1 /******************************************************************************
2  *
3  *  Copyright (C) 2004-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
22  *  functions
23  *
24  ******************************************************************************/
25 
26 #include <assert.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30 
31 #include "bt_types.h"
32 #include "bt_common.h"
33 #include "hcimsgs.h"
34 #include "l2c_api.h"
35 #include "l2c_int.h"
36 #include "l2cdefs.h"
37 #include "btm_api.h"
38 #include "btm_int.h"
39 #include "btu.h"
40 
41 
42 extern fixed_queue_t *btu_general_alarm_queue;
43 
44 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted */
45 #define L2C_FCR_RETX_ALL_PKTS   0xFF
46 
47 /* this is the minimal offset required by OBX to process incoming packets */
48 static const uint16_t OBX_BUF_MIN_OFFSET = 4;
49 
50 #if BT_TRACE_VERBOSE == TRUE
51 static char *SAR_types[] = { "Unsegmented", "Start", "End", "Continuation" };
52 static char *SUP_types[] = { "RR", "REJ", "RNR", "SREJ" };
53 #endif
54 
55 /* Look-up table for the CRC calculation */
56 static const unsigned short crctab[256] = {
57     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241,
58     0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
59     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40,
60     0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
61     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40,
62     0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
63     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641,
64     0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
65     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
66     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
67     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41,
68     0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
69     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41,
70     0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
71     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640,
72     0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
73     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240,
74     0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
75     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41,
76     0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
77     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41,
78     0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
79     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640,
80     0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
81     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241,
82     0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
83     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
84     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
85     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40,
86     0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
87     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641,
88     0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
89 };
90 
91 
92 /*******************************************************************************
93 **  Static local functions
94 */
95 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word);
96 static void    process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
97 static void    process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack);
98 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq);
99 static void    prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission);
100 static void    process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf);
101 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
102 
103 #if (L2CAP_ERTM_STATS == TRUE)
104 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked);
105 #endif
106 
107 /*******************************************************************************
108 **
109 ** Function         l2c_fcr_updcrc
110 **
111 ** Description      This function computes the CRC using the look-up table.
112 **
113 ** Returns          CRC
114 **
115 *******************************************************************************/
l2c_fcr_updcrc(unsigned short icrc,unsigned char * icp,int icnt)116 static unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char *icp, int icnt)
117 {
118     register unsigned short crc = icrc;
119     register unsigned char  *cp = icp;
120     register          int   cnt = icnt;
121 
122     while (cnt--)
123     {
124         crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
125     }
126 
127     return(crc);
128 }
129 
130 
131 /*******************************************************************************
132 **
133 ** Function         l2c_fcr_tx_get_fcs
134 **
135 ** Description      This function computes the CRC for a frame to be TXed.
136 **
137 ** Returns          CRC
138 **
139 *******************************************************************************/
l2c_fcr_tx_get_fcs(BT_HDR * p_buf)140 static UINT16 l2c_fcr_tx_get_fcs (BT_HDR *p_buf)
141 {
142     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
143 
144     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len));
145 }
146 
147 /*******************************************************************************
148 **
149 ** Function         l2c_fcr_rx_get_fcs
150 **
151 ** Description      This function computes the CRC for a received frame.
152 **
153 ** Returns          CRC
154 **
155 *******************************************************************************/
l2c_fcr_rx_get_fcs(BT_HDR * p_buf)156 static UINT16 l2c_fcr_rx_get_fcs (BT_HDR *p_buf)
157 {
158     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
159 
160     /* offset points past the L2CAP header, but the CRC check includes it */
161     p -= L2CAP_PKT_OVERHEAD;
162 
163     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
164 }
165 
166 /*******************************************************************************
167 **
168 ** Function         l2c_fcr_start_timer
169 **
170 ** Description      This function starts the (monitor or retransmission) timer.
171 **
172 ** Returns          -
173 **
174 *******************************************************************************/
l2c_fcr_start_timer(tL2C_CCB * p_ccb)175 void l2c_fcr_start_timer (tL2C_CCB *p_ccb)
176 {
177     assert(p_ccb != NULL);
178     UINT32  tout;
179 
180     /* The timers which are in milliseconds */
181     if (p_ccb->fcrb.wait_ack)
182     {
183         tout = (UINT32)p_ccb->our_cfg.fcr.mon_tout;
184     }
185     else
186     {
187         tout = (UINT32)p_ccb->our_cfg.fcr.rtrans_tout;
188     }
189 
190     /* Only start a timer that was not started */
191     if (!alarm_is_scheduled(p_ccb->fcrb.mon_retrans_timer)) {
192         alarm_set_on_queue(p_ccb->fcrb.mon_retrans_timer, tout,
193                            l2c_ccb_timer_timeout, p_ccb,
194                            btu_general_alarm_queue);
195     }
196 }
197 
198 /*******************************************************************************
199 **
200 ** Function         l2c_fcr_stop_timer
201 **
202 ** Description      This function stops the (monitor or transmission) timer.
203 **
204 ** Returns          -
205 **
206 *******************************************************************************/
l2c_fcr_stop_timer(tL2C_CCB * p_ccb)207 void l2c_fcr_stop_timer (tL2C_CCB *p_ccb)
208 {
209     assert(p_ccb != NULL);
210     alarm_cancel(p_ccb->fcrb.mon_retrans_timer);
211 }
212 
213 /*******************************************************************************
214 **
215 ** Function         l2c_fcr_cleanup
216 **
217 ** Description      This function cleans up the variable used for flow-control/retrans.
218 **
219 ** Returns          -
220 **
221 *******************************************************************************/
l2c_fcr_cleanup(tL2C_CCB * p_ccb)222 void l2c_fcr_cleanup (tL2C_CCB *p_ccb)
223 {
224     assert(p_ccb != NULL);
225     tL2C_FCRB *p_fcrb = &p_ccb->fcrb;
226 
227     alarm_free(p_fcrb->mon_retrans_timer);
228     p_fcrb->mon_retrans_timer = NULL;
229     alarm_free(p_fcrb->ack_timer);
230     p_fcrb->ack_timer = NULL;
231 
232     osi_free_and_reset((void **)&p_fcrb->p_rx_sdu);
233 
234     fixed_queue_free(p_fcrb->waiting_for_ack_q, osi_free);
235     p_fcrb->waiting_for_ack_q = NULL;
236 
237     fixed_queue_free(p_fcrb->srej_rcv_hold_q, osi_free);
238     p_fcrb->srej_rcv_hold_q = NULL;
239 
240     fixed_queue_free(p_fcrb->retrans_q, osi_free);
241     p_fcrb->retrans_q = NULL;
242 
243 #if (L2CAP_ERTM_STATS == TRUE)
244     if ( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID) && (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) )
245     {
246         UINT32  dur = time_get_os_boottime_ms() - p_ccb->fcrb.connect_tick_count;
247         char    *p_str = (char *)osi_malloc(120);
248         UINT16  i;
249         UINT32  throughput_avg, ack_delay_avg, ack_q_count_avg;
250 
251         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
252                    "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums", p_ccb->local_cid, dur);
253         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
254                    "Retransmissions:%08u Times Flow Controlled:%08u Retrans Touts:%08u Ack Touts:%08u",
255                     p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed, p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
256         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
257                    "Times there is less than 2 packets in controller when flow controlled:%08u", p_ccb->fcrb.controller_idle);
258         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
259                    "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u", p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz );
260 
261         sprintf(p_str, "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
262                 p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
263                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
264                 p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1], p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
265 
266         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
267 
268         sprintf(p_str, "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
269                 p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
270                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
271                 p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1], p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
272 
273         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
274 
275         throughput_avg = 0;
276         ack_delay_avg = 0;
277         ack_q_count_avg = 0;
278 
279         for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++) {
280             if (i == p_ccb->fcrb.ack_delay_avg_index) {
281                 BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
282                          "[%02u] collecting data ...", i );
283                 continue;
284             }
285 
286             sprintf(p_str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
287                     i, p_ccb->fcrb.throughput[i],
288                     p_ccb->fcrb.ack_delay_avg[i], p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
289                     p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i], p_ccb->fcrb.ack_q_count_max[i] );
290 
291             BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
292 
293             throughput_avg  += p_ccb->fcrb.throughput[i];
294             ack_delay_avg   += p_ccb->fcrb.ack_delay_avg[i];
295             ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
296         }
297 
298         throughput_avg  /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
299         ack_delay_avg   /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
300         ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
301 
302         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
303                  "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, ack_q_count_avg: %8u",
304                  throughput_avg, ack_delay_avg, ack_q_count_avg );
305 
306         osi_free(p_str);
307 
308         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
309                    "---");
310     }
311 #endif
312 
313     memset (p_fcrb, 0, sizeof (tL2C_FCRB));
314 }
315 
316 /*******************************************************************************
317 **
318 ** Function         l2c_fcr_clone_buf
319 **
320 ** Description      This function allocates and copies requested part of a buffer
321 **                  at a new-offset.
322 **
323 ** Returns          pointer to new buffer
324 **
325 *******************************************************************************/
l2c_fcr_clone_buf(BT_HDR * p_buf,UINT16 new_offset,UINT16 no_of_bytes)326 BT_HDR *l2c_fcr_clone_buf(BT_HDR *p_buf, UINT16 new_offset, UINT16 no_of_bytes)
327 {
328     assert(p_buf != NULL);
329     /*
330      * NOTE: We allocate extra L2CAP_FCS_LEN octets, in case we need to put
331      * the FCS (Frame Check Sequence) at the end of the buffer.
332      */
333     uint16_t buf_size = no_of_bytes + sizeof(BT_HDR) + new_offset + L2CAP_FCS_LEN;
334 #if (L2CAP_ERTM_STATS == TRUE)
335     /*
336      * NOTE: If L2CAP_ERTM_STATS is enabled, we need 4 extra octets at the
337      * end for a timestamp at the end of an I-frame.
338      */
339     buf_size += sizeof(uint32_t);
340 #endif
341     BT_HDR *p_buf2 = (BT_HDR *)osi_malloc(buf_size);
342 
343     p_buf2->offset = new_offset;
344     p_buf2->len = no_of_bytes;
345     memcpy(((UINT8 *)(p_buf2 + 1)) + p_buf2->offset,
346            ((UINT8 *)(p_buf + 1))  + p_buf->offset,
347            no_of_bytes);
348 
349     return (p_buf2);
350 }
351 
352 /*******************************************************************************
353 **
354 ** Function         l2c_fcr_is_flow_controlled
355 **
356 ** Description      This function checks if the CCB is flow controlled by peer.
