Home | History | Annotate | Download | only in l2cap
      1 /******************************************************************************
      2  *
      3  *  Copyright 1999-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  this file contains the functions relating to link management. A "link"
     22  *  is a connection between this device and another device. Only ACL links
     23  *  are managed.
     24  *
     25  ******************************************************************************/
     26 
     27 #include <base/logging.h>
     28 #include <stdio.h>
     29 #include <stdlib.h>
     30 #include <string.h>
     31 
     32 #include "bt_common.h"
     33 #include "bt_types.h"
     34 #include "bt_utils.h"
     35 #include "btm_api.h"
     36 #include "btm_int.h"
     37 #include "btu.h"
     38 #include "device/include/controller.h"
     39 #include "hcimsgs.h"
     40 #include "l2c_api.h"
     41 #include "l2c_int.h"
     42 #include "l2cdefs.h"
     43 #include "osi/include/osi.h"
     44 
     45 static bool l2c_link_send_to_lower(tL2C_LCB* p_lcb, BT_HDR* p_buf,
     46                                    tL2C_TX_COMPLETE_CB_INFO* p_cbi);
     47 
     48 /*******************************************************************************
     49  *
     50  * Function         l2c_link_hci_conn_req
     51  *
     52  * Description      This function is called when an HCI Connection Request
     53  *                  event is received.
     54  *
     55  * Returns          true, if accept conn
     56  *
     57  ******************************************************************************/
     58 bool l2c_link_hci_conn_req(const RawAddress& bd_addr) {
     59   tL2C_LCB* p_lcb;
     60   tL2C_LCB* p_lcb_cur;
     61   int xx;
     62   bool no_links;
     63 
     64   /* See if we have a link control block for the remote device */
     65   p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_BR_EDR);
     66 
     67   /* If we don't have one, create one and accept the connection. */
     68   if (!p_lcb) {
     69     p_lcb = l2cu_allocate_lcb(bd_addr, false, BT_TRANSPORT_BR_EDR);
     70     if (!p_lcb) {
     71       btsnd_hcic_reject_conn(bd_addr, HCI_ERR_HOST_REJECT_RESOURCES);
     72       L2CAP_TRACE_ERROR("L2CAP failed to allocate LCB");
     73       return false;
     74     }
     75 
     76     no_links = true;
     77 
     78     /* If we already have connection, accept as a master */
     79     for (xx = 0, p_lcb_cur = &l2cb.lcb_pool[0]; xx < MAX_L2CAP_LINKS;
     80          xx++, p_lcb_cur++) {
     81       if (p_lcb_cur == p_lcb) continue;
     82 
     83       if (p_lcb_cur->in_use) {
     84         no_links = false;
     85         p_lcb->link_role = HCI_ROLE_MASTER;
     86         break;
     87       }
     88     }
     89 
     90     if (no_links) {
     91       if (!btm_dev_support_switch(bd_addr))
     92         p_lcb->link_role = HCI_ROLE_SLAVE;
     93       else
     94         p_lcb->link_role = l2cu_get_conn_role(p_lcb);
     95     }
     96 
     97     /* Tell the other side we accept the connection */
     98     btsnd_hcic_accept_conn(bd_addr, p_lcb->link_role);
     99 
    100     p_lcb->link_state = LST_CONNECTING;
    101 
    102     /* Start a timer waiting for connect complete */
    103     alarm_set_on_mloop(p_lcb->l2c_lcb_timer, L2CAP_LINK_CONNECT_TIMEOUT_MS,
    104                        l2c_lcb_timer_timeout, p_lcb);
    105     return (true);
    106   }
    107 
    108   /* We already had a link control block to the guy. Check what state it is in
    109    */
    110   if ((p_lcb->link_state == LST_CONNECTING) ||
    111       (p_lcb->link_state == LST_CONNECT_HOLDING)) {
    112     /* Connection collision. Accept the connection anyways. */
    113 
    114     if (!btm_dev_support_switch(bd_addr))
    115       p_lcb->link_role = HCI_ROLE_SLAVE;
    116     else
    117       p_lcb->link_role = l2cu_get_conn_role(p_lcb);
    118 
    119     btsnd_hcic_accept_conn(bd_addr, p_lcb->link_role);
    120 
    121     p_lcb->link_state = LST_CONNECTING;
    122     return (true);
    123   } else if (p_lcb->link_state == LST_DISCONNECTING) {
    124     /* In disconnecting state, reject the connection. */
    125     btsnd_hcic_reject_conn(bd_addr, HCI_ERR_HOST_REJECT_DEVICE);
    126   } else {
    127     L2CAP_TRACE_ERROR(
    128         "L2CAP got conn_req while connected (state:%d). Reject it",
    129         p_lcb->link_state);
    130     /* Reject the connection with ACL Connection Already exist reason */
    131     btsnd_hcic_reject_conn(bd_addr, HCI_ERR_CONNECTION_EXISTS);
    132   }
    133   return (false);
    134 }
    135 
    136 /*******************************************************************************
    137  *
    138  * Function         l2c_link_hci_conn_comp
    139  *
    140  * Description      This function is called when an HCI Connection Complete
    141  *                  event is received.
    142  *
    143  * Returns          void
    144  *
    145  ******************************************************************************/
    146 bool l2c_link_hci_conn_comp(uint8_t status, uint16_t handle,
    147                             const RawAddress& p_bda) {
    148   tL2C_CONN_INFO ci;
    149   tL2C_LCB* p_lcb;
    150   tL2C_CCB* p_ccb;
    151   tBTM_SEC_DEV_REC* p_dev_info = NULL;
    152 
    153   btm_acl_update_busy_level(BTM_BLI_PAGE_DONE_EVT);
    154 
    155   /* Save the parameters */
    156   ci.status = status;
    157   ci.bd_addr = p_bda;
    158 
    159   /* See if we have a link control block for the remote device */
    160   p_lcb = l2cu_find_lcb_by_bd_addr(ci.bd_addr, BT_TRANSPORT_BR_EDR);
    161 
    162   /* If we don't have one, this is an error */
    163   if (!p_lcb) {
    164     L2CAP_TRACE_WARNING("L2CAP got conn_comp for unknown BD_ADDR");
    165     return (false);
    166   }
    167 
    168   if (p_lcb->link_state != LST_CONNECTING) {
    169     L2CAP_TRACE_ERROR("L2CAP got conn_comp in bad state: %d  status: 0x%d",
    170                       p_lcb->link_state, status);
    171 
    172     if (status != HCI_SUCCESS) l2c_link_hci_disc_comp(p_lcb->handle, status);
    173 
    174     return (false);
    175   }
    176 
    177   /* Save the handle */
    178   p_lcb->handle = handle;
    179 
    180   if (ci.status == HCI_SUCCESS) {
    181     /* Connected OK. Change state to connected */
