Home | History | Annotate | Download | only in l2cap
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
     22  *  functions
     23  *
     24  ******************************************************************************/
     25 
     26 #include <stdlib.h>
     27 #include <string.h>
     28 #include <stdio.h>
     29 
     30 #include "gki.h"
     31 #include "bt_types.h"
     32 #include "hcimsgs.h"
     33 #include "l2cdefs.h"
     34 #include "l2c_int.h"
     35 #include "l2c_api.h"
     36 #include "btu.h"
     37 #include "btm_api.h"
     38 #include "btm_int.h"
     39 
     40 
     41 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted */
     42 #define L2C_FCR_RETX_ALL_PKTS   0xFF
     43 
     44 #if BT_TRACE_VERBOSE == TRUE
     45 static char *SAR_types[] = { "Unsegmented", "Start", "End", "Continuation" };
     46 static char *SUP_types[] = { "RR", "REJ", "RNR", "SREJ" };
     47 #endif
     48 
     49 /* Look-up table for the CRC calculation */
     50 static const unsigned short crctab[256] = {
     51     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241,
     52     0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
     53     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40,
     54     0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
     55     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40,
     56     0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
     57     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641,
     58     0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
     59     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
     60     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
     61     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41,
     62     0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
     63     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41,
     64     0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
     65     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640,
     66     0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
     67     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240,
     68     0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
     69     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41,
     70     0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
     71     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41,
     72     0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
     73     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640,
     74     0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
     75     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241,
     76     0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
     77     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
     78     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
     79     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40,
     80     0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
     81     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641,
     82     0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
     83 };
     84 
     85 
     86 /*******************************************************************************
     87 **  Static local functions
     88 */
     89 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word);
     90 static void    process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
     91 static void    process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack);
     92 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq);
     93 static void    prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission);
     94 static void    process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf);
     95 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
     96 
     97 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
     98 static BOOLEAN l2c_corrupt_the_fcr_packet (tL2C_CCB *p_ccb, BT_HDR *p_buf,
     99                                            BOOLEAN is_rx, UINT16 ctrl_word);
    100 static BOOLEAN l2c_bypass_sframe_packet (tL2C_CCB *p_ccb);
    101 #endif
    102 
    103 #if (L2CAP_ERTM_STATS == TRUE)
    104 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked);
    105 #endif
    106 
    107 /*******************************************************************************
    108 **
    109 ** Function         l2c_fcr_updcrc
    110 **
    111 ** Description      This function computes the CRC using the look-up table.
    112 **
    113 ** Returns          CRC
    114 **
    115 *******************************************************************************/
    116 unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char *icp, int icnt)
    117 {
    118     register unsigned short crc = icrc;
    119     register unsigned char  *cp = icp;
    120     register          int   cnt = icnt;
    121 
    122     while (cnt--)
    123     {
    124         crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
    125     }
    126 
    127     return(crc);
    128 }
    129 
    130 
    131 /*******************************************************************************
    132 **
    133 ** Function         l2c_fcr_tx_get_fcs
    134 **
    135 ** Description      This function computes the CRC for a frame to be TXed.
    136 **
    137 ** Returns          CRC
    138 **
    139 *******************************************************************************/
    140 UINT16 l2c_fcr_tx_get_fcs (BT_HDR *p_buf)
    141 {
    142     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
    143 
    144     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len));
    145 }
    146 
    147 /*******************************************************************************
    148 **
    149 ** Function         l2c_fcr_rx_get_fcs
    150 **
    151 ** Description      This function computes the CRC for a received frame.
    152 **
    153 ** Returns          CRC
    154 **
    155 *******************************************************************************/
    156 UINT16 l2c_fcr_rx_get_fcs (BT_HDR *p_buf)
    157 {
    158     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
    159 
    160     /* offset points past the L2CAP header, but the CRC check includes it */
    161     p -= L2CAP_PKT_OVERHEAD;
    162 
    163     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
    164 }
    165 
    166 /*******************************************************************************
    167 **
    168 ** Function         l2c_fcr_start_timer
    169 **
    170 ** Description      This function starts the (monitor or retransmission) timer.
    171 **
    172 ** Returns          -
    173 **
    174 *******************************************************************************/
    175 void l2c_fcr_start_timer (tL2C_CCB *p_ccb)
    176 {
    177     UINT32  tout;
    178 
    179     /* The timers which are in milliseconds */
    180     if (p_ccb->fcrb.wait_ack)
    181     {
    182         tout = (UINT32)p_ccb->our_cfg.fcr.mon_tout;
    183     }
    184     else
    185     {
    186         tout = (UINT32)p_ccb->our_cfg.fcr.rtrans_tout;
    187     }
    188 /*
    189     L2CAP_TRACE_DEBUG4 ("l2c_fcr_start_timer Tout: %u  Already Running: %u  wait_ack: %u  ack_q_count: %u",
    190                         tout, p_ccb->timer_entry.in_use, p_ccb->fcrb.wait_ack, p_ccb->fcrb.waiting_for_ack_q.count);
    191 */
    192     /* Only start a timer that was not started */
    193     if (p_ccb->fcrb.mon_retrans_timer.in_use == 0)
    194         btu_start_quick_timer (&p_ccb->fcrb.mon_retrans_timer, BTU_TTYPE_L2CAP_CHNL, tout*QUICK_TIMER_TICKS_PER_SEC/1000);
    195 }
    196 
    197 /*******************************************************************************
    198 **
    199 ** Function         l2c_fcr_stop_timer
    200 **
    201 ** Description      This function stops the (monitor or transmission) timer.
    202 **
    203 ** Returns          -
    204 **
    205 *******************************************************************************/
    206 void l2c_fcr_stop_timer (tL2C_CCB *p_ccb)
    207 {
    208     if (p_ccb->fcrb.mon_retrans_timer.in_use)
    209     {
    210 /*
    211         L2CAP_TRACE_DEBUG2 ("l2c_fcr_stop_timer wait_ack: %u  ack_q_count: %u",
    212                             p_ccb->fcrb.wait_ack, p_ccb->fcrb.waiting_for_ack_q.count);
    213 */
    214         btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
    215     }
    216 }
    217 
    218 /*******************************************************************************
    219 **
    220 ** Function         l2c_fcr_cleanup
    221 **
    222 ** Description      This function cleans up the variable used for flow-control/retrans.
    223 **
    224 ** Returns          -
    225 **
    226 *******************************************************************************/
    227 void l2c_fcr_cleanup (tL2C_CCB *p_ccb)
    228 {
    229     tL2C_FCRB *p_fcrb = &p_ccb->fcrb;
    230 
    231     l2c_fcr_stop_timer (p_ccb);
    232 
    233     if (p_fcrb->p_rx_sdu)
    234         GKI_freebuf (p_fcrb->p_rx_sdu);
    235 
    236     while (p_fcrb->waiting_for_ack_q.p_first)
    237         GKI_freebuf (GKI_dequeue (&p_fcrb->waiting_for_ack_q));
    238 
    239     while (p_fcrb->srej_rcv_hold_q.p_first)
    240         GKI_freebuf (GKI_dequeue (&p_fcrb->srej_rcv_hold_q));
    241 
    242     while (p_fcrb->retrans_q.p_first)
    243         GKI_freebuf (GKI_dequeue (&p_fcrb->retrans_q));
    244 
    245     btu_stop_quick_timer (&p_fcrb->ack_timer);
    246     btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
    247 
    248 #if (L2CAP_ERTM_STATS == TRUE)
    249     if ( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID) && (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) )
    250     {
    251         UINT32  dur = GKI_get_os_tick_count() - p_ccb->fcrb.connect_tick_count;
    252         char    *p_str = (char *)GKI_getbuf(120);
    253         UINT16  i;
    254         UINT32  throughput_avg, ack_delay_avg, ack_q_count_avg;
    255 
    256         dur = GKI_OS_TICKS_TO_MS(dur);
    257         BT_TRACE_2(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    258                    "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums", p_ccb->local_cid, dur);
    259         BT_TRACE_4(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    260                    "Retransmissions:%08u Times Flow Controlled:%08u Retrans Touts:%08u Ack Touts:%08u",
    261                     p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed, p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
    262         BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    263                    "Times there is less than 2 packets in controller when flow controlled:%08u", p_ccb->fcrb.controller_idle);
    264         BT_TRACE_2(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    265                    "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u", p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz );
    266         if (p_str)
    267         {
    268             sprintf(p_str, "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
    269                 p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
    270                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
    271                 p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1], p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
    272 
    273             BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    274 
    275             sprintf(p_str, "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
    276                 p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
    277                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
    278                 p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1], p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
    279 
    280             BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    281 
    282             throughput_avg  = 0;
    283             ack_delay_avg   = 0;
    284             ack_q_count_avg = 0;
    285 
    286             for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++ )
    287             {
    288                 if (i == p_ccb->fcrb.ack_delay_avg_index )
    289                 {
    290                     BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    291                            "[%02u] collecting data ...", i );
    292                     continue;
    293                 }
    294 
    295                 sprintf(p_str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
    296                         i, p_ccb->fcrb.throughput[i],
    297                         p_ccb->fcrb.ack_delay_avg[i], p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
    298                         p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i], p_ccb->fcrb.ack_q_count_max[i] );
    299 
    300                 BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    301 
    302                 throughput_avg  += p_ccb->fcrb.throughput[i];
    303                 ack_delay_avg   += p_ccb->fcrb.ack_delay_avg[i];
    304                 ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
    305             }
    306 
    307             throughput_avg  /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    308             ack_delay_avg   /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    309             ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    310 
    311             BT_TRACE_3(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    312                    "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, ack_q_count_avg: %8u",
    313                     throughput_avg, ack_delay_avg, ack_q_count_avg );
    314 
    315             GKI_freebuf(p_str);
    316         }
    317 
    318         BT_TRACE_0(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    319                    "---");
    320     }
    321 #endif
    322 
    323     memset (p_fcrb, 0, sizeof (tL2C_FCRB));
    324 }
    325 
    326 /*******************************************************************************
    327 **
    328 ** Function         l2c_fcr_clone_buf
    329 **
    330 ** Description      This function allocates and copies requested part of a buffer
    331 **                  at a new-offset.
    332 **
    333 ** Returns          pointer to new buffer
    334 **
    335 *******************************************************************************/
    336 BT_HDR *l2c_fcr_clone_buf (BT_HDR *p_buf, UINT16 new_offset, UINT16 no_of_bytes, UINT8 pool)
    337 {
    338     BT_HDR *p_buf2;
    339 
    340     /* If using the common pool, should be at least 10% free. */
    341     if ( (pool == HCI_ACL_POOL_ID) && (GKI_poolutilization (pool) > 90) )
    342     {
    343         L2CAP_TRACE_ERROR1 ("L2CAP - failed to clone buffer on HCI_ACL_POOL_ID Utilization: %u", GKI_poolutilization(pool));
    344         return (NULL);
    345     }
    346 
    347     if ((p_buf2 = (BT_HDR *)GKI_getpoolbuf(pool)) != NULL)
    348     {
    349         UINT16    pool_buf_size = GKI_get_pool_bufsize (pool);
    350 
    351         /* Make sure buffer fits into buffer pool */
    352         if ((no_of_bytes + sizeof(BT_HDR) + new_offset) > pool_buf_size)
    353         {
    354             L2CAP_TRACE_ERROR5("##### l2c_fcr_clone_buf (NumBytes %d) -> Exceeds poolsize %d [bytes %d + BT_HDR %d + offset %d]",
    355                                (no_of_bytes + sizeof(BT_HDR) + new_offset),
    356                                pool_buf_size, no_of_bytes, sizeof(BT_HDR),
    357                                new_offset);
    358 
    359             GKI_freebuf(p_buf2);
    360             return (NULL);
    361         }
    362 
    363         p_buf2->offset = new_offset;
    364         p_buf2->len    = no_of_bytes;
    365 
    366         memcpy (((UINT8 *)(p_buf2 + 1)) + p_buf2->offset,
    367                 ((UINT8 *)(p_buf + 1))  + p_buf->offset,
    368                 no_of_bytes);
    369     }
    370     else
    371     {
    372         L2CAP_TRACE_ERROR2 ("L2CAP - failed to clone buffer, Pool: %u  Count: %u", pool,  GKI_poolfreecount(pool));
    373     }
    374 
    375     return (p_buf2);
    376 }
    377 
    378 /*******************************************************************************
    379 **
    380 ** Function         l2c_fcr_is_flow_controlled
    381 **
    382 ** Description      This function checks if the CCB is flow controlled by peer.
