Home | History | Annotate | Download | only in l2cap
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2004-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
     22  *  functions
     23  *
     24  ******************************************************************************/
     25 
     26 #include <base/logging.h>
     27 #include <stdio.h>
     28 #include <stdlib.h>
     29 #include <string.h>
     30 
     31 #include "bt_common.h"
     32 #include "bt_types.h"
     33 #include "btm_api.h"
     34 #include "btm_int.h"
     35 #include "btu.h"
     36 #include "hcimsgs.h"
     37 #include "l2c_api.h"
     38 #include "l2c_int.h"
     39 #include "l2cdefs.h"
     40 
     41 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted
     42  */
     43 #define L2C_FCR_RETX_ALL_PKTS 0xFF
     44 
     45 /* this is the minimal offset required by OBX to process incoming packets */
     46 static const uint16_t OBX_BUF_MIN_OFFSET = 4;
     47 
     48 static const char* SAR_types[] = {"Unsegmented", "Start", "End",
     49                                   "Continuation"};
     50 static const char* SUP_types[] = {"RR", "REJ", "RNR", "SREJ"};
     51 
     52 /* Look-up table for the CRC calculation */
     53 static const unsigned short crctab[256] = {
     54     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601,
     55     0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440, 0xcc01, 0x0cc0,
     56     0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81,
     57     0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841, 0xd801, 0x18c0, 0x1980, 0xd941,
     58     0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01,
     59     0x1dc0, 0x1c80, 0xdc41, 0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0,
     60     0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081,
     61     0x1040, 0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
     62     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441, 0x3c00,
     63     0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0,
     64     0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840, 0x2800, 0xe8c1, 0xe981,
     65     0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41,
     66     0x2d00, 0xedc1, 0xec81, 0x2c40, 0xe401, 0x24c0, 0x2580, 0xe541, 0x2700,
     67     0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0,
     68     0x2080, 0xe041, 0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281,
     69     0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
     70     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01,
     71     0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840, 0x7800, 0xb8c1,
     72     0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80,
     73     0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40, 0xb401, 0x74c0, 0x7580, 0xb541,
     74     0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101,
     75     0x71c0, 0x7080, 0xb041, 0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0,
     76     0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481,
     77     0x5440, 0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
     78     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841, 0x8801,
     79     0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1,
     80     0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41, 0x4400, 0x84c1, 0x8581,
     81     0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341,
     82     0x4100, 0x81c1, 0x8081, 0x4040,
     83 };
     84 
     85 /*******************************************************************************
     86  *  Static local functions
     87 */
     88 static bool process_reqseq(tL2C_CCB* p_ccb, uint16_t ctrl_word);
     89 static void process_s_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf, uint16_t ctrl_word);
     90 static void process_i_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf, uint16_t ctrl_word,
     91                             bool delay_ack);
     92 static bool retransmit_i_frames(tL2C_CCB* p_ccb, uint8_t tx_seq);
     93 static void prepare_I_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf,
     94                             bool is_retransmission);
     95 static void process_stream_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf);
     96 static bool do_sar_reassembly(tL2C_CCB* p_ccb, BT_HDR* p_buf,
     97                               uint16_t ctrl_word);
     98 
     99 #if (L2CAP_ERTM_STATS == TRUE)
    100 static void l2c_fcr_collect_ack_delay(tL2C_CCB* p_ccb, uint8_t num_bufs_acked);
    101 #endif
    102 
    103 /*******************************************************************************
    104  *
    105  * Function         l2c_fcr_updcrc
    106  *
    107  * Description      This function computes the CRC using the look-up table.
    108  *
    109  * Returns          CRC
    110  *
    111  ******************************************************************************/
    112 static unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char* icp,
    113                                      int icnt) {
    114   unsigned short crc = icrc;
    115   unsigned char* cp = icp;
    116   int cnt = icnt;
    117 
    118   while (cnt--) {
    119     crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
    120   }
    121 
    122   return (crc);
    123 }
    124 
    125 /*******************************************************************************
    126  *
    127  * Function         l2c_fcr_tx_get_fcs
    128  *
    129  * Description      This function computes the CRC for a frame to be TXed.
    130  *
    131  * Returns          CRC
    132  *
    133  ******************************************************************************/
    134 static uint16_t l2c_fcr_tx_get_fcs(BT_HDR* p_buf) {
    135   uint8_t* p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
    136 
    137   return (l2c_fcr_updcrc(L2CAP_FCR_INIT_CRC, p, p_buf->len));
    138 }
    139 
    140 /*******************************************************************************
    141  *
    142  * Function         l2c_fcr_rx_get_fcs
    143  *
    144  * Description      This function computes the CRC for a received frame.
    145  *
    146  * Returns          CRC
    147  *
    148  ******************************************************************************/
    149 static uint16_t l2c_fcr_rx_get_fcs(BT_HDR* p_buf) {
    150   uint8_t* p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
    151 
    152   /* offset points past the L2CAP header, but the CRC check includes it */
    153   p -= L2CAP_PKT_OVERHEAD;
    154 
    155   return (
    156       l2c_fcr_updcrc(L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
    157 }
    158 
    159 /*******************************************************************************
    160  *
    161  * Function         l2c_fcr_start_timer
    162  *
    163  * Description      This function starts the (monitor or retransmission) timer.
    164  *
    165  * Returns          -
    166  *
    167  ******************************************************************************/
    168 void l2c_fcr_start_timer(tL2C_CCB* p_ccb) {
    169   CHECK(p_ccb != NULL);
    170   uint32_t tout;
    171 
    172   /* The timers which are in milliseconds */
    173   if (p_ccb->fcrb.wait_ack) {
    174     tout = (uint32_t)p_ccb->our_cfg.fcr.mon_tout;
    175   } else {
    176     tout = (uint32_t)p_ccb->our_cfg.fcr.rtrans_tout;
    177   }
    178 
    179   /* Only start a timer that was not started */
    180   if (!alarm_is_scheduled(p_ccb->fcrb.mon_retrans_timer)) {
    181     alarm_set_on_mloop(p_ccb->fcrb.mon_retrans_timer, tout,
    182                        l2c_ccb_timer_timeout, p_ccb);
    183   }
    184 }
    185 
    186 /*******************************************************************************
    187  *
    188  * Function         l2c_fcr_stop_timer
    189  *
    190  * Description      This function stops the (monitor or transmission) timer.
    191  *
    192  * Returns          -
    193  *
    194  ******************************************************************************/
    195 void l2c_fcr_stop_timer(tL2C_CCB* p_ccb) {
    196   CHECK(p_ccb != NULL);
    197   alarm_cancel(p_ccb->fcrb.mon_retrans_timer);
    198 }
    199 
    200 /*******************************************************************************
    201  *
    202  * Function         l2c_fcr_cleanup
    203  *
    204  * Description      This function cleans up the variable used for
    205  *                  flow-control/retrans.
    206  *
    207  * Returns          -
    208  *
    209  ******************************************************************************/
    210 void l2c_fcr_cleanup(tL2C_CCB* p_ccb) {
    211   CHECK(p_ccb != NULL);
    212   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
    213 
    214   alarm_free(p_fcrb->mon_retrans_timer);
    215   p_fcrb->mon_retrans_timer = NULL;
    216   alarm_free(p_fcrb->ack_timer);
    217   p_fcrb->ack_timer = NULL;
    218 
    219   osi_free_and_reset((void**)&p_fcrb->p_rx_sdu);
    220 
    221   fixed_queue_free(p_fcrb->waiting_for_ack_q, osi_free);
    222   p_fcrb->waiting_for_ack_q = NULL;
    223 
    224   fixed_queue_free(p_fcrb->srej_rcv_hold_q, osi_free);
    225   p_fcrb->srej_rcv_hold_q = NULL;
    226 
    227   fixed_queue_free(p_fcrb->retrans_q, osi_free);
    228   p_fcrb->retrans_q = NULL;
    229 
    230 #if (L2CAP_ERTM_STATS == TRUE)
    231   if ((p_ccb->local_cid >= L2CAP_BASE_APPL_CID) &&
    232       (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)) {
    233     uint32_t dur = time_get_os_boottime_ms() - p_ccb->fcrb.connect_tick_count;
    234     size_t p_str_size = 120;
    235     char* p_str = (char*)osi_malloc(p_str_size);
    236     uint16_t i;
    237     uint32_t throughput_avg, ack_delay_avg, ack_q_count_avg;
    238 
    239     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    240              TRACE_TYPE_GENERIC,
    241              "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums",
    242              p_ccb->local_cid, dur);
    243     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    244              TRACE_TYPE_GENERIC,
    245              "Retransmissions:%08u Times Flow Controlled:%08u Retrans "
    246              "Touts:%08u Ack Touts:%08u",
    247              p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed,
    248              p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
    249     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    250              TRACE_TYPE_GENERIC,
    251              "Times there is less than 2 packets in controller when flow "
    252              "controlled:%08u",
    253              p_ccb->fcrb.controller_idle);
    254     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    255              TRACE_TYPE_GENERIC,
    256              "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u",
    257              p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz);
    258 
    259     snprintf(
    260         p_str, p_str_size,
    261         "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u "
    262         "SREJ:%08u",
    263         p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
    264         (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
    265         p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1],
    266         p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
    267 
    268     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    269              TRACE_TYPE_GENERIC, "%s", p_str);
    270 
    271     snprintf(
    272         p_str, p_str_size,
    273         "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u "
    274         "SREJ:%08u",
    275         p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
    276         (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
    277         p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1],
    278         p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
    279 
    280     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    281              TRACE_TYPE_GENERIC, "%s", p_str);
    282 
    283     throughput_avg = 0;
    284     ack_delay_avg = 0;
    285     ack_q_count_avg = 0;
    286 
    287     for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++) {
    288       if (i == p_ccb->fcrb.ack_delay_avg_index) {
    289         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    290                  TRACE_TYPE_GENERIC, "[%02u] collecting data ...", i);
    291         continue;
    292       }
    293 
    294       snprintf(p_str, p_str_size,
    295                "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, "
    296                "ack_q_count avg:%3u, min:%3u, max:%3u",
    297                i, p_ccb->fcrb.throughput[i], p_ccb->fcrb.ack_delay_avg[i],
    298                p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
    299                p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i],
    300                p_ccb->fcrb.ack_q_count_max[i]);
    301 
    302       BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    303                TRACE_TYPE_GENERIC, "%s", p_str);
    304 
    305       throughput_avg += p_ccb->fcrb.throughput[i];
    306       ack_delay_avg += p_ccb->fcrb.ack_delay_avg[i];
    307       ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
    308     }
    309 
    310     throughput_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    311     ack_delay_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    312     ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
    313 
    314     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    315              TRACE_TYPE_GENERIC,
    316              "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, "
    317              "ack_q_count_avg: %8u",
    318              throughput_avg, ack_delay_avg, ack_q_count_avg);
    319 
    320     osi_free(p_str);
    321 
    322     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
    323              TRACE_TYPE_GENERIC, "---");
    324   }
    325 #endif
    326 
    327   memset(p_fcrb, 0, sizeof(tL2C_FCRB));
    328 }
    329 
    330 /*******************************************************************************
    331  *
    332  * Function         l2c_fcr_clone_buf
    333  *
    334  * Description      This function allocates and copies requested part of a
    335  *                  buffer at a new-offset.
    336  *
    337  * Returns          pointer to new buffer
    338  *
    339  ******************************************************************************/
    340 BT_HDR* l2c_fcr_clone_buf(BT_HDR* p_buf, uint16_t new_offset,
    341                           uint16_t no_of_bytes) {
    342   CHECK(p_buf != NULL);
    343   /*
    344    * NOTE: We allocate extra L2CAP_FCS_LEN octets, in case we need to put
    345    * the FCS (Frame Check Sequence) at the end of the buffer.
