Home | History | Annotate | Download | only in l2cap
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
     22  *  functions
     23  *
     24  ******************************************************************************/
     25 
     26 #include <assert.h>
     27 #include <stdio.h>
     28 #include <stdlib.h>
     29 #include <string.h>
     30 
     31 #include "bt_types.h"
     32 #include "bt_common.h"
     33 #include "hcimsgs.h"
     34 #include "l2c_api.h"
     35 #include "l2c_int.h"
     36 #include "l2cdefs.h"
     37 #include "btm_api.h"
     38 #include "btm_int.h"
     39 #include "btu.h"
     40 
     41 
     42 extern fixed_queue_t *btu_general_alarm_queue;
     43 
     44 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted */
     45 #define L2C_FCR_RETX_ALL_PKTS   0xFF
     46 
     47 /* this is the minimal offset required by OBX to process incoming packets */
     48 static const uint16_t OBX_BUF_MIN_OFFSET = 4;
     49 
     50 #if BT_TRACE_VERBOSE == TRUE
     51 static char *SAR_types[] = { "Unsegmented", "Start", "End", "Continuation" };
     52 static char *SUP_types[] = { "RR", "REJ", "RNR", "SREJ" };
     53 #endif
     54 
     55 /* Look-up table for the CRC calculation */
     56 static const unsigned short crctab[256] = {
     57     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241,
     58     0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
     59     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40,
     60     0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
     61     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40,
     62     0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
     63     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641,
     64     0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
     65     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
     66     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
     67     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41,
     68     0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
     69     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41,
     70     0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
     71     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640,
     72     0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
     73     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240,
     74     0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
     75     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41,
     76     0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
     77     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41,
     78     0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
     79     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640,
     80     0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
     81     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241,
     82     0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
     83     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
     84     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
     85     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40,
     86     0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
     87     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641,
     88     0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
     89 };
     90 
     91 
     92 /*******************************************************************************
     93 **  Static local functions
     94 */
     95 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word);
     96 static void    process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
     97 static void    process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack);
     98 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq);
     99 static void    prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission);
    100 static void    process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf);
    101 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
    102 
    103 #if (L2CAP_ERTM_STATS == TRUE)
    104 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked);
    105 #endif
    106 
    107 /*******************************************************************************
    108 **
    109 ** Function         l2c_fcr_updcrc
    110 **
    111 ** Description      This function computes the CRC using the look-up table.
    112 **
    113 ** Returns          CRC
    114 **
    115 *******************************************************************************/
    116 static unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char *icp, int icnt)
    117 {
    118     register unsigned short crc = icrc;
    119     register unsigned char  *cp = icp;
    120     register          int   cnt = icnt;
    121 
    122     while (cnt--)
    123     {
    124         crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
    125     }
    126 
    127     return(crc);
    128 }
    129 
    130 
    131 /*******************************************************************************
    132 **
    133 ** Function         l2c_fcr_tx_get_fcs
    134 **
    135 ** Description      This function computes the CRC for a frame to be TXed.
    136 **
    137 ** Returns          CRC
    138 **
    139 *******************************************************************************/
    140 static UINT16 l2c_fcr_tx_get_fcs (BT_HDR *p_buf)
    141 {
    142     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
    143 
    144     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len));
    145 }
    146 
    147 /*******************************************************************************
    148 **
    149 ** Function         l2c_fcr_rx_get_fcs
    150 **
    151 ** Description      This function computes the CRC for a received frame.
    152 **
    153 ** Returns          CRC
    154 **
    155 *******************************************************************************/
    156 static UINT16 l2c_fcr_rx_get_fcs (BT_HDR *p_buf)
    157 {
    158     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
    159 
    160     /* offset points past the L2CAP header, but the CRC check includes it */
    161     p -= L2CAP_PKT_OVERHEAD;
    162 
    163     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
    164 }
    165 
    166 /*******************************************************************************
    167 **
    168 ** Function         l2c_fcr_start_timer
    169 **
    170 ** Description      This function starts the (monitor or retransmission) timer.
    171 **
    172 ** Returns          -
    173 **
    174 *******************************************************************************/
    175 void l2c_fcr_start_timer (tL2C_CCB *p_ccb)
    176 {
    177     assert(p_ccb != NULL);
    178     UINT32  tout;
    179 
    180     /* The timers which are in milliseconds */
    181     if (p_ccb->fcrb.wait_ack)
    182     {
    183         tout = (UINT32)p_ccb->our_cfg.fcr.mon_tout;
    184     }
    185     else
    186     {
    187         tout = (UINT32)p_ccb->our_cfg.fcr.rtrans_tout;
    188     }
    189 
    190     /* Only start a timer that was not started */
    191     if (!alarm_is_scheduled(p_ccb->fcrb.mon_retrans_timer)) {
    192         alarm_set_on_queue(p_ccb->fcrb.mon_retrans_timer, tout,
    193                            l2c_ccb_timer_timeout, p_ccb,
    194                            btu_general_alarm_queue);
    195     }
    196 }
    197 
    198 /*******************************************************************************
    199 **
    200 ** Function         l2c_fcr_stop_timer
    201 **
    202 ** Description      This function stops the (monitor or transmission) timer.
    203 **
    204 ** Returns          -
    205 **
    206 *******************************************************************************/
    207 void l2c_fcr_stop_timer (tL2C_CCB *p_ccb)
    208 {
    209     assert(p_ccb != NULL);
    210     alarm_cancel(p_ccb->fcrb.mon_retrans_timer);
    211 }
    212 
    213 /*******************************************************************************
    214 **
    215 ** Function         l2c_fcr_cleanup
    216 **
    217 ** Description      This function cleans up the variable used for flow-control/retrans.
    218 **
    219 ** Returns          -
    220 **
    221 *******************************************************************************/
    222 void l2c_fcr_cleanup (tL2C_CCB *p_ccb)
    223 {
    224     assert(p_ccb != NULL);
    225     tL2C_FCRB *p_fcrb = &p_ccb->fcrb;
    226 
    227     alarm_free(p_fcrb->mon_retrans_timer);
    228     p_fcrb->mon_retrans_timer = NULL;
    229     alarm_free(p_fcrb->ack_timer);
    230     p_fcrb->ack_timer = NULL;
    231 
    232     osi_free_and_reset((void **)&p_fcrb->p_rx_sdu);
    233 
    234     fixed_queue_free(p_fcrb->waiting_for_ack_q, osi_free);
    235     p_fcrb->waiting_for_ack_q = NULL;
    236 
    237     fixed_queue_free(p_fcrb->srej_rcv_hold_q, osi_free);
    238     p_fcrb->srej_rcv_hold_q = NULL;
    239 
    240     fixed_queue_free(p_fcrb->retrans_q, osi_free);
    241     p_fcrb->retrans_q = NULL;
    242 
    243 #if (L2CAP_ERTM_STATS == TRUE)
    244     if ( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID) && (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) )
    245     {
    246         UINT32  dur = time_get_os_boottime_ms() - p_ccb->fcrb.connect_tick_count;
    247         char    *p_str = (char *)osi_malloc(120);
    248         UINT16  i;
    249         UINT32  throughput_avg, ack_delay_avg, ack_q_count_avg;
    250 
    251         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    252                    "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums", p_ccb->local_cid, dur);
    253         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    254                    "Retransmissions:%08u Times Flow Controlled:%08u Retrans Touts:%08u Ack Touts:%08u",
    255                     p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed, p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
    256         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    257                    "Times there is less than 2 packets in controller when flow controlled:%08u", p_ccb->fcrb.controller_idle);
    258         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    259                    "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u", p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz );
    260 
    261         sprintf(p_str, "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
    262                 p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
    263                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
    264                 p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1], p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
    265 
    266         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    267 
    268         sprintf(p_str, "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
    269                 p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
    270                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
    271                 p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1], p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
    272 
    273         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    274 
    275         throughput_avg = 0;
    276         ack_delay_avg = 0;
    277         ack_q_count_avg = 0;
    278 
    279         for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++) {
    280             if (i == p_ccb->fcrb.ack_delay_avg_index) {
    281                 BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    282                          "[%02u] collecting data ...", i );
    283                 continue;
    284             }
    285 
    286             sprintf(p_str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
    287                     i, p_ccb->fcrb.throughput[i],
    288                     p_ccb->fcrb.ack_delay_avg[i], p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
    289                     p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i], p_ccb->fcrb.ack_q_count_max[i] );
    290 
    291             BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
    292 
    293             throughput_avg  += p_ccb->fcrb.throughput[i];
    294             ack_delay_avg   += p_ccb->fcrb.ack_delay_avg[i];
    295             ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
    296         }
    297 
    298         throughput_avg  /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    299         ack_delay_avg   /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    300         ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    301 
    302         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    303                  "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, ack_q_count_avg: %8u",
    304                  throughput_avg, ack_delay_avg, ack_q_count_avg );
    305 
    306         osi_free(p_str);
    307 
    308         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
    309                    "---");
    310     }
    311 #endif
    312 
    313     memset (p_fcrb, 0, sizeof (tL2C_FCRB));
    314 }
    315 
    316 /*******************************************************************************
    317 **
    318 ** Function         l2c_fcr_clone_buf
    319 **
    320 ** Description      This function allocates and copies requested part of a buffer
    321 **                  at a new-offset.
    322 **
    323 ** Returns          pointer to new buffer
    324 **
    325 *******************************************************************************/
    326 BT_HDR *l2c_fcr_clone_buf(BT_HDR *p_buf, UINT16 new_offset, UINT16 no_of_bytes)
    327 {
    328     assert(p_buf != NULL);
    329     /*
    330      * NOTE: We allocate extra L2CAP_FCS_LEN octets, in case we need to put
    331      * the FCS (Frame Check Sequence) at the end of the buffer.
    332      */
    333     uint16_t buf_size = no_of_bytes + sizeof(BT_HDR) + new_offset + L2CAP_FCS_LEN;
    334 #if (L2CAP_ERTM_STATS == TRUE)
    335     /*
    336      * NOTE: If L2CAP_ERTM_STATS is enabled, we need 4 extra octets at the
    337      * end for a timestamp at the end of an I-frame.
    338      */
    339     buf_size += sizeof(uint32_t);
    340 #endif
    341     BT_HDR *p_buf2 = (BT_HDR *)osi_malloc(buf_size);
    342 
    343     p_buf2->offset = new_offset;
    344     p_buf2->len = no_of_bytes;
    345     memcpy(((UINT8 *)(p_buf2 + 1)) + p_buf2->offset,
    346            ((UINT8 *)(p_buf + 1))  + p_buf->offset,
    347            no_of_bytes);
    348 
    349     return (p_buf2);
    350 }
    351 
    352 /*******************************************************************************
    353 **
    354 ** Function         l2c_fcr_is_flow_controlled
    355 **
    356 ** Description      This function checks if the CCB is flow controlled by peer.
