• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /******************************************************************************
2  *
3  *  Copyright 2004-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
22  *  functions
23  *
24  ******************************************************************************/
25 
26 #include <base/logging.h>
27 #include <log/log.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 
32 #include "bt_common.h"
33 #include "bt_types.h"
34 #include "btu.h"
35 #include "common/time_util.h"
36 #include "hcimsgs.h"
37 #include "l2c_api.h"
38 #include "l2c_int.h"
39 #include "l2cdefs.h"
40 
41 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted
42  */
43 #define L2C_FCR_RETX_ALL_PKTS 0xFF
44 
45 /* this is the minimal offset required by OBX to process incoming packets */
46 static const uint16_t OBX_BUF_MIN_OFFSET = 4;
47 
48 static const char* SAR_types[] = {"Unsegmented", "Start", "End",
49                                   "Continuation"};
50 static const char* SUP_types[] = {"RR", "REJ", "RNR", "SREJ"};
51 
52 /* Look-up table for the CRC calculation */
53 static const unsigned short crctab[256] = {
54     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601,
55     0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440, 0xcc01, 0x0cc0,
56     0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81,
57     0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841, 0xd801, 0x18c0, 0x1980, 0xd941,
58     0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01,
59     0x1dc0, 0x1c80, 0xdc41, 0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0,
60     0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081,
61     0x1040, 0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
62     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441, 0x3c00,
63     0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0,
64     0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840, 0x2800, 0xe8c1, 0xe981,
65     0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41,
66     0x2d00, 0xedc1, 0xec81, 0x2c40, 0xe401, 0x24c0, 0x2580, 0xe541, 0x2700,
67     0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0,
68     0x2080, 0xe041, 0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281,
69     0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
70     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01,
71     0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840, 0x7800, 0xb8c1,
72     0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80,
73     0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40, 0xb401, 0x74c0, 0x7580, 0xb541,
74     0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101,
75     0x71c0, 0x7080, 0xb041, 0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0,
76     0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481,
77     0x5440, 0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
78     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841, 0x8801,
79     0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1,
80     0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41, 0x4400, 0x84c1, 0x8581,
81     0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341,
82     0x4100, 0x81c1, 0x8081, 0x4040,
83 };
84 
85 /*******************************************************************************
86  *  Static local functions
87 */
88 static bool process_reqseq(tL2C_CCB* p_ccb, uint16_t ctrl_word);
89 static void process_s_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf, uint16_t ctrl_word);
90 static void process_i_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf, uint16_t ctrl_word,
91                             bool delay_ack);
92 static bool retransmit_i_frames(tL2C_CCB* p_ccb, uint8_t tx_seq);
93 static void prepare_I_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf,
94                             bool is_retransmission);
95 static void process_stream_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf);
96 static bool do_sar_reassembly(tL2C_CCB* p_ccb, BT_HDR* p_buf,
97                               uint16_t ctrl_word);
98 
99 #if (L2CAP_ERTM_STATS == TRUE)
100 static void l2c_fcr_collect_ack_delay(tL2C_CCB* p_ccb, uint8_t num_bufs_acked);
101 #endif
102 
103 /*******************************************************************************
104  *
105  * Function         l2c_fcr_updcrc
106  *
107  * Description      This function computes the CRC using the look-up table.
108  *
109  * Returns          CRC
110  *
111  ******************************************************************************/
l2c_fcr_updcrc(unsigned short icrc,unsigned char * icp,int icnt)112 static unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char* icp,
113                                      int icnt) {
114   unsigned short crc = icrc;
115   unsigned char* cp = icp;
116   int cnt = icnt;
117 
118   while (cnt--) {
119     crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
120   }
121 
122   return (crc);
123 }
124 
125 /*******************************************************************************
126  *
127  * Function         l2c_fcr_tx_get_fcs
128  *
129  * Description      This function computes the CRC for a frame to be TXed.
130  *
131  * Returns          CRC
132  *
133  ******************************************************************************/
l2c_fcr_tx_get_fcs(BT_HDR * p_buf)134 static uint16_t l2c_fcr_tx_get_fcs(BT_HDR* p_buf) {
135   uint8_t* p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
136 
137   return (l2c_fcr_updcrc(L2CAP_FCR_INIT_CRC, p, p_buf->len));
138 }
139 
140 /*******************************************************************************
141  *
142  * Function         l2c_fcr_rx_get_fcs
143  *
144  * Description      This function computes the CRC for a received frame.