    182     p_lcb->link_state = LST_CONNECTED;
    183 
    184     /* Get the peer information if the l2cap flow-control/rtrans is supported */
    185     l2cu_send_peer_info_req(p_lcb, L2CAP_EXTENDED_FEATURES_INFO_TYPE);
    186 
    187     /* Tell BTM Acl management about the link */
    188     p_dev_info = btm_find_dev(p_bda);
    189     if (p_dev_info != NULL)
    190       btm_acl_created(ci.bd_addr, p_dev_info->dev_class,
    191                       p_dev_info->sec_bd_name, handle, p_lcb->link_role,
    192                       BT_TRANSPORT_BR_EDR);
    193     else
    194       btm_acl_created(ci.bd_addr, NULL, NULL, handle, p_lcb->link_role,
    195                       BT_TRANSPORT_BR_EDR);
    196 
    197     BTM_SetLinkSuperTout(ci.bd_addr, btm_cb.btm_def_link_super_tout);
    198 
    199     /* If dedicated bonding do not process any further */
    200     if (p_lcb->is_bonding) {
    201       if (l2cu_start_post_bond_timer(handle)) return (true);
    202     }
    203 
    204     /* Update the timeouts in the hold queue */
    205     l2c_process_held_packets(false);
    206 
    207     alarm_cancel(p_lcb->l2c_lcb_timer);
    208 
    209     /* For all channels, send the event through their FSMs */
    210     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
    211          p_ccb = p_ccb->p_next_ccb) {
    212       l2c_csm_execute(p_ccb, L2CEVT_LP_CONNECT_CFM, &ci);
    213     }
    214 
    215     if (p_lcb->p_echo_rsp_cb) {
    216       l2cu_send_peer_echo_req(p_lcb, NULL, 0);
    217       alarm_set_on_mloop(p_lcb->l2c_lcb_timer, L2CAP_ECHO_RSP_TIMEOUT_MS,
    218                          l2c_lcb_timer_timeout, p_lcb);
    219     } else if (!p_lcb->ccb_queue.p_first_ccb) {
    220       period_ms_t timeout_ms = L2CAP_LINK_STARTUP_TOUT * 1000;
    221       alarm_set_on_mloop(p_lcb->l2c_lcb_timer, timeout_ms,
    222                          l2c_lcb_timer_timeout, p_lcb);
    223     }
    224   }
    225   /* Max number of acl connections.                          */
    226   /* If there's an lcb disconnecting set this one to holding */
    227   else if ((ci.status == HCI_ERR_MAX_NUM_OF_CONNECTIONS) &&
    228            l2cu_lcb_disconnecting()) {
    229     p_lcb->link_state = LST_CONNECT_HOLDING;
    230     p_lcb->handle = HCI_INVALID_HANDLE;
    231   } else {
    232     /* Just in case app decides to try again in the callback context */
    233     p_lcb->link_state = LST_DISCONNECTING;
    234 
    235     /* Connection failed. For all channels, send the event through */
    236     /* their FSMs. The CCBs should remove themselves from the LCB  */
    237     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;) {
    238       tL2C_CCB* pn = p_ccb->p_next_ccb;
    239 
    240       l2c_csm_execute(p_ccb, L2CEVT_LP_CONNECT_CFM_NEG, &ci);
    241 
    242       p_ccb = pn;
    243     }
    244 
    245     p_lcb->disc_reason = status;
    246     /* Release the LCB */
    247     if (p_lcb->ccb_queue.p_first_ccb == NULL)
    248       l2cu_release_lcb(p_lcb);
    249     else /* there are any CCBs remaining */
    250     {
    251       if (ci.status == HCI_ERR_CONNECTION_EXISTS) {
    252         /* we are in collision situation, wait for connecttion request from
    253          * controller */
    254         p_lcb->link_state = LST_CONNECTING;
    255       } else {
    256         l2cu_create_conn(p_lcb, BT_TRANSPORT_BR_EDR);
    257       }
    258     }
    259   }
    260   return (true);
    261 }
    262 
    263 /*******************************************************************************
    264  *
    265  * Function         l2c_link_sec_comp
    266  *
    267  * Description      This function is called when required security procedures
    268  *                  are completed.
    269  *
    270  * Returns          void
    271  *
    272  ******************************************************************************/
    273 void l2c_link_sec_comp(const RawAddress* p_bda,
    274                        UNUSED_ATTR tBT_TRANSPORT transport, void* p_ref_data,
    275                        uint8_t status) {
    276   l2c_link_sec_comp2(*p_bda, transport, p_ref_data, status);
    277 }
    278 
    279 void l2c_link_sec_comp2(const RawAddress& p_bda,
    280                         UNUSED_ATTR tBT_TRANSPORT transport, void* p_ref_data,
    281                         uint8_t status) {
    282   tL2C_CONN_INFO ci;
    283   tL2C_LCB* p_lcb;
    284   tL2C_CCB* p_ccb;
    285   tL2C_CCB* p_next_ccb;
    286   uint8_t event;
    287 
    288   L2CAP_TRACE_DEBUG("%s: status=%d, p_ref_data=%p, BD_ADDR=%s", __func__,
    289                     status, p_ref_data, p_bda.ToString().c_str());
    290 
    291   if (status == BTM_SUCCESS_NO_SECURITY) status = BTM_SUCCESS;
    292 
    293   /* Save the parameters */
    294   ci.status = status;
    295   ci.bd_addr = p_bda;
    296 
    297   p_lcb = l2cu_find_lcb_by_bd_addr(p_bda, transport);
    298 
    299   /* If we don't have one, this is an error */
    300   if (!p_lcb) {
    301     L2CAP_TRACE_WARNING("L2CAP got sec_comp for unknown BD_ADDR");
    302     return;
    303   }
    304 
    305   /* Match p_ccb with p_ref_data returned by sec manager */
    306   for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_next_ccb) {
    307     p_next_ccb = p_ccb->p_next_ccb;
    308 
    309     if (p_ccb == p_ref_data) {
    310       switch (status) {
    311         case BTM_SUCCESS:
    312           event = L2CEVT_SEC_COMP;
    313           break;
    314 
    315         case BTM_DELAY_CHECK:
    316           /* start a timer - encryption change not received before L2CAP connect
    317            * req */
    318           alarm_set_on_mloop(p_ccb->l2c_ccb_timer,
    319                              L2CAP_DELAY_CHECK_SM4_TIMEOUT_MS,
    320                              l2c_ccb_timer_timeout, p_ccb);
    321           return;
    322 
    323         default:
    324           event = L2CEVT_SEC_COMP_NEG;
    325       }
    326       l2c_csm_execute(p_ccb, event, &ci);
    327       break;
    328     }
    329   }
    330 }
    331 
    332 /*******************************************************************************
    333  *
    334  * Function         l2c_link_hci_disc_comp
    335  *
    336  * Description      This function is called when an HCI Disconnect Complete
    337  *                  event is received.
