Home | History | Annotate | Download | only in l2cap
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 1999-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains the L2CAP API code
     22  *
     23  ******************************************************************************/
     24 
     25 #define LOG_TAG "bt_l2cap"
     26 
     27 #include <assert.h>
     28 #include <stdlib.h>
     29 #include <string.h>
     30 #include <stdio.h>
     31 
     32 #include "gki.h"
     33 #include "bt_types.h"
     34 #include "btcore/include/counter.h"
     35 #include "hcidefs.h"
     36 #include "hcimsgs.h"
     37 #include "l2cdefs.h"
     38 #include "l2c_int.h"
     39 #include "btu.h"
     40 #include "btm_api.h"
     41 #include "osi/include/allocator.h"
     42 #include "osi/include/log.h"
     43 
     44 /*******************************************************************************
     45 **
     46 ** Function         L2CA_Register
     47 **
     48 ** Description      Other layers call this function to register for L2CAP
     49 **                  services.
     50 **
     51 ** Returns          PSM to use or zero if error. Typically, the PSM returned
     52 **                  is the same as was passed in, but for an outgoing-only
     53 **                  connection to a dynamic PSM, a "virtual" PSM is returned
     54 **                  and should be used in the calls to L2CA_ConnectReq(),
     55 **                  L2CA_ErtmConnectReq() and L2CA_Deregister()
     56 **
     57 *******************************************************************************/
     58 UINT16 L2CA_Register (UINT16 psm, tL2CAP_APPL_INFO *p_cb_info)
     59 {
     60     tL2C_RCB    *p_rcb;
     61     UINT16      vpsm = psm;
     62 
     63     L2CAP_TRACE_API ("L2CAP - L2CA_Register() called for PSM: 0x%04x", psm);
     64 
     65     /* Verify that the required callback info has been filled in
     66     **      Note:  Connection callbacks are required but not checked
     67     **             for here because it is possible to be only a client
     68     **             or only a server.
     69     */
     70     if ((!p_cb_info->pL2CA_ConfigCfm_Cb)
     71      || (!p_cb_info->pL2CA_ConfigInd_Cb)
     72      || (!p_cb_info->pL2CA_DataInd_Cb)
     73      || (!p_cb_info->pL2CA_DisconnectInd_Cb))
     74     {
     75         L2CAP_TRACE_ERROR ("L2CAP - no cb registering PSM: 0x%04x", psm);
     76         return (0);
     77     }
     78 
     79     /* Verify PSM is valid */
     80     if (L2C_INVALID_PSM(psm))
     81     {
     82         L2CAP_TRACE_ERROR ("L2CAP - invalid PSM value, PSM: 0x%04x", psm);
     83         return (0);
     84     }
     85 
     86     /* Check if this is a registration for an outgoing-only connection to */
     87     /* a dynamic PSM. If so, allocate a "virtual" PSM for the app to use. */
     88     if ( (psm >= 0x1001) && (p_cb_info->pL2CA_ConnectInd_Cb == NULL) )
     89     {
     90         for (vpsm = 0x1002; vpsm < 0x8000; vpsm += 2)
     91         {
     92             if ((p_rcb = l2cu_find_rcb_by_psm (vpsm)) == NULL)
     93                 break;
     94         }
     95 
     96         L2CAP_TRACE_API ("L2CA_Register - Real PSM: 0x%04x  Virtual PSM: 0x%04x", psm, vpsm);
     97     }
     98 
     99     /* If registration block already there, just overwrite it */
    100     if ((p_rcb = l2cu_find_rcb_by_psm (vpsm)) == NULL)
    101     {
    102         if ((p_rcb = l2cu_allocate_rcb (vpsm)) == NULL)
    103         {
    104             L2CAP_TRACE_WARNING ("L2CAP - no RCB available, PSM: 0x%04x  vPSM: 0x%04x", psm, vpsm);
    105             return (0);
    106         }
    107     }
    108 
    109     p_rcb->api      = *p_cb_info;
    110     p_rcb->real_psm = psm;
    111 
    112     return (vpsm);
    113 }
    114 
    115 
    116 
    117 /*******************************************************************************
    118 **
    119 ** Function         L2CA_Deregister
    120 **
    121 ** Description      Other layers call this function to de-register for L2CAP
    122 **                  services.
    123 **
    124 ** Returns          void
    125 **
    126 *******************************************************************************/
    127 void L2CA_Deregister (UINT16 psm)
    128 {
    129     tL2C_RCB    *p_rcb;
    130     tL2C_CCB    *p_ccb;
    131     tL2C_LCB    *p_lcb;
    132     int         ii;
    133 
    134     L2CAP_TRACE_API ("L2CAP - L2CA_Deregister() called for PSM: 0x%04x", psm);
    135 
    136     if ((p_rcb = l2cu_find_rcb_by_psm (psm)) != NULL)
    137     {
    138         p_lcb = &l2cb.lcb_pool[0];
    139         for (ii = 0; ii < MAX_L2CAP_LINKS; ii++, p_lcb++)
    140         {
    141             if (p_lcb->in_use)
    142             {
    143                 if (((p_ccb = p_lcb->ccb_queue.p_first_ccb) == NULL)
    144                  || (p_lcb->link_state == LST_DISCONNECTING))
    145                     continue;
    146 
    147                 if ((p_ccb->in_use) &&
    148                     ((p_ccb->chnl_state == CST_W4_L2CAP_DISCONNECT_RSP) ||
    149                      (p_ccb->chnl_state == CST_W4_L2CA_DISCONNECT_RSP)))
    150                     continue;
    151 
    152                 if (p_ccb->p_rcb == p_rcb)
    153                     l2c_csm_execute (p_ccb, L2CEVT_L2CA_DISCONNECT_REQ, NULL);
    154             }
    155         }
    156         l2cu_release_rcb (p_rcb);
    157     }
    158     else
    159     {
    160         L2CAP_TRACE_WARNING ("L2CAP - PSM: 0x%04x not found for deregistration", psm);
    161     }
    162 }
    163 
    164 /*******************************************************************************
    165 **
    166 ** Function         L2CA_AllocatePSM
    167 **
    168 ** Description      Other layers call this function to find an unused PSM for L2CAP
    169 **                  services.
    170 **
    171 ** Returns          PSM to use.
    172 **
    173 *******************************************************************************/
    174 UINT16 L2CA_AllocatePSM(void)
    175 {
    176     BOOLEAN done = FALSE;
    177     UINT16 psm = l2cb.dyn_psm;
    178 
    179     L2CAP_TRACE_API( "L2CA_AllocatePSM");
    180     while (!done)
    181     {
    182         psm += 2;
    183         if (psm > 0xfeff)
    184         {
    185             psm = 0x1001;
    186         }
    187         else if (psm & 0x0100)
    188         {
    189             /* the upper byte must be even */
    190             psm += 0x0100;
    191         }
    192 
    193         /* if psm is in range of reserved BRCM Aware features */
    194         if ((BRCM_RESERVED_PSM_START <= psm)&&(psm <= BRCM_RESERVED_PSM_END))
    195             continue;
    196 
    197         /* make sure the newlly allocated psm is not used right now */
    198         if ((l2cu_find_rcb_by_psm (psm)) == NULL)
    199             done = TRUE;
    200     }
    201     l2cb.dyn_psm = psm;
    202 
    203     return(psm);
    204 }
    205 
    206 /*******************************************************************************
    207 **
    208 ** Function         L2CA_ConnectReq
    209 **
    210 ** Description      Higher layers call this function to create an L2CAP connection.
    211 **                  Note that the connection is not established at this time, but
    212 **                  connection establishment gets started. The callback function
    213 **                  will be invoked when connection establishes or fails.
    214 **
    215 ** Returns          the CID of the connection, or 0 if it failed to start
    216 **
    217 *******************************************************************************/
    218 UINT16 L2CA_ConnectReq (UINT16 psm, BD_ADDR p_bd_addr)
    219 {
    220     return L2CA_ErtmConnectReq (psm, p_bd_addr, NULL);
    221 }
    222 
    223 /*******************************************************************************
    224 **
    225 ** Function         L2CA_ErtmConnectReq
    226 **
    227 ** Description      Higher layers call this function to create an L2CAP connection.
    228 **                  Note that the connection is not established at this time, but
    229 **                  connection establishment gets started. The callback function
    230 **                  will be invoked when connection establishes or fails.