145  *
146  * Returns          CRC
147  *
148  ******************************************************************************/
l2c_fcr_rx_get_fcs(BT_HDR * p_buf)149 static uint16_t l2c_fcr_rx_get_fcs(BT_HDR* p_buf) {
150   uint8_t* p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
151 
152   /* offset points past the L2CAP header, but the CRC check includes it */
153   p -= L2CAP_PKT_OVERHEAD;
154 
155   return (
156       l2c_fcr_updcrc(L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
157 }
158 
159 /*******************************************************************************
160  *
161  * Function         l2c_fcr_start_timer
162  *
163  * Description      This function starts the (monitor or retransmission) timer.
164  *
165  * Returns          -
166  *
167  ******************************************************************************/
l2c_fcr_start_timer(tL2C_CCB * p_ccb)168 void l2c_fcr_start_timer(tL2C_CCB* p_ccb) {
169   CHECK(p_ccb != NULL);
170   uint32_t tout;
171 
172   /* The timers which are in milliseconds */
173   if (p_ccb->fcrb.wait_ack) {
174     tout = (uint32_t)p_ccb->our_cfg.fcr.mon_tout;
175   } else {
176     tout = (uint32_t)p_ccb->our_cfg.fcr.rtrans_tout;
177   }
178 
179   /* Only start a timer that was not started */
180   if (!alarm_is_scheduled(p_ccb->fcrb.mon_retrans_timer)) {
181     alarm_set_on_mloop(p_ccb->fcrb.mon_retrans_timer, tout,
182                        l2c_ccb_timer_timeout, p_ccb);
183   }
184 }
185 
186 /*******************************************************************************
187  *
188  * Function         l2c_fcr_stop_timer
189  *
190  * Description      This function stops the (monitor or transmission) timer.
191  *
192  * Returns          -
193  *
194  ******************************************************************************/
l2c_fcr_stop_timer(tL2C_CCB * p_ccb)195 void l2c_fcr_stop_timer(tL2C_CCB* p_ccb) {
196   CHECK(p_ccb != NULL);
197   alarm_cancel(p_ccb->fcrb.mon_retrans_timer);
198 }
199 
200 /*******************************************************************************
201  *
202  * Function         l2c_fcr_cleanup
203  *
204  * Description      This function cleans up the variable used for
205  *                  flow-control/retrans.
206  *
207  * Returns          -
208  *
209  ******************************************************************************/
l2c_fcr_cleanup(tL2C_CCB * p_ccb)210 void l2c_fcr_cleanup(tL2C_CCB* p_ccb) {
211   CHECK(p_ccb != NULL);
212   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
213 
214   alarm_free(p_fcrb->mon_retrans_timer);
215   p_fcrb->mon_retrans_timer = NULL;
216   alarm_free(p_fcrb->ack_timer);
217   p_fcrb->ack_timer = NULL;
218 
219   osi_free_and_reset((void**)&p_fcrb->p_rx_sdu);
220 
221   fixed_queue_free(p_fcrb->waiting_for_ack_q, osi_free);
222   p_fcrb->waiting_for_ack_q = NULL;
223 
224   fixed_queue_free(p_fcrb->srej_rcv_hold_q, osi_free);
225   p_fcrb->srej_rcv_hold_q = NULL;
226 
227   fixed_queue_free(p_fcrb->retrans_q, osi_free);
228   p_fcrb->retrans_q = NULL;
229 
230 #if (L2CAP_ERTM_STATS == TRUE)
231   if ((p_ccb->local_cid >= L2CAP_BASE_APPL_CID) &&
232       (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)) {
233     uint64_t dur = bluetooth::common::time_get_os_boottime_ms() -
234                    p_ccb->fcrb.connect_tick_count;
235     size_t p_str_size = 120;
236     char* p_str = (char*)osi_malloc(p_str_size);
237     uint16_t i;
238     uint32_t throughput_avg, ack_delay_avg, ack_q_count_avg;
239 
240     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
241              TRACE_TYPE_GENERIC,
242              "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums",
243              p_ccb->local_cid, dur);
244     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
245              TRACE_TYPE_GENERIC,
246              "Retransmissions:%08u Times Flow Controlled:%08u Retrans "
247              "Touts:%08u Ack Touts:%08u",
248              p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed,
249              p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
250     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
251              TRACE_TYPE_GENERIC,
252              "Times there is less than 2 packets in controller when flow "
253              "controlled:%08u",
254              p_ccb->fcrb.controller_idle);
255     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
256              TRACE_TYPE_GENERIC,
257              "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u",
258              p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz);