    383 **
    384 ** Returns          The control word
    385 **
    386 *******************************************************************************/
    387 BOOLEAN l2c_fcr_is_flow_controlled (tL2C_CCB *p_ccb)
    388 {
    389     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    390     {
    391         /* Check if remote side flowed us off or the transmit window is full */
    392         if ( (p_ccb->fcrb.remote_busy == TRUE)
    393          ||  (p_ccb->fcrb.waiting_for_ack_q.count >= p_ccb->peer_cfg.fcr.tx_win_sz) )
    394         {
    395 #if (L2CAP_ERTM_STATS == TRUE)
    396             if (p_ccb->xmit_hold_q.count != 0)
    397             {
    398                 p_ccb->fcrb.xmit_window_closed++;
    399 
    400                 if ((p_ccb->p_lcb->sent_not_acked < 2)&&(l2cb.controller_xmit_window > 0))
    401                     p_ccb->fcrb.controller_idle++;
    402             }
    403 #endif
    404             return (TRUE);
    405         }
    406     }
    407     return (FALSE);
    408 }
    409 
    410 /*******************************************************************************
    411 **
    412 ** Function         prepare_I_frame
    413 **
    414 ** Description      This function sets the FCR variables in an I-frame that is
    415 **                  about to be sent to HCI for transmission. This may be the
    416 **                  first time the I-frame is sent, or a retransmission
    417 **
    418 ** Returns          -
    419 **
    420 *******************************************************************************/
    421 static void prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission)
    422 {
    423     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
    424     UINT8       *p;
    425     UINT16      fcs;
    426     UINT16      ctrl_word;
    427     BOOLEAN     set_f_bit = p_fcrb->send_f_rsp;
    428 
    429     p_fcrb->send_f_rsp = FALSE;
    430 
    431     if (is_retransmission)
    432     {
    433         /* Get the old control word and clear out the old req_seq and F bits */
    434         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    435 
    436         STREAM_TO_UINT16 (ctrl_word, p);
    437 
    438         ctrl_word  &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
    439     }
    440     else
    441     {
    442         ctrl_word  = p_buf->layer_specific & L2CAP_FCR_SEG_BITS;                /* SAR bits */
    443         ctrl_word |= (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT);      /* Tx Seq */
    444 
    445         p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
    446     }
    447 
    448     /* Set the F-bit and reqseq only if using re-transmission mode */
    449     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    450     {
    451         if (set_f_bit)
    452             ctrl_word |= L2CAP_FCR_F_BIT;
    453 
    454         ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    455 
    456         p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
    457 
    458         if (p_ccb->fcrb.ack_timer.in_use)
    459             btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
    460     }
    461 
    462     /* Set the control word */
    463     p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    464 
    465     UINT16_TO_STREAM (p, ctrl_word);
    466 
    467     /* Compute the FCS and add to the end of the buffer if not bypassed */
    468     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    469     {
    470         /* length field in l2cap header has to include FCS length */
    471         p = ((UINT8 *) (p_buf+1)) + p_buf->offset;
    472         UINT16_TO_STREAM (p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
    473 
    474         /* Calculate the FCS */
    475         fcs = l2c_fcr_tx_get_fcs(p_buf);
    476 
    477         /* Point to the end of the buffer and put the FCS there */
    478         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
    479 
    480         UINT16_TO_STREAM (p, fcs);
    481 
    482         p_buf->len += L2CAP_FCS_LEN;
    483     }
    484 
    485 #if BT_TRACE_VERBOSE == TRUE
    486     if (is_retransmission)
    487     {
    488         L2CAP_TRACE_EVENT6 ("L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  ReqSeq: %u  F: %u",
    489                             p_ccb->local_cid, p_buf->len,
    490                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    491                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    492                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    493                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    494     }
    495     else
    496     {
    497         L2CAP_TRACE_EVENT6 ("L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
    498                             p_ccb->local_cid, p_buf->len,
    499                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    500                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    501                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    502                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    503     }
    504 #endif
    505 
    506     /* Start the retransmission timer if not already running */
    507     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    508         l2c_fcr_start_timer (p_ccb);
    509 }
    510 
    511 /*******************************************************************************
    512 **
    513 ** Function         l2c_fcr_send_S_frame
    514 **
    515 ** Description      This function formats and sends an S-frame for transmission.
    516 **
    517 ** Returns          -
    518 **
    519 *******************************************************************************/
    520 void l2c_fcr_send_S_frame (tL2C_CCB *p_ccb, UINT16 function_code, UINT16 pf_bit)
    521 {
    522     BT_HDR      *p_buf;
    523     UINT8       *p;
    524     UINT16      ctrl_word;
    525     UINT16      fcs;
    526 
    527 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
    528     /* Only used for conformance testing */
    529     if (l2c_bypass_sframe_packet (p_ccb))
    530         return;
    531 #endif
    532 
    533     if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN))
    534         return;
    535 
    536 #if (L2CAP_ERTM_STATS == TRUE)
    537      p_ccb->fcrb.s_frames_sent[function_code]++;
    538 #endif
    539 
    540     if (pf_bit == L2CAP_FCR_P_BIT)
    541     {
    542         p_ccb->fcrb.wait_ack = TRUE;
    543 
    544         l2c_fcr_stop_timer (p_ccb);         /* Restart the monitor timer */
    545         l2c_fcr_start_timer (p_ccb);
    546     }
    547 
    548     /* Create the control word to use */
    549     ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
    550     ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
    551     ctrl_word |= pf_bit;
    552 
    553     if ((p_buf = (BT_HDR *)GKI_getpoolbuf (L2CAP_CMD_POOL_ID)) != NULL)
    554     {
    555         p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
    556         p_buf->len    = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
    557 
    558         /* Set the pointer to the beginning of the data */
    559         p = (UINT8 *)(p_buf + 1) + p_buf->offset;
    560 
    561         /* Put in the L2CAP header */
    562         UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
    563         UINT16_TO_STREAM (p, p_ccb->remote_cid);
    564         UINT16_TO_STREAM (p, ctrl_word);
    565 
    566         /* Compute the FCS and add to the end of the buffer if not bypassed */
    567         if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    568         {
    569             fcs = l2c_fcr_tx_get_fcs (p_buf);
    570 
    571             UINT16_TO_STREAM (p, fcs);
    572             p_buf->len += L2CAP_FCS_LEN;
    573         }
    574         else /* rewrite the length without FCS length */
    575         {
    576             p -= 6;
    577             UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD);
    578         }
    579 
    580 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
    581         /* Get out if packet was dropped */
    582         if (l2c_corrupt_the_fcr_packet (p_ccb, p_buf, FALSE, ctrl_word))
    583             return;
    584 #endif
    585         /* Now, the HCI transport header */
    586         p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
    587         l2cu_set_acl_hci_header (p_buf, p_ccb);
    588 
    589 #if BT_TRACE_VERBOSE == TRUE
    590         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
    591          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
    592         {
    593             L2CAP_TRACE_WARNING6 ("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
    594                             p_ccb->local_cid, ctrl_word,
    595                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    596                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    597                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    598                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    599             L2CAP_TRACE_WARNING1 ("                  Buf Len: %u", p_buf->len);
    600         }
    601         else
    602         {
    603             L2CAP_TRACE_EVENT6 ("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
    604                             p_ccb->local_cid, ctrl_word,
    605                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    606                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    607                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    608                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    609             L2CAP_TRACE_EVENT1 ("                  Buf Len: %u", p_buf->len);
    610         }
    611 #endif  /* BT_TRACE_VERBOSE */
    612 
    613         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, p_buf);
    614 
    615         p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
    616 
    617         if (p_ccb->fcrb.ack_timer.in_use)
    618             btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
    619     }
    620     else
    621     {
    622         L2CAP_TRACE_ERROR2 ("l2c_fcr_send_S_frame(No Resources) cid 0x%04x, Type: 0x%4x",
    623                              p_ccb->local_cid, function_code);
    624     }
    625 }
    626 
    627 
    628 /*******************************************************************************
    629 **
    630 ** Function         l2c_fcr_proc_pdu
    631 **
    632 ** Description      This function is the entry point for processing of a
    633 **                  received PDU when in flow control and/or retransmission modes.
    634 **
    635 ** Returns          -
    636 **
    637 *******************************************************************************/
    638 void l2c_fcr_proc_pdu (tL2C_CCB *p_ccb, BT_HDR *p_buf)
    639 {
    640     UINT8       *p;
    641     UINT16      fcs;
    642     UINT16      min_pdu_len;
    643     UINT16      ctrl_word;
    644 
    645     /* Check the length */
    646     min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS) ?
    647                   (UINT16)L2CAP_FCR_OVERHEAD : (UINT16)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
    648 
    649     if (p_buf->len < min_pdu_len)
    650     {
    651         L2CAP_TRACE_WARNING2 ("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u", p_ccb->local_cid, p_buf->len);
    652         GKI_freebuf (p_buf);
    653         return;
    654     }
    655 
    656     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE)
    657     {
    658         process_stream_frame (p_ccb, p_buf);
    659         return;
    660     }
    661 
    662 #if BT_TRACE_VERBOSE == TRUE
    663     /* Get the control word */
    664     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    665     STREAM_TO_UINT16 (ctrl_word, p);
    666 
    667     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    668     {
    669         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
    670          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
    671         {
    672             /* REJ or SREJ */
    673             L2CAP_TRACE_WARNING6 ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
    674                             p_ccb->local_cid, p_buf->len,
    675                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    676                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    677                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    678                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    679         }
    680         else
    681         {
    682             L2CAP_TRACE_EVENT6 ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
    683                             p_ccb->local_cid, p_buf->len,
    684                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    685                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    686                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    687                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    688         }
    689     }
    690     else
    691     {
    692         L2CAP_TRACE_EVENT6 ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
    693                             p_ccb->local_cid, p_buf->len,
    694                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    695                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    696                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    697                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    698     }
    699 
    700     L2CAP_TRACE_EVENT6 ("      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt %u, wt_q.cnt %u, tries %u",
    701                         p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack, p_ccb->fcrb.next_seq_expected,
    702                         p_ccb->fcrb.last_ack_sent, p_ccb->fcrb.waiting_for_ack_q.count, p_ccb->fcrb.num_tries);
    703 
    704 #endif /* BT_TRACE_VERBOSE */
    705 
    706 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
    707     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    708     STREAM_TO_UINT16 (ctrl_word, p);
    709 
    710     /* Get out if packet was dropped */
    711     if (l2c_corrupt_the_fcr_packet (p_ccb, p_buf, TRUE, ctrl_word))
    712         return;
    713 #endif  /* L2CAP_CORRUPT_ERTM_PKTS */
    714 
    715     /* Verify FCS if using */
    716     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    717     {
    718         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
    719 
    720         /* Extract and drop the FCS from the packet */
    721         STREAM_TO_UINT16 (fcs, p);
    722         p_buf->len -= L2CAP_FCS_LEN;
    723 
    724         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
    725         {
    726             L2CAP_TRACE_WARNING1 ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
    727             GKI_freebuf(p_buf);
    728             return;
    729         }
    730     }
    731 
    732     /* Get the control word */
    733     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    734 
    735     STREAM_TO_UINT16 (ctrl_word, p);
    736 
    737     p_buf->len    -= L2CAP_FCR_OVERHEAD;
    738     p_buf->offset += L2CAP_FCR_OVERHEAD;
    739 
    740     /* If we had a poll bit outstanding, check if we got a final response */
    741     if (p_ccb->fcrb.wait_ack)
    742     {
    743         /* If final bit not set, ignore the frame unless it is a polled S-frame */
    744         if ( !(ctrl_word & L2CAP_FCR_F_BIT) )
    745         {
    746             if ( (ctrl_word & L2CAP_FCR_P_BIT) && (ctrl_word & L2CAP_FCR_S_FRAME_BIT) )
    747             {
    748                 if (p_ccb->fcrb.srej_sent)
    749                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
    750                 else if (p_ccb->fcrb.local_busy)
    751                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
    752                 else
    753                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
    754 
    755                 /* Got a poll while in wait_ack state, so re-start our timer with 1-second */
    756                 /* This is a small optimization... the monitor timer is 12 secs, but we saw */
    757                 /* that if the other side sends us a poll when we are waiting for a final,  */
    758                 /* then it speeds up recovery significantly if we poll him back soon after his poll. */
    759                 btu_start_quick_timer (&p_ccb->fcrb.mon_retrans_timer, BTU_TTYPE_L2CAP_CHNL, QUICK_TIMER_TICKS_PER_SEC);
    760             }
    761             GKI_freebuf (p_buf);
    762             return;
    763         }
    764 
    765         p_ccb->fcrb.wait_ack  = FALSE;
    766 
    767         /* P and F are mutually exclusive */
    768         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    769             ctrl_word &= ~L2CAP_FCR_P_BIT;
    770 
    771         if (p_ccb->fcrb.waiting_for_ack_q.count == 0)
    772             p_ccb->fcrb.num_tries = 0;
    773 
    774         l2c_fcr_stop_timer (p_ccb);
    775     }
    776     else
    777     {
    778         /* Otherwise, ensure the final bit is ignored */
    779         ctrl_word &= ~L2CAP_FCR_F_BIT;
    780     }
    781 
    782     /* Process receive sequence number */
    783     if (!process_reqseq (p_ccb, ctrl_word))
    784     {
    785         GKI_freebuf (p_buf);
    786         return;
    787     }
    788 
    789      /* Process based on whether it is an S-frame or an I-frame */
    790     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    791         process_s_frame (p_ccb, p_buf, ctrl_word);
    792     else
    793         process_i_frame (p_ccb, p_buf, ctrl_word, FALSE);
    794 
    795     /* Return if the channel got disconnected by a bad packet or max retransmissions */
    796     if ( (!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN) )
    797         return;
    798 
    799     /* If we have some buffers held while doing SREJ, and SREJ has cleared, process them now */
    800     if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) && (p_ccb->fcrb.srej_rcv_hold_q.count > 0) )
    801     {
    802         BUFFER_Q temp_q = p_ccb->fcrb.srej_rcv_hold_q;
    803 
    804         GKI_init_q (&p_ccb->fcrb.srej_rcv_hold_q);
    805 
    806         while ((p_buf = (BT_HDR *)GKI_dequeue (&temp_q)) != NULL)
    807         {
    808             if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
    809             {
    810                 /* Get the control word */
    811                 p = ((UINT8 *)(p_buf+1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
    812 
    813                 STREAM_TO_UINT16 (ctrl_word, p);
    814 
    815                 L2CAP_TRACE_DEBUG3 ("l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   TxSeq: %u  Expected_Seq: %u",
    816                                     p_ccb->local_cid, (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    817                                     p_ccb->fcrb.next_seq_expected);
    818 
    819                 /* Process the SREJ held I-frame, but do not send an RR for each individual frame */
    820                 process_i_frame (p_ccb, p_buf, ctrl_word, TRUE);
    821             }
    822             else
    823                 GKI_freebuf (p_buf);
    824 
    825             /* If more frames were lost during SREJ, send a REJ */
    826             if (p_ccb->fcrb.rej_after_srej)
    827             {
    828                 p_ccb->fcrb.rej_after_srej = FALSE;
    829                 p_ccb->fcrb.rej_sent       = TRUE;
    830 
    831                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
    832             }
    833         }
    834 
    835         /* Now, if needed, send one RR for the whole held queue */
    836         if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) && (!p_ccb->fcrb.srej_sent)
    837          &&  (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent) )
    838             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
    839         else
    840         {
    841             L2CAP_TRACE_DEBUG6 ("l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
    842                                 p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent, p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
    843                                 p_ccb->fcrb.last_ack_sent);
    844         }
    845     }
    846 
    847     /* If a window has opened, check if we can send any more packets */
    848     if ( (p_ccb->fcrb.retrans_q.count || p_ccb->xmit_hold_q.count)
    849       && (p_ccb->fcrb.wait_ack == FALSE)
    850       && (l2c_fcr_is_flow_controlled (p_ccb) == FALSE) )
    851     {
    852         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
    853     }
    854 }
    855 
    856 /*******************************************************************************
    857 **
    858 ** Function         l2c_fcr_proc_tout
    859 **
    860 ** Description      Handle a timeout. We should be in error recovery state.