    231 **
    232 **  Parameters:       PSM: L2CAP PSM for the connection
    233 **                    BD address of the peer
    234 **                   Enhaced retransmission mode configurations
    235 
    236 ** Returns          the CID of the connection, or 0 if it failed to start
    237 **
    238 *******************************************************************************/
    239 UINT16 L2CA_ErtmConnectReq (UINT16 psm, BD_ADDR p_bd_addr, tL2CAP_ERTM_INFO *p_ertm_info)
    240 {
    241     tL2C_LCB        *p_lcb;
    242     tL2C_CCB        *p_ccb;
    243     tL2C_RCB        *p_rcb;
    244 
    245     counter_add("l2cap.conn.req", 1);
    246     L2CAP_TRACE_API ("L2CA_ErtmConnectReq()  PSM: 0x%04x  BDA: %08x%04x  p_ertm_info: 0x%08x allowed:0x%x preferred:%d", psm,
    247                       (p_bd_addr[0]<<24)+(p_bd_addr[1]<<16)+(p_bd_addr[2]<<8)+p_bd_addr[3],
    248                       (p_bd_addr[4]<<8)+p_bd_addr[5], p_ertm_info,
    249                       (p_ertm_info) ? p_ertm_info->allowed_modes : 0,
    250                       (p_ertm_info) ? p_ertm_info->preferred_mode : 0);
    251 
    252     /* Fail if we have not established communications with the controller */
    253     if (!BTM_IsDeviceUp())
    254     {
    255         L2CAP_TRACE_WARNING ("L2CAP connect req - BTU not ready");
    256         return (0);
    257     }
    258     /* Fail if the PSM is not registered */
    259     if ((p_rcb = l2cu_find_rcb_by_psm (psm)) == NULL)
    260     {
    261         L2CAP_TRACE_WARNING ("L2CAP - no RCB for L2CA_conn_req, PSM: 0x%04x", psm);
    262         return (0);
    263     }
    264 
    265     /* First, see if we already have a link to the remote */
    266     /* assume all ERTM l2cap connection is going over BR/EDR for now */
    267     if ((p_lcb = l2cu_find_lcb_by_bd_addr (p_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
    268     {
    269         /* No link. Get an LCB and start link establishment */
    270         if ( ((p_lcb = l2cu_allocate_lcb (p_bd_addr, FALSE, BT_TRANSPORT_BR_EDR)) == NULL)
    271              /* currently use BR/EDR for ERTM mode l2cap connection */
    272          ||  (l2cu_create_conn(p_lcb, BT_TRANSPORT_BR_EDR) == FALSE) )
    273         {
    274             L2CAP_TRACE_WARNING ("L2CAP - conn not started for PSM: 0x%04x  p_lcb: 0x%08x", psm, p_lcb);
    275             return (0);
    276         }
    277     }
    278 
    279     /* Allocate a channel control block */
    280     if ((p_ccb = l2cu_allocate_ccb (p_lcb, 0)) == NULL)
    281     {
    282         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_conn_req, PSM: 0x%04x", psm);
    283         return (0);
    284     }
    285 
    286     /* Save registration info */
    287     p_ccb->p_rcb = p_rcb;
    288 
    289     if (p_ertm_info)
    290     {
    291         p_ccb->ertm_info  = *p_ertm_info;
    292 
    293         /* Replace default indicators with the actual default pool */
    294         if (p_ccb->ertm_info.fcr_rx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    295             p_ccb->ertm_info.fcr_rx_pool_id = L2CAP_FCR_RX_POOL_ID;
    296 
    297         if (p_ccb->ertm_info.fcr_tx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    298             p_ccb->ertm_info.fcr_tx_pool_id = L2CAP_FCR_TX_POOL_ID;
    299 
    300         if (p_ccb->ertm_info.user_rx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    301             p_ccb->ertm_info.user_rx_pool_id = HCI_ACL_POOL_ID;
    302 
    303         if (p_ccb->ertm_info.user_tx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    304             p_ccb->ertm_info.user_tx_pool_id = HCI_ACL_POOL_ID;
    305 
    306         p_ccb->max_rx_mtu = GKI_get_pool_bufsize (p_ertm_info->user_rx_pool_id) -
    307             (L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET + L2CAP_FCS_LEN);
    308     }
    309 
    310     /* If link is up, start the L2CAP connection */
    311     if (p_lcb->link_state == LST_CONNECTED)
    312     {
    313         l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONNECT_REQ, NULL);
    314     }
    315 
    316     /* If link is disconnecting, save link info to retry after disconnect
    317      * Possible Race condition when a reconnect occurs
    318      * on the channel during a disconnect of link. This
    319      * ccb will be automatically retried after link disconnect
    320      * arrives
    321      */
    322     else if (p_lcb->link_state == LST_DISCONNECTING)
    323     {
    324         L2CAP_TRACE_DEBUG ("L2CAP API - link disconnecting: RETRY LATER");
    325 
    326         /* Save ccb so it can be started after disconnect is finished */
    327         p_lcb->p_pending_ccb = p_ccb;
    328     }
    329 
    330     L2CAP_TRACE_API ("L2CAP - L2CA_conn_req(psm: 0x%04x) returned CID: 0x%04x", psm, p_ccb->local_cid);
    331 
    332     /* Return the local CID as our handle */
    333     return (p_ccb->local_cid);
    334 }
    335 
    336 bool L2CA_SetConnectionCallbacks(uint16_t local_cid, const tL2CAP_APPL_INFO *callbacks) {
    337   assert(callbacks != NULL);
    338   assert(callbacks->pL2CA_ConnectInd_Cb == NULL);
    339   assert(callbacks->pL2CA_ConnectCfm_Cb != NULL);
    340   assert(callbacks->pL2CA_ConfigInd_Cb != NULL);
    341   assert(callbacks->pL2CA_ConfigCfm_Cb != NULL);
    342   assert(callbacks->pL2CA_DisconnectInd_Cb != NULL);
    343   assert(callbacks->pL2CA_DisconnectCfm_Cb != NULL);
    344   assert(callbacks->pL2CA_CongestionStatus_Cb != NULL);
    345   assert(callbacks->pL2CA_DataInd_Cb != NULL);
    346   assert(callbacks->pL2CA_TxComplete_Cb != NULL);
    347 
    348   tL2C_CCB *channel_control_block = l2cu_find_ccb_by_cid(NULL, local_cid);
    349   if (!channel_control_block) {
    350     LOG_ERROR("%s no channel control block found for L2CAP LCID=0x%04x.", __func__, local_cid);
    351     return false;
    352   }
    353 
    354   // We're making a connection-specific registration control block so we check if
    355   // we already have a private one allocated to us on the heap. If not, we make a
    356   // new allocation, mark it as heap-allocated, and inherit the fields from the old
    357   // control block.
    358   tL2C_RCB *registration_control_block = channel_control_block->p_rcb;
    359   if (!channel_control_block->should_free_rcb) {
    360     registration_control_block = (tL2C_RCB *)osi_calloc(sizeof(tL2C_RCB));
    361     if (!registration_control_block) {
    362       LOG_ERROR("%s unable to allocate registration control block.", __func__);
    363       return false;
    364     }
    365 
    366     *registration_control_block = *channel_control_block->p_rcb;
    367     channel_control_block->p_rcb = registration_control_block;
    368     channel_control_block->should_free_rcb = true;
    369   }
    370 
    371   registration_control_block->api = *callbacks;
    372   return true;
    373 }
    374 
    375 /*******************************************************************************
    376 **
    377 ** Function         L2CA_ConnectRsp
    378 **
    379 ** Description      Higher layers call this function to accept an incoming
    380 **                  L2CAP connection, for which they had gotten an connect
    381 **                  indication callback.
    382 **
    383 ** Returns          TRUE for success, FALSE for failure
    384 **
    385 *******************************************************************************/
    386 BOOLEAN L2CA_ConnectRsp (BD_ADDR p_bd_addr, UINT8 id, UINT16 lcid,
    387                               UINT16 result, UINT16 status)
    388 {
    389     return L2CA_ErtmConnectRsp (p_bd_addr, id, lcid, result, status, NULL);
    390 }
    391 
    392 
    393 /*******************************************************************************
    394 **
    395 ** Function         L2CA_ErtmConnectRsp
    396 **
    397 ** Description      Higher layers call this function to accept an incoming
    398 **                  L2CAP connection, for which they had gotten an connect
    399 **                  indication callback.
    400 **
    401 ** Returns          TRUE for success, FALSE for failure
    402 **
    403 *******************************************************************************/
    404 BOOLEAN L2CA_ErtmConnectRsp (BD_ADDR p_bd_addr, UINT8 id, UINT16 lcid, UINT16 result,
    405                              UINT16 status, tL2CAP_ERTM_INFO *p_ertm_info)
    406 {
    407     tL2C_LCB        *p_lcb;
    408     tL2C_CCB        *p_ccb;
    409 
    410     counter_add("l2cap.conn.rsp", 1);
    411     L2CAP_TRACE_API ("L2CA_ErtmConnectRsp()  CID: 0x%04x  Result: %d  Status: %d  BDA: %08x%04x  p_ertm_info:0x%08x",
    412                       lcid, result, status,
    413                       (p_bd_addr[0]<<24)+(p_bd_addr[1]<<16)+(p_bd_addr[2]<<8)+p_bd_addr[3],
    414                       (p_bd_addr[4]<<8)+p_bd_addr[5], p_ertm_info);
    415 
    416     /* First, find the link control block */
    417     if ((p_lcb = l2cu_find_lcb_by_bd_addr (p_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
    418     {
    419         /* No link. Get an LCB and start link establishment */
    420         L2CAP_TRACE_WARNING ("L2CAP - no LCB for L2CA_conn_rsp");
    421         return (FALSE);
    422     }
    423 
    424     /* Now, find the channel control block */
    425     if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) == NULL)
    426     {
    427         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_conn_rsp");
    428         return (FALSE);
    429     }
    430 
    431     /* The IDs must match */
    432     if (p_ccb->remote_id != id)
    433     {
    434         L2CAP_TRACE_WARNING ("L2CAP - bad id in L2CA_conn_rsp. Exp: %d  Got: %d", p_ccb->remote_id, id);
    435         return (FALSE);
    436     }
    437 
    438     if (p_ertm_info)
    439     {
    440         p_ccb->ertm_info  = *p_ertm_info;
    441 
    442         /* Replace default indicators with the actual default pool */
    443         if (p_ccb->ertm_info.fcr_rx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    444             p_ccb->ertm_info.fcr_rx_pool_id = L2CAP_FCR_RX_POOL_ID;
    445 
    446         if (p_ccb->ertm_info.fcr_tx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    447             p_ccb->ertm_info.fcr_tx_pool_id = L2CAP_FCR_TX_POOL_ID;
    448 
    449         if (p_ccb->ertm_info.user_rx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    450             p_ccb->ertm_info.user_rx_pool_id = HCI_ACL_POOL_ID;
    451 
    452         if (p_ccb->ertm_info.user_tx_pool_id == L2CAP_DEFAULT_ERM_POOL_ID)
    453             p_ccb->ertm_info.user_tx_pool_id = HCI_ACL_POOL_ID;
    454 
    455         p_ccb->max_rx_mtu = GKI_get_pool_bufsize (p_ertm_info->user_rx_pool_id) - (L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET + L2CAP_FCS_LEN);
    456     }
    457 
    458     if (result == L2CAP_CONN_OK)
    459     {
    460         l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONNECT_RSP, NULL);
    461     }
    462     else
    463     {
    464         tL2C_CONN_INFO   conn_info;
    465 
    466         conn_info.l2cap_result = result;
    467         conn_info.l2cap_status = status;
    468 
    469         if (result == L2CAP_CONN_PENDING)
    470             l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONNECT_RSP, &conn_info);
    471         else
    472             l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONNECT_RSP_NEG, &conn_info);
    473     }
    474 
    475     return (TRUE);
    476 }
    477 
    478 
    479 /*******************************************************************************
    480 **
    481 ** Function         L2CA_ConfigReq
    482 **
    483 ** Description      Higher layers call this function to send configuration.
    484 **
    485 **                  Note:  The FCR options of p_cfg are not used.
    486 **
    487 ** Returns          TRUE if configuration sent, else FALSE
    488 **
    489 *******************************************************************************/
    490 BOOLEAN L2CA_ConfigReq (UINT16 cid, tL2CAP_CFG_INFO *p_cfg)
    491 {
    492     tL2C_CCB        *p_ccb;
    493 
    494     counter_add("l2cap.cfg.req", 1);
    495     L2CAP_TRACE_API ("L2CA_ConfigReq()  CID 0x%04x: fcr_present:%d (mode %d) mtu_present:%d (%d)",
    496         cid, p_cfg->fcr_present, p_cfg->fcr.mode, p_cfg->mtu_present, p_cfg->mtu);
    497 
    498     /* Find the channel control block. We don't know the link it is on. */
    499     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
    500     {
    501         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_cfg_req, CID: %d", cid);
    502         return (FALSE);
    503     }
    504 
    505     /* We need to have at least one mode type common with the peer */
    506     if (!l2c_fcr_adj_our_req_options(p_ccb, p_cfg))
    507         return (FALSE);
    508 
    509     /* Don't adjust FCR options if not used */
    510     if ((!p_cfg->fcr_present)||(p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE))
    511     {
    512         /* FCR and FCS options are not used in basic mode */
    513         p_cfg->fcs_present = FALSE;
    514         p_cfg->ext_flow_spec_present = FALSE;
    515 
    516         if ( (p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE) )
    517         {
    518             L2CAP_TRACE_WARNING ("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
    519             p_cfg->mtu = L2CAP_MTU_SIZE;
    520         }
    521     }
    522 
    523     /* Save the adjusted configuration in case it needs to be used for renegotiation */
    524     p_ccb->our_cfg = *p_cfg;
    525 
    526     l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONFIG_REQ, p_cfg);
    527 
    528     return (TRUE);
    529 }
    530 
    531 
    532 /*******************************************************************************
    533 **
    534 ** Function         L2CA_ConfigRsp
    535 **
    536 ** Description      Higher layers call this function to send a configuration
    537 **                  response.