259 
260     snprintf(
261         p_str, p_str_size,
262         "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u "
263         "SREJ:%08u",
264         p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
265         (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
266         p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1],
267         p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
268 
269     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
270              TRACE_TYPE_GENERIC, "%s", p_str);
271 
272     snprintf(
273         p_str, p_str_size,
274         "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u "
275         "SREJ:%08u",
276         p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
277         (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
278         p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1],
279         p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
280 
281     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
282              TRACE_TYPE_GENERIC, "%s", p_str);
283 
284     throughput_avg = 0;
285     ack_delay_avg = 0;
286     ack_q_count_avg = 0;
287 
288     for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++) {
289       if (i == p_ccb->fcrb.ack_delay_avg_index) {
290         BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
291                  TRACE_TYPE_GENERIC, "[%02u] collecting data ...", i);
292         continue;
293       }
294 
295       snprintf(p_str, p_str_size,
296                "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, "
297                "ack_q_count avg:%3u, min:%3u, max:%3u",
298                i, p_ccb->fcrb.throughput[i], p_ccb->fcrb.ack_delay_avg[i],
299                p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
300                p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i],
301                p_ccb->fcrb.ack_q_count_max[i]);
302 
303       BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
304                TRACE_TYPE_GENERIC, "%s", p_str);
305 
306       throughput_avg += p_ccb->fcrb.throughput[i];
307       ack_delay_avg += p_ccb->fcrb.ack_delay_avg[i];
308       ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
309     }
310 
311     throughput_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
312     ack_delay_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
313     ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
314 
315     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
316              TRACE_TYPE_GENERIC,
317              "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, "
318              "ack_q_count_avg: %8u",
319              throughput_avg, ack_delay_avg, ack_q_count_avg);
320 
321     osi_free(p_str);
322 
323     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
324              TRACE_TYPE_GENERIC, "---");
325   }
326 #endif
327 
328   memset(p_fcrb, 0, sizeof(tL2C_FCRB));
329 }
330 
331 /*******************************************************************************
332  *
333  * Function         l2c_fcr_clone_buf
334  *
335  * Description      This function allocates and copies requested part of a
336  *                  buffer at a new-offset.
337  *
338  * Returns          pointer to new buffer
339  *
340  ******************************************************************************/
l2c_fcr_clone_buf(BT_HDR * p_buf,uint16_t new_offset,uint16_t no_of_bytes)341 BT_HDR* l2c_fcr_clone_buf(BT_HDR* p_buf, uint16_t new_offset,
342                           uint16_t no_of_bytes) {
343   CHECK(p_buf != NULL);
344   /*
345    * NOTE: We allocate extra L2CAP_FCS_LEN octets, in case we need to put
346    * the FCS (Frame Check Sequence) at the end of the buffer.
347    */
348   uint16_t buf_size = no_of_bytes + sizeof(BT_HDR) + new_offset + L2CAP_FCS_LEN;
349 #if (L2CAP_ERTM_STATS == TRUE)
350   /*
351    * NOTE: If L2CAP_ERTM_STATS is enabled, we need 4 extra octets at the
352    * end for a timestamp at the end of an I-frame.
353    */
354   buf_size += sizeof(uint32_t);
355 #endif
356   BT_HDR* p_buf2 = (BT_HDR*)osi_malloc(buf_size);
357 
358   p_buf2->offset = new_offset;
359   p_buf2->len = no_of_bytes;
360   memcpy(((uint8_t*)(p_buf2 + 1)) + p_buf2->offset,
361          ((uint8_t*)(p_buf + 1)) + p_buf->offset, no_of_bytes);
362 
363   return (p_buf2);
364 }
365 
366 /*******************************************************************************
367  *
368  * Function         l2c_fcr_is_flow_controlled
369  *
370  * Description      This function checks if the CCB is flow controlled by peer.
