Home | History | Annotate | Download | only in l2cap
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
     22  *  functions
     23  *
     24  ******************************************************************************/
     25 
     26 #include <assert.h>
     27 #include <stdio.h>
     28 #include <stdlib.h>
     29 #include <string.h>
     30 
     31 #include "bt_types.h"
     32 #include "gki.h"
     33 #include "hcimsgs.h"
     34 #include "l2c_api.h"
     35 #include "l2c_int.h"
     36 #include "l2cdefs.h"
     37 #include "btm_api.h"
     38 #include "btm_int.h"
     39 #include "btu.h"
     40 
     41 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted */
     42 #define L2C_FCR_RETX_ALL_PKTS   0xFF
     43 
     44 #if BT_TRACE_VERBOSE == TRUE
     45 static char *SAR_types[] = { "Unsegmented", "Start", "End", "Continuation" };
     46 static char *SUP_types[] = { "RR", "REJ", "RNR", "SREJ" };
     47 #endif
     48 
     49 /* Look-up table for the CRC calculation */
     50 static const unsigned short crctab[256] = {
     51     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241,
     52     0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
     53     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40,
     54     0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
     55     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40,
     56     0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
     57     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641,
     58     0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
     59     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
     60     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
     61     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41,
     62     0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
     63     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41,
     64     0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
     65     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640,
     66     0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
     67     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240,
     68     0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
     69     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41,
     70     0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
     71     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41,
     72     0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
     73     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640,
     74     0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
     75     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241,
     76     0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
     77     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
     78     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
     79     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40,
     80     0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
     81     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641,
     82     0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
     83 };
     84 
     85 
     86 /*******************************************************************************
     87 **  Static local functions
     88 */
     89 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word);
     90 static void    process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
     91 static void    process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack);
     92 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq);
     93 static void    prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission);
     94 static void    process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf);
     95 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
     96 
     97 #if (L2CAP_ERTM_STATS == TRUE)
     98 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked);
     99 #endif
    100 
    101 /*******************************************************************************
    102 **
    103 ** Function         l2c_fcr_updcrc
    104 **
    105 ** Description      This function computes the CRC using the look-up table.
    106 **
    107 ** Returns          CRC
    108 **
    109 *******************************************************************************/
    110 static unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char *icp, int icnt)
    111 {
    112     register unsigned short crc = icrc;
    113     register unsigned char  *cp = icp;
    114     register          int   cnt = icnt;
    115 
    116     while (cnt--)
    117     {
    118         crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
    119     }
    120 
    121     return(crc);
    122 }
    123 
    124 
    125 /*******************************************************************************
    126 **
    127 ** Function         l2c_fcr_tx_get_fcs
    128 **
    129 ** Description      This function computes the CRC for a frame to be TXed.
    130 **
    131 ** Returns          CRC
    132 **
    133 *******************************************************************************/
    134 static UINT16 l2c_fcr_tx_get_fcs (BT_HDR *p_buf)
    135 {
    136     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
    137 
    138     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len));
    139 }
    140 
    141 /*******************************************************************************
    142 **
    143 ** Function         l2c_fcr_rx_get_fcs
    144 **
    145 ** Description      This function computes the CRC for a received frame.
    146 **
    147 ** Returns          CRC
    148 **
    149 *******************************************************************************/
    150 static UINT16 l2c_fcr_rx_get_fcs (BT_HDR *p_buf)
    151 {
    152     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
    153 
    154     /* offset points past the L2CAP header, but the CRC check includes it */
    155     p -= L2CAP_PKT_OVERHEAD;
    156 
    157     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
    158 }
    159 
    160 /*******************************************************************************
    161 **
    162 ** Function         l2c_fcr_start_timer
    163 **
    164 ** Description      This function starts the (monitor or retransmission) timer.
    165 **
    166 ** Returns          -
    167 **
    168 *******************************************************************************/
    169 void l2c_fcr_start_timer (tL2C_CCB *p_ccb)
    170 {
    171     assert(p_ccb != NULL);
    172     UINT32  tout;
    173 
    174     /* The timers which are in milliseconds */
    175     if (p_ccb->fcrb.wait_ack)
    176     {
    177         tout = (UINT32)p_ccb->our_cfg.fcr.mon_tout;
    178     }
    179     else
    180     {
    181         tout = (UINT32)p_ccb->our_cfg.fcr.rtrans_tout;
    182     }
    183 
    184     /* Only start a timer that was not started */
    185     if (p_ccb->fcrb.mon_retrans_timer.in_use == 0)
    186         btu_start_quick_timer (&p_ccb->fcrb.mon_retrans_timer, BTU_TTYPE_L2CAP_CHNL, tout*QUICK_TIMER_TICKS_PER_SEC/1000);
    187 }
    188 
    189 /*******************************************************************************
    190 **
    191 ** Function         l2c_fcr_stop_timer
    192 **
    193 ** Description      This function stops the (monitor or transmission) timer.
    194 **
    195 ** Returns          -
    196 **
    197 *******************************************************************************/
    198 void l2c_fcr_stop_timer (tL2C_CCB *p_ccb)
    199 {
    200     assert(p_ccb != NULL);
    201     if (p_ccb->fcrb.mon_retrans_timer.in_use)
    202     {
    203         btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
    204     }
    205 }
    206 
    207 /*******************************************************************************
    208 **
    209 ** Function         l2c_fcr_cleanup
    210 **
    211 ** Description      This function cleans up the variable used for flow-control/retrans.
    212 **
    213 ** Returns          -
    214 **
    215 *******************************************************************************/
    216 void l2c_fcr_cleanup (tL2C_CCB *p_ccb)
    217 {
    218     assert(p_ccb != NULL);
    219     tL2C_FCRB *p_fcrb = &p_ccb->fcrb;
    220 
    221     l2c_fcr_stop_timer (p_ccb);
    222 
    223     if (p_fcrb->p_rx_sdu)
    224         GKI_freebuf (p_fcrb->p_rx_sdu);
    225 
    226     while (!GKI_queue_is_empty(&p_fcrb->waiting_for_ack_q))
    227         GKI_freebuf (GKI_dequeue (&p_fcrb->waiting_for_ack_q));
    228 
    229     while (!GKI_queue_is_empty(&p_fcrb->srej_rcv_hold_q))
    230         GKI_freebuf (GKI_dequeue (&p_fcrb->srej_rcv_hold_q));
    231 
    232     while (!GKI_queue_is_empty(&p_fcrb->retrans_q))
    233         GKI_freebuf (GKI_dequeue (&p_fcrb->retrans_q));
    234 
    235     btu_stop_quick_timer (&p_fcrb->ack_timer);
    236     btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
    237 
    238 #if (L2CAP_ERTM_STATS == TRUE)
    239     if ( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID) && (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) )
    240     {
    241         UINT32  dur = GKI_get_os_tick_count() - p_ccb->fcrb.connect_tick_count;
    242         char    *p_str = (char *)GKI_getbuf(120);
    243         UINT16  i;
    244         UINT32  throughput_avg, ack_delay_avg, ack_q_count_avg;
    245 
    246         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    247                    "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums", p_ccb->local_cid, dur);
    248         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    249                    "Retransmissions:%08u Times Flow Controlled:%08u Retrans Touts:%08u Ack Touts:%08u",
    250                     p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed, p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
    251         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    252                    "Times there is less than 2 packets in controller when flow controlled:%08u", p_ccb->fcrb.controller_idle);
    253         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    254                    "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u", p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz );
    255         if (p_str)
    256         {
    257             sprintf(p_str, "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
    258                 p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
    259                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
    260                 p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1], p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
    261 
    262             BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    263 
    264             sprintf(p_str, "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
    265                 p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
    266                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
    267                 p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1], p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
    268 
    269             BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    270 
    271             throughput_avg  = 0;
    272             ack_delay_avg   = 0;
    273             ack_q_count_avg = 0;
    274 
    275             for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++ )
    276             {
    277                 if (i == p_ccb->fcrb.ack_delay_avg_index )
    278                 {
    279                     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    280                            "[%02u] collecting data ...", i );
    281                     continue;
    282                 }
    283 
    284                 sprintf(p_str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
    285                         i, p_ccb->fcrb.throughput[i],
    286                         p_ccb->fcrb.ack_delay_avg[i], p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
    287                         p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i], p_ccb->fcrb.ack_q_count_max[i] );
    288 
    289                 BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    290 
    291                 throughput_avg  += p_ccb->fcrb.throughput[i];
    292                 ack_delay_avg   += p_ccb->fcrb.ack_delay_avg[i];
    293                 ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
    294             }
    295 
    296             throughput_avg  /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    297             ack_delay_avg   /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    298             ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    299 
    300             BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    301                    "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, ack_q_count_avg: %8u",
    302                     throughput_avg, ack_delay_avg, ack_q_count_avg );
    303 
    304             GKI_freebuf(p_str);
    305         }
    306 
    307         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    308                    "---");
    309     }
    310 #endif
    311 
    312     memset (p_fcrb, 0, sizeof (tL2C_FCRB));
    313 }
    314 
    315 /*******************************************************************************
    316 **
    317 ** Function         l2c_fcr_clone_buf
    318 **
    319 ** Description      This function allocates and copies requested part of a buffer
    320 **                  at a new-offset.
    321 **
    322 ** Returns          pointer to new buffer
    323 **
    324 *******************************************************************************/
    325 BT_HDR *l2c_fcr_clone_buf (BT_HDR *p_buf, UINT16 new_offset, UINT16 no_of_bytes, UINT8 pool)
    326 {
    327     assert(p_buf != NULL);
    328     BT_HDR *p_buf2;
    329 
    330     /* If using the common pool, should be at least 10% free. */
    331     if ( (pool == HCI_ACL_POOL_ID) && (GKI_poolutilization (pool) > 90) )
    332     {
    333         L2CAP_TRACE_ERROR ("L2CAP - failed to clone buffer on HCI_ACL_POOL_ID Utilization: %u", GKI_poolutilization(pool));
    334         return (NULL);
    335     }
    336 
    337     if ((p_buf2 = (BT_HDR *)GKI_getpoolbuf(pool)) != NULL)
    338     {
    339         UINT16    pool_buf_size = GKI_get_pool_bufsize (pool);
    340 
    341         /* Make sure buffer fits into buffer pool */
    342         if ((no_of_bytes + sizeof(BT_HDR) + new_offset) > pool_buf_size)
    343         {
    344             L2CAP_TRACE_ERROR("##### l2c_fcr_clone_buf (NumBytes %d) -> Exceeds poolsize %d [bytes %d + BT_HDR %d + offset %d]",
    345                                (no_of_bytes + sizeof(BT_HDR) + new_offset),
    346                                pool_buf_size, no_of_bytes, sizeof(BT_HDR),
    347                                new_offset);
    348 
    349             GKI_freebuf(p_buf2);
    350             return (NULL);
    351         }
    352 
    353         p_buf2->offset = new_offset;
    354         p_buf2->len    = no_of_bytes;
    355 
    356         memcpy (((UINT8 *)(p_buf2 + 1)) + p_buf2->offset,
    357                 ((UINT8 *)(p_buf + 1))  + p_buf->offset,
    358                 no_of_bytes);
    359     }
    360     else
    361     {
    362         L2CAP_TRACE_ERROR ("L2CAP - failed to clone buffer, Pool: %u  Count: %u", pool,  GKI_poolfreecount(pool));
    363     }
    364 
    365     return (p_buf2);
    366 }
    367 
    368 /*******************************************************************************
    369 **
    370 ** Function         l2c_fcr_is_flow_controlled
    371 **
    372 ** Description      This function checks if the CCB is flow controlled by peer.