    861 **
    862 ** Returns          -
    863 **
    864 *******************************************************************************/
    865 void l2c_fcr_proc_tout (tL2C_CCB *p_ccb)
    866 {
    867     L2CAP_TRACE_DEBUG5 ("l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  ack_q_count: %u",
    868                         p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
    869                         p_ccb->fcrb.wait_ack, p_ccb->fcrb.waiting_for_ack_q.count);
    870 
    871 #if (L2CAP_ERTM_STATS == TRUE)
    872     p_ccb->fcrb.retrans_touts++;
    873 #endif
    874 
    875     if ( (p_ccb->peer_cfg.fcr.max_transmit != 0) && (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit) )
    876     {
    877         l2cu_disconnect_chnl (p_ccb);
    878     }
    879     else
    880     {
    881         if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent)
    882         {
    883             if (p_ccb->fcrb.local_busy)
    884                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
    885             else
    886                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
    887         }
    888     }
    889 }
    890 
    891 
    892 /*******************************************************************************
    893 **
    894 ** Function         l2c_fcr_proc_ack_tout
    895 **
    896 ** Description      Send RR/RNR if we have not acked I frame
    897 **
    898 ** Returns          -
    899 **
    900 *******************************************************************************/
    901 void l2c_fcr_proc_ack_tout (tL2C_CCB *p_ccb)
    902 {
    903     L2CAP_TRACE_DEBUG5 ("l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d", p_ccb->local_cid,
    904                         p_ccb->chnl_state, p_ccb->fcrb.wait_ack, p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
    905 
    906     if ( (p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack)
    907       && (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected) )
    908     {
    909 #if (L2CAP_ERTM_STATS == TRUE)
    910         p_ccb->fcrb.xmit_ack_touts++;
    911 #endif
    912         if (p_ccb->fcrb.local_busy)
    913             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
    914         else
    915             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
    916     }
    917 }
    918 
    919 
    920 /*******************************************************************************
    921 **
    922 ** Function         process_reqseq
    923 **
    924 ** Description      Handle receive sequence number
    925 **
    926 ** Returns          -
    927 **
    928 *******************************************************************************/
    929 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
    930 {
    931     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
    932     UINT8       req_seq, num_bufs_acked, xx;
    933     UINT16      ls;
    934     UINT16      full_sdus_xmitted;
    935 
    936     /* Receive sequence number does not ack anything for SREJ with P-bit set to zero */
    937     if ( (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    938      &&  ((ctrl_word & L2CAP_FCR_SUP_BITS) == (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT))
    939      &&  ((ctrl_word & L2CAP_FCR_P_BIT) == 0) )
    940     {
    941         /* If anything still waiting for ack, restart the timer if it was stopped */
    942         if (p_fcrb->waiting_for_ack_q.count)
    943             l2c_fcr_start_timer (p_ccb);
    944 
    945         return (TRUE);
    946     }
    947 
    948     /* Extract the receive sequence number from the control word */
    949     req_seq = (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    950 
    951     num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
    952 
    953     /* Verify the request sequence is in range before proceeding */
    954     if (num_bufs_acked > p_fcrb->waiting_for_ack_q.count)
    955     {
    956         /* The channel is closed if ReqSeq is not in range */
    957         L2CAP_TRACE_WARNING4 ("L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
    958                                ctrl_word, req_seq, p_fcrb->last_rx_ack, p_fcrb->waiting_for_ack_q.count);
    959 
    960         l2cu_disconnect_chnl (p_ccb);
    961         return (FALSE);
    962     }
    963 
    964 /*
    965     L2CAP_TRACE_DEBUG3 ("L2CAP process_reqseq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
    966                            req_seq, p_fcrb->last_rx_ack, p_fcrb->waiting_for_ack_q.count);
    967 */
    968     p_fcrb->last_rx_ack = req_seq;
    969 
    970     /* Now we can release all acknowledged frames, and restart the retransmission timer if needed */
    971     if (num_bufs_acked != 0)
    972     {
    973         p_fcrb->num_tries = 0;
    974         full_sdus_xmitted = 0;
    975 
    976 #if (L2CAP_ERTM_STATS == TRUE)
    977         l2c_fcr_collect_ack_delay (p_ccb, num_bufs_acked);
    978 #endif
    979 
    980         for (xx = 0; xx < num_bufs_acked; xx++)
    981         {
    982             ls = ((BT_HDR *)(p_fcrb->waiting_for_ack_q.p_first))->layer_specific & L2CAP_FCR_SAR_BITS;
    983 
    984             if ( (ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU) )
    985                 full_sdus_xmitted++;
    986 
    987             GKI_freebuf (GKI_dequeue (&p_fcrb->waiting_for_ack_q));
    988         }
    989 
    990         /* If we are still in a wait_ack state, do not mess with the timer */
    991         if (!p_ccb->fcrb.wait_ack)
    992             l2c_fcr_stop_timer (p_ccb);
    993 
    994         /* Check if we need to call the "packet_sent" callback */
    995         if ( (p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) && (full_sdus_xmitted) )
    996         {
    997             /* Special case for eRTM, if all packets sent, send 0xFFFF */
    998             if ( (p_fcrb->waiting_for_ack_q.count == 0) && (p_ccb->xmit_hold_q.count == 0) )
    999                 full_sdus_xmitted = 0xFFFF;
   1000 
   1001             (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid, full_sdus_xmitted);
   1002         }
   1003     }
   1004 
   1005     /* If anything still waiting for ack, restart the timer if it was stopped */
   1006     if (p_fcrb->waiting_for_ack_q.count)
   1007         l2c_fcr_start_timer (p_ccb);
   1008 
   1009     return (TRUE);
   1010 }
   1011 
   1012 
   1013 /*******************************************************************************
   1014 **
   1015 ** Function         process_s_frame
   1016 **
   1017 ** Description      Process an S frame
   1018 **
   1019 ** Returns          -
   1020 **
   1021 *******************************************************************************/
   1022 static void process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
   1023 {
   1024     tL2C_FCRB   *p_fcrb      = &p_ccb->fcrb;
   1025     UINT16      s_frame_type = (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
   1026     BOOLEAN     remote_was_busy;
   1027     BOOLEAN     all_ok = TRUE;
   1028 
   1029     if (p_buf->len != 0)
   1030     {
   1031         L2CAP_TRACE_WARNING1 ("Incorrect S-frame Length (%d)", p_buf->len);
   1032     }
   1033 
   1034     L2CAP_TRACE_DEBUG2 ("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d", ctrl_word, p_fcrb->remote_busy);
   1035 
   1036 #if (L2CAP_ERTM_STATS == TRUE)
   1037     p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
   1038 #endif
   1039 
   1040     if (ctrl_word & L2CAP_FCR_P_BIT)
   1041     {
   1042         p_fcrb->rej_sent   = FALSE;             /* After checkpoint, we can send anoher REJ */
   1043         p_fcrb->send_f_rsp = TRUE;              /* Set a flag in case an I-frame is pending */
   1044     }
   1045 
   1046     switch (s_frame_type)
   1047     {
   1048     case L2CAP_FCR_SUP_RR:
   1049         remote_was_busy     = p_fcrb->remote_busy;
   1050         p_fcrb->remote_busy = FALSE;
   1051 
   1052         if ( (ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy) )
   1053             all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1054         break;
   1055 
   1056     case L2CAP_FCR_SUP_REJ:
   1057         p_fcrb->remote_busy = FALSE;
   1058         all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1059         break;
   1060 
   1061     case L2CAP_FCR_SUP_RNR:
   1062         p_fcrb->remote_busy = TRUE;
   1063         l2c_fcr_stop_timer (p_ccb);
   1064         break;
   1065 
   1066     case L2CAP_FCR_SUP_SREJ:
   1067         p_fcrb->remote_busy = FALSE;
   1068         all_ok = retransmit_i_frames (p_ccb, (UINT8)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
   1069         break;
   1070     }
   1071 
   1072     if (all_ok)
   1073     {
   1074         /* If polled, we need to respond with F-bit. Note, we may have sent a I-frame with the F-bit */
   1075         if (p_fcrb->send_f_rsp)
   1076         {
   1077             if (p_fcrb->srej_sent)
   1078                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
   1079             else if (p_fcrb->local_busy)
   1080                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
   1081             else
   1082                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
   1083 
   1084             p_fcrb->send_f_rsp = FALSE;
   1085         }
   1086     }
   1087     else
   1088     {
   1089         L2CAP_TRACE_DEBUG0 ("process_s_frame hit_max_retries");
   1090     }
   1091 
   1092     GKI_freebuf (p_buf);
   1093 }
   1094 
   1095 
   1096 /*******************************************************************************
   1097 **
   1098 ** Function         process_i_frame
   1099 **
   1100 ** Description      Process an I frame
   1101 **
   1102 ** Returns          -
   1103 **
   1104 *******************************************************************************/
   1105 static void process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack)
   1106 {
   1107     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
   1108     UINT8       tx_seq, num_lost, num_to_ack, next_srej;
   1109 
   1110     /* If we were doing checkpoint recovery, first retransmit all unacked I-frames */
   1111     if (ctrl_word & L2CAP_FCR_F_BIT)
   1112     {
   1113         if (!retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS))
   1114         {
   1115             GKI_freebuf(p_buf);
   1116             return;
   1117         }
   1118     }
   1119 
   1120 #if (L2CAP_ERTM_STATS == TRUE)
   1121     p_ccb->fcrb.ertm_pkt_counts[1]++;
   1122     p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
   1123 #endif
   1124 
   1125     /* Extract the sequence number */
   1126     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1127 
   1128     /* If we have flow controlled the peer, ignore any bad I-frames from him */
   1129     if ( (tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy) )
   1130     {
   1131         L2CAP_TRACE_WARNING1 ("Dropping bad I-Frame since we flowed off, tx_seq:%u", tx_seq);
   1132         l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1133         GKI_freebuf(p_buf);
   1134         return;
   1135     }
   1136 
   1137     /* If there are no free buffers in the user Rx queue, drop the  */
   1138     /* received buffer now before we update any sequence numbers    */
   1139     if (GKI_poolfreecount (p_ccb->ertm_info.user_rx_pool_id) == 0)
   1140     {
   1141         L2CAP_TRACE_WARNING4 ("L2CAP CID: 0x%04x  Dropping I-Frame seq: %u  User RX Pool: %u  (Size: %u)  has no free buffers!!",
   1142                               p_ccb->local_cid, tx_seq, p_ccb->ertm_info.user_rx_pool_id,
   1143                               GKI_poolcount (p_ccb->ertm_info.user_rx_pool_id));
   1144         GKI_freebuf(p_buf);
   1145         return;
   1146     }
   1147 
   1148     /* Check if tx-sequence is the expected one */
   1149     if (tx_seq != p_fcrb->next_seq_expected)
   1150     {
   1151         num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
   1152 
   1153         /* Is the frame a duplicate ? If so, just drop it */
   1154         if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz)
   1155         {
   1156             /* Duplicate - simply drop it */
   1157             L2CAP_TRACE_WARNING2 ("process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq %u", tx_seq, p_fcrb->next_seq_expected);
   1158             GKI_freebuf(p_buf);
   1159         }
   1160         else
   1161         {
   1162             L2CAP_TRACE_WARNING6 ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej: %u",
   1163                                  p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent, p_fcrb->srej_sent);
   1164 
   1165             if (p_fcrb->srej_sent)
   1166             {
   1167                 /* If SREJ sent, save the frame for later processing as long as it is in sequence */
   1168                 next_srej = (((BT_HDR *)p_fcrb->srej_rcv_hold_q.p_last)->layer_specific + 1) & L2CAP_FCR_SEQ_MODULO;
   1169 
   1170                 if ( (tx_seq == next_srej) && (p_fcrb->srej_rcv_hold_q.count < p_ccb->our_cfg.fcr.tx_win_sz) )
   1171                 {
   1172                     /* If user gave us a pool for held rx buffers, use that */
   1173                     if (p_ccb->ertm_info.fcr_rx_pool_id != HCI_ACL_POOL_ID)
   1174                     {
   1175                         BT_HDR *p_buf2;
   1176 
   1177                         /* Adjust offset and len so that control word is copied */
   1178                         p_buf->offset -= L2CAP_FCR_OVERHEAD;
   1179                         p_buf->len    += L2CAP_FCR_OVERHEAD;
   1180 
   1181                         p_buf2 = l2c_fcr_clone_buf (p_buf, p_buf->offset, p_buf->len, p_ccb->ertm_info.fcr_rx_pool_id);
   1182 
   1183                         if (p_buf2)
   1184                         {
   1185                             GKI_freebuf (p_buf);
   1186                             p_buf = p_buf2;
   1187                         }
   1188                         p_buf->offset += L2CAP_FCR_OVERHEAD;
   1189                         p_buf->len -= L2CAP_FCR_OVERHEAD;
   1190                     }