    338  *
    339  * Returns          true if the link is known about, else false
    340  *
    341  ******************************************************************************/
    342 bool l2c_link_hci_disc_comp(uint16_t handle, uint8_t reason) {
    343   tL2C_LCB* p_lcb;
    344   tL2C_CCB* p_ccb;
    345   bool status = true;
    346   bool lcb_is_free = true;
    347   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
    348 
    349   /* See if we have a link control block for the connection */
    350   p_lcb = l2cu_find_lcb_by_handle(handle);
    351 
    352   /* If we don't have one, maybe an SCO link. Send to MM */
    353   if (!p_lcb) {
    354     status = false;
    355   } else {
    356     /* There can be a case when we rejected PIN code authentication */
    357     /* otherwise save a new reason */
    358     if (btm_cb.acl_disc_reason != HCI_ERR_HOST_REJECT_SECURITY)
    359       btm_cb.acl_disc_reason = reason;
    360 
    361     p_lcb->disc_reason = btm_cb.acl_disc_reason;
    362 
    363     /* Just in case app decides to try again in the callback context */
    364     p_lcb->link_state = LST_DISCONNECTING;
    365 
    366     /* Check for BLE and handle that differently */
    367     if (p_lcb->transport == BT_TRANSPORT_LE)
    368       btm_ble_update_link_topology_mask(p_lcb->link_role, false);
    369     /* Link is disconnected. For all channels, send the event through */
    370     /* their FSMs. The CCBs should remove themselves from the LCB     */
    371     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;) {
    372       tL2C_CCB* pn = p_ccb->p_next_ccb;
    373 
    374       /* Keep connect pending control block (if exists)
    375        * Possible Race condition when a reconnect occurs
    376        * on the channel during a disconnect of link. This
    377        * ccb will be automatically retried after link disconnect
    378        * arrives
    379        */
    380       if (p_ccb != p_lcb->p_pending_ccb) {
    381         l2c_csm_execute(p_ccb, L2CEVT_LP_DISCONNECT_IND, &reason);
    382       }
    383       p_ccb = pn;
    384     }
    385 
    386 #if (BTM_SCO_INCLUDED == TRUE)
    387     if (p_lcb->transport == BT_TRANSPORT_BR_EDR)
    388       /* Tell SCO management to drop any SCOs on this ACL */
    389       btm_sco_acl_removed(&p_lcb->remote_bd_addr);
    390 #endif
    391 
    392     /* If waiting for disconnect and reconnect is pending start the reconnect
    393        now
    394        race condition where layer above issued connect request on link that was
    395        disconnecting
    396      */
    397     if (p_lcb->ccb_queue.p_first_ccb != NULL || p_lcb->p_pending_ccb) {
    398       L2CAP_TRACE_DEBUG(
    399           "l2c_link_hci_disc_comp: Restarting pending ACL request");
    400       /* Release any held buffers */
    401       while (!list_is_empty(p_lcb->link_xmit_data_q)) {
    402         BT_HDR* p_buf =
    403             static_cast<BT_HDR*>(list_front(p_lcb->link_xmit_data_q));
    404         list_remove(p_lcb->link_xmit_data_q, p_buf);
    405         osi_free(p_buf);
    406       }
    407       transport = p_lcb->transport;
    408       /* for LE link, always drop and re-open to ensure to get LE remote feature
    409        */
    410       if (p_lcb->transport == BT_TRANSPORT_LE) {
    411         l2cb.is_ble_connecting = false;
    412         btm_acl_removed(p_lcb->remote_bd_addr, p_lcb->transport);
    413       } else {
    414 #if (L2CAP_NUM_FIXED_CHNLS > 0)
    415         /* If we are going to re-use the LCB without dropping it, release all
    416         fixed channels
    417         here */
    418         int xx;
    419         for (xx = 0; xx < L2CAP_NUM_FIXED_CHNLS; xx++) {
    420           if (p_lcb->p_fixed_ccbs[xx] &&
    421               p_lcb->p_fixed_ccbs[xx] != p_lcb->p_pending_ccb) {
    422             (*l2cb.fixed_reg[xx].pL2CA_FixedConn_Cb)(
    423                 xx + L2CAP_FIRST_FIXED_CHNL, p_lcb->remote_bd_addr, false,
    424                 p_lcb->disc_reason, p_lcb->transport);
    425             if (p_lcb->p_fixed_ccbs[xx] == NULL) {
    426               L2CAP_TRACE_ERROR(
    427                   "%s: unexpected p_fixed_ccbs[%d] is NULL remote_bd_addr = %s "
    428                   "p_lcb = %p in_use = %d link_state = %d handle = %d "
    429                   "link_role = %d is_bonding = %d disc_reason = %d transport = "
    430                   "%d",
    431                   __func__, xx, p_lcb->remote_bd_addr.ToString().c_str(), p_lcb,
    432                   p_lcb->in_use, p_lcb->link_state, p_lcb->handle,
    433                   p_lcb->link_role, p_lcb->is_bonding, p_lcb->disc_reason,
    434                   p_lcb->transport);
    435             }
    436             CHECK(p_lcb->p_fixed_ccbs[xx] != NULL);
    437             l2cu_release_ccb(p_lcb->p_fixed_ccbs[xx]);
    438 
    439             p_lcb->p_fixed_ccbs[xx] = NULL;
    440           }
    441         }
    442 #endif
    443       }
    444       if (l2cu_create_conn(p_lcb, transport))
    445         lcb_is_free = false; /* still using this lcb */
    446     }
    447 
    448     p_lcb->p_pending_ccb = NULL;
    449 
    450     /* Release the LCB */
    451     if (lcb_is_free) l2cu_release_lcb(p_lcb);
    452   }
    453 
    454   /* Now that we have a free acl connection, see if any lcbs are pending */
    455   if (lcb_is_free &&
    456       ((p_lcb = l2cu_find_lcb_by_state(LST_CONNECT_HOLDING)) != NULL)) {
    457     /* we found one-- create a connection */
    458     l2cu_create_conn(p_lcb, BT_TRANSPORT_BR_EDR);
    459   }
    460 
    461   return status;
    462 }
    463 
    464 /*******************************************************************************
    465  *
    466  * Function         l2c_link_hci_qos_violation
    467  *
    468  * Description      This function is called when an HCI QOS Violation
    469  *                  event is received.
    470  *
    471  * Returns          true if the link is known about, else false
    472  *
    473  ******************************************************************************/
    474 bool l2c_link_hci_qos_violation(uint16_t handle) {
    475   tL2C_LCB* p_lcb;
    476   tL2C_CCB* p_ccb;
    477 
    478   /* See if we have a link control block for the connection */
    479   p_lcb = l2cu_find_lcb_by_handle(handle);
    480 
    481   /* If we don't have one, maybe an SCO link. */
    482   if (!p_lcb) return (false);
    483 
    484   /* For all channels, tell the upper layer about it */
    485   for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
    486     if (p_ccb->p_rcb->api.pL2CA_QoSViolationInd_Cb)
    487       l2c_csm_execute(p_ccb, L2CEVT_LP_QOS_VIOLATION_IND, NULL);
    488   }
    489 
    490   return (true);
    491 }
    492 
    493 /*******************************************************************************
    494  *
    495  * Function         l2c_link_timeout
    496  *
    497  * Description      This function is called when a link timer expires
    498  *