    373 **
    374 ** Returns          The control word
    375 **
    376 *******************************************************************************/
    377 BOOLEAN l2c_fcr_is_flow_controlled (tL2C_CCB *p_ccb)
    378 {
    379     assert(p_ccb != NULL);
    380     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    381     {
    382         /* Check if remote side flowed us off or the transmit window is full */
    383         if ( (p_ccb->fcrb.remote_busy == TRUE)
    384          ||  (GKI_queue_length(&p_ccb->fcrb.waiting_for_ack_q) >= p_ccb->peer_cfg.fcr.tx_win_sz) )
    385         {
    386 #if (L2CAP_ERTM_STATS == TRUE)
    387             if (!GKI_queue_is_empty(&p_ccb->xmit_hold_q))
    388             {
    389                 p_ccb->fcrb.xmit_window_closed++;
    390 
    391                 if ((p_ccb->p_lcb->sent_not_acked < 2)&&(l2cb.controller_xmit_window > 0))
    392                     p_ccb->fcrb.controller_idle++;
    393             }
    394 #endif
    395             return (TRUE);
    396         }
    397     }
    398     return (FALSE);
    399 }
    400 
    401 /*******************************************************************************
    402 **
    403 ** Function         prepare_I_frame
    404 **
    405 ** Description      This function sets the FCR variables in an I-frame that is
    406 **                  about to be sent to HCI for transmission. This may be the
    407 **                  first time the I-frame is sent, or a retransmission
    408 **
    409 ** Returns          -
    410 **
    411 *******************************************************************************/
    412 static void prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission)
    413 {
    414     assert(p_ccb != NULL);
    415     assert(p_buf != NULL);
    416     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
    417     UINT8       *p;
    418     UINT16      fcs;
    419     UINT16      ctrl_word;
    420     BOOLEAN     set_f_bit = p_fcrb->send_f_rsp;
    421 
    422     p_fcrb->send_f_rsp = FALSE;
    423 
    424     if (is_retransmission)
    425     {
    426         /* Get the old control word and clear out the old req_seq and F bits */
    427         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    428 
    429         STREAM_TO_UINT16 (ctrl_word, p);
    430 
    431         ctrl_word  &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
    432     }
    433     else
    434     {
    435         ctrl_word  = p_buf->layer_specific & L2CAP_FCR_SEG_BITS;                /* SAR bits */
    436         ctrl_word |= (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT);      /* Tx Seq */
    437 
    438         p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
    439     }
    440 
    441     /* Set the F-bit and reqseq only if using re-transmission mode */
    442     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    443     {
    444         if (set_f_bit)
    445             ctrl_word |= L2CAP_FCR_F_BIT;
    446 
    447         ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    448 
    449         p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
    450 
    451         if (p_ccb->fcrb.ack_timer.in_use)
    452             btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
    453     }
    454 
    455     /* Set the control word */
    456     p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    457 
    458     UINT16_TO_STREAM (p, ctrl_word);
    459 
    460     /* Compute the FCS and add to the end of the buffer if not bypassed */
    461     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    462     {
    463         /* length field in l2cap header has to include FCS length */
    464         p = ((UINT8 *) (p_buf+1)) + p_buf->offset;
    465         UINT16_TO_STREAM (p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
    466 
    467         /* Calculate the FCS */
    468         fcs = l2c_fcr_tx_get_fcs(p_buf);
    469 
    470         /* Point to the end of the buffer and put the FCS there */
    471         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
    472 
    473         UINT16_TO_STREAM (p, fcs);
    474 
    475         p_buf->len += L2CAP_FCS_LEN;
    476     }
    477 
    478 #if BT_TRACE_VERBOSE == TRUE
    479     if (is_retransmission)
    480     {
    481         L2CAP_TRACE_EVENT ("L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  ReqSeq: %u  F: %u",
    482                             p_ccb->local_cid, p_buf->len,
    483                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    484                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    485                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    486                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    487     }
    488     else
    489     {
    490         L2CAP_TRACE_EVENT ("L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
    491                             p_ccb->local_cid, p_buf->len,
    492                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    493                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    494                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    495                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    496     }
    497 #endif
    498 
    499     /* Start the retransmission timer if not already running */
    500     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    501         l2c_fcr_start_timer (p_ccb);
    502 }
    503 
    504 /*******************************************************************************
    505 **
    506 ** Function         l2c_fcr_send_S_frame
    507 **
    508 ** Description      This function formats and sends an S-frame for transmission.
    509 **
    510 ** Returns          -
    511 **
    512 *******************************************************************************/
    513 void l2c_fcr_send_S_frame (tL2C_CCB *p_ccb, UINT16 function_code, UINT16 pf_bit)
    514 {
    515     assert(p_ccb != NULL);
    516     BT_HDR      *p_buf;
    517     UINT8       *p;
    518     UINT16      ctrl_word;
    519     UINT16      fcs;
    520 
    521     if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN))
    522         return;
    523 
    524 #if (L2CAP_ERTM_STATS == TRUE)
    525      p_ccb->fcrb.s_frames_sent[function_code]++;
    526 #endif
    527 
    528     if (pf_bit == L2CAP_FCR_P_BIT)
    529     {
    530         p_ccb->fcrb.wait_ack = TRUE;
    531 
    532         l2c_fcr_stop_timer (p_ccb);         /* Restart the monitor timer */
    533         l2c_fcr_start_timer (p_ccb);
    534     }
    535 
    536     /* Create the control word to use */
    537     ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
    538     ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
    539     ctrl_word |= pf_bit;
    540 
    541     if ((p_buf = (BT_HDR *)GKI_getpoolbuf (L2CAP_CMD_POOL_ID)) != NULL)
    542     {
    543         p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
    544         p_buf->len    = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
    545 
    546         /* Set the pointer to the beginning of the data */
    547         p = (UINT8 *)(p_buf + 1) + p_buf->offset;
    548 
    549         /* Put in the L2CAP header */
    550         UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
    551         UINT16_TO_STREAM (p, p_ccb->remote_cid);
    552         UINT16_TO_STREAM (p, ctrl_word);
    553 
    554         /* Compute the FCS and add to the end of the buffer if not bypassed */
    555         if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    556         {
    557             fcs = l2c_fcr_tx_get_fcs (p_buf);
    558 
    559             UINT16_TO_STREAM (p, fcs);
    560             p_buf->len += L2CAP_FCS_LEN;
    561         }
    562         else /* rewrite the length without FCS length */
    563         {
    564             p -= 6;
    565             UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD);
    566         }
    567 
    568         /* Now, the HCI transport header */
    569         p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
    570         l2cu_set_acl_hci_header (p_buf, p_ccb);
    571 
    572 #if BT_TRACE_VERBOSE == TRUE
    573         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
    574          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
    575         {
    576             L2CAP_TRACE_WARNING ("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
    577                             p_ccb->local_cid, ctrl_word,
    578                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    579                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    580                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    581                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    582             L2CAP_TRACE_WARNING ("                  Buf Len: %u", p_buf->len);
    583         }
    584         else
    585         {
    586             L2CAP_TRACE_EVENT ("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
    587                             p_ccb->local_cid, ctrl_word,
    588                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    589                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    590                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    591                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    592             L2CAP_TRACE_EVENT ("                  Buf Len: %u", p_buf->len);
    593         }
    594 #endif  /* BT_TRACE_VERBOSE */
    595 
    596         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, p_buf);
    597 
    598         p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
    599 
    600         if (p_ccb->fcrb.ack_timer.in_use)
    601             btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
    602     }
    603     else
    604     {
    605         L2CAP_TRACE_ERROR ("l2c_fcr_send_S_frame(No Resources) cid 0x%04x, Type: 0x%4x",
    606                              p_ccb->local_cid, function_code);
    607     }
    608 }
    609 
    610 
    611 /*******************************************************************************
    612 **
    613 ** Function         l2c_fcr_proc_pdu
    614 **
    615 ** Description      This function is the entry point for processing of a
    616 **                  received PDU when in flow control and/or retransmission modes.
    617 **
    618 ** Returns          -
    619 **
    620 *******************************************************************************/
    621 void l2c_fcr_proc_pdu (tL2C_CCB *p_ccb, BT_HDR *p_buf)
    622 {
    623     assert(p_ccb != NULL);
    624     assert(p_buf != NULL);
    625     UINT8       *p;
    626     UINT16      fcs;
    627     UINT16      min_pdu_len;
    628     UINT16      ctrl_word;
    629 
    630     /* Check the length */
    631     min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS) ?