371  *
372  * Returns          The control word
373  *
374  ******************************************************************************/
l2c_fcr_is_flow_controlled(tL2C_CCB * p_ccb)375 bool l2c_fcr_is_flow_controlled(tL2C_CCB* p_ccb) {
376   CHECK(p_ccb != NULL);
377   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
378     /* Check if remote side flowed us off or the transmit window is full */
379     if ((p_ccb->fcrb.remote_busy) ||
380         (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) >=
381          p_ccb->peer_cfg.fcr.tx_win_sz)) {
382 #if (L2CAP_ERTM_STATS == TRUE)
383       if (!fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
384         p_ccb->fcrb.xmit_window_closed++;
385 
386         if ((p_ccb->p_lcb->sent_not_acked < 2) &&
387             (l2cb.controller_xmit_window > 0))
388           p_ccb->fcrb.controller_idle++;
389       }
390 #endif
391       return (true);
392     }
393   }
394   return (false);
395 }
396 
397 /*******************************************************************************
398  *
399  * Function         prepare_I_frame
400  *
401  * Description      This function sets the FCR variables in an I-frame that is
402  *                  about to be sent to HCI for transmission. This may be the
403  *                  first time the I-frame is sent, or a retransmission
404  *
405  * Returns          -
406  *
407  ******************************************************************************/
prepare_I_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,bool is_retransmission)408 static void prepare_I_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf,
409                             bool is_retransmission) {
410   CHECK(p_ccb != NULL);
411   CHECK(p_buf != NULL);
412   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
413   uint8_t* p;
414   uint16_t fcs;
415   uint16_t ctrl_word;
416   bool set_f_bit = p_fcrb->send_f_rsp;
417 
418   p_fcrb->send_f_rsp = false;
419 
420   if (is_retransmission) {
421     /* Get the old control word and clear out the old req_seq and F bits */
422     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
423 
424     STREAM_TO_UINT16(ctrl_word, p);
425 
426     ctrl_word &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
427   } else {
428     ctrl_word = p_buf->layer_specific & L2CAP_FCR_SEG_BITS; /* SAR bits */
429     ctrl_word |=
430         (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT); /* Tx Seq */
431 
432     p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
433   }
434 
435   /* Set the F-bit and reqseq only if using re-transmission mode */
436   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
437     if (set_f_bit) ctrl_word |= L2CAP_FCR_F_BIT;
438 
439     ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
440 
441     p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
442 
443     alarm_cancel(p_ccb->fcrb.ack_timer);
444   }
445 
446   /* Set the control word */
447   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
448 
449   UINT16_TO_STREAM(p, ctrl_word);
450 
451   /* Compute the FCS and add to the end of the buffer if not bypassed */
452   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
453     /* length field in l2cap header has to include FCS length */
454     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
455     UINT16_TO_STREAM(p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
456 
457     /* Calculate the FCS */
458     fcs = l2c_fcr_tx_get_fcs(p_buf);
459 
460     /* Point to the end of the buffer and put the FCS there */
461     /*
462      * NOTE: Here we assume the allocated buffer is large enough
463      * to include extra L2CAP_FCS_LEN octets at the end.
464      */
465     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len;
466 
467     UINT16_TO_STREAM(p, fcs);
468 
469     p_buf->len += L2CAP_FCS_LEN;
470   }
471 
472   if (is_retransmission) {
473     L2CAP_TRACE_EVENT(
474         "L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  "
475         "ReqSeq: %u  F: %u",
476         p_ccb->local_cid, p_buf->len,
477         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
478         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
479         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
480         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
481   } else {
482     L2CAP_TRACE_EVENT(
483         "L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  "
484         "ReqSeq: %u  F: %u",
485         p_ccb->local_cid, p_buf->len,
486         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
487         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
488         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
489         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
490   }
491 
492   /* Start the retransmission timer if not already running */
493   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
494     l2c_fcr_start_timer(p_ccb);
495 }
496 
497 /*******************************************************************************
498  *
499  * Function         l2c_fcr_send_S_frame
500  *
501  * Description      This function formats and sends an S-frame for transmission.