    538 **
    539 ** Returns          TRUE if configuration response sent, else FALSE
    540 **
    541 *******************************************************************************/
    542 BOOLEAN L2CA_ConfigRsp (UINT16 cid, tL2CAP_CFG_INFO *p_cfg)
    543 {
    544     tL2C_CCB        *p_ccb;
    545 
    546     counter_add("l2cap.cfg.rsp", 1);
    547     L2CAP_TRACE_API ("L2CA_ConfigRsp()  CID: 0x%04x  Result: %d MTU present:%d Flush TO:%d FCR:%d FCS:%d",
    548         cid, p_cfg->result, p_cfg->mtu_present, p_cfg->flush_to_present, p_cfg->fcr_present, p_cfg->fcs_present);
    549 
    550     /* Find the channel control block. We don't know the link it is on. */
    551     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
    552     {
    553         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_cfg_rsp, CID: %d", cid);
    554         return (FALSE);
    555     }
    556 
    557     if ( (p_cfg->result == L2CAP_CFG_OK) || (p_cfg->result == L2CAP_CFG_PENDING) )
    558         l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONFIG_RSP, p_cfg);
    559     else
    560     {
    561         p_cfg->fcr_present = FALSE; /* FCR options already negotiated before this point */
    562 
    563         /* Clear out any cached options that are being returned as an error (excluding FCR) */
    564         if (p_cfg->mtu_present)
    565             p_ccb->peer_cfg.mtu_present = FALSE;
    566         if (p_cfg->flush_to_present)
    567             p_ccb->peer_cfg.flush_to_present = FALSE;
    568         if (p_cfg->qos_present)
    569             p_ccb->peer_cfg.qos_present = FALSE;
    570 
    571         l2c_csm_execute (p_ccb, L2CEVT_L2CA_CONFIG_RSP_NEG, p_cfg);
    572     }
    573 
    574     return (TRUE);
    575 }
    576 
    577 
    578 /*******************************************************************************
    579 **
    580 ** Function         L2CA_DisconnectReq
    581 **
    582 ** Description      Higher layers call this function to disconnect a channel.
    583 **
    584 ** Returns          TRUE if disconnect sent, else FALSE
    585 **
    586 *******************************************************************************/
    587 BOOLEAN L2CA_DisconnectReq (UINT16 cid)
    588 {
    589     tL2C_CCB        *p_ccb;
    590 
    591     counter_add("l2cap.disconn.req", 1);
    592     L2CAP_TRACE_API ("L2CA_DisconnectReq()  CID: 0x%04x", cid);
    593 
    594     /* Find the channel control block. We don't know the link it is on. */
    595     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
    596     {
    597         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_disc_req, CID: %d", cid);
    598         return (FALSE);
    599     }
    600 
    601     l2c_csm_execute (p_ccb, L2CEVT_L2CA_DISCONNECT_REQ, NULL);
    602 
    603     return (TRUE);
    604 }
    605 
    606 /*******************************************************************************
    607 **
    608 ** Function         L2CA_DisconnectRsp
    609 **
    610 ** Description      Higher layers call this function to acknowledge the
    611 **                  disconnection of a channel.
    612 **
    613 ** Returns          void
    614 **
    615 *******************************************************************************/
    616 BOOLEAN L2CA_DisconnectRsp (UINT16 cid)
    617 {
    618     tL2C_CCB        *p_ccb;
    619 
    620     counter_add("l2cap.disconn.rsp", 1);
    621     L2CAP_TRACE_API ("L2CA_DisconnectRsp()  CID: 0x%04x", cid);
    622 
    623     /* Find the channel control block. We don't know the link it is on. */
    624     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
    625     {
    626         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_disc_rsp, CID: %d", cid);
    627         return (FALSE);
    628     }
    629 
    630     l2c_csm_execute (p_ccb, L2CEVT_L2CA_DISCONNECT_RSP, NULL);
    631 
    632     return (TRUE);
    633 }
    634 
    635 /*******************************************************************************
    636 **
    637 ** Function         L2CA_Ping
    638 **
    639 ** Description      Higher layers call this function to send an echo request.
    640 **
    641 ** Returns          TRUE if echo request sent, else FALSE.
    642 **
    643 *******************************************************************************/
    644 BOOLEAN  L2CA_Ping (BD_ADDR p_bd_addr, tL2CA_ECHO_RSP_CB *p_callback)
    645 {
    646     tL2C_LCB        *p_lcb;
    647 
    648     L2CAP_TRACE_API ("L2CA_Ping()  BDA: %02x-%02x-%02x-%02x-%02x-%02x",
    649                       p_bd_addr[0], p_bd_addr[1], p_bd_addr[2], p_bd_addr[3], p_bd_addr[4], p_bd_addr[5]);
    650 
    651     /* Fail if we have not established communications with the controller */
    652     if (!BTM_IsDeviceUp())
    653         return (FALSE);
    654 
    655     /* First, see if we already have a link to the remote */
    656     if ((p_lcb = l2cu_find_lcb_by_bd_addr (p_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
    657     {
    658         /* No link. Get an LCB and start link establishment */
    659         if ((p_lcb = l2cu_allocate_lcb (p_bd_addr, FALSE, BT_TRANSPORT_BR_EDR)) == NULL)
    660         {
    661             L2CAP_TRACE_WARNING ("L2CAP - no LCB for L2CA_ping");
    662             return (FALSE);
    663         }
    664         if (l2cu_create_conn(p_lcb, BT_TRANSPORT_BR_EDR) == FALSE)
    665         {
    666             return (FALSE);
    667         }
    668 
    669         p_lcb->p_echo_rsp_cb = p_callback;
    670 
    671         return (TRUE);
    672     }
    673 
    674     /* We only allow 1 ping outstanding at a time */
    675     if (p_lcb->p_echo_rsp_cb != NULL)
    676     {
    677         L2CAP_TRACE_WARNING ("L2CAP - rejected second L2CA_ping");
    678         return (FALSE);
    679     }
    680 
    681     /* Have a link control block. If link is disconnecting, tell user to retry later */
    682     if (p_lcb->link_state == LST_DISCONNECTING)
    683     {
    684         L2CAP_TRACE_WARNING ("L2CAP - L2CA_ping rejected - link disconnecting");
    685         return (FALSE);
    686     }
    687 
    688     /* Save address of callback */
    689     p_lcb->p_echo_rsp_cb = p_callback;
    690 
    691     if (p_lcb->link_state == LST_CONNECTED)
    692     {
    693         l2cu_adj_id(p_lcb, L2CAP_ADJ_BRCM_ID);  /* Make sure not using Broadcom ID */
    694         l2cu_send_peer_echo_req (p_lcb, NULL, 0);
    695         btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_ECHO_RSP_TOUT);
    696     }
    697 
    698     return (TRUE);
    699 }
    700 
    701 /*******************************************************************************
    702 **
    703 ** Function         L2CA_Echo
    704 **
    705 ** Description      Higher layers call this function to send an echo request
    706 **                  with application-specific data.
    707 **
    708 ** Returns          TRUE if echo request sent, else FALSE.
    709 **
    710 *******************************************************************************/
    711 BOOLEAN  L2CA_Echo (BD_ADDR p_bd_addr, BT_HDR *p_data, tL2CA_ECHO_DATA_CB *p_callback)
    712 {
    713     tL2C_LCB    *p_lcb;
    714     UINT8       *pp;
    715 
    716     L2CAP_TRACE_API ("L2CA_Echo() BDA: %08X%04X",
    717             ((p_bd_addr[0] << 24) + (p_bd_addr[1] << 16) + (p_bd_addr[2] <<  8) + (p_bd_addr[3])),
    718             ((p_bd_addr[4] <<  8) + (p_bd_addr[5])));
    719 
    720     /* Fail if we have not established communications with the controller */
    721     if (!BTM_IsDeviceUp())
    722         return (FALSE);
    723 
    724     if ((memcmp(BT_BD_ANY, p_bd_addr, BD_ADDR_LEN) == 0) && (p_data == NULL))
    725     {
    726         /* Only register callback without sending message. */
    727         l2cb.p_echo_data_cb = p_callback;
    728         return TRUE;
    729     }
    730 
    731     /* We assume the upper layer will call this function only when the link is established. */
    732     if ((p_lcb = l2cu_find_lcb_by_bd_addr (p_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
    733     {
    734         L2CAP_TRACE_ERROR ("L2CA_Echo ERROR : link not established");
    735         return FALSE;
    736     }
    737 
    738     if (p_lcb->link_state != LST_CONNECTED)
    739     {
    740         L2CAP_TRACE_ERROR ("L2CA_Echo ERROR : link is not connected");
    741         return FALSE;
    742     }
    743 
    744     /* Save address of callback */
    745     l2cb.p_echo_data_cb = p_callback;
    746 
    747     /* Set the pointer to the beginning of the data */
    748     pp = (UINT8 *)(p_data + 1) + p_data->offset;
    749     l2cu_adj_id(p_lcb, L2CAP_ADJ_BRCM_ID);  /* Make sure not using Broadcom ID */
    750     l2cu_send_peer_echo_req (p_lcb, pp, p_data->len);
    751 
    752     return (TRUE);
    753 
    754 }
    755 
    756 bool L2CA_GetIdentifiers(uint16_t lcid, uint16_t *rcid, uint16_t *handle) {
    757   tL2C_CCB *control_block = l2cu_find_ccb_by_cid(NULL, lcid);
    758   if (!control_block)
    759     return false;
    760 
    761   if (rcid)
    762     *rcid = control_block->remote_cid;
    763   if (handle)
    764     *handle = control_block->p_lcb->handle;
    765 
    766   return true;
    767 }
    768 
    769 /*******************************************************************************
    770 **
    771 ** Function         L2CA_SetIdleTimeout
    772 **
    773 ** Description      Higher layers call this function to set the idle timeout for
    774 **                  a connection, or for all future connections. The "idle timeout"
    775 **                  is the amount of time that a connection can remain up with
    776 **                  no L2CAP channels on it. A timeout of zero means that the
    777 **                  connection will be torn down immediately when the last channel
    778 **                  is removed. A timeout of 0xFFFF means no timeout. Values are
    779 **                  in seconds.
    780 **
    781 ** Returns          TRUE if command succeeded, FALSE if failed
    782 **
    783 ** NOTE             This timeout takes effect after at least 1 channel has been
    784 **                  established and removed. L2CAP maintains its own timer from
    785 **                  whan a connection is established till the first channel is
    786 **                  set up.
