_rpn_t*) event)->data, sizeof(rfcomm_rpn_data_t));
2153                     rfcomm_emit_port_configuration(channel, true);
2154                     break;
2155                 case CH_EVT_READY_TO_SEND:
2156                     if (channel->new_credits_incoming) {
2157                         uint8_t new_credits = channel->new_credits_incoming;
2158                         channel->new_credits_incoming = 0;
2159                         rfcomm_channel_send_credits(channel, new_credits);
2160                         break;
2161                     }
2162                     break;
2163                 case CH_EVT_RCVD_CREDITS:
2164                     rfcomm_notify_channel_can_send();
2165                     break;
2166                 default:
2167                     break;
2168             }
2169             break;
2170 
2171         case RFCOMM_CHANNEL_SEND_DM:
2172             switch (event->type) {
2173                 case CH_EVT_READY_TO_SEND:
2174                     log_info("Sending DM_PF for #%u", channel->dlci);
2175                     // don't emit channel closed - channel was never open
2176                     channel->state = RFCOMM_CHANNEL_CLOSED;
2177                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2178                     rfcomm_channel_finalize(channel);
2179                     *out_channel_valid = 0;
2180                     break;
2181                 default:
2182                     break;
2183             }
2184             break;
2185 
2186         case RFCOMM_CHANNEL_SEND_DISC:
2187             switch (event->type) {
2188                 case CH_EVT_READY_TO_SEND:
2189                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2190                     rfcomm_send_disc(multiplexer, channel->dlci);
2191                     break;
2192                 default:
2193                     break;
2194             }
2195             break;
2196 
2197         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2198             switch (event->type){
2199                 case CH_EVT_RCVD_UA:
2200                     channel->state = RFCOMM_CHANNEL_CLOSED;
2201                     rfcomm_emit_channel_closed(channel);
2202                     rfcomm_channel_finalize(channel);
2203                     *out_channel_valid = 0;
2204                     break;
2205                 default:
2206                     break;
2207             }
2208             break;
2209 
2210         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2211             switch (event->type) {
2212                 case CH_EVT_READY_TO_SEND:
2213                     log_info("Sending UA after DISC for #%u", channel->dlci);
2214                     channel->state = RFCOMM_CHANNEL_CLOSED;
2215                     rfcomm_send_ua(multiplexer, channel->dlci);
2216                     rfcomm_channel_finalize(channel);
2217                     *out_channel_valid = 0;
2218                     break;
2219                 default:
2220                     break;
2221             }
2222             break;
2223 
2224         default:
2225             break;
2226     }
2227 }
2228 
2229 // MARK: RFCOMM BTstack API
2230 
2231 void rfcomm_init(void){
2232     rfcomm_security_level = gap_get_security_level();
2233 #ifdef RFCOMM_USE_ERTM
2234     rfcomm_ertm_id = 0;
2235 #endif
2236 }
2237 
2238 void rfcomm_deinit(void){
2239     rfcomm_client_cid_generator = 0;
2240     rfcomm_multiplexers = NULL;
2241     rfcomm_services     = NULL;
2242     rfcomm_channels     = NULL;
2243 #ifdef RFCOMM_USE_ERTM
2244     rfcomm_ertm_request_callback  = NULL;
2245     rfcomm_ertm_released_callback = NULL;
2246 #endif
2247 }
2248 
2249 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2250     rfcomm_security_level = security_level;
2251 }
2252 
2253 bool rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2254     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2255     if (!channel){
2256         log_error("send cid 0x%02x doesn't exist!", rfcomm_cid);
2257         return false;
2258     }
2259     return rfcomm_channel_can_send(channel);
2260 }
2261 
2262 uint8_t rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2263     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2264     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2265     channel->waiting_for_can_send_now = 1;
2266     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2267     return ERROR_CODE_SUCCESS;
2268 }
2269 
2270 static uint8_t rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2271     if (len > channel->max_frame_size){
2272         log_error("send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2273         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2274     }
2275 
2276 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2277     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2278         log_error("send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2279         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2280     }
2281 #endif
2282 
2283     if (!channel->credits_outgoing){
2284         log_info("send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2285         return RFCOMM_NO_OUTGOING_CREDITS;
2286     }
2287 
2288     if ((channel->multiplexer->fcon & 1) == 0){
2289         log_info("send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2290         return RFCOMM_AGGREGATE_FLOW_OFF;
2291     }
2292     return ERROR_CODE_SUCCESS;
2293 }
2294 
2295 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2296     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2297     if (!channel){
2298         return 0;
2299     }
2300     return channel->max_frame_size;
2301 }
2302 
2303 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2304 bool rfcomm_reserve_packet_buffer(void){
2305 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2306     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2307     return false;
2308 #else
2309     return l2cap_reserve_packet_buffer();
2310 #endif
2311 }
2312 
2313 void rfcomm_release_packet_buffer(void){
2314 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2315     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2316 #else
2317     l2cap_release_packet_buffer();
2318 #endif
2319 }
2320 
2321 uint8_t * rfcomm_get_outgoing_buffer(void){
2322 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2323     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2324 #else
2325     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2326 #endif
2327     // address + control + length (16) + no credit field
2328     return &rfcomm_out_buffer[4];
2329 }
2330 
2331 uint8_t rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2332     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2333     if (!channel){