357 **
358 ** Returns          The control word
359 **
360 *******************************************************************************/
l2c_fcr_is_flow_controlled(tL2C_CCB * p_ccb)361 BOOLEAN l2c_fcr_is_flow_controlled (tL2C_CCB *p_ccb)
362 {
363     assert(p_ccb != NULL);
364     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
365     {
366         /* Check if remote side flowed us off or the transmit window is full */
367         if ( (p_ccb->fcrb.remote_busy == TRUE)
368          ||  (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) >= p_ccb->peer_cfg.fcr.tx_win_sz) )
369         {
370 #if (L2CAP_ERTM_STATS == TRUE)
371             if (!fixed_queue_is_empty(p_ccb->xmit_hold_q))
372             {
373                 p_ccb->fcrb.xmit_window_closed++;
374 
375                 if ((p_ccb->p_lcb->sent_not_acked < 2)&&(l2cb.controller_xmit_window > 0))
376                     p_ccb->fcrb.controller_idle++;
377             }
378 #endif
379             return (TRUE);
380         }
381     }
382     return (FALSE);
383 }
384 
385 /*******************************************************************************
386 **
387 ** Function         prepare_I_frame
388 **
389 ** Description      This function sets the FCR variables in an I-frame that is
390 **                  about to be sent to HCI for transmission. This may be the
391 **                  first time the I-frame is sent, or a retransmission
392 **
393 ** Returns          -
394 **
395 *******************************************************************************/
prepare_I_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,BOOLEAN is_retransmission)396 static void prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission)
397 {
398     assert(p_ccb != NULL);
399     assert(p_buf != NULL);
400     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
401     UINT8       *p;
402     UINT16      fcs;
403     UINT16      ctrl_word;
404     BOOLEAN     set_f_bit = p_fcrb->send_f_rsp;
405 
406     p_fcrb->send_f_rsp = FALSE;
407 
408     if (is_retransmission)
409     {
410         /* Get the old control word and clear out the old req_seq and F bits */
411         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
412 
413         STREAM_TO_UINT16 (ctrl_word, p);
414 
415         ctrl_word  &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
416     }
417     else
418     {
419         ctrl_word  = p_buf->layer_specific & L2CAP_FCR_SEG_BITS;                /* SAR bits */
420         ctrl_word |= (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT);      /* Tx Seq */
421 
422         p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
423     }
424 
425     /* Set the F-bit and reqseq only if using re-transmission mode */
426     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
427     {
428         if (set_f_bit)
429             ctrl_word |= L2CAP_FCR_F_BIT;
430 
431         ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
432 
433         p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
434 
435         alarm_cancel(p_ccb->fcrb.ack_timer);
436     }
437 
438     /* Set the control word */
439     p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
440 
441     UINT16_TO_STREAM (p, ctrl_word);
442 
443     /* Compute the FCS and add to the end of the buffer if not bypassed */
444     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
445     {
446         /* length field in l2cap header has to include FCS length */
447         p = ((UINT8 *) (p_buf+1)) + p_buf->offset;
448         UINT16_TO_STREAM (p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
449 
450         /* Calculate the FCS */
451         fcs = l2c_fcr_tx_get_fcs(p_buf);
452 
453         /* Point to the end of the buffer and put the FCS there */
454         /*
455          * NOTE: Here we assume the allocated buffer is large enough
456          * to include extra L2CAP_FCS_LEN octets at the end.
457          */
458         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
459 
460         UINT16_TO_STREAM (p, fcs);
461 
462         p_buf->len += L2CAP_FCS_LEN;
463     }
464 
465 #if BT_TRACE_VERBOSE == TRUE
466     if (is_retransmission)
467     {
468         L2CAP_TRACE_EVENT ("L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  ReqSeq: %u  F: %u",
469                             p_ccb->local_cid, p_buf->len,
470                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
471                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
472                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
473                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
474     }
475     else
476     {
477         L2CAP_TRACE_EVENT ("L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
478                             p_ccb->local_cid, p_buf->len,
479                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
480                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
481                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
482                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
483     }
484 #endif
485 
486     /* Start the retransmission timer if not already running */
487     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
488         l2c_fcr_start_timer (p_ccb);
489 }
490 
491 /*******************************************************************************
492 **
493 ** Function         l2c_fcr_send_S_frame
494 **
495 ** Description      This function formats and sends an S-frame for transmission.
496 **
497 ** Returns          -
498 **
499 *******************************************************************************/
l2c_fcr_send_S_frame(tL2C_CCB * p_ccb,UINT16 function_code,UINT16 pf_bit)500 void l2c_fcr_send_S_frame (tL2C_CCB *p_ccb, UINT16 function_code, UINT16 pf_bit)
501 {
502     assert(p_ccb != NULL);
503     UINT8       *p;
504     UINT16      ctrl_word;
505     UINT16      fcs;
506 
507     if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN))
508         return;
509 
510 #if (L2CAP_ERTM_STATS == TRUE)
511      p_ccb->fcrb.s_frames_sent[function_code]++;
512 #endif
513 
514     if (pf_bit == L2CAP_FCR_P_BIT)
515     {
516         p_ccb->fcrb.wait_ack = TRUE;
517 
518         l2c_fcr_stop_timer (p_ccb);         /* Restart the monitor timer */
519         l2c_fcr_start_timer (p_ccb);
520     }
521 
522     /* Create the control word to use */
523     ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
524     ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
525     ctrl_word |= pf_bit;
526 
527     BT_HDR *p_buf = (BT_HDR *)osi_malloc(L2CAP_CMD_BUF_SIZE);
528     p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
529     p_buf->len    = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
530 
531     /* Set the pointer to the beginning of the data */
532     p = (UINT8 *)(p_buf + 1) + p_buf->offset;
533 
534     /* Put in the L2CAP header */
535     UINT16_TO_STREAM(p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
536     UINT16_TO_STREAM(p, p_ccb->remote_cid);
537     UINT16_TO_STREAM(p, ctrl_word);
538 
539     /* Compute the FCS and add to the end of the buffer if not bypassed */
540     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
541         fcs = l2c_fcr_tx_get_fcs (p_buf);
542 
543         UINT16_TO_STREAM (p, fcs);
544         p_buf->len += L2CAP_FCS_LEN;
545     } else {
546         /* rewrite the length without FCS length */
547         p -= 6;
548         UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD);
549     }
550 
551     /* Now, the HCI transport header */
552     p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
553     l2cu_set_acl_hci_header (p_buf, p_ccb);
554 
555 #if BT_TRACE_VERBOSE == TRUE
556     if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
557         || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3)) {
558         L2CAP_TRACE_WARNING("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
559                             p_ccb->local_cid, ctrl_word,
560                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
561                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
562                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
563                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
564         L2CAP_TRACE_WARNING ("                  Buf Len: %u", p_buf->len);
565     } else {
566         L2CAP_TRACE_EVENT("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
567                           p_ccb->local_cid, ctrl_word,
568                           SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
569                           (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
570                           (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
571                           (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
572         L2CAP_TRACE_EVENT("                  Buf Len: %u", p_buf->len);
573     }
574 #endif  /* BT_TRACE_VERBOSE */
575 
576     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, p_buf);
577 
578     p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
579 
580     alarm_cancel(p_ccb->fcrb.ack_timer);
581 }
582 
583 
584 /*******************************************************************************
585 **
586 ** Function         l2c_fcr_proc_pdu
587 **
588 ** Description      This function is the entry point for processing of a
589 **                  received PDU when in flow control and/or retransmission modes.
590 **
591 ** Returns          -
592 **
593 *******************************************************************************/
l2c_fcr_proc_pdu(tL2C_CCB * p_ccb,BT_HDR * p_buf)594 void l2c_fcr_proc_pdu (tL2C_CCB *p_ccb, BT_HDR *p_buf)
595 {
596     assert(p_ccb != NULL);
597     assert(p_buf != NULL);
598     UINT8       *p;
599     UINT16      fcs;
600     UINT16      min_pdu_len;
601     UINT16      ctrl_word;
602 
603     /* Check the length */
604     min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS) ?