   1191                     L2CAP_TRACE_DEBUG4 ("process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej1",
   1192                                          num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1193 
   1194                     p_buf->layer_specific = tx_seq;
   1195                     GKI_enqueue (&p_fcrb->srej_rcv_hold_q, p_buf);
   1196                 }
   1197                 else
   1198                 {
   1199                     L2CAP_TRACE_WARNING4 ("process_i_frame() CID: 0x%04x  frame dropped in Srej Sent next_srej:%u  hold_q.count:%u  win_sz:%u",
   1200                                          p_ccb->local_cid, next_srej, p_fcrb->srej_rcv_hold_q.count, p_ccb->our_cfg.fcr.tx_win_sz);
   1201 
   1202                     p_fcrb->rej_after_srej = TRUE;
   1203                     GKI_freebuf (p_buf);
   1204                 }
   1205             }
   1206             else if (p_fcrb->rej_sent)
   1207             {
   1208                 L2CAP_TRACE_WARNING5 ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: 1  SRej: %u",
   1209                                      p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->srej_sent);
   1210 
   1211                 /* If REJ sent, just drop the frame */
   1212                 GKI_freebuf (p_buf);
   1213             }
   1214             else
   1215             {
   1216                 L2CAP_TRACE_DEBUG4 ("process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
   1217                                      p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1218 
   1219                 /* If only one lost, we will send SREJ, otherwise we will send REJ */
   1220                 if (num_lost > 1)
   1221                 {
   1222                     GKI_freebuf (p_buf);
   1223                     p_fcrb->rej_sent = TRUE;
   1224                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
   1225                 }
   1226                 else
   1227                 {
   1228                     if (p_fcrb->srej_rcv_hold_q.count != 0)
   1229                     {
   1230                         L2CAP_TRACE_ERROR3 ("process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d hold_q.count:%u",
   1231                                              p_ccb->local_cid, tx_seq, p_fcrb->srej_rcv_hold_q.count);
   1232                     }
   1233                     p_buf->layer_specific = tx_seq;
   1234                     GKI_enqueue (&p_fcrb->srej_rcv_hold_q, p_buf);
   1235                     p_fcrb->srej_sent = TRUE;
   1236                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, 0);
   1237                 }
   1238                 btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
   1239             }
   1240         }
   1241         return;
   1242     }
   1243 
   1244     /* Seq number is the next expected. Clear possible reject exception in case it occured */
   1245     p_fcrb->rej_sent = p_fcrb->srej_sent = FALSE;
   1246 
   1247     /* Adjust the next_seq, so that if the upper layer sends more data in the callback
   1248        context, the received frame is acked by an I-frame. */
   1249     p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1250 
   1251     /* If any SAR problem in eRTM mode, spec says disconnect. */
   1252     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
   1253     {
   1254         L2CAP_TRACE_WARNING1 ("process_i_frame() CID: 0x%04x  reassembly failed", p_ccb->local_cid);
   1255         l2cu_disconnect_chnl (p_ccb);
   1256         return;
   1257     }
   1258 
   1259     /* RR optimization - if peer can still send us more, then start an ACK timer */
   1260     num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) & L2CAP_FCR_SEQ_MODULO;
   1261 
   1262     if ( (num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy) )
   1263         delay_ack = TRUE;
   1264 
   1265     /* We should neve never ack frame if we are not in OPEN state */
   1266     if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
   1267     {
   1268         /* If no frames are awaiting transmission or are held, send an RR or RNR S-frame for ack */
   1269         if (delay_ack)
   1270         {
   1271             /* If it is the first I frame we did not ack, start ack timer */
   1272             if (!p_ccb->fcrb.ack_timer.in_use)
   1273             {
   1274                 btu_start_quick_timer (&p_ccb->fcrb.ack_timer, BTU_TTYPE_L2CAP_FCR_ACK,
   1275                                         (L2CAP_FCR_ACK_TOUT*QUICK_TIMER_TICKS_PER_SEC)/1000);
   1276             }
   1277         }
   1278         else if ( ((p_ccb->xmit_hold_q.count == 0) || (l2c_fcr_is_flow_controlled (p_ccb)))
   1279                &&  (p_ccb->fcrb.srej_rcv_hold_q.count == 0) )
   1280         {
   1281             if (p_fcrb->local_busy)
   1282                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1283             else
   1284                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
   1285         }
   1286     }
   1287 }
   1288 
   1289 
   1290 /*******************************************************************************
   1291 **
   1292 ** Function         process_stream_frame
   1293 **
   1294 ** Description      This function processes frames in streaming mode
   1295 **
   1296 ** Returns          -
   1297 **
   1298 *******************************************************************************/
   1299 static void process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf)
   1300 {
   1301     UINT16      ctrl_word;
   1302     UINT16      fcs;
   1303     UINT8       *p;
   1304     UINT8       tx_seq;
   1305 
   1306     /* Verify FCS if using */
   1307     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1308     {
   1309         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
   1310 
   1311         /* Extract and drop the FCS from the packet */
   1312         STREAM_TO_UINT16 (fcs, p);
   1313         p_buf->len -= L2CAP_FCS_LEN;
   1314 
   1315         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
   1316         {
   1317             L2CAP_TRACE_WARNING1 ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
   1318             GKI_freebuf(p_buf);
   1319             return;
   1320         }
   1321     }
   1322 
   1323     /* Get the control word */
   1324     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
   1325 
   1326     STREAM_TO_UINT16 (ctrl_word, p);
   1327 
   1328     p_buf->len    -= L2CAP_FCR_OVERHEAD;
   1329     p_buf->offset += L2CAP_FCR_OVERHEAD;
   1330 
   1331     /* Make sure it is an I-frame */
   1332     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
   1333     {
   1334         L2CAP_TRACE_WARNING2 ("Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: 0x%04x", p_ccb->local_cid, ctrl_word);
   1335         GKI_freebuf (p_buf);
   1336         return;
   1337     }
   1338 
   1339 #if BT_TRACE_VERBOSE == TRUE
   1340     L2CAP_TRACE_EVENT6 ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
   1341                         p_ccb->local_cid, p_buf->len,
   1342                         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
   1343                         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
   1344                         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
   1345                         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
   1346 #endif
   1347 
   1348     /* Extract the sequence number */
   1349     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1350 
   1351     /* Check if tx-sequence is the expected one */
   1352     if (tx_seq != p_ccb->fcrb.next_seq_expected)
   1353     {
   1354         L2CAP_TRACE_WARNING4 ("Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: 0x%08x",
   1355                                 p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq, p_ccb->fcrb.p_rx_sdu);
   1356 
   1357         /* Lost one or more packets, so flush the SAR queue */
   1358         if (p_ccb->fcrb.p_rx_sdu != NULL)
   1359         {
   1360             GKI_freebuf (p_ccb->fcrb.p_rx_sdu);
   1361             p_ccb->fcrb.p_rx_sdu = NULL;
   1362         }
   1363     }
   1364 
   1365     p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1366 
   1367     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
   1368     {
   1369         /* Some sort of SAR error, so flush the SAR queue */
   1370         if (p_ccb->fcrb.p_rx_sdu != NULL)
   1371         {
   1372             GKI_freebuf (p_ccb->fcrb.p_rx_sdu);
   1373             p_ccb->fcrb.p_rx_sdu = NULL;
   1374         }
   1375     }
   1376 }
   1377 
   1378 
   1379 /*******************************************************************************
   1380 **
   1381 ** Function         do_sar_reassembly
   1382 **
   1383 ** Description      Process SAR bits and re-assemble frame
   1384 **
   1385 ** Returns          TRUE if all OK, else FALSE
   1386 **
   1387 *******************************************************************************/
   1388 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
   1389 {
   1390     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
   1391     UINT16      sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
   1392     BOOLEAN     packet_ok = TRUE;
   1393     UINT8       *p;
   1394 
   1395     /* Check if the SAR state is correct */
   1396     if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU))
   1397     {
   1398         if (p_fcrb->p_rx_sdu != NULL)
   1399         {
   1400             L2CAP_TRACE_WARNING2 ("SAR - got unexpected unsegmented or start SDU  Expected len: %u  Got so far: %u",
   1401                                   p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
   1402 
   1403             packet_ok = FALSE;
   1404         }
   1405         /* Check the length of the packet */
   1406         if ( (sar_type == L2CAP_FCR_START_SDU) && (p_buf->len < L2CAP_SDU_LEN_OVERHEAD) )
   1407         {
   1408             L2CAP_TRACE_WARNING1 ("SAR start packet too short: %u", p_buf->len);
   1409             packet_ok = FALSE;
   1410         }
   1411     }
   1412     else
   1413     {
   1414         if (p_fcrb->p_rx_sdu == NULL)
   1415         {
   1416             L2CAP_TRACE_WARNING0 ("SAR - got unexpected cont or end SDU");
   1417             packet_ok = FALSE;
   1418         }
   1419     }
   1420 
   1421     if ( (packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU) )
   1422     {
   1423         p = ((UINT8 *)(p_buf + 1)) + p_buf->offset;
   1424 
   1425         /* For start SDU packet, extract the SDU length */
   1426         if (sar_type == L2CAP_FCR_START_SDU)
   1427         {
   1428             /* Get the SDU length */
   1429             STREAM_TO_UINT16 (p_fcrb->rx_sdu_len, p);
   1430             p_buf->offset += 2;
   1431             p_buf->len    -= 2;
   1432 
   1433             if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu)
   1434             {
   1435                 L2CAP_TRACE_WARNING2 ("SAR - SDU len: %u  larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
   1436                 packet_ok = FALSE;
   1437             }
   1438             else if ((p_fcrb->p_rx_sdu = (BT_HDR *)GKI_getpoolbuf (p_ccb->ertm_info.user_rx_pool_id)) == NULL)
   1439             {
   1440                 L2CAP_TRACE_ERROR1 ("SAR - no buffer for SDU start user_rx_pool_id:%d", p_ccb->ertm_info.user_rx_pool_id);
   1441                 packet_ok = FALSE;
   1442             }
   1443             else
   1444             {
   1445                 p_fcrb->p_rx_sdu->offset = 4; /* this is the minimal offset required by OBX to process incoming packets */
   1446                 p_fcrb->p_rx_sdu->len    = 0;
   1447             }
   1448         }
   1449 
   1450         if (packet_ok)
   1451         {
   1452             if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len)
   1453             {
   1454                 L2CAP_TRACE_ERROR4 ("SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u",
   1455                                     sar_type, p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1456                 packet_ok = FALSE;
   1457             }
   1458             else if ( (sar_type == L2CAP_FCR_END_SDU) && ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len) )
   1459             {
   1460                 L2CAP_TRACE_WARNING3 ("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
   1461                                       p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1462                 packet_ok = FALSE;
   1463             }
   1464             else
   1465             {
   1466                 memcpy (((UINT8 *) (p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset + p_fcrb->p_rx_sdu->len, p, p_buf->len);
   1467 
   1468                 p_fcrb->p_rx_sdu->len += p_buf->len;
   1469 
   1470                 GKI_freebuf (p_buf);
   1471                 p_buf = NULL;
   1472 
   1473                 if (sar_type == L2CAP_FCR_END_SDU)
   1474                 {
   1475                     p_buf            = p_fcrb->p_rx_sdu;
   1476                     p_fcrb->p_rx_sdu = NULL;
   1477                 }
   1478             }
   1479         }
   1480     }
   1481 
   1482     if (packet_ok == FALSE)
   1483     {
   1484         GKI_freebuf (p_buf);
   1485     }
   1486     else if (p_buf != NULL)
   1487     {
   1488 #if (L2CAP_NUM_FIXED_CHNLS > 0)
   1489         if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
   1490             (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL && p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL))
   1491         {
   1492             if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
   1493                 (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(p_ccb->p_lcb->remote_bd_addr, p_buf);
   1494         }
   1495         else
   1496 #endif
   1497             l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
   1498     }
   1499 
   1500     return (packet_ok);
   1501 }
   1502 
   1503 
   1504 /*******************************************************************************
   1505 **
   1506 ** Function         retransmit_i_frames
   1507 **
   1508 ** Description      This function retransmits i-frames awaiting acks.