    346    */
    347   uint16_t buf_size = no_of_bytes + sizeof(BT_HDR) + new_offset + L2CAP_FCS_LEN;
    348 #if (L2CAP_ERTM_STATS == TRUE)
    349   /*
    350    * NOTE: If L2CAP_ERTM_STATS is enabled, we need 4 extra octets at the
    351    * end for a timestamp at the end of an I-frame.
    352    */
    353   buf_size += sizeof(uint32_t);
    354 #endif
    355   BT_HDR* p_buf2 = (BT_HDR*)osi_malloc(buf_size);
    356 
    357   p_buf2->offset = new_offset;
    358   p_buf2->len = no_of_bytes;
    359   memcpy(((uint8_t*)(p_buf2 + 1)) + p_buf2->offset,
    360          ((uint8_t*)(p_buf + 1)) + p_buf->offset, no_of_bytes);
    361 
    362   return (p_buf2);
    363 }
    364 
    365 /*******************************************************************************
    366  *
    367  * Function         l2c_fcr_is_flow_controlled
    368  *
    369  * Description      This function checks if the CCB is flow controlled by peer.
    370  *
    371  * Returns          The control word
    372  *
    373  ******************************************************************************/
    374 bool l2c_fcr_is_flow_controlled(tL2C_CCB* p_ccb) {
    375   CHECK(p_ccb != NULL);
    376   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
    377     /* Check if remote side flowed us off or the transmit window is full */
    378     if ((p_ccb->fcrb.remote_busy == true) ||
    379         (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) >=
    380          p_ccb->peer_cfg.fcr.tx_win_sz)) {
    381 #if (L2CAP_ERTM_STATS == TRUE)
    382       if (!fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
    383         p_ccb->fcrb.xmit_window_closed++;
    384 
    385         if ((p_ccb->p_lcb->sent_not_acked < 2) &&
    386             (l2cb.controller_xmit_window > 0))
    387           p_ccb->fcrb.controller_idle++;
    388       }
    389 #endif
    390       return (true);
    391     }
    392   }
    393   return (false);
    394 }
    395 
    396 /*******************************************************************************
    397  *
    398  * Function         prepare_I_frame
    399  *
    400  * Description      This function sets the FCR variables in an I-frame that is
    401  *                  about to be sent to HCI for transmission. This may be the
    402  *                  first time the I-frame is sent, or a retransmission
    403  *
    404  * Returns          -
    405  *
    406  ******************************************************************************/
    407 static void prepare_I_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf,
    408                             bool is_retransmission) {
    409   CHECK(p_ccb != NULL);
    410   CHECK(p_buf != NULL);
    411   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
    412   uint8_t* p;
    413   uint16_t fcs;
    414   uint16_t ctrl_word;
    415   bool set_f_bit = p_fcrb->send_f_rsp;
    416 
    417   p_fcrb->send_f_rsp = false;
    418 
    419   if (is_retransmission) {
    420     /* Get the old control word and clear out the old req_seq and F bits */
    421     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    422 
    423     STREAM_TO_UINT16(ctrl_word, p);
    424 
    425     ctrl_word &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
    426   } else {
    427     ctrl_word = p_buf->layer_specific & L2CAP_FCR_SEG_BITS; /* SAR bits */
    428     ctrl_word |=
    429         (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT); /* Tx Seq */
    430 
    431     p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
    432   }
    433 
    434   /* Set the F-bit and reqseq only if using re-transmission mode */
    435   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
    436     if (set_f_bit) ctrl_word |= L2CAP_FCR_F_BIT;
    437 
    438     ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    439 
    440     p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
    441 
    442     alarm_cancel(p_ccb->fcrb.ack_timer);
    443   }
    444 
    445   /* Set the control word */
    446   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
    447 
    448   UINT16_TO_STREAM(p, ctrl_word);
    449 
    450   /* Compute the FCS and add to the end of the buffer if not bypassed */
    451   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
    452     /* length field in l2cap header has to include FCS length */
    453     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
    454     UINT16_TO_STREAM(p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
    455 
    456     /* Calculate the FCS */
    457     fcs = l2c_fcr_tx_get_fcs(p_buf);
    458 
    459     /* Point to the end of the buffer and put the FCS there */
    460     /*
    461      * NOTE: Here we assume the allocated buffer is large enough
    462      * to include extra L2CAP_FCS_LEN octets at the end.
    463      */
    464     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len;
    465 
    466     UINT16_TO_STREAM(p, fcs);
    467 
    468     p_buf->len += L2CAP_FCS_LEN;
    469   }
    470 
    471   if (is_retransmission) {
    472     L2CAP_TRACE_EVENT(
    473         "L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  "
    474         "ReqSeq: %u  F: %u",
    475         p_ccb->local_cid, p_buf->len,
    476         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    477         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    478         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    479         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    480   } else {
    481     L2CAP_TRACE_EVENT(
    482         "L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  "
    483         "ReqSeq: %u  F: %u",
    484         p_ccb->local_cid, p_buf->len,
    485         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    486         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    487         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    488         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    489   }
    490 
    491   /* Start the retransmission timer if not already running */
    492   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
    493     l2c_fcr_start_timer(p_ccb);
    494 }
    495 
    496 /*******************************************************************************
    497  *
    498  * Function         l2c_fcr_send_S_frame
    499  *
    500  * Description      This function formats and sends an S-frame for transmission.
    501  *
    502  * Returns          -
    503  *
    504  ******************************************************************************/
    505 void l2c_fcr_send_S_frame(tL2C_CCB* p_ccb, uint16_t function_code,
    506                           uint16_t pf_bit) {
    507   CHECK(p_ccb != NULL);
    508   uint8_t* p;
    509   uint16_t ctrl_word;
    510   uint16_t fcs;
    511 
    512   if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN)) return;
    513 
    514 #if (L2CAP_ERTM_STATS == TRUE)
    515   p_ccb->fcrb.s_frames_sent[function_code]++;
    516 #endif
    517 
    518   if (pf_bit == L2CAP_FCR_P_BIT) {
    519     p_ccb->fcrb.wait_ack = true;
    520 
    521     l2c_fcr_stop_timer(p_ccb); /* Restart the monitor timer */
    522     l2c_fcr_start_timer(p_ccb);
    523   }
    524 
    525   /* Create the control word to use */
    526   ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
    527   ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
    528   ctrl_word |= pf_bit;
    529 
    530   BT_HDR* p_buf = (BT_HDR*)osi_malloc(L2CAP_CMD_BUF_SIZE);
    531   p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
    532   p_buf->len = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
    533 
    534   /* Set the pointer to the beginning of the data */
    535   p = (uint8_t*)(p_buf + 1) + p_buf->offset;
    536 
    537   /* Put in the L2CAP header */
    538   UINT16_TO_STREAM(p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
    539   UINT16_TO_STREAM(p, p_ccb->remote_cid);
    540   UINT16_TO_STREAM(p, ctrl_word);
    541 
    542   /* Compute the FCS and add to the end of the buffer if not bypassed */
    543   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
    544     fcs = l2c_fcr_tx_get_fcs(p_buf);
    545 
    546     UINT16_TO_STREAM(p, fcs);
    547     p_buf->len += L2CAP_FCS_LEN;
    548   } else {
    549     /* rewrite the length without FCS length */
    550     p -= 6;
    551     UINT16_TO_STREAM(p, L2CAP_FCR_OVERHEAD);
    552   }
    553 
    554   /* Now, the HCI transport header */
    555   p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
    556   l2cu_set_acl_hci_header(p_buf, p_ccb);
    557 
    558   if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1) ||
    559       (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3)) {
    560     L2CAP_TRACE_WARNING(
    561         "L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  "
    562         "ReqSeq: %u  P: %u  F: %u",
    563         p_ccb->local_cid, ctrl_word,
    564         SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    565         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    566         (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    567         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    568     L2CAP_TRACE_WARNING("                  Buf Len: %u", p_buf->len);
    569   } else {
    570     L2CAP_TRACE_EVENT(
    571         "L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  "
    572         "ReqSeq: %u  P: %u  F: %u",
    573         p_ccb->local_cid, ctrl_word,
    574         SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    575         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    576         (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    577         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    578     L2CAP_TRACE_EVENT("                  Buf Len: %u", p_buf->len);
    579   }
    580 
    581   l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, p_buf);
    582 
    583   p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
    584 
    585   alarm_cancel(p_ccb->fcrb.ack_timer);
    586 }
    587 
    588 /*******************************************************************************
    589  *
    590  * Function         l2c_fcr_proc_pdu
    591  *
    592  * Description      This function is the entry point for processing of a
    593  *                  received PDU when in flow control and/or retransmission
    594  *                  modes.