605                   (UINT16)L2CAP_FCR_OVERHEAD : (UINT16)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
606 
607     if (p_buf->len < min_pdu_len)
608     {
609         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u", p_ccb->local_cid, p_buf->len);
610         osi_free(p_buf);
611         return;
612     }
613 
614     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE)
615     {
616         process_stream_frame (p_ccb, p_buf);
617         return;
618     }
619 
620 #if BT_TRACE_VERBOSE == TRUE
621     /* Get the control word */
622     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
623     STREAM_TO_UINT16 (ctrl_word, p);
624 
625     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
626     {
627         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
628          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
629         {
630             /* REJ or SREJ */
631             L2CAP_TRACE_WARNING ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
632                             p_ccb->local_cid, p_buf->len,
633                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
634                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
635                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
636                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
637         }
638         else
639         {
640             L2CAP_TRACE_EVENT ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
641                             p_ccb->local_cid, p_buf->len,
642                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
643                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
644                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
645                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
646         }
647     }
648     else
649     {
650         L2CAP_TRACE_EVENT ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
651                             p_ccb->local_cid, p_buf->len,
652                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
653                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
654                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
655                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
656     }
657 
658     L2CAP_TRACE_EVENT ("      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt %u, wt_q.cnt %u, tries %u",
659                        p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack,
660                        p_ccb->fcrb.next_seq_expected,
661                        p_ccb->fcrb.last_ack_sent,
662                        fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q),
663                        p_ccb->fcrb.num_tries);
664 
665 #endif /* BT_TRACE_VERBOSE */
666 
667     /* Verify FCS if using */
668     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
669     {
670         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
671 
672         /* Extract and drop the FCS from the packet */
673         STREAM_TO_UINT16 (fcs, p);
674         p_buf->len -= L2CAP_FCS_LEN;
675 
676         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
677         {
678             L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
679             osi_free(p_buf);
680             return;
681         }
682     }
683 
684     /* Get the control word */
685     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
686 
687     STREAM_TO_UINT16 (ctrl_word, p);
688 
689     p_buf->len    -= L2CAP_FCR_OVERHEAD;
690     p_buf->offset += L2CAP_FCR_OVERHEAD;
691 
692     /* If we had a poll bit outstanding, check if we got a final response */
693     if (p_ccb->fcrb.wait_ack)
694     {
695         /* If final bit not set, ignore the frame unless it is a polled S-frame */
696         if ( !(ctrl_word & L2CAP_FCR_F_BIT) )
697         {
698             if ( (ctrl_word & L2CAP_FCR_P_BIT) && (ctrl_word & L2CAP_FCR_S_FRAME_BIT) )
699             {
700                 if (p_ccb->fcrb.srej_sent)
701                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
702                 else if (p_ccb->fcrb.local_busy)
703                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
704                 else
705                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
706 
707                 /* Got a poll while in wait_ack state, so re-start our timer with 1-second */
708                 /* This is a small optimization... the monitor timer is 12 secs, but we saw */
709                 /* that if the other side sends us a poll when we are waiting for a final,  */
710                 /* then it speeds up recovery significantly if we poll him back soon after his poll. */
711                 alarm_set_on_queue(p_ccb->fcrb.mon_retrans_timer,
712                                    BT_1SEC_TIMEOUT_MS,
713                                    l2c_ccb_timer_timeout, p_ccb,
714                                    btu_general_alarm_queue);
715             }
716             osi_free(p_buf);
717             return;
718         }
719 
720         p_ccb->fcrb.wait_ack  = FALSE;
721 
722         /* P and F are mutually exclusive */
723         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
724             ctrl_word &= ~L2CAP_FCR_P_BIT;
725 
726         if (fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
727             p_ccb->fcrb.num_tries = 0;
728 
729         l2c_fcr_stop_timer (p_ccb);
730     }
731     else
732     {
733         /* Otherwise, ensure the final bit is ignored */
734         ctrl_word &= ~L2CAP_FCR_F_BIT;
735     }
736 
737     /* Process receive sequence number */
738     if (!process_reqseq (p_ccb, ctrl_word))
739     {
740         osi_free(p_buf);
741         return;
742     }
743 
744      /* Process based on whether it is an S-frame or an I-frame */
745     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
746         process_s_frame (p_ccb, p_buf, ctrl_word);
747     else
748         process_i_frame (p_ccb, p_buf, ctrl_word, FALSE);
749 
750     /* Return if the channel got disconnected by a bad packet or max retransmissions */
751     if ( (!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN) )
752         return;
753 
754     /* If we have some buffers held while doing SREJ, and SREJ has cleared, process them now */
755     if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) &&
756          (!fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q)))
757     {
758         fixed_queue_t *temp_q = p_ccb->fcrb.srej_rcv_hold_q;
759         p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(SIZE_MAX);
760 
761         while ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(temp_q)) != NULL)
762         {
763             if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
764             {
765                 /* Get the control word */
766                 p = ((UINT8 *)(p_buf+1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
767 
768                 STREAM_TO_UINT16 (ctrl_word, p);
769 
770                 L2CAP_TRACE_DEBUG ("l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   TxSeq: %u  Expected_Seq: %u",
771                                     p_ccb->local_cid, (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
772                                     p_ccb->fcrb.next_seq_expected);
773 
774                 /* Process the SREJ held I-frame, but do not send an RR for each individual frame */
775                 process_i_frame (p_ccb, p_buf, ctrl_word, TRUE);
776             }
777             else
778                 osi_free(p_buf);
779 
780             /* If more frames were lost during SREJ, send a REJ */
781             if (p_ccb->fcrb.rej_after_srej)
782             {
783                 p_ccb->fcrb.rej_after_srej = FALSE;
784                 p_ccb->fcrb.rej_sent       = TRUE;
785 
786                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
787             }
788         }
789         fixed_queue_free(temp_q, NULL);
790 
791         /* Now, if needed, send one RR for the whole held queue */
792         if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) && (!p_ccb->fcrb.srej_sent)
793          &&  (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent) )
794             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
795         else
796         {
797             L2CAP_TRACE_DEBUG ("l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
798                                 p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent, p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
799                                 p_ccb->fcrb.last_ack_sent);
800         }
801     }
802 
803     /* If a window has opened, check if we can send any more packets */
804     if ( (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q) ||
805           !fixed_queue_is_empty(p_ccb->xmit_hold_q))
806       && (p_ccb->fcrb.wait_ack == FALSE)
807       && (l2c_fcr_is_flow_controlled (p_ccb) == FALSE) )
808     {
809         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
810     }
811 }
812 
813 /*******************************************************************************
814 **
815 ** Function         l2c_lcc_proc_pdu
816 **
817 ** Description      This function is the entry point for processing of a
818 **                  received PDU when in LE Coc flow control modes.
819 **
820 ** Returns          -
821 **
822 *******************************************************************************/
l2c_lcc_proc_pdu(tL2C_CCB * p_ccb,BT_HDR * p_buf)823 void l2c_lcc_proc_pdu(tL2C_CCB *p_ccb, BT_HDR *p_buf)
824 {
825 
826     assert(p_ccb != NULL);
827     assert(p_buf != NULL);
828     UINT8  *p = (UINT8*)(p_buf + 1) + p_buf->offset;
829     UINT16 sdu_length;
830     BT_HDR *p_data = NULL;
831 
832     /* Buffer length should not exceed local mps */
833     if (p_buf->len > p_ccb->local_conn_cfg.mps)
834     {
835         /* Discard the buffer */
836         osi_free(p_buf);
837         return;
838     }
839 
840     if (p_ccb->is_first_seg)
841     {
842         STREAM_TO_UINT16(sdu_length, p);
843         /* Check the SDU Length with local MTU size */
844         if (sdu_length > p_ccb->local_conn_cfg.mtu)
845         {
846             /* Discard the buffer */
847             osi_free(p_buf);
848             return;
849         }
850 
851 
852         if ((p_data = (BT_HDR *) osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL)
853         {
854             osi_free(p_buf);
855             return;
856         }
857 
858         p_ccb->ble_sdu = p_data;
859         p_data->len = 0;
860         p_ccb->ble_sdu_length = sdu_length;
861         L2CAP_TRACE_DEBUG ("%s SDU Length = %d",__func__,sdu_length);
862         p_buf->len -= sizeof(sdu_length);
863         p_buf->offset += sizeof(sdu_length);
864         p_data->offset = 0;
865 
866     }
867     else
868         p_data = p_ccb->ble_sdu;
869 
870     memcpy((UINT8*)(p_data + 1) + p_data->offset + p_data->len, (UINT8*)(p_buf + 1) + p_buf->offset, p_buf->len);
871     p_data->len += p_buf->len;
872     p = (UINT8*)(p_data+1) + p_data->offset;
873     if (p_data->len == p_ccb->ble_sdu_length)
874     {
875         l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_data);
876         p_ccb->is_first_seg = TRUE;
877         p_ccb->ble_sdu = NULL;
878         p_ccb->ble_sdu_length = 0;
879     }
880     else if (p_data->len < p_ccb->ble_sdu_length)
881     {
882         p_ccb->is_first_seg = FALSE;
883     }
884     else
885     {
886         L2CAP_TRACE_ERROR ("%s Length in the SDU messed up",__func__);
887         // TODO: reset every thing may be???
888     }
889 
890     osi_free(p_buf);
891     return;
892 }
893 
894 /*******************************************************************************
895 **
896 ** Function         l2c_fcr_proc_tout
897 **
898 ** Description      Handle a timeout. We should be in error recovery state.
899 **
900 ** Returns          -
901 **
902 *******************************************************************************/
l2c_fcr_proc_tout(tL2C_CCB * p_ccb)903 void l2c_fcr_proc_tout (tL2C_CCB *p_ccb)
904 {
905     assert(p_ccb != NULL);
906     L2CAP_TRACE_DEBUG ("l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  ack_q_count: %u",
907                        p_ccb->local_cid, p_ccb->fcrb.num_tries,
908                        p_ccb->peer_cfg.fcr.max_transmit,
909                        p_ccb->fcrb.wait_ack,
910                        fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
911 
912 #if (L2CAP_ERTM_STATS == TRUE)
913     p_ccb->fcrb.retrans_touts++;
914 #endif
915 
916     if ( (p_ccb->peer_cfg.fcr.max_transmit != 0) && (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit) )
917     {
918         l2cu_disconnect_chnl (p_ccb);
919     }
920     else
921     {
922         if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent)
923         {
924             if (p_ccb->fcrb.local_busy)
925                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
926             else
927                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
928         }
929     }
930 }
931 
932 
933 /*******************************************************************************
934 **
935 ** Function         l2c_fcr_proc_ack_tout
936 **
937 ** Description      Send RR/RNR if we have not acked I frame
938 **
939 ** Returns          -
940 **
941 *******************************************************************************/
l2c_fcr_proc_ack_tout(tL2C_CCB * p_ccb)942 void l2c_fcr_proc_ack_tout (tL2C_CCB *p_ccb)
943 {
944     assert(p_ccb != NULL);
945     L2CAP_TRACE_DEBUG ("l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d", p_ccb->local_cid,
946                         p_ccb->chnl_state, p_ccb->fcrb.wait_ack, p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
947 
948     if ( (p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack)
949       && (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected) )
950     {
951 #if (L2CAP_ERTM_STATS == TRUE)
952         p_ccb->fcrb.xmit_ack_touts++;
953 #endif
954         if (p_ccb->fcrb.local_busy)
955             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
956         else
957             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
958     }
959 }
960 
961 
962 /*******************************************************************************