    357 **
    358 ** Returns          The control word
    359 **
    360 *******************************************************************************/
    361 BOOLEAN l2c_fcr_is_flow_controlled (tL2C_CCB *p_ccb)
    362 {
    363     assert(p_ccb != NULL);
    364     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    365     {
    366         /* Check if remote side flowed us off or the transmit window is full */
    367         if ( (p_ccb->fcrb.remote_busy == TRUE)
    368          ||  (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) >= p_ccb->peer_cfg.fcr.tx_win_sz) )
    369         {
    370 #if (L2CAP_ERTM_STATS == TRUE)
    371             if (!fixed_queue_is_empty(p_ccb->xmit_hold_q))
    372             {
    373                 p_ccb->fcrb.xmit_window_closed++;
    374 
    375                 if ((p_ccb->p_lcb->sent_not_acked < 2)&&(l2cb.controller_xmit_window > 0))
    376                     p_ccb->fcrb.controller_idle++;
    377             }
    378 #endif
    379             return (TRUE);
    380         }
    381     }
    382     return (FALSE);
    383 }
    384 
    385 /*******************************************************************************
    386 **
    387 ** Function         prepare_I_frame
    388 **
    389 ** Description      This function sets the FCR variables in an I-frame that is
    390 **                  about to be sent to HCI for transmission. This may be the
    391 **                  first time the I-frame is sent, or a retransmission
    392 **
    393 ** Returns          -
    394 **
    395 *******************************************************************************/
    396 static void prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission)
    397 {
    398     assert(p_ccb != NULL);
    399     assert(p_buf != NULL);
    400     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
    401     UINT8       *p;
    402     UINT16      fcs;
    403     UINT16      ctrl_word;
    404     BOOLEAN     set_f_bit = p_fcrb->send_f_rsp;
    405 
    406     p_fcrb->send_f_rsp = FALSE;
    407 
    408     if (is_retransmission)
    409     {
    410         /* Get the old control word and clear out the old req_seq and F bits */
    411         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    412 
    413         STREAM_TO_UINT16 (ctrl_word, p);
    414 
    415         ctrl_word  &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
    416     }
    417     else
    418     {
    419         ctrl_word  = p_buf->layer_specific & L2CAP_FCR_SEG_BITS;                /* SAR bits */
    420         ctrl_word |= (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT);      /* Tx Seq */
    421 
    422         p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
    423     }
    424 
    425     /* Set the F-bit and reqseq only if using re-transmission mode */
    426     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    427     {
    428         if (set_f_bit)
    429             ctrl_word |= L2CAP_FCR_F_BIT;
    430 
    431         ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    432 
    433         p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
    434 
    435         alarm_cancel(p_ccb->fcrb.ack_timer);
    436     }
    437 
    438     /* Set the control word */
    439     p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    440 
    441     UINT16_TO_STREAM (p, ctrl_word);
    442 
    443     /* Compute the FCS and add to the end of the buffer if not bypassed */
    444     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    445     {
    446         /* length field in l2cap header has to include FCS length */
    447         p = ((UINT8 *) (p_buf+1)) + p_buf->offset;
    448         UINT16_TO_STREAM (p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
    449 
    450         /* Calculate the FCS */
    451         fcs = l2c_fcr_tx_get_fcs(p_buf);
    452 
    453         /* Point to the end of the buffer and put the FCS there */
    454         /*
    455          * NOTE: Here we assume the allocated buffer is large enough
    456          * to include extra L2CAP_FCS_LEN octets at the end.
    457          */
    458         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
    459 
    460         UINT16_TO_STREAM (p, fcs);
    461 
    462         p_buf->len += L2CAP_FCS_LEN;
    463     }
    464 
    465 #if BT_TRACE_VERBOSE == TRUE
    466     if (is_retransmission)
    467     {
    468         L2CAP_TRACE_EVENT ("L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  ReqSeq: %u  F: %u",
    469                             p_ccb->local_cid, p_buf->len,
    470                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    471                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    472                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    473                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    474     }
    475     else
    476     {
    477         L2CAP_TRACE_EVENT ("L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
    478                             p_ccb->local_cid, p_buf->len,
    479                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    480                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    481                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    482                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    483     }
    484 #endif
    485 
    486     /* Start the retransmission timer if not already running */
    487     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    488         l2c_fcr_start_timer (p_ccb);
    489 }
    490 
    491 /*******************************************************************************
    492 **
    493 ** Function         l2c_fcr_send_S_frame
    494 **
    495 ** Description      This function formats and sends an S-frame for transmission.
    496 **
    497 ** Returns          -
    498 **
    499 *******************************************************************************/
    500 void l2c_fcr_send_S_frame (tL2C_CCB *p_ccb, UINT16 function_code, UINT16 pf_bit)
    501 {
    502     assert(p_ccb != NULL);
    503     UINT8       *p;
    504     UINT16      ctrl_word;
    505     UINT16      fcs;
    506 
    507     if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN))
    508         return;
    509 
    510 #if (L2CAP_ERTM_STATS == TRUE)
    511      p_ccb->fcrb.s_frames_sent[function_code]++;
    512 #endif
    513 
    514     if (pf_bit == L2CAP_FCR_P_BIT)
    515     {
    516         p_ccb->fcrb.wait_ack = TRUE;
    517 
    518         l2c_fcr_stop_timer (p_ccb);         /* Restart the monitor timer */
    519         l2c_fcr_start_timer (p_ccb);
    520     }
    521 
    522     /* Create the control word to use */
    523     ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
    524     ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
    525     ctrl_word |= pf_bit;
    526 
    527     BT_HDR *p_buf = (BT_HDR *)osi_malloc(L2CAP_CMD_BUF_SIZE);
    528     p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
    529     p_buf->len    = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
    530 
    531     /* Set the pointer to the beginning of the data */
    532     p = (UINT8 *)(p_buf + 1) + p_buf->offset;
    533 
    534     /* Put in the L2CAP header */
    535     UINT16_TO_STREAM(p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
    536     UINT16_TO_STREAM(p, p_ccb->remote_cid);
    537     UINT16_TO_STREAM(p, ctrl_word);
    538 
    539     /* Compute the FCS and add to the end of the buffer if not bypassed */
    540     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
    541         fcs = l2c_fcr_tx_get_fcs (p_buf);
    542 
    543         UINT16_TO_STREAM (p, fcs);
    544         p_buf->len += L2CAP_FCS_LEN;
    545     } else {
    546         /* rewrite the length without FCS length */
    547         p -= 6;
    548         UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD);
    549     }
    550 
    551     /* Now, the HCI transport header */
    552     p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
    553     l2cu_set_acl_hci_header (p_buf, p_ccb);
    554 
    555 #if BT_TRACE_VERBOSE == TRUE
    556     if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
    557         || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3)) {
    558         L2CAP_TRACE_WARNING("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
    559                             p_ccb->local_cid, ctrl_word,
    560                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    561                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    562                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    563                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    564         L2CAP_TRACE_WARNING ("                  Buf Len: %u", p_buf->len);
    565     } else {
    566         L2CAP_TRACE_EVENT("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
    567                           p_ccb->local_cid, ctrl_word,
    568                           SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    569                           (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    570                           (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    571                           (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    572         L2CAP_TRACE_EVENT("                  Buf Len: %u", p_buf->len);
    573     }
    574 #endif  /* BT_TRACE_VERBOSE */
    575 
    576     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, p_buf);
    577 
    578     p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
    579 
    580     alarm_cancel(p_ccb->fcrb.ack_timer);
    581 }
    582 
    583 
    584 /*******************************************************************************
    585 **
    586 ** Function         l2c_fcr_proc_pdu
    587 **
    588 ** Description      This function is the entry point for processing of a
    589 **                  received PDU when in flow control and/or retransmission modes.
    590 **
    591 ** Returns          -
    592 **
    593 *******************************************************************************/
    594 void l2c_fcr_proc_pdu (tL2C_CCB *p_ccb, BT_HDR *p_buf)
    595 {
    596     assert(p_ccb != NULL);
    597     assert(p_buf != NULL);
    598     UINT8       *p;
    599     UINT16      fcs;
    600     UINT16      min_pdu_len;
    601     UINT16      ctrl_word;
    602 
    603     /* Check the length */
    604     min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS) ?
    605                   (UINT16)L2CAP_FCR_OVERHEAD : (UINT16)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
    606 
    607     if (p_buf->len < min_pdu_len)
    608     {
    609         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u", p_ccb->local_cid, p_buf->len);
    610         osi_free(p_buf);
    611         return;
    612     }
    613 
    614     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE)
    615     {
    616         process_stream_frame (p_ccb, p_buf);
    617         return;
    618     }
    619 
    620 #if BT_TRACE_VERBOSE == TRUE
    621     /* Get the control word */
    622     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    623     STREAM_TO_UINT16 (ctrl_word, p);
    624 
    625     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    626     {
    627         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
    628          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
    629         {
    630             /* REJ or SREJ */
    631             L2CAP_TRACE_WARNING ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
    632                             p_ccb->local_cid, p_buf->len,
    633                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    634                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    635                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    636                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    637         }
    638         else
    639         {
    640             L2CAP_TRACE_EVENT ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
    641                             p_ccb->local_cid, p_buf->len,
    642                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    643                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    644                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    645                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    646         }
    647     }
    648     else
    649     {
    650         L2CAP_TRACE_EVENT ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
    651                             p_ccb->local_cid, p_buf->len,
    652                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    653                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    654                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    655                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    656     }
    657 
    658     L2CAP_TRACE_EVENT ("      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt %u, wt_q.cnt %u, tries %u",
    659                        p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack,
    660                        p_ccb->fcrb.next_seq_expected,
    661                        p_ccb->fcrb.last_ack_sent,
    662                        fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q),
    663                        p_ccb->fcrb.num_tries);
    664 
    665 #endif /* BT_TRACE_VERBOSE */
    666 
    667     /* Verify FCS if using */
    668     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
    669     {
    670         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
    671 
    672         /* Extract and drop the FCS from the packet */
    673         STREAM_TO_UINT16 (fcs, p);
    674         p_buf->len -= L2CAP_FCS_LEN;
    675 
    676         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