    595  *
    596  * Returns          -
    597  *
    598  ******************************************************************************/
    599 void l2c_fcr_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
    600   CHECK(p_ccb != NULL);
    601   CHECK(p_buf != NULL);
    602   uint8_t* p;
    603   uint16_t fcs;
    604   uint16_t min_pdu_len;
    605   uint16_t ctrl_word;
    606 
    607   /* Check the length */
    608   min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS)
    609                     ? (uint16_t)L2CAP_FCR_OVERHEAD
    610                     : (uint16_t)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
    611 
    612   if (p_buf->len < min_pdu_len) {
    613     L2CAP_TRACE_WARNING("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u",
    614                         p_ccb->local_cid, p_buf->len);
    615     osi_free(p_buf);
    616     return;
    617   }
    618 
    619   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE) {
    620     process_stream_frame(p_ccb, p_buf);
    621     return;
    622   }
    623 
    624   /* Get the control word */
    625   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
    626   STREAM_TO_UINT16(ctrl_word, p);
    627 
    628   if (ctrl_word & L2CAP_FCR_S_FRAME_BIT) {
    629     if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1) ||
    630         (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3)) {
    631       /* REJ or SREJ */
    632       L2CAP_TRACE_WARNING(
    633           "L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  "
    634           "P: %u  F: %u",
    635           p_ccb->local_cid, p_buf->len,
    636           SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    637           (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    638           (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    639           (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    640     } else {
    641       L2CAP_TRACE_EVENT(
    642           "L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  "
    643           "P: %u  F: %u",
    644           p_ccb->local_cid, p_buf->len,
    645           SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
    646           (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    647           (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
    648           (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    649     }
    650   } else {
    651     L2CAP_TRACE_EVENT(
    652         "L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  "
    653         "ReqSeq: %u  F: %u",
    654         p_ccb->local_cid, p_buf->len,
    655         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
    656         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    657         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
    658         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
    659   }
    660 
    661   L2CAP_TRACE_EVENT(
    662       "      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt "
    663       "%u, wt_q.cnt %u, tries %u",
    664       p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack,
    665       p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent,
    666       fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q), p_ccb->fcrb.num_tries);
    667 
    668   /* Verify FCS if using */
    669   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
    670     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
    671 
    672     /* Extract and drop the FCS from the packet */
    673     STREAM_TO_UINT16(fcs, p);
    674     p_buf->len -= L2CAP_FCS_LEN;
    675 
    676     if (l2c_fcr_rx_get_fcs(p_buf) != fcs) {
    677       L2CAP_TRACE_WARNING("Rx L2CAP PDU: CID: 0x%04x  BAD FCS",
    678                           p_ccb->local_cid);
    679       osi_free(p_buf);
    680       return;
    681     }
    682   }
    683 
    684   /* Get the control word */
    685   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
    686 
    687   STREAM_TO_UINT16(ctrl_word, p);
    688 
    689   p_buf->len -= L2CAP_FCR_OVERHEAD;
    690   p_buf->offset += L2CAP_FCR_OVERHEAD;
    691 
    692   /* If we had a poll bit outstanding, check if we got a final response */
    693   if (p_ccb->fcrb.wait_ack) {
    694     /* If final bit not set, ignore the frame unless it is a polled S-frame */
    695     if (!(ctrl_word & L2CAP_FCR_F_BIT)) {
    696       if ((ctrl_word & L2CAP_FCR_P_BIT) &&
    697           (ctrl_word & L2CAP_FCR_S_FRAME_BIT)) {
    698         if (p_ccb->fcrb.srej_sent)
    699           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
    700         else if (p_ccb->fcrb.local_busy)
    701           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
    702         else
    703           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
    704 
    705         /* Got a poll while in wait_ack state, so re-start our timer with
    706          * 1-second */
    707         /* This is a small optimization... the monitor timer is 12 secs, but we
    708          * saw */
    709         /* that if the other side sends us a poll when we are waiting for a
    710          * final,  */
    711         /* then it speeds up recovery significantly if we poll him back soon
    712          * after his poll. */
    713         alarm_set_on_mloop(p_ccb->fcrb.mon_retrans_timer, BT_1SEC_TIMEOUT_MS,
    714                            l2c_ccb_timer_timeout, p_ccb);
    715       }
    716       osi_free(p_buf);
    717       return;
    718     }
    719 
    720     p_ccb->fcrb.wait_ack = false;
    721 
    722     /* P and F are mutually exclusive */
    723     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT) ctrl_word &= ~L2CAP_FCR_P_BIT;
    724 
    725     if (fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
    726       p_ccb->fcrb.num_tries = 0;
    727 
    728     l2c_fcr_stop_timer(p_ccb);
    729   } else {
    730     /* Otherwise, ensure the final bit is ignored */
    731     ctrl_word &= ~L2CAP_FCR_F_BIT;
    732   }
    733 
    734   /* Process receive sequence number */
    735   if (!process_reqseq(p_ccb, ctrl_word)) {
    736     osi_free(p_buf);
    737     return;
    738   }
    739 
    740   /* Process based on whether it is an S-frame or an I-frame */
    741   if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
    742     process_s_frame(p_ccb, p_buf, ctrl_word);
    743   else
    744     process_i_frame(p_ccb, p_buf, ctrl_word, false);
    745 
    746   /* Return if the channel got disconnected by a bad packet or max
    747    * retransmissions */
    748   if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN)) return;
    749 
    750   /* If we have some buffers held while doing SREJ, and SREJ has cleared,
    751    * process them now */
    752   if ((!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) &&
    753       (!fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q))) {
    754     fixed_queue_t* temp_q = p_ccb->fcrb.srej_rcv_hold_q;
    755     p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(SIZE_MAX);
    756 
    757     while ((p_buf = (BT_HDR*)fixed_queue_try_dequeue(temp_q)) != NULL) {
    758       if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN)) {
    759         /* Get the control word */
    760         p = ((uint8_t*)(p_buf + 1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
    761 
    762         STREAM_TO_UINT16(ctrl_word, p);
    763 
    764         L2CAP_TRACE_DEBUG(
    765             "l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   "
    766             "TxSeq: %u  Expected_Seq: %u",
    767             p_ccb->local_cid,
    768             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
    769             p_ccb->fcrb.next_seq_expected);
    770 
    771         /* Process the SREJ held I-frame, but do not send an RR for each
    772          * individual frame */
    773         process_i_frame(p_ccb, p_buf, ctrl_word, true);
    774       } else
    775         osi_free(p_buf);
    776 
    777       /* If more frames were lost during SREJ, send a REJ */
    778       if (p_ccb->fcrb.rej_after_srej) {
    779         p_ccb->fcrb.rej_after_srej = false;
    780         p_ccb->fcrb.rej_sent = true;
    781 
    782         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_REJ, 0);
    783       }
    784     }
    785     fixed_queue_free(temp_q, NULL);
    786 
    787     /* Now, if needed, send one RR for the whole held queue */
    788     if ((!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) &&
    789         (!p_ccb->fcrb.srej_sent) &&
    790         (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent))
    791       l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, 0);
    792     else {
    793       L2CAP_TRACE_DEBUG(
    794           "l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d "
    795           "rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
    796           p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent,
    797           p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
    798           p_ccb->fcrb.last_ack_sent);
    799     }
    800   }
    801 
    802   /* If a window has opened, check if we can send any more packets */
    803   if ((!fixed_queue_is_empty(p_ccb->fcrb.retrans_q) ||
    804        !fixed_queue_is_empty(p_ccb->xmit_hold_q)) &&
    805       (p_ccb->fcrb.wait_ack == false) &&
    806       (l2c_fcr_is_flow_controlled(p_ccb) == false)) {
    807     l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, NULL);
    808   }
    809 }
    810 
    811 /*******************************************************************************
    812  *
    813  * Function         l2c_lcc_proc_pdu
    814  *
    815  * Description      This function is the entry point for processing of a
    816  *                  received PDU when in LE Coc flow control modes.
    817  *
    818  * Returns          -
    819  *
    820  ******************************************************************************/
    821 void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
    822   CHECK(p_ccb != NULL);
    823   CHECK(p_buf != NULL);
    824   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
    825   uint16_t sdu_length;
    826   BT_HDR* p_data = NULL;
    827 
    828   /* Buffer length should not exceed local mps */
    829   if (p_buf->len > p_ccb->local_conn_cfg.mps) {
    830     /* Discard the buffer */
    831     osi_free(p_buf);
    832     return;
    833   }
    834 
    835   if (p_ccb->is_first_seg) {
    836     STREAM_TO_UINT16(sdu_length, p);
    837     /* Check the SDU Length with local MTU size */
    838     if (sdu_length > p_ccb->local_conn_cfg.mtu) {
    839       /* Discard the buffer */
    840       osi_free(p_buf);
    841       return;
    842     }
    843 
    844     p_data = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE);
    845     if (p_data == NULL) {
    846       osi_free(p_buf);
    847       return;
    848     }
    849 
    850     p_ccb->ble_sdu = p_data;
    851     p_data->len = 0;
    852     p_ccb->ble_sdu_length = sdu_length;
    853     L2CAP_TRACE_DEBUG("%s SDU Length = %d", __func__, sdu_length);
    854     p_buf->len -= sizeof(sdu_length);
    855     p_buf->offset += sizeof(sdu_length);
    856     p_data->offset = 0;
    857 
    858   } else
    859     p_data = p_ccb->ble_sdu;
    860 
    861   memcpy((uint8_t*)(p_data + 1) + p_data->offset + p_data->len,
    862          (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len);
    863   p_data->len += p_buf->len;
    864   p = (uint8_t*)(p_data + 1) + p_data->offset;
    865   if (p_data->len == p_ccb->ble_sdu_length) {
    866     l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DATA, p_data);
    867     p_ccb->is_first_seg = true;
    868     p_ccb->ble_sdu = NULL;
    869     p_ccb->ble_sdu_length = 0;
    870   } else if (p_data->len < p_ccb->ble_sdu_length) {
    871     p_ccb->is_first_seg = false;
    872   } else {
    873     L2CAP_TRACE_ERROR("%s Length in the SDU messed up", __func__);
    874     // TODO: reset every thing may be???
    875   }
    876 
    877   osi_free(p_buf);
    878   return;
    879 }
    880 
    881 /*******************************************************************************
    882  *
    883  * Function         l2c_fcr_proc_tout
    884  *
    885  * Description      Handle a timeout. We should be in error recovery state.
    886  *
    887  * Returns          -
    888  *
    889  ******************************************************************************/
    890 void l2c_fcr_proc_tout(tL2C_CCB* p_ccb) {
    891   CHECK(p_ccb != NULL);
    892   L2CAP_TRACE_DEBUG(
    893       "l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  "
    894       "ack_q_count: %u",
    895       p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
    896       p_ccb->fcrb.wait_ack, fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
    897 
    898 #if (L2CAP_ERTM_STATS == TRUE)
    899   p_ccb->fcrb.retrans_touts++;
    900 #endif
    901 
    902   if ((p_ccb->peer_cfg.fcr.max_transmit != 0) &&
    903       (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit)) {
    904     l2cu_disconnect_chnl(p_ccb);
    905   } else {
    906     if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent) {
    907       if (p_ccb->fcrb.local_busy)
    908         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
    909       else
    910         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
    911     }
    912   }
    913 }
    914 
    915 /*******************************************************************************
    916  *
    917  * Function         l2c_fcr_proc_ack_tout
    918  *
    919  * Description      Send RR/RNR if we have not acked I frame
    920  *
    921  * Returns          -