963 **
964 ** Function         process_reqseq
965 **
966 ** Description      Handle receive sequence number
967 **
968 ** Returns          -
969 **
970 *******************************************************************************/
process_reqseq(tL2C_CCB * p_ccb,UINT16 ctrl_word)971 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
972 {
973     assert(p_ccb != NULL);
974     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
975     UINT8       req_seq, num_bufs_acked, xx;
976     UINT16      ls;
977     UINT16      full_sdus_xmitted;
978 
979     /* Receive sequence number does not ack anything for SREJ with P-bit set to zero */
980     if ( (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
981      &&  ((ctrl_word & L2CAP_FCR_SUP_BITS) == (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT))
982      &&  ((ctrl_word & L2CAP_FCR_P_BIT) == 0) )
983     {
984         /* If anything still waiting for ack, restart the timer if it was stopped */
985         if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
986             l2c_fcr_start_timer(p_ccb);
987 
988         return (TRUE);
989     }
990 
991     /* Extract the receive sequence number from the control word */
992     req_seq = (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
993 
994     num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
995 
996     /* Verify the request sequence is in range before proceeding */
997     if (num_bufs_acked > fixed_queue_length(p_fcrb->waiting_for_ack_q))
998     {
999         /* The channel is closed if ReqSeq is not in range */
1000         L2CAP_TRACE_WARNING ("L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
1001                              ctrl_word, req_seq, p_fcrb->last_rx_ack,
1002                              fixed_queue_length(p_fcrb->waiting_for_ack_q));
1003 
1004         l2cu_disconnect_chnl (p_ccb);
1005         return (FALSE);
1006     }
1007 
1008     p_fcrb->last_rx_ack = req_seq;
1009 
1010     /* Now we can release all acknowledged frames, and restart the retransmission timer if needed */
1011     if (num_bufs_acked != 0)
1012     {
1013         p_fcrb->num_tries = 0;
1014         full_sdus_xmitted = 0;
1015 
1016 #if (L2CAP_ERTM_STATS == TRUE)
1017         l2c_fcr_collect_ack_delay (p_ccb, num_bufs_acked);
1018 #endif
1019 
1020         for (xx = 0; xx < num_bufs_acked; xx++)
1021         {
1022             BT_HDR *p_tmp = (BT_HDR *)fixed_queue_try_dequeue(p_fcrb->waiting_for_ack_q);
1023             ls = p_tmp->layer_specific & L2CAP_FCR_SAR_BITS;
1024 
1025             if ( (ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU) )
1026                 full_sdus_xmitted++;
1027 
1028             osi_free(p_tmp);
1029         }
1030 
1031         /* If we are still in a wait_ack state, do not mess with the timer */
1032         if (!p_ccb->fcrb.wait_ack)
1033             l2c_fcr_stop_timer (p_ccb);
1034 
1035         /* Check if we need to call the "packet_sent" callback */
1036         if ( (p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) && (full_sdus_xmitted) )
1037         {
1038             /* Special case for eRTM, if all packets sent, send 0xFFFF */
1039             if (fixed_queue_is_empty(p_fcrb->waiting_for_ack_q) &&
1040                 fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
1041                 full_sdus_xmitted = 0xFFFF;
1042             }
1043 
1044             (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid, full_sdus_xmitted);
1045         }
1046     }
1047 
1048     /* If anything still waiting for ack, restart the timer if it was stopped */
1049     if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
1050         l2c_fcr_start_timer(p_ccb);
1051     return (TRUE);
1052 }
1053 
1054 
1055 /*******************************************************************************
1056 **
1057 ** Function         process_s_frame
1058 **
1059 ** Description      Process an S frame
1060 **
1061 ** Returns          -
1062 **
1063 *******************************************************************************/
process_s_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,UINT16 ctrl_word)1064 static void process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
1065 {
1066     assert(p_ccb != NULL);
1067     assert(p_buf != NULL);
1068 
1069     tL2C_FCRB   *p_fcrb      = &p_ccb->fcrb;
1070     UINT16      s_frame_type = (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
1071     BOOLEAN     remote_was_busy;
1072     BOOLEAN     all_ok = TRUE;
1073 
1074     if (p_buf->len != 0)
1075     {
1076         L2CAP_TRACE_WARNING ("Incorrect S-frame Length (%d)", p_buf->len);
1077     }
1078 
1079     L2CAP_TRACE_DEBUG ("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d", ctrl_word, p_fcrb->remote_busy);
1080 
1081 #if (L2CAP_ERTM_STATS == TRUE)
1082     p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
1083 #endif
1084 
1085     if (ctrl_word & L2CAP_FCR_P_BIT)
1086     {
1087         p_fcrb->rej_sent   = FALSE;             /* After checkpoint, we can send anoher REJ */
1088         p_fcrb->send_f_rsp = TRUE;              /* Set a flag in case an I-frame is pending */
1089     }
1090 
1091     switch (s_frame_type)
1092     {
1093     case L2CAP_FCR_SUP_RR:
1094         remote_was_busy     = p_fcrb->remote_busy;
1095         p_fcrb->remote_busy = FALSE;
1096 
1097         if ( (ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy) )
1098             all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
1099         break;
1100 
1101     case L2CAP_FCR_SUP_REJ:
1102         p_fcrb->remote_busy = FALSE;
1103         all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
1104         break;
1105 
1106     case L2CAP_FCR_SUP_RNR:
1107         p_fcrb->remote_busy = TRUE;
1108         l2c_fcr_stop_timer (p_ccb);
1109         break;
1110 
1111     case L2CAP_FCR_SUP_SREJ:
1112         p_fcrb->remote_busy = FALSE;
1113         all_ok = retransmit_i_frames (p_ccb, (UINT8)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
1114         break;
1115     }
1116 
1117     if (all_ok)
1118     {
1119         /* If polled, we need to respond with F-bit. Note, we may have sent a I-frame with the F-bit */
1120         if (p_fcrb->send_f_rsp)
1121         {
1122             if (p_fcrb->srej_sent)
1123                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
1124             else if (p_fcrb->local_busy)
1125                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
1126             else
1127                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
1128 
1129             p_fcrb->send_f_rsp = FALSE;
1130         }
1131     }
1132     else
1133     {
1134         L2CAP_TRACE_DEBUG ("process_s_frame hit_max_retries");
1135     }
1136 
1137     osi_free(p_buf);
1138 }
1139 
1140 
1141 /*******************************************************************************
1142 **
1143 ** Function         process_i_frame
1144 **
1145 ** Description      Process an I frame
1146 **
1147 ** Returns          -
1148 **
1149 *******************************************************************************/
process_i_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,UINT16 ctrl_word,BOOLEAN delay_ack)1150 static void process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack)
1151 {
1152     assert(p_ccb != NULL);
1153     assert(p_buf != NULL);
1154 
1155     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
1156     UINT8       tx_seq, num_lost, num_to_ack, next_srej;
1157 
1158     /* If we were doing checkpoint recovery, first retransmit all unacked I-frames */
1159     if (ctrl_word & L2CAP_FCR_F_BIT)
1160     {
1161         if (!retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS))
1162         {
1163             osi_free(p_buf);
1164             return;
1165         }
1166     }
1167 
1168 #if (L2CAP_ERTM_STATS == TRUE)
1169     p_ccb->fcrb.ertm_pkt_counts[1]++;
1170     p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
1171 #endif
1172 
1173     /* Extract the sequence number */
1174     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1175 
1176     /* If we have flow controlled the peer, ignore any bad I-frames from him */
1177     if ( (tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy) )
1178     {
1179         L2CAP_TRACE_WARNING ("Dropping bad I-Frame since we flowed off, tx_seq:%u", tx_seq);
1180         l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
1181         osi_free(p_buf);
1182         return;
1183     }
1184 
1185     /* Check if tx-sequence is the expected one */
1186     if (tx_seq != p_fcrb->next_seq_expected)
1187     {
1188         num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
1189 
1190         /* Is the frame a duplicate ? If so, just drop it */
1191         if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz)
1192         {
1193             /* Duplicate - simply drop it */
1194             L2CAP_TRACE_WARNING ("process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq %u", tx_seq, p_fcrb->next_seq_expected);
1195             osi_free(p_buf);
1196         }
1197         else
1198         {
1199             L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej: %u",
1200                                  p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent, p_fcrb->srej_sent);
1201 
1202             if (p_fcrb->srej_sent)
1203             {
1204                 /* If SREJ sent, save the frame for later processing as long as it is in sequence */
1205                 next_srej = (((BT_HDR *)fixed_queue_try_peek_last(p_fcrb->srej_rcv_hold_q))->layer_specific + 1) & L2CAP_FCR_SEQ_MODULO;
1206 
1207                 if ( (tx_seq == next_srej) && (fixed_queue_length(p_fcrb->srej_rcv_hold_q) < p_ccb->our_cfg.fcr.tx_win_sz) )
1208                 {
1209                     /* If user gave us a pool for held rx buffers, use that */
1210                     /* TODO: Could that happen? Get rid of this code. */
1211                     if (p_ccb->ertm_info.fcr_rx_buf_size != L2CAP_FCR_RX_BUF_SIZE)
1212                     {
1213                         BT_HDR *p_buf2;
1214 
1215                         /* Adjust offset and len so that control word is copied */
1216                         p_buf->offset -= L2CAP_FCR_OVERHEAD;
1217                         p_buf->len    += L2CAP_FCR_OVERHEAD;
1218 
1219                         p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
1220 
1221                         if (p_buf2)
1222                         {
1223                             osi_free(p_buf);
1224                             p_buf = p_buf2;
1225                         }
1226                         p_buf->offset += L2CAP_FCR_OVERHEAD;
1227                         p_buf->len -= L2CAP_FCR_OVERHEAD;
1228                     }
1229                     L2CAP_TRACE_DEBUG ("process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej1",
1230                                          num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
1231 
1232                     p_buf->layer_specific = tx_seq;
1233                     fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
1234                 }
1235                 else
1236                 {
1237                     L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  frame dropped in Srej Sent next_srej:%u  hold_q.count:%u  win_sz:%u",
1238                                          p_ccb->local_cid, next_srej, fixed_queue_length(p_fcrb->srej_rcv_hold_q), p_ccb->our_cfg.fcr.tx_win_sz);
1239 
1240                     p_fcrb->rej_after_srej = TRUE;
1241                     osi_free(p_buf);
1242                 }
1243             }
1244             else if (p_fcrb->rej_sent)
1245             {
1246                 L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: 1  SRej: %u",
1247                                      p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->srej_sent);
1248 
1249                 /* If REJ sent, just drop the frame */
1250                 osi_free(p_buf);
1251             }
1252             else
1253             {
1254                 L2CAP_TRACE_DEBUG ("process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
1255                                      p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
1256 
1257                 /* If only one lost, we will send SREJ, otherwise we will send REJ */
1258                 if (num_lost > 1)
1259                 {
1260                     osi_free(p_buf);
1261                     p_fcrb->rej_sent = TRUE;
1262                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
1263                 }
1264                 else
1265                 {
1266                     if (!fixed_queue_is_empty(p_fcrb->srej_rcv_hold_q))
1267                     {
1268                         L2CAP_TRACE_ERROR ("process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d hold_q.count:%u",
1269                                              p_ccb->local_cid, tx_seq, fixed_queue_length(p_fcrb->srej_rcv_hold_q));
1270                     }
1271                     p_buf->layer_specific = tx_seq;
1272                     fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
1273                     p_fcrb->srej_sent = TRUE;
1274                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, 0);
1275                 }
1276                 alarm_cancel(p_ccb->fcrb.ack_timer);
1277             }
1278         }
1279         return;
1280     }
1281 
1282     /* Seq number is the next expected. Clear possible reject exception in case it occured */
1283     p_fcrb->rej_sent = p_fcrb->srej_sent = FALSE;
1284 
1285     /* Adjust the next_seq, so that if the upper layer sends more data in the callback
1286        context, the received frame is acked by an I-frame. */
1287     p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
1288 
1289     /* If any SAR problem in eRTM mode, spec says disconnect. */
1290     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
1291     {
1292         L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  reassembly failed", p_ccb->local_cid);
1293         l2cu_disconnect_chnl (p_ccb);
1294         return;
1295     }
1296 
1297     /* RR optimization - if peer can still send us more, then start an ACK timer */
1298     num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) & L2CAP_FCR_SEQ_MODULO;
1299 
1300     if ( (num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy) )