   1509 **
   1510 ** Returns          BOOLEAN - TRUE if retransmitted
   1511 **
   1512 *******************************************************************************/
   1513 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
   1514 {
   1515     BT_HDR      *p_buf, *p_buf2;
   1516     UINT8       *p;
   1517     UINT8       buf_seq;
   1518     UINT16      ctrl_word;
   1519 
   1520     if ( (p_ccb->fcrb.waiting_for_ack_q.p_first)
   1521      &&  (p_ccb->peer_cfg.fcr.max_transmit != 0)
   1522      &&  (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit) )
   1523     {
   1524         L2CAP_TRACE_EVENT5 ("Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: %u) ack_q_count: %u",
   1525                 p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
   1526                 p_ccb->fcrb.waiting_for_ack_q.count);
   1527 
   1528         l2cu_disconnect_chnl (p_ccb);
   1529         return (FALSE);
   1530     }
   1531 
   1532     /* tx_seq indicates whether to retransmit a specific sequence or all (if == L2C_FCR_RETX_ALL_PKTS) */
   1533     if (tx_seq != L2C_FCR_RETX_ALL_PKTS)
   1534     {
   1535         /* If sending only one, the sequence number tells us which one. Look for it.
   1536         */
   1537         for (p_buf = (BT_HDR *)p_ccb->fcrb.waiting_for_ack_q.p_first; p_buf; p_buf = (BT_HDR *)GKI_getnext (p_buf))
   1538         {
   1539             /* Get the old control word */
   1540             p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
   1541 
   1542             STREAM_TO_UINT16 (ctrl_word, p);
   1543 
   1544             buf_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1545 
   1546             L2CAP_TRACE_DEBUG2 ("retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq, tx_seq);
   1547 
   1548             if (tx_seq == buf_seq)
   1549                 break;
   1550         }
   1551 
   1552         if (!p_buf)
   1553         {
   1554             L2CAP_TRACE_ERROR2 ("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u", tx_seq, p_ccb->fcrb.waiting_for_ack_q.count);
   1555             return (TRUE);
   1556         }
   1557     }
   1558     else
   1559     {
   1560         /* Retransmitting everything. Flush buffers we already put in the link xmit queue.
   1561         */
   1562         p_buf = (BT_HDR *)p_ccb->p_lcb->link_xmit_data_q.p_first;
   1563 
   1564         while (p_buf != NULL)
   1565         {
   1566             /* Do not flush other CIDs or partial segments */
   1567             if ( (p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid) )
   1568             {
   1569                 p_buf2 = p_buf;
   1570                 p_buf = (BT_HDR *)GKI_getnext (p_buf);
   1571 
   1572                 GKI_remove_from_queue (&p_ccb->p_lcb->link_xmit_data_q, p_buf2);
   1573                 GKI_freebuf (p_buf2);
   1574             }
   1575             else
   1576                 p_buf = (BT_HDR *)GKI_getnext (p_buf);
   1577         }
   1578 
   1579         /* Also flush our retransmission queue */
   1580         while (p_ccb->fcrb.retrans_q.p_first)
   1581             GKI_freebuf (GKI_dequeue (&p_ccb->fcrb.retrans_q));
   1582 
   1583         p_buf = (BT_HDR *)p_ccb->fcrb.waiting_for_ack_q.p_first;
   1584     }
   1585 
   1586     while (p_buf != NULL)
   1587     {
   1588         p_buf2 = l2c_fcr_clone_buf (p_buf, p_buf->offset, p_buf->len, p_ccb->ertm_info.fcr_tx_pool_id);
   1589 
   1590         if (p_buf2)
   1591         {
   1592             p_buf2->layer_specific = p_buf->layer_specific;
   1593 
   1594             GKI_enqueue (&p_ccb->fcrb.retrans_q, p_buf2);
   1595         }
   1596 
   1597         if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) )
   1598             break;
   1599         else
   1600             p_buf = (BT_HDR *)GKI_getnext (p_buf);
   1601     }
   1602 
   1603     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
   1604 
   1605     if (p_ccb->fcrb.waiting_for_ack_q.count)
   1606     {
   1607         p_ccb->fcrb.num_tries++;
   1608         l2c_fcr_start_timer (p_ccb);
   1609     }
   1610 
   1611     return (TRUE);
   1612 }
   1613 
   1614 
   1615 /*******************************************************************************
   1616 **
   1617 ** Function         l2c_fcr_get_next_xmit_sdu_seg
   1618 **
   1619 ** Description      Get the next SDU segment to transmit.
   1620 **
   1621 ** Returns          pointer to buffer with segment or NULL
   1622 **
   1623 *******************************************************************************/
   1624 BT_HDR *l2c_fcr_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
   1625 {
   1626     BOOLEAN     first_seg    = FALSE,       /* The segment is the first part of data  */
   1627                 mid_seg      = FALSE,       /* The segment is the middle part of data */
   1628                 last_seg     = FALSE;       /* The segment is the last part of data   */
   1629     UINT16      sdu_len = 0;
   1630     BT_HDR      *p_buf, *p_xmit;
   1631     UINT8       *p;
   1632     UINT16      max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
   1633 
   1634     /* If there is anything in the retransmit queue, that goes first
   1635     */
   1636     if (p_ccb->fcrb.retrans_q.p_first)
   1637     {
   1638         p_buf = (BT_HDR *)GKI_dequeue (&p_ccb->fcrb.retrans_q);
   1639 
   1640         /* Update Rx Seq and FCS if we acked some packets while this one was queued */
   1641         prepare_I_frame (p_ccb, p_buf, TRUE);
   1642 
   1643         p_buf->event = p_ccb->local_cid;
   1644 
   1645 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
   1646         /* Use sdu_len to hold the control word */
   1647         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
   1648         STREAM_TO_UINT16 (sdu_len, p);
   1649 
   1650         /* Get out if packet was dropped; just pretend it went out */
   1651         if (l2c_corrupt_the_fcr_packet (p_ccb, p_buf, FALSE, sdu_len))
   1652             return (NULL);
   1653 #endif  /* L2CAP_CORRUPT_ERTM_PKTS */
   1654 
   1655 #if (L2CAP_ERTM_STATS == TRUE)
   1656         p_ccb->fcrb.pkts_retransmitted++;
   1657         p_ccb->fcrb.ertm_pkt_counts[0]++;
   1658         p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
   1659 #endif
   1660         return (p_buf);
   1661     }
   1662 
   1663     /* For BD/EDR controller, max_packet_length is set to 0             */
   1664     /* For AMP controller, max_packet_length is set by available blocks */
   1665     if ( (max_packet_length > L2CAP_MAX_HEADER_FCS)
   1666       && (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length) )
   1667     {
   1668         max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
   1669     }
   1670 
   1671     p_buf = (BT_HDR *)p_ccb->xmit_hold_q.p_first;
   1672 
   1673     /* If there is more data than the MPS, it requires segmentation */
   1674     if (p_buf->len > max_pdu)
   1675     {
   1676         /* We are using the "event" field to tell is if we already started segmentation */
   1677         if (p_buf->event == 0)
   1678         {
   1679             first_seg = TRUE;
   1680             sdu_len   = p_buf->len;
   1681         }
   1682         else
   1683             mid_seg = TRUE;
   1684 
   1685         /* Get a new buffer and copy the data that can be sent in a PDU */
   1686         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
   1687                                     max_pdu, p_ccb->ertm_info.fcr_tx_pool_id);
   1688 
   1689         if (p_xmit != NULL)
   1690         {
   1691             p_buf->event  = p_ccb->local_cid;
   1692             p_xmit->event = p_ccb->local_cid;
   1693 
   1694             p_buf->len    -= max_pdu;
   1695             p_buf->offset += max_pdu;
   1696 
   1697             /* copy PBF setting */
   1698             p_xmit->layer_specific = p_buf->layer_specific;
   1699         }
   1700         else /* Should never happen if the application has configured buffers correctly */
   1701         {
   1702             L2CAP_TRACE_ERROR1 ("L2CAP - cannot get buffer, for segmentation, pool: %u", p_ccb->ertm_info.fcr_tx_pool_id);
   1703             return (NULL);
   1704         }
   1705     }
   1706     else    /* Use the original buffer if no segmentation, or the last segment */
   1707     {
   1708         p_xmit = (BT_HDR *)GKI_dequeue (&p_ccb->xmit_hold_q);
   1709 
   1710         if (p_xmit->event != 0)
   1711             last_seg = TRUE;
   1712 
   1713         p_xmit->event = p_ccb->local_cid;
   1714     }
   1715 
   1716     /* Step back to add the L2CAP headers */
   1717     p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
   1718     p_xmit->len    += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
   1719 
   1720     if (first_seg)
   1721     {
   1722         p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
   1723         p_xmit->len    += L2CAP_SDU_LEN_OVERHEAD;
   1724     }
   1725 
   1726     /* Set the pointer to the beginning of the data */
   1727     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
   1728 
   1729     /* Now the L2CAP header */
   1730 
   1731     /* Note: if FCS has to be included then the length is recalculated later */
   1732     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
   1733 
   1734     UINT16_TO_STREAM (p, p_ccb->remote_cid);
   1735 
   1736     if (first_seg)
   1737     {
   1738         /* Skip control word and add SDU length */
   1739         p += 2;
   1740         UINT16_TO_STREAM (p, sdu_len);
   1741 
   1742         /* We will store the SAR type in layer-specific */
   1743         /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
   1744         p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
   1745 
   1746         first_seg = FALSE;
   1747     }
   1748     else if (mid_seg)
   1749         p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
   1750     else if (last_seg)
   1751         p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
   1752     else
   1753         p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
   1754 
   1755     prepare_I_frame (p_ccb, p_xmit, FALSE);
   1756 
   1757     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
   1758     {
   1759         BT_HDR *p_wack = l2c_fcr_clone_buf (p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len, p_ccb->ertm_info.fcr_tx_pool_id);
   1760 
   1761         if (!p_wack)
   1762         {
   1763             L2CAP_TRACE_ERROR3 ("L2CAP - no buffer for xmit cloning, CID: 0x%04x  Pool: %u  Count: %u",
   1764                                 p_ccb->local_cid, p_ccb->ertm_info.fcr_tx_pool_id,  GKI_poolfreecount(p_ccb->ertm_info.fcr_tx_pool_id));
   1765 
   1766             /* We will not save the FCS in case we reconfigure and change options */
   1767             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1768                 p_xmit->len -= L2CAP_FCS_LEN;
   1769 
   1770             /* Pretend we sent it and it got lost */
   1771             GKI_enqueue (&p_ccb->fcrb.waiting_for_ack_q, p_xmit);
   1772             return (NULL);
   1773         }
   1774         else
   1775         {
   1776 #if (L2CAP_ERTM_STATS == TRUE)
   1777             /* set timestamp at the end of tx I-frame to get acking delay */
   1778             p = ((UINT8 *) (p_wack+1)) + p_wack->offset + p_wack->len;
   1779             UINT32_TO_STREAM (p, GKI_get_os_tick_count());
   1780 #endif
   1781             /* We will not save the FCS in case we reconfigure and change options */
   1782             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1783                 p_wack->len -= L2CAP_FCS_LEN;
   1784 
   1785             p_wack->layer_specific = p_xmit->layer_specific;
   1786             GKI_enqueue (&p_ccb->fcrb.waiting_for_ack_q, p_wack);
   1787         }
   1788 
   1789 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
   1790         {
   1791             UINT16 ctrl_word;
   1792             p = ((UINT8 *) (p_xmit+1)) + p_xmit->offset + L2CAP_PKT_OVERHEAD;
   1793             STREAM_TO_UINT16 (ctrl_word, p);
   1794 
   1795             /* Get out if packet was dropped; pretend it was sent */
   1796             if (l2c_corrupt_the_fcr_packet (p_ccb, p_xmit, FALSE, ctrl_word))
   1797                 return (NULL);
   1798         }
   1799 #endif
   1800 #if (L2CAP_ERTM_STATS == TRUE)
   1801         p_ccb->fcrb.ertm_pkt_counts[0]++;
   1802         p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
   1803 #endif
   1804 
   1805     }
   1806 
   1807     return (p_xmit);
   1808 }
   1809 
   1810 
   1811 /*******************************************************************************
   1812 ** Configuration negotiation functions
   1813 **
   1814 ** The following functions are used in negotiating channel modes during
   1815 ** configuration
   1816 ********************************************************************************/
   1817 
   1818 /*******************************************************************************
   1819 **
   1820 ** Function         l2c_fcr_chk_chan_modes
   1821 **
   1822 ** Description      Validates and adjusts if necessary, the FCR options
   1823 **                  based on remote EXT features.