    922  *
    923  ******************************************************************************/
    924 void l2c_fcr_proc_ack_tout(tL2C_CCB* p_ccb) {
    925   CHECK(p_ccb != NULL);
    926   L2CAP_TRACE_DEBUG(
    927       "l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d",
    928       p_ccb->local_cid, p_ccb->chnl_state, p_ccb->fcrb.wait_ack,
    929       p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
    930 
    931   if ((p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack) &&
    932       (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected)) {
    933 #if (L2CAP_ERTM_STATS == TRUE)
    934     p_ccb->fcrb.xmit_ack_touts++;
    935 #endif
    936     if (p_ccb->fcrb.local_busy)
    937       l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, 0);
    938     else
    939       l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, 0);
    940   }
    941 }
    942 
    943 /*******************************************************************************
    944  *
    945  * Function         process_reqseq
    946  *
    947  * Description      Handle receive sequence number
    948  *
    949  * Returns          -
    950  *
    951  ******************************************************************************/
    952 static bool process_reqseq(tL2C_CCB* p_ccb, uint16_t ctrl_word) {
    953   CHECK(p_ccb != NULL);
    954   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
    955   uint8_t req_seq, num_bufs_acked, xx;
    956   uint16_t ls;
    957   uint16_t full_sdus_xmitted;
    958 
    959   /* Receive sequence number does not ack anything for SREJ with P-bit set to
    960    * zero */
    961   if ((ctrl_word & L2CAP_FCR_S_FRAME_BIT) &&
    962       ((ctrl_word & L2CAP_FCR_SUP_BITS) ==
    963        (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT)) &&
    964       ((ctrl_word & L2CAP_FCR_P_BIT) == 0)) {
    965     /* If anything still waiting for ack, restart the timer if it was stopped */
    966     if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
    967       l2c_fcr_start_timer(p_ccb);
    968 
    969     return (true);
    970   }
    971 
    972   /* Extract the receive sequence number from the control word */
    973   req_seq =
    974       (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
    975 
    976   num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
    977 
    978   /* Verify the request sequence is in range before proceeding */
    979   if (num_bufs_acked > fixed_queue_length(p_fcrb->waiting_for_ack_q)) {
    980     /* The channel is closed if ReqSeq is not in range */
    981     L2CAP_TRACE_WARNING(
    982         "L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  "
    983         "last_rx_ack: 0x%02x  QCount: %u",
    984         ctrl_word, req_seq, p_fcrb->last_rx_ack,
    985         fixed_queue_length(p_fcrb->waiting_for_ack_q));
    986 
    987     l2cu_disconnect_chnl(p_ccb);
    988     return (false);
    989   }
    990 
    991   p_fcrb->last_rx_ack = req_seq;
    992 
    993   /* Now we can release all acknowledged frames, and restart the retransmission
    994    * timer if needed */
    995   if (num_bufs_acked != 0) {
    996     p_fcrb->num_tries = 0;
    997     full_sdus_xmitted = 0;
    998 
    999 #if (L2CAP_ERTM_STATS == TRUE)
   1000     l2c_fcr_collect_ack_delay(p_ccb, num_bufs_acked);
   1001 #endif
   1002 
   1003     for (xx = 0; xx < num_bufs_acked; xx++) {
   1004       BT_HDR* p_tmp =
   1005           (BT_HDR*)fixed_queue_try_dequeue(p_fcrb->waiting_for_ack_q);
   1006       ls = p_tmp->layer_specific & L2CAP_FCR_SAR_BITS;
   1007 
   1008       if ((ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU))
   1009         full_sdus_xmitted++;
   1010 
   1011       osi_free(p_tmp);
   1012     }
   1013 
   1014     /* If we are still in a wait_ack state, do not mess with the timer */
   1015     if (!p_ccb->fcrb.wait_ack) l2c_fcr_stop_timer(p_ccb);
   1016 
   1017     /* Check if we need to call the "packet_sent" callback */
   1018     if ((p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) &&
   1019         (full_sdus_xmitted)) {
   1020       /* Special case for eRTM, if all packets sent, send 0xFFFF */
   1021       if (fixed_queue_is_empty(p_fcrb->waiting_for_ack_q) &&
   1022           fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
   1023         full_sdus_xmitted = 0xFFFF;
   1024       }
   1025 
   1026       (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid,
   1027                                                full_sdus_xmitted);
   1028     }
   1029   }
   1030 
   1031   /* If anything still waiting for ack, restart the timer if it was stopped */
   1032   if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
   1033     l2c_fcr_start_timer(p_ccb);
   1034   return (true);
   1035 }
   1036 
   1037 /*******************************************************************************
   1038  *
   1039  * Function         process_s_frame
   1040  *
   1041  * Description      Process an S frame
   1042  *
   1043  * Returns          -
   1044  *
   1045  ******************************************************************************/
   1046 static void process_s_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf,
   1047                             uint16_t ctrl_word) {
   1048   CHECK(p_ccb != NULL);
   1049   CHECK(p_buf != NULL);
   1050 
   1051   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
   1052   uint16_t s_frame_type =
   1053       (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
   1054   bool remote_was_busy;
   1055   bool all_ok = true;
   1056 
   1057   if (p_buf->len != 0) {
   1058     L2CAP_TRACE_WARNING("Incorrect S-frame Length (%d)", p_buf->len);
   1059   }
   1060 
   1061   L2CAP_TRACE_DEBUG("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d",
   1062                     ctrl_word, p_fcrb->remote_busy);
   1063 
   1064 #if (L2CAP_ERTM_STATS == TRUE)
   1065   p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
   1066 #endif
   1067 
   1068   if (ctrl_word & L2CAP_FCR_P_BIT) {
   1069     p_fcrb->rej_sent = false;  /* After checkpoint, we can send anoher REJ */
   1070     p_fcrb->send_f_rsp = true; /* Set a flag in case an I-frame is pending */
   1071   }
   1072 
   1073   switch (s_frame_type) {
   1074     case L2CAP_FCR_SUP_RR:
   1075       remote_was_busy = p_fcrb->remote_busy;
   1076       p_fcrb->remote_busy = false;
   1077 
   1078       if ((ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy))
   1079         all_ok = retransmit_i_frames(p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1080       break;
   1081 
   1082     case L2CAP_FCR_SUP_REJ:
   1083       p_fcrb->remote_busy = false;
   1084       all_ok = retransmit_i_frames(p_ccb, L2C_FCR_RETX_ALL_PKTS);
   1085       break;
   1086 
   1087     case L2CAP_FCR_SUP_RNR:
   1088       p_fcrb->remote_busy = true;
   1089       l2c_fcr_stop_timer(p_ccb);
   1090       break;
   1091 
   1092     case L2CAP_FCR_SUP_SREJ:
   1093       p_fcrb->remote_busy = false;
   1094       all_ok = retransmit_i_frames(
   1095           p_ccb, (uint8_t)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >>
   1096                            L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
   1097       break;
   1098   }
   1099 
   1100   if (all_ok) {
   1101     /* If polled, we need to respond with F-bit. Note, we may have sent a
   1102      * I-frame with the F-bit */
   1103     if (p_fcrb->send_f_rsp) {
   1104       if (p_fcrb->srej_sent)
   1105         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
   1106       else if (p_fcrb->local_busy)
   1107         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
   1108       else
   1109         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
   1110 
   1111       p_fcrb->send_f_rsp = false;
   1112     }
   1113   } else {
   1114     L2CAP_TRACE_DEBUG("process_s_frame hit_max_retries");
   1115   }
   1116 
   1117   osi_free(p_buf);
   1118 }
   1119 
   1120 /*******************************************************************************
   1121  *
   1122  * Function         process_i_frame
   1123  *
   1124  * Description      Process an I frame
   1125  *
   1126  * Returns          -
   1127  *
   1128  ******************************************************************************/
   1129 static void process_i_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf, uint16_t ctrl_word,
   1130                             bool delay_ack) {
   1131   CHECK(p_ccb != NULL);
   1132   CHECK(p_buf != NULL);
   1133 
   1134   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
   1135   uint8_t tx_seq, num_lost, num_to_ack, next_srej;
   1136 
   1137   /* If we were doing checkpoint recovery, first retransmit all unacked I-frames
   1138    */
   1139   if (ctrl_word & L2CAP_FCR_F_BIT) {
   1140     if (!retransmit_i_frames(p_ccb, L2C_FCR_RETX_ALL_PKTS)) {
   1141       osi_free(p_buf);
   1142       return;
   1143     }
   1144   }
   1145 
   1146 #if (L2CAP_ERTM_STATS == TRUE)
   1147   p_ccb->fcrb.ertm_pkt_counts[1]++;
   1148   p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
   1149 #endif
   1150 
   1151   /* Extract the sequence number */
   1152   tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1153 
   1154   /* If we have flow controlled the peer, ignore any bad I-frames from him */
   1155   if ((tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy)) {
   1156     L2CAP_TRACE_WARNING("Dropping bad I-Frame since we flowed off, tx_seq:%u",
   1157                         tx_seq);
   1158     l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1159     osi_free(p_buf);
   1160     return;
   1161   }
   1162 
   1163   /* Check if tx-sequence is the expected one */
   1164   if (tx_seq != p_fcrb->next_seq_expected) {
   1165     num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
   1166 
   1167     /* Is the frame a duplicate ? If so, just drop it */
   1168     if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz) {
   1169       /* Duplicate - simply drop it */
   1170       L2CAP_TRACE_WARNING(
   1171           "process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq "
   1172           "%u",
   1173           tx_seq, p_fcrb->next_seq_expected);
   1174       osi_free(p_buf);
   1175     } else {
   1176       L2CAP_TRACE_WARNING(
   1177           "process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  "
   1178           "Rej: %u  SRej: %u",
   1179           p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected,
   1180           p_fcrb->rej_sent, p_fcrb->srej_sent);
   1181 
   1182       if (p_fcrb->srej_sent) {
   1183         /* If SREJ sent, save the frame for later processing as long as it is in
   1184          * sequence */
   1185         next_srej =
   1186             (((BT_HDR*)fixed_queue_try_peek_last(p_fcrb->srej_rcv_hold_q))
   1187                  ->layer_specific +
   1188              1) &
   1189             L2CAP_FCR_SEQ_MODULO;
   1190 
   1191         if ((tx_seq == next_srej) &&
   1192             (fixed_queue_length(p_fcrb->srej_rcv_hold_q) <
   1193              p_ccb->our_cfg.fcr.tx_win_sz)) {
   1194           /* If user gave us a pool for held rx buffers, use that */
   1195           /* TODO: Could that happen? Get rid of this code. */
   1196           if (p_ccb->ertm_info.fcr_rx_buf_size != L2CAP_FCR_RX_BUF_SIZE) {
   1197             BT_HDR* p_buf2;
   1198 
   1199             /* Adjust offset and len so that control word is copied */
   1200             p_buf->offset -= L2CAP_FCR_OVERHEAD;
   1201             p_buf->len += L2CAP_FCR_OVERHEAD;
   1202 
   1203             p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
   1204 
   1205             if (p_buf2) {
   1206               osi_free(p_buf);
   1207               p_buf = p_buf2;
   1208             }
   1209             p_buf->offset += L2CAP_FCR_OVERHEAD;
   1210             p_buf->len -= L2CAP_FCR_OVERHEAD;
   1211           }
   1212           L2CAP_TRACE_DEBUG(
   1213               "process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  "
   1214               "SRej1",
   1215               num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
   1216 
   1217           p_buf->layer_specific = tx_seq;
   1218           fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
   1219         } else {
   1220           L2CAP_TRACE_WARNING(
   1221               "process_i_frame() CID: 0x%04x  frame dropped in Srej Sent "
   1222               "next_srej:%u  hold_q.count:%u  win_sz:%u",
   1223               p_ccb->local_cid, next_srej,
   1224               fixed_queue_length(p_fcrb->srej_rcv_hold_q),
   1225               p_ccb->our_cfg.fcr.tx_win_sz);
   1226 
   1227           p_fcrb->rej_after_srej = true;
   1228           osi_free(p_buf);
   1229         }
   1230       } else if (p_fcrb->rej_sent) {
   1231         L2CAP_TRACE_WARNING(
   1232             "process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  "
   1233             "Rej: 1  SRej: %u",
   1234             p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected,
   1235             p_fcrb->srej_sent);
   1236 
   1237         /* If REJ sent, just drop the frame */
   1238         osi_free(p_buf);
   1239       } else {
   1240         L2CAP_TRACE_DEBUG(
   1241             "process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
   1242             p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected,
   1243             p_fcrb->rej_sent);
   1244 
   1245         /* If only one lost, we will send SREJ, otherwise we will send REJ */
   1246         if (num_lost > 1) {
   1247           osi_free(p_buf);
   1248           p_fcrb->rej_sent = true;
   1249           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_REJ, 0);
   1250         } else {
   1251           if (!fixed_queue_is_empty(p_fcrb->srej_rcv_hold_q)) {