    632                   (UINT16)L2CAP_FCR_OVERHEAD : (UINT16)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
    633 
    634     if (p_buf->len < min_pdu_len)
    635     {
    636         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u", p_ccb->local_cid, p_buf->len);
    637         GKI_freebuf (p_buf);
    638         return;
    639     }
    640 
    641     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE)
    642     {
    643         process_stream_frame (p_ccb, p_buf);
    644         return;
    645     }
    646 
    647 #if BT_TRACE_VERBOSE == TRUE
    648     /* Get the control word */
    649     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    650     STREAM_TO_UINT16 (ctrl_word, p);
    651 
    652     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    653     {
    654         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
    655          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
    656         {
    657             /* REJ or SREJ */
    658             L2CAP_TRACE_WARNING ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
    659                             p_ccb->local_cid, p_buf->len,
    660                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    661                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    662                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    663                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    664         }
    665         else
    666         {
    667             L2CAP_TRACE_EVENT ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
    668                             p_ccb->local_cid, p_buf->len,
    669                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    670                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    671                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    672                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    673         }
    674     }
    675     else
    676     {
    677         L2CAP_TRACE_EVENT ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
    678                             p_ccb->local_cid, p_buf->len,
    679                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    680                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    681                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    682                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    683     }
    684 
    685     L2CAP_TRACE_EVENT ("      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt %u, wt_q.cnt %u, tries %u",
    686                         p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack, p_ccb->fcrb.next_seq_expected,
    687                         p_ccb->fcrb.last_ack_sent, GKI_queue_length(&p_ccb->fcrb.waiting_for_ack_q), p_ccb->fcrb.num_tries);
    688 
    689 #endif /* BT_TRACE_VERBOSE */
    690 
    691     /* Verify FCS if using */
    692     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    693     {
    694         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
    695 
    696         /* Extract and drop the FCS from the packet */
    697         STREAM_TO_UINT16 (fcs, p);
    698         p_buf->len -= L2CAP_FCS_LEN;
    699 
    700         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
    701         {
    702             L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
    703             GKI_freebuf(p_buf);
    704             return;
    705         }
    706     }
    707 
    708     /* Get the control word */
    709     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    710 
    711     STREAM_TO_UINT16 (ctrl_word, p);
    712 
    713     p_buf->len    -= L2CAP_FCR_OVERHEAD;
    714     p_buf->offset += L2CAP_FCR_OVERHEAD;
    715 
    716     /* If we had a poll bit outstanding, check if we got a final response */
    717     if (p_ccb->fcrb.wait_ack)
    718     {
    719         /* If final bit not set, ignore the frame unless it is a polled S-frame */
    720         if ( !(ctrl_word & L2CAP_FCR_F_BIT) )
    721         {
    722             if ( (ctrl_word & L2CAP_FCR_P_BIT) && (ctrl_word & L2CAP_FCR_S_FRAME_BIT) )
    723             {
    724                 if (p_ccb->fcrb.srej_sent)
    725                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
    726                 else if (p_ccb->fcrb.local_busy)
    727                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
    728                 else
    729                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
    730 
    731                 /* Got a poll while in wait_ack state, so re-start our timer with 1-second */
    732                 /* This is a small optimization... the monitor timer is 12 secs, but we saw */
    733                 /* that if the other side sends us a poll when we are waiting for a final,  */
    734                 /* then it speeds up recovery significantly if we poll him back soon after his poll. */
    735                 btu_start_quick_timer (&p_ccb->fcrb.mon_retrans_timer, BTU_TTYPE_L2CAP_CHNL, QUICK_TIMER_TICKS_PER_SEC);
    736             }
    737             GKI_freebuf (p_buf);
    738             return;
    739         }
    740 
    741         p_ccb->fcrb.wait_ack  = FALSE;
    742 
    743         /* P and F are mutually exclusive */
    744         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    745             ctrl_word &= ~L2CAP_FCR_P_BIT;
    746 
    747         if (GKI_queue_is_empty(&p_ccb->fcrb.waiting_for_ack_q))
    748             p_ccb->fcrb.num_tries = 0;
    749 
    750         l2c_fcr_stop_timer (p_ccb);
    751     }
    752     else
    753     {
    754         /* Otherwise, ensure the final bit is ignored */
    755         ctrl_word &= ~L2CAP_FCR_F_BIT;
    756     }
    757 
    758     /* Process receive sequence number */
    759     if (!process_reqseq (p_ccb, ctrl_word))
    760     {
    761         GKI_freebuf (p_buf);
    762         return;
    763     }
    764 
    765      /* Process based on whether it is an S-frame or an I-frame */
    766     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    767         process_s_frame (p_ccb, p_buf, ctrl_word);
    768     else
    769         process_i_frame (p_ccb, p_buf, ctrl_word, FALSE);
    770 
    771     /* Return if the channel got disconnected by a bad packet or max retransmissions */
    772     if ( (!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN) )
    773         return;
    774 
    775     /* If we have some buffers held while doing SREJ, and SREJ has cleared, process them now */
    776     if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) && (!GKI_queue_is_empty(&p_ccb->fcrb.srej_rcv_hold_q)))
    777     {
    778         BUFFER_Q temp_q = p_ccb->fcrb.srej_rcv_hold_q;
    779 
    780         GKI_init_q (&p_ccb->fcrb.srej_rcv_hold_q);
    781 
    782         while ((p_buf = (BT_HDR *)GKI_dequeue (&temp_q)) != NULL)
    783         {
    784             if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
    785             {
    786                 /* Get the control word */
    787                 p = ((UINT8 *)(p_buf+1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
    788 
    789                 STREAM_TO_UINT16 (ctrl_word, p);
    790 
    791                 L2CAP_TRACE_DEBUG ("l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   TxSeq: %u  Expected_Seq: %u",
    792                                     p_ccb->local_cid, (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    793                                     p_ccb->fcrb.next_seq_expected);
    794 
    795                 /* Process the SREJ held I-frame, but do not send an RR for each individual frame */
    796                 process_i_frame (p_ccb, p_buf, ctrl_word, TRUE);
    797             }
    798             else
    799                 GKI_freebuf (p_buf);
    800 
    801             /* If more frames were lost during SREJ, send a REJ */
    802             if (p_ccb->fcrb.rej_after_srej)
    803             {
    804                 p_ccb->fcrb.rej_after_srej = FALSE;
    805                 p_ccb->fcrb.rej_sent       = TRUE;
    806 
    807                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
    808             }
    809         }
    810 
    811         /* Now, if needed, send one RR for the whole held queue */
    812         if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) && (!p_ccb->fcrb.srej_sent)
    813          &&  (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent) )
    814             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
    815         else
    816         {
    817             L2CAP_TRACE_DEBUG ("l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
    818                                 p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent, p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
    819                                 p_ccb->fcrb.last_ack_sent);
    820         }
    821     }
    822 
    823     /* If a window has opened, check if we can send any more packets */
    824     if ( (!GKI_queue_is_empty(&p_ccb->fcrb.retrans_q) || !GKI_queue_is_empty(&p_ccb->xmit_hold_q))
    825       && (p_ccb->fcrb.wait_ack == FALSE)
    826       && (l2c_fcr_is_flow_controlled (p_ccb) == FALSE) )
    827     {
    828         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
    829     }
    830 }
    831 
    832 /*******************************************************************************
    833 **
    834 ** Function         l2c_fcr_proc_tout
    835 **
    836 ** Description      Handle a timeout. We should be in error recovery state.
    837 **
    838 ** Returns          -
    839 **
    840 *******************************************************************************/
    841 void l2c_fcr_proc_tout (tL2C_CCB *p_ccb)
    842 {
    843     assert(p_ccb != NULL);
    844     L2CAP_TRACE_DEBUG ("l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  ack_q_count: %u",
    845                         p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
    846                         p_ccb->fcrb.wait_ack, GKI_queue_length(&p_ccb->fcrb.waiting_for_ack_q));
    847 
    848 #if (L2CAP_ERTM_STATS == TRUE)
    849     p_ccb->fcrb.retrans_touts++;
    850 #endif
    851 
    852     if ( (p_ccb->peer_cfg.fcr.max_transmit != 0) && (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit) )
    853     {
    854         l2cu_disconnect_chnl (p_ccb);
    855     }
    856     else
    857     {
    858         if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent)
    859         {
    860             if (p_ccb->fcrb.local_busy)
    861                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
    862             else
    863                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
    864         }
    865     }
    866 }
    867 
    868 
    869 /*******************************************************************************
    870 **
    871 ** Function         l2c_fcr_proc_ack_tout
    872 **
    873 ** Description      Send RR/RNR if we have not acked I frame
    874 **
    875 ** Returns          -
    876 **
    877 *******************************************************************************/
    878 void l2c_fcr_proc_ack_tout (tL2C_CCB *p_ccb)
    879 {
    880     assert(p_ccb != NULL);
    881     L2CAP_TRACE_DEBUG ("l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d", p_ccb->local_cid,
    882                         p_ccb->chnl_state, p_ccb->fcrb.wait_ack, p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
    883 
    884     if ( (p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack)
    885       && (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected) )
    886     {
    887 #if (L2CAP_ERTM_STATS == TRUE)
    888         p_ccb->fcrb.xmit_ack_touts++;
    889 #endif
    890         if (p_ccb->fcrb.local_busy)
    891             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
    892         else
    893             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
    894     }
    895 }
    896 
    897 
    898 /*******************************************************************************
    899 **
    900 ** Function         process_reqseq
    901 **
    902 ** Description      Handle receive sequence number
    903 **
    904 ** Returns          -
    905 **
    906 *******************************************************************************/
    907 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
    908 {
    909     assert(p_ccb != NULL);
    910     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
    911     UINT8       req_seq, num_bufs_acked, xx;
    912     UINT16      ls;
    913     UINT16      full_sdus_xmitted;
    914 
    915     /* Receive sequence number does not ack anything for SREJ with P-bit set to zero */
    916     if ( (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    917      &&  ((ctrl_word & L2CAP_FCR_SUP_BITS) == (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT))
    918      &&  ((ctrl_word & L2CAP_FCR_P_BIT) == 0) )
    919     {
    920         /* If anything still waiting for ack, restart the timer if it was stopped */