    677         {
    678             L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
    679             osi_free(p_buf);
    680             return;
    681         }
    682     }
    683 
    684     /* Get the control word */
    685     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
    686 
    687     STREAM_TO_UINT16 (ctrl_word, p);
    688 
    689     p_buf->len    -= L2CAP_FCR_OVERHEAD;
    690     p_buf->offset += L2CAP_FCR_OVERHEAD;
    691 
    692     /* If we had a poll bit outstanding, check if we got a final response */
    693     if (p_ccb->fcrb.wait_ack)
    694     {
    695         /* If final bit not set, ignore the frame unless it is a polled S-frame */
    696         if ( !(ctrl_word & L2CAP_FCR_F_BIT) )
    697         {
    698             if ( (ctrl_word & L2CAP_FCR_P_BIT) && (ctrl_word & L2CAP_FCR_S_FRAME_BIT) )
    699             {
    700                 if (p_ccb->fcrb.srej_sent)
    701                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
    702                 else if (p_ccb->fcrb.local_busy)
    703                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
    704                 else
    705                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
    706 
    707                 /* Got a poll while in wait_ack state, so re-start our timer with 1-second */
    708                 /* This is a small optimization... the monitor timer is 12 secs, but we saw */
    709                 /* that if the other side sends us a poll when we are waiting for a final,  */
    710                 /* then it speeds up recovery significantly if we poll him back soon after his poll. */
    711                 alarm_set_on_queue(p_ccb->fcrb.mon_retrans_timer,
    712                                    BT_1SEC_TIMEOUT_MS,
    713                                    l2c_ccb_timer_timeout, p_ccb,
    714                                    btu_general_alarm_queue);
    715             }
    716             osi_free(p_buf);
    717             return;
    718         }
    719 
    720         p_ccb->fcrb.wait_ack  = FALSE;
    721 
    722         /* P and F are mutually exclusive */
    723         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    724             ctrl_word &= ~L2CAP_FCR_P_BIT;
    725 
    726         if (fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
    727             p_ccb->fcrb.num_tries = 0;
    728 
    729         l2c_fcr_stop_timer (p_ccb);
    730     }
    731     else
    732     {
    733         /* Otherwise, ensure the final bit is ignored */
    734         ctrl_word &= ~L2CAP_FCR_F_BIT;
    735     }
    736 
    737     /* Process receive sequence number */
    738     if (!process_reqseq (p_ccb, ctrl_word))
    739     {
    740         osi_free(p_buf);
    741         return;
    742     }
    743 
    744      /* Process based on whether it is an S-frame or an I-frame */
    745     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    746         process_s_frame (p_ccb, p_buf, ctrl_word);
    747     else
    748         process_i_frame (p_ccb, p_buf, ctrl_word, FALSE);
    749 
    750     /* Return if the channel got disconnected by a bad packet or max retransmissions */
    751     if ( (!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN) )
    752         return;
    753 
    754     /* If we have some buffers held while doing SREJ, and SREJ has cleared, process them now */
    755     if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) &&
    756          (!fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q)))
    757     {
    758         fixed_queue_t *temp_q = p_ccb->fcrb.srej_rcv_hold_q;
    759         p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(SIZE_MAX);
    760 
    761         while ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(temp_q)) != NULL)
    762         {
    763             if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
    764             {
    765                 /* Get the control word */
    766                 p = ((UINT8 *)(p_buf+1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
    767 
    768                 STREAM_TO_UINT16 (ctrl_word, p);
    769 
    770                 L2CAP_TRACE_DEBUG ("l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   TxSeq: %u  Expected_Seq: %u",
    771                                     p_ccb->local_cid, (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    772                                     p_ccb->fcrb.next_seq_expected);
    773 
    774                 /* Process the SREJ held I-frame, but do not send an RR for each individual frame */
    775                 process_i_frame (p_ccb, p_buf, ctrl_word, TRUE);
    776             }
    777             else
    778                 osi_free(p_buf);
    779 
    780             /* If more frames were lost during SREJ, send a REJ */
    781             if (p_ccb->fcrb.rej_after_srej)
    782             {
    783                 p_ccb->fcrb.rej_after_srej = FALSE;
    784                 p_ccb->fcrb.rej_sent       = TRUE;
    785 
    786                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
    787             }
    788         }
    789         fixed_queue_free(temp_q, NULL);
    790 
    791         /* Now, if needed, send one RR for the whole held queue */
    792         if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) && (!p_ccb->fcrb.srej_sent)
    793          &&  (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent) )
    794             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
    795         else
    796         {
    797             L2CAP_TRACE_DEBUG ("l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
    798                                 p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent, p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
    799                                 p_ccb->fcrb.last_ack_sent);
    800         }
    801     }
    802 
    803     /* If a window has opened, check if we can send any more packets */
    804     if ( (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q) ||
    805           !fixed_queue_is_empty(p_ccb->xmit_hold_q))
    806       && (p_ccb->fcrb.wait_ack == FALSE)
    807       && (l2c_fcr_is_flow_controlled (p_ccb) == FALSE) )
    808     {
    809         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
    810     }
    811 }
    812 
    813 /*******************************************************************************
    814 **
    815 ** Function         l2c_lcc_proc_pdu
    816 **
    817 ** Description      This function is the entry point for processing of a
    818 **                  received PDU when in LE Coc flow control modes.
    819 **
    820 ** Returns          -
    821 **
    822 *******************************************************************************/
    823 void l2c_lcc_proc_pdu(tL2C_CCB *p_ccb, BT_HDR *p_buf)
    824 {
    825 
    826     assert(p_ccb != NULL);
    827     assert(p_buf != NULL);
    828     UINT8  *p = (UINT8*)(p_buf + 1) + p_buf->offset;
    829     UINT16 sdu_length;
    830     BT_HDR *p_data = NULL;
    831 
    832     /* Buffer length should not exceed local mps */
    833     if (p_buf->len > p_ccb->local_conn_cfg.mps)
    834     {
    835         /* Discard the buffer */
    836         osi_free(p_buf);
    837         return;
    838     }
    839 
    840     if (p_ccb->is_first_seg)
    841     {
    842         STREAM_TO_UINT16(sdu_length, p);
    843         /* Check the SDU Length with local MTU size */
    844         if (sdu_length > p_ccb->local_conn_cfg.mtu)
    845         {
    846             /* Discard the buffer */
    847             osi_free(p_buf);
    848             return;
    849         }
    850 
    851 
    852         if ((p_data = (BT_HDR *) osi_malloc(L2CAP_MAX_BUF_SIZE)) == NULL)
    853         {
    854             osi_free(p_buf);
    855             return;
    856         }
    857 
    858         p_ccb->ble_sdu = p_data;
    859         p_data->len = 0;
    860         p_ccb->ble_sdu_length = sdu_length;
    861         L2CAP_TRACE_DEBUG ("%s SDU Length = %d",__func__,sdu_length);
    862         p_buf->len -= sizeof(sdu_length);
    863         p_buf->offset += sizeof(sdu_length);
    864         p_data->offset = 0;
    865 
    866     }
    867     else
    868         p_data = p_ccb->ble_sdu;
    869 
    870     memcpy((UINT8*)(p_data + 1) + p_data->offset + p_data->len, (UINT8*)(p_buf + 1) + p_buf->offset, p_buf->len);
    871     p_data->len += p_buf->len;
    872     p = (UINT8*)(p_data+1) + p_data->offset;
    873     if (p_data->len == p_ccb->ble_sdu_length)
    874     {
    875         l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_data);
    876         p_ccb->is_first_seg = TRUE;
    877         p_ccb->ble_sdu = NULL;
    878         p_ccb->ble_sdu_length = 0;
    879     }
    880     else if (p_data->len < p_ccb->ble_sdu_length)
    881     {
    882         p_ccb->is_first_seg = FALSE;
    883     }
    884     else
    885     {
    886         L2CAP_TRACE_ERROR ("%s Length in the SDU messed up",__func__);
    887         // TODO: reset every thing may be???
    888     }
    889 
    890     osi_free(p_buf);
    891     return;
    892 }
    893 
    894 /*******************************************************************************
    895 **
    896 ** Function         l2c_fcr_proc_tout
    897 **
    898 ** Description      Handle a timeout. We should be in error recovery state.
    899 **
    900 ** Returns          -
    901 **
    902 *******************************************************************************/
    903 void l2c_fcr_proc_tout (tL2C_CCB *p_ccb)
    904 {
    905     assert(p_ccb != NULL);
    906     L2CAP_TRACE_DEBUG ("l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  ack_q_count: %u",
    907                        p_ccb->local_cid, p_ccb->fcrb.num_tries,
    908                        p_ccb->peer_cfg.fcr.max_transmit,
    909                        p_ccb->fcrb.wait_ack,
    910                        fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
    911 
    912 #if (L2CAP_ERTM_STATS == TRUE)
    913     p_ccb->fcrb.retrans_touts++;
    914 #endif
    915 
    916     if ( (p_ccb->peer_cfg.fcr.max_transmit != 0) && (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit) )
    917     {
    918         l2cu_disconnect_chnl (p_ccb);
    919     }
    920     else
    921     {
    922         if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent)
    923         {
    924             if (p_ccb->fcrb.local_busy)
    925                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
    926             else
    927                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
    928         }
    929     }
    930 }
    931 
    932 
    933 /*******************************************************************************
    934 **
    935 ** Function         l2c_fcr_proc_ack_tout
    936 **
    937 ** Description      Send RR/RNR if we have not acked I frame
    938 **
    939 ** Returns          -
    940 **
    941 *******************************************************************************/
    942 void l2c_fcr_proc_ack_tout (tL2C_CCB *p_ccb)
    943 {
    944     assert(p_ccb != NULL);
    945     L2CAP_TRACE_DEBUG ("l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d", p_ccb->local_cid,
    946                         p_ccb->chnl_state, p_ccb->fcrb.wait_ack, p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
    947 
    948     if ( (p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack)
    949       && (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected) )
    950     {
    951 #if (L2CAP_ERTM_STATS == TRUE)
    952         p_ccb->fcrb.xmit_ack_touts++;
    953 #endif
    954         if (p_ccb->fcrb.local_busy)
    955             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
    956         else
    957             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
    958     }
    959 }
    960 
    961 
    962 /*******************************************************************************
    963 **
    964 ** Function         process_reqseq
    965 **
    966 ** Description      Handle receive sequence number
    967 **
    968 ** Returns          -
    969 **
    970 *******************************************************************************/
    971 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
    972 {
    973     assert(p_ccb != NULL);
    974     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
    975     UINT8       req_seq, num_bufs_acked, xx;
    976     UINT16      ls;
    977     UINT16      full_sdus_xmitted;
    978 
    979     /* Receive sequence number does not ack anything for SREJ with P-bit set to zero */
    980     if ( (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    981      &&  ((ctrl_word & L2CAP_FCR_SUP_BITS) == (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT))
    982      &&  ((ctrl_word & L2CAP_FCR_P_BIT) == 0) )
    983     {
    984         /* If anything still waiting for ack, restart the timer if it was stopped */
    985         if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
    986             l2c_fcr_start_timer(p_ccb);
    987 
    988         return (TRUE);
    989     }
    990 
    991     /* Extract the receive sequence number from the control word */
    992     req_seq = (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    993 
    994     num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
    995 
    996     /* Verify the request sequence is in range before proceeding */
    997     if (num_bufs_acked > fixed_queue_length(p_fcrb->waiting_for_ack_q))
    998     {
    999         /* The channel is closed if ReqSeq is not in range */
   1000         L2CAP_TRACE_WARNING ("L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
   1001                              ctrl_word, req_seq, p_fcrb->last_rx_ack,
   1002                              fixed_queue_length(p_fcrb->waiting_for_ack_q));
   1003 
   1004         l2cu_disconnect_chnl (p_ccb);
   1005         return (FALSE);
   1006     }
   1007 