   1252             L2CAP_TRACE_ERROR(
   1253                 "process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d "
   1254                 "hold_q.count:%u",
   1255                 p_ccb->local_cid, tx_seq,
   1256                 fixed_queue_length(p_fcrb->srej_rcv_hold_q));
   1257           }
   1258           p_buf->layer_specific = tx_seq;
   1259           fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
   1260           p_fcrb->srej_sent = true;
   1261           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_SREJ, 0);
   1262         }
   1263         alarm_cancel(p_ccb->fcrb.ack_timer);
   1264       }
   1265     }
   1266     return;
   1267   }
   1268 
   1269   /* Seq number is the next expected. Clear possible reject exception in case it
   1270    * occured */
   1271   p_fcrb->rej_sent = p_fcrb->srej_sent = false;
   1272 
   1273   /* Adjust the next_seq, so that if the upper layer sends more data in the
   1274      callback
   1275      context, the received frame is acked by an I-frame. */
   1276   p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1277 
   1278   /* If any SAR problem in eRTM mode, spec says disconnect. */
   1279   if (!do_sar_reassembly(p_ccb, p_buf, ctrl_word)) {
   1280     L2CAP_TRACE_WARNING("process_i_frame() CID: 0x%04x  reassembly failed",
   1281                         p_ccb->local_cid);
   1282     l2cu_disconnect_chnl(p_ccb);
   1283     return;
   1284   }
   1285 
   1286   /* RR optimization - if peer can still send us more, then start an ACK timer
   1287    */
   1288   num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) &
   1289                L2CAP_FCR_SEQ_MODULO;
   1290 
   1291   if ((num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy))
   1292     delay_ack = true;
   1293 
   1294   /* We should neve never ack frame if we are not in OPEN state */
   1295   if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN)) {
   1296     /* If no frames are awaiting transmission or are held, send an RR or RNR
   1297      * S-frame for ack */
   1298     if (delay_ack) {
   1299       /* If it is the first I frame we did not ack, start ack timer */
   1300       if (!alarm_is_scheduled(p_ccb->fcrb.ack_timer)) {
   1301         alarm_set_on_mloop(p_ccb->fcrb.ack_timer, L2CAP_FCR_ACK_TIMEOUT_MS,
   1302                            l2c_fcrb_ack_timer_timeout, p_ccb);
   1303       }
   1304     } else if ((fixed_queue_is_empty(p_ccb->xmit_hold_q) ||
   1305                 l2c_fcr_is_flow_controlled(p_ccb)) &&
   1306                fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q)) {
   1307       if (p_fcrb->local_busy)
   1308         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, 0);
   1309       else
   1310         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, 0);
   1311     }
   1312   }
   1313 }
   1314 
   1315 /*******************************************************************************
   1316  *
   1317  * Function         process_stream_frame
   1318  *
   1319  * Description      This function processes frames in streaming mode
   1320  *
   1321  * Returns          -
   1322  *
   1323  ******************************************************************************/
   1324 static void process_stream_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
   1325   CHECK(p_ccb != NULL);
   1326   CHECK(p_buf != NULL);
   1327 
   1328   uint16_t ctrl_word;
   1329   uint16_t fcs;
   1330   uint8_t* p;
   1331   uint8_t tx_seq;
   1332 
   1333   /* Verify FCS if using */
   1334   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
   1335     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
   1336 
   1337     /* Extract and drop the FCS from the packet */
   1338     STREAM_TO_UINT16(fcs, p);
   1339     p_buf->len -= L2CAP_FCS_LEN;
   1340 
   1341     if (l2c_fcr_rx_get_fcs(p_buf) != fcs) {
   1342       L2CAP_TRACE_WARNING("Rx L2CAP PDU: CID: 0x%04x  BAD FCS",
   1343                           p_ccb->local_cid);
   1344       osi_free(p_buf);
   1345       return;
   1346     }
   1347   }
   1348 
   1349   /* Get the control word */
   1350   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
   1351 
   1352   STREAM_TO_UINT16(ctrl_word, p);
   1353 
   1354   p_buf->len -= L2CAP_FCR_OVERHEAD;
   1355   p_buf->offset += L2CAP_FCR_OVERHEAD;
   1356 
   1357   /* Make sure it is an I-frame */
   1358   if (ctrl_word & L2CAP_FCR_S_FRAME_BIT) {
   1359     L2CAP_TRACE_WARNING(
   1360         "Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: "
   1361         "0x%04x",
   1362         p_ccb->local_cid, ctrl_word);
   1363     osi_free(p_buf);
   1364     return;
   1365   }
   1366 
   1367   L2CAP_TRACE_EVENT(
   1368       "L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  "
   1369       "ReqSeq: %u  F: %u",
   1370       p_ccb->local_cid, p_buf->len,
   1371       SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
   1372       (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
   1373       (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
   1374       (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
   1375 
   1376   /* Extract the sequence number */
   1377   tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1378 
   1379   /* Check if tx-sequence is the expected one */
   1380   if (tx_seq != p_ccb->fcrb.next_seq_expected) {
   1381     L2CAP_TRACE_WARNING(
   1382         "Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: "
   1383         "0x%08x",
   1384         p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq,
   1385         p_ccb->fcrb.p_rx_sdu);
   1386 
   1387     /* Lost one or more packets, so flush the SAR queue */
   1388     osi_free_and_reset((void**)&p_ccb->fcrb.p_rx_sdu);
   1389   }
   1390 
   1391   p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
   1392 
   1393   if (!do_sar_reassembly(p_ccb, p_buf, ctrl_word)) {
   1394     /* Some sort of SAR error, so flush the SAR queue */
   1395     osi_free_and_reset((void**)&p_ccb->fcrb.p_rx_sdu);
   1396   }
   1397 }
   1398 
   1399 /*******************************************************************************
   1400  *
   1401  * Function         do_sar_reassembly
   1402  *
   1403  * Description      Process SAR bits and re-assemble frame
   1404  *
   1405  * Returns          true if all OK, else false
   1406  *
   1407  ******************************************************************************/
   1408 static bool do_sar_reassembly(tL2C_CCB* p_ccb, BT_HDR* p_buf,
   1409                               uint16_t ctrl_word) {
   1410   CHECK(p_ccb != NULL);
   1411   CHECK(p_buf != NULL);
   1412 
   1413   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
   1414   uint16_t sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
   1415   bool packet_ok = true;
   1416   uint8_t* p;
   1417 
   1418   /* Check if the SAR state is correct */
   1419   if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU)) {
   1420     if (p_fcrb->p_rx_sdu != NULL) {
   1421       L2CAP_TRACE_WARNING(
   1422           "SAR - got unexpected unsegmented or start SDU  Expected len: %u  "
   1423           "Got so far: %u",
   1424           p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
   1425 
   1426       packet_ok = false;
   1427     }
   1428     /* Check the length of the packet */
   1429     if ((sar_type == L2CAP_FCR_START_SDU) &&
   1430         (p_buf->len < L2CAP_SDU_LEN_OVERHEAD)) {
   1431       L2CAP_TRACE_WARNING("SAR start packet too short: %u", p_buf->len);
   1432       packet_ok = false;
   1433     }
   1434   } else {
   1435     if (p_fcrb->p_rx_sdu == NULL) {
   1436       L2CAP_TRACE_WARNING("SAR - got unexpected cont or end SDU");
   1437       packet_ok = false;
   1438     }
   1439   }
   1440 
   1441   if ((packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU)) {
   1442     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
   1443 
   1444     /* For start SDU packet, extract the SDU length */
   1445     if (sar_type == L2CAP_FCR_START_SDU) {
   1446       /* Get the SDU length */
   1447       STREAM_TO_UINT16(p_fcrb->rx_sdu_len, p);
   1448       p_buf->offset += 2;
   1449       p_buf->len -= 2;
   1450 
   1451       if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) {
   1452         L2CAP_TRACE_WARNING("SAR - SDU len: %u  larger than MTU: %u",
   1453                             p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
   1454         packet_ok = false;
   1455       } else {
   1456         p_fcrb->p_rx_sdu = (BT_HDR*)osi_malloc(L2CAP_MAX_BUF_SIZE);
   1457         p_fcrb->p_rx_sdu->offset = OBX_BUF_MIN_OFFSET;
   1458         p_fcrb->p_rx_sdu->len = 0;
   1459       }
   1460     }
   1461 
   1462     if (packet_ok) {
   1463       if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len) {
   1464         L2CAP_TRACE_ERROR(
   1465             "SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u", sar_type,
   1466             p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
   1467         packet_ok = false;
   1468       } else if ((sar_type == L2CAP_FCR_END_SDU) &&
   1469                  ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len)) {
   1470         L2CAP_TRACE_WARNING("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
   1471                             p_fcrb->p_rx_sdu->len, p_buf->len,
   1472                             p_fcrb->rx_sdu_len);
   1473         packet_ok = false;
   1474       } else {
   1475         memcpy(((uint8_t*)(p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset +
   1476                    p_fcrb->p_rx_sdu->len,
   1477                p, p_buf->len);
   1478 
   1479         p_fcrb->p_rx_sdu->len += p_buf->len;
   1480 
   1481         osi_free(p_buf);
   1482         p_buf = NULL;
   1483 
   1484         if (sar_type == L2CAP_FCR_END_SDU) {
   1485           p_buf = p_fcrb->p_rx_sdu;
   1486           p_fcrb->p_rx_sdu = NULL;
   1487         }
   1488       }
   1489     }
   1490   }
   1491 
   1492   if (packet_ok == false) {
   1493     osi_free(p_buf);
   1494   } else if (p_buf != NULL) {
   1495 #if (L2CAP_NUM_FIXED_CHNLS > 0)
   1496     if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
   1497         (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL &&
   1498          p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL)) {
   1499       if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL]
   1500               .pL2CA_FixedData_Cb)
   1501         (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL]
   1502               .pL2CA_FixedData_Cb)(p_ccb->local_cid,
   1503                                    p_ccb->p_lcb->remote_bd_addr, p_buf);
   1504     } else
   1505 #endif
   1506       l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DATA, p_buf);
   1507   }
   1508 
   1509   return (packet_ok);
   1510 }
   1511 
   1512 /*******************************************************************************
   1513  *
   1514  * Function         retransmit_i_frames
   1515  *
   1516  * Description      This function retransmits i-frames awaiting acks.
   1517  *
   1518  * Returns          bool    - true if retransmitted
   1519  *
   1520  ******************************************************************************/
   1521 static bool retransmit_i_frames(tL2C_CCB* p_ccb, uint8_t tx_seq) {
   1522   CHECK(p_ccb != NULL);
   1523 
   1524   BT_HDR* p_buf = NULL;
   1525   uint8_t* p;
   1526   uint8_t buf_seq;
   1527   uint16_t ctrl_word;
   1528 
   1529   if ((!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q)) &&
   1530       (p_ccb->peer_cfg.fcr.max_transmit != 0) &&
   1531       (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit)) {
   1532     L2CAP_TRACE_EVENT(
   1533         "Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: "
   1534         "%u) ack_q_count: %u",
   1535         p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries,
   1536         p_ccb->peer_cfg.fcr.max_transmit,
   1537         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
   1538 
   1539     l2cu_disconnect_chnl(p_ccb);
   1540     return (false);
   1541   }
   1542 
   1543   /* tx_seq indicates whether to retransmit a specific sequence or all (if ==
   1544    * L2C_FCR_RETX_ALL_PKTS) */
   1545   list_t* list_ack = NULL;
   1546   const list_node_t* node_ack = NULL;
   1547   if (!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q)) {
   1548     list_ack = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
   1549     node_ack = list_begin(list_ack);
   1550   }
   1551   if (tx_seq != L2C_FCR_RETX_ALL_PKTS) {
   1552     /* If sending only one, the sequence number tells us which one. Look for it.
   1553     */
   1554     if (list_ack != NULL) {
   1555       for (; node_ack != list_end(list_ack); node_ack = list_next(node_ack)) {
   1556         p_buf = (BT_HDR*)list_node(node_ack);
   1557         /* Get the old control word */
   1558         p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
   1559 
   1560         STREAM_TO_UINT16(ctrl_word, p);
   1561 
   1562         buf_seq =
   1563             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
   1564 
   1565         L2CAP_TRACE_DEBUG(
   1566             "retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq,
   1567             tx_seq);
   1568 
   1569         if (tx_seq == buf_seq) break;
   1570       }
   1571     }
   1572 
   1573     if (!p_buf) {
   1574       L2CAP_TRACE_ERROR("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u",
   1575                         tx_seq,
   1576                         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
   1577       return (true);
   1578     }
   1579   } else {
   1580     // Iterate though list and flush the amount requested from
   1581     // the transmit data queue that satisfy the layer and event conditions.