    499  * Returns          void
    500  *
    501  ******************************************************************************/
    502 void l2c_link_timeout(tL2C_LCB* p_lcb) {
    503   tL2C_CCB* p_ccb;
    504   tBTM_STATUS rc;
    505 
    506   L2CAP_TRACE_EVENT(
    507       "L2CAP - l2c_link_timeout() link state %d first CCB %p is_bonding:%d",
    508       p_lcb->link_state, p_lcb->ccb_queue.p_first_ccb, p_lcb->is_bonding);
    509 
    510   /* If link was connecting or disconnecting, clear all channels and drop the
    511    * LCB */
    512   if ((p_lcb->link_state == LST_CONNECTING_WAIT_SWITCH) ||
    513       (p_lcb->link_state == LST_CONNECTING) ||
    514       (p_lcb->link_state == LST_CONNECT_HOLDING) ||
    515       (p_lcb->link_state == LST_DISCONNECTING)) {
    516     p_lcb->p_pending_ccb = NULL;
    517 
    518     /* For all channels, send a disconnect indication event through */
    519     /* their FSMs. The CCBs should remove themselves from the LCB   */
    520     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;) {
    521       tL2C_CCB* pn = p_ccb->p_next_ccb;
    522 
    523       l2c_csm_execute(p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
    524 
    525       p_ccb = pn;
    526     }
    527     if (p_lcb->link_state == LST_CONNECTING && l2cb.is_ble_connecting) {
    528       L2CA_CancelBleConnectReq(l2cb.ble_connecting_bda);
    529     }
    530     /* Release the LCB */
    531     l2cu_release_lcb(p_lcb);
    532   }
    533 
    534   /* If link is connected, check for inactivity timeout */
    535   if (p_lcb->link_state == LST_CONNECTED) {
    536     /* Check for ping outstanding */
    537     if (p_lcb->p_echo_rsp_cb) {
    538       tL2CA_ECHO_RSP_CB* p_cb = p_lcb->p_echo_rsp_cb;
    539 
    540       /* Zero out the callback in case app immediately calls us again */
    541       p_lcb->p_echo_rsp_cb = NULL;
    542 
    543       (*p_cb)(L2CAP_PING_RESULT_NO_RESP);
    544 
    545       L2CAP_TRACE_WARNING("L2CAP - ping timeout");
    546 
    547       /* For all channels, send a disconnect indication event through */
    548       /* their FSMs. The CCBs should remove themselves from the LCB   */
    549       for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;) {
    550         tL2C_CCB* pn = p_ccb->p_next_ccb;
    551 
    552         l2c_csm_execute(p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
    553 
    554         p_ccb = pn;
    555       }
    556     }
    557 
    558     /* If no channels in use, drop the link. */
    559     if (!p_lcb->ccb_queue.p_first_ccb) {
    560       period_ms_t timeout_ms;
    561       bool start_timeout = true;
    562 
    563       rc = btm_sec_disconnect(p_lcb->handle, HCI_ERR_PEER_USER);
    564 
    565       if (rc == BTM_CMD_STORED) {
    566         /* Security Manager will take care of disconnecting, state will be
    567          * updated at that time */
    568         start_timeout = false;
    569       } else if (rc == BTM_CMD_STARTED) {
    570         p_lcb->link_state = LST_DISCONNECTING;
    571         timeout_ms = L2CAP_LINK_DISCONNECT_TIMEOUT_MS;
    572       } else if (rc == BTM_SUCCESS) {
    573         l2cu_process_fixed_disc_cback(p_lcb);
    574         /* BTM SEC will make sure that link is release (probably after pairing
    575          * is done) */
    576         p_lcb->link_state = LST_DISCONNECTING;
    577         start_timeout = false;
    578       } else if (rc == BTM_BUSY) {
    579         /* BTM is still executing security process. Let lcb stay as connected */
    580         start_timeout = false;
    581       } else if (p_lcb->is_bonding) {
    582         btsnd_hcic_disconnect(p_lcb->handle, HCI_ERR_PEER_USER);
    583         l2cu_process_fixed_disc_cback(p_lcb);
    584         p_lcb->link_state = LST_DISCONNECTING;
    585         timeout_ms = L2CAP_LINK_DISCONNECT_TIMEOUT_MS;
    586       } else {
    587         /* probably no buffer to send disconnect */
    588         timeout_ms = BT_1SEC_TIMEOUT_MS;
    589       }
    590 
    591       if (start_timeout) {
    592         alarm_set_on_mloop(p_lcb->l2c_lcb_timer, timeout_ms,
    593                            l2c_lcb_timer_timeout, p_lcb);
    594       }
    595     } else {
    596       /* Check in case we were flow controlled */
    597       l2c_link_check_send_pkts(p_lcb, NULL, NULL);
    598     }
    599   }
    600 }
    601 
    602 /*******************************************************************************
    603  *
    604  * Function         l2c_info_resp_timer_timeout
    605  *
    606  * Description      This function is called when an info request times out
    607  *
    608  * Returns          void
    609  *
    610  ******************************************************************************/
    611 void l2c_info_resp_timer_timeout(void* data) {
    612   tL2C_LCB* p_lcb = (tL2C_LCB*)data;
    613   tL2C_CCB* p_ccb;
    614   tL2C_CONN_INFO ci;
    615 
    616   /* If we timed out waiting for info response, just continue using basic if
    617    * allowed */
    618   if (p_lcb->w4_info_rsp) {
    619     /* If waiting for security complete, restart the info response timer */
    620     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
    621          p_ccb = p_ccb->p_next_ccb) {
    622       if ((p_ccb->chnl_state == CST_ORIG_W4_SEC_COMP) ||
    623           (p_ccb->chnl_state == CST_TERM_W4_SEC_COMP)) {
    624         alarm_set_on_mloop(p_lcb->info_resp_timer,
    625                            L2CAP_WAIT_INFO_RSP_TIMEOUT_MS,
    626                            l2c_info_resp_timer_timeout, p_lcb);
    627         return;
    628       }
    629     }
    630 
    631     p_lcb->w4_info_rsp = false;
    632 
    633     /* If link is in process of being brought up */
    634     if ((p_lcb->link_state != LST_DISCONNECTED) &&
    635         (p_lcb->link_state != LST_DISCONNECTING)) {
    636       /* Notify active channels that peer info is finished */
    637       if (p_lcb->ccb_queue.p_first_ccb) {
    638         ci.status = HCI_SUCCESS;
    639         ci.bd_addr = p_lcb->remote_bd_addr;
    640 
    641         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
    642              p_ccb = p_ccb->p_next_ccb) {
    643           l2c_csm_execute(p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
    644         }
    645       }
    646     }
    647   }
    648 }
    649 
    650 /*******************************************************************************
    651  *
    652  * Function         l2c_link_adjust_allocation
    653  *
    654  * Description      This function is called when a link is created or removed
    655  *                  to calculate the amount of packets each link may send to
    656  *                  the HCI without an ack coming back.
    657  *
    658  *                  Currently, this is a simple allocation, dividing the
    659  *                  number of Controller Packets by the number of links. In
    660  *                  the future, QOS configuration should be examined.