1301         delay_ack = TRUE;
1302 
1303     /* We should neve never ack frame if we are not in OPEN state */
1304     if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
1305     {
1306         /* If no frames are awaiting transmission or are held, send an RR or RNR S-frame for ack */
1307         if (delay_ack)
1308         {
1309             /* If it is the first I frame we did not ack, start ack timer */
1310             if (!alarm_is_scheduled(p_ccb->fcrb.ack_timer)) {
1311                 alarm_set_on_queue(p_ccb->fcrb.ack_timer,
1312                                    L2CAP_FCR_ACK_TIMEOUT_MS,
1313                                    l2c_fcrb_ack_timer_timeout, p_ccb,
1314                                    btu_general_alarm_queue);
1315             }
1316         }
1317         else if ((fixed_queue_is_empty(p_ccb->xmit_hold_q) ||
1318                   l2c_fcr_is_flow_controlled(p_ccb))
1319                  && fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q))
1320         {
1321             if (p_fcrb->local_busy)
1322                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
1323             else
1324                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
1325         }
1326     }
1327 }
1328 
1329 
1330 /*******************************************************************************
1331 **
1332 ** Function         process_stream_frame
1333 **
1334 ** Description      This function processes frames in streaming mode
1335 **
1336 ** Returns          -
1337 **
1338 *******************************************************************************/
process_stream_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf)1339 static void process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf)
1340 {
1341     assert(p_ccb != NULL);
1342     assert(p_buf != NULL);
1343 
1344     UINT16      ctrl_word;
1345     UINT16      fcs;
1346     UINT8       *p;
1347     UINT8       tx_seq;
1348 
1349     /* Verify FCS if using */
1350     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
1351     {
1352         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
1353 
1354         /* Extract and drop the FCS from the packet */
1355         STREAM_TO_UINT16 (fcs, p);
1356         p_buf->len -= L2CAP_FCS_LEN;
1357 
1358         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
1359         {
1360             L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
1361             osi_free(p_buf);
1362             return;
1363         }
1364     }
1365 
1366     /* Get the control word */
1367     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
1368 
1369     STREAM_TO_UINT16 (ctrl_word, p);
1370 
1371     p_buf->len    -= L2CAP_FCR_OVERHEAD;
1372     p_buf->offset += L2CAP_FCR_OVERHEAD;
1373 
1374     /* Make sure it is an I-frame */
1375     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
1376     {
1377         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: 0x%04x", p_ccb->local_cid, ctrl_word);
1378         osi_free(p_buf);
1379         return;
1380     }
1381 
1382 #if BT_TRACE_VERBOSE == TRUE
1383     L2CAP_TRACE_EVENT ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
1384                         p_ccb->local_cid, p_buf->len,
1385                         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
1386                         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
1387                         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
1388                         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
1389 #endif
1390 
1391     /* Extract the sequence number */
1392     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1393 
1394     /* Check if tx-sequence is the expected one */
1395     if (tx_seq != p_ccb->fcrb.next_seq_expected)
1396     {
1397         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: 0x%08x",
1398                                 p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq, p_ccb->fcrb.p_rx_sdu);
1399 
1400         /* Lost one or more packets, so flush the SAR queue */
1401         osi_free_and_reset((void **)&p_ccb->fcrb.p_rx_sdu);
1402     }
1403 
1404     p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
1405 
1406     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
1407     {
1408         /* Some sort of SAR error, so flush the SAR queue */
1409         osi_free_and_reset((void **)&p_ccb->fcrb.p_rx_sdu);
1410     }
1411 }
1412 
1413 
1414 /*******************************************************************************
1415 **
1416 ** Function         do_sar_reassembly
1417 **
1418 ** Description      Process SAR bits and re-assemble frame
1419 **
1420 ** Returns          TRUE if all OK, else FALSE
1421 **
1422 *******************************************************************************/
do_sar_reassembly(tL2C_CCB * p_ccb,BT_HDR * p_buf,UINT16 ctrl_word)1423 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
1424 {
1425     assert(p_ccb != NULL);
1426     assert(p_buf != NULL);
1427 
1428     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
1429     UINT16      sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
1430     BOOLEAN     packet_ok = TRUE;
1431     UINT8       *p;
1432 
1433     /* Check if the SAR state is correct */
1434     if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU))
1435     {
1436         if (p_fcrb->p_rx_sdu != NULL)
1437         {
1438             L2CAP_TRACE_WARNING ("SAR - got unexpected unsegmented or start SDU  Expected len: %u  Got so far: %u",
1439                                   p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
1440 
1441             packet_ok = FALSE;
1442         }
1443         /* Check the length of the packet */
1444         if ( (sar_type == L2CAP_FCR_START_SDU) && (p_buf->len < L2CAP_SDU_LEN_OVERHEAD) )
1445         {
1446             L2CAP_TRACE_WARNING ("SAR start packet too short: %u", p_buf->len);
1447             packet_ok = FALSE;
1448         }
1449     }
1450     else
1451     {
1452         if (p_fcrb->p_rx_sdu == NULL)
1453         {
1454             L2CAP_TRACE_WARNING ("SAR - got unexpected cont or end SDU");
1455             packet_ok = FALSE;
1456         }
1457     }
1458 
1459     if ( (packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU) )
1460     {
1461         p = ((UINT8 *)(p_buf + 1)) + p_buf->offset;
1462 
1463         /* For start SDU packet, extract the SDU length */
1464         if (sar_type == L2CAP_FCR_START_SDU)
1465         {
1466             /* Get the SDU length */
1467             STREAM_TO_UINT16 (p_fcrb->rx_sdu_len, p);
1468             p_buf->offset += 2;
1469             p_buf->len    -= 2;
1470 
1471             if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu)
1472             {
1473                 L2CAP_TRACE_WARNING ("SAR - SDU len: %u  larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
1474                 packet_ok = FALSE;
1475             } else {
1476                 p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE);
1477                 p_fcrb->p_rx_sdu->offset = OBX_BUF_MIN_OFFSET;
1478                 p_fcrb->p_rx_sdu->len = 0;
1479             }
1480         }
1481 
1482         if (packet_ok)
1483         {
1484             if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len)
1485             {
1486                 L2CAP_TRACE_ERROR ("SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u",
1487                                     sar_type, p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
1488                 packet_ok = FALSE;
1489             }
1490             else if ( (sar_type == L2CAP_FCR_END_SDU) && ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len) )
1491             {
1492                 L2CAP_TRACE_WARNING ("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
1493                                       p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
1494                 packet_ok = FALSE;
1495             }
1496             else
1497             {
1498                 memcpy (((UINT8 *) (p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset + p_fcrb->p_rx_sdu->len, p, p_buf->len);
1499 
1500                 p_fcrb->p_rx_sdu->len += p_buf->len;
1501 
1502                 osi_free(p_buf);
1503                 p_buf = NULL;
1504 
1505                 if (sar_type == L2CAP_FCR_END_SDU)
1506                 {
1507                     p_buf            = p_fcrb->p_rx_sdu;
1508                     p_fcrb->p_rx_sdu = NULL;
1509                 }
1510             }
1511         }
1512     }
1513 
1514     if (packet_ok == FALSE)
1515     {
1516         osi_free(p_buf);
1517     }
1518     else if (p_buf != NULL)
1519     {
1520 #if (L2CAP_NUM_FIXED_CHNLS > 0)
1521         if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
1522             (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL && p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL))
1523         {
1524             if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
1525                 (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
1526                     (p_ccb->local_cid, p_ccb->p_lcb->remote_bd_addr, p_buf);
1527         }
1528         else
1529 #endif
1530             l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
1531     }
1532 
1533     return (packet_ok);
1534 }
1535 
1536 
1537 /*******************************************************************************
1538 **
1539 ** Function         retransmit_i_frames
1540 **
1541 ** Description      This function retransmits i-frames awaiting acks.
1542 **
1543 ** Returns          BOOLEAN - TRUE if retransmitted
1544 **
1545 *******************************************************************************/
retransmit_i_frames(tL2C_CCB * p_ccb,UINT8 tx_seq)1546 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
1547 {
1548     assert(p_ccb != NULL);
1549 
1550     BT_HDR      *p_buf = NULL;
1551     UINT8       *p;
1552     UINT8       buf_seq;
1553     UINT16      ctrl_word;
1554 
1555     if ( (!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
1556      &&  (p_ccb->peer_cfg.fcr.max_transmit != 0)
1557      &&  (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit) )
1558     {
1559         L2CAP_TRACE_EVENT ("Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: %u) ack_q_count: %u",
1560                 p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
1561                 fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
1562 
1563         l2cu_disconnect_chnl (p_ccb);
1564         return (FALSE);
1565     }
1566 
1567     /* tx_seq indicates whether to retransmit a specific sequence or all (if == L2C_FCR_RETX_ALL_PKTS) */
1568     list_t *list_ack = NULL;
1569     const list_node_t *node_ack = NULL;
1570     if (! fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q)) {
1571         list_ack = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
1572         node_ack = list_begin(list_ack);
1573     }
1574     if (tx_seq != L2C_FCR_RETX_ALL_PKTS)
1575     {
1576         /* If sending only one, the sequence number tells us which one. Look for it.
1577         */
1578         if (list_ack != NULL) {
1579             for ( ; node_ack != list_end(list_ack); node_ack = list_next(node_ack)) {
1580                 p_buf = (BT_HDR *)list_node(node_ack);
1581                 /* Get the old control word */
1582                 p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
1583 
1584                 STREAM_TO_UINT16 (ctrl_word, p);
1585 
1586                 buf_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1587 
1588                 L2CAP_TRACE_DEBUG ("retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq, tx_seq);
1589 
1590                 if (tx_seq == buf_seq)
1591                     break;
1592             }
1593         }
1594 
1595         if (!p_buf)
1596         {
1597             L2CAP_TRACE_ERROR ("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u",
1598                                tx_seq,
1599                                fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
1600             return (TRUE);
1601         }
1602     }
1603     else
1604     {
1605         // Iterate though list and flush the amount requested from
1606         // the transmit data queue that satisfy the layer and event conditions.
1607         for (list_node_t *node_tmp = list_begin(p_ccb->p_lcb->link_xmit_data_q);
1608             node_tmp != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
1609           BT_HDR *p_tmp = (BT_HDR *)list_node(node_tmp);
1610           node_tmp = list_next(node_tmp);
1611 
1612             /* Do not flush other CIDs or partial segments */
1613           if ((p_tmp->layer_specific == 0) && (p_tmp->event == p_ccb->local_cid)) {
1614             list_remove(p_ccb->p_lcb->link_xmit_data_q, p_tmp);
1615             osi_free(p_tmp);
1616           }
1617         }
1618 
1619         /* Also flush our retransmission queue */
1620         while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q))
1621             osi_free(fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q));
1622 
1623         if (list_ack != NULL)
1624             node_ack = list_begin(list_ack);
1625     }
1626 
1627     if (list_ack != NULL) {
1628         while (node_ack != list_end(list_ack))
1629         {
1630             p_buf = (BT_HDR *)list_node(node_ack);
1631             node_ack = list_next(node_ack);
1632 
1633             BT_HDR *p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
1634             if (p_buf2)
1635             {
1636                 p_buf2->layer_specific = p_buf->layer_specific;
1637 
1638                 fixed_queue_enqueue(p_ccb->fcrb.retrans_q, p_buf2);
1639             }
1640 
1641             if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) )
1642                 break;
1643         }
1644     }
1645 
1646     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
1647 
1648     if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q))
1649     {
1650         p_ccb->fcrb.num_tries++;
1651         l2c_fcr_start_timer (p_ccb);
1652     }
1653 
1654     return (TRUE);
1655 }
1656 
1657 
1658 /*******************************************************************************
1659 **
1660 ** Function         l2c_fcr_get_next_xmit_sdu_seg
1661 **
1662 ** Description      Get the next SDU segment to transmit.