    921         if (!GKI_queue_is_empty(&p_fcrb->waiting_for_ack_q))
    922             l2c_fcr_start_timer (p_ccb);
    923 
    924         return (TRUE);
    925     }
    926 
    927     /* Extract the receive sequence number from the control word */
    928     req_seq = (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    929 
    930     num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
    931 
    932     /* Verify the request sequence is in range before proceeding */
    933     if (num_bufs_acked > GKI_queue_length(&p_fcrb->waiting_for_ack_q))
    934     {
    935         /* The channel is closed if ReqSeq is not in range */
    936         L2CAP_TRACE_WARNING ("L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
    937                                ctrl_word, req_seq, p_fcrb->last_rx_ack, GKI_queue_length(&p_fcrb->waiting_for_ack_q));
    938 
    939         l2cu_disconnect_chnl (p_ccb);
    940         return (FALSE);
    941     }
    942 
    943     p_fcrb->last_rx_ack = req_seq;
    944 
    945     /* Now we can release all acknowledged frames, and restart the retransmission timer if needed */
    946     if (num_bufs_acked != 0)
    947     {
    948         p_fcrb->num_tries = 0;
    949         full_sdus_xmitted = 0;
    950 
    951 #if (L2CAP_ERTM_STATS == TRUE)
    952         l2c_fcr_collect_ack_delay (p_ccb, num_bufs_acked);
    953 #endif
    954 
    955         for (xx = 0; xx < num_bufs_acked; xx++)
    956         {
    957             ls = ((BT_HDR *)(GKI_getfirst(&p_fcrb->waiting_for_ack_q)))->layer_specific & L2CAP_FCR_SAR_BITS;
    958 
    959             if ( (ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU) )
    960                 full_sdus_xmitted++;
    961 
    962             GKI_freebuf (GKI_dequeue (&p_fcrb->waiting_for_ack_q));
    963         }
    964 
    965         /* If we are still in a wait_ack state, do not mess with the timer */
    966         if (!p_ccb->fcrb.wait_ack)
    967             l2c_fcr_stop_timer (p_ccb);
    968 
    969         /* Check if we need to call the "packet_sent" callback */
    970         if ( (p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) && (full_sdus_xmitted) )
    971         {
    972             /* Special case for eRTM, if all packets sent, send 0xFFFF */
    973             if (GKI_queue_is_empty(&p_fcrb->waiting_for_ack_q) && (GKI_queue_is_empty(&p_ccb->xmit_hold_q)))
    974                 full_sdus_xmitted = 0xFFFF;
    975 
    976             (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid, full_sdus_xmitted);
    977         }
    978     }
    979 
    980     /* If anything still waiting for ack, restart the timer if it was stopped */
    981     if (!GKI_queue_is_empty(&p_fcrb->waiting_for_ack_q))
    982         l2c_fcr_start_timer (p_ccb);
    983 
    984     return (TRUE);
    985 }
    986 
    987 
    988 /*******************************************************************************
    989 **
    990 ** Function         process_s_frame
    991 **
    992 ** Description      Process an S frame
    993 **
    994 ** Returns          -
    995 **
    996 *******************************************************************************/
    997 static void process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
    998 {
    999     assert(p_ccb != NULL);
   1000     assert(p_buf != NULL);
   1001 
   1002     tL2C_FCRB   *p_fcrb      = &p_ccb->fcrb;
   1003     UINT16      s_frame_type = (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
   1004     BOOLEAN     remote_was_busy;
   1005     BOOLEAN     all_ok = TRUE;
   1006 
   1007     if (p_buf->len != 0)
   1008     {
   1009         L2CAP_TRACE_WARNING ("Incorrect S-frame Length (%d)", p_buf->len);
   1010     }
   1011 
   1012     L2CAP_TRACE_DEBUG ("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d", ctrl_word, p_fcrb->remote_busy);
   1013 
   1014 #if (L2CAP_ERTM_STATS == TRUE)
   1015     p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
   1016 #endif
   1017 
   1018     if (ctrl_word & L2CAP_FCR_P_BIT)
   1019     {
   1020         p_fcrb->rej_sent   = FALSE;             /* After checkpoint, we can send anoher REJ */
   1021         p_fcrb->send_f_rsp = TRUE;              /* Set a flag in case an I-frame is pending */
   1022     }
   1023 
   1024     switch (s_frame_type)
   1025     {
   1026     case L2CAP_FCR_SUP_RR:
   1027         remote_was_busy     = p_fcrb->remote_busy;
   1028         p_fcrb->remote_busy = FALSE;
   1029 
   1030         if ( (ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy) )
   1031             all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1032         break;
   1033 
   1034     case L2CAP_FCR_SUP_REJ:
   1035         p_fcrb->remote_busy = FALSE;
   1036         all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1037         break;
   1038 
   1039     case L2CAP_FCR_SUP_RNR:
   1040         p_fcrb->remote_busy = TRUE;
   1041         l2c_fcr_stop_timer (p_ccb);
   1042         break;
   1043 
   1044     case L2CAP_FCR_SUP_SREJ:
   1045         p_fcrb->remote_busy = FALSE;
   1046         all_ok = retransmit_i_frames (p_ccb, (UINT8)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
   1047         break;
   1048     }
   1049 
   1050     if (all_ok)
   1051     {
   1052         /* If polled, we need to respond with F-bit. Note, we may have sent a I-frame with the F-bit */
   1053         if (p_fcrb->send_f_rsp)
   1054         {
   1055             if (p_fcrb->srej_sent)
   1056                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
   1057             else if (p_fcrb->local_busy)
   1058                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
   1059             else
   1060                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
   1061 
   1062             p_fcrb->send_f_rsp = FALSE;
   1063         }
   1064     }
   1065     else
   1066     {
   1067         L2CAP_TRACE_DEBUG ("process_s_frame hit_max_retries");
   1068     }
   1069 
   1070     GKI_freebuf (p_buf);
   1071 }
   1072 
   1073 
   1074 /*******************************************************************************
   1075 **
   1076 ** Function         process_i_frame
   1077 **
   1078 ** Description      Process an I frame
   1079 **
   1080 ** Returns          -
   1081 **
   1082 *******************************************************************************/
   1083 static void process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack)
   1084 {
   1085     assert(p_ccb != NULL);
   1086     assert(p_buf != NULL);
   1087 
   1088     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
   1089     UINT8       tx_seq, num_lost, num_to_ack, next_srej;
   1090 
   1091     /* If we were doing checkpoint recovery, first retransmit all unacked I-frames */
   1092     if (ctrl_word & L2CAP_FCR_F_BIT)
   1093     {
   1094         if (!retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS))
   1095         {
   1096             GKI_freebuf(p_buf);
   1097             return;
   1098         }
   1099     }
   1100 
   1101 #if (L2CAP_ERTM_STATS == TRUE)
   1102     p_ccb->fcrb.ertm_pkt_counts[1]++;
   1103     p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
   1104 #endif
   1105 
   1106     /* Extract the sequence number */
   1107     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1108 
   1109     /* If we have flow controlled the peer, ignore any bad I-frames from him */
   1110     if ( (tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy) )
   1111     {
   1112         L2CAP_TRACE_WARNING ("Dropping bad I-Frame since we flowed off, tx_seq:%u", tx_seq);
   1113         l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1114         GKI_freebuf(p_buf);
   1115         return;
   1116     }
   1117 
   1118     /* If there are no free buffers in the user Rx queue, drop the  */
   1119     /* received buffer now before we update any sequence numbers    */
   1120     if (GKI_poolfreecount (p_ccb->ertm_info.user_rx_pool_id) == 0)
   1121     {
   1122         L2CAP_TRACE_WARNING ("L2CAP CID: 0x%04x  Dropping I-Frame seq: %u  User RX Pool: %u  (Size: %u)  has no free buffers!!",
   1123                               p_ccb->local_cid, tx_seq, p_ccb->ertm_info.user_rx_pool_id,
   1124                               GKI_poolcount (p_ccb->ertm_info.user_rx_pool_id));
   1125         GKI_freebuf(p_buf);
   1126         return;
   1127     }
   1128 
   1129     /* Check if tx-sequence is the expected one */
   1130     if (tx_seq != p_fcrb->next_seq_expected)
   1131     {
   1132         num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
   1133 
   1134         /* Is the frame a duplicate ? If so, just drop it */
   1135         if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz)
   1136         {
   1137             /* Duplicate - simply drop it */
   1138             L2CAP_TRACE_WARNING ("process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq %u", tx_seq, p_fcrb->next_seq_expected);
   1139             GKI_freebuf(p_buf);
   1140         }
   1141         else
   1142         {
   1143             L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej: %u",
   1144                                  p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent, p_fcrb->srej_sent);
   1145 
   1146             if (p_fcrb->srej_sent)
   1147             {
   1148                 /* If SREJ sent, save the frame for later processing as long as it is in sequence */
   1149                 next_srej = (((BT_HDR *)GKI_getlast(&p_fcrb->srej_rcv_hold_q))->layer_specific + 1) & L2CAP_FCR_SEQ_MODULO;
   1150 
   1151                 if ( (tx_seq == next_srej) && (GKI_queue_length(&p_fcrb->srej_rcv_hold_q) < p_ccb->our_cfg.fcr.tx_win_sz) )
   1152                 {
   1153                     /* If user gave us a pool for held rx buffers, use that */
   1154                     if (p_ccb->ertm_info.fcr_rx_pool_id != HCI_ACL_POOL_ID)
   1155                     {
   1156                         BT_HDR *p_buf2;
   1157 
   1158                         /* Adjust offset and len so that control word is copied */
   1159                         p_buf->offset -= L2CAP_FCR_OVERHEAD;
   1160                         p_buf->len    += L2CAP_FCR_OVERHEAD;
   1161 
   1162                         p_buf2 = l2c_fcr_clone_buf (p_buf, p_buf->offset, p_buf->len, p_ccb->ertm_info.fcr_rx_pool_id);
   1163 
   1164                         if (p_buf2)
   1165                         {
   1166                             GKI_freebuf (p_buf);
   1167                             p_buf = p_buf2;
   1168                         }
   1169                         p_buf->offset += L2CAP_FCR_OVERHEAD;
   1170                         p_buf->len -= L2CAP_FCR_OVERHEAD;
   1171                     }
   1172                     L2CAP_TRACE_DEBUG ("process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej1",
   1173                                          num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1174 
   1175                     p_buf->layer_specific = tx_seq;
   1176                     GKI_enqueue (&p_fcrb->srej_rcv_hold_q, p_buf);
   1177                 }
   1178                 else
   1179                 {
   1180                     L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  frame dropped in Srej Sent next_srej:%u  hold_q.count:%u  win_sz:%u",
   1181                                          p_ccb->local_cid, next_srej, GKI_queue_length(&p_fcrb->srej_rcv_hold_q), p_ccb->our_cfg.fcr.tx_win_sz);
   1182 
   1183                     p_fcrb->rej_after_srej = TRUE;
   1184                     GKI_freebuf (p_buf);
   1185                 }
   1186             }
   1187             else if (p_fcrb->rej_sent)
   1188             {
   1189                 L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: 1  SRej: %u",
   1190                                      p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->srej_sent);
   1191 
   1192                 /* If REJ sent, just drop the frame */
   1193                 GKI_freebuf (p_buf);
   1194             }
   1195             else
   1196             {
   1197                 L2CAP_TRACE_DEBUG ("process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
   1198                                      p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1199 
   1200                 /* If only one lost, we will send SREJ, otherwise we will send REJ */
   1201                 if (num_lost > 1)
   1202                 {
   1203                     GKI_freebuf (p_buf);
   1204                     p_fcrb->rej_sent = TRUE;
   1205                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
   1206                 }
   1207                 else
   1208                 {
   1209                     if (!GKI_queue_is_empty(&p_fcrb->srej_rcv_hold_q))
   1210                     {
   1211                         L2CAP_TRACE_ERROR ("process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d hold_q.count:%u",
   1212                                              p_ccb->local_cid, tx_seq, GKI_queue_length(&p_fcrb->srej_rcv_hold_q));
   1213                     }
   1214                     p_buf->layer_specific = tx_seq;