   1824 **
   1825 **                  Note: This assumes peer EXT Features have been received.
   1826 **                      Basic mode is used if FCR Options have not been received
   1827 **
   1828 ** Returns          UINT8 - nonzero if can continue, '0' if no compatible channels
   1829 **
   1830 *******************************************************************************/
   1831 UINT8 l2c_fcr_chk_chan_modes (tL2C_CCB *p_ccb)
   1832 {
   1833     /* Remove nonbasic options that the peer does not support */
   1834     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
   1835         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
   1836 
   1837     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
   1838         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
   1839 
   1840     /* At least one type needs to be set (Basic, ERTM, STM) to continue */
   1841     if (!p_ccb->ertm_info.allowed_modes)
   1842     {
   1843         L2CAP_TRACE_WARNING0 ("L2CAP - Peer does not support our desired channel types");
   1844     }
   1845 
   1846     return (p_ccb->ertm_info.allowed_modes);
   1847 }
   1848 
   1849 /*******************************************************************************
   1850 **
   1851 ** Function         l2c_fcr_adj_our_req_options
   1852 **
   1853 ** Description      Validates and sets up the FCR options passed in from
   1854 **                  L2CA_ConfigReq based on remote device's features.
   1855 **
   1856 ** Returns          TRUE if no errors, Otherwise FALSE
   1857 **
   1858 *******************************************************************************/
   1859 BOOLEAN l2c_fcr_adj_our_req_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   1860 {
   1861     tL2CAP_FCR_OPTS *p_fcr = &p_cfg->fcr;
   1862 
   1863     if (p_fcr->mode != p_ccb->ertm_info.preferred_mode)
   1864     {
   1865         L2CAP_TRACE_WARNING2 ("l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match mode (%d)",
   1866                             p_ccb->ertm_info.preferred_mode, p_fcr->mode);
   1867 
   1868         /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override this one */
   1869         p_fcr->mode = p_ccb->ertm_info.preferred_mode;
   1870     }
   1871 
   1872     /* If upper layer did not request eRTM mode, BASIC must be used */
   1873     if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
   1874     {
   1875         if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE)
   1876         {
   1877             L2CAP_TRACE_WARNING1 ("l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set using BASIC mode", p_fcr->mode);
   1878         }
   1879         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   1880     }
   1881 
   1882     /* Process the FCR options if initial channel bring-up (not a reconfig request)
   1883     ** Determine initial channel mode to try based on our options and remote's features
   1884     */
   1885     if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG))
   1886     {
   1887         /* We need to have at least one mode type common with the peer */
   1888         if (!l2c_fcr_chk_chan_modes(p_ccb))
   1889         {
   1890             /* Two channels have incompatible supported types */
   1891             l2cu_disconnect_chnl (p_ccb);
   1892             return (FALSE);
   1893         }
   1894 
   1895         /* Basic is the only common channel mode between the two devices */
   1896         else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
   1897         {
   1898             /* We only want to try Basic, so bypass sending the FCR options entirely */
   1899             p_cfg->fcr_present = FALSE;
   1900             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
   1901             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
   1902         }
   1903 
   1904         /* We have at least one non-basic mode available
   1905          * Override mode from available mode options based on preference, if needed
   1906          */
   1907         else
   1908         {
   1909             /* If peer does not support STREAMING, try ERTM */
   1910             if (p_fcr->mode == L2CAP_FCR_STREAM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM))
   1911             {
   1912                 L2CAP_TRACE_DEBUG0 ("L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
   1913                 p_fcr->mode = L2CAP_FCR_ERTM_MODE;
   1914             }
   1915 
   1916             /* If peer does not support ERTM, try BASIC (will support this if made it here in the code) */
   1917             if (p_fcr->mode == L2CAP_FCR_ERTM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM))
   1918             {
   1919                 L2CAP_TRACE_DEBUG0 ("L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
   1920                 p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   1921             }
   1922         }
   1923 
   1924         if (p_fcr->mode != L2CAP_FCR_BASIC_MODE)
   1925         {
   1926             /* MTU must be smaller than buffer size */
   1927             if ( (p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu) )
   1928             {
   1929                 L2CAP_TRACE_WARNING2 ("L2CAP - MTU: %u  larger than buf size: %u", p_cfg->mtu, p_ccb->max_rx_mtu);
   1930                 return (FALSE);
   1931             }
   1932 
   1933             /* application want to use the default MPS */
   1934             if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS)
   1935             {
   1936                 p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
   1937             }
   1938             /* MPS must be less than MTU */
   1939             else if (p_fcr->mps > p_ccb->max_rx_mtu)
   1940             {
   1941                 L2CAP_TRACE_WARNING2 ("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps, p_ccb->max_rx_mtu);
   1942                 return (FALSE);
   1943             }
   1944 
   1945             /* We always initially read into the HCI buffer pool, so make sure it fits */
   1946             if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
   1947                 p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
   1948         }
   1949         else
   1950         {
   1951             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
   1952             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
   1953         }
   1954 
   1955         p_ccb->our_cfg.fcr = *p_fcr;
   1956     }
   1957     else    /* Not sure how to send a reconfiguration(??) should fcr be included? */
   1958     {
   1959         p_ccb->our_cfg.fcr_present = FALSE;
   1960     }
   1961 
   1962     return (TRUE);
   1963 }
   1964 
   1965 
   1966 /*******************************************************************************
   1967 **
   1968 ** Function         l2c_fcr_adj_monitor_retran_timeout
   1969 **
   1970 ** Description      Overrides monitor/retrans timer value based on controller
   1971 **
   1972 ** Returns          None
   1973 **
   1974 *******************************************************************************/
   1975 void l2c_fcr_adj_monitor_retran_timeout (tL2C_CCB *p_ccb)
   1976 {
   1977     /* adjust our monitor/retran timeout */
   1978     if (p_ccb->out_cfg_fcr_present)
   1979     {
   1980         /*
   1981         ** if we requestd ERTM or accepted ERTM
   1982         ** We may accept ERTM even if we didn't request ERTM, in case of requesting STREAM
   1983         */
   1984         if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
   1985           ||(p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE))
   1986         {
   1987             /* upper layer setting is ignored */
   1988             p_ccb->our_cfg.fcr.mon_tout    = L2CAP_MIN_MONITOR_TOUT;
   1989             p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
   1990         }
   1991         else
   1992         {
   1993             p_ccb->our_cfg.fcr.mon_tout    = 0;
   1994             p_ccb->our_cfg.fcr.rtrans_tout = 0;
   1995         }
   1996 
   1997         L2CAP_TRACE_DEBUG2 ("l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
   1998                              p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
   1999     }
   2000 }
   2001 /*******************************************************************************
   2002 **
   2003 ** Function         l2c_fcr_adj_our_rsp_options
   2004 **
   2005 ** Description      Overrides any neccesary FCR options passed in from
   2006 **                  L2CA_ConfigRsp based on our FCR options.
   2007 **                  Only makes adjustments if channel is in ERTM mode.
   2008 **
   2009 ** Returns          None
   2010 **
   2011 *******************************************************************************/
   2012 void l2c_fcr_adj_our_rsp_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2013 {
   2014     /* adjust our monitor/retran timeout */
   2015     l2c_fcr_adj_monitor_retran_timeout(p_ccb);
   2016 
   2017     p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
   2018 
   2019     if (p_cfg->fcr_present)
   2020     {
   2021 // btla-specific ++
   2022         /* Temporary - until a better algorithm is implemented */
   2023         /* If peer's tx_wnd_sz requires too many buffers for us to support, then adjust it. For now, respond with our own tx_wnd_sz. */
   2024         /* Note: peer is not guaranteed to obey our adjustment */
   2025         if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz)
   2026         {
   2027             L2CAP_TRACE_DEBUG3 ("%s: adjusting requested tx_win_sz from %i to %i", __FUNCTION__, p_ccb->peer_cfg.fcr.tx_win_sz, p_ccb->our_cfg.fcr.tx_win_sz);
   2028             p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2029         }
   2030 // btla-specific --
   2031 
   2032         p_cfg->fcr.mode         = p_ccb->peer_cfg.fcr.mode;
   2033         p_cfg->fcr.tx_win_sz    = p_ccb->peer_cfg.fcr.tx_win_sz;
   2034         p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
   2035         p_cfg->fcr.mps          = p_ccb->peer_cfg.fcr.mps;
   2036         p_cfg->fcr.rtrans_tout  = p_ccb->our_cfg.fcr.rtrans_tout;
   2037         p_cfg->fcr.mon_tout     = p_ccb->our_cfg.fcr.mon_tout;
   2038     }
   2039 }
   2040 
   2041 /*******************************************************************************
   2042 **
   2043 ** Function         l2c_fcr_renegotiate_chan
   2044 **
   2045 ** Description      Called upon unsuccessful peer response to config request.
   2046 **                  If the error is because of the channel mode, it will try
   2047 **                  to resend using another supported optional channel.
   2048 **
   2049 ** Returns          TRUE if resent configuration, False if channel matches or
   2050 **                  cannot match.