1663 **
1664 ** Returns          pointer to buffer with segment or NULL
1665 **
1666 *******************************************************************************/
l2c_fcr_get_next_xmit_sdu_seg(tL2C_CCB * p_ccb,UINT16 max_packet_length)1667 BT_HDR *l2c_fcr_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
1668 {
1669     assert(p_ccb != NULL);
1670 
1671     BOOLEAN     first_seg    = FALSE,       /* The segment is the first part of data  */
1672                 mid_seg      = FALSE,       /* The segment is the middle part of data */
1673                 last_seg     = FALSE;       /* The segment is the last part of data   */
1674     UINT16      sdu_len = 0;
1675     BT_HDR      *p_buf, *p_xmit;
1676     UINT8       *p;
1677     UINT16      max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
1678 
1679     /* If there is anything in the retransmit queue, that goes first
1680     */
1681     p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q);
1682     if (p_buf != NULL)
1683     {
1684         /* Update Rx Seq and FCS if we acked some packets while this one was queued */
1685         prepare_I_frame (p_ccb, p_buf, TRUE);
1686 
1687         p_buf->event = p_ccb->local_cid;
1688 
1689 #if (L2CAP_ERTM_STATS == TRUE)
1690         p_ccb->fcrb.pkts_retransmitted++;
1691         p_ccb->fcrb.ertm_pkt_counts[0]++;
1692         p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
1693 #endif
1694         return (p_buf);
1695     }
1696 
1697     /* For BD/EDR controller, max_packet_length is set to 0             */
1698     /* For AMP controller, max_packet_length is set by available blocks */
1699     if ( (max_packet_length > L2CAP_MAX_HEADER_FCS)
1700       && (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length) )
1701     {
1702         max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
1703     }
1704 
1705     p_buf = (BT_HDR *)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
1706 
1707     /* If there is more data than the MPS, it requires segmentation */
1708     if (p_buf->len > max_pdu)
1709     {
1710         /* We are using the "event" field to tell is if we already started segmentation */
1711         if (p_buf->event == 0)
1712         {
1713             first_seg = TRUE;
1714             sdu_len   = p_buf->len;
1715         }
1716         else
1717             mid_seg = TRUE;
1718 
1719         /* Get a new buffer and copy the data that can be sent in a PDU */
1720         p_xmit = l2c_fcr_clone_buf(p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
1721                                    max_pdu);
1722 
1723         if (p_xmit != NULL)
1724         {
1725             p_buf->event  = p_ccb->local_cid;
1726             p_xmit->event = p_ccb->local_cid;
1727 
1728             p_buf->len    -= max_pdu;
1729             p_buf->offset += max_pdu;
1730 
1731             /* copy PBF setting */
1732             p_xmit->layer_specific = p_buf->layer_specific;
1733         }
1734         else /* Should never happen if the application has configured buffers correctly */
1735         {
1736             L2CAP_TRACE_ERROR ("L2CAP - cannot get buffer for segmentation, max_pdu: %u", max_pdu);
1737             return (NULL);
1738         }
1739     }
1740     else    /* Use the original buffer if no segmentation, or the last segment */
1741     {
1742         p_xmit = (BT_HDR *)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
1743 
1744         if (p_xmit->event != 0)
1745             last_seg = TRUE;
1746 
1747         p_xmit->event = p_ccb->local_cid;
1748     }
1749 
1750     /* Step back to add the L2CAP headers */
1751     p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
1752     p_xmit->len    += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
1753 
1754     if (first_seg)
1755     {
1756         p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
1757         p_xmit->len    += L2CAP_SDU_LEN_OVERHEAD;
1758     }
1759 
1760     /* Set the pointer to the beginning of the data */
1761     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
1762 
1763     /* Now the L2CAP header */
1764 
1765     /* Note: if FCS has to be included then the length is recalculated later */
1766     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
1767 
1768     UINT16_TO_STREAM (p, p_ccb->remote_cid);
1769 
1770     if (first_seg)
1771     {
1772         /* Skip control word and add SDU length */
1773         p += 2;
1774         UINT16_TO_STREAM (p, sdu_len);
1775 
1776         /* We will store the SAR type in layer-specific */
1777         /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
1778         p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
1779 
1780         first_seg = FALSE;
1781     }
1782     else if (mid_seg)
1783         p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
1784     else if (last_seg)
1785         p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
1786     else
1787         p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
1788 
1789     prepare_I_frame (p_ccb, p_xmit, FALSE);
1790 
1791     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
1792     {
1793         BT_HDR *p_wack = l2c_fcr_clone_buf(p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len);
1794 
1795         if (!p_wack)
1796         {
1797             L2CAP_TRACE_ERROR("L2CAP - no buffer for xmit cloning, CID: 0x%04x  Length: %u",
1798                               p_ccb->local_cid, p_xmit->len);
1799 
1800             /* We will not save the FCS in case we reconfigure and change options */
1801             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
1802                 p_xmit->len -= L2CAP_FCS_LEN;
1803 
1804             /* Pretend we sent it and it got lost */
1805             fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_xmit);
1806             return (NULL);
1807         }
1808         else
1809         {
1810 #if (L2CAP_ERTM_STATS == TRUE)
1811             /* set timestamp at the end of tx I-frame to get acking delay */
1812             /*
1813              * NOTE: Here we assume the allocate buffer is large enough
1814              * to include extra 4 octets at the end.
1815              */
1816             p = ((UINT8 *) (p_wack+1)) + p_wack->offset + p_wack->len;
1817             UINT32_TO_STREAM (p, time_get_os_boottime_ms());
1818 #endif
1819             /* We will not save the FCS in case we reconfigure and change options */
1820             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
1821                 p_wack->len -= L2CAP_FCS_LEN;
1822 
1823             p_wack->layer_specific = p_xmit->layer_specific;
1824             fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_wack);
1825         }
1826 
1827 #if (L2CAP_ERTM_STATS == TRUE)
1828         p_ccb->fcrb.ertm_pkt_counts[0]++;
1829         p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
1830 #endif
1831 
1832     }
1833 
1834     return (p_xmit);
1835 }
1836 
1837 /*******************************************************************************
1838 **
1839 ** Function         l2c_lcc_get_next_xmit_sdu_seg
1840 **
1841 ** Description      Get the next SDU segment to transmit for LE connection oriented channel
1842 **
1843 ** Returns          pointer to buffer with segment or NULL
1844 **
1845 *******************************************************************************/
l2c_lcc_get_next_xmit_sdu_seg(tL2C_CCB * p_ccb,UINT16 max_packet_length)1846 BT_HDR *l2c_lcc_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
1847 {
1848     BOOLEAN     first_seg    = FALSE;       /* The segment is the first part of data  */
1849     BOOLEAN     last_seg     = FALSE;       /* The segment is the last part of data  */
1850     UINT16      no_of_bytes_to_send = 0;
1851     UINT16      sdu_len = 0;
1852     BT_HDR      *p_buf, *p_xmit;
1853     UINT8       *p;
1854     UINT16      max_pdu = p_ccb->peer_conn_cfg.mps;
1855 
1856     p_buf = (BT_HDR *)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
1857 
1858     /* We are using the "event" field to tell is if we already started segmentation */
1859     if (p_buf->event == 0)
1860     {
1861         first_seg = TRUE;
1862         sdu_len   = p_buf->len;
1863         if (p_buf->len <= (max_pdu - L2CAP_LCC_SDU_LENGTH))
1864         {
1865             last_seg = TRUE;
1866             no_of_bytes_to_send = p_buf->len;
1867         }
1868         else
1869             no_of_bytes_to_send = max_pdu - L2CAP_LCC_SDU_LENGTH;
1870     }
1871     else if (p_buf->len <= max_pdu)
1872     {
1873         last_seg = TRUE;
1874         no_of_bytes_to_send = p_buf->len;
1875     }
1876     else
1877     {
1878         /* Middle Packet */
1879         no_of_bytes_to_send = max_pdu;
1880     }
1881 
1882     /* Get a new buffer and copy the data that can be sent in a PDU */
1883     if (first_seg == TRUE)
1884         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_LCC_OFFSET,
1885                     no_of_bytes_to_send);
1886     else
1887         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_MIN_OFFSET,
1888                    no_of_bytes_to_send);
1889 
1890     if (p_xmit != NULL)
1891     {
1892         p_buf->event  = p_ccb->local_cid;
1893         p_xmit->event = p_ccb->local_cid;
1894 
1895         if (first_seg == TRUE)
1896         {
1897             p_xmit->offset -= L2CAP_LCC_SDU_LENGTH;  /* for writing the SDU length. */
1898             p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
1899             UINT16_TO_STREAM(p, sdu_len);
1900             p_xmit->len += L2CAP_LCC_SDU_LENGTH;
1901         }
1902 
1903         p_buf->len    -= no_of_bytes_to_send;
1904         p_buf->offset += no_of_bytes_to_send;
1905 
1906         /* copy PBF setting */
1907         p_xmit->layer_specific = p_buf->layer_specific;
1908 
1909     }
1910     else /* Should never happen if the application has configured buffers correctly */
1911     {
1912         L2CAP_TRACE_ERROR ("L2CAP - cannot get buffer, for segmentation");
1913         return (NULL);
1914     }
1915 
1916     if (last_seg == TRUE)
1917     {
1918         p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
1919         osi_free(p_buf);
1920     }
1921 
1922     /* Step back to add the L2CAP headers */
1923     p_xmit->offset -= L2CAP_PKT_OVERHEAD;
1924     p_xmit->len    += L2CAP_PKT_OVERHEAD ;
1925 
1926     /* Set the pointer to the beginning of the data */
1927     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
1928 
1929     /* Note: if FCS has to be included then the length is recalculated later */
1930     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
1931     UINT16_TO_STREAM (p, p_ccb->remote_cid);
1932     return (p_xmit);
1933 
1934 }
1935 
1936 /*******************************************************************************
1937 ** Configuration negotiation functions
1938 **
1939 ** The following functions are used in negotiating channel modes during
1940 ** configuration
1941 ********************************************************************************/
1942 
1943 /*******************************************************************************
1944 **
1945 ** Function         l2c_fcr_chk_chan_modes
1946 **
1947 ** Description      Validates and adjusts if necessary, the FCR options
1948 **                  based on remote EXT features.