   1215                     GKI_enqueue (&p_fcrb->srej_rcv_hold_q, p_buf);
   1216                     p_fcrb->srej_sent = TRUE;
   1217                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, 0);
   1218                 }
   1219                 btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
   1220             }
   1221         }
   1222         return;
   1223     }
   1224 
   1225     /* Seq number is the next expected. Clear possible reject exception in case it occured */
   1226     p_fcrb->rej_sent = p_fcrb->srej_sent = FALSE;
   1227 
   1228     /* Adjust the next_seq, so that if the upper layer sends more data in the callback
   1229        context, the received frame is acked by an I-frame. */
   1230     p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1231 
   1232     /* If any SAR problem in eRTM mode, spec says disconnect. */
   1233     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
   1234     {
   1235         L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  reassembly failed", p_ccb->local_cid);
   1236         l2cu_disconnect_chnl (p_ccb);
   1237         return;
   1238     }
   1239 
   1240     /* RR optimization - if peer can still send us more, then start an ACK timer */
   1241     num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) & L2CAP_FCR_SEQ_MODULO;
   1242 
   1243     if ( (num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy) )
   1244         delay_ack = TRUE;
   1245 
   1246     /* We should neve never ack frame if we are not in OPEN state */
   1247     if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
   1248     {
   1249         /* If no frames are awaiting transmission or are held, send an RR or RNR S-frame for ack */
   1250         if (delay_ack)
   1251         {
   1252             /* If it is the first I frame we did not ack, start ack timer */
   1253             if (!p_ccb->fcrb.ack_timer.in_use)
   1254             {
   1255                 btu_start_quick_timer (&p_ccb->fcrb.ack_timer, BTU_TTYPE_L2CAP_FCR_ACK,
   1256                                         (L2CAP_FCR_ACK_TOUT*QUICK_TIMER_TICKS_PER_SEC)/1000);
   1257             }
   1258         }
   1259         else if ( ((GKI_queue_is_empty(&p_ccb->xmit_hold_q)) || (l2c_fcr_is_flow_controlled (p_ccb)))
   1260                &&  (GKI_queue_is_empty(&p_ccb->fcrb.srej_rcv_hold_q)))
   1261         {
   1262             if (p_fcrb->local_busy)
   1263                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1264             else
   1265                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
   1266         }
   1267     }
   1268 }
   1269 
   1270 
   1271 /*******************************************************************************
   1272 **
   1273 ** Function         process_stream_frame
   1274 **
   1275 ** Description      This function processes frames in streaming mode
   1276 **
   1277 ** Returns          -
   1278 **
   1279 *******************************************************************************/
   1280 static void process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf)
   1281 {
   1282     assert(p_ccb != NULL);
   1283     assert(p_buf != NULL);
   1284 
   1285     UINT16      ctrl_word;
   1286     UINT16      fcs;
   1287     UINT8       *p;
   1288     UINT8       tx_seq;
   1289 
   1290     /* Verify FCS if using */
   1291     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1292     {
   1293         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
   1294 
   1295         /* Extract and drop the FCS from the packet */
   1296         STREAM_TO_UINT16 (fcs, p);
   1297         p_buf->len -= L2CAP_FCS_LEN;
   1298 
   1299         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
   1300         {
   1301             L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
   1302             GKI_freebuf(p_buf);
   1303             return;
   1304         }
   1305     }
   1306 
   1307     /* Get the control word */
   1308     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
   1309 
   1310     STREAM_TO_UINT16 (ctrl_word, p);
   1311 
   1312     p_buf->len    -= L2CAP_FCR_OVERHEAD;
   1313     p_buf->offset += L2CAP_FCR_OVERHEAD;
   1314 
   1315     /* Make sure it is an I-frame */
   1316     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
   1317     {
   1318         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: 0x%04x", p_ccb->local_cid, ctrl_word);
   1319         GKI_freebuf (p_buf);
   1320         return;
   1321     }
   1322 
   1323 #if BT_TRACE_VERBOSE == TRUE
   1324     L2CAP_TRACE_EVENT ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
   1325                         p_ccb->local_cid, p_buf->len,
   1326                         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
   1327                         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
   1328                         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
   1329                         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
   1330 #endif
   1331 
   1332     /* Extract the sequence number */
   1333     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1334 
   1335     /* Check if tx-sequence is the expected one */
   1336     if (tx_seq != p_ccb->fcrb.next_seq_expected)
   1337     {
   1338         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: 0x%08x",
   1339                                 p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq, p_ccb->fcrb.p_rx_sdu);
   1340 
   1341         /* Lost one or more packets, so flush the SAR queue */
   1342         if (p_ccb->fcrb.p_rx_sdu != NULL)
   1343         {
   1344             GKI_freebuf (p_ccb->fcrb.p_rx_sdu);
   1345             p_ccb->fcrb.p_rx_sdu = NULL;
   1346         }
   1347     }
   1348 
   1349     p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1350 
   1351     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
   1352     {
   1353         /* Some sort of SAR error, so flush the SAR queue */
   1354         if (p_ccb->fcrb.p_rx_sdu != NULL)
   1355         {
   1356             GKI_freebuf (p_ccb->fcrb.p_rx_sdu);
   1357             p_ccb->fcrb.p_rx_sdu = NULL;
   1358         }
   1359     }
   1360 }
   1361 
   1362 
   1363 /*******************************************************************************
   1364 **
   1365 ** Function         do_sar_reassembly
   1366 **
   1367 ** Description      Process SAR bits and re-assemble frame
   1368 **
   1369 ** Returns          TRUE if all OK, else FALSE
   1370 **
   1371 *******************************************************************************/
   1372 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
   1373 {
   1374     assert(p_ccb != NULL);
   1375     assert(p_buf != NULL);
   1376 
   1377     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
   1378     UINT16      sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
   1379     BOOLEAN     packet_ok = TRUE;
   1380     UINT8       *p;
   1381 
   1382     /* Check if the SAR state is correct */
   1383     if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU))
   1384     {
   1385         if (p_fcrb->p_rx_sdu != NULL)
   1386         {
   1387             L2CAP_TRACE_WARNING ("SAR - got unexpected unsegmented or start SDU  Expected len: %u  Got so far: %u",
   1388                                   p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
   1389 
   1390             packet_ok = FALSE;
   1391         }
   1392         /* Check the length of the packet */
   1393         if ( (sar_type == L2CAP_FCR_START_SDU) && (p_buf->len < L2CAP_SDU_LEN_OVERHEAD) )
   1394         {
   1395             L2CAP_TRACE_WARNING ("SAR start packet too short: %u", p_buf->len);
   1396             packet_ok = FALSE;
   1397         }
   1398     }
   1399     else
   1400     {
   1401         if (p_fcrb->p_rx_sdu == NULL)
   1402         {
   1403             L2CAP_TRACE_WARNING ("SAR - got unexpected cont or end SDU");
   1404             packet_ok = FALSE;
   1405         }
   1406     }
   1407 
   1408     if ( (packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU) )
   1409     {
   1410         p = ((UINT8 *)(p_buf + 1)) + p_buf->offset;
   1411 
   1412         /* For start SDU packet, extract the SDU length */
   1413         if (sar_type == L2CAP_FCR_START_SDU)
   1414         {
   1415             /* Get the SDU length */
   1416             STREAM_TO_UINT16 (p_fcrb->rx_sdu_len, p);
   1417             p_buf->offset += 2;
   1418             p_buf->len    -= 2;
   1419 
   1420             if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu)
   1421             {
   1422                 L2CAP_TRACE_WARNING ("SAR - SDU len: %u  larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
   1423                 packet_ok = FALSE;
   1424             }
   1425             else if ((p_fcrb->p_rx_sdu = (BT_HDR *)GKI_getpoolbuf (p_ccb->ertm_info.user_rx_pool_id)) == NULL)
   1426             {
   1427                 L2CAP_TRACE_ERROR ("SAR - no buffer for SDU start user_rx_pool_id:%d", p_ccb->ertm_info.user_rx_pool_id);
   1428                 packet_ok = FALSE;
   1429             }
   1430             else
   1431             {
   1432                 p_fcrb->p_rx_sdu->offset = 4; /* this is the minimal offset required by OBX to process incoming packets */
   1433                 p_fcrb->p_rx_sdu->len    = 0;
   1434             }
   1435         }
   1436 
   1437         if (packet_ok)
   1438         {
   1439             if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len)
   1440             {
   1441                 L2CAP_TRACE_ERROR ("SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u",
   1442                                     sar_type, p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1443                 packet_ok = FALSE;
   1444             }
   1445             else if ( (sar_type == L2CAP_FCR_END_SDU) && ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len) )
   1446             {
   1447                 L2CAP_TRACE_WARNING ("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
   1448                                       p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1449                 packet_ok = FALSE;
   1450             }
   1451             else
   1452             {
   1453                 memcpy (((UINT8 *) (p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset + p_fcrb->p_rx_sdu->len, p, p_buf->len);
   1454 
   1455                 p_fcrb->p_rx_sdu->len += p_buf->len;
   1456 
   1457                 GKI_freebuf (p_buf);
   1458                 p_buf = NULL;
   1459 
   1460                 if (sar_type == L2CAP_FCR_END_SDU)
   1461                 {
   1462                     p_buf            = p_fcrb->p_rx_sdu;
   1463                     p_fcrb->p_rx_sdu = NULL;
   1464                 }
   1465             }
   1466         }
   1467     }
   1468 
   1469     if (packet_ok == FALSE)
   1470     {
   1471         GKI_freebuf (p_buf);
   1472     }
   1473     else if (p_buf != NULL)
   1474     {
   1475 #if (L2CAP_NUM_FIXED_CHNLS > 0)
   1476         if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
   1477             (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL && p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL))
   1478         {
   1479             if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
   1480                 (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
   1481                     (p_ccb->local_cid, p_ccb->p_lcb->remote_bd_addr, p_buf);
   1482         }
   1483         else
   1484 #endif
   1485             l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
   1486     }
   1487 
   1488     return (packet_ok);
   1489 }
   1490 
   1491 
   1492 /*******************************************************************************
   1493 **
   1494 ** Function         retransmit_i_frames
   1495 **
   1496 ** Description      This function retransmits i-frames awaiting acks.
   1497 **
   1498 ** Returns          BOOLEAN - TRUE if retransmitted
   1499 **
   1500 *******************************************************************************/
   1501 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
   1502 {
   1503     assert(p_ccb != NULL);
   1504 
   1505     BT_HDR      *p_buf, *p_buf2;
   1506     UINT8       *p;
   1507     UINT8       buf_seq;
   1508     UINT16      ctrl_word;
   1509 
   1510     if ( (GKI_getfirst(&p_ccb->fcrb.waiting_for_ack_q))
   1511      &&  (p_ccb->peer_cfg.fcr.max_transmit != 0)
   1512      &&  (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit) )
   1513     {
   1514         L2CAP_TRACE_EVENT ("Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: %u) ack_q_count: %u",
   1515                 p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
   1516                 GKI_queue_length(&p_ccb->fcrb.waiting_for_ack_q));
   1517 
   1518         l2cu_disconnect_chnl (p_ccb);
   1519         return (FALSE);
   1520     }
   1521 
   1522     /* tx_seq indicates whether to retransmit a specific sequence or all (if == L2C_FCR_RETX_ALL_PKTS) */
   1523     if (tx_seq != L2C_FCR_RETX_ALL_PKTS)
   1524     {
   1525         /* If sending only one, the sequence number tells us which one. Look for it.