   1582     for (list_node_t* node_tmp = list_begin(p_ccb->p_lcb->link_xmit_data_q);
   1583          node_tmp != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
   1584       BT_HDR* p_tmp = (BT_HDR*)list_node(node_tmp);
   1585       node_tmp = list_next(node_tmp);
   1586 
   1587       /* Do not flush other CIDs or partial segments */
   1588       if ((p_tmp->layer_specific == 0) && (p_tmp->event == p_ccb->local_cid)) {
   1589         list_remove(p_ccb->p_lcb->link_xmit_data_q, p_tmp);
   1590         osi_free(p_tmp);
   1591       }
   1592     }
   1593 
   1594     /* Also flush our retransmission queue */
   1595     while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q))
   1596       osi_free(fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q));
   1597 
   1598     if (list_ack != NULL) node_ack = list_begin(list_ack);
   1599   }
   1600 
   1601   if (list_ack != NULL) {
   1602     while (node_ack != list_end(list_ack)) {
   1603       p_buf = (BT_HDR*)list_node(node_ack);
   1604       node_ack = list_next(node_ack);
   1605 
   1606       BT_HDR* p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
   1607       if (p_buf2) {
   1608         p_buf2->layer_specific = p_buf->layer_specific;
   1609 
   1610         fixed_queue_enqueue(p_ccb->fcrb.retrans_q, p_buf2);
   1611       }
   1612 
   1613       if ((tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL)) break;
   1614     }
   1615   }
   1616 
   1617   l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, NULL);
   1618 
   1619   if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q)) {
   1620     p_ccb->fcrb.num_tries++;
   1621     l2c_fcr_start_timer(p_ccb);
   1622   }
   1623 
   1624   return (true);
   1625 }
   1626 
   1627 /*******************************************************************************
   1628  *
   1629  * Function         l2c_fcr_get_next_xmit_sdu_seg
   1630  *
   1631  * Description      Get the next SDU segment to transmit.
   1632  *
   1633  * Returns          pointer to buffer with segment or NULL
   1634  *
   1635  ******************************************************************************/
   1636 BT_HDR* l2c_fcr_get_next_xmit_sdu_seg(tL2C_CCB* p_ccb,
   1637                                       uint16_t max_packet_length) {
   1638   CHECK(p_ccb != NULL);
   1639 
   1640   bool first_seg = false, /* The segment is the first part of data  */
   1641       mid_seg = false,    /* The segment is the middle part of data */
   1642       last_seg = false;   /* The segment is the last part of data   */
   1643   uint16_t sdu_len = 0;
   1644   BT_HDR *p_buf, *p_xmit;
   1645   uint8_t* p;
   1646   uint16_t max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
   1647 
   1648   /* If there is anything in the retransmit queue, that goes first
   1649   */
   1650   p_buf = (BT_HDR*)fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q);
   1651   if (p_buf != NULL) {
   1652     /* Update Rx Seq and FCS if we acked some packets while this one was queued
   1653      */
   1654     prepare_I_frame(p_ccb, p_buf, true);
   1655 
   1656     p_buf->event = p_ccb->local_cid;
   1657 
   1658 #if (L2CAP_ERTM_STATS == TRUE)
   1659     p_ccb->fcrb.pkts_retransmitted++;
   1660     p_ccb->fcrb.ertm_pkt_counts[0]++;
   1661     p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
   1662 #endif
   1663     return (p_buf);
   1664   }
   1665 
   1666   /* For BD/EDR controller, max_packet_length is set to 0             */
   1667   /* For AMP controller, max_packet_length is set by available blocks */
   1668   if ((max_packet_length > L2CAP_MAX_HEADER_FCS) &&
   1669       (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length)) {
   1670     max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
   1671   }
   1672 
   1673   p_buf = (BT_HDR*)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
   1674 
   1675   /* If there is more data than the MPS, it requires segmentation */
   1676   if (p_buf->len > max_pdu) {
   1677     /* We are using the "event" field to tell is if we already started
   1678      * segmentation */
   1679     if (p_buf->event == 0) {
   1680       first_seg = true;
   1681       sdu_len = p_buf->len;
   1682     } else
   1683       mid_seg = true;
   1684 
   1685     /* Get a new buffer and copy the data that can be sent in a PDU */
   1686     p_xmit = l2c_fcr_clone_buf(p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
   1687                                max_pdu);
   1688 
   1689     if (p_xmit != NULL) {
   1690       p_buf->event = p_ccb->local_cid;
   1691       p_xmit->event = p_ccb->local_cid;
   1692 
   1693       p_buf->len -= max_pdu;
   1694       p_buf->offset += max_pdu;
   1695 
   1696       /* copy PBF setting */
   1697       p_xmit->layer_specific = p_buf->layer_specific;
   1698     } else /* Should never happen if the application has configured buffers
   1699               correctly */
   1700     {
   1701       L2CAP_TRACE_ERROR(
   1702           "L2CAP - cannot get buffer for segmentation, max_pdu: %u", max_pdu);
   1703       return (NULL);
   1704     }
   1705   } else /* Use the original buffer if no segmentation, or the last segment */
   1706   {
   1707     p_xmit = (BT_HDR*)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
   1708 
   1709     if (p_xmit->event != 0) last_seg = true;
   1710 
   1711     p_xmit->event = p_ccb->local_cid;
   1712   }
   1713 
   1714   /* Step back to add the L2CAP headers */
   1715   p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
   1716   p_xmit->len += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
   1717 
   1718   if (first_seg) {
   1719     p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
   1720     p_xmit->len += L2CAP_SDU_LEN_OVERHEAD;
   1721   }
   1722 
   1723   /* Set the pointer to the beginning of the data */
   1724   p = (uint8_t*)(p_xmit + 1) + p_xmit->offset;
   1725 
   1726   /* Now the L2CAP header */
   1727 
   1728   /* Note: if FCS has to be included then the length is recalculated later */
   1729   UINT16_TO_STREAM(p, p_xmit->len - L2CAP_PKT_OVERHEAD);
   1730 
   1731   UINT16_TO_STREAM(p, p_ccb->remote_cid);
   1732 
   1733   if (first_seg) {
   1734     /* Skip control word and add SDU length */
   1735     p += 2;
   1736     UINT16_TO_STREAM(p, sdu_len);
   1737 
   1738     /* We will store the SAR type in layer-specific */
   1739     /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
   1740     p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
   1741 
   1742     first_seg = false;
   1743   } else if (mid_seg)
   1744     p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
   1745   else if (last_seg)
   1746     p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
   1747   else
   1748     p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
   1749 
   1750   prepare_I_frame(p_ccb, p_xmit, false);
   1751 
   1752   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
   1753     BT_HDR* p_wack =
   1754         l2c_fcr_clone_buf(p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len);
   1755 
   1756     if (!p_wack) {
   1757       L2CAP_TRACE_ERROR(
   1758           "L2CAP - no buffer for xmit cloning, CID: 0x%04x  Length: %u",
   1759           p_ccb->local_cid, p_xmit->len);
   1760 
   1761       /* We will not save the FCS in case we reconfigure and change options */
   1762       if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) p_xmit->len -= L2CAP_FCS_LEN;
   1763 
   1764       /* Pretend we sent it and it got lost */
   1765       fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_xmit);
   1766       return (NULL);
   1767     } else {
   1768 #if (L2CAP_ERTM_STATS == TRUE)
   1769       /* set timestamp at the end of tx I-frame to get acking delay */
   1770       /*
   1771        * NOTE: Here we assume the allocate buffer is large enough
   1772        * to include extra 4 octets at the end.
   1773        */
   1774       p = ((uint8_t*)(p_wack + 1)) + p_wack->offset + p_wack->len;
   1775       UINT32_TO_STREAM(p, time_get_os_boottime_ms());
   1776 #endif
   1777       /* We will not save the FCS in case we reconfigure and change options */
   1778       if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) p_wack->len -= L2CAP_FCS_LEN;
   1779 
   1780       p_wack->layer_specific = p_xmit->layer_specific;
   1781       fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_wack);
   1782     }
   1783 
   1784 #if (L2CAP_ERTM_STATS == TRUE)
   1785     p_ccb->fcrb.ertm_pkt_counts[0]++;
   1786     p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
   1787 #endif
   1788   }
   1789 
   1790   return (p_xmit);
   1791 }
   1792 
   1793 /*******************************************************************************
   1794  *
   1795  * Function         l2c_lcc_get_next_xmit_sdu_seg
   1796  *
   1797  * Description      Get the next SDU segment to transmit for LE connection
   1798  *                  oriented channel
   1799  *
   1800  * Returns          pointer to buffer with segment or NULL
   1801  *
   1802  ******************************************************************************/
   1803 BT_HDR* l2c_lcc_get_next_xmit_sdu_seg(tL2C_CCB* p_ccb,
   1804                                       uint16_t max_packet_length) {
   1805   bool first_seg = false; /* The segment is the first part of data  */
   1806   bool last_seg = false;  /* The segment is the last part of data  */
   1807   uint16_t no_of_bytes_to_send = 0;
   1808   uint16_t sdu_len = 0;
   1809   BT_HDR *p_buf, *p_xmit;
   1810   uint8_t* p;
   1811   uint16_t max_pdu = p_ccb->peer_conn_cfg.mps;
   1812 
   1813   p_buf = (BT_HDR*)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
   1814 
   1815   /* We are using the "event" field to tell is if we already started
   1816    * segmentation */
   1817   if (p_buf->event == 0) {
   1818     first_seg = true;
   1819     sdu_len = p_buf->len;
   1820     if (p_buf->len <= (max_pdu - L2CAP_LCC_SDU_LENGTH)) {
   1821       last_seg = true;
   1822       no_of_bytes_to_send = p_buf->len;
   1823     } else
   1824       no_of_bytes_to_send = max_pdu - L2CAP_LCC_SDU_LENGTH;
   1825   } else if (p_buf->len <= max_pdu) {
   1826     last_seg = true;
   1827     no_of_bytes_to_send = p_buf->len;
   1828   } else {
   1829     /* Middle Packet */
   1830     no_of_bytes_to_send = max_pdu;
   1831   }
   1832 
   1833   /* Get a new buffer and copy the data that can be sent in a PDU */
   1834   if (first_seg == true)
   1835     p_xmit = l2c_fcr_clone_buf(p_buf, L2CAP_LCC_OFFSET, no_of_bytes_to_send);
   1836   else
   1837     p_xmit = l2c_fcr_clone_buf(p_buf, L2CAP_MIN_OFFSET, no_of_bytes_to_send);
   1838 
   1839   if (p_xmit != NULL) {
   1840     p_buf->event = p_ccb->local_cid;
   1841     p_xmit->event = p_ccb->local_cid;
   1842 
   1843     if (first_seg == true) {
   1844       p_xmit->offset -= L2CAP_LCC_SDU_LENGTH; /* for writing the SDU length. */
   1845       p = (uint8_t*)(p_xmit + 1) + p_xmit->offset;
   1846       UINT16_TO_STREAM(p, sdu_len);
   1847       p_xmit->len += L2CAP_LCC_SDU_LENGTH;
   1848     }
   1849 
   1850     p_buf->len -= no_of_bytes_to_send;
   1851     p_buf->offset += no_of_bytes_to_send;
   1852 
   1853     /* copy PBF setting */
   1854     p_xmit->layer_specific = p_buf->layer_specific;
   1855 
   1856   } else /* Should never happen if the application has configured buffers
   1857             correctly */
   1858   {
   1859     L2CAP_TRACE_ERROR("L2CAP - cannot get buffer, for segmentation");
   1860     return (NULL);
   1861   }
   1862 
   1863   if (last_seg == true) {
   1864     p_buf = (BT_HDR*)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
   1865     osi_free(p_buf);
   1866   }
   1867 
   1868   /* Step back to add the L2CAP headers */
   1869   p_xmit->offset -= L2CAP_PKT_OVERHEAD;
   1870   p_xmit->len += L2CAP_PKT_OVERHEAD;
   1871 
   1872   /* Set the pointer to the beginning of the data */
   1873   p = (uint8_t*)(p_xmit + 1) + p_xmit->offset;
   1874 
   1875   /* Note: if FCS has to be included then the length is recalculated later */
   1876   UINT16_TO_STREAM(p, p_xmit->len - L2CAP_PKT_OVERHEAD);
   1877   UINT16_TO_STREAM(p, p_ccb->remote_cid);
   1878   return (p_xmit);
   1879 }
   1880 
   1881 /*******************************************************************************
   1882  * Configuration negotiation functions
   1883  *
   1884  * The following functions are used in negotiating channel modes during
   1885  * configuration
   1886  ******************************************************************************/
   1887 
   1888 /*******************************************************************************
   1889  *
   1890  * Function         l2c_fcr_chk_chan_modes
   1891  *
   1892  * Description      Validates and adjusts if necessary, the FCR options
   1893  *                  based on remote EXT features.