   1008     p_fcrb->last_rx_ack = req_seq;
   1009 
   1010     /* Now we can release all acknowledged frames, and restart the retransmission timer if needed */
   1011     if (num_bufs_acked != 0)
   1012     {
   1013         p_fcrb->num_tries = 0;
   1014         full_sdus_xmitted = 0;
   1015 
   1016 #if (L2CAP_ERTM_STATS == TRUE)
   1017         l2c_fcr_collect_ack_delay (p_ccb, num_bufs_acked);
   1018 #endif
   1019 
   1020         for (xx = 0; xx < num_bufs_acked; xx++)
   1021         {
   1022             BT_HDR *p_tmp = (BT_HDR *)fixed_queue_try_dequeue(p_fcrb->waiting_for_ack_q);
   1023             ls = p_tmp->layer_specific & L2CAP_FCR_SAR_BITS;
   1024 
   1025             if ( (ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU) )
   1026                 full_sdus_xmitted++;
   1027 
   1028             osi_free(p_tmp);
   1029         }
   1030 
   1031         /* If we are still in a wait_ack state, do not mess with the timer */
   1032         if (!p_ccb->fcrb.wait_ack)
   1033             l2c_fcr_stop_timer (p_ccb);
   1034 
   1035         /* Check if we need to call the "packet_sent" callback */
   1036         if ( (p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) && (full_sdus_xmitted) )
   1037         {
   1038             /* Special case for eRTM, if all packets sent, send 0xFFFF */
   1039             if (fixed_queue_is_empty(p_fcrb->waiting_for_ack_q) &&
   1040                 fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
   1041                 full_sdus_xmitted = 0xFFFF;
   1042             }
   1043 
   1044             (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid, full_sdus_xmitted);
   1045         }
   1046     }
   1047 
   1048     /* If anything still waiting for ack, restart the timer if it was stopped */
   1049     if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
   1050         l2c_fcr_start_timer(p_ccb);
   1051     return (TRUE);
   1052 }
   1053 
   1054 
   1055 /*******************************************************************************
   1056 **
   1057 ** Function         process_s_frame
   1058 **
   1059 ** Description      Process an S frame
   1060 **
   1061 ** Returns          -
   1062 **
   1063 *******************************************************************************/
   1064 static void process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
   1065 {
   1066     assert(p_ccb != NULL);
   1067     assert(p_buf != NULL);
   1068 
   1069     tL2C_FCRB   *p_fcrb      = &p_ccb->fcrb;
   1070     UINT16      s_frame_type = (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
   1071     BOOLEAN     remote_was_busy;
   1072     BOOLEAN     all_ok = TRUE;
   1073 
   1074     if (p_buf->len != 0)
   1075     {
   1076         L2CAP_TRACE_WARNING ("Incorrect S-frame Length (%d)", p_buf->len);
   1077     }
   1078 
   1079     L2CAP_TRACE_DEBUG ("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d", ctrl_word, p_fcrb->remote_busy);
   1080 
   1081 #if (L2CAP_ERTM_STATS == TRUE)
   1082     p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
   1083 #endif
   1084 
   1085     if (ctrl_word & L2CAP_FCR_P_BIT)
   1086     {
   1087         p_fcrb->rej_sent   = FALSE;             /* After checkpoint, we can send anoher REJ */
   1088         p_fcrb->send_f_rsp = TRUE;              /* Set a flag in case an I-frame is pending */
   1089     }
   1090 
   1091     switch (s_frame_type)
   1092     {
   1093     case L2CAP_FCR_SUP_RR:
   1094         remote_was_busy     = p_fcrb->remote_busy;
   1095         p_fcrb->remote_busy = FALSE;
   1096 
   1097         if ( (ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy) )
   1098             all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1099         break;
   1100 
   1101     case L2CAP_FCR_SUP_REJ:
   1102         p_fcrb->remote_busy = FALSE;
   1103         all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1104         break;
   1105 
   1106     case L2CAP_FCR_SUP_RNR:
   1107         p_fcrb->remote_busy = TRUE;
   1108         l2c_fcr_stop_timer (p_ccb);
   1109         break;
   1110 
   1111     case L2CAP_FCR_SUP_SREJ:
   1112         p_fcrb->remote_busy = FALSE;
   1113         all_ok = retransmit_i_frames (p_ccb, (UINT8)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
   1114         break;
   1115     }
   1116 
   1117     if (all_ok)
   1118     {
   1119         /* If polled, we need to respond with F-bit. Note, we may have sent a I-frame with the F-bit */
   1120         if (p_fcrb->send_f_rsp)
   1121         {
   1122             if (p_fcrb->srej_sent)
   1123                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
   1124             else if (p_fcrb->local_busy)
   1125                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
   1126             else
   1127                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
   1128 
   1129             p_fcrb->send_f_rsp = FALSE;
   1130         }
   1131     }
   1132     else
   1133     {
   1134         L2CAP_TRACE_DEBUG ("process_s_frame hit_max_retries");
   1135     }
   1136 
   1137     osi_free(p_buf);
   1138 }
   1139 
   1140 
   1141 /*******************************************************************************
   1142 **
   1143 ** Function         process_i_frame
   1144 **
   1145 ** Description      Process an I frame
   1146 **
   1147 ** Returns          -
   1148 **
   1149 *******************************************************************************/
   1150 static void process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack)
   1151 {
   1152     assert(p_ccb != NULL);
   1153     assert(p_buf != NULL);
   1154 
   1155     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
   1156     UINT8       tx_seq, num_lost, num_to_ack, next_srej;
   1157 
   1158     /* If we were doing checkpoint recovery, first retransmit all unacked I-frames */
   1159     if (ctrl_word & L2CAP_FCR_F_BIT)
   1160     {
   1161         if (!retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS))
   1162         {
   1163             osi_free(p_buf);
   1164             return;
   1165         }
   1166     }
   1167 
   1168 #if (L2CAP_ERTM_STATS == TRUE)
   1169     p_ccb->fcrb.ertm_pkt_counts[1]++;
   1170     p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
   1171 #endif
   1172 
   1173     /* Extract the sequence number */
   1174     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1175 
   1176     /* If we have flow controlled the peer, ignore any bad I-frames from him */
   1177     if ( (tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy) )
   1178     {
   1179         L2CAP_TRACE_WARNING ("Dropping bad I-Frame since we flowed off, tx_seq:%u", tx_seq);
   1180         l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1181         osi_free(p_buf);
   1182         return;
   1183     }
   1184 
   1185     /* Check if tx-sequence is the expected one */
   1186     if (tx_seq != p_fcrb->next_seq_expected)
   1187     {
   1188         num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
   1189 
   1190         /* Is the frame a duplicate ? If so, just drop it */
   1191         if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz)
   1192         {
   1193             /* Duplicate - simply drop it */
   1194             L2CAP_TRACE_WARNING ("process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq %u", tx_seq, p_fcrb->next_seq_expected);
   1195             osi_free(p_buf);
   1196         }
   1197         else
   1198         {
   1199             L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej: %u",
   1200                                  p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent, p_fcrb->srej_sent);
   1201 
   1202             if (p_fcrb->srej_sent)
   1203             {
   1204                 /* If SREJ sent, save the frame for later processing as long as it is in sequence */
   1205                 next_srej = (((BT_HDR *)fixed_queue_try_peek_last(p_fcrb->srej_rcv_hold_q))->layer_specific + 1) & L2CAP_FCR_SEQ_MODULO;
   1206 
   1207                 if ( (tx_seq == next_srej) && (fixed_queue_length(p_fcrb->srej_rcv_hold_q) < p_ccb->our_cfg.fcr.tx_win_sz) )
   1208                 {
   1209                     /* If user gave us a pool for held rx buffers, use that */
   1210                     /* TODO: Could that happen? Get rid of this code. */
   1211                     if (p_ccb->ertm_info.fcr_rx_buf_size != L2CAP_FCR_RX_BUF_SIZE)
   1212                     {
   1213                         BT_HDR *p_buf2;
   1214 
   1215                         /* Adjust offset and len so that control word is copied */
   1216                         p_buf->offset -= L2CAP_FCR_OVERHEAD;
   1217                         p_buf->len    += L2CAP_FCR_OVERHEAD;
   1218 
   1219                         p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
   1220 
   1221                         if (p_buf2)
   1222                         {
   1223                             osi_free(p_buf);
   1224                             p_buf = p_buf2;
   1225                         }
   1226                         p_buf->offset += L2CAP_FCR_OVERHEAD;
   1227                         p_buf->len -= L2CAP_FCR_OVERHEAD;
   1228                     }
   1229                     L2CAP_TRACE_DEBUG ("process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej1",
   1230                                          num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1231 
   1232                     p_buf->layer_specific = tx_seq;
   1233                     fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
   1234                 }
   1235                 else
   1236                 {
   1237                     L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  frame dropped in Srej Sent next_srej:%u  hold_q.count:%u  win_sz:%u",
   1238                                          p_ccb->local_cid, next_srej, fixed_queue_length(p_fcrb->srej_rcv_hold_q), p_ccb->our_cfg.fcr.tx_win_sz);
   1239 
   1240                     p_fcrb->rej_after_srej = TRUE;
   1241                     osi_free(p_buf);
   1242                 }
   1243             }
   1244             else if (p_fcrb->rej_sent)
   1245             {
   1246                 L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: 1  SRej: %u",
   1247                                      p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->srej_sent);
   1248 
   1249                 /* If REJ sent, just drop the frame */
   1250                 osi_free(p_buf);
   1251             }
   1252             else
   1253             {
   1254                 L2CAP_TRACE_DEBUG ("process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
   1255                                      p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1256 
   1257                 /* If only one lost, we will send SREJ, otherwise we will send REJ */
   1258                 if (num_lost > 1)
   1259                 {
   1260                     osi_free(p_buf);
   1261                     p_fcrb->rej_sent = TRUE;
   1262                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
   1263                 }
   1264                 else
   1265                 {
   1266                     if (!fixed_queue_is_empty(p_fcrb->srej_rcv_hold_q))
   1267                     {
   1268                         L2CAP_TRACE_ERROR ("process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d hold_q.count:%u",
   1269                                              p_ccb->local_cid, tx_seq, fixed_queue_length(p_fcrb->srej_rcv_hold_q));
   1270                     }
   1271                     p_buf->layer_specific = tx_seq;
   1272                     fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
   1273                     p_fcrb->srej_sent = TRUE;
   1274                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, 0);
   1275                 }
   1276                 alarm_cancel(p_ccb->fcrb.ack_timer);
   1277             }
   1278         }
   1279         return;
   1280     }
   1281 
   1282     /* Seq number is the next expected. Clear possible reject exception in case it occured */
   1283     p_fcrb->rej_sent = p_fcrb->srej_sent = FALSE;
   1284 
   1285     /* Adjust the next_seq, so that if the upper layer sends more data in the callback
   1286        context, the received frame is acked by an I-frame. */
   1287     p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1288 
   1289     /* If any SAR problem in eRTM mode, spec says disconnect. */
   1290     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
   1291     {
   1292         L2CAP_TRACE_WARNING ("process_i_frame() CID: 0x%04x  reassembly failed", p_ccb->local_cid);
   1293         l2cu_disconnect_chnl (p_ccb);
   1294         return;
   1295     }
   1296 
   1297     /* RR optimization - if peer can still send us more, then start an ACK timer */
   1298     num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) & L2CAP_FCR_SEQ_MODULO;
   1299 
   1300     if ( (num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy) )
   1301         delay_ack = TRUE;
   1302 
   1303     /* We should neve never ack frame if we are not in OPEN state */
   1304     if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
   1305     {
   1306         /* If no frames are awaiting transmission or are held, send an RR or RNR S-frame for ack */
   1307         if (delay_ack)
   1308         {
   1309             /* If it is the first I frame we did not ack, start ack timer */
   1310             if (!alarm_is_scheduled(p_ccb->fcrb.ack_timer)) {
   1311                 alarm_set_on_queue(p_ccb->fcrb.ack_timer,
   1312                                    L2CAP_FCR_ACK_TIMEOUT_MS,
   1313                                    l2c_fcrb_ack_timer_timeout, p_ccb,
   1314                                    btu_general_alarm_queue);
   1315             }
   1316         }
   1317         else if ((fixed_queue_is_empty(p_ccb->xmit_hold_q) ||
   1318                   l2c_fcr_is_flow_controlled(p_ccb))
   1319                  && fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q))
   1320         {