502  *
503  * Returns          -
504  *
505  ******************************************************************************/
l2c_fcr_send_S_frame(tL2C_CCB * p_ccb,uint16_t function_code,uint16_t pf_bit)506 void l2c_fcr_send_S_frame(tL2C_CCB* p_ccb, uint16_t function_code,
507                           uint16_t pf_bit) {
508   CHECK(p_ccb != NULL);
509   uint8_t* p;
510   uint16_t ctrl_word;
511   uint16_t fcs;
512 
513   if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN)) return;
514 
515 #if (L2CAP_ERTM_STATS == TRUE)
516   p_ccb->fcrb.s_frames_sent[function_code]++;
517 #endif
518 
519   if (pf_bit == L2CAP_FCR_P_BIT) {
520     p_ccb->fcrb.wait_ack = true;
521 
522     l2c_fcr_stop_timer(p_ccb); /* Restart the monitor timer */
523     l2c_fcr_start_timer(p_ccb);
524   }
525 
526   /* Create the control word to use */
527   ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
528   ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
529   ctrl_word |= pf_bit;
530 
531   BT_HDR* p_buf = (BT_HDR*)osi_malloc(L2CAP_CMD_BUF_SIZE);
532   p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
533   p_buf->len = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
534 
535   /* Set the pointer to the beginning of the data */
536   p = (uint8_t*)(p_buf + 1) + p_buf->offset;
537 
538   /* Put in the L2CAP header */
539   UINT16_TO_STREAM(p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
540   UINT16_TO_STREAM(p, p_ccb->remote_cid);
541   UINT16_TO_STREAM(p, ctrl_word);
542 
543   /* Compute the FCS and add to the end of the buffer if not bypassed */
544   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
545     fcs = l2c_fcr_tx_get_fcs(p_buf);
546 
547     UINT16_TO_STREAM(p, fcs);
548     p_buf->len += L2CAP_FCS_LEN;
549   } else {
550     /* rewrite the length without FCS length */
551     p -= 6;
552     UINT16_TO_STREAM(p, L2CAP_FCR_OVERHEAD);
553   }
554 
555   /* Now, the HCI transport header */
556   p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
557   l2cu_set_acl_hci_header(p_buf, p_ccb);
558 
559   if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1) ||
560       (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3)) {
561     L2CAP_TRACE_WARNING(
562         "L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  "
563         "ReqSeq: %u  P: %u  F: %u",
564         p_ccb->local_cid, ctrl_word,
565         SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
566         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
567         (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
568         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
569     L2CAP_TRACE_WARNING("                  Buf Len: %u", p_buf->len);
570   } else {
571     L2CAP_TRACE_EVENT(
572         "L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  "
573         "ReqSeq: %u  P: %u  F: %u",
574         p_ccb->local_cid, ctrl_word,
575         SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
576         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
577         (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
578         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
579     L2CAP_TRACE_EVENT("                  Buf Len: %u", p_buf->len);
580   }
581 
582   l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, p_buf);
583 
584   p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
585 
586   alarm_cancel(p_ccb->fcrb.ack_timer);
587 }
588 
589 /*******************************************************************************
590  *
591  * Function         l2c_fcr_proc_pdu
592  *
593  * Description      This function is the entry point for processing of a
594  *                  received PDU when in flow control and/or retransmission
595  *                  modes.
596  *
597  * Returns          -
598  *
599  ******************************************************************************/
l2c_fcr_proc_pdu(tL2C_CCB * p_ccb,BT_HDR * p_buf)600 void l2c_fcr_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
601   CHECK(p_ccb != NULL);
602   CHECK(p_buf != NULL);
603   uint8_t* p;
604   uint16_t fcs;
605   uint16_t min_pdu_len;
606   uint16_t ctrl_word;
607 
608   /* Check the length */
609   min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS)
610                     ? (uint16_t)L2CAP_FCR_OVERHEAD
611                     : (uint16_t)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
612 
613   if (p_buf->len < min_pdu_len) {
614     L2CAP_TRACE_WARNING("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u",
615                         p_ccb->local_cid, p_buf->len);
616     osi_free(p_buf);
617     return;
618   }
619 
620   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE) {
621     process_stream_frame(p_ccb, p_buf);
622     return;
623   }
624 
625   /* Get the control word */
626   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
627   STREAM_TO_UINT16(ctrl_word, p);
628 
629   if (ctrl_word & L2CAP_FCR_S_FRAME_BIT) {
630     if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1) ||
631         (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3)) {
632       /* REJ or SREJ */
633       L2CAP_TRACE_WARNING(
634           "L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  "
635           "P: %u  F: %u",
636           p_ccb->local_cid, p_buf->len,
637           SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