    787 *******************************************************************************/
    788 BOOLEAN L2CA_SetIdleTimeout (UINT16 cid, UINT16 timeout, BOOLEAN is_global)
    789 {
    790     tL2C_CCB        *p_ccb;
    791     tL2C_LCB        *p_lcb;
    792 
    793     if (is_global)
    794     {
    795         l2cb.idle_timeout = timeout;
    796     }
    797     else
    798     {
    799         /* Find the channel control block. We don't know the link it is on. */
    800         if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
    801         {
    802             L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_SetIdleTimeout, CID: %d", cid);
    803             return (FALSE);
    804         }
    805 
    806         p_lcb = p_ccb->p_lcb;
    807 
    808         if ((p_lcb) && (p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTED))
    809             p_lcb->idle_timeout = timeout;
    810         else
    811             return (FALSE);
    812     }
    813 
    814     return (TRUE);
    815 }
    816 
    817 /*******************************************************************************
    818 **
    819 ** Function         L2CA_SetIdleTimeoutByBdAddr
    820 **
    821 ** Description      Higher layers call this function to set the idle timeout for
    822 **                  a connection. The "idle timeout" is the amount of time that
    823 **                  a connection can remain up with no L2CAP channels on it.
    824 **                  A timeout of zero means that the connection will be torn
    825 **                  down immediately when the last channel is removed.
    826 **                  A timeout of 0xFFFF means no timeout. Values are in seconds.
    827 **                  A bd_addr is the remote BD address. If bd_addr = BT_BD_ANY,
    828 **                  then the idle timeouts for all active l2cap links will be
    829 **                  changed.
    830 **
    831 ** Returns          TRUE if command succeeded, FALSE if failed
    832 **
    833 ** NOTE             This timeout applies to all logical channels active on the
    834 **                  ACL link.
    835 *******************************************************************************/
    836 BOOLEAN L2CA_SetIdleTimeoutByBdAddr(BD_ADDR bd_addr, UINT16 timeout, tBT_TRANSPORT transport)
    837 {
    838     tL2C_LCB        *p_lcb;
    839 
    840     if (memcmp (BT_BD_ANY, bd_addr, BD_ADDR_LEN))
    841     {
    842         p_lcb = l2cu_find_lcb_by_bd_addr( bd_addr, transport);
    843         if ((p_lcb) && (p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTED))
    844         {
    845             p_lcb->idle_timeout = timeout;
    846 
    847             if (!p_lcb->ccb_queue.p_first_ccb)
    848                 l2cu_no_dynamic_ccbs (p_lcb);
    849         }
    850         else
    851             return FALSE;
    852     }
    853     else
    854     {
    855         int         xx;
    856         tL2C_LCB    *p_lcb = &l2cb.lcb_pool[0];
    857 
    858         for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_lcb++)
    859         {
    860             if ((p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTED))
    861             {
    862                 p_lcb->idle_timeout = timeout;
    863 
    864                 if (!p_lcb->ccb_queue.p_first_ccb)
    865                     l2cu_no_dynamic_ccbs (p_lcb);
    866             }
    867         }
    868     }
    869 
    870     return TRUE;
    871 }
    872 
    873 /*******************************************************************************
    874 **
    875 ** Function         L2CA_SetTraceLevel
    876 **
    877 ** Description      This function sets the trace level for L2CAP. If called with
    878 **                  a value of 0xFF, it simply reads the current trace level.
    879 **
    880 ** Returns          the new (current) trace level
    881 **
    882 *******************************************************************************/
    883 UINT8 L2CA_SetTraceLevel (UINT8 new_level)
    884 {
    885     if (new_level != 0xFF)
    886         l2cb.l2cap_trace_level = new_level;
    887 
    888     return (l2cb.l2cap_trace_level);
    889 }
    890 
    891 
    892 /*******************************************************************************
    893 **
    894 ** Function     L2CA_SetDesireRole
    895 **
    896 ** Description  This function sets the desire role for L2CAP.
    897 **              If the new role is L2CAP_ROLE_ALLOW_SWITCH, allow switch on
    898 **              HciCreateConnection.
    899 **              If the new role is L2CAP_ROLE_DISALLOW_SWITCH, do not allow switch on
    900 **              HciCreateConnection.
    901 **
    902 **              If the new role is a valid role (HCI_ROLE_MASTER or HCI_ROLE_SLAVE),
    903 **              the desire role is set to the new value. Otherwise, it is not changed.
    904 **
    905 ** Returns      the new (current) role
    906 **
    907 *******************************************************************************/
    908 UINT8 L2CA_SetDesireRole (UINT8 new_role)
    909 {
    910     L2CAP_TRACE_API ("L2CA_SetDesireRole() new:x%x, disallow_switch:%d",
    911         new_role, l2cb.disallow_switch);
    912 
    913     if (L2CAP_ROLE_CHECK_SWITCH != (L2CAP_ROLE_CHECK_SWITCH & new_role))
    914     {
    915         /* do not process the allow_switch when both bits are set */
    916         if (new_role & L2CAP_ROLE_ALLOW_SWITCH)
    917         {
    918             l2cb.disallow_switch = FALSE;
    919         }
    920         if (new_role & L2CAP_ROLE_DISALLOW_SWITCH)
    921         {
    922             l2cb.disallow_switch = TRUE;
    923         }
    924     }
    925 
    926     if (new_role == HCI_ROLE_MASTER || new_role == HCI_ROLE_SLAVE)
    927         l2cb.desire_role = new_role;
    928 
    929     return (l2cb.desire_role);
    930 }
    931 
    932 /*******************************************************************************
    933 **
    934 ** Function     L2CA_LocalLoopbackReq
    935 **
    936 ** Description  This function sets up a CID for local loopback
    937 **
    938 ** Returns      CID of 0 if none.
    939 **
    940 *******************************************************************************/
    941 UINT16 L2CA_LocalLoopbackReq (UINT16 psm, UINT16 handle, BD_ADDR p_bd_addr)
    942 {
    943     tL2C_LCB        *p_lcb;
    944     tL2C_CCB        *p_ccb;
    945     tL2C_RCB        *p_rcb;
    946 
    947     L2CAP_TRACE_API ("L2CA_LocalLoopbackReq()  PSM: %d  Handle: 0x%04x", psm, handle);
    948 
    949     /* Fail if we have not established communications with the controller */
    950     if (!BTM_IsDeviceUp())
    951     {
    952         L2CAP_TRACE_WARNING ("L2CAP loop req - BTU not ready");
    953         return (0);
    954     }
    955 
    956     /* Fail if the PSM is not registered */
    957     if ((p_rcb = l2cu_find_rcb_by_psm (psm)) == NULL)
    958     {
    959         L2CAP_TRACE_WARNING ("L2CAP - no RCB for L2CA_conn_req, PSM: %d", psm);
    960         return (0);
    961     }
    962 
    963     if ((p_lcb = l2cu_allocate_lcb (p_bd_addr, FALSE, BT_TRANSPORT_BR_EDR)) == NULL)
    964     {
    965         L2CAP_TRACE_WARNING ("L2CAP - no LCB for L2CA_conn_req");
    966         return (0);
    967     }
    968 
    969     p_lcb->link_state = LST_CONNECTED;
    970     p_lcb->handle     = handle;
    971 
    972     /* Allocate a channel control block */
    973     if ((p_ccb = l2cu_allocate_ccb (p_lcb, 0)) == NULL)
    974     {
    975         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_conn_req");
    976         return (0);
    977     }
    978 
    979     /* Save registration info */
    980     p_ccb->p_rcb        = p_rcb;
    981     p_ccb->chnl_state   = CST_OPEN;
    982     p_ccb->remote_cid   = p_ccb->local_cid;
    983     p_ccb->config_done  = CFG_DONE_MASK;
    984 
    985     /* Return the local CID as our handle */
    986     return (p_ccb->local_cid);
    987 }
    988 
    989 /*******************************************************************************
    990 **
    991 ** Function         L2CA_SetAclPriority
    992 **
    993 ** Description      Sets the transmission priority for a channel.
    994 **                  (For initial implementation only two values are valid.
    995 **                  L2CAP_PRIORITY_NORMAL and L2CAP_PRIORITY_HIGH).
    996 **
    997 ** Returns          TRUE if a valid channel, else FALSE
    998 **
    999 *******************************************************************************/
   1000 BOOLEAN L2CA_SetAclPriority (BD_ADDR bd_addr, UINT8 priority)
   1001 {
   1002     L2CAP_TRACE_API ("L2CA_SetAclPriority()  bdaddr: %02x%02x%02x%02x%04x, priority:%d",
   1003                     bd_addr[0], bd_addr[1], bd_addr[2],
   1004                     bd_addr[3], (bd_addr[4] << 8) + bd_addr[5], priority);
   1005 
   1006     return (l2cu_set_acl_priority(bd_addr, priority, FALSE));
   1007 }
   1008 
   1009 /*******************************************************************************
   1010 **
   1011 ** Function         L2CA_FlowControl
   1012 **
   1013 ** Description      Higher layers call this function to flow control a channel.
   1014 **
   1015 **                  data_enabled - TRUE data flows, FALSE data is stopped
   1016 **
   1017 ** Returns          TRUE if valid channel, else FALSE
   1018 **
   1019 *******************************************************************************/
   1020 BOOLEAN L2CA_FlowControl (UINT16 cid, BOOLEAN data_enabled)
   1021 {
   1022     tL2C_CCB  *p_ccb;
   1023     BOOLEAN   on_off = !data_enabled;
   1024 
   1025     L2CAP_TRACE_API ("L2CA_FlowControl(%d)  CID: 0x%04x", on_off, cid);
   1026 
   1027     /* Find the channel control block. We don't know the link it is on. */
   1028     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
   1029     {
   1030         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_FlowControl, CID: 0x%04x  data_enabled: %d", cid, data_enabled);
   1031         return (FALSE);
   1032     }
   1033 
   1034     if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_ERTM_MODE)
   1035     {
   1036         L2CAP_TRACE_EVENT ("L2CA_FlowControl()  invalid mode:%d", p_ccb->peer_cfg.fcr.mode);
   1037         return (FALSE);
   1038     }
   1039     if (p_ccb->fcrb.local_busy != on_off)
   1040     {
   1041         p_ccb->fcrb.local_busy = on_off;
   1042 
   1043         if ( (p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack) )
   1044         {
   1045             if (on_off)
   1046                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1047             else
   1048                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
   1049         }
   1050     }
   1051 
   1052     return (TRUE);
   1053 }
   1054 
   1055 /*******************************************************************************
   1056 **
   1057 ** Function         L2CA_SendTestSFrame
   1058 **
   1059 ** Description      Higher layers call this function to send a test S-frame.