    661  *
    662  * Returns          void
    663  *
    664  ******************************************************************************/
    665 void l2c_link_adjust_allocation(void) {
    666   uint16_t qq, yy, qq_remainder;
    667   tL2C_LCB* p_lcb;
    668   uint16_t hi_quota, low_quota;
    669   uint16_t num_lowpri_links = 0;
    670   uint16_t num_hipri_links = 0;
    671   uint16_t controller_xmit_quota = l2cb.num_lm_acl_bufs;
    672   uint16_t high_pri_link_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA_A;
    673 
    674   /* If no links active, reset buffer quotas and controller buffers */
    675   if (l2cb.num_links_active == 0) {
    676     l2cb.controller_xmit_window = l2cb.num_lm_acl_bufs;
    677     l2cb.round_robin_quota = l2cb.round_robin_unacked = 0;
    678     return;
    679   }
    680 
    681   /* First, count the links */
    682   for (yy = 0, p_lcb = &l2cb.lcb_pool[0]; yy < MAX_L2CAP_LINKS; yy++, p_lcb++) {
    683     if (p_lcb->in_use) {
    684       if (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH)
    685         num_hipri_links++;
    686       else
    687         num_lowpri_links++;
    688     }
    689   }
    690 
    691   /* now adjust high priority link quota */
    692   low_quota = num_lowpri_links ? 1 : 0;
    693   while ((num_hipri_links * high_pri_link_quota + low_quota) >
    694          controller_xmit_quota)
    695     high_pri_link_quota--;
    696 
    697   /* Work out the xmit quota and buffer quota high and low priorities */
    698   hi_quota = num_hipri_links * high_pri_link_quota;
    699   low_quota =
    700       (hi_quota < controller_xmit_quota) ? controller_xmit_quota - hi_quota : 1;
    701 
    702   /* Work out and save the HCI xmit quota for each low priority link */
    703 
    704   /* If each low priority link cannot have at least one buffer */
    705   if (num_lowpri_links > low_quota) {
    706     l2cb.round_robin_quota = low_quota;
    707     qq = qq_remainder = 1;
    708   }
    709   /* If each low priority link can have at least one buffer */
    710   else if (num_lowpri_links > 0) {
    711     l2cb.round_robin_quota = 0;
    712     l2cb.round_robin_unacked = 0;
    713     qq = low_quota / num_lowpri_links;
    714     qq_remainder = low_quota % num_lowpri_links;
    715   }
    716   /* If no low priority link */
    717   else {
    718     l2cb.round_robin_quota = 0;
    719     l2cb.round_robin_unacked = 0;
    720     qq = qq_remainder = 1;
    721   }
    722 
    723   L2CAP_TRACE_EVENT(
    724       "l2c_link_adjust_allocation  num_hipri: %u  num_lowpri: %u  low_quota: "
    725       "%u  round_robin_quota: %u  qq: %u",
    726       num_hipri_links, num_lowpri_links, low_quota, l2cb.round_robin_quota, qq);
    727 
    728   /* Now, assign the quotas to each link */
    729   for (yy = 0, p_lcb = &l2cb.lcb_pool[0]; yy < MAX_L2CAP_LINKS; yy++, p_lcb++) {
    730     if (p_lcb->in_use) {
    731       if (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) {
    732         p_lcb->link_xmit_quota = high_pri_link_quota;
    733       } else {
    734         /* Safety check in case we switched to round-robin with something
    735          * outstanding */
    736         /* if sent_not_acked is added into round_robin_unacked then don't add it
    737          * again */
    738         /* l2cap keeps updating sent_not_acked for exiting from round robin */
    739         if ((p_lcb->link_xmit_quota > 0) && (qq == 0))
    740           l2cb.round_robin_unacked += p_lcb->sent_not_acked;
    741 
    742         p_lcb->link_xmit_quota = qq;
    743         if (qq_remainder > 0) {
    744           p_lcb->link_xmit_quota++;
    745           qq_remainder--;
    746         }
    747       }
    748 
    749       L2CAP_TRACE_EVENT(
    750           "l2c_link_adjust_allocation LCB %d   Priority: %d  XmitQuota: %d", yy,
    751           p_lcb->acl_priority, p_lcb->link_xmit_quota);
    752 
    753       L2CAP_TRACE_EVENT("        SentNotAcked: %d  RRUnacked: %d",
    754                         p_lcb->sent_not_acked, l2cb.round_robin_unacked);
    755 
    756       /* There is a special case where we have readjusted the link quotas and */
    757       /* this link may have sent anything but some other link sent packets so */
    758       /* so we may need a timer to kick off this link's transmissions. */
    759       if ((p_lcb->link_state == LST_CONNECTED) &&
    760           (!list_is_empty(p_lcb->link_xmit_data_q)) &&
    761           (p_lcb->sent_not_acked < p_lcb->link_xmit_quota)) {
    762         alarm_set_on_mloop(p_lcb->l2c_lcb_timer,
    763                            L2CAP_LINK_FLOW_CONTROL_TIMEOUT_MS,
    764                            l2c_lcb_timer_timeout, p_lcb);
    765       }
    766     }
    767   }
    768 }
    769 
    770 /*******************************************************************************
    771  *
    772  * Function         l2c_link_adjust_chnl_allocation
    773  *
    774  * Description      This function is called to calculate the amount of packets
    775  *                  each non-F&EC channel may have outstanding.
    776  *
    777  *                  Currently, this is a simple allocation, dividing the number
    778  *                  of packets allocated to the link by the number of channels.
    779  *                  In the future, QOS configuration should be examined.
    780  *
    781  * Returns          void
    782  *
    783  ******************************************************************************/
    784 void l2c_link_adjust_chnl_allocation(void) {
    785   uint8_t xx;
    786 
    787   L2CAP_TRACE_DEBUG("%s", __func__);
    788 
    789   /* assign buffer quota to each channel based on its data rate requirement */
    790   for (xx = 0; xx < MAX_L2CAP_CHANNELS; xx++) {
    791     tL2C_CCB* p_ccb = l2cb.ccb_pool + xx;
    792 
    793     if (!p_ccb->in_use) continue;
    794 
    795     tL2CAP_CHNL_DATA_RATE data_rate = p_ccb->tx_data_rate + p_ccb->rx_data_rate;
    796     p_ccb->buff_quota = L2CAP_CBB_DEFAULT_DATA_RATE_BUFF_QUOTA * data_rate;
    797     L2CAP_TRACE_EVENT(
    798         "CID:0x%04x FCR Mode:%u Priority:%u TxDataRate:%u RxDataRate:%u "
    799         "Quota:%u",
    800         p_ccb->local_cid, p_ccb->peer_cfg.fcr.mode, p_ccb->ccb_priority,
    801         p_ccb->tx_data_rate, p_ccb->rx_data_rate, p_ccb->buff_quota);
    802 
    803     /* quota may be change so check congestion */
    804     l2cu_check_channel_congestion(p_ccb);
    805   }
    806 }
    807 
    808 /*******************************************************************************
    809  *
    810  * Function         l2c_link_processs_num_bufs
    811  *
    812  * Description      This function is called when a "controller buffer size"
    813  *                  event is first received from the controller. It updates
    814  *                  the L2CAP values.
    815  *
    816  * Returns          void
    817  *
    818  ******************************************************************************/
    819 void l2c_link_processs_num_bufs(uint16_t num_lm_acl_bufs) {
    820   l2cb.num_lm_acl_bufs = l2cb.controller_xmit_window = num_lm_acl_bufs;
    821 }
    822 
    823 /*******************************************************************************
    824  *
    825  * Function         l2c_link_pkts_rcvd
    826  *
    827  * Description      This function is called from the HCI transport when it is
    828  *                  time to send a "Host ready for packets" command. This is
    829  *                  only when host to controller flow control is used. It fills
    830  *                  in the arrays of numbers of packets and handles.
    831  *
    832  * Returns          count of number of entries filled in
    833  *
    834  ******************************************************************************/
    835 uint8_t l2c_link_pkts_rcvd(UNUSED_ATTR uint16_t* num_pkts,
    836                            UNUSED_ATTR uint16_t* handles) {
    837   uint8_t num_found = 0;
    838 
    839   return (num_found);
    840 }
    841 
    842 /*******************************************************************************
    843  *
    844  * Function         l2c_link_role_changed
    845  *
    846  * Description      This function is called whan a link's master/slave role
    847  *                  change event is received. It simply updates the link control
    848  *                  block.