2334         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2335         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2336     }
2337 
2338     uint8_t status = rfcomm_assert_send_valid(channel, len);
2339     if (status != ERROR_CODE_SUCCESS) return status;
2340 
2341 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2342     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2343         log_error("l2cap cannot send now");
2344         return BTSTACK_ACL_BUFFERS_FULL;
2345     }
2346 #else
2347     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2348         log_error("l2cap cannot send now");
2349         return BTSTACK_ACL_BUFFERS_FULL;
2350     }
2351 #endif
2352 
2353     // send might cause l2cap to emit new credits, update counters first
2354     if (len){
2355         channel->credits_outgoing--;
2356     } else {
2357         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2358     }
2359 
2360     status = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2361 
2362     if (status != 0) {
2363         log_error("error %d", status);
2364         if (len) {
2365             channel->credits_outgoing++;
2366         }
2367     }
2368 
2369     return status;
2370 }
2371 
2372 uint8_t rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2373     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2374     if (!channel){
2375         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2376         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2377     }
2378 
2379     uint8_t status = rfcomm_assert_send_valid(channel, len);
2380     if (status != ERROR_CODE_SUCCESS) return status;
2381     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2382         log_error("rfcomm_send_internal: l2cap cannot send now");
2383         return BTSTACK_ACL_BUFFERS_FULL;
2384     }
2385 
2386 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2387 #else
2388     rfcomm_reserve_packet_buffer();
2389 #endif
2390     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2391 
2392     (void)memcpy(rfcomm_payload, data, len);
2393     status = rfcomm_send_prepared(rfcomm_cid, len);
2394 
2395 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2396 #else
2397     if (status != ERROR_CODE_SUCCESS){
2398         rfcomm_release_packet_buffer();
2399     }
2400 #endif
2401 
2402     return ERROR_CODE_SUCCESS;
2403 }
2404 
2405 // Sends Local Line Status, see LINE_STATUS_..
2406 uint8_t rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2407     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2408     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2409     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) return ERROR_CODE_COMMAND_DISALLOWED;
2410     channel->local_line_status = line_status;
2411     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2412     return ERROR_CODE_SUCCESS;
2413 }
2414 
2415 // Sned local modem status. see MODEM_STAUS_..
2416 uint8_t rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2417     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2418     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2419     channel->local_modem_status = modem_status;
2420     // trigger send
2421     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2422     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2423     return ERROR_CODE_SUCCESS;
2424 }
2425 
2426 // Configure remote port
2427 uint8_t rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, uint8_t flow_control){
2428     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2429     if (!channel){
2430         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2431     }
2432 
2433     // store remote config
2434     channel->remote_rpn_data.baud_rate = baud_rate;
2435     channel->remote_rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2436     channel->remote_rpn_data.flow_control = flow_control;
2437     channel->remote_rpn_data.xon = 0;
2438     channel->remote_rpn_data.xoff = 0;
2439     channel->remote_rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2440     channel->remote_rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2441 
2442     // trigger send
2443     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
2444     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2445     return ERROR_CODE_SUCCESS;
2446 }
2447 
2448 // Query remote port
2449 uint8_t rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2450     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2451     if (!channel){
2452         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2453     }
2454     // trigger send
2455     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY | RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2456     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2457     return ERROR_CODE_SUCCESS;
2458 }
2459 
2460 
2461 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2462     log_info("create addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2463 
2464     // create new multiplexer if necessary
2465     uint8_t status = 0;
2466     uint8_t dlci = 0;
2467     int new_multiplexer = 0;
2468     rfcomm_channel_t * channel = NULL;
2469     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2470     if (!multiplexer) {
2471         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2472         if (!multiplexer) return BTSTACK_MEMORY_ALLOC_FAILED;
2473 
2474         multiplexer->outgoing = 1;
2475         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2476         new_multiplexer = 1;
2477     }
2478 
2479     // check if channel for this remote service already exists
2480     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2481     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2482     if (channel){
2483         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2484         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2485     }
2486 
2487     // prepare channel
2488     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2489     if (!channel){
2490         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2491         return BTSTACK_MEMORY_ALLOC_FAILED;
2492     }
2493 
2494     // rfcomm_cid is already assigned by rfcomm_channel_create
2495     channel->incoming_flow_control = incoming_flow_control;
2496     channel->new_credits_incoming  = initial_credits;
2497     channel->packet_handler = packet_handler;
2498 
2499     // return rfcomm_cid
2500     if (out_rfcomm_cid){
2501         *out_rfcomm_cid = channel->rfcomm_cid;
2502     }
2503 
2504     // start multiplexer setup
2505     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2506         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2507         uint16_t l2cap_cid = 0;
2508 #ifdef RFCOMM_USE_ERTM
2509         // request
2510         rfcomm_ertm_request_t request;