   2051 **
   2052 *******************************************************************************/
   2053 BOOLEAN l2c_fcr_renegotiate_chan(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2054 {
   2055     UINT8   peer_mode = p_ccb->our_cfg.fcr.mode;
   2056     BOOLEAN can_renegotiate;
   2057 
   2058     /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned */
   2059     if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
   2060         return (FALSE);
   2061 
   2062     /* Only retry if there are more channel options to try */
   2063     if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS)
   2064     {
   2065         peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
   2066 
   2067         if (p_ccb->our_cfg.fcr.mode != peer_mode)
   2068         {
   2069 
   2070             if ((--p_ccb->fcr_cfg_tries) == 0)
   2071             {
   2072                 p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
   2073                 L2CAP_TRACE_WARNING0 ("l2c_fcr_renegotiate_chan (Max retries exceeded)");
   2074             }
   2075 
   2076             can_renegotiate = FALSE;
   2077 
   2078             /* Try another supported mode if available based on our last attempted channel */
   2079             switch (p_ccb->our_cfg.fcr.mode)
   2080             {
   2081                 /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
   2082             case L2CAP_FCR_STREAM_MODE:
   2083                 /* Peer wants ERTM and we support it */
   2084                 if ( (peer_mode == L2CAP_FCR_ERTM_MODE) && (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
   2085                 {
   2086                     L2CAP_TRACE_DEBUG0 ("l2c_fcr_renegotiate_chan(Trying ERTM)");
   2087                     p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
   2088                     can_renegotiate = TRUE;
   2089                 }
   2090                 else    /* Falls through */
   2091 
   2092             case L2CAP_FCR_ERTM_MODE:
   2093                 {
   2094                     /* We can try basic for any other peer mode if we support it */
   2095                     if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC)
   2096                     {
   2097                         L2CAP_TRACE_DEBUG0 ("l2c_fcr_renegotiate_chan(Trying Basic)");
   2098                         can_renegotiate = TRUE;
   2099                         p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
   2100                     }
   2101                 }
   2102                 break;
   2103 
   2104             default:
   2105                 /* All other scenarios cannot be renegotiated */
   2106                 break;
   2107             }
   2108 
   2109             if (can_renegotiate)
   2110             {
   2111                 p_ccb->our_cfg.fcr_present = TRUE;
   2112 
   2113                 if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
   2114                 {
   2115                     p_ccb->our_cfg.fcs_present = FALSE;
   2116                     p_ccb->our_cfg.ext_flow_spec_present = FALSE;
   2117 
   2118                     /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
   2119                     if ( (p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE) )
   2120                     {
   2121                         L2CAP_TRACE_WARNING1 ("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
   2122                         p_cfg->mtu = L2CAP_MTU_SIZE;
   2123                     }
   2124                 }
   2125 
   2126                 l2cu_process_our_cfg_req (p_ccb, &p_ccb->our_cfg);
   2127                 l2cu_send_peer_config_req (p_ccb, &p_ccb->our_cfg);
   2128                 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_L2CAP_CHNL, L2CAP_CHNL_CFG_TIMEOUT);
   2129                 return (TRUE);
   2130             }
   2131         }
   2132     }
   2133 
   2134     /* Disconnect if the channels do not match */
   2135     if (p_ccb->our_cfg.fcr.mode != peer_mode)
   2136     {
   2137         L2CAP_TRACE_WARNING2 ("L2C CFG:  Channels incompatible (local %d, peer %d)",
   2138                               p_ccb->our_cfg.fcr.mode, peer_mode);
   2139         l2cu_disconnect_chnl (p_ccb);
   2140     }
   2141 
   2142     return (FALSE);
   2143 }
   2144 
   2145 
   2146 /*******************************************************************************
   2147 **
   2148 ** Function         l2c_fcr_process_peer_cfg_req
   2149 **
   2150 ** Description      This function is called to process the FCR options passed
   2151 **                  in the peer's configuration request.
   2152 **
   2153 ** Returns          UINT8 - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
   2154 **                          or L2CAP_PEER_CFG_DISCONNECT.
   2155 **
   2156 *******************************************************************************/
   2157 UINT8 l2c_fcr_process_peer_cfg_req(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2158 {
   2159     UINT16 max_retrans_size;
   2160     UINT8  fcr_ok = L2CAP_PEER_CFG_OK;
   2161 
   2162     p_ccb->p_lcb->w4_info_rsp = FALSE;      /* Handles T61x SonyEricsson Bug in Info Request */
   2163 
   2164     L2CAP_TRACE_EVENT5 ("l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR mode:%d preferred: %u allowed:%u",
   2165                         p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode, p_ccb->ertm_info.preferred_mode,
   2166                         p_ccb->ertm_info.allowed_modes);
   2167 
   2168     /* If Peer wants basic, we are done (accept it or disconnect) */
   2169     if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE)
   2170     {
   2171         /* If we do not allow basic, disconnect */
   2172         if ( !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) )
   2173             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2174     }
   2175 
   2176     /* Need to negotiate if our modes are not the same */
   2177     else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode)
   2178     {
   2179         /* If peer wants a mode that we don't support then retry our mode (ex. rtx/flc), OR
   2180         ** If we want ERTM and they wanted streaming retry our mode.
   2181         ** Note: If we have already determined they support our mode previously
   2182         **       from their EXF mask.
   2183         */
   2184         if ( (((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0)
   2185             || (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE) )
   2186         {
   2187             p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
   2188             p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2189             p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
   2190             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2191         }
   2192 
   2193         /* If we wanted basic, then try to renegotiate it */
   2194         else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE)
   2195         {
   2196             p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
   2197             p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
   2198             p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
   2199             p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout = p_ccb->our_cfg.fcr.mps = 0;
   2200             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2201         }
   2202 
   2203         /* Only other valid case is if they want ERTM and we wanted STM which should be
   2204            accepted if we support it; otherwise the channel should be disconnected */
   2205         else if ( (p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE)
   2206               || !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
   2207         {
   2208             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2209         }
   2210     }
   2211 
   2212     /* Configuration for FCR channels so make any adjustments and fwd to upper layer */
   2213     if (fcr_ok == L2CAP_PEER_CFG_OK)
   2214     {
   2215         /* by default don't need to send params in the response */
   2216         p_ccb->out_cfg_fcr_present = FALSE;
   2217 
   2218         /* Make any needed adjustments for the response to the peer */
   2219         if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE)
   2220         {
   2221             /* Peer desires to bypass FCS check, and streaming or ERTM mode */
   2222             if (p_cfg->fcs_present)
   2223             {
   2224                 p_ccb->peer_cfg.fcs = p_cfg->fcs;
   2225                 p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
   2226                 if( p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
   2227                     p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
   2228             }
   2229 
   2230             max_retrans_size = GKI_get_pool_bufsize (p_ccb->ertm_info.fcr_tx_pool_id) - sizeof(BT_HDR)
   2231                                             - L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET - L2CAP_FCS_LEN;
   2232 
   2233             /* Ensure the MPS is not bigger than the MTU */
   2234             if ( (p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu) )
   2235             {
   2236                 p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
   2237                 p_ccb->out_cfg_fcr_present = TRUE;
   2238             }
   2239 
   2240             /* Ensure the MPS is not bigger than our retransmission buffer */
   2241             if (p_cfg->fcr.mps > max_retrans_size)
   2242             {
   2243                 L2CAP_TRACE_DEBUG2("CFG: Overriding MPS to %d (orig %d)", max_retrans_size, p_cfg->fcr.mps);
   2244 
   2245                 p_cfg->fcr.mps = max_retrans_size;
   2246                 p_ccb->out_cfg_fcr_present = TRUE;
   2247             }
   2248 
   2249             if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE)
   2250             {
   2251                 /* Always respond with FCR ERTM parameters */
   2252                 p_ccb->out_cfg_fcr_present = TRUE;
   2253             }
   2254         }
   2255 
   2256         /* Everything ok, so save the peer's adjusted fcr options */
   2257         p_ccb->peer_cfg.fcr = p_cfg->fcr;
   2258 
   2259         if (p_cfg->fcr_present)
   2260             p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
   2261     }
   2262     else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE)
   2263     {
   2264         /* Allow peer only one retry for mode */
   2265         if (p_ccb->peer_cfg_already_rejected)
   2266             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2267         else
   2268             p_ccb->peer_cfg_already_rejected = TRUE;
   2269     }
   2270 
   2271     return (fcr_ok);
   2272 }
   2273 
   2274 
   2275 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
   2276 /*******************************************************************************
   2277 **  Functions used for testing ERTM mode
   2278 */
   2279 /* If FALSE, will also corrupt cid, length, control word, etc. */
   2280 #ifndef L2CAP_CORR_FCS_ONLY
   2281 #define L2CAP_CORR_FCS_ONLY TRUE
   2282 #endif
   2283 
   2284 #define L2C_DISP_FRAME_SIZE 16
   2285 /*******************************************************************************
   2286 **
   2287 ** Function         l2c_corrupt_the_fcr_packet
   2288 **
   2289 ** Description      This function is used for testing purposes only.
   2290 **                  It systematically or randomly corrupts packets used with
   2291 **                  ERTM channels.
   2292 **
   2293 ** Returns          BOOLEAN   TRUE if packet was dropped,
   2294 **                            FALSE if fcs corrupted or no corruption
   2295 **
   2296 *******************************************************************************/
   2297 static BOOLEAN l2c_corrupt_the_fcr_packet (tL2C_CCB *p_ccb, BT_HDR *p_buf,
   2298                                            BOOLEAN is_rx, UINT16 ctrl_word)
   2299 {
   2300     tL2C_FCR_TEST_CFG *p_cfg;
   2301     UINT32   tc;
   2302     UINT8   *p;
   2303     UINT32   xx;
   2304     char     buf[L2C_DISP_FRAME_SIZE];
   2305 
   2306     if (!p_ccb || !p_ccb->fcrb.test_cb.cfg.in_use)
   2307         return FALSE;
   2308 
   2309     /* Prepare bad FCS */
   2310     p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
   2311     tc = GKI_get_os_tick_count();
   2312     tc ^= p[p_buf->len - 1];
   2313     xx = tc % 47;
   2314 
   2315     p_cfg = &p_ccb->fcrb.test_cb.cfg;
   2316 #if 0
   2317     L2CAP_TRACE_DEBUG4 ("testcfg: type: %d, freq: %d (NRM-0, RDM-1), is_rx: %d, count: %d",
   2318         p_cfg->type, p_cfg->freq, p_cfg->is_rx, p_cfg->count);
   2319 #endif
   2320     /* If not time to corrupt get out */
   2321     if (p_cfg->freq == L2CAP_FCR_FREQ_RANDOM)
   2322     {
   2323         if (xx != 0)
   2324             return FALSE;
   2325     }
   2326     else    /* check test criteria before corrupting */
   2327     {
   2328         if ( (p_cfg->count == 0)
   2329           || (p_cfg->is_rx != is_rx)
   2330           || ((UINT8)(ctrl_word & L2CAP_FCR_S_FRAME_BIT) != p_cfg->type) )
   2331         {
   2332             return FALSE;
   2333         }
   2334 
   2335         /* Turn off if done */
   2336         if (--(p_cfg->count) == 0)
   2337         {
   2338             p_ccb->fcrb.test_cb.cfg.in_use = FALSE;
   2339         }
   2340     }
   2341 
   2342 #if L2CAP_CORR_FCS_ONLY == TRUE
   2343     /* Corrupt the FCS check */
   2344     p[p_buf->len - 1] = p[p_buf->len - 2] = 0;
   2345 #else
   2346     /* If made it this far packet needs to be corrupted */
   2347     xx = tc % p_buf->len;
   2348 
   2349     /* Make sure the value was changed */
   2350     if (p[xx + 1] == 0)
   2351         p[xx + 1] = 0x5A;
   2352 
   2353     p[xx] = p[xx] ^ p[xx + 1];
   2354 
   2355 #if 1   /* Enable if not wishing to corrupting frame type */
   2356     {
   2357         UINT8 *p_temp = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
   2358         p_temp += L2CAP_PKT_OVERHEAD;
   2359         if ((UINT16)((*p_temp) & 0x01) != (ctrl_word & 0x0001))
   2360         {
   2361             (*p_temp) |= (UINT8)(ctrl_word & 0x0001);
   2362         }
   2363     }
   2364 #endif
   2365 #endif
   2366 
   2367     if (is_rx)
   2368     {
   2369         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
   2370             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Rx S-Frame");
   2371         else
   2372             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Rx I-Frame");
   2373     }
   2374     else
   2375     {
   2376         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
   2377             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Tx S-Frame");
   2378         else
   2379             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Tx I-Frame");
   2380     }
   2381 
   2382     /* Lastly, just drop packet if FCS is not being used or if Tx */
   2383     if (!is_rx || p_ccb->bypass_fcs == L2CAP_BYPASS_FCS)
   2384     {
   2385         L2CAP_TRACE_ERROR6 ("-=-=-=-=-=-=-=-   Dropping %s packet (0x%04x) tc: %u  Buf Len: %u  xx: %u  count: %d",
   2386                         buf, (UINT32)p_buf, tc, p_buf->len, xx, p_cfg->count);
   2387         GKI_freebuf(p_buf);
   2388         return TRUE;
   2389     }
   2390     else
   2391     {
   2392         L2CAP_TRACE_ERROR6 ("-=-=-=-=-=-=-=-   Corrupting %s packet (0x%04x) tc: %u  Buf Len: %u  xx: %u  count: %d",
   2393                         buf, (UINT32)p_buf, tc, p_buf->len, xx, p_cfg->count);
   2394     }
   2395 
   2396     return FALSE;
   2397 }
   2398 
   2399 
   2400 /*******************************************************************************
   2401 **
   2402 ** Function         L2CA_SetupErtmTest
   2403 **
   2404 ** Description      This function is used for testing purposes only.
   2405 **                  It corrupts or drops one or more packets used with ERTM channels.