   1060 **
   1061 ** Returns          TRUE if valid Channel, else FALSE
   1062 **
   1063 *******************************************************************************/
   1064 BOOLEAN L2CA_SendTestSFrame (UINT16 cid, UINT8 sup_type, UINT8 back_track)
   1065 {
   1066     tL2C_CCB        *p_ccb;
   1067 
   1068     L2CAP_TRACE_API ("L2CA_SendTestSFrame()  CID: 0x%04x  Type: 0x%02x  back_track: %u", cid, sup_type, back_track);
   1069 
   1070     /* Find the channel control block. We don't know the link it is on. */
   1071     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
   1072     {
   1073         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_SendTestSFrame, CID: %d", cid);
   1074         return (FALSE);
   1075     }
   1076 
   1077     if ( (p_ccb->chnl_state != CST_OPEN) || (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_ERTM_MODE) )
   1078         return (FALSE);
   1079 
   1080     p_ccb->fcrb.next_seq_expected -= back_track;
   1081 
   1082     l2c_fcr_send_S_frame (p_ccb, (UINT16)(sup_type & 3), (UINT16)(sup_type & (L2CAP_FCR_P_BIT | L2CAP_FCR_F_BIT)));
   1083 
   1084     return (TRUE);
   1085 }
   1086 
   1087 
   1088 /*******************************************************************************
   1089 **
   1090 ** Function         L2CA_SetTxPriority
   1091 **
   1092 ** Description      Sets the transmission priority for a channel.
   1093 **
   1094 ** Returns          TRUE if a valid channel, else FALSE
   1095 **
   1096 *******************************************************************************/
   1097 BOOLEAN L2CA_SetTxPriority (UINT16 cid, tL2CAP_CHNL_PRIORITY priority)
   1098 {
   1099     tL2C_CCB        *p_ccb;
   1100 
   1101     L2CAP_TRACE_API ("L2CA_SetTxPriority()  CID: 0x%04x, priority:%d", cid, priority);
   1102 
   1103     /* Find the channel control block. We don't know the link it is on. */
   1104     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
   1105     {
   1106         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_SetTxPriority, CID: %d", cid);
   1107         return (FALSE);
   1108     }
   1109 
   1110     /* it will update the order of CCB in LCB by priority and update round robin service variables */
   1111     l2cu_change_pri_ccb (p_ccb, priority);
   1112 
   1113     return (TRUE);
   1114 }
   1115 
   1116 /*******************************************************************************
   1117 **
   1118 ** Function         L2CA_SetChnlDataRate
   1119 **
   1120 ** Description      Sets the tx/rx data rate for a channel.
   1121 **
   1122 ** Returns          TRUE if a valid channel, else FALSE
   1123 **
   1124 *******************************************************************************/
   1125 BOOLEAN L2CA_SetChnlDataRate (UINT16 cid, tL2CAP_CHNL_DATA_RATE tx, tL2CAP_CHNL_DATA_RATE rx)
   1126 {
   1127     tL2C_CCB        *p_ccb;
   1128 
   1129     L2CAP_TRACE_API ("L2CA_SetChnlDataRate()  CID: 0x%04x, tx:%d, rx:%d", cid, tx, rx);
   1130 
   1131     /* Find the channel control block. We don't know the link it is on. */
   1132     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
   1133     {
   1134         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_SetChnlDataRate, CID: %d", cid);
   1135         return (FALSE);
   1136     }
   1137 
   1138     p_ccb->tx_data_rate = tx;
   1139     p_ccb->rx_data_rate = rx;
   1140 
   1141     /* Adjust channel buffer allocation */
   1142     l2c_link_adjust_chnl_allocation ();
   1143 
   1144     return(TRUE);
   1145 }
   1146 
   1147 /*******************************************************************************
   1148 **
   1149 ** Function         L2CA_SetFlushTimeout
   1150 **
   1151 ** Description      This function set the automatic flush time out in Baseband
   1152 **                  for ACL-U packets.
   1153 **                  BdAddr : the remote BD address of ACL link. If it is BT_DB_ANY
   1154 **                           then the flush time out will be applied to all ACL link.
   1155 **                  FlushTimeout: flush time out in ms
   1156 **                           0x0000 : No automatic flush
   1157 **                           L2CAP_NO_RETRANSMISSION : No retransmission
   1158 **                           0x0002 - 0xFFFE : flush time out, if (flush_tout*8)+3/5)
   1159 **                                    <= HCI_MAX_AUTO_FLUSH_TOUT (in 625us slot).
   1160 **                                    Otherwise, return FALSE.
   1161 **                           L2CAP_NO_AUTOMATIC_FLUSH : No automatic flush
   1162 **
   1163 ** Returns          TRUE if command succeeded, FALSE if failed
   1164 **
   1165 ** NOTE             This flush timeout applies to all logical channels active on the
   1166 **                  ACL link.
   1167 *******************************************************************************/
   1168 BOOLEAN L2CA_SetFlushTimeout (BD_ADDR bd_addr, UINT16 flush_tout)
   1169 {
   1170     tL2C_LCB    *p_lcb;
   1171     UINT16      hci_flush_to;
   1172     UINT32      temp;
   1173 
   1174     /* no automatic flush (infinite timeout) */
   1175     if (flush_tout == 0x0000)
   1176     {
   1177         hci_flush_to = flush_tout;
   1178         flush_tout   = L2CAP_NO_AUTOMATIC_FLUSH;
   1179     }
   1180     /* no retransmission */
   1181     else if (flush_tout == L2CAP_NO_RETRANSMISSION)
   1182     {
   1183         /* not mandatory range for controller */
   1184         /* Packet is flushed before getting any ACK/NACK */
   1185         /* To do this, flush timeout should be 1 baseband slot */
   1186         hci_flush_to = flush_tout;
   1187     }
   1188     /* no automatic flush (infinite timeout) */
   1189     else if (flush_tout == L2CAP_NO_AUTOMATIC_FLUSH)
   1190     {
   1191         hci_flush_to = 0x0000;
   1192     }
   1193     else
   1194     {
   1195         /* convert L2CAP flush_to to 0.625 ms units, with round */
   1196         temp = (((UINT32)flush_tout * 8) + 3) / 5;
   1197 
   1198         /* if L2CAP flush_to within range of HCI, set HCI flush timeout */
   1199         if (temp > HCI_MAX_AUTO_FLUSH_TOUT)
   1200         {
   1201             L2CAP_TRACE_WARNING("WARNING L2CA_SetFlushTimeout timeout(0x%x) is out of range", flush_tout);
   1202             return FALSE;
   1203         }
   1204         else
   1205         {
   1206             hci_flush_to = (UINT16)temp;
   1207         }
   1208     }
   1209 
   1210     if (memcmp (BT_BD_ANY, bd_addr, BD_ADDR_LEN))
   1211     {
   1212         p_lcb = l2cu_find_lcb_by_bd_addr (bd_addr, BT_TRANSPORT_BR_EDR);
   1213 
   1214         if ((p_lcb) && (p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTED))
   1215         {
   1216             if (p_lcb->link_flush_tout != flush_tout)
   1217             {
   1218                 p_lcb->link_flush_tout = flush_tout;
   1219 
   1220                 L2CAP_TRACE_API ("L2CA_SetFlushTimeout 0x%04x ms for bd_addr [...;%02x%02x%02x]",
   1221                                   flush_tout, bd_addr[3], bd_addr[4], bd_addr[5]);
   1222 
   1223                 if (!btsnd_hcic_write_auto_flush_tout (p_lcb->handle, hci_flush_to))
   1224                     return (FALSE);
   1225             }
   1226         }
   1227         else
   1228         {
   1229             L2CAP_TRACE_WARNING ("WARNING L2CA_SetFlushTimeout No lcb for bd_addr [...;%02x%02x%02x]",
   1230                                   bd_addr[3], bd_addr[4], bd_addr[5]);
   1231             return (FALSE);
   1232         }
   1233     }
   1234     else
   1235     {
   1236         int   xx;
   1237         p_lcb = &l2cb.lcb_pool[0];
   1238 
   1239         for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_lcb++)
   1240         {
   1241             if ((p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTED))
   1242             {
   1243                 if (p_lcb->link_flush_tout != flush_tout)
   1244                 {
   1245                     p_lcb->link_flush_tout = flush_tout;
   1246 
   1247                     L2CAP_TRACE_API ("L2CA_SetFlushTimeout 0x%04x ms for bd_addr [...;%02x%02x%02x]",
   1248                                       flush_tout, p_lcb->remote_bd_addr[3],
   1249                                       p_lcb->remote_bd_addr[4], p_lcb->remote_bd_addr[5]);
   1250 
   1251                     if (!btsnd_hcic_write_auto_flush_tout(p_lcb->handle, hci_flush_to))
   1252                         return (FALSE);
   1253                 }
   1254             }
   1255         }
   1256     }
   1257 
   1258     return (TRUE);
   1259 }
   1260 
   1261 /*******************************************************************************
   1262 **
   1263 **  Function         L2CA_GetPeerFeatures
   1264 **
   1265 **  Description      Get a peers features and fixed channel map
   1266 **
   1267 **  Parameters:      BD address of the peer
   1268 **                   Pointers to features and channel mask storage area
   1269 **
   1270 **  Return value:    TRUE if peer is connected
   1271 **
   1272 *******************************************************************************/
   1273 BOOLEAN L2CA_GetPeerFeatures (BD_ADDR bd_addr, UINT32 *p_ext_feat, UINT8 *p_chnl_mask)
   1274 {
   1275     tL2C_LCB        *p_lcb;
   1276 
   1277     /* We must already have a link to the remote */
   1278     if ((p_lcb = l2cu_find_lcb_by_bd_addr (bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
   1279     {
   1280         L2CAP_TRACE_WARNING ("L2CA_GetPeerFeatures() No BDA: %08x%04x",
   1281                               (bd_addr[0]<<24)+(bd_addr[1]<<16)+(bd_addr[2]<<8)+bd_addr[3],
   1282                               (bd_addr[4]<<8)+bd_addr[5]);
   1283         return (FALSE);
   1284     }
   1285 
   1286     L2CAP_TRACE_API ("L2CA_GetPeerFeatures() BDA: %08x%04x  ExtFea: 0x%08x  Chnl_Mask[0]: 0x%02x",
   1287                       (bd_addr[0]<<24)+(bd_addr[1]<<16)+(bd_addr[2]<<8)+bd_addr[3],
   1288                       (bd_addr[4]<<8)+bd_addr[5], p_lcb->peer_ext_fea, p_lcb->peer_chnl_mask[0]);
   1289 
   1290     *p_ext_feat = p_lcb->peer_ext_fea;
   1291 
   1292     memcpy (p_chnl_mask, p_lcb->peer_chnl_mask, L2CAP_FIXED_CHNL_ARRAY_SIZE);
   1293 
   1294     return (TRUE);
   1295 }
   1296 
   1297 /*******************************************************************************
   1298 **
   1299 **  Function         L2CA_GetBDAddrbyHandle
   1300 **
   1301 **  Description      Get BD address for the given HCI handle
   1302 **
   1303 **  Parameters:      HCI handle
   1304 **                   BD address of the peer
   1305 **
   1306 **  Return value:    TRUE if found lcb for the given handle, FALSE otherwise
   1307 **
   1308 *******************************************************************************/
   1309 BOOLEAN L2CA_GetBDAddrbyHandle (UINT16 handle, BD_ADDR bd_addr)
   1310 {
   1311     tL2C_LCB *p_lcb = NULL;
   1312     BOOLEAN found_dev = FALSE;
   1313 
   1314     p_lcb = l2cu_find_lcb_by_handle (handle);
   1315     if (p_lcb)
   1316     {
   1317         found_dev = TRUE;
   1318         memcpy (bd_addr, p_lcb->remote_bd_addr, BD_ADDR_LEN);
   1319     }
   1320 
   1321     return found_dev;
   1322 }
   1323 
   1324 /*******************************************************************************
   1325 **
   1326 **  Function         L2CA_GetChnlFcrMode
   1327 **
   1328 **  Description      Get the channel FCR mode
   1329 **
   1330 **  Parameters:      Local CID
   1331 **
   1332 **  Return value:    Channel mode
   1333 **
   1334 *******************************************************************************/
   1335 UINT8 L2CA_GetChnlFcrMode (UINT16 lcid)
   1336 {
   1337     tL2C_CCB    *p_ccb = l2cu_find_ccb_by_cid (NULL, lcid);
   1338 
   1339     if (p_ccb)
   1340     {
   1341         L2CAP_TRACE_API ("L2CA_GetChnlFcrMode() returns mode %d", p_ccb->peer_cfg.fcr.mode);
   1342         return (p_ccb->peer_cfg.fcr.mode);
   1343     }
   1344 
   1345     L2CAP_TRACE_API ("L2CA_GetChnlFcrMode() returns mode L2CAP_FCR_BASIC_MODE");
   1346     return (L2CAP_FCR_BASIC_MODE);
   1347 }
   1348 
   1349 #if (L2CAP_NUM_FIXED_CHNLS > 0)
   1350 /*******************************************************************************
   1351 **
   1352 **  Function        L2CA_RegisterFixedChannel
   1353 **
   1354 **  Description     Register a fixed channel.