    849  *
    850  * Returns          void
    851  *
    852  ******************************************************************************/
    853 void l2c_link_role_changed(const RawAddress* bd_addr, uint8_t new_role,
    854                            uint8_t hci_status) {
    855   tL2C_LCB* p_lcb;
    856   int xx;
    857 
    858   /* Make sure not called from HCI Command Status (bd_addr and new_role are
    859    * invalid) */
    860   if (bd_addr) {
    861     /* If here came form hci role change event */
    862     p_lcb = l2cu_find_lcb_by_bd_addr(*bd_addr, BT_TRANSPORT_BR_EDR);
    863     if (p_lcb) {
    864       p_lcb->link_role = new_role;
    865 
    866       /* Reset high priority link if needed */
    867       if (hci_status == HCI_SUCCESS)
    868         l2cu_set_acl_priority(*bd_addr, p_lcb->acl_priority, true);
    869     }
    870   }
    871 
    872   /* Check if any LCB was waiting for switch to be completed */
    873   for (xx = 0, p_lcb = &l2cb.lcb_pool[0]; xx < MAX_L2CAP_LINKS; xx++, p_lcb++) {
    874     if ((p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTING_WAIT_SWITCH)) {
    875       l2cu_create_conn_after_switch(p_lcb);
    876     }
    877   }
    878 }
    879 
    880 /*******************************************************************************
    881  *
    882  * Function         l2c_pin_code_request
    883  *
    884  * Description      This function is called whan a pin-code request is received
    885  *                  on a connection. If there are no channels active yet on the
    886  *                  link, it extends the link first connection timer.  Make sure
    887  *                  that inactivity timer is not extended if PIN code happens
    888  *                  to be after last ccb released.
    889  *
    890  * Returns          void
    891  *
    892  ******************************************************************************/
    893 void l2c_pin_code_request(const RawAddress& bd_addr) {
    894   tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_BR_EDR);
    895 
    896   if ((p_lcb) && (!p_lcb->ccb_queue.p_first_ccb)) {
    897     alarm_set_on_mloop(p_lcb->l2c_lcb_timer, L2CAP_LINK_CONNECT_EXT_TIMEOUT_MS,
    898                        l2c_lcb_timer_timeout, p_lcb);
    899   }
    900 }
    901 
    902 #if (L2CAP_WAKE_PARKED_LINK == TRUE)
    903 /*******************************************************************************
    904  *
    905  * Function         l2c_link_check_power_mode
    906  *
    907  * Description      This function is called to check power mode.
    908  *
    909  * Returns          true if link is going to be active from park
    910  *                  false if nothing to send or not in park mode
    911  *
    912  ******************************************************************************/
    913 bool l2c_link_check_power_mode(tL2C_LCB* p_lcb) {
    914   tBTM_PM_MODE mode;
    915   tL2C_CCB* p_ccb;
    916   bool need_to_active = false;
    917 
    918   /*
    919    * We only switch park to active only if we have unsent packets
    920    */
    921   if (list_is_empty(p_lcb->link_xmit_data_q)) {
    922     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
    923          p_ccb = p_ccb->p_next_ccb) {
    924       if (!fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
    925         need_to_active = true;
    926         break;
    927       }
    928     }
    929   } else
    930     need_to_active = true;
    931 
    932   /* if we have packets to send */
    933   if (need_to_active) {
    934     /* check power mode */
    935     if (BTM_ReadPowerMode(p_lcb->remote_bd_addr, &mode) == BTM_SUCCESS) {
    936       if (mode == BTM_PM_STS_PENDING) {
    937         L2CAP_TRACE_DEBUG("LCB(0x%x) is in PM pending state", p_lcb->handle);
    938 
    939         return true;
    940       }
    941     }
    942   }
    943   return false;
    944 }
    945 #endif /* L2CAP_WAKE_PARKED_LINK == TRUE) */
    946 
    947 /*******************************************************************************
    948  *
    949  * Function         l2c_link_check_send_pkts
    950  *
    951  * Description      This function is called to check if it can send packets
    952  *                  to the Host Controller. It may be passed the address of
    953  *                  a packet to send.
    954  *
    955  * Returns          void
    956  *
    957  ******************************************************************************/
    958 void l2c_link_check_send_pkts(tL2C_LCB* p_lcb, tL2C_CCB* p_ccb, BT_HDR* p_buf) {
    959   int xx;
    960   bool single_write = false;
    961 
    962   /* Save the channel ID for faster counting */
    963   if (p_buf) {
    964     if (p_ccb != NULL) {
    965       p_buf->event = p_ccb->local_cid;
    966       single_write = true;
    967     } else
    968       p_buf->event = 0;
    969 
    970     p_buf->layer_specific = 0;
    971     list_append(p_lcb->link_xmit_data_q, p_buf);
    972 
    973     if (p_lcb->link_xmit_quota == 0) {
    974       if (p_lcb->transport == BT_TRANSPORT_LE)
    975         l2cb.ble_check_round_robin = true;
    976       else
    977         l2cb.check_round_robin = true;
    978     }
    979   }
    980 
    981   /* If this is called from uncongested callback context break recursive
    982   *calling.
    983   ** This LCB will be served when receiving number of completed packet event.
    984   */
    985   if (l2cb.is_cong_cback_context) return;
    986 
    987   /* If we are in a scenario where there are not enough buffers for each link to
    988   ** have at least 1, then do a round-robin for all the LCBs
    989   */
    990   if ((p_lcb == NULL) || (p_lcb->link_xmit_quota == 0)) {
    991     if (p_lcb == NULL)
    992       p_lcb = l2cb.lcb_pool;
    993     else if (!single_write)
    994       p_lcb++;
    995 
    996     /* Loop through, starting at the next */
    997     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_lcb++) {
    998       /* Check for wraparound */
    999       if (p_lcb == &l2cb.lcb_pool[MAX_L2CAP_LINKS]) p_lcb = &l2cb.lcb_pool[0];
   1000 
   1001       /* If controller window is full, nothing to do */
   1002       if (((l2cb.controller_xmit_window == 0 ||
   1003             (l2cb.round_robin_unacked >= l2cb.round_robin_quota)) &&
   1004            (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
   1005           (p_lcb->transport == BT_TRANSPORT_LE &&
   1006            (l2cb.ble_round_robin_unacked >= l2cb.ble_round_robin_quota ||
   1007             l2cb.controller_le_xmit_window == 0)))
   1008         continue;
   1009 
   1010       if ((!p_lcb->in_use) || (p_lcb->partial_segment_being_sent) ||
   1011           (p_lcb->link_state != LST_CONNECTED) ||
   1012           (p_lcb->link_xmit_quota != 0) || (L2C_LINK_CHECK_POWER_MODE(p_lcb)))
   1013         continue;
   1014 
   1015       /* See if we can send anything from the Link Queue */
   1016       if (!list_is_empty(p_lcb->link_xmit_data_q)) {
   1017         p_buf = (BT_HDR*)list_front(p_lcb->link_xmit_data_q);
   1018         list_remove(p_lcb->link_xmit_data_q, p_buf);
   1019         l2c_link_send_to_lower(p_lcb, p_buf, NULL);
   1020       } else if (single_write) {
   1021         /* If only doing one write, break out */
   1022         break;
   1023       }
   1024       /* If nothing on the link queue, check the channel queue */
   1025       else {
   1026         tL2C_TX_COMPLETE_CB_INFO cbi;
   1027         p_buf = l2cu_get_next_buffer_to_send(p_lcb, &cbi);
   1028         if (p_buf != NULL) {
   1029           l2c_link_send_to_lower(p_lcb, p_buf, &cbi);
   1030         }
   1031       }
   1032     }
   1033 