   1894  *
   1895  *                  Note: This assumes peer EXT Features have been received.
   1896  *                      Basic mode is used if FCR Options have not been received
   1897  *
   1898  * Returns          uint8_t - nonzero if can continue, '0' if no compatible
   1899  *                            channels
   1900  *
   1901  ******************************************************************************/
   1902 uint8_t l2c_fcr_chk_chan_modes(tL2C_CCB* p_ccb) {
   1903   CHECK(p_ccb != NULL);
   1904 
   1905   /* Remove nonbasic options that the peer does not support */
   1906   if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
   1907     p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
   1908 
   1909   if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
   1910     p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
   1911 
   1912   /* At least one type needs to be set (Basic, ERTM, STM) to continue */
   1913   if (!p_ccb->ertm_info.allowed_modes) {
   1914     L2CAP_TRACE_WARNING(
   1915         "L2CAP - Peer does not support our desired channel types");
   1916   }
   1917 
   1918   return (p_ccb->ertm_info.allowed_modes);
   1919 }
   1920 
   1921 /*******************************************************************************
   1922  *
   1923  * Function         l2c_fcr_adj_our_req_options
   1924  *
   1925  * Description      Validates and sets up the FCR options passed in from
   1926  *                  L2CA_ConfigReq based on remote device's features.
   1927  *
   1928  * Returns          true if no errors, Otherwise false
   1929  *
   1930  ******************************************************************************/
   1931 bool l2c_fcr_adj_our_req_options(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
   1932   CHECK(p_ccb != NULL);
   1933   CHECK(p_cfg != NULL);
   1934 
   1935   tL2CAP_FCR_OPTS* p_fcr = &p_cfg->fcr;
   1936 
   1937   if (p_fcr->mode != p_ccb->ertm_info.preferred_mode) {
   1938     L2CAP_TRACE_WARNING(
   1939         "l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match "
   1940         "mode (%d)",
   1941         p_ccb->ertm_info.preferred_mode, p_fcr->mode);
   1942 
   1943     /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override
   1944      * this one */
   1945     p_fcr->mode = p_ccb->ertm_info.preferred_mode;
   1946   }
   1947 
   1948   /* If upper layer did not request eRTM mode, BASIC must be used */
   1949   if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC) {
   1950     if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE) {
   1951       L2CAP_TRACE_WARNING(
   1952           "l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set "
   1953           "using BASIC mode",
   1954           p_fcr->mode);
   1955     }
   1956     p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   1957   }
   1958 
   1959   /* Process the FCR options if initial channel bring-up (not a reconfig
   1960   *request)
   1961   ** Determine initial channel mode to try based on our options and remote's
   1962   *features
   1963   */
   1964   if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG)) {
   1965     /* We need to have at least one mode type common with the peer */
   1966     if (!l2c_fcr_chk_chan_modes(p_ccb)) {
   1967       /* Two channels have incompatible supported types */
   1968       l2cu_disconnect_chnl(p_ccb);
   1969       return (false);
   1970     }
   1971 
   1972     /* Basic is the only common channel mode between the two devices */
   1973     else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC) {
   1974       /* We only want to try Basic, so bypass sending the FCR options entirely
   1975        */
   1976       p_cfg->fcr_present = false;
   1977       p_cfg->fcs_present = false; /* Illegal to use FCS option in basic mode */
   1978       p_cfg->ext_flow_spec_present =
   1979           false; /* Illegal to use extended flow spec in basic mode */
   1980     }
   1981 
   1982     /* We have at least one non-basic mode available
   1983      * Override mode from available mode options based on preference, if needed
   1984      */
   1985     else {
   1986       /* If peer does not support STREAMING, try ERTM */
   1987       if (p_fcr->mode == L2CAP_FCR_STREAM_MODE &&
   1988           !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM)) {
   1989         L2CAP_TRACE_DEBUG(
   1990             "L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
   1991         p_fcr->mode = L2CAP_FCR_ERTM_MODE;
   1992       }
   1993 
   1994       /* If peer does not support ERTM, try BASIC (will support this if made it
   1995        * here in the code) */
   1996       if (p_fcr->mode == L2CAP_FCR_ERTM_MODE &&
   1997           !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
   1998         L2CAP_TRACE_DEBUG(
   1999             "L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
   2000         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
   2001       }
   2002     }
   2003 
   2004     if (p_fcr->mode != L2CAP_FCR_BASIC_MODE) {
   2005       /* MTU must be smaller than buffer size */
   2006       if ((p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu)) {
   2007         L2CAP_TRACE_WARNING("L2CAP - MTU: %u  larger than buf size: %u",
   2008                             p_cfg->mtu, p_ccb->max_rx_mtu);
   2009         return (false);
   2010       }
   2011 
   2012       /* application want to use the default MPS */
   2013       if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS) {
   2014         p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
   2015       }
   2016       /* MPS must be less than MTU */
   2017       else if (p_fcr->mps > p_ccb->max_rx_mtu) {
   2018         L2CAP_TRACE_WARNING("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps,
   2019                             p_ccb->max_rx_mtu);
   2020         return (false);
   2021       }
   2022 
   2023       /* We always initially read into the HCI buffer pool, so make sure it fits
   2024        */
   2025       if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
   2026         p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
   2027     } else {
   2028       p_cfg->fcs_present = false; /* Illegal to use FCS option in basic mode */
   2029       p_cfg->ext_flow_spec_present =
   2030           false; /* Illegal to use extended flow spec in basic mode */
   2031     }
   2032 
   2033     p_ccb->our_cfg.fcr = *p_fcr;
   2034   } else /* Not sure how to send a reconfiguration(??) should fcr be included?
   2035             */
   2036   {
   2037     p_ccb->our_cfg.fcr_present = false;
   2038   }
   2039 
   2040   return (true);
   2041 }
   2042 
   2043 /*******************************************************************************
   2044  *
   2045  * Function         l2c_fcr_adj_monitor_retran_timeout
   2046  *
   2047  * Description      Overrides monitor/retrans timer value based on controller
   2048  *
   2049  * Returns          None
   2050  *
   2051  ******************************************************************************/
   2052 void l2c_fcr_adj_monitor_retran_timeout(tL2C_CCB* p_ccb) {
   2053   CHECK(p_ccb != NULL);
   2054 
   2055   /* adjust our monitor/retran timeout */
   2056   if (p_ccb->out_cfg_fcr_present) {
   2057     /*
   2058     ** if we requestd ERTM or accepted ERTM
   2059     ** We may accept ERTM even if we didn't request ERTM, in case of requesting
   2060     *STREAM
   2061     */
   2062     if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) ||
   2063         (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)) {
   2064       /* upper layer setting is ignored */
   2065       p_ccb->our_cfg.fcr.mon_tout = L2CAP_MIN_MONITOR_TOUT;
   2066       p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
   2067     } else {
   2068       p_ccb->our_cfg.fcr.mon_tout = 0;
   2069       p_ccb->our_cfg.fcr.rtrans_tout = 0;
   2070     }
   2071 
   2072     L2CAP_TRACE_DEBUG(
   2073         "l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
   2074         p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
   2075   }
   2076 }
   2077 /*******************************************************************************
   2078  *
   2079  * Function         l2c_fcr_adj_our_rsp_options
   2080  *
   2081  * Description      Overrides any neccesary FCR options passed in from
   2082  *                  L2CA_ConfigRsp based on our FCR options.
   2083  *                  Only makes adjustments if channel is in ERTM mode.
   2084  *
   2085  * Returns          None
   2086  *
   2087  ******************************************************************************/
   2088 void l2c_fcr_adj_our_rsp_options(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
   2089   CHECK(p_ccb != NULL);
   2090   CHECK(p_cfg != NULL);
   2091 
   2092   /* adjust our monitor/retran timeout */
   2093   l2c_fcr_adj_monitor_retran_timeout(p_ccb);
   2094 
   2095   p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
   2096 
   2097   if (p_cfg->fcr_present) {
   2098     /* Temporary - until a better algorithm is implemented */
   2099     /* If peer's tx_wnd_sz requires too many buffers for us to support, then
   2100      * adjust it. For now, respond with our own tx_wnd_sz. */
   2101     /* Note: peer is not guaranteed to obey our adjustment */
   2102     if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz) {
   2103       L2CAP_TRACE_DEBUG("%s: adjusting requested tx_win_sz from %i to %i",
   2104                         __func__, p_ccb->peer_cfg.fcr.tx_win_sz,
   2105                         p_ccb->our_cfg.fcr.tx_win_sz);
   2106       p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2107     }
   2108 
   2109     p_cfg->fcr.mode = p_ccb->peer_cfg.fcr.mode;
   2110     p_cfg->fcr.tx_win_sz = p_ccb->peer_cfg.fcr.tx_win_sz;
   2111     p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
   2112     p_cfg->fcr.mps = p_ccb->peer_cfg.fcr.mps;
   2113     p_cfg->fcr.rtrans_tout = p_ccb->our_cfg.fcr.rtrans_tout;
   2114     p_cfg->fcr.mon_tout = p_ccb->our_cfg.fcr.mon_tout;
   2115   }
   2116 }
   2117 
   2118 /*******************************************************************************
   2119  *
   2120  * Function         l2c_fcr_renegotiate_chan
   2121  *
   2122  * Description      Called upon unsuccessful peer response to config request.
   2123  *                  If the error is because of the channel mode, it will try
   2124  *                  to resend using another supported optional channel.
   2125  *
   2126  * Returns          true if resent configuration, False if channel matches or
   2127  *                  cannot match.