   1321             if (p_fcrb->local_busy)
   1322                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1323             else
   1324                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
   1325         }
   1326     }
   1327 }
   1328 
   1329 
   1330 /*******************************************************************************
   1331 **
   1332 ** Function         process_stream_frame
   1333 **
   1334 ** Description      This function processes frames in streaming mode
   1335 **
   1336 ** Returns          -
   1337 **
   1338 *******************************************************************************/
   1339 static void process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf)
   1340 {
   1341     assert(p_ccb != NULL);
   1342     assert(p_buf != NULL);
   1343 
   1344     UINT16      ctrl_word;
   1345     UINT16      fcs;
   1346     UINT8       *p;
   1347     UINT8       tx_seq;
   1348 
   1349     /* Verify FCS if using */
   1350     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1351     {
   1352         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
   1353 
   1354         /* Extract and drop the FCS from the packet */
   1355         STREAM_TO_UINT16 (fcs, p);
   1356         p_buf->len -= L2CAP_FCS_LEN;
   1357 
   1358         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
   1359         {
   1360             L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
   1361             osi_free(p_buf);
   1362             return;
   1363         }
   1364     }
   1365 
   1366     /* Get the control word */
   1367     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
   1368 
   1369     STREAM_TO_UINT16 (ctrl_word, p);
   1370 
   1371     p_buf->len    -= L2CAP_FCR_OVERHEAD;
   1372     p_buf->offset += L2CAP_FCR_OVERHEAD;
   1373 
   1374     /* Make sure it is an I-frame */
   1375     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
   1376     {
   1377         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: 0x%04x", p_ccb->local_cid, ctrl_word);
   1378         osi_free(p_buf);
   1379         return;
   1380     }
   1381 
   1382 #if BT_TRACE_VERBOSE == TRUE
   1383     L2CAP_TRACE_EVENT ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
   1384                         p_ccb->local_cid, p_buf->len,
   1385                         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
   1386                         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
   1387                         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
   1388                         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
   1389 #endif
   1390 
   1391     /* Extract the sequence number */
   1392     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1393 
   1394     /* Check if tx-sequence is the expected one */
   1395     if (tx_seq != p_ccb->fcrb.next_seq_expected)
   1396     {
   1397         L2CAP_TRACE_WARNING ("Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: 0x%08x",
   1398                                 p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq, p_ccb->fcrb.p_rx_sdu);
   1399 
   1400         /* Lost one or more packets, so flush the SAR queue */
   1401         osi_free_and_reset((void **)&p_ccb->fcrb.p_rx_sdu);
   1402     }
   1403 
   1404     p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1405 
   1406     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
   1407     {
   1408         /* Some sort of SAR error, so flush the SAR queue */
   1409         osi_free_and_reset((void **)&p_ccb->fcrb.p_rx_sdu);
   1410     }
   1411 }
   1412 
   1413 
   1414 /*******************************************************************************
   1415 **
   1416 ** Function         do_sar_reassembly
   1417 **
   1418 ** Description      Process SAR bits and re-assemble frame
   1419 **
   1420 ** Returns          TRUE if all OK, else FALSE
   1421 **
   1422 *******************************************************************************/
   1423 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
   1424 {
   1425     assert(p_ccb != NULL);
   1426     assert(p_buf != NULL);
   1427 
   1428     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
   1429     UINT16      sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
   1430     BOOLEAN     packet_ok = TRUE;
   1431     UINT8       *p;
   1432 
   1433     /* Check if the SAR state is correct */
   1434     if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU))
   1435     {
   1436         if (p_fcrb->p_rx_sdu != NULL)
   1437         {
   1438             L2CAP_TRACE_WARNING ("SAR - got unexpected unsegmented or start SDU  Expected len: %u  Got so far: %u",
   1439                                   p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
   1440 
   1441             packet_ok = FALSE;
   1442         }
   1443         /* Check the length of the packet */
   1444         if ( (sar_type == L2CAP_FCR_START_SDU) && (p_buf->len < L2CAP_SDU_LEN_OVERHEAD) )
   1445         {
   1446             L2CAP_TRACE_WARNING ("SAR start packet too short: %u", p_buf->len);
   1447             packet_ok = FALSE;
   1448         }
   1449     }
   1450     else
   1451     {
   1452         if (p_fcrb->p_rx_sdu == NULL)
   1453         {
   1454             L2CAP_TRACE_WARNING ("SAR - got unexpected cont or end SDU");
   1455             packet_ok = FALSE;
   1456         }
   1457     }
   1458 
   1459     if ( (packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU) )
   1460     {
   1461         p = ((UINT8 *)(p_buf + 1)) + p_buf->offset;
   1462 
   1463         /* For start SDU packet, extract the SDU length */
   1464         if (sar_type == L2CAP_FCR_START_SDU)
   1465         {
   1466             /* Get the SDU length */
   1467             STREAM_TO_UINT16 (p_fcrb->rx_sdu_len, p);
   1468             p_buf->offset += 2;
   1469             p_buf->len    -= 2;
   1470 
   1471             if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu)
   1472             {
   1473                 L2CAP_TRACE_WARNING ("SAR - SDU len: %u  larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
   1474                 packet_ok = FALSE;
   1475             } else {
   1476                 p_fcrb->p_rx_sdu = (BT_HDR *)osi_malloc(L2CAP_MAX_BUF_SIZE);
   1477                 p_fcrb->p_rx_sdu->offset = OBX_BUF_MIN_OFFSET;
   1478                 p_fcrb->p_rx_sdu->len = 0;
   1479             }
   1480         }
   1481 
   1482         if (packet_ok)
   1483         {
   1484             if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len)
   1485             {
   1486                 L2CAP_TRACE_ERROR ("SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u",
   1487                                     sar_type, p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1488                 packet_ok = FALSE;
   1489             }
   1490             else if ( (sar_type == L2CAP_FCR_END_SDU) && ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len) )
   1491             {
   1492                 L2CAP_TRACE_WARNING ("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
   1493                                       p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1494                 packet_ok = FALSE;
   1495             }
   1496             else
   1497             {
   1498                 memcpy (((UINT8 *) (p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset + p_fcrb->p_rx_sdu->len, p, p_buf->len);
   1499 
   1500                 p_fcrb->p_rx_sdu->len += p_buf->len;
   1501 
   1502                 osi_free(p_buf);
   1503                 p_buf = NULL;
   1504 
   1505                 if (sar_type == L2CAP_FCR_END_SDU)
   1506                 {
   1507                     p_buf            = p_fcrb->p_rx_sdu;
   1508                     p_fcrb->p_rx_sdu = NULL;
   1509                 }
   1510             }
   1511         }
   1512     }
   1513 
   1514     if (packet_ok == FALSE)
   1515     {
   1516         osi_free(p_buf);
   1517     }
   1518     else if (p_buf != NULL)
   1519     {
   1520 #if (L2CAP_NUM_FIXED_CHNLS > 0)
   1521         if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
   1522             (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL && p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL))
   1523         {
   1524             if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
   1525                 (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
   1526                     (p_ccb->local_cid, p_ccb->p_lcb->remote_bd_addr, p_buf);
   1527         }
   1528         else
   1529 #endif
   1530             l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
   1531     }
   1532 
   1533     return (packet_ok);
   1534 }
   1535 
   1536 
   1537 /*******************************************************************************
   1538 **
   1539 ** Function         retransmit_i_frames
   1540 **
   1541 ** Description      This function retransmits i-frames awaiting acks.
   1542 **
   1543 ** Returns          BOOLEAN - TRUE if retransmitted
   1544 **
   1545 *******************************************************************************/
   1546 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
   1547 {
   1548     assert(p_ccb != NULL);
   1549 
   1550     BT_HDR      *p_buf = NULL;
   1551     UINT8       *p;
   1552     UINT8       buf_seq;
   1553     UINT16      ctrl_word;
   1554 
   1555     if ( (!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
   1556      &&  (p_ccb->peer_cfg.fcr.max_transmit != 0)
   1557      &&  (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit) )
   1558     {
   1559         L2CAP_TRACE_EVENT ("Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: %u) ack_q_count: %u",
   1560                 p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
   1561                 fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
   1562 
   1563         l2cu_disconnect_chnl (p_ccb);
   1564         return (FALSE);
   1565     }
   1566 
   1567     /* tx_seq indicates whether to retransmit a specific sequence or all (if == L2C_FCR_RETX_ALL_PKTS) */
   1568     list_t *list_ack = NULL;
   1569     const list_node_t *node_ack = NULL;
   1570     if (! fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q)) {
   1571         list_ack = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
   1572         node_ack = list_begin(list_ack);
   1573     }
   1574     if (tx_seq != L2C_FCR_RETX_ALL_PKTS)
   1575     {
   1576         /* If sending only one, the sequence number tells us which one. Look for it.
   1577         */
   1578         if (list_ack != NULL) {
   1579             for ( ; node_ack != list_end(list_ack); node_ack = list_next(node_ack)) {
   1580                 p_buf = (BT_HDR *)list_node(node_ack);
   1581                 /* Get the old control word */
   1582                 p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
   1583 
   1584                 STREAM_TO_UINT16 (ctrl_word, p);
   1585 
   1586                 buf_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1587 
   1588                 L2CAP_TRACE_DEBUG ("retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq, tx_seq);
   1589 
   1590                 if (tx_seq == buf_seq)
   1591                     break;
   1592             }
   1593         }
   1594 
   1595         if (!p_buf)
   1596         {
   1597             L2CAP_TRACE_ERROR ("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u",
   1598                                tx_seq,
   1599                                fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
   1600             return (TRUE);
   1601         }
   1602     }
   1603     else
   1604     {
   1605         // Iterate though list and flush the amount requested from
   1606         // the transmit data queue that satisfy the layer and event conditions.
   1607         for (list_node_t *node_tmp = list_begin(p_ccb->p_lcb->link_xmit_data_q);
   1608             node_tmp != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
   1609           BT_HDR *p_tmp = (BT_HDR *)list_node(node_tmp);
   1610           node_tmp = list_next(node_tmp);
   1611 
   1612             /* Do not flush other CIDs or partial segments */
   1613           if ((p_tmp->layer_specific == 0) && (p_tmp->event == p_ccb->local_cid)) {
   1614             list_remove(p_ccb->p_lcb->link_xmit_data_q, p_tmp);
   1615             osi_free(p_tmp);
   1616           }
   1617         }
   1618 
   1619         /* Also flush our retransmission queue */
   1620         while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q))
   1621             osi_free(fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q));
   1622 
   1623         if (list_ack != NULL)
   1624             node_ack = list_begin(list_ack);
   1625     }
   1626 
   1627     if (list_ack != NULL) {
   1628         while (node_ack != list_end(list_ack))
   1629         {
   1630             p_buf = (BT_HDR *)list_node(node_ack);
   1631             node_ack = list_next(node_ack);
   1632 
   1633             BT_HDR *p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
   1634             if (p_buf2)
   1635             {
   1636                 p_buf2->layer_specific = p_buf->layer_specific;
   1637 
   1638                 fixed_queue_enqueue(p_ccb->fcrb.retrans_q, p_buf2);
   1639             }
   1640 
   1641             if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) )
   1642                 break;
   1643         }
   1644     }
   1645 
   1646     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
   1647 
   1648     if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q))
   1649     {
   1650         p_ccb->fcrb.num_tries++;
   1651         l2c_fcr_start_timer (p_ccb);
   1652     }
   1653 
   1654     return (TRUE);
   1655 }
   1656 
   1657 
   1658 /*******************************************************************************
   1659 **
   1660 ** Function         l2c_fcr_get_next_xmit_sdu_seg
   1661 **
   1662 ** Description      Get the next SDU segment to transmit.