   1526         */
   1527         for (p_buf = (BT_HDR *)GKI_getfirst(&p_ccb->fcrb.waiting_for_ack_q); p_buf; p_buf = (BT_HDR *)GKI_getnext (p_buf))
   1528         {
   1529             /* Get the old control word */
   1530             p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
   1531 
   1532             STREAM_TO_UINT16 (ctrl_word, p);
   1533 
   1534             buf_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1535 
   1536             L2CAP_TRACE_DEBUG ("retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq, tx_seq);
   1537 
   1538             if (tx_seq == buf_seq)
   1539                 break;
   1540         }
   1541 
   1542         if (!p_buf)
   1543         {
   1544             L2CAP_TRACE_ERROR ("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u", tx_seq, GKI_queue_length(&p_ccb->fcrb.waiting_for_ack_q));
   1545             return (TRUE);
   1546         }
   1547     }
   1548     else
   1549     {
   1550         // Iterate though list and flush the amount requested from
   1551         // the transmit data queue that satisfy the layer and event conditions.
   1552         for (const list_node_t *node = list_begin(p_ccb->p_lcb->link_xmit_data_q);
   1553             node != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
   1554           BT_HDR *p_buf = (BT_HDR *)list_node(node);
   1555           node = list_next(node);
   1556 
   1557             /* Do not flush other CIDs or partial segments */
   1558           if ((p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid)) {
   1559             list_remove(p_ccb->p_lcb->link_xmit_data_q, p_buf);
   1560             GKI_freebuf(p_buf);
   1561           }
   1562         }
   1563 
   1564         /* Also flush our retransmission queue */
   1565         while (!GKI_queue_is_empty(&p_ccb->fcrb.retrans_q))
   1566             GKI_freebuf (GKI_dequeue (&p_ccb->fcrb.retrans_q));
   1567 
   1568         p_buf = (BT_HDR *)GKI_getfirst(&p_ccb->fcrb.waiting_for_ack_q);
   1569     }
   1570 
   1571     while (p_buf != NULL)
   1572     {
   1573         p_buf2 = l2c_fcr_clone_buf (p_buf, p_buf->offset, p_buf->len, p_ccb->ertm_info.fcr_tx_pool_id);
   1574 
   1575         if (p_buf2)
   1576         {
   1577             p_buf2->layer_specific = p_buf->layer_specific;
   1578 
   1579             GKI_enqueue (&p_ccb->fcrb.retrans_q, p_buf2);
   1580         }
   1581 
   1582         if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) )
   1583             break;
   1584         else
   1585             p_buf = (BT_HDR *)GKI_getnext (p_buf);
   1586     }
   1587 
   1588     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
   1589 
   1590     if (GKI_queue_length(&p_ccb->fcrb.waiting_for_ack_q))
   1591     {
   1592         p_ccb->fcrb.num_tries++;
   1593         l2c_fcr_start_timer (p_ccb);
   1594     }
   1595 
   1596     return (TRUE);
   1597 }
   1598 
   1599 
   1600 /*******************************************************************************
   1601 **
   1602 ** Function         l2c_fcr_get_next_xmit_sdu_seg
   1603 **
   1604 ** Description      Get the next SDU segment to transmit.
   1605 **
   1606 ** Returns          pointer to buffer with segment or NULL
   1607 **
   1608 *******************************************************************************/
   1609 BT_HDR *l2c_fcr_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
   1610 {
   1611     assert(p_ccb != NULL);
   1612 
   1613     BOOLEAN     first_seg    = FALSE,       /* The segment is the first part of data  */
   1614                 mid_seg      = FALSE,       /* The segment is the middle part of data */
   1615                 last_seg     = FALSE;       /* The segment is the last part of data   */
   1616     UINT16      sdu_len = 0;
   1617     BT_HDR      *p_buf, *p_xmit;
   1618     UINT8       *p;
   1619     UINT16      max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
   1620 
   1621     /* If there is anything in the retransmit queue, that goes first
   1622     */
   1623     if (GKI_getfirst(&p_ccb->fcrb.retrans_q))
   1624     {
   1625         p_buf = (BT_HDR *)GKI_dequeue (&p_ccb->fcrb.retrans_q);
   1626 
   1627         /* Update Rx Seq and FCS if we acked some packets while this one was queued */
   1628         prepare_I_frame (p_ccb, p_buf, TRUE);
   1629 
   1630         p_buf->event = p_ccb->local_cid;
   1631 
   1632 #if (L2CAP_ERTM_STATS == TRUE)
   1633         p_ccb->fcrb.pkts_retransmitted++;
   1634         p_ccb->fcrb.ertm_pkt_counts[0]++;
   1635         p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
   1636 #endif
   1637         return (p_buf);
   1638     }
   1639 
   1640     /* For BD/EDR controller, max_packet_length is set to 0             */
   1641     /* For AMP controller, max_packet_length is set by available blocks */
   1642     if ( (max_packet_length > L2CAP_MAX_HEADER_FCS)
   1643       && (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length) )
   1644     {
   1645         max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
   1646     }
   1647 
   1648     p_buf = (BT_HDR *)GKI_getfirst(&p_ccb->xmit_hold_q);
   1649 
   1650     /* If there is more data than the MPS, it requires segmentation */
   1651     if (p_buf->len > max_pdu)
   1652     {
   1653         /* We are using the "event" field to tell is if we already started segmentation */
   1654         if (p_buf->event == 0)
   1655         {
   1656             first_seg = TRUE;
   1657             sdu_len   = p_buf->len;
   1658         }
   1659         else
   1660             mid_seg = TRUE;
   1661 
   1662         /* Get a new buffer and copy the data that can be sent in a PDU */
   1663         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
   1664                                     max_pdu, p_ccb->ertm_info.fcr_tx_pool_id);
   1665 
   1666         if (p_xmit != NULL)
   1667         {
   1668             p_buf->event  = p_ccb->local_cid;
   1669             p_xmit->event = p_ccb->local_cid;
   1670 
   1671             p_buf->len    -= max_pdu;
   1672             p_buf->offset += max_pdu;
   1673 
   1674             /* copy PBF setting */
   1675             p_xmit->layer_specific = p_buf->layer_specific;
   1676         }
   1677         else /* Should never happen if the application has configured buffers correctly */
   1678         {
   1679             L2CAP_TRACE_ERROR ("L2CAP - cannot get buffer, for segmentation, pool: %u", p_ccb->ertm_info.fcr_tx_pool_id);
   1680             return (NULL);
   1681         }
   1682     }
   1683     else    /* Use the original buffer if no segmentation, or the last segment */
   1684     {
   1685         p_xmit = (BT_HDR *)GKI_dequeue (&p_ccb->xmit_hold_q);
   1686 
   1687         if (p_xmit->event != 0)
   1688             last_seg = TRUE;
   1689 
   1690         p_xmit->event = p_ccb->local_cid;
   1691     }
   1692 
   1693     /* Step back to add the L2CAP headers */
   1694     p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
   1695     p_xmit->len    += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
   1696 
   1697     if (first_seg)
   1698     {
   1699         p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
   1700         p_xmit->len    += L2CAP_SDU_LEN_OVERHEAD;
   1701     }
   1702 
   1703     /* Set the pointer to the beginning of the data */
   1704     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
   1705 
   1706     /* Now the L2CAP header */
   1707 
   1708     /* Note: if FCS has to be included then the length is recalculated later */
   1709     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
   1710 
   1711     UINT16_TO_STREAM (p, p_ccb->remote_cid);
   1712 
   1713     if (first_seg)
   1714     {
   1715         /* Skip control word and add SDU length */
   1716         p += 2;
   1717         UINT16_TO_STREAM (p, sdu_len);
   1718 
   1719         /* We will store the SAR type in layer-specific */
   1720         /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
   1721         p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
   1722 
   1723         first_seg = FALSE;
   1724     }
   1725     else if (mid_seg)
   1726         p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
   1727     else if (last_seg)
   1728         p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
   1729     else
   1730         p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
   1731 
   1732     prepare_I_frame (p_ccb, p_xmit, FALSE);
   1733 
   1734     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
   1735     {
   1736         BT_HDR *p_wack = l2c_fcr_clone_buf (p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len, p_ccb->ertm_info.fcr_tx_pool_id);
   1737 
   1738         if (!p_wack)
   1739         {
   1740             L2CAP_TRACE_ERROR ("L2CAP - no buffer for xmit cloning, CID: 0x%04x  Pool: %u  Count: %u",
   1741                                 p_ccb->local_cid, p_ccb->ertm_info.fcr_tx_pool_id,  GKI_poolfreecount(p_ccb->ertm_info.fcr_tx_pool_id));
   1742 
   1743             /* We will not save the FCS in case we reconfigure and change options */
   1744             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1745                 p_xmit->len -= L2CAP_FCS_LEN;
   1746 
   1747             /* Pretend we sent it and it got lost */
   1748             GKI_enqueue (&p_ccb->fcrb.waiting_for_ack_q, p_xmit);
   1749             return (NULL);
   1750         }
   1751         else
   1752         {
   1753 #if (L2CAP_ERTM_STATS == TRUE)
   1754             /* set timestamp at the end of tx I-frame to get acking delay */
   1755             p = ((UINT8 *) (p_wack+1)) + p_wack->offset + p_wack->len;
   1756             UINT32_TO_STREAM (p, GKI_get_os_tick_count());
   1757 #endif
   1758             /* We will not save the FCS in case we reconfigure and change options */
   1759             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1760                 p_wack->len -= L2CAP_FCS_LEN;
   1761 
   1762             p_wack->layer_specific = p_xmit->layer_specific;
   1763             GKI_enqueue (&p_ccb->fcrb.waiting_for_ack_q, p_wack);
   1764         }
   1765 
   1766 #if (L2CAP_ERTM_STATS == TRUE)
   1767         p_ccb->fcrb.ertm_pkt_counts[0]++;
   1768         p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
   1769 #endif
   1770 
   1771     }
   1772 
   1773     return (p_xmit);
   1774 }
   1775 
   1776 
   1777 /*******************************************************************************
   1778 ** Configuration negotiation functions
   1779 **
   1780 ** The following functions are used in negotiating channel modes during
   1781 ** configuration
   1782 ********************************************************************************/
   1783 
   1784 /*******************************************************************************
   1785 **
   1786 ** Function         l2c_fcr_chk_chan_modes
   1787 **
   1788 ** Description      Validates and adjusts if necessary, the FCR options
   1789 **                  based on remote EXT features.
   1790 **
   1791 **                  Note: This assumes peer EXT Features have been received.
   1792 **                      Basic mode is used if FCR Options have not been received
   1793 **
   1794 ** Returns          UINT8 - nonzero if can continue, '0' if no compatible channels
   1795 **
   1796 *******************************************************************************/
   1797 UINT8 l2c_fcr_chk_chan_modes (tL2C_CCB *p_ccb)
   1798 {
   1799     assert(p_ccb != NULL);
   1800 
   1801     /* Remove nonbasic options that the peer does not support */
   1802     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
   1803         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
   1804 
   1805     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
   1806         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
   1807 
   1808     /* At least one type needs to be set (Basic, ERTM, STM) to continue */
   1809     if (!p_ccb->ertm_info.allowed_modes)
   1810     {
   1811         L2CAP_TRACE_WARNING ("L2CAP - Peer does not support our desired channel types");
   1812     }
   1813 
   1814     return (p_ccb->ertm_info.allowed_modes);
   1815 }
   1816 
   1817 /*******************************************************************************
   1818 **
   1819 ** Function         l2c_fcr_adj_our_req_options
   1820 **
   1821 ** Description      Validates and sets up the FCR options passed in from
   1822 **                  L2CA_ConfigReq based on remote device's features.