   2128  *
   2129  ******************************************************************************/
   2130 bool l2c_fcr_renegotiate_chan(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
   2131   CHECK(p_ccb != NULL);
   2132   CHECK(p_cfg != NULL);
   2133 
   2134   uint8_t peer_mode = p_ccb->our_cfg.fcr.mode;
   2135   bool can_renegotiate;
   2136 
   2137   /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned
   2138    */
   2139   if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
   2140     return (false);
   2141 
   2142   /* Only retry if there are more channel options to try */
   2143   if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS) {
   2144     peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
   2145 
   2146     if (p_ccb->our_cfg.fcr.mode != peer_mode) {
   2147       if ((--p_ccb->fcr_cfg_tries) == 0) {
   2148         p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
   2149         L2CAP_TRACE_WARNING("l2c_fcr_renegotiate_chan (Max retries exceeded)");
   2150       }
   2151 
   2152       can_renegotiate = false;
   2153 
   2154       /* Try another supported mode if available based on our last attempted
   2155        * channel */
   2156       switch (p_ccb->our_cfg.fcr.mode) {
   2157         /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
   2158         case L2CAP_FCR_STREAM_MODE:
   2159           /* Peer wants ERTM and we support it */
   2160           if ((peer_mode == L2CAP_FCR_ERTM_MODE) &&
   2161               (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
   2162             L2CAP_TRACE_DEBUG("l2c_fcr_renegotiate_chan(Trying ERTM)");
   2163             p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
   2164             can_renegotiate = true;
   2165           } else /* Falls through */
   2166 
   2167           case L2CAP_FCR_ERTM_MODE: {
   2168             /* We can try basic for any other peer mode if we support it */
   2169             if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) {
   2170               L2CAP_TRACE_DEBUG("l2c_fcr_renegotiate_chan(Trying Basic)");
   2171               can_renegotiate = true;
   2172               p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
   2173             }
   2174           } break;
   2175 
   2176           default:
   2177             /* All other scenarios cannot be renegotiated */
   2178             break;
   2179       }
   2180 
   2181       if (can_renegotiate) {
   2182         p_ccb->our_cfg.fcr_present = true;
   2183 
   2184         if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE) {
   2185           p_ccb->our_cfg.fcs_present = false;
   2186           p_ccb->our_cfg.ext_flow_spec_present = false;
   2187 
   2188           /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
   2189           if ((p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE)) {
   2190             L2CAP_TRACE_WARNING("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
   2191             p_cfg->mtu = L2CAP_MTU_SIZE;
   2192           }
   2193         }
   2194 
   2195         l2cu_process_our_cfg_req(p_ccb, &p_ccb->our_cfg);
   2196         l2cu_send_peer_config_req(p_ccb, &p_ccb->our_cfg);
   2197         alarm_set_on_mloop(p_ccb->l2c_ccb_timer, L2CAP_CHNL_CFG_TIMEOUT_MS,
   2198                            l2c_ccb_timer_timeout, p_ccb);
   2199         return (true);
   2200       }
   2201     }
   2202   }
   2203 
   2204   /* Disconnect if the channels do not match */
   2205   if (p_ccb->our_cfg.fcr.mode != peer_mode) {
   2206     L2CAP_TRACE_WARNING("L2C CFG:  Channels incompatible (local %d, peer %d)",
   2207                         p_ccb->our_cfg.fcr.mode, peer_mode);
   2208     l2cu_disconnect_chnl(p_ccb);
   2209   }
   2210 
   2211   return (false);
   2212 }
   2213 
   2214 /*******************************************************************************
   2215  *
   2216  * Function         l2c_fcr_process_peer_cfg_req
   2217  *
   2218  * Description      This function is called to process the FCR options passed
   2219  *                  in the peer's configuration request.
   2220  *
   2221  * Returns          uint8_t - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
   2222  *                          or L2CAP_PEER_CFG_DISCONNECT.
   2223  *
   2224  ******************************************************************************/
   2225 uint8_t l2c_fcr_process_peer_cfg_req(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
   2226   CHECK(p_ccb != NULL);
   2227   CHECK(p_cfg != NULL);
   2228 
   2229   uint16_t max_retrans_size;
   2230   uint8_t fcr_ok = L2CAP_PEER_CFG_OK;
   2231 
   2232   p_ccb->p_lcb->w4_info_rsp =
   2233       false; /* Handles T61x SonyEricsson Bug in Info Request */
   2234 
   2235   L2CAP_TRACE_EVENT(
   2236       "l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR "
   2237       "mode:%d preferred: %u allowed:%u",
   2238       p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode,
   2239       p_ccb->ertm_info.preferred_mode, p_ccb->ertm_info.allowed_modes);
   2240 
   2241   /* If Peer wants basic, we are done (accept it or disconnect) */
   2242   if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE) {
   2243     /* If we do not allow basic, disconnect */
   2244     if (!(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC))
   2245       fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2246   }
   2247 
   2248   /* Need to negotiate if our modes are not the same */
   2249   else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode) {
   2250     /* If peer wants a mode that we don't support then retry our mode (ex.
   2251     *rtx/flc), OR
   2252     ** If we want ERTM and they wanted streaming retry our mode.
   2253     ** Note: If we have already determined they support our mode previously
   2254     **       from their EXF mask.
   2255     */
   2256     if ((((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0) ||
   2257         (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE)) {
   2258       p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
   2259       p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
   2260       p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
   2261       fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2262     }
   2263 
   2264     /* If we wanted basic, then try to renegotiate it */
   2265     else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE) {
   2266       p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
   2267       p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
   2268       p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
   2269       p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout =
   2270           p_ccb->our_cfg.fcr.mps = 0;
   2271       fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
   2272     }
   2273 
   2274     /* Only other valid case is if they want ERTM and we wanted STM which should
   2275        be
   2276        accepted if we support it; otherwise the channel should be disconnected
   2277        */
   2278     else if ((p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE) ||
   2279              !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
   2280       fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2281     }
   2282   }
   2283 
   2284   /* Configuration for FCR channels so make any adjustments and fwd to upper
   2285    * layer */
   2286   if (fcr_ok == L2CAP_PEER_CFG_OK) {
   2287     /* by default don't need to send params in the response */
   2288     p_ccb->out_cfg_fcr_present = false;
   2289 
   2290     /* Make any needed adjustments for the response to the peer */
   2291     if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE) {
   2292       /* Peer desires to bypass FCS check, and streaming or ERTM mode */
   2293       if (p_cfg->fcs_present) {
   2294         p_ccb->peer_cfg.fcs = p_cfg->fcs;
   2295         p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
   2296         if (p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
   2297           p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
   2298       }
   2299 
   2300       max_retrans_size = p_ccb->ertm_info.fcr_tx_buf_size - sizeof(BT_HDR) -
   2301                          L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET -
   2302                          L2CAP_FCS_LEN;
   2303 
   2304       /* Ensure the MPS is not bigger than the MTU */
   2305       if ((p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu)) {
   2306         p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
   2307         p_ccb->out_cfg_fcr_present = true;
   2308       }
   2309 
   2310       /* Ensure the MPS is not bigger than our retransmission buffer */
   2311       if (p_cfg->fcr.mps > max_retrans_size) {
   2312         L2CAP_TRACE_DEBUG("CFG: Overriding MPS to %d (orig %d)",
   2313                           max_retrans_size, p_cfg->fcr.mps);
   2314 
   2315         p_cfg->fcr.mps = max_retrans_size;
   2316         p_ccb->out_cfg_fcr_present = true;
   2317       }
   2318 
   2319       if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE ||
   2320           p_cfg->fcr.mode == L2CAP_FCR_STREAM_MODE) {
   2321         /* Always respond with FCR ERTM parameters */
   2322         p_ccb->out_cfg_fcr_present = true;
   2323       }
   2324     }
   2325 
   2326     /* Everything ok, so save the peer's adjusted fcr options */
   2327     p_ccb->peer_cfg.fcr = p_cfg->fcr;
   2328 
   2329     if (p_cfg->fcr_present) p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
   2330   } else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE) {
   2331     /* Allow peer only one retry for mode */
   2332     if (p_ccb->peer_cfg_already_rejected)
   2333       fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
   2334     else
   2335       p_ccb->peer_cfg_already_rejected = true;
   2336   }
   2337 
   2338   return (fcr_ok);
   2339 }
   2340 
   2341 #if (L2CAP_ERTM_STATS == TRUE)
   2342 /*******************************************************************************
   2343  *
   2344  * Function         l2c_fcr_collect_ack_delay
   2345  *
   2346  * Description      collect throughput, delay, queue size of waiting ack
   2347  *
   2348  * Parameters
   2349  *                  tL2C_CCB
   2350  *
   2351  * Returns          void
   2352  *
   2353  ******************************************************************************/
   2354 static void l2c_fcr_collect_ack_delay(tL2C_CCB* p_ccb, uint8_t num_bufs_acked) {
   2355   uint32_t index;
   2356   BT_HDR* p_buf;
   2357   uint8_t* p;
   2358   uint32_t timestamp, delay;
   2359   uint8_t xx;
   2360   uint8_t str[120];
   2361 
   2362   index = p_ccb->fcrb.ack_delay_avg_index;
   2363 
   2364   /* update sum, max and min of waiting for ack queue size */
   2365   p_ccb->fcrb.ack_q_count_avg[index] +=
   2366       fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
   2367 
   2368   if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) >
   2369       p_ccb->fcrb.ack_q_count_max[index])
   2370     p_ccb->fcrb.ack_q_count_max[index] =
   2371         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
   2372 
   2373   if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) <
   2374       p_ccb->fcrb.ack_q_count_min[index])
   2375     p_ccb->fcrb.ack_q_count_min[index] =
   2376         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
   2377 
   2378   /* update sum, max and min of round trip delay of acking */
   2379   list_t* list = NULL;
   2380   if (!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
   2381     list = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
   2382   if (list != NULL) {
   2383     for (const list_node_t *node = list_begin(list), xx = 0;
   2384          (node != list_end(list)) && (xx < num_bufs_acked);
   2385          node = list_next(node), xx++) {
   2386       p_buf = list_node(node);
   2387       /* adding up length of acked I-frames to get throughput */
   2388       p_ccb->fcrb.throughput[index] += p_buf->len - 8;
   2389 
   2390       if (xx == num_bufs_acked - 1) {
   2391         /* get timestamp from tx I-frame that receiver is acking */
   2392         p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len;
   2393         if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
   2394           p += L2CAP_FCS_LEN;
   2395         }
   2396 
   2397         STREAM_TO_UINT32(timestamp, p);
   2398         delay = time_get_os_boottime_ms() - timestamp;
   2399 
   2400         p_ccb->fcrb.ack_delay_avg[index] += delay;
   2401         if (delay > p_ccb->fcrb.ack_delay_max[index])
   2402           p_ccb->fcrb.ack_delay_max[index] = delay;
   2403         if (delay < p_ccb->fcrb.ack_delay_min[index])
   2404           p_ccb->fcrb.ack_delay_min[index] = delay;
   2405       }
   2406     }
   2407   }
   2408 
   2409   p_ccb->fcrb.ack_delay_avg_count++;
   2410 
   2411   /* calculate average and initialize next avg, min and max */
   2412   if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES) {
   2413     p_ccb->fcrb.ack_delay_avg_count = 0;
   2414 
   2415     p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2416     p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
   2417 
   2418     /* calculate throughput */
   2419     timestamp = time_get_os_boottime_ms();
   2420     if (timestamp - p_ccb->fcrb.throughput_start > 0)
   2421       p_ccb->fcrb.throughput[index] /=
   2422           (timestamp - p_ccb->fcrb.throughput_start);
   2423 
   2424     p_ccb->fcrb.throughput_start = timestamp;
   2425 
   2426     snprintf(
   2427         str, sizeof(str),
   2428         "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, "
   2429         "ack_q_count avg:%3u, min:%3u, max:%3u",
   2430         index, p_ccb->fcrb.throughput[index], p_ccb->fcrb.ack_delay_avg[index],
   2431         p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
   2432         p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index],
   2433         p_ccb->fcrb.ack_q_count_max[index]);
   2434 
   2435     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
   2436              TRACE_TYPE_GENERIC, "%s", str);
   2437 
   2438     index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
   2439     p_ccb->fcrb.ack_delay_avg_index = index;
   2440 
   2441     p_ccb->fcrb.ack_q_count_max[index] = 0;
   2442     p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
   2443     p_ccb->fcrb.ack_q_count_avg[index] = 0;
   2444 
   2445     p_ccb->fcrb.ack_delay_max[index] = 0;
   2446     p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
   2447     p_ccb->fcrb.ack_delay_avg[index] = 0;
   2448 
   2449     p_ccb->fcrb.throughput[index] = 0;
   2450   }
   2451 }
   2452 #endif
   2453