   2406 **
   2407 ** Parameters
   2408 **                  cid - channel ID  (0 uses RFCOMM PSM's CID)
   2409 **
   2410 **                  type - type of test to run (L2CAP_FCR_TTYPE_CORR_IFRAMES
   2411 **                                              L2CAP_FCR_TTYPE_CORR_SFRAME
   2412 **                                              L2CAP_FCR_TTYPE_STOP_TEST
   2413 **                                              L2CAP_FCR_TTYPE_GET_CID - returns rfcomm cid only)
   2414 **
   2415 **                  is_rx  - TRUE to corrupt Rx packet, FALSE for Tx packet)
   2416 **
   2417 **                  freq - L2CAP_FCR_FREQ_RANDOM    (turns on random corruptions/drops)
   2418 **                         L2CAP_FCR_FREQ_NORMAL    (turns on test with "count" corruptions/drops)
   2419 **
   2420 **                  count - number of packets in a row to drop or corrupt
   2421 **
   2422 ** Returns          CID of channel running test
   2423 **
   2424 *******************************************************************************/
   2425 UINT16 L2CA_SetupErtmTest (UINT16 cid, UINT8 type, BOOLEAN is_rx, UINT8 freq, UINT16 count)
   2426 {
   2427     tL2C_CCB *p_ccb = NULL;
   2428     tL2C_CCB *p_temp_ccb;
   2429     tL2C_FCR_TEST_CB *p_test_cb;
   2430     UINT16 xx;
   2431 
   2432     /* If '0' tests run on top of RFCOMM CID if active */
   2433     if (cid == 0)
   2434     {
   2435         p_temp_ccb = l2cb.ccb_pool;
   2436         for (xx = 0; xx < MAX_L2CAP_CHANNELS; xx++, p_temp_ccb++)
   2437         {
   2438             /* Fixed channels don't have p_rcb's */
   2439             if (p_temp_ccb->in_use && p_temp_ccb->p_rcb && p_temp_ccb->p_rcb->psm == BT_PSM_RFCOMM)
   2440             {
   2441                 p_ccb = p_temp_ccb;
   2442                 cid = L2CAP_BASE_APPL_CID + xx;
   2443                 break;
   2444             }
   2445         }
   2446     }
   2447     else
   2448         p_ccb = l2cu_find_ccb_by_cid (NULL, cid);
   2449 
   2450     if (!p_ccb || type == L2CAP_FCR_TTYPE_GET_CID)
   2451     {
   2452         if (type == L2CAP_FCR_TTYPE_GET_CID)
   2453         {
   2454             L2CAP_TRACE_API1 ("L2CA_SetupErtmTest (GET_CID): cid = 0x%04x", cid);
   2455         }
   2456         return (cid);
   2457     }
   2458 
   2459     p_test_cb = &p_ccb->fcrb.test_cb;
   2460 
   2461     /* Turn off the current test */
   2462     if (type == L2CAP_FCR_TTYPE_STOP_TEST)
   2463     {
   2464         if (p_test_cb->cfg.in_use)
   2465         {
   2466             L2CAP_TRACE_ERROR1 ("L2CA_SetupErtmTest (OFF): cid 0x%04x", cid);
   2467         }
   2468         p_test_cb->cfg.in_use = FALSE;
   2469         p_test_cb->cfg.count = 0;
   2470     }
   2471 
   2472     /* Process the new request */
   2473     else if (!p_test_cb->cfg.in_use)
   2474     {
   2475         /* count must be positive unless random is used */
   2476         if (!count && freq != L2CAP_FCR_FREQ_RANDOM)
   2477         {
   2478             L2CAP_TRACE_ERROR1 ("L2CA_SetupErtmTest (FAIL): Count = 0, freq = %d", freq);
   2479             return (cid);
   2480         }
   2481 
   2482         L2CAP_TRACE_ERROR5 ("L2CA_SetupErtmTest (START): cid 0x%04x, type %d, is_rx %d, freq %d, count %d",
   2483                             cid, type, is_rx, freq, count);
   2484 
   2485         p_test_cb->cfg.in_use = TRUE;
   2486         p_test_cb->cfg.freq = freq;
   2487         p_test_cb->cfg.type = type;
   2488         p_test_cb->cfg.is_rx = is_rx;
   2489         p_test_cb->cfg.count = count;
   2490     }
   2491     else /* Test already in progress so ignore */
   2492     {
   2493         L2CAP_TRACE_ERROR5 ("L2CA_SetupErtmTest (ignoring): cid 0x%04x, type %d, is_rx %d, freq %d, count %d",
   2494                             cid, type, is_rx, freq, count);
   2495     }
   2496 
   2497     return (cid);
   2498 }
   2499 
   2500 
   2501 /*******************************************************************************
   2502 ** The following routines are only used in conjunction with Conformance testing
   2503 ********************************************************************************/
   2504 
   2505 /*******************************************************************************
   2506 **
   2507 ** Function         L2CA_SendPolledSFrame
   2508 **
   2509 ** Description      This function is used for testing purposes only.
   2510 **                  It Sends a Polled RR or RNR to the peer
   2511 **
   2512 ** Parameters
   2513 **                  cid - channel ID
   2514 **
   2515 **                  sup_type - (L2CAP_FCR_SUP_RR or L2CAP_FCR_SUP_RNR)
   2516 **
   2517 ** Returns          void
   2518 **
   2519 *******************************************************************************/
   2520 void L2CA_SendPolledSFrame (UINT16 cid, UINT16 sup_type)
   2521 {
   2522     tL2C_CCB *p_ccb = l2cu_find_ccb_by_cid (NULL, cid);
   2523 
   2524     if (p_ccb && (sup_type == L2CAP_FCR_SUP_RR || sup_type == L2CAP_FCR_SUP_RNR))
   2525     {
   2526         l2c_fcr_send_S_frame (p_ccb, sup_type, L2CAP_FCR_P_BIT);
   2527     }
   2528     else
   2529     {
   2530         L2CAP_TRACE_ERROR2 ("L2CA_SendPolledSFrame(ERROR): sup_type %u, p_ccb 0x%07x",
   2531                             sup_type, (UINT32)p_ccb);
   2532     }
   2533 }
   2534 
   2535 /*******************************************************************************
   2536 **
   2537 ** Function         l2c_bypass_sframe_packet
   2538 **
   2539 ** Description      This function is used for testing purposes only.
   2540 **                  It returns TRUE if S-Frame should be bypassed.
   2541 **
   2542 ** Returns          void
   2543 **
   2544 *******************************************************************************/
   2545 static BOOLEAN l2c_bypass_sframe_packet (tL2C_CCB *p_ccb)
   2546 {
   2547     if (p_ccb && p_ccb->fcrb.test_cb.cfm.in_use)
   2548     {
   2549         if (p_ccb->fcrb.test_cb.cfm.skip_sframe_count > 0)
   2550         {
   2551             L2CAP_TRACE_ERROR1 ("l2c_bypass_sframe_packet (count %d)",
   2552                                 p_ccb->fcrb.test_cb.cfm.skip_sframe_count);
   2553 
   2554             if (--p_ccb->fcrb.test_cb.cfm.skip_sframe_count == 0)
   2555                 p_ccb->fcrb.test_cb.cfm.in_use = FALSE;
   2556 
   2557             /* Bypass sending S-Frame */
   2558             return TRUE;
   2559         }
   2560         else
   2561             p_ccb->fcrb.test_cb.cfm.in_use = FALSE;
   2562     }
   2563 
   2564     return FALSE;
   2565 }
   2566 
   2567 /*******************************************************************************
   2568 **
   2569 ** Function         L2CA_BypassSFrame
   2570 **
   2571 ** Description      This function is used for testing purposes only.
   2572 **                  It skips sending 'count' S-Frames.
   2573 **
   2574 ** Parameters
   2575 **                  cid - channel ID
   2576 **
   2577 **                  count - Number of S-Frames to skip sending
   2578 **
   2579 ** Returns          void
   2580 **
   2581 *******************************************************************************/
   2582 void L2CA_BypassSFrame (UINT16 cid, UINT8 count)
   2583 {
   2584     tL2C_CCB *p_ccb = l2cu_find_ccb_by_cid (NULL, cid);
   2585     tL2C_FCR_CFM_TEST_CB *p_test_cb;
   2586 
   2587     if (!p_ccb)
   2588     {
   2589         L2CAP_TRACE_WARNING1 ("L2CA_BypassSFrame(ERROR): no p_ccb (0x%07x)", (UINT32)p_ccb);
   2590         return;
   2591     }
   2592 
   2593     p_test_cb = &p_ccb->fcrb.test_cb.cfm;
   2594 
   2595     /* Initiate test if not active */
   2596     if (!p_test_cb->in_use)
   2597     {
   2598         p_test_cb->in_use = TRUE;
   2599         p_test_cb->skip_sframe_count = count;
   2600     }
   2601     else
   2602     {
   2603         L2CAP_TRACE_WARNING0 ("L2CA_BypassSFrame(ERROR): already in use (ignoring...)");
   2604     }
   2605 }
   2606 
   2607 #endif  /* L2CAP_CORRUPT_ERTM_PKTS == TRUE */
   2608 
   2609 #if (L2CAP_ERTM_STATS == TRUE)
   2610 /*******************************************************************************
   2611 **
   2612 ** Function         l2c_fcr_collect_ack_delay
   2613 **
   2614 ** Description      collect throughput, delay, queue size of waiting ack
   2615 **
   2616 ** Parameters
   2617 **                  tL2C_CCB
   2618 **
   2619 ** Returns          void
   2620 **
   2621 *******************************************************************************/
   2622 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
   2623 {
   2624     UINT32  index;
   2625     BT_HDR *p_buf;
   2626     UINT8  *p;
   2627     UINT32  timestamp, delay;
   2628     UINT8   xx;
   2629     UINT8   str[120];
   2630 
   2631     index = p_ccb->fcrb.ack_delay_avg_index;
   2632 
   2633     /* update sum, max and min of waiting for ack queue size */
   2634     p_ccb->fcrb.ack_q_count_avg[index] += p_ccb->fcrb.waiting_for_ack_q.count;
   2635 
   2636     if ( p_ccb->fcrb.waiting_for_ack_q.count > p_ccb->fcrb.ack_q_count_max[index] )
   2637         p_ccb->fcrb.ack_q_count_max[index] = p_ccb->fcrb.waiting_for_ack_q.count;
   2638 
   2639     if ( p_ccb->fcrb.waiting_for_ack_q.count < p_ccb->fcrb.ack_q_count_min[index] )
   2640         p_ccb->fcrb.ack_q_count_min[index] = p_ccb->fcrb.waiting_for_ack_q.count;
   2641 
   2642     /* update sum, max and min of round trip delay of acking */
   2643     p_buf = (BT_HDR *)(p_ccb->fcrb.waiting_for_ack_q.p_first);
   2644     for (xx = 0; (xx < num_bufs_acked)&&(p_buf); xx++)
   2645     {
   2646         /* adding up length of acked I-frames to get throughput */
   2647         p_ccb->fcrb.throughput[index] += p_buf->len - 8;
   2648 
   2649         if ( xx == num_bufs_acked - 1 )
   2650         {
   2651             /* get timestamp from tx I-frame that receiver is acking */
   2652             p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
   2653             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   2654             {
   2655                 p += L2CAP_FCS_LEN;
   2656             }
   2657 
   2658             STREAM_TO_UINT32 (timestamp, p);
   2659             delay = GKI_get_os_tick_count() - timestamp;
   2660 
   2661             p_ccb->fcrb.ack_delay_avg[index] += delay;
   2662             if ( delay > p_ccb->fcrb.ack_delay_max[index] )
   2663                 p_ccb->fcrb.ack_delay_max[index] = delay;
   2664             if ( delay < p_ccb->fcrb.ack_delay_min[index] )
   2665                 p_ccb->fcrb.ack_delay_min[index] = delay;
   2666         }
   2667 
   2668         p_buf = GKI_getnext(p_buf);
   2669     }
   2670 
   2671     p_ccb->fcrb.ack_delay_avg_count++;
   2672 
   2673     /* calculate average and initialize next avg, min and max */
   2674     if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES)
   2675     {
   2676         p_ccb->fcrb.ack_delay_avg_count = 0;
   2677 
   2678         p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2679         p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2680 
   2681         /* calculate throughput */
   2682         timestamp = GKI_get_os_tick_count();
   2683         if (timestamp - p_ccb->fcrb.throughput_start > 0 )
   2684             p_ccb->fcrb.throughput[index] /= (timestamp - p_ccb->fcrb.throughput_start);
   2685 
   2686         p_ccb->fcrb.throughput_start = timestamp;
   2687 
   2688         sprintf(str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
   2689                 index, p_ccb->fcrb.throughput[index],
   2690                 p_ccb->fcrb.ack_delay_avg[index], p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
   2691                 p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index], p_ccb->fcrb.ack_q_count_max[index] );
   2692 
   2693         BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", str);
   2694 
   2695         index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
   2696         p_ccb->fcrb.ack_delay_avg_index = index;
   2697 
   2698         p_ccb->fcrb.ack_q_count_max[index] = 0;
   2699         p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
   2700         p_ccb->fcrb.ack_q_count_avg[index] = 0;
   2701 
   2702 
   2703         p_ccb->fcrb.ack_delay_max[index] = 0;
   2704         p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
   2705         p_ccb->fcrb.ack_delay_avg[index] = 0;
   2706 
   2707         p_ccb->fcrb.throughput[index] = 0;
   2708     }
   2709 }
   2710 #endif
   2711 
   2712 
   2713 
   2714