   1355 **
   1356 **  Parameters:     Fixed Channel #
   1357 **                  Channel Callbacks and config
   1358 **
   1359 **  Return value:   -
   1360 **
   1361 *******************************************************************************/
   1362 BOOLEAN  L2CA_RegisterFixedChannel (UINT16 fixed_cid, tL2CAP_FIXED_CHNL_REG *p_freg)
   1363 {
   1364     if ( (fixed_cid < L2CAP_FIRST_FIXED_CHNL) || (fixed_cid > L2CAP_LAST_FIXED_CHNL) )
   1365     {
   1366         L2CAP_TRACE_ERROR ("L2CA_RegisterFixedChannel()  Invalid CID: 0x%04x", fixed_cid);
   1367 
   1368         return (FALSE);
   1369     }
   1370 
   1371     l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL] = *p_freg;
   1372     return (TRUE);
   1373 }
   1374 
   1375 /*******************************************************************************
   1376 **
   1377 **  Function        L2CA_ConnectFixedChnl
   1378 **
   1379 **  Description     Connect an fixed signalling channel to a remote device.
   1380 **
   1381 **  Parameters:     Fixed CID
   1382 **                  BD Address of remote
   1383 **
   1384 **  Return value:   TRUE if connection started
   1385 **
   1386 *******************************************************************************/
   1387 BOOLEAN L2CA_ConnectFixedChnl (UINT16 fixed_cid, BD_ADDR rem_bda)
   1388 {
   1389     tL2C_LCB *p_lcb;
   1390     tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
   1391 
   1392     L2CAP_TRACE_API  ("%s() CID: 0x%04x  BDA: %08x%04x", __func__, fixed_cid,
   1393           (rem_bda[0]<<24)+(rem_bda[1]<<16)+(rem_bda[2]<<8)+rem_bda[3], (rem_bda[4]<<8)+rem_bda[5]);
   1394 
   1395     // Check CID is valid and registered
   1396     if ( (fixed_cid < L2CAP_FIRST_FIXED_CHNL) || (fixed_cid > L2CAP_LAST_FIXED_CHNL)
   1397      ||  (l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb == NULL) )
   1398     {
   1399         L2CAP_TRACE_ERROR ("%s() Invalid CID: 0x%04x", __func__, fixed_cid);
   1400         return (FALSE);
   1401     }
   1402 
   1403     // Fail if BT is not yet up
   1404     if (!BTM_IsDeviceUp())
   1405     {
   1406         L2CAP_TRACE_WARNING ("%s(0x%04x) - BTU not ready", __func__, fixed_cid);
   1407         return (FALSE);
   1408     }
   1409 
   1410 #if BLE_INCLUDED == TRUE
   1411     if (fixed_cid >= L2CAP_ATT_CID && fixed_cid <= L2CAP_SMP_CID)
   1412         transport = BT_TRANSPORT_LE;
   1413 #endif
   1414 
   1415     tL2C_BLE_FIXED_CHNLS_MASK peer_channel_mask;
   1416 
   1417     // If we already have a link to the remote, check if it supports that CID
   1418     if ((p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, transport)) != NULL)
   1419     {
   1420         // Fixed channels are mandatory on LE transports so ignore the received
   1421         // channel mask and use the locally cached LE channel mask.
   1422 
   1423 #if BLE_INCLUDED == TRUE
   1424         if (transport == BT_TRANSPORT_LE)
   1425             peer_channel_mask = l2cb.l2c_ble_fixed_chnls_mask;
   1426         else
   1427 #endif
   1428             peer_channel_mask = p_lcb->peer_chnl_mask[0];
   1429 
   1430         // Check for supported channel
   1431         if (!(peer_channel_mask & (1 << fixed_cid)))
   1432         {
   1433             L2CAP_TRACE_EVENT  ("%s() CID:0x%04x  BDA: %08x%04x not supported", __func__,
   1434                 fixed_cid,(rem_bda[0]<<24)+(rem_bda[1]<<16)+(rem_bda[2]<<8)+rem_bda[3],
   1435                 (rem_bda[4]<<8)+rem_bda[5]);
   1436             return FALSE;
   1437         }
   1438 
   1439         // Get a CCB and link the lcb to it
   1440         if (!l2cu_initialize_fixed_ccb (p_lcb, fixed_cid,
   1441             &l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].fixed_chnl_opts))
   1442         {
   1443             L2CAP_TRACE_WARNING ("%s(0x%04x) - LCB but no CCB", __func__, fixed_cid);
   1444             return FALSE;
   1445         }
   1446 
   1447         // racing with disconnecting, queue the connection request
   1448         if (p_lcb->link_state == LST_DISCONNECTING)
   1449         {
   1450             L2CAP_TRACE_DEBUG ("$s() - link disconnecting: RETRY LATER", __func__);
   1451             /* Save ccb so it can be started after disconnect is finished */
   1452             p_lcb->p_pending_ccb = p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL];
   1453             return TRUE;
   1454         }
   1455 
   1456 #if BLE_INCLUDED == TRUE
   1457         (*l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedConn_Cb)
   1458         (fixed_cid,p_lcb->remote_bd_addr, TRUE, 0, p_lcb->transport);
   1459 #else
   1460         (*l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedConn_Cb)
   1461         (fixed_cid, p_lcb->remote_bd_addr, TRUE, 0, BT_TRANSPORT_BR_EDR);
   1462 #endif
   1463         return TRUE;
   1464     }
   1465 
   1466     // No link. Get an LCB and start link establishment
   1467     if ((p_lcb = l2cu_allocate_lcb (rem_bda, FALSE, transport)) == NULL)
   1468     {
   1469         L2CAP_TRACE_WARNING ("%s(0x%04x) - no LCB", __func__, fixed_cid);
   1470         return FALSE;
   1471     }
   1472 
   1473     // Get a CCB and link the lcb to it
   1474     if (!l2cu_initialize_fixed_ccb (p_lcb, fixed_cid,
   1475         &l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].fixed_chnl_opts))
   1476     {
   1477         p_lcb->disc_reason = L2CAP_CONN_NO_RESOURCES;
   1478         L2CAP_TRACE_WARNING ("%s(0x%04x) - no CCB", __func__, fixed_cid);
   1479         l2cu_release_lcb (p_lcb);
   1480         return FALSE;
   1481     }
   1482 
   1483     if (!l2cu_create_conn(p_lcb, transport))
   1484     {
   1485         L2CAP_TRACE_WARNING ("%s() - create_conn failed", __func__);
   1486         l2cu_release_lcb (p_lcb);
   1487         return FALSE;
   1488     }
   1489     return TRUE;
   1490 }
   1491 
   1492 /*******************************************************************************
   1493 **
   1494 **  Function        L2CA_SendFixedChnlData
   1495 **
   1496 **  Description     Write data on a fixed channel.