   1823 **
   1824 ** Returns          TRUE if no errors, Otherwise FALSE
   1825 **
   1826 *******************************************************************************/
   1827 BOOLEAN l2c_fcr_adj_our_req_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   1828 {
   1829     assert(p_ccb != NULL);
   1830     assert(p_cfg != NULL);
   1831 
   1832     tL2CAP_FCR_OPTS *p_fcr = &p_cfg->fcr;
   1833 
   1834     if (p_fcr->mode != p_ccb->ertm_info.preferred_mode)
   1835     {
   1836         L2CAP_TRACE_WARNING ("l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match mode (%d)",
   1837                             p_ccb->ertm_info.preferred_mode, p_fcr->mode);
   1838 
   1839         /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override this one */
   1840         p_fcr->mode = p_ccb->ertm_info.preferred_mode;
   1841     }
   1842 
   1843     /* If upper layer did not request eRTM mode, BASIC must be used */
   1844     if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
   1845     {
   1846         if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE)
   1847         {
   1848             L2CAP_TRACE_WARNING ("l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set using BASIC mode", p_fcr->mode);
   1849         }
   1850         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   1851     }
   1852 
   1853     /* Process the FCR options if initial channel bring-up (not a reconfig request)
   1854     ** Determine initial channel mode to try based on our options and remote's features
   1855     */
   1856     if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG))
   1857     {
   1858         /* We need to have at least one mode type common with the peer */
   1859         if (!l2c_fcr_chk_chan_modes(p_ccb))
   1860         {
   1861             /* Two channels have incompatible supported types */
   1862             l2cu_disconnect_chnl (p_ccb);
   1863             return (FALSE);
   1864         }
   1865 
   1866         /* Basic is the only common channel mode between the two devices */
   1867         else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
   1868         {
   1869             /* We only want to try Basic, so bypass sending the FCR options entirely */
   1870             p_cfg->fcr_present = FALSE;
   1871             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
   1872             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
   1873         }
   1874 
   1875         /* We have at least one non-basic mode available
   1876          * Override mode from available mode options based on preference, if needed
   1877          */
   1878         else
   1879         {
   1880             /* If peer does not support STREAMING, try ERTM */
   1881             if (p_fcr->mode == L2CAP_FCR_STREAM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM))
   1882             {
   1883                 L2CAP_TRACE_DEBUG ("L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
   1884                 p_fcr->mode = L2CAP_FCR_ERTM_MODE;
   1885             }
   1886 
   1887             /* If peer does not support ERTM, try BASIC (will support this if made it here in the code) */
   1888             if (p_fcr->mode == L2CAP_FCR_ERTM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM))
   1889             {
   1890                 L2CAP_TRACE_DEBUG ("L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
   1891                 p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   1892             }
   1893         }
   1894 
   1895         if (p_fcr->mode != L2CAP_FCR_BASIC_MODE)
   1896         {
   1897             /* MTU must be smaller than buffer size */
   1898             if ( (p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu) )
   1899             {
   1900                 L2CAP_TRACE_WARNING ("L2CAP - MTU: %u  larger than buf size: %u", p_cfg->mtu, p_ccb->max_rx_mtu);
   1901                 return (FALSE);
   1902             }
   1903 
   1904             /* application want to use the default MPS */
   1905             if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS)
   1906             {
   1907                 p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
   1908             }
   1909             /* MPS must be less than MTU */
   1910             else if (p_fcr->mps > p_ccb->max_rx_mtu)
   1911             {
   1912                 L2CAP_TRACE_WARNING ("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps, p_ccb->max_rx_mtu);
   1913                 return (FALSE);
   1914             }
   1915 
   1916             /* We always initially read into the HCI buffer pool, so make sure it fits */
   1917             if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
   1918                 p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
   1919         }
   1920         else
   1921         {
   1922             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
   1923             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
   1924         }
   1925 
   1926         p_ccb->our_cfg.fcr = *p_fcr;
   1927     }
   1928     else    /* Not sure how to send a reconfiguration(??) should fcr be included? */
   1929     {
   1930         p_ccb->our_cfg.fcr_present = FALSE;
   1931     }
   1932 
   1933     return (TRUE);
   1934 }
   1935 
   1936 
   1937 /*******************************************************************************
   1938 **
   1939 ** Function         l2c_fcr_adj_monitor_retran_timeout
   1940 **
   1941 ** Description      Overrides monitor/retrans timer value based on controller
   1942 **
   1943 ** Returns          None
   1944 **
   1945 *******************************************************************************/
   1946 void l2c_fcr_adj_monitor_retran_timeout (tL2C_CCB *p_ccb)
   1947 {
   1948     assert(p_ccb != NULL);
   1949 
   1950     /* adjust our monitor/retran timeout */
   1951     if (p_ccb->out_cfg_fcr_present)
   1952     {
   1953         /*
   1954         ** if we requestd ERTM or accepted ERTM
   1955         ** We may accept ERTM even if we didn't request ERTM, in case of requesting STREAM
   1956         */
   1957         if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
   1958           ||(p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE))
   1959         {
   1960             /* upper layer setting is ignored */
   1961             p_ccb->our_cfg.fcr.mon_tout    = L2CAP_MIN_MONITOR_TOUT;
   1962             p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
   1963         }
   1964         else
   1965         {
   1966             p_ccb->our_cfg.fcr.mon_tout    = 0;
   1967             p_ccb->our_cfg.fcr.rtrans_tout = 0;
   1968         }
   1969 
   1970         L2CAP_TRACE_DEBUG ("l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
   1971                              p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
   1972     }
   1973 }
   1974 /*******************************************************************************
   1975 **
   1976 ** Function         l2c_fcr_adj_our_rsp_options
   1977 **
   1978 ** Description      Overrides any neccesary FCR options passed in from
   1979 **                  L2CA_ConfigRsp based on our FCR options.
   1980 **                  Only makes adjustments if channel is in ERTM mode.
   1981 **
   1982 ** Returns          None
   1983 **
   1984 *******************************************************************************/
   1985 void l2c_fcr_adj_our_rsp_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   1986 {
   1987     assert(p_ccb != NULL);
   1988     assert(p_cfg != NULL);
   1989 
   1990     /* adjust our monitor/retran timeout */
   1991     l2c_fcr_adj_monitor_retran_timeout(p_ccb);
   1992 
   1993     p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
   1994 
   1995     if (p_cfg->fcr_present)
   1996     {
   1997 // btla-specific ++
   1998         /* Temporary - until a better algorithm is implemented */
   1999         /* If peer's tx_wnd_sz requires too many buffers for us to support, then adjust it. For now, respond with our own tx_wnd_sz. */
   2000         /* Note: peer is not guaranteed to obey our adjustment */
   2001         if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz)
   2002         {
   2003             L2CAP_TRACE_DEBUG ("%s: adjusting requested tx_win_sz from %i to %i", __FUNCTION__, p_ccb->peer_cfg.fcr.tx_win_sz, p_ccb->our_cfg.fcr.tx_win_sz);
   2004             p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2005         }
   2006 // btla-specific --
   2007 
   2008         p_cfg->fcr.mode         = p_ccb->peer_cfg.fcr.mode;
   2009         p_cfg->fcr.tx_win_sz    = p_ccb->peer_cfg.fcr.tx_win_sz;
   2010         p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
   2011         p_cfg->fcr.mps          = p_ccb->peer_cfg.fcr.mps;
   2012         p_cfg->fcr.rtrans_tout  = p_ccb->our_cfg.fcr.rtrans_tout;
   2013         p_cfg->fcr.mon_tout     = p_ccb->our_cfg.fcr.mon_tout;
   2014     }
   2015 }
   2016 
   2017 /*******************************************************************************
   2018 **
   2019 ** Function         l2c_fcr_renegotiate_chan
   2020 **
   2021 ** Description      Called upon unsuccessful peer response to config request.
   2022 **                  If the error is because of the channel mode, it will try
   2023 **                  to resend using another supported optional channel.
   2024 **
   2025 ** Returns          TRUE if resent configuration, False if channel matches or
   2026 **                  cannot match.
   2027 **
   2028 *******************************************************************************/
   2029 BOOLEAN l2c_fcr_renegotiate_chan(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2030 {
   2031     assert(p_ccb != NULL);
   2032     assert(p_cfg != NULL);
   2033 
   2034     UINT8   peer_mode = p_ccb->our_cfg.fcr.mode;
   2035     BOOLEAN can_renegotiate;
   2036 
   2037     /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned */
   2038     if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
   2039         return (FALSE);
   2040 
   2041     /* Only retry if there are more channel options to try */
   2042     if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS)
   2043     {
   2044         peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
   2045 
   2046         if (p_ccb->our_cfg.fcr.mode != peer_mode)
   2047         {
   2048 
   2049             if ((--p_ccb->fcr_cfg_tries) == 0)
   2050             {
   2051                 p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
   2052                 L2CAP_TRACE_WARNING ("l2c_fcr_renegotiate_chan (Max retries exceeded)");
   2053             }
   2054 
   2055             can_renegotiate = FALSE;
   2056 
   2057             /* Try another supported mode if available based on our last attempted channel */
   2058             switch (p_ccb->our_cfg.fcr.mode)
   2059             {
   2060                 /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
   2061             case L2CAP_FCR_STREAM_MODE:
   2062                 /* Peer wants ERTM and we support it */
   2063                 if ( (peer_mode == L2CAP_FCR_ERTM_MODE) && (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
   2064                 {
   2065                     L2CAP_TRACE_DEBUG ("l2c_fcr_renegotiate_chan(Trying ERTM)");
   2066                     p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
   2067                     can_renegotiate = TRUE;
   2068                 }
   2069                 else    /* Falls through */
   2070 
   2071             case L2CAP_FCR_ERTM_MODE:
   2072                 {
   2073                     /* We can try basic for any other peer mode if we support it */
   2074                     if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC)
   2075                     {
   2076                         L2CAP_TRACE_DEBUG ("l2c_fcr_renegotiate_chan(Trying Basic)");
   2077                         can_renegotiate = TRUE;
   2078                         p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
   2079                     }
   2080                 }
   2081                 break;
   2082 
   2083             default:
   2084                 /* All other scenarios cannot be renegotiated */
   2085                 break;
   2086             }
   2087 
   2088             if (can_renegotiate)
   2089             {
   2090                 p_ccb->our_cfg.fcr_present = TRUE;
   2091 
   2092                 if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
   2093                 {
   2094                     p_ccb->our_cfg.fcs_present = FALSE;
   2095                     p_ccb->our_cfg.ext_flow_spec_present = FALSE;
   2096 
   2097                     /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
   2098                     if ( (p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE) )
   2099                     {
   2100                         L2CAP_TRACE_WARNING ("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
   2101                         p_cfg->mtu = L2CAP_MTU_SIZE;
   2102                     }
   2103                 }
   2104 
   2105                 l2cu_process_our_cfg_req (p_ccb, &p_ccb->our_cfg);
   2106                 l2cu_send_peer_config_req (p_ccb, &p_ccb->our_cfg);
   2107                 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_L2CAP_CHNL, L2CAP_CHNL_CFG_TIMEOUT);
   2108                 return (TRUE);
   2109             }
   2110         }
   2111     }
   2112 
   2113     /* Disconnect if the channels do not match */
   2114     if (p_ccb->our_cfg.fcr.mode != peer_mode)
   2115     {
   2116         L2CAP_TRACE_WARNING ("L2C CFG:  Channels incompatible (local %d, peer %d)",
   2117                               p_ccb->our_cfg.fcr.mode, peer_mode);
   2118         l2cu_disconnect_chnl (p_ccb);
   2119     }
   2120 
   2121     return (FALSE);
   2122 }
   2123 
   2124 
   2125 /*******************************************************************************
   2126 **
   2127 ** Function         l2c_fcr_process_peer_cfg_req
   2128 **
   2129 ** Description      This function is called to process the FCR options passed
   2130 **                  in the peer's configuration request.