   1034     /* If we finished without using up our quota, no need for a safety check */
   1035     if ((l2cb.controller_xmit_window > 0) &&
   1036         (l2cb.round_robin_unacked < l2cb.round_robin_quota) &&
   1037         (p_lcb->transport == BT_TRANSPORT_BR_EDR))
   1038       l2cb.check_round_robin = false;
   1039 
   1040     if ((l2cb.controller_le_xmit_window > 0) &&
   1041         (l2cb.ble_round_robin_unacked < l2cb.ble_round_robin_quota) &&
   1042         (p_lcb->transport == BT_TRANSPORT_LE))
   1043       l2cb.ble_check_round_robin = false;
   1044   } else /* if this is not round-robin service */
   1045   {
   1046     /* If a partial segment is being sent, can't send anything else */
   1047     if ((p_lcb->partial_segment_being_sent) ||
   1048         (p_lcb->link_state != LST_CONNECTED) ||
   1049         (L2C_LINK_CHECK_POWER_MODE(p_lcb)))
   1050       return;
   1051 
   1052     /* See if we can send anything from the link queue */
   1053     while (((l2cb.controller_xmit_window != 0 &&
   1054              (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
   1055             (l2cb.controller_le_xmit_window != 0 &&
   1056              (p_lcb->transport == BT_TRANSPORT_LE))) &&
   1057            (p_lcb->sent_not_acked < p_lcb->link_xmit_quota)) {
   1058       if (list_is_empty(p_lcb->link_xmit_data_q)) break;
   1059 
   1060       p_buf = (BT_HDR*)list_front(p_lcb->link_xmit_data_q);
   1061       list_remove(p_lcb->link_xmit_data_q, p_buf);
   1062       if (!l2c_link_send_to_lower(p_lcb, p_buf, NULL)) break;
   1063     }
   1064 
   1065     if (!single_write) {
   1066       /* See if we can send anything for any channel */
   1067       while (((l2cb.controller_xmit_window != 0 &&
   1068                (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
   1069               (l2cb.controller_le_xmit_window != 0 &&
   1070                (p_lcb->transport == BT_TRANSPORT_LE))) &&
   1071              (p_lcb->sent_not_acked < p_lcb->link_xmit_quota)) {
   1072         tL2C_TX_COMPLETE_CB_INFO cbi;
   1073         p_buf = l2cu_get_next_buffer_to_send(p_lcb, &cbi);
   1074         if (p_buf == NULL) break;
   1075 
   1076         if (!l2c_link_send_to_lower(p_lcb, p_buf, &cbi)) break;
   1077       }
   1078     }
   1079 
   1080     /* There is a special case where we have readjusted the link quotas and  */
   1081     /* this link may have sent anything but some other link sent packets so  */
   1082     /* so we may need a timer to kick off this link's transmissions.         */
   1083     if ((!list_is_empty(p_lcb->link_xmit_data_q)) &&
   1084         (p_lcb->sent_not_acked < p_lcb->link_xmit_quota)) {
   1085       alarm_set_on_mloop(p_lcb->l2c_lcb_timer,
   1086                          L2CAP_LINK_FLOW_CONTROL_TIMEOUT_MS,
   1087                          l2c_lcb_timer_timeout, p_lcb);
   1088     }
   1089   }
   1090 }
   1091 
   1092 /*******************************************************************************
   1093  *
   1094  * Function         l2c_link_send_to_lower
   1095  *
   1096  * Description      This function queues the buffer for HCI transmission
   1097  *
   1098  * Returns          true for success, false for fail
   1099  *
   1100  ******************************************************************************/
   1101 static bool l2c_link_send_to_lower(tL2C_LCB* p_lcb, BT_HDR* p_buf,
   1102                                    tL2C_TX_COMPLETE_CB_INFO* p_cbi) {
   1103   uint16_t num_segs;
   1104   uint16_t xmit_window, acl_data_size;
   1105   const controller_t* controller = controller_get_interface();
   1106 
   1107   if ((p_buf->len <= controller->get_acl_packet_size_classic() &&
   1108        (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
   1109       ((p_lcb->transport == BT_TRANSPORT_LE) &&
   1110        (p_buf->len <= controller->get_acl_packet_size_ble()))) {
   1111     if (p_lcb->link_xmit_quota == 0) {
   1112       if (p_lcb->transport == BT_TRANSPORT_LE)
   1113         l2cb.ble_round_robin_unacked++;
   1114       else
   1115         l2cb.round_robin_unacked++;
   1116     }
   1117     p_lcb->sent_not_acked++;
   1118     p_buf->layer_specific = 0;
   1119 
   1120     if (p_lcb->transport == BT_TRANSPORT_LE) {
   1121       l2cb.controller_le_xmit_window--;
   1122       bte_main_hci_send(
   1123           p_buf, (uint16_t)(BT_EVT_TO_LM_HCI_ACL | LOCAL_BLE_CONTROLLER_ID));
   1124     } else {
   1125       l2cb.controller_xmit_window--;
   1126       bte_main_hci_send(p_buf, BT_EVT_TO_LM_HCI_ACL);
   1127     }
   1128   } else {
   1129     if (p_lcb->transport == BT_TRANSPORT_LE) {
   1130       acl_data_size = controller->get_acl_data_size_ble();
   1131       xmit_window = l2cb.controller_le_xmit_window;
   1132 
   1133     } else {
   1134       acl_data_size = controller->get_acl_data_size_classic();
   1135       xmit_window = l2cb.controller_xmit_window;
   1136     }
   1137     num_segs = (p_buf->len - HCI_DATA_PREAMBLE_SIZE + acl_data_size - 1) /
   1138                acl_data_size;
   1139 
   1140     /* If doing round-robin, then only 1 segment each time */
   1141     if (p_lcb->link_xmit_quota == 0) {
   1142       num_segs = 1;
   1143       p_lcb->partial_segment_being_sent = true;
   1144     } else {
   1145       /* Multi-segment packet. Make sure it can fit */
   1146       if (num_segs > xmit_window) {
   1147         num_segs = xmit_window;
   1148         p_lcb->partial_segment_being_sent = true;
   1149       }
   1150 
   1151       if (num_segs > (p_lcb->link_xmit_quota - p_lcb->sent_not_acked)) {
   1152         num_segs = (p_lcb->link_xmit_quota - p_lcb->sent_not_acked);
   1153         p_lcb->partial_segment_being_sent = true;
   1154       }
   1155     }
   1156 
   1157     p_buf->layer_specific = num_segs;
   1158     if (p_lcb->transport == BT_TRANSPORT_LE) {
   1159       l2cb.controller_le_xmit_window -= num_segs;
   1160       if (p_lcb->link_xmit_quota == 0) l2cb.ble_round_robin_unacked += num_segs;
   1161     } else {
   1162       l2cb.controller_xmit_window -= num_segs;
   1163 
   1164       if (p_lcb->link_xmit_quota == 0) l2cb.round_robin_unacked += num_segs;
   1165     }
   1166 
   1167     p_lcb->sent_not_acked += num_segs;
   1168     if (p_lcb->transport == BT_TRANSPORT_LE) {
   1169       bte_main_hci_send(
   1170           p_buf, (uint16_t)(BT_EVT_TO_LM_HCI_ACL | LOCAL_BLE_CONTROLLER_ID));
   1171     } else {
   1172       bte_main_hci_send(p_buf, BT_EVT_TO_LM_HCI_ACL);
   1173     }
   1174   }
   1175 
   1176 #if (L2CAP_HCI_FLOW_CONTROL_DEBUG == TRUE)
   1177   if (p_lcb->transport == BT_TRANSPORT_LE) {
   1178     L2CAP_TRACE_DEBUG(
   1179         "TotalWin=%d,Hndl=0x%x,Quota=%d,Unack=%d,RRQuota=%d,RRUnack=%d",
   1180         l2cb.controller_le_xmit_window, p_lcb->handle, p_lcb->link_xmit_quota,
   1181         p_lcb->sent_not_acked, l2cb.ble_round_robin_quota,
   1182         l2cb.ble_round_robin_unacked);
   1183   } else {
   1184     L2CAP_TRACE_DEBUG(
   1185         "TotalWin=%d,Hndl=0x%x,Quota=%d,Unack=%d,RRQuota=%d,RRUnack=%d",
   1186         l2cb.controller_xmit_window, p_lcb->handle, p_lcb->link_xmit_quota,
   1187         p_lcb->sent_not_acked, l2cb.round_robin_quota,
   1188         l2cb.round_robin_unacked);
   1189   }
   1190 #endif
   1191 
   1192   if (p_cbi) l2cu_tx_complete(p_cbi);
   1193 
   1194   return true;
   1195 }
   1196 
   1197 /*******************************************************************************
   1198  *
   1199  * Function         l2c_link_process_num_completed_pkts
   1200  *
   1201  * Description      This function is called when a "number-of-completed-packets"
   1202  *                  event is received from the controller. It updates all the
   1203  *                  LCB transmit counts.