1949 **
1950 **                  Note: This assumes peer EXT Features have been received.
1951 **                      Basic mode is used if FCR Options have not been received
1952 **
1953 ** Returns          UINT8 - nonzero if can continue, '0' if no compatible channels
1954 **
1955 *******************************************************************************/
l2c_fcr_chk_chan_modes(tL2C_CCB * p_ccb)1956 UINT8 l2c_fcr_chk_chan_modes (tL2C_CCB *p_ccb)
1957 {
1958     assert(p_ccb != NULL);
1959 
1960     /* Remove nonbasic options that the peer does not support */
1961     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
1962         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
1963 
1964     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
1965         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
1966 
1967     /* At least one type needs to be set (Basic, ERTM, STM) to continue */
1968     if (!p_ccb->ertm_info.allowed_modes)
1969     {
1970         L2CAP_TRACE_WARNING ("L2CAP - Peer does not support our desired channel types");
1971     }
1972 
1973     return (p_ccb->ertm_info.allowed_modes);
1974 }
1975 
1976 /*******************************************************************************
1977 **
1978 ** Function         l2c_fcr_adj_our_req_options
1979 **
1980 ** Description      Validates and sets up the FCR options passed in from
1981 **                  L2CA_ConfigReq based on remote device's features.
1982 **
1983 ** Returns          TRUE if no errors, Otherwise FALSE
1984 **
1985 *******************************************************************************/
l2c_fcr_adj_our_req_options(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)1986 BOOLEAN l2c_fcr_adj_our_req_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
1987 {
1988     assert(p_ccb != NULL);
1989     assert(p_cfg != NULL);
1990 
1991     tL2CAP_FCR_OPTS *p_fcr = &p_cfg->fcr;
1992 
1993     if (p_fcr->mode != p_ccb->ertm_info.preferred_mode)
1994     {
1995         L2CAP_TRACE_WARNING ("l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match mode (%d)",
1996                             p_ccb->ertm_info.preferred_mode, p_fcr->mode);
1997 
1998         /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override this one */
1999         p_fcr->mode = p_ccb->ertm_info.preferred_mode;
2000     }
2001 
2002     /* If upper layer did not request eRTM mode, BASIC must be used */
2003     if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
2004     {
2005         if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE)
2006         {
2007             L2CAP_TRACE_WARNING ("l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set using BASIC mode", p_fcr->mode);
2008         }
2009         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
2010     }
2011 
2012     /* Process the FCR options if initial channel bring-up (not a reconfig request)
2013     ** Determine initial channel mode to try based on our options and remote's features
2014     */
2015     if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG))
2016     {
2017         /* We need to have at least one mode type common with the peer */
2018         if (!l2c_fcr_chk_chan_modes(p_ccb))
2019         {
2020             /* Two channels have incompatible supported types */
2021             l2cu_disconnect_chnl (p_ccb);
2022             return (FALSE);
2023         }
2024 
2025         /* Basic is the only common channel mode between the two devices */
2026         else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
2027         {
2028             /* We only want to try Basic, so bypass sending the FCR options entirely */
2029             p_cfg->fcr_present = FALSE;
2030             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
2031             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
2032         }
2033 
2034         /* We have at least one non-basic mode available
2035          * Override mode from available mode options based on preference, if needed
2036          */
2037         else
2038         {
2039             /* If peer does not support STREAMING, try ERTM */
2040             if (p_fcr->mode == L2CAP_FCR_STREAM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM))
2041             {
2042                 L2CAP_TRACE_DEBUG ("L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
2043                 p_fcr->mode = L2CAP_FCR_ERTM_MODE;
2044             }
2045 
2046             /* If peer does not support ERTM, try BASIC (will support this if made it here in the code) */
2047             if (p_fcr->mode == L2CAP_FCR_ERTM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM))
2048             {
2049                 L2CAP_TRACE_DEBUG ("L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
2050                 p_fcr->mode = L2CAP_FCR_BASIC_MODE;
2051             }
2052         }
2053 
2054         if (p_fcr->mode != L2CAP_FCR_BASIC_MODE)
2055         {
2056             /* MTU must be smaller than buffer size */
2057             if ( (p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu) )
2058             {
2059                 L2CAP_TRACE_WARNING ("L2CAP - MTU: %u  larger than buf size: %u", p_cfg->mtu, p_ccb->max_rx_mtu);
2060                 return (FALSE);
2061             }
2062 
2063             /* application want to use the default MPS */
2064             if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS)
2065             {
2066                 p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
2067             }
2068             /* MPS must be less than MTU */
2069             else if (p_fcr->mps > p_ccb->max_rx_mtu)
2070             {
2071                 L2CAP_TRACE_WARNING ("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps, p_ccb->max_rx_mtu);
2072                 return (FALSE);
2073             }
2074 
2075             /* We always initially read into the HCI buffer pool, so make sure it fits */
2076             if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
2077                 p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
2078         }
2079         else
2080         {
2081             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
2082             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
2083         }
2084 
2085         p_ccb->our_cfg.fcr = *p_fcr;
2086     }
2087     else    /* Not sure how to send a reconfiguration(??) should fcr be included? */
2088     {
2089         p_ccb->our_cfg.fcr_present = FALSE;
2090     }
2091 
2092     return (TRUE);
2093 }
2094 
2095 
2096 /*******************************************************************************
2097 **
2098 ** Function         l2c_fcr_adj_monitor_retran_timeout
2099 **
2100 ** Description      Overrides monitor/retrans timer value based on controller
2101 **
2102 ** Returns          None
2103 **
2104 *******************************************************************************/
l2c_fcr_adj_monitor_retran_timeout(tL2C_CCB * p_ccb)2105 void l2c_fcr_adj_monitor_retran_timeout (tL2C_CCB *p_ccb)
2106 {
2107     assert(p_ccb != NULL);
2108 
2109     /* adjust our monitor/retran timeout */
2110     if (p_ccb->out_cfg_fcr_present)
2111     {
2112         /*
2113         ** if we requestd ERTM or accepted ERTM
2114         ** We may accept ERTM even if we didn't request ERTM, in case of requesting STREAM
2115         */
2116         if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
2117           ||(p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE))
2118         {
2119             /* upper layer setting is ignored */
2120             p_ccb->our_cfg.fcr.mon_tout    = L2CAP_MIN_MONITOR_TOUT;
2121             p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
2122         }
2123         else
2124         {
2125             p_ccb->our_cfg.fcr.mon_tout    = 0;
2126             p_ccb->our_cfg.fcr.rtrans_tout = 0;
2127         }
2128 
2129         L2CAP_TRACE_DEBUG ("l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
2130                              p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
2131     }
2132 }
2133 /*******************************************************************************
2134 **
2135 ** Function         l2c_fcr_adj_our_rsp_options
2136 **
2137 ** Description      Overrides any neccesary FCR options passed in from
2138 **                  L2CA_ConfigRsp based on our FCR options.
2139 **                  Only makes adjustments if channel is in ERTM mode.
2140 **
2141 ** Returns          None
2142 **
2143 *******************************************************************************/
l2c_fcr_adj_our_rsp_options(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2144 void l2c_fcr_adj_our_rsp_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
2145 {
2146     assert(p_ccb != NULL);
2147     assert(p_cfg != NULL);
2148 
2149     /* adjust our monitor/retran timeout */
2150     l2c_fcr_adj_monitor_retran_timeout(p_ccb);
2151 
2152     p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
2153 
2154     if (p_cfg->fcr_present)
2155     {
2156         /* Temporary - until a better algorithm is implemented */
2157         /* If peer's tx_wnd_sz requires too many buffers for us to support, then adjust it. For now, respond with our own tx_wnd_sz. */
2158         /* Note: peer is not guaranteed to obey our adjustment */
2159         if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz)
2160         {
2161             L2CAP_TRACE_DEBUG ("%s: adjusting requested tx_win_sz from %i to %i", __FUNCTION__, p_ccb->peer_cfg.fcr.tx_win_sz, p_ccb->our_cfg.fcr.tx_win_sz);
2162             p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
2163         }
2164 
2165         p_cfg->fcr.mode         = p_ccb->peer_cfg.fcr.mode;
2166         p_cfg->fcr.tx_win_sz    = p_ccb->peer_cfg.fcr.tx_win_sz;
2167         p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
2168         p_cfg->fcr.mps          = p_ccb->peer_cfg.fcr.mps;
2169         p_cfg->fcr.rtrans_tout  = p_ccb->our_cfg.fcr.rtrans_tout;
2170         p_cfg->fcr.mon_tout     = p_ccb->our_cfg.fcr.mon_tout;
2171     }
2172 }
2173 
2174 /*******************************************************************************
2175 **
2176 ** Function         l2c_fcr_renegotiate_chan
2177 **
2178 ** Description      Called upon unsuccessful peer response to config request.
2179 **                  If the error is because of the channel mode, it will try
2180 **                  to resend using another supported optional channel.
2181 **
2182 ** Returns          TRUE if resent configuration, False if channel matches or
2183 **                  cannot match.