   2131 **
   2132 ** Returns          UINT8 - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
   2133 **                          or L2CAP_PEER_CFG_DISCONNECT.
   2134 **
   2135 *******************************************************************************/
   2136 UINT8 l2c_fcr_process_peer_cfg_req(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2137 {
   2138     assert(p_ccb != NULL);
   2139     assert(p_cfg != NULL);
   2140 
   2141     UINT16 max_retrans_size;
   2142     UINT8  fcr_ok = L2CAP_PEER_CFG_OK;
   2143 
   2144     p_ccb->p_lcb->w4_info_rsp = FALSE;      /* Handles T61x SonyEricsson Bug in Info Request */
   2145 
   2146     L2CAP_TRACE_EVENT ("l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR mode:%d preferred: %u allowed:%u",
   2147                         p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode, p_ccb->ertm_info.preferred_mode,
   2148                         p_ccb->ertm_info.allowed_modes);
   2149 
   2150     /* If Peer wants basic, we are done (accept it or disconnect) */
   2151     if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE)
   2152     {
   2153         /* If we do not allow basic, disconnect */
   2154         if ( !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) )
   2155             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2156     }
   2157 
   2158     /* Need to negotiate if our modes are not the same */
   2159     else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode)
   2160     {
   2161         /* If peer wants a mode that we don't support then retry our mode (ex. rtx/flc), OR
   2162         ** If we want ERTM and they wanted streaming retry our mode.
   2163         ** Note: If we have already determined they support our mode previously
   2164         **       from their EXF mask.
   2165         */
   2166         if ( (((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0)
   2167             || (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE) )
   2168         {
   2169             p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
   2170             p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2171             p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
   2172             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2173         }
   2174 
   2175         /* If we wanted basic, then try to renegotiate it */
   2176         else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE)
   2177         {
   2178             p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
   2179             p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
   2180             p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
   2181             p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout = p_ccb->our_cfg.fcr.mps = 0;
   2182             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2183         }
   2184 
   2185         /* Only other valid case is if they want ERTM and we wanted STM which should be
   2186            accepted if we support it; otherwise the channel should be disconnected */
   2187         else if ( (p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE)
   2188               || !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
   2189         {
   2190             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2191         }
   2192     }
   2193 
   2194     /* Configuration for FCR channels so make any adjustments and fwd to upper layer */
   2195     if (fcr_ok == L2CAP_PEER_CFG_OK)
   2196     {
   2197         /* by default don't need to send params in the response */
   2198         p_ccb->out_cfg_fcr_present = FALSE;
   2199 
   2200         /* Make any needed adjustments for the response to the peer */
   2201         if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE)
   2202         {
   2203             /* Peer desires to bypass FCS check, and streaming or ERTM mode */
   2204             if (p_cfg->fcs_present)
   2205             {
   2206                 p_ccb->peer_cfg.fcs = p_cfg->fcs;
   2207                 p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
   2208                 if( p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
   2209                     p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
   2210             }
   2211 
   2212             max_retrans_size = GKI_get_pool_bufsize (p_ccb->ertm_info.fcr_tx_pool_id) - sizeof(BT_HDR)
   2213                                             - L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET - L2CAP_FCS_LEN;
   2214 
   2215             /* Ensure the MPS is not bigger than the MTU */
   2216             if ( (p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu) )
   2217             {
   2218                 p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
   2219                 p_ccb->out_cfg_fcr_present = TRUE;
   2220             }
   2221 
   2222             /* Ensure the MPS is not bigger than our retransmission buffer */
   2223             if (p_cfg->fcr.mps > max_retrans_size)
   2224             {
   2225                 L2CAP_TRACE_DEBUG("CFG: Overriding MPS to %d (orig %d)", max_retrans_size, p_cfg->fcr.mps);
   2226 
   2227                 p_cfg->fcr.mps = max_retrans_size;
   2228                 p_ccb->out_cfg_fcr_present = TRUE;
   2229             }
   2230 
   2231             if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE || p_cfg->fcr.mode == L2CAP_FCR_STREAM_MODE)
   2232             {
   2233                 /* Always respond with FCR ERTM parameters */
   2234                 p_ccb->out_cfg_fcr_present = TRUE;
   2235             }
   2236         }
   2237 
   2238         /* Everything ok, so save the peer's adjusted fcr options */
   2239         p_ccb->peer_cfg.fcr = p_cfg->fcr;
   2240 
   2241         if (p_cfg->fcr_present)
   2242             p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
   2243     }
   2244     else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE)
   2245     {
   2246         /* Allow peer only one retry for mode */
   2247         if (p_ccb->peer_cfg_already_rejected)
   2248             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2249         else
   2250             p_ccb->peer_cfg_already_rejected = TRUE;
   2251     }
   2252 
   2253     return (fcr_ok);
   2254 }
   2255 
   2256 #if (L2CAP_ERTM_STATS == TRUE)
   2257 /*******************************************************************************
   2258 **
   2259 ** Function         l2c_fcr_collect_ack_delay
   2260 **
   2261 ** Description      collect throughput, delay, queue size of waiting ack
   2262 **
   2263 ** Parameters
   2264 **                  tL2C_CCB
   2265 **
   2266 ** Returns          void
   2267 **
   2268 *******************************************************************************/
   2269 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
   2270 {
   2271     UINT32  index;
   2272     BT_HDR *p_buf;
   2273     UINT8  *p;
   2274     UINT32  timestamp, delay;
   2275     UINT8   xx;
   2276     UINT8   str[120];
   2277 
   2278     index = p_ccb->fcrb.ack_delay_avg_index;
   2279 
   2280     /* update sum, max and min of waiting for ack queue size */
   2281     p_ccb->fcrb.ack_q_count_avg[index] += p_ccb->fcrb.waiting_for_ack_q.count;
   2282 
   2283     if ( p_ccb->fcrb.waiting_for_ack_q.count > p_ccb->fcrb.ack_q_count_max[index] )
   2284         p_ccb->fcrb.ack_q_count_max[index] = p_ccb->fcrb.waiting_for_ack_q.count;
   2285 
   2286     if ( p_ccb->fcrb.waiting_for_ack_q.count < p_ccb->fcrb.ack_q_count_min[index] )
   2287         p_ccb->fcrb.ack_q_count_min[index] = p_ccb->fcrb.waiting_for_ack_q.count;
   2288 
   2289     /* update sum, max and min of round trip delay of acking */
   2290     p_buf = (BT_HDR *)(p_ccb->fcrb.waiting_for_ack_q.p_first);
   2291     for (xx = 0; (xx < num_bufs_acked)&&(p_buf); xx++)
   2292     {
   2293         /* adding up length of acked I-frames to get throughput */
   2294         p_ccb->fcrb.throughput[index] += p_buf->len - 8;
   2295 
   2296         if ( xx == num_bufs_acked - 1 )
   2297         {
   2298             /* get timestamp from tx I-frame that receiver is acking */
   2299             p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
   2300             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   2301             {
   2302                 p += L2CAP_FCS_LEN;
   2303             }
   2304 
   2305             STREAM_TO_UINT32 (timestamp, p);
   2306             delay = GKI_get_os_tick_count() - timestamp;
   2307 
   2308             p_ccb->fcrb.ack_delay_avg[index] += delay;
   2309             if ( delay > p_ccb->fcrb.ack_delay_max[index] )
   2310                 p_ccb->fcrb.ack_delay_max[index] = delay;
   2311             if ( delay < p_ccb->fcrb.ack_delay_min[index] )
   2312                 p_ccb->fcrb.ack_delay_min[index] = delay;
   2313         }
   2314 
   2315         p_buf = GKI_getnext(p_buf);
   2316     }
   2317 
   2318     p_ccb->fcrb.ack_delay_avg_count++;
   2319 
   2320     /* calculate average and initialize next avg, min and max */
   2321     if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES)
   2322     {
   2323         p_ccb->fcrb.ack_delay_avg_count = 0;
   2324 
   2325         p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2326         p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2327 
   2328         /* calculate throughput */
   2329         timestamp = GKI_get_os_tick_count();
   2330         if (timestamp - p_ccb->fcrb.throughput_start > 0 )
   2331             p_ccb->fcrb.throughput[index] /= (timestamp - p_ccb->fcrb.throughput_start);
   2332 
   2333         p_ccb->fcrb.throughput_start = timestamp;
   2334 
   2335         sprintf(str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
   2336                 index, p_ccb->fcrb.throughput[index],
   2337                 p_ccb->fcrb.ack_delay_avg[index], p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
   2338                 p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index], p_ccb->fcrb.ack_q_count_max[index] );
   2339 
   2340         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", str);
   2341 
   2342         index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
   2343         p_ccb->fcrb.ack_delay_avg_index = index;
   2344 
   2345         p_ccb->fcrb.ack_q_count_max[index] = 0;
   2346         p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
   2347         p_ccb->fcrb.ack_q_count_avg[index] = 0;
   2348 
   2349 
   2350         p_ccb->fcrb.ack_delay_max[index] = 0;
   2351         p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
   2352         p_ccb->fcrb.ack_delay_avg[index] = 0;
   2353 
   2354         p_ccb->fcrb.throughput[index] = 0;
   2355     }
   2356 }
   2357 #endif
   2358