2511         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2512         (void)memcpy(request.addr, addr, 6);
2513         request.ertm_id = rfcomm_next_ertm_id();
2514         if (rfcomm_ertm_request_callback){
2515             (*rfcomm_ertm_request_callback)(&request);
2516         }
2517         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2518             multiplexer->ertm_id = request.ertm_id;
2519             status = l2cap_ertm_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2520                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2521         }
2522         else
2523 #endif
2524         {
2525             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2526         }
2527         if (status) {
2528             if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2529             btstack_memory_rfcomm_channel_free(channel);
2530             return status;
2531         }
2532         multiplexer->l2cap_cid = l2cap_cid;
2533         return ERROR_CODE_SUCCESS;
2534     }
2535 
2536     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2537 
2538     // start connecting, if multiplexer is already up and running
2539     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2540     return ERROR_CODE_SUCCESS;
2541 }
2542 
2543 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2544     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2545 }
2546 
2547 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2548     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2549 }
2550 
2551 uint8_t rfcomm_disconnect(uint16_t rfcomm_cid){
2552     log_info("disconnect cid 0x%02x", rfcomm_cid);
2553     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2554     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2555 
2556     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2557     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2558     return ERROR_CODE_SUCCESS;
2559 }
2560 
2561 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2562     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2563 
2564     log_info("register channel #%u mtu %u flow_control %u credits %u",
2565              channel, max_frame_size, incoming_flow_control, initial_credits);
2566 
2567     // check if already registered
2568     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2569     if (service){
2570         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2571     }
2572 
2573     // alloc structure
2574     service = btstack_memory_rfcomm_service_get();
2575     if (!service) {
2576         return BTSTACK_MEMORY_ALLOC_FAILED;
2577     }
2578 
2579     // register with l2cap if not registered before, max MTU
2580     if (btstack_linked_list_empty(&rfcomm_services)){
2581         uint8_t status = l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2582         if (status != ERROR_CODE_SUCCESS){
2583             btstack_memory_rfcomm_service_free(service);
2584             return status;
2585         }
2586     }
2587 
2588     // fill in
2589     service->packet_handler = packet_handler;
2590     service->server_channel = channel;
2591     service->max_frame_size = max_frame_size;
2592     service->incoming_flow_control = incoming_flow_control;
2593     service->incoming_initial_credits = initial_credits;
2594 
2595     // add to services list
2596     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2597 
2598     return ERROR_CODE_SUCCESS;
2599 }
2600 
2601 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2602     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2603 
2604     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2605 }
2606 
2607 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2608     uint16_t max_frame_size){
2609 
2610     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2611 }
2612 
2613 void rfcomm_unregister_service(uint8_t service_channel){
2614     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2615     if (!service) return;
2616     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2617     btstack_memory_rfcomm_service_free(service);
2618 
2619     // unregister if no services active
2620     if (btstack_linked_list_empty(&rfcomm_services)){
2621         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2622         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2623     }
2624 }
2625 
2626 uint8_t rfcomm_accept_connection(uint16_t rfcomm_cid){
2627     log_info("accept cid 0x%02x", rfcomm_cid);
2628     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2629     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2630 
2631     switch (channel->state) {
2632         case RFCOMM_CHANNEL_INCOMING_SETUP:
2633             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2634             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2635                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2636                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2637             }
2638             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2639                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2640                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2641             }
2642             // at least one of { PN RSP, UA } needs to be sent
2643             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2644             return ERROR_CODE_SUCCESS;
2645         default:
2646            return ERROR_CODE_COMMAND_DISALLOWED;
2647     }
2648 }
2649 
2650 uint8_t rfcomm_decline_connection(uint16_t rfcomm_cid){
2651     log_info("decline cid 0x%02x", rfcomm_cid);
2652     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2653     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2654 
2655     switch (channel->state) {
2656         case RFCOMM_CHANNEL_INCOMING_SETUP:
2657             channel->state = RFCOMM_CHANNEL_SEND_DM;
2658             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2659             return ERROR_CODE_SUCCESS;
2660         default:
2661             return ERROR_CODE_COMMAND_DISALLOWED;
2662     }
2663 }
2664 
2665 uint8_t rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2666     log_info("grant cid 0x%02x credits %u", rfcomm_cid, credits);
2667     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2668     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2669     if (!channel->incoming_flow_control) return ERROR_CODE_COMMAND_DISALLOWED;
2670     channel->new_credits_incoming += credits;
2671 
2672     // process
2673     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2674     return ERROR_CODE_SUCCESS;
2675 }
2676 
2677 #ifdef RFCOMM_USE_ERTM
2678 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2679     rfcomm_ertm_request_callback  = request_callback;
2680     rfcomm_ertm_released_callback = released_callback;
2681 }
2682 #endif
2683