   1663 **
   1664 ** Returns          pointer to buffer with segment or NULL
   1665 **
   1666 *******************************************************************************/
   1667 BT_HDR *l2c_fcr_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
   1668 {
   1669     assert(p_ccb != NULL);
   1670 
   1671     BOOLEAN     first_seg    = FALSE,       /* The segment is the first part of data  */
   1672                 mid_seg      = FALSE,       /* The segment is the middle part of data */
   1673                 last_seg     = FALSE;       /* The segment is the last part of data   */
   1674     UINT16      sdu_len = 0;
   1675     BT_HDR      *p_buf, *p_xmit;
   1676     UINT8       *p;
   1677     UINT16      max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
   1678 
   1679     /* If there is anything in the retransmit queue, that goes first
   1680     */
   1681     p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q);
   1682     if (p_buf != NULL)
   1683     {
   1684         /* Update Rx Seq and FCS if we acked some packets while this one was queued */
   1685         prepare_I_frame (p_ccb, p_buf, TRUE);
   1686 
   1687         p_buf->event = p_ccb->local_cid;
   1688 
   1689 #if (L2CAP_ERTM_STATS == TRUE)
   1690         p_ccb->fcrb.pkts_retransmitted++;
   1691         p_ccb->fcrb.ertm_pkt_counts[0]++;
   1692         p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
   1693 #endif
   1694         return (p_buf);
   1695     }
   1696 
   1697     /* For BD/EDR controller, max_packet_length is set to 0             */
   1698     /* For AMP controller, max_packet_length is set by available blocks */
   1699     if ( (max_packet_length > L2CAP_MAX_HEADER_FCS)
   1700       && (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length) )
   1701     {
   1702         max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
   1703     }
   1704 
   1705     p_buf = (BT_HDR *)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
   1706 
   1707     /* If there is more data than the MPS, it requires segmentation */
   1708     if (p_buf->len > max_pdu)
   1709     {
   1710         /* We are using the "event" field to tell is if we already started segmentation */
   1711         if (p_buf->event == 0)
   1712         {
   1713             first_seg = TRUE;
   1714             sdu_len   = p_buf->len;
   1715         }
   1716         else
   1717             mid_seg = TRUE;
   1718 
   1719         /* Get a new buffer and copy the data that can be sent in a PDU */
   1720         p_xmit = l2c_fcr_clone_buf(p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
   1721                                    max_pdu);
   1722 
   1723         if (p_xmit != NULL)
   1724         {
   1725             p_buf->event  = p_ccb->local_cid;
   1726             p_xmit->event = p_ccb->local_cid;
   1727 
   1728             p_buf->len    -= max_pdu;
   1729             p_buf->offset += max_pdu;
   1730 
   1731             /* copy PBF setting */
   1732             p_xmit->layer_specific = p_buf->layer_specific;
   1733         }
   1734         else /* Should never happen if the application has configured buffers correctly */
   1735         {
   1736             L2CAP_TRACE_ERROR ("L2CAP - cannot get buffer for segmentation, max_pdu: %u", max_pdu);
   1737             return (NULL);
   1738         }
   1739     }
   1740     else    /* Use the original buffer if no segmentation, or the last segment */
   1741     {
   1742         p_xmit = (BT_HDR *)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
   1743 
   1744         if (p_xmit->event != 0)
   1745             last_seg = TRUE;
   1746 
   1747         p_xmit->event = p_ccb->local_cid;
   1748     }
   1749 
   1750     /* Step back to add the L2CAP headers */
   1751     p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
   1752     p_xmit->len    += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
   1753 
   1754     if (first_seg)
   1755     {
   1756         p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
   1757         p_xmit->len    += L2CAP_SDU_LEN_OVERHEAD;
   1758     }
   1759 
   1760     /* Set the pointer to the beginning of the data */
   1761     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
   1762 
   1763     /* Now the L2CAP header */
   1764 
   1765     /* Note: if FCS has to be included then the length is recalculated later */
   1766     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
   1767 
   1768     UINT16_TO_STREAM (p, p_ccb->remote_cid);
   1769 
   1770     if (first_seg)
   1771     {
   1772         /* Skip control word and add SDU length */
   1773         p += 2;
   1774         UINT16_TO_STREAM (p, sdu_len);
   1775 
   1776         /* We will store the SAR type in layer-specific */
   1777         /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
   1778         p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
   1779 
   1780         first_seg = FALSE;
   1781     }
   1782     else if (mid_seg)
   1783         p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
   1784     else if (last_seg)
   1785         p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
   1786     else
   1787         p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
   1788 
   1789     prepare_I_frame (p_ccb, p_xmit, FALSE);
   1790 
   1791     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
   1792     {
   1793         BT_HDR *p_wack = l2c_fcr_clone_buf(p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len);
   1794 
   1795         if (!p_wack)
   1796         {
   1797             L2CAP_TRACE_ERROR("L2CAP - no buffer for xmit cloning, CID: 0x%04x  Length: %u",
   1798                               p_ccb->local_cid, p_xmit->len);
   1799 
   1800             /* We will not save the FCS in case we reconfigure and change options */
   1801             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1802                 p_xmit->len -= L2CAP_FCS_LEN;
   1803 
   1804             /* Pretend we sent it and it got lost */
   1805             fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_xmit);
   1806             return (NULL);
   1807         }
   1808         else
   1809         {
   1810 #if (L2CAP_ERTM_STATS == TRUE)
   1811             /* set timestamp at the end of tx I-frame to get acking delay */
   1812             /*
   1813              * NOTE: Here we assume the allocate buffer is large enough
   1814              * to include extra 4 octets at the end.
   1815              */
   1816             p = ((UINT8 *) (p_wack+1)) + p_wack->offset + p_wack->len;
   1817             UINT32_TO_STREAM (p, time_get_os_boottime_ms());
   1818 #endif
   1819             /* We will not save the FCS in case we reconfigure and change options */
   1820             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   1821                 p_wack->len -= L2CAP_FCS_LEN;
   1822 
   1823             p_wack->layer_specific = p_xmit->layer_specific;
   1824             fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_wack);
   1825         }
   1826 
   1827 #if (L2CAP_ERTM_STATS == TRUE)
   1828         p_ccb->fcrb.ertm_pkt_counts[0]++;
   1829         p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
   1830 #endif
   1831 
   1832     }
   1833 
   1834     return (p_xmit);
   1835 }
   1836 
   1837 /*******************************************************************************
   1838 **
   1839 ** Function         l2c_lcc_get_next_xmit_sdu_seg
   1840 **
   1841 ** Description      Get the next SDU segment to transmit for LE connection oriented channel
   1842 **
   1843 ** Returns          pointer to buffer with segment or NULL
   1844 **
   1845 *******************************************************************************/
   1846 BT_HDR *l2c_lcc_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
   1847 {
   1848     BOOLEAN     first_seg    = FALSE;       /* The segment is the first part of data  */
   1849     BOOLEAN     last_seg     = FALSE;       /* The segment is the last part of data  */
   1850     UINT16      no_of_bytes_to_send = 0;
   1851     UINT16      sdu_len = 0;
   1852     BT_HDR      *p_buf, *p_xmit;
   1853     UINT8       *p;
   1854     UINT16      max_pdu = p_ccb->peer_conn_cfg.mps;
   1855 
   1856     p_buf = (BT_HDR *)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
   1857 
   1858     /* We are using the "event" field to tell is if we already started segmentation */
   1859     if (p_buf->event == 0)
   1860     {
   1861         first_seg = TRUE;
   1862         sdu_len   = p_buf->len;
   1863         if (p_buf->len <= (max_pdu - L2CAP_LCC_SDU_LENGTH))
   1864         {
   1865             last_seg = TRUE;
   1866             no_of_bytes_to_send = p_buf->len;
   1867         }
   1868         else
   1869             no_of_bytes_to_send = max_pdu - L2CAP_LCC_SDU_LENGTH;
   1870     }
   1871     else if (p_buf->len <= max_pdu)
   1872     {
   1873         last_seg = TRUE;
   1874         no_of_bytes_to_send = p_buf->len;
   1875     }
   1876     else
   1877     {
   1878         /* Middle Packet */
   1879         no_of_bytes_to_send = max_pdu;
   1880     }
   1881 
   1882     /* Get a new buffer and copy the data that can be sent in a PDU */
   1883     if (first_seg == TRUE)
   1884         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_LCC_OFFSET,
   1885                     no_of_bytes_to_send);
   1886     else
   1887         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_MIN_OFFSET,
   1888                    no_of_bytes_to_send);
   1889 
   1890     if (p_xmit != NULL)
   1891     {
   1892         p_buf->event  = p_ccb->local_cid;
   1893         p_xmit->event = p_ccb->local_cid;
   1894 
   1895         if (first_seg == TRUE)
   1896         {
   1897             p_xmit->offset -= L2CAP_LCC_SDU_LENGTH;  /* for writing the SDU length. */
   1898             p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
   1899             UINT16_TO_STREAM(p, sdu_len);
   1900             p_xmit->len += L2CAP_LCC_SDU_LENGTH;
   1901         }
   1902 
   1903         p_buf->len    -= no_of_bytes_to_send;
   1904         p_buf->offset += no_of_bytes_to_send;
   1905 
   1906         /* copy PBF setting */
   1907         p_xmit->layer_specific = p_buf->layer_specific;
   1908 
   1909     }
   1910     else /* Should never happen if the application has configured buffers correctly */
   1911     {
   1912         L2CAP_TRACE_ERROR ("L2CAP - cannot get buffer, for segmentation");
   1913         return (NULL);
   1914     }
   1915 
   1916     if (last_seg == TRUE)
   1917     {
   1918         p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
   1919         osi_free(p_buf);
   1920     }
   1921 
   1922     /* Step back to add the L2CAP headers */
   1923     p_xmit->offset -= L2CAP_PKT_OVERHEAD;
   1924     p_xmit->len    += L2CAP_PKT_OVERHEAD ;
   1925 
   1926     /* Set the pointer to the beginning of the data */
   1927     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
   1928 
   1929     /* Note: if FCS has to be included then the length is recalculated later */
   1930     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
   1931     UINT16_TO_STREAM (p, p_ccb->remote_cid);
   1932     return (p_xmit);
   1933 
   1934 }
   1935 
   1936 /*******************************************************************************
   1937 ** Configuration negotiation functions
   1938 **
   1939 ** The following functions are used in negotiating channel modes during
   1940 ** configuration
   1941 ********************************************************************************/
   1942 
   1943 /*******************************************************************************
   1944 **
   1945 ** Function         l2c_fcr_chk_chan_modes
   1946 **
   1947 ** Description      Validates and adjusts if necessary, the FCR options
   1948 **                  based on remote EXT features.