   1204  *
   1205  * Returns          void
   1206  *
   1207  ******************************************************************************/
   1208 void l2c_link_process_num_completed_pkts(uint8_t* p) {
   1209   uint8_t num_handles, xx;
   1210   uint16_t handle;
   1211   uint16_t num_sent;
   1212   tL2C_LCB* p_lcb;
   1213 
   1214   STREAM_TO_UINT8(num_handles, p);
   1215 
   1216   for (xx = 0; xx < num_handles; xx++) {
   1217     STREAM_TO_UINT16(handle, p);
   1218     STREAM_TO_UINT16(num_sent, p);
   1219 
   1220     p_lcb = l2cu_find_lcb_by_handle(handle);
   1221 
   1222     /* Callback for number of completed packet event    */
   1223     /* Originally designed for [3DSG]                   */
   1224     if ((p_lcb != NULL) && (p_lcb->p_nocp_cb)) {
   1225       L2CAP_TRACE_DEBUG("L2CAP - calling NoCP callback");
   1226       (*p_lcb->p_nocp_cb)(p_lcb->remote_bd_addr);
   1227     }
   1228 
   1229     if (p_lcb) {
   1230       if (p_lcb && (p_lcb->transport == BT_TRANSPORT_LE))
   1231         l2cb.controller_le_xmit_window += num_sent;
   1232       else {
   1233         /* Maintain the total window to the controller */
   1234         l2cb.controller_xmit_window += num_sent;
   1235       }
   1236       /* If doing round-robin, adjust communal counts */
   1237       if (p_lcb->link_xmit_quota == 0) {
   1238         if (p_lcb->transport == BT_TRANSPORT_LE) {
   1239           /* Don't go negative */
   1240           if (l2cb.ble_round_robin_unacked > num_sent)
   1241             l2cb.ble_round_robin_unacked -= num_sent;
   1242           else
   1243             l2cb.ble_round_robin_unacked = 0;
   1244         } else {
   1245           /* Don't go negative */
   1246           if (l2cb.round_robin_unacked > num_sent)
   1247             l2cb.round_robin_unacked -= num_sent;
   1248           else
   1249             l2cb.round_robin_unacked = 0;
   1250         }
   1251       }
   1252 
   1253       /* Don't go negative */
   1254       if (p_lcb->sent_not_acked > num_sent)
   1255         p_lcb->sent_not_acked -= num_sent;
   1256       else
   1257         p_lcb->sent_not_acked = 0;
   1258 
   1259       l2c_link_check_send_pkts(p_lcb, NULL, NULL);
   1260 
   1261       /* If we were doing round-robin for low priority links, check 'em */
   1262       if ((p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) &&
   1263           (l2cb.check_round_robin) &&
   1264           (l2cb.round_robin_unacked < l2cb.round_robin_quota)) {
   1265         l2c_link_check_send_pkts(NULL, NULL, NULL);
   1266       }
   1267       if ((p_lcb->transport == BT_TRANSPORT_LE) &&
   1268           (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) &&
   1269           ((l2cb.ble_check_round_robin) &&
   1270            (l2cb.ble_round_robin_unacked < l2cb.ble_round_robin_quota))) {
   1271         l2c_link_check_send_pkts(NULL, NULL, NULL);
   1272       }
   1273     }
   1274 
   1275 #if (L2CAP_HCI_FLOW_CONTROL_DEBUG == TRUE)
   1276     if (p_lcb) {
   1277       if (p_lcb->transport == BT_TRANSPORT_LE) {
   1278         L2CAP_TRACE_DEBUG(
   1279             "TotalWin=%d,LinkUnack(0x%x)=%d,RRCheck=%d,RRUnack=%d",
   1280             l2cb.controller_le_xmit_window, p_lcb->handle,
   1281             p_lcb->sent_not_acked, l2cb.ble_check_round_robin,
   1282             l2cb.ble_round_robin_unacked);
   1283       } else {
   1284         L2CAP_TRACE_DEBUG(
   1285             "TotalWin=%d,LinkUnack(0x%x)=%d,RRCheck=%d,RRUnack=%d",
   1286             l2cb.controller_xmit_window, p_lcb->handle, p_lcb->sent_not_acked,
   1287             l2cb.check_round_robin, l2cb.round_robin_unacked);
   1288       }
   1289     } else {
   1290       L2CAP_TRACE_DEBUG(
   1291           "TotalWin=%d  LE_Win: %d, Handle=0x%x, RRCheck=%d, RRUnack=%d",
   1292           l2cb.controller_xmit_window, l2cb.controller_le_xmit_window, handle,
   1293           l2cb.ble_check_round_robin, l2cb.ble_round_robin_unacked);
   1294     }
   1295 #endif
   1296   }
   1297 }
   1298 
   1299 /*******************************************************************************
   1300  *
   1301  * Function         l2c_link_segments_xmitted
   1302  *
   1303  * Description      This function is called from the HCI Interface when an ACL
   1304  *                  data packet segment is transmitted.
   1305  *
   1306  * Returns          void
   1307  *
   1308  ******************************************************************************/
   1309 void l2c_link_segments_xmitted(BT_HDR* p_msg) {
   1310   uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
   1311   uint16_t handle;
   1312   tL2C_LCB* p_lcb;
   1313 
   1314   /* Extract the handle */
   1315   STREAM_TO_UINT16(handle, p);
   1316   handle = HCID_GET_HANDLE(handle);
   1317 
   1318   /* Find the LCB based on the handle */
   1319   p_lcb = l2cu_find_lcb_by_handle(handle);
   1320   if (p_lcb == NULL) {
   1321     L2CAP_TRACE_WARNING("L2CAP - rcvd segment complete, unknown handle: %d",
   1322                         handle);
   1323     osi_free(p_msg);
   1324     return;
   1325   }
   1326 
   1327   if (p_lcb->link_state == LST_CONNECTED) {
   1328     /* Enqueue the buffer to the head of the transmit queue, and see */
   1329     /* if we can transmit anything more.                             */
   1330     list_prepend(p_lcb->link_xmit_data_q, p_msg);
   1331 
   1332     p_lcb->partial_segment_being_sent = false;
   1333 
   1334     l2c_link_check_send_pkts(p_lcb, NULL, NULL);
   1335   } else
   1336     osi_free(p_msg);
   1337 }
   1338