   1497 **
   1498 **  Parameters:     Fixed CID
   1499 **                  BD Address of remote
   1500 **                  Pointer to buffer of type BT_HDR
   1501 **
   1502 ** Return value     L2CAP_DW_SUCCESS, if data accepted
   1503 **                  L2CAP_DW_FAILED,  if error
   1504 **
   1505 *******************************************************************************/
   1506 UINT16 L2CA_SendFixedChnlData (UINT16 fixed_cid, BD_ADDR rem_bda, BT_HDR *p_buf)
   1507 {
   1508     tL2C_LCB        *p_lcb;
   1509     tBT_TRANSPORT   transport = BT_TRANSPORT_BR_EDR;
   1510 
   1511     L2CAP_TRACE_API ("L2CA_SendFixedChnlData()  CID: 0x%04x  BDA: %08x%04x", fixed_cid,
   1512                      (rem_bda[0]<<24)+(rem_bda[1]<<16)+(rem_bda[2]<<8)+rem_bda[3], (rem_bda[4]<<8)+rem_bda[5]);
   1513 
   1514 #if BLE_INCLUDED == TRUE
   1515     if (fixed_cid >= L2CAP_ATT_CID && fixed_cid <= L2CAP_SMP_CID)
   1516         transport = BT_TRANSPORT_LE;
   1517 #endif
   1518 
   1519     // Check CID is valid and registered
   1520     if ( (fixed_cid < L2CAP_FIRST_FIXED_CHNL) || (fixed_cid > L2CAP_LAST_FIXED_CHNL)
   1521      ||  (l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb == NULL) )
   1522     {
   1523         L2CAP_TRACE_ERROR ("L2CA_SendFixedChnlData()  Invalid CID: 0x%04x", fixed_cid);
   1524         GKI_freebuf (p_buf);
   1525         return (L2CAP_DW_FAILED);
   1526     }
   1527 
   1528     // Fail if BT is not yet up
   1529     if (!BTM_IsDeviceUp())
   1530     {
   1531         L2CAP_TRACE_WARNING ("L2CA_SendFixedChnlData(0x%04x) - BTU not ready", fixed_cid);
   1532         GKI_freebuf (p_buf);
   1533         return (L2CAP_DW_FAILED);
   1534     }
   1535 
   1536     // We need to have a link up
   1537     if ((p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, transport)) == NULL ||
   1538         /* if link is disconnecting, also report data sending failure */
   1539         p_lcb->link_state == LST_DISCONNECTING)
   1540     {
   1541         L2CAP_TRACE_WARNING ("L2CA_SendFixedChnlData(0x%04x) - no LCB", fixed_cid);
   1542         GKI_freebuf (p_buf);
   1543         return (L2CAP_DW_FAILED);
   1544     }
   1545 
   1546     tL2C_BLE_FIXED_CHNLS_MASK peer_channel_mask;
   1547 
   1548     // Select peer channels mask to use depending on transport
   1549 #if BLE_INCLUDED == TRUE
   1550     if (transport == BT_TRANSPORT_LE)
   1551         peer_channel_mask = l2cb.l2c_ble_fixed_chnls_mask;
   1552     else
   1553 #endif
   1554         peer_channel_mask = p_lcb->peer_chnl_mask[0];
   1555 
   1556     if ((peer_channel_mask & (1 << fixed_cid)) == 0)
   1557     {
   1558         L2CAP_TRACE_WARNING ("L2CA_SendFixedChnlData() - peer does not support fixed chnl: 0x%04x", fixed_cid);
   1559         GKI_freebuf (p_buf);
   1560         return (L2CAP_DW_FAILED);
   1561     }
   1562 
   1563     p_buf->event = 0;
   1564     p_buf->layer_specific = L2CAP_FLUSHABLE_CH_BASED;
   1565 
   1566     if (!p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL])
   1567     {
   1568         if (!l2cu_initialize_fixed_ccb (p_lcb, fixed_cid, &l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].fixed_chnl_opts))
   1569         {
   1570             L2CAP_TRACE_WARNING ("L2CA_SendFixedChnlData() - no CCB for chnl: 0x%4x", fixed_cid);
   1571             GKI_freebuf (p_buf);
   1572             return (L2CAP_DW_FAILED);
   1573         }
   1574     }
   1575 
   1576     // If already congested, do not accept any more packets
   1577     if (p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->cong_sent)
   1578     {
   1579         L2CAP_TRACE_ERROR ("L2CAP - CID: 0x%04x cannot send, already congested \
   1580             xmit_hold_q.count: %u buff_quota: %u", fixed_cid,
   1581             GKI_queue_length(&p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->xmit_hold_q),
   1582             p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->buff_quota);
   1583         GKI_freebuf (p_buf);
   1584         return (L2CAP_DW_FAILED);
   1585     }
   1586 
   1587     l2c_enqueue_peer_data (p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL], p_buf);
   1588 
   1589     l2c_link_check_send_pkts (p_lcb, NULL, NULL);
   1590 
   1591     // If there is no dynamic CCB on the link, restart the idle timer each time something is sent
   1592     if (p_lcb->in_use && p_lcb->link_state == LST_CONNECTED && !p_lcb->ccb_queue.p_first_ccb)
   1593     {
   1594         l2cu_no_dynamic_ccbs (p_lcb);
   1595     }
   1596 
   1597     if (p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->cong_sent)
   1598         return (L2CAP_DW_CONGESTED);
   1599 
   1600     return (L2CAP_DW_SUCCESS);
   1601 }
   1602 
   1603 /*******************************************************************************
   1604 **
   1605 **  Function        L2CA_RemoveFixedChnl
   1606 **
   1607 **  Description     Remove a fixed channel to a remote device.
   1608 **
   1609 **  Parameters:     Fixed CID
   1610 **                  BD Address of remote
   1611 **                  Idle timeout to use (or 0xFFFF if don't care)
   1612 **
   1613 **  Return value:   TRUE if channel removed
   1614 **
   1615 *******************************************************************************/
   1616 BOOLEAN L2CA_RemoveFixedChnl (UINT16 fixed_cid, BD_ADDR rem_bda)
   1617 {
   1618     tL2C_LCB    *p_lcb;
   1619     tL2C_CCB    *p_ccb;
   1620     tBT_TRANSPORT   transport = BT_TRANSPORT_BR_EDR;
   1621 
   1622     /* Check CID is valid and registered */
   1623     if ( (fixed_cid < L2CAP_FIRST_FIXED_CHNL) || (fixed_cid > L2CAP_LAST_FIXED_CHNL)
   1624      ||  (l2cb.fixed_reg[fixed_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb == NULL) )
   1625     {
   1626         L2CAP_TRACE_ERROR ("L2CA_RemoveFixedChnl()  Invalid CID: 0x%04x", fixed_cid);
   1627         return (FALSE);
   1628     }
   1629 
   1630 #if BLE_INCLUDED == TRUE
   1631     if (fixed_cid >= L2CAP_ATT_CID && fixed_cid <= L2CAP_SMP_CID)
   1632         transport = BT_TRANSPORT_LE;
   1633 #endif
   1634 
   1635     /* Is a fixed channel connected to the remote BDA ?*/
   1636     p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, transport);
   1637 
   1638     if ( ((p_lcb) == NULL) || (!p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]) )
   1639     {
   1640         L2CAP_TRACE_WARNING ("L2CA_RemoveFixedChnl()  CID: 0x%04x  BDA: %08x%04x not connected", fixed_cid,
   1641                              (rem_bda[0]<<24)+(rem_bda[1]<<16)+(rem_bda[2]<<8)+rem_bda[3], (rem_bda[4]<<8)+rem_bda[5]);
   1642         return (FALSE);
   1643     }
   1644 
   1645     L2CAP_TRACE_API ("L2CA_RemoveFixedChnl()  CID: 0x%04x  BDA: %08x%04x", fixed_cid,
   1646                       (rem_bda[0]<<24)+(rem_bda[1]<<16)+(rem_bda[2]<<8)+rem_bda[3], (rem_bda[4]<<8)+rem_bda[5]);
   1647 
   1648     /* Release the CCB, starting an inactivity timeout on the LCB if no other CCBs exist */
   1649     p_ccb = p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL];
   1650 
   1651     p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL] = NULL;
   1652     p_lcb->disc_reason = HCI_ERR_CONN_CAUSE_LOCAL_HOST;
   1653 
   1654 #if BLE_INCLUDED == TRUE
   1655     // Retain the link for a few more seconds after SMP pairing is done, since the Android
   1656     // platform always does service discovery after pairing is complete. This will avoid
   1657     // the link down (pairing is complete) and an immediate re-connection for service
   1658     // discovery.
   1659     // Some devices do not do auto advertising when link is dropped, thus fail the second
   1660     // connection and service discovery.
   1661     if ((fixed_cid == L2CAP_ATT_CID ) && !p_lcb->ccb_queue.p_first_ccb)
   1662         p_lcb->idle_timeout = 0;
   1663 #endif
   1664 
   1665     l2cu_release_ccb (p_ccb);
   1666 
   1667     return (TRUE);
   1668 }
   1669 
   1670 /*******************************************************************************
   1671 **
   1672 ** Function         L2CA_SetFixedChannelTout
   1673 **
   1674 ** Description      Higher layers call this function to set the idle timeout for
   1675 **                  a fixed channel. The "idle timeout" is the amount of time that
   1676 **                  a connection can remain up with no L2CAP channels on it.
   1677 **                  A timeout of zero means that the connection will be torn
   1678 **                  down immediately when the last channel is removed.
   1679 **                  A timeout of 0xFFFF means no timeout. Values are in seconds.
   1680 **                  A bd_addr is the remote BD address. If bd_addr = BT_BD_ANY,
   1681 **                  then the idle timeouts for all active l2cap links will be
   1682 **                  changed.
   1683 **
   1684 ** Returns          TRUE if command succeeded, FALSE if failed
   1685 **
   1686 *******************************************************************************/
   1687 BOOLEAN L2CA_SetFixedChannelTout (BD_ADDR rem_bda, UINT16 fixed_cid, UINT16 idle_tout)
   1688 {
   1689     tL2C_LCB        *p_lcb;
   1690     tBT_TRANSPORT   transport = BT_TRANSPORT_BR_EDR;
   1691 
   1692 #if BLE_INCLUDED == TRUE
   1693     if (fixed_cid >= L2CAP_ATT_CID && fixed_cid <= L2CAP_SMP_CID)
   1694         transport = BT_TRANSPORT_LE;
   1695 #endif
   1696 
   1697     /* Is a fixed channel connected to the remote BDA ?*/
   1698     p_lcb = l2cu_find_lcb_by_bd_addr (rem_bda, transport);
   1699     if ( ((p_lcb) == NULL) || (!p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]) )
   1700     {
   1701         L2CAP_TRACE_WARNING ("L2CA_SetFixedChannelTout()  CID: 0x%04x  BDA: %08x%04x not connected", fixed_cid,
   1702                              (rem_bda[0]<<24)+(rem_bda[1]<<16)+(rem_bda[2]<<8)+rem_bda[3], (rem_bda[4]<<8)+rem_bda[5]);
   1703         return (FALSE);
   1704     }
   1705 
   1706     p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->fixed_chnl_idle_tout = idle_tout;
   1707 
   1708     if (p_lcb->in_use && p_lcb->link_state == LST_CONNECTED && !p_lcb->ccb_queue.p_first_ccb)
   1709     {
   1710         /* If there are no dynamic CCBs, (re)start the idle timer in case we changed it */
   1711         l2cu_no_dynamic_ccbs (p_lcb);
   1712     }
   1713 
   1714     return TRUE;
   1715 }
   1716 
   1717 #endif /* #if (L2CAP_NUM_FIXED_CHNLS > 0) */
   1718 
   1719 /*******************************************************************************
   1720 **
   1721 ** Function     L2CA_GetCurrentConfig
   1722 **
   1723 ** Description  This function returns configurations of L2CAP channel
   1724 **              pp_our_cfg : pointer of our saved configuration options
   1725 **              p_our_cfg_bits : valid config in bitmap
   1726 **              pp_peer_cfg: pointer of peer's saved configuration options
   1727 **              p_peer_cfg_bits : valid config in bitmap
   1728 **
   1729 ** Returns      TRUE if successful
   1730 **
   1731 *******************************************************************************/
   1732 BOOLEAN L2CA_GetCurrentConfig (UINT16 lcid,
   1733                                tL2CAP_CFG_INFO **pp_our_cfg,  tL2CAP_CH_CFG_BITS *p_our_cfg_bits,
   1734                                tL2CAP_CFG_INFO **pp_peer_cfg, tL2CAP_CH_CFG_BITS *p_peer_cfg_bits)
   1735 {
   1736     tL2C_CCB    *p_ccb;
   1737 
   1738     L2CAP_TRACE_API ("L2CA_GetCurrentConfig()  CID: 0x%04x", lcid);
   1739 
   1740     p_ccb = l2cu_find_ccb_by_cid(NULL, lcid);
   1741 
   1742     if (p_ccb)
   1743     {
   1744         *pp_our_cfg  = &(p_ccb->our_cfg);
   1745 
   1746         /* convert valid config items into bitmap */
   1747         *p_our_cfg_bits = 0;
   1748         if (p_ccb->our_cfg.mtu_present)
   1749             *p_our_cfg_bits |= L2CAP_CH_CFG_MASK_MTU;
   1750         if (p_ccb->our_cfg.qos_present)
   1751             *p_our_cfg_bits |= L2CAP_CH_CFG_MASK_QOS;
   1752         if (p_ccb->our_cfg.flush_to_present)
   1753             *p_our_cfg_bits |= L2CAP_CH_CFG_MASK_FLUSH_TO;
   1754         if (p_ccb->our_cfg.fcr_present)
   1755             *p_our_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
   1756         if (p_ccb->our_cfg.fcs_present)
   1757             *p_our_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
   1758         if (p_ccb->our_cfg.ext_flow_spec_present)
   1759             *p_our_cfg_bits |= L2CAP_CH_CFG_MASK_EXT_FLOW_SPEC;
   1760 
   1761         *pp_peer_cfg = &(p_ccb->peer_cfg);
   1762         *p_peer_cfg_bits = p_ccb->peer_cfg_bits;
   1763 
   1764         return TRUE;
   1765     }
   1766     else
   1767     {
   1768         L2CAP_TRACE_ERROR ("No CCB for CID:0x%04x", lcid);
   1769         return FALSE;
   1770     }
   1771 }
   1772 
   1773 /*******************************************************************************
   1774 **
   1775 ** Function         L2CA_RegForNoCPEvt
   1776 **
   1777 ** Description      Register callback for Number of Completed Packets event.