   1949 **
   1950 **                  Note: This assumes peer EXT Features have been received.
   1951 **                      Basic mode is used if FCR Options have not been received
   1952 **
   1953 ** Returns          UINT8 - nonzero if can continue, '0' if no compatible channels
   1954 **
   1955 *******************************************************************************/
   1956 UINT8 l2c_fcr_chk_chan_modes (tL2C_CCB *p_ccb)
   1957 {
   1958     assert(p_ccb != NULL);
   1959 
   1960     /* Remove nonbasic options that the peer does not support */
   1961     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
   1962         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
   1963 
   1964     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
   1965         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
   1966 
   1967     /* At least one type needs to be set (Basic, ERTM, STM) to continue */
   1968     if (!p_ccb->ertm_info.allowed_modes)
   1969     {
   1970         L2CAP_TRACE_WARNING ("L2CAP - Peer does not support our desired channel types");
   1971     }
   1972 
   1973     return (p_ccb->ertm_info.allowed_modes);
   1974 }
   1975 
   1976 /*******************************************************************************
   1977 **
   1978 ** Function         l2c_fcr_adj_our_req_options
   1979 **
   1980 ** Description      Validates and sets up the FCR options passed in from
   1981 **                  L2CA_ConfigReq based on remote device's features.
   1982 **
   1983 ** Returns          TRUE if no errors, Otherwise FALSE
   1984 **
   1985 *******************************************************************************/
   1986 BOOLEAN l2c_fcr_adj_our_req_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   1987 {
   1988     assert(p_ccb != NULL);
   1989     assert(p_cfg != NULL);
   1990 
   1991     tL2CAP_FCR_OPTS *p_fcr = &p_cfg->fcr;
   1992 
   1993     if (p_fcr->mode != p_ccb->ertm_info.preferred_mode)
   1994     {
   1995         L2CAP_TRACE_WARNING ("l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match mode (%d)",
   1996                             p_ccb->ertm_info.preferred_mode, p_fcr->mode);
   1997 
   1998         /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override this one */
   1999         p_fcr->mode = p_ccb->ertm_info.preferred_mode;
   2000     }
   2001 
   2002     /* If upper layer did not request eRTM mode, BASIC must be used */
   2003     if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
   2004     {
   2005         if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE)
   2006         {
   2007             L2CAP_TRACE_WARNING ("l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set using BASIC mode", p_fcr->mode);
   2008         }
   2009         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   2010     }
   2011 
   2012     /* Process the FCR options if initial channel bring-up (not a reconfig request)
   2013     ** Determine initial channel mode to try based on our options and remote's features
   2014     */
   2015     if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG))
   2016     {
   2017         /* We need to have at least one mode type common with the peer */
   2018         if (!l2c_fcr_chk_chan_modes(p_ccb))
   2019         {
   2020             /* Two channels have incompatible supported types */
   2021             l2cu_disconnect_chnl (p_ccb);
   2022             return (FALSE);
   2023         }
   2024 
   2025         /* Basic is the only common channel mode between the two devices */
   2026         else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
   2027         {
   2028             /* We only want to try Basic, so bypass sending the FCR options entirely */
   2029             p_cfg->fcr_present = FALSE;
   2030             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
   2031             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
   2032         }
   2033 
   2034         /* We have at least one non-basic mode available
   2035          * Override mode from available mode options based on preference, if needed
   2036          */
   2037         else
   2038         {
   2039             /* If peer does not support STREAMING, try ERTM */
   2040             if (p_fcr->mode == L2CAP_FCR_STREAM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM))
   2041             {
   2042                 L2CAP_TRACE_DEBUG ("L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
   2043                 p_fcr->mode = L2CAP_FCR_ERTM_MODE;
   2044             }
   2045 
   2046             /* If peer does not support ERTM, try BASIC (will support this if made it here in the code) */
   2047             if (p_fcr->mode == L2CAP_FCR_ERTM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM))
   2048             {
   2049                 L2CAP_TRACE_DEBUG ("L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
   2050                 p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   2051             }
   2052         }
   2053 
   2054         if (p_fcr->mode != L2CAP_FCR_BASIC_MODE)
   2055         {
   2056             /* MTU must be smaller than buffer size */
   2057             if ( (p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu) )
   2058             {
   2059                 L2CAP_TRACE_WARNING ("L2CAP - MTU: %u  larger than buf size: %u", p_cfg->mtu, p_ccb->max_rx_mtu);
   2060                 return (FALSE);
   2061             }
   2062 
   2063             /* application want to use the default MPS */
   2064             if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS)
   2065             {
   2066                 p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
   2067             }
   2068             /* MPS must be less than MTU */
   2069             else if (p_fcr->mps > p_ccb->max_rx_mtu)
   2070             {
   2071                 L2CAP_TRACE_WARNING ("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps, p_ccb->max_rx_mtu);
   2072                 return (FALSE);
   2073             }
   2074 
   2075             /* We always initially read into the HCI buffer pool, so make sure it fits */
   2076             if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
   2077                 p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
   2078         }
   2079         else
   2080         {
   2081             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
   2082             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
   2083         }
   2084 
   2085         p_ccb->our_cfg.fcr = *p_fcr;
   2086     }
   2087     else    /* Not sure how to send a reconfiguration(??) should fcr be included? */
   2088     {
   2089         p_ccb->our_cfg.fcr_present = FALSE;
   2090     }
   2091 
   2092     return (TRUE);
   2093 }
   2094 
   2095 
   2096 /*******************************************************************************
   2097 **
   2098 ** Function         l2c_fcr_adj_monitor_retran_timeout
   2099 **
   2100 ** Description      Overrides monitor/retrans timer value based on controller
   2101 **
   2102 ** Returns          None
   2103 **
   2104 *******************************************************************************/
   2105 void l2c_fcr_adj_monitor_retran_timeout (tL2C_CCB *p_ccb)
   2106 {
   2107     assert(p_ccb != NULL);
   2108 
   2109     /* adjust our monitor/retran timeout */
   2110     if (p_ccb->out_cfg_fcr_present)
   2111     {
   2112         /*
   2113         ** if we requestd ERTM or accepted ERTM
   2114         ** We may accept ERTM even if we didn't request ERTM, in case of requesting STREAM
   2115         */
   2116         if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
   2117           ||(p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE))
   2118         {
   2119             /* upper layer setting is ignored */
   2120             p_ccb->our_cfg.fcr.mon_tout    = L2CAP_MIN_MONITOR_TOUT;
   2121             p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
   2122         }
   2123         else
   2124         {
   2125             p_ccb->our_cfg.fcr.mon_tout    = 0;
   2126             p_ccb->our_cfg.fcr.rtrans_tout = 0;
   2127         }
   2128 
   2129         L2CAP_TRACE_DEBUG ("l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
   2130                              p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
   2131     }
   2132 }
   2133 /*******************************************************************************
   2134 **
   2135 ** Function         l2c_fcr_adj_our_rsp_options
   2136 **
   2137 ** Description      Overrides any neccesary FCR options passed in from
   2138 **                  L2CA_ConfigRsp based on our FCR options.
   2139 **                  Only makes adjustments if channel is in ERTM mode.
   2140 **
   2141 ** Returns          None
   2142 **
   2143 *******************************************************************************/
   2144 void l2c_fcr_adj_our_rsp_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2145 {
   2146     assert(p_ccb != NULL);
   2147     assert(p_cfg != NULL);
   2148 
   2149     /* adjust our monitor/retran timeout */
   2150     l2c_fcr_adj_monitor_retran_timeout(p_ccb);
   2151 
   2152     p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
   2153 
   2154     if (p_cfg->fcr_present)
   2155     {
   2156         /* Temporary - until a better algorithm is implemented */
   2157         /* If peer's tx_wnd_sz requires too many buffers for us to support, then adjust it. For now, respond with our own tx_wnd_sz. */
   2158         /* Note: peer is not guaranteed to obey our adjustment */
   2159         if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz)
   2160         {
   2161             L2CAP_TRACE_DEBUG ("%s: adjusting requested tx_win_sz from %i to %i", __FUNCTION__, p_ccb->peer_cfg.fcr.tx_win_sz, p_ccb->our_cfg.fcr.tx_win_sz);
   2162             p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2163         }
   2164 
   2165         p_cfg->fcr.mode         = p_ccb->peer_cfg.fcr.mode;
   2166         p_cfg->fcr.tx_win_sz    = p_ccb->peer_cfg.fcr.tx_win_sz;
   2167         p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
   2168         p_cfg->fcr.mps          = p_ccb->peer_cfg.fcr.mps;
   2169         p_cfg->fcr.rtrans_tout  = p_ccb->our_cfg.fcr.rtrans_tout;
   2170         p_cfg->fcr.mon_tout     = p_ccb->our_cfg.fcr.mon_tout;
   2171     }
   2172 }
   2173 
   2174 /*******************************************************************************
   2175 **
   2176 ** Function         l2c_fcr_renegotiate_chan
   2177 **
   2178 ** Description      Called upon unsuccessful peer response to config request.
   2179 **                  If the error is because of the channel mode, it will try
   2180 **                  to resend using another supported optional channel.
   2181 **
   2182 ** Returns          TRUE if resent configuration, False if channel matches or
   2183 **                  cannot match.