2184 **
2185 *******************************************************************************/
l2c_fcr_renegotiate_chan(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2186 BOOLEAN l2c_fcr_renegotiate_chan(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
2187 {
2188     assert(p_ccb != NULL);
2189     assert(p_cfg != NULL);
2190 
2191     UINT8   peer_mode = p_ccb->our_cfg.fcr.mode;
2192     BOOLEAN can_renegotiate;
2193 
2194     /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned */
2195     if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
2196         return (FALSE);
2197 
2198     /* Only retry if there are more channel options to try */
2199     if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS)
2200     {
2201         peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
2202 
2203         if (p_ccb->our_cfg.fcr.mode != peer_mode)
2204         {
2205 
2206             if ((--p_ccb->fcr_cfg_tries) == 0)
2207             {
2208                 p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
2209                 L2CAP_TRACE_WARNING ("l2c_fcr_renegotiate_chan (Max retries exceeded)");
2210             }
2211 
2212             can_renegotiate = FALSE;
2213 
2214             /* Try another supported mode if available based on our last attempted channel */
2215             switch (p_ccb->our_cfg.fcr.mode)
2216             {
2217                 /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
2218             case L2CAP_FCR_STREAM_MODE:
2219                 /* Peer wants ERTM and we support it */
2220                 if ( (peer_mode == L2CAP_FCR_ERTM_MODE) && (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
2221                 {
2222                     L2CAP_TRACE_DEBUG ("l2c_fcr_renegotiate_chan(Trying ERTM)");
2223                     p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
2224                     can_renegotiate = TRUE;
2225                 }
2226                 else    /* Falls through */
2227 
2228             case L2CAP_FCR_ERTM_MODE:
2229                 {
2230                     /* We can try basic for any other peer mode if we support it */
2231                     if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC)
2232                     {
2233                         L2CAP_TRACE_DEBUG ("l2c_fcr_renegotiate_chan(Trying Basic)");
2234                         can_renegotiate = TRUE;
2235                         p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
2236                     }
2237                 }
2238                 break;
2239 
2240             default:
2241                 /* All other scenarios cannot be renegotiated */
2242                 break;
2243             }
2244 
2245             if (can_renegotiate)
2246             {
2247                 p_ccb->our_cfg.fcr_present = TRUE;
2248 
2249                 if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
2250                 {
2251                     p_ccb->our_cfg.fcs_present = FALSE;
2252                     p_ccb->our_cfg.ext_flow_spec_present = FALSE;
2253 
2254                     /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
2255                     if ( (p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE) )
2256                     {
2257                         L2CAP_TRACE_WARNING ("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
2258                         p_cfg->mtu = L2CAP_MTU_SIZE;
2259                     }
2260                 }
2261 
2262                 l2cu_process_our_cfg_req (p_ccb, &p_ccb->our_cfg);
2263                 l2cu_send_peer_config_req (p_ccb, &p_ccb->our_cfg);
2264                 alarm_set_on_queue(p_ccb->l2c_ccb_timer,
2265                                    L2CAP_CHNL_CFG_TIMEOUT_MS,
2266                                    l2c_ccb_timer_timeout, p_ccb,
2267                                    btu_general_alarm_queue);
2268                 return (TRUE);
2269             }
2270         }
2271     }
2272 
2273     /* Disconnect if the channels do not match */
2274     if (p_ccb->our_cfg.fcr.mode != peer_mode)
2275     {
2276         L2CAP_TRACE_WARNING ("L2C CFG:  Channels incompatible (local %d, peer %d)",
2277                               p_ccb->our_cfg.fcr.mode, peer_mode);
2278         l2cu_disconnect_chnl (p_ccb);
2279     }
2280 
2281     return (FALSE);
2282 }
2283 
2284 
2285 /*******************************************************************************
2286 **
2287 ** Function         l2c_fcr_process_peer_cfg_req
2288 **
2289 ** Description      This function is called to process the FCR options passed
2290 **                  in the peer's configuration request.
2291 **
2292 ** Returns          UINT8 - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
2293 **                          or L2CAP_PEER_CFG_DISCONNECT.
2294 **
2295 *******************************************************************************/
l2c_fcr_process_peer_cfg_req(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2296 UINT8 l2c_fcr_process_peer_cfg_req(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
2297 {
2298     assert(p_ccb != NULL);
2299     assert(p_cfg != NULL);
2300 
2301     UINT16 max_retrans_size;
2302     UINT8  fcr_ok = L2CAP_PEER_CFG_OK;
2303 
2304     p_ccb->p_lcb->w4_info_rsp = FALSE;      /* Handles T61x SonyEricsson Bug in Info Request */
2305 
2306     L2CAP_TRACE_EVENT ("l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR mode:%d preferred: %u allowed:%u",
2307                         p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode, p_ccb->ertm_info.preferred_mode,
2308                         p_ccb->ertm_info.allowed_modes);
2309 
2310     /* If Peer wants basic, we are done (accept it or disconnect) */
2311     if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE)
2312     {
2313         /* If we do not allow basic, disconnect */
2314         if ( !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) )
2315             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2316     }
2317 
2318     /* Need to negotiate if our modes are not the same */
2319     else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode)
2320     {
2321         /* If peer wants a mode that we don't support then retry our mode (ex. rtx/flc), OR
2322         ** If we want ERTM and they wanted streaming retry our mode.
2323         ** Note: If we have already determined they support our mode previously
2324         **       from their EXF mask.
2325         */
2326         if ( (((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0)
2327             || (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE) )
2328         {
2329             p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
2330             p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
2331             p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
2332             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
2333         }
2334 
2335         /* If we wanted basic, then try to renegotiate it */
2336         else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE)
2337         {
2338             p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
2339             p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
2340             p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
2341             p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout = p_ccb->our_cfg.fcr.mps = 0;
2342             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
2343         }
2344 
2345         /* Only other valid case is if they want ERTM and we wanted STM which should be
2346            accepted if we support it; otherwise the channel should be disconnected */
2347         else if ( (p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE)
2348               || !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
2349         {
2350             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2351         }
2352     }
2353 
2354     /* Configuration for FCR channels so make any adjustments and fwd to upper layer */
2355     if (fcr_ok == L2CAP_PEER_CFG_OK)
2356     {
2357         /* by default don't need to send params in the response */
2358         p_ccb->out_cfg_fcr_present = FALSE;
2359 
2360         /* Make any needed adjustments for the response to the peer */
2361         if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE)
2362         {
2363             /* Peer desires to bypass FCS check, and streaming or ERTM mode */
2364             if (p_cfg->fcs_present)
2365             {
2366                 p_ccb->peer_cfg.fcs = p_cfg->fcs;
2367                 p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
2368                 if( p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
2369                     p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
2370             }
2371 
2372             max_retrans_size = p_ccb->ertm_info.fcr_tx_buf_size - sizeof(BT_HDR)
2373                                             - L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET - L2CAP_FCS_LEN;
2374 
2375             /* Ensure the MPS is not bigger than the MTU */
2376             if ( (p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu) )
2377             {
2378                 p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
2379                 p_ccb->out_cfg_fcr_present = TRUE;
2380             }
2381 
2382             /* Ensure the MPS is not bigger than our retransmission buffer */
2383             if (p_cfg->fcr.mps > max_retrans_size)
2384             {
2385                 L2CAP_TRACE_DEBUG("CFG: Overriding MPS to %d (orig %d)", max_retrans_size, p_cfg->fcr.mps);
2386 
2387                 p_cfg->fcr.mps = max_retrans_size;
2388                 p_ccb->out_cfg_fcr_present = TRUE;
2389             }
2390 
2391             if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE || p_cfg->fcr.mode == L2CAP_FCR_STREAM_MODE)
2392             {
2393                 /* Always respond with FCR ERTM parameters */
2394                 p_ccb->out_cfg_fcr_present = TRUE;
2395             }
2396         }
2397 
2398         /* Everything ok, so save the peer's adjusted fcr options */
2399         p_ccb->peer_cfg.fcr = p_cfg->fcr;
2400 
2401         if (p_cfg->fcr_present)
2402             p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
2403     }
2404     else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE)
2405     {
2406         /* Allow peer only one retry for mode */
2407         if (p_ccb->peer_cfg_already_rejected)
2408             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2409         else
2410             p_ccb->peer_cfg_already_rejected = TRUE;
2411     }
2412 
2413     return (fcr_ok);
2414 }
2415 
2416 #if (L2CAP_ERTM_STATS == TRUE)
2417 /*******************************************************************************
2418 **
2419 ** Function         l2c_fcr_collect_ack_delay
2420 **
2421 ** Description      collect throughput, delay, queue size of waiting ack
2422 **
2423 ** Parameters
2424 **                  tL2C_CCB
2425 **
2426 ** Returns          void
2427 **
2428 *******************************************************************************/
l2c_fcr_collect_ack_delay(tL2C_CCB * p_ccb,UINT8 num_bufs_acked)2429 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
2430 {
2431     UINT32  index;
2432     BT_HDR *p_buf;
2433     UINT8  *p;
2434     UINT32  timestamp, delay;
2435     UINT8   xx;
2436     UINT8   str[120];
2437 
2438     index = p_ccb->fcrb.ack_delay_avg_index;
2439 
2440     /* update sum, max and min of waiting for ack queue size */
2441     p_ccb->fcrb.ack_q_count_avg[index] +=
2442         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
2443 
2444     if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index])
2445         p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
2446 
2447     if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index])
2448         p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
2449 
2450     /* update sum, max and min of round trip delay of acking */
2451     list_t *list = NULL;
2452     if (! fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
2453         list = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
2454     if (list != NULL) {
2455         for (const list_node_t *node = list_begin(list), xx = 0;
2456              (node != list_end(list)) && (xx < num_bufs_acked);
2457              node = list_next(node), xx++) {
2458             p_buf = list_node(node);
2459             /* adding up length of acked I-frames to get throughput */
2460             p_ccb->fcrb.throughput[index] += p_buf->len - 8;
2461 
2462             if ( xx == num_bufs_acked - 1 )
2463             {
2464                 /* get timestamp from tx I-frame that receiver is acking */
2465                 p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
2466                 if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
2467                 {
2468                     p += L2CAP_FCS_LEN;
2469                 }
2470 
2471                 STREAM_TO_UINT32(timestamp, p);
2472                 delay = time_get_os_boottime_ms() - timestamp;
2473 
2474                 p_ccb->fcrb.ack_delay_avg[index] += delay;
2475                 if ( delay > p_ccb->fcrb.ack_delay_max[index] )
2476                     p_ccb->fcrb.ack_delay_max[index] = delay;
2477                 if ( delay < p_ccb->fcrb.ack_delay_min[index] )
2478                     p_ccb->fcrb.ack_delay_min[index] = delay;
2479             }
2480         }
2481     }
2482 
2483     p_ccb->fcrb.ack_delay_avg_count++;
2484 
2485     /* calculate average and initialize next avg, min and max */
2486     if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES)
2487     {
2488         p_ccb->fcrb.ack_delay_avg_count = 0;
2489 
2490         p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
2491         p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
2492 
2493         /* calculate throughput */
2494         timestamp = time_get_os_boottime_ms();
2495         if (timestamp - p_ccb->fcrb.throughput_start > 0)
2496             p_ccb->fcrb.throughput[index] /= (timestamp - p_ccb->fcrb.throughput_start);
2497 
2498         p_ccb->fcrb.throughput_start = timestamp;
2499 
2500         sprintf(str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
2501                 index, p_ccb->fcrb.throughput[index],
2502                 p_ccb->fcrb.ack_delay_avg[index], p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
2503                 p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index], p_ccb->fcrb.ack_q_count_max[index] );
2504 
2505         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", str);
2506 
2507         index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
2508         p_ccb->fcrb.ack_delay_avg_index = index;
2509 
2510         p_ccb->fcrb.ack_q_count_max[index] = 0;
2511         p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
2512         p_ccb->fcrb.ack_q_count_avg[index] = 0;
2513 
2514 
2515         p_ccb->fcrb.ack_delay_max[index] = 0;
2516         p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
2517         p_ccb->fcrb.ack_delay_avg[index] = 0;
2518 
2519         p_ccb->fcrb.throughput[index] = 0;
2520     }
2521 }
2522 #endif
2523