   1778 **
   1779 ** Input Param      p_cb - callback for Number of completed packets event
   1780 **                  p_bda - BT address of remote device
   1781 **
   1782 ** Returns          TRUE if registered OK, else FALSE
   1783 **
   1784 *******************************************************************************/
   1785 BOOLEAN L2CA_RegForNoCPEvt(tL2CA_NOCP_CB *p_cb, BD_ADDR p_bda)
   1786 {
   1787     tL2C_LCB        *p_lcb;
   1788 
   1789     /* Find the link that is associated with this remote bdaddr */
   1790     p_lcb = l2cu_find_lcb_by_bd_addr (p_bda, BT_TRANSPORT_BR_EDR);
   1791 
   1792     /* If no link for this handle, nothing to do. */
   1793     if (!p_lcb)
   1794         return FALSE;
   1795 
   1796     p_lcb->p_nocp_cb = p_cb;
   1797 
   1798     return TRUE;
   1799 }
   1800 
   1801 /*******************************************************************************
   1802 **
   1803 ** Function         L2CA_DataWrite
   1804 **
   1805 ** Description      Higher layers call this function to write data.
   1806 **
   1807 ** Returns          L2CAP_DW_SUCCESS, if data accepted, else FALSE
   1808 **                  L2CAP_DW_CONGESTED, if data accepted and the channel is congested
   1809 **                  L2CAP_DW_FAILED, if error
   1810 **
   1811 *******************************************************************************/
   1812 UINT8 L2CA_DataWrite (UINT16 cid, BT_HDR *p_data)
   1813 {
   1814     L2CAP_TRACE_API ("L2CA_DataWrite()  CID: 0x%04x  Len: %d", cid, p_data->len);
   1815     return l2c_data_write (cid, p_data, L2CAP_FLUSHABLE_CH_BASED);
   1816 }
   1817 
   1818 /*******************************************************************************
   1819 **
   1820 ** Function         L2CA_SetChnlFlushability
   1821 **
   1822 ** Description      Higher layers call this function to set a channels
   1823 **                  flushability flags
   1824 **
   1825 ** Returns          TRUE if CID found, else FALSE
   1826 **
   1827 *******************************************************************************/
   1828 BOOLEAN L2CA_SetChnlFlushability (UINT16 cid, BOOLEAN is_flushable)
   1829 {
   1830 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
   1831 
   1832     tL2C_CCB        *p_ccb;
   1833 
   1834     /* Find the channel control block. We don't know the link it is on. */
   1835     if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL)
   1836     {
   1837         L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_SetChnlFlushability, CID: %d", cid);
   1838         return (FALSE);
   1839     }
   1840 
   1841     p_ccb->is_flushable = is_flushable;
   1842 
   1843     L2CAP_TRACE_API ("L2CA_SetChnlFlushability()  CID: 0x%04x  is_flushable: %d", cid, is_flushable);
   1844 
   1845 #endif
   1846 
   1847     return (TRUE);
   1848 }
   1849 
   1850 /*******************************************************************************
   1851 **
   1852 ** Function         L2CA_DataWriteEx
   1853 **
   1854 ** Description      Higher layers call this function to write data with extended
   1855 **                  flags.
   1856 **                  flags : L2CAP_FLUSHABLE_CH_BASED
   1857 **                          L2CAP_FLUSHABLE_PKT
   1858 **                          L2CAP_NON_FLUSHABLE_PKT
   1859 **
   1860 ** Returns          L2CAP_DW_SUCCESS, if data accepted, else FALSE
   1861 **                  L2CAP_DW_CONGESTED, if data accepted and the channel is congested
   1862 **                  L2CAP_DW_FAILED, if error
   1863 **
   1864 *******************************************************************************/
   1865 UINT8 L2CA_DataWriteEx (UINT16 cid, BT_HDR *p_data, UINT16 flags)
   1866 {
   1867     L2CAP_TRACE_API ("L2CA_DataWriteEx()  CID: 0x%04x  Len: %d Flags:0x%04X",
   1868                        cid, p_data->len, flags);
   1869     return l2c_data_write (cid, p_data, flags);
   1870 }
   1871 
   1872 /*******************************************************************************
   1873 **
   1874 ** Function     L2CA_FlushChannel
   1875 **
   1876 ** Description  This function flushes none, some or all buffers queued up
   1877 **              for xmission for a particular CID. If called with
   1878 **              L2CAP_FLUSH_CHANS_GET (0), it simply returns the number
   1879 **              of buffers queued for that CID L2CAP_FLUSH_CHANS_ALL (0xffff)
   1880 **              flushes all buffers.  All other values specifies the maximum
   1881 **              buffers to flush.
   1882 **
   1883 ** Returns      Number of buffers left queued for that CID
   1884 **
   1885 *******************************************************************************/
   1886 UINT16 L2CA_FlushChannel (UINT16 lcid, UINT16 num_to_flush)
   1887 {
   1888     tL2C_CCB        *p_ccb;
   1889     tL2C_LCB        *p_lcb;
   1890     UINT16          num_left = 0,
   1891                     num_flushed1 = 0,
   1892                     num_flushed2 = 0;
   1893 
   1894     p_ccb = l2cu_find_ccb_by_cid(NULL, lcid);
   1895 
   1896     if ( !p_ccb || ((p_lcb = p_ccb->p_lcb) == NULL) )
   1897     {
   1898         L2CAP_TRACE_WARNING ("L2CA_FlushChannel()  abnormally returning 0  CID: 0x%04x", lcid);
   1899         return (0);
   1900     }
   1901 
   1902     if (num_to_flush != L2CAP_FLUSH_CHANS_GET)
   1903     {
   1904         L2CAP_TRACE_API ("L2CA_FlushChannel (FLUSH)  CID: 0x%04x  NumToFlush: %d  QC: %u  pFirst: 0x%08x",
   1905                            lcid, num_to_flush, GKI_queue_length(&p_ccb->xmit_hold_q), GKI_getfirst(&p_ccb->xmit_hold_q));
   1906     }
   1907     else
   1908     {
   1909         L2CAP_TRACE_API ("L2CA_FlushChannel (QUERY)  CID: 0x%04x", lcid);
   1910     }
   1911 
   1912     /* Cannot flush eRTM buffers once they have a sequence number */
   1913     if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_ERTM_MODE)
   1914     {
   1915 #if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
   1916         if (num_to_flush != L2CAP_FLUSH_CHANS_GET)
   1917         {
   1918             /* If the controller supports enhanced flush, flush the data queued at the controller */
   1919             if ( (HCI_NON_FLUSHABLE_PB_SUPPORTED(BTM_ReadLocalFeatures ()))
   1920              && (BTM_GetNumScoLinks() == 0) )
   1921             {
   1922                 if ( l2cb.is_flush_active == FALSE )
   1923                 {
   1924                     l2cb.is_flush_active = TRUE;
   1925 
   1926                     /* The only packet type defined - 0 - Automatically-Flushable Only */
   1927                     btsnd_hcic_enhanced_flush (p_lcb->handle, 0);
   1928                 }
   1929             }
   1930         }
   1931 #endif
   1932 
   1933         // Iterate though list and flush the amount requested from
   1934         // the transmit data queue that satisfy the layer and event conditions.
   1935         for (const list_node_t *node = list_begin(p_lcb->link_xmit_data_q);
   1936             (num_to_flush > 0) && node != list_end(p_lcb->link_xmit_data_q);) {
   1937           BT_HDR *p_buf = (BT_HDR *)list_node(node);
   1938           node = list_next(node);
   1939           if ((p_buf->layer_specific == 0) && (p_buf->event == lcid)) {
   1940             num_to_flush--;
   1941             num_flushed1++;
   1942 
   1943             list_remove(p_lcb->link_xmit_data_q, p_buf);
   1944             GKI_freebuf(p_buf);
   1945           }
   1946         }
   1947     }
   1948 
   1949     /* If needed, flush buffers in the CCB xmit hold queue */
   1950     while ( (num_to_flush != 0) && (!GKI_queue_is_empty(&p_ccb->xmit_hold_q)))
   1951     {
   1952         BT_HDR *p_buf = (BT_HDR *)GKI_dequeue (&p_ccb->xmit_hold_q);
   1953         if (p_buf)
   1954             GKI_freebuf (p_buf);
   1955         num_to_flush--;
   1956         num_flushed2++;
   1957     }
   1958 
   1959     /* If app needs to track all packets, call him */
   1960     if ( (p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) && (num_flushed2) )
   1961         (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid, num_flushed2);
   1962 
   1963     /* Now count how many are left */
   1964     for (const list_node_t *node = list_begin(p_lcb->link_xmit_data_q);
   1965         node != list_end(p_lcb->link_xmit_data_q);
   1966         node = list_next(node)) {
   1967 
   1968       BT_HDR *p_buf = (BT_HDR *)list_node(node);
   1969       if (p_buf->event == lcid)
   1970         num_left++;
   1971     }
   1972 
   1973     /* Add in the number in the CCB xmit queue */
   1974     num_left += GKI_queue_length(&p_ccb->xmit_hold_q);
   1975 
   1976     /* Return the local number of buffers left for the CID */
   1977     L2CAP_TRACE_DEBUG ("L2CA_FlushChannel()  flushed: %u + %u,  num_left: %u", num_flushed1, num_flushed2, num_left);
   1978 
   1979     /* If we were congested, and now we are not, tell the app */
   1980     l2cu_check_channel_congestion (p_ccb);
   1981 
   1982     return (num_left);
   1983 }
   1984 
   1985