   2184 **
   2185 *******************************************************************************/
   2186 BOOLEAN l2c_fcr_renegotiate_chan(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2187 {
   2188     assert(p_ccb != NULL);
   2189     assert(p_cfg != NULL);
   2190 
   2191     UINT8   peer_mode = p_ccb->our_cfg.fcr.mode;
   2192     BOOLEAN can_renegotiate;
   2193 
   2194     /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned */
   2195     if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
   2196         return (FALSE);
   2197 
   2198     /* Only retry if there are more channel options to try */
   2199     if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS)
   2200     {
   2201         peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
   2202 
   2203         if (p_ccb->our_cfg.fcr.mode != peer_mode)
   2204         {
   2205 
   2206             if ((--p_ccb->fcr_cfg_tries) == 0)
   2207             {
   2208                 p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
   2209                 L2CAP_TRACE_WARNING ("l2c_fcr_renegotiate_chan (Max retries exceeded)");
   2210             }
   2211 
   2212             can_renegotiate = FALSE;
   2213 
   2214             /* Try another supported mode if available based on our last attempted channel */
   2215             switch (p_ccb->our_cfg.fcr.mode)
   2216             {
   2217                 /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
   2218             case L2CAP_FCR_STREAM_MODE:
   2219                 /* Peer wants ERTM and we support it */
   2220                 if ( (peer_mode == L2CAP_FCR_ERTM_MODE) && (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
   2221                 {
   2222                     L2CAP_TRACE_DEBUG ("l2c_fcr_renegotiate_chan(Trying ERTM)");
   2223                     p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
   2224                     can_renegotiate = TRUE;
   2225                 }
   2226                 else    /* Falls through */
   2227 
   2228             case L2CAP_FCR_ERTM_MODE:
   2229                 {
   2230                     /* We can try basic for any other peer mode if we support it */
   2231                     if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC)
   2232                     {
   2233                         L2CAP_TRACE_DEBUG ("l2c_fcr_renegotiate_chan(Trying Basic)");
   2234                         can_renegotiate = TRUE;
   2235                         p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
   2236                     }
   2237                 }
   2238                 break;
   2239 
   2240             default:
   2241                 /* All other scenarios cannot be renegotiated */
   2242                 break;
   2243             }
   2244 
   2245             if (can_renegotiate)
   2246             {
   2247                 p_ccb->our_cfg.fcr_present = TRUE;
   2248 
   2249                 if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
   2250                 {
   2251                     p_ccb->our_cfg.fcs_present = FALSE;
   2252                     p_ccb->our_cfg.ext_flow_spec_present = FALSE;
   2253 
   2254                     /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
   2255                     if ( (p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE) )
   2256                     {
   2257                         L2CAP_TRACE_WARNING ("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
   2258                         p_cfg->mtu = L2CAP_MTU_SIZE;
   2259                     }
   2260                 }
   2261 
   2262                 l2cu_process_our_cfg_req (p_ccb, &p_ccb->our_cfg);
   2263                 l2cu_send_peer_config_req (p_ccb, &p_ccb->our_cfg);
   2264                 alarm_set_on_queue(p_ccb->l2c_ccb_timer,
   2265                                    L2CAP_CHNL_CFG_TIMEOUT_MS,
   2266                                    l2c_ccb_timer_timeout, p_ccb,
   2267                                    btu_general_alarm_queue);
   2268                 return (TRUE);
   2269             }
   2270         }
   2271     }
   2272 
   2273     /* Disconnect if the channels do not match */
   2274     if (p_ccb->our_cfg.fcr.mode != peer_mode)
   2275     {
   2276         L2CAP_TRACE_WARNING ("L2C CFG:  Channels incompatible (local %d, peer %d)",
   2277                               p_ccb->our_cfg.fcr.mode, peer_mode);
   2278         l2cu_disconnect_chnl (p_ccb);
   2279     }
   2280 
   2281     return (FALSE);
   2282 }
   2283 
   2284 
   2285 /*******************************************************************************
   2286 **
   2287 ** Function         l2c_fcr_process_peer_cfg_req
   2288 **
   2289 ** Description      This function is called to process the FCR options passed
   2290 **                  in the peer's configuration request.
   2291 **
   2292 ** Returns          UINT8 - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
   2293 **                          or L2CAP_PEER_CFG_DISCONNECT.
   2294 **
   2295 *******************************************************************************/
   2296 UINT8 l2c_fcr_process_peer_cfg_req(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
   2297 {
   2298     assert(p_ccb != NULL);
   2299     assert(p_cfg != NULL);
   2300 
   2301     UINT16 max_retrans_size;
   2302     UINT8  fcr_ok = L2CAP_PEER_CFG_OK;
   2303 
   2304     p_ccb->p_lcb->w4_info_rsp = FALSE;      /* Handles T61x SonyEricsson Bug in Info Request */
   2305 
   2306     L2CAP_TRACE_EVENT ("l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR mode:%d preferred: %u allowed:%u",
   2307                         p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode, p_ccb->ertm_info.preferred_mode,
   2308                         p_ccb->ertm_info.allowed_modes);
   2309 
   2310     /* If Peer wants basic, we are done (accept it or disconnect) */
   2311     if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE)
   2312     {
   2313         /* If we do not allow basic, disconnect */
   2314         if ( !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) )
   2315             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2316     }
   2317 
   2318     /* Need to negotiate if our modes are not the same */
   2319     else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode)
   2320     {
   2321         /* If peer wants a mode that we don't support then retry our mode (ex. rtx/flc), OR
   2322         ** If we want ERTM and they wanted streaming retry our mode.
   2323         ** Note: If we have already determined they support our mode previously
   2324         **       from their EXF mask.
   2325         */
   2326         if ( (((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0)
   2327             || (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE) )
   2328         {
   2329             p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
   2330             p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2331             p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
   2332             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2333         }
   2334 
   2335         /* If we wanted basic, then try to renegotiate it */
   2336         else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE)
   2337         {
   2338             p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
   2339             p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
   2340             p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
   2341             p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout = p_ccb->our_cfg.fcr.mps = 0;
   2342             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2343         }
   2344 
   2345         /* Only other valid case is if they want ERTM and we wanted STM which should be
   2346            accepted if we support it; otherwise the channel should be disconnected */
   2347         else if ( (p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE)
   2348               || !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
   2349         {
   2350             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2351         }
   2352     }
   2353 
   2354     /* Configuration for FCR channels so make any adjustments and fwd to upper layer */
   2355     if (fcr_ok == L2CAP_PEER_CFG_OK)
   2356     {
   2357         /* by default don't need to send params in the response */
   2358         p_ccb->out_cfg_fcr_present = FALSE;
   2359 
   2360         /* Make any needed adjustments for the response to the peer */
   2361         if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE)
   2362         {
   2363             /* Peer desires to bypass FCS check, and streaming or ERTM mode */
   2364             if (p_cfg->fcs_present)
   2365             {
   2366                 p_ccb->peer_cfg.fcs = p_cfg->fcs;
   2367                 p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
   2368                 if( p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
   2369                     p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
   2370             }
   2371 
   2372             max_retrans_size = p_ccb->ertm_info.fcr_tx_buf_size - sizeof(BT_HDR)
   2373                                             - L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET - L2CAP_FCS_LEN;
   2374 
   2375             /* Ensure the MPS is not bigger than the MTU */
   2376             if ( (p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu) )
   2377             {
   2378                 p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
   2379                 p_ccb->out_cfg_fcr_present = TRUE;
   2380             }
   2381 
   2382             /* Ensure the MPS is not bigger than our retransmission buffer */
   2383             if (p_cfg->fcr.mps > max_retrans_size)
   2384             {
   2385                 L2CAP_TRACE_DEBUG("CFG: Overriding MPS to %d (orig %d)", max_retrans_size, p_cfg->fcr.mps);
   2386 
   2387                 p_cfg->fcr.mps = max_retrans_size;
   2388                 p_ccb->out_cfg_fcr_present = TRUE;
   2389             }
   2390 
   2391             if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE || p_cfg->fcr.mode == L2CAP_FCR_STREAM_MODE)
   2392             {
   2393                 /* Always respond with FCR ERTM parameters */
   2394                 p_ccb->out_cfg_fcr_present = TRUE;
   2395             }
   2396         }
   2397 
   2398         /* Everything ok, so save the peer's adjusted fcr options */
   2399         p_ccb->peer_cfg.fcr = p_cfg->fcr;
   2400 
   2401         if (p_cfg->fcr_present)
   2402             p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
   2403     }
   2404     else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE)
   2405     {
   2406         /* Allow peer only one retry for mode */
   2407         if (p_ccb->peer_cfg_already_rejected)
   2408             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2409         else
   2410             p_ccb->peer_cfg_already_rejected = TRUE;
   2411     }
   2412 
   2413     return (fcr_ok);
   2414 }
   2415 
   2416 #if (L2CAP_ERTM_STATS == TRUE)
   2417 /*******************************************************************************
   2418 **
   2419 ** Function         l2c_fcr_collect_ack_delay
   2420 **
   2421 ** Description      collect throughput, delay, queue size of waiting ack
   2422 **
   2423 ** Parameters
   2424 **                  tL2C_CCB
   2425 **
   2426 ** Returns          void
   2427 **
   2428 *******************************************************************************/
   2429 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
   2430 {
   2431     UINT32  index;
   2432     BT_HDR *p_buf;
   2433     UINT8  *p;
   2434     UINT32  timestamp, delay;
   2435     UINT8   xx;
   2436     UINT8   str[120];
   2437 
   2438     index = p_ccb->fcrb.ack_delay_avg_index;
   2439 
   2440     /* update sum, max and min of waiting for ack queue size */
   2441     p_ccb->fcrb.ack_q_count_avg[index] +=
   2442         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
   2443 
   2444     if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) > p_ccb->fcrb.ack_q_count_max[index])
   2445         p_ccb->fcrb.ack_q_count_max[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
   2446 
   2447     if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) < p_ccb->fcrb.ack_q_count_min[index])
   2448         p_ccb->fcrb.ack_q_count_min[index] = fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
   2449 
   2450     /* update sum, max and min of round trip delay of acking */
   2451     list_t *list = NULL;
   2452     if (! fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
   2453         list = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
   2454     if (list != NULL) {
   2455         for (const list_node_t *node = list_begin(list), xx = 0;
   2456              (node != list_end(list)) && (xx < num_bufs_acked);
   2457              node = list_next(node), xx++) {
   2458             p_buf = list_node(node);
   2459             /* adding up length of acked I-frames to get throughput */
   2460             p_ccb->fcrb.throughput[index] += p_buf->len - 8;
   2461 
   2462             if ( xx == num_bufs_acked - 1 )
   2463             {
   2464                 /* get timestamp from tx I-frame that receiver is acking */
   2465                 p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
   2466                 if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
   2467                 {
   2468                     p += L2CAP_FCS_LEN;
   2469                 }
   2470 
   2471                 STREAM_TO_UINT32(timestamp, p);
   2472                 delay = time_get_os_boottime_ms() - timestamp;
   2473 
   2474                 p_ccb->fcrb.ack_delay_avg[index] += delay;
   2475                 if ( delay > p_ccb->fcrb.ack_delay_max[index] )
   2476                     p_ccb->fcrb.ack_delay_max[index] = delay;
   2477                 if ( delay < p_ccb->fcrb.ack_delay_min[index] )
   2478                     p_ccb->fcrb.ack_delay_min[index] = delay;
   2479             }
   2480         }
   2481     }
   2482 
   2483     p_ccb->fcrb.ack_delay_avg_count++;
   2484 
   2485     /* calculate average and initialize next avg, min and max */
   2486     if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES)
   2487     {
   2488         p_ccb->fcrb.ack_delay_avg_count = 0;
   2489 
   2490         p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2491         p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2492 
   2493         /* calculate throughput */
   2494         timestamp = time_get_os_boottime_ms();
   2495         if (timestamp - p_ccb->fcrb.throughput_start > 0)
   2496             p_ccb->fcrb.throughput[index] /= (timestamp - p_ccb->fcrb.throughput_start);
   2497 
   2498         p_ccb->fcrb.throughput_start = timestamp;
   2499 
   2500         sprintf(str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
   2501                 index, p_ccb->fcrb.throughput[index],
   2502                 p_ccb->fcrb.ack_delay_avg[index], p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
   2503                 p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index], p_ccb->fcrb.ack_q_count_max[index] );
   2504 
   2505         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", str);
   2506 
   2507         index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
   2508         p_ccb->fcrb.ack_delay_avg_index = index;
   2509 
   2510         p_ccb->fcrb.ack_q_count_max[index] = 0;
   2511         p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
   2512         p_ccb->fcrb.ack_q_count_avg[index] = 0;
   2513 
   2514 
   2515         p_ccb->fcrb.ack_delay_max[index] = 0;
   2516         p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
   2517         p_ccb->fcrb.ack_delay_avg[index] = 0;
   2518 
   2519         p_ccb->fcrb.throughput[index] = 0;
   2520     }
   2521 }
   2522 #endif
   2523