638           (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
639           (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
640           (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
641     } else {
642       L2CAP_TRACE_EVENT(
643           "L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  "
644           "P: %u  F: %u",
645           p_ccb->local_cid, p_buf->len,
646           SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
647           (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
648           (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
649           (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
650     }
651   } else {
652     L2CAP_TRACE_EVENT(
653         "L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  "
654         "ReqSeq: %u  F: %u",
655         p_ccb->local_cid, p_buf->len,
656         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
657         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
658         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
659         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
660   }
661 
662   L2CAP_TRACE_EVENT(
663       "      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt "
664       "%u, wt_q.cnt %u, tries %u",
665       p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack,
666       p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent,
667       fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q), p_ccb->fcrb.num_tries);
668 
669   /* Verify FCS if using */
670   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
671     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
672 
673     /* Extract and drop the FCS from the packet */
674     STREAM_TO_UINT16(fcs, p);
675     p_buf->len -= L2CAP_FCS_LEN;
676 
677     if (l2c_fcr_rx_get_fcs(p_buf) != fcs) {
678       L2CAP_TRACE_WARNING("Rx L2CAP PDU: CID: 0x%04x  BAD FCS",
679                           p_ccb->local_cid);
680       osi_free(p_buf);
681       return;
682     }
683   }
684 
685   /* Get the control word */
686   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
687 
688   STREAM_TO_UINT16(ctrl_word, p);
689 
690   p_buf->len -= L2CAP_FCR_OVERHEAD;
691   p_buf->offset += L2CAP_FCR_OVERHEAD;
692 
693   /* If we had a poll bit outstanding, check if we got a final response */
694   if (p_ccb->fcrb.wait_ack) {
695     /* If final bit not set, ignore the frame unless it is a polled S-frame */
696     if (!(ctrl_word & L2CAP_FCR_F_BIT)) {
697       if ((ctrl_word & L2CAP_FCR_P_BIT) &&
698           (ctrl_word & L2CAP_FCR_S_FRAME_BIT)) {
699         if (p_ccb->fcrb.srej_sent)
700           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
701         else if (p_ccb->fcrb.local_busy)
702           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
703         else
704           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
705 
706         /* Got a poll while in wait_ack state, so re-start our timer with
707          * 1-second */
708         /* This is a small optimization... the monitor timer is 12 secs, but we
709          * saw */
710         /* that if the other side sends us a poll when we are waiting for a
711          * final,  */
712         /* then it speeds up recovery significantly if we poll him back soon
713          * after his poll. */
714         alarm_set_on_mloop(p_ccb->fcrb.mon_retrans_timer, BT_1SEC_TIMEOUT_MS,
715                            l2c_ccb_timer_timeout, p_ccb);
716       }
717       osi_free(p_buf);
718       return;
719     }
720 
721     p_ccb->fcrb.wait_ack = false;
722 
723     /* P and F are mutually exclusive */
724     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT) ctrl_word &= ~L2CAP_FCR_P_BIT;
725 
726     if (fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
727       p_ccb->fcrb.num_tries = 0;
728 
729     l2c_fcr_stop_timer(p_ccb);
730   } else {
731     /* Otherwise, ensure the final bit is ignored */
732     ctrl_word &= ~L2CAP_FCR_F_BIT;
733   }
734 
735   /* Process receive sequence number */
736   if (!process_reqseq(p_ccb, ctrl_word)) {
737     osi_free(p_buf);
738     return;
739   }
740 
741   /* Process based on whether it is an S-frame or an I-frame */
742   if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
743     process_s_frame(p_ccb, p_buf, ctrl_word);
744   else
745     process_i_frame(p_ccb, p_buf, ctrl_word, false);
746 
747   /* Return if the channel got disconnected by a bad packet or max
748    * retransmissions */
749   if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN)) return;
750 
751   /* If we have some buffers held while doing SREJ, and SREJ has cleared,
752    * process them now */
753   if ((!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) &&
754       (!fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q))) {
755     fixed_queue_t* temp_q = p_ccb->fcrb.srej_rcv_hold_q;
756     p_ccb->fcrb.srej_rcv_hold_q = fixed_queue_new(SIZE_MAX);
757 
758     while ((p_buf = (BT_HDR*)fixed_queue_try_dequeue(temp_q)) != NULL) {
759       if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN)) {
760         /* Get the control word */
761         p = ((uint8_t*)(p_buf + 1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
762 
763         STREAM_TO_UINT16(ctrl_word, p);
764 
765         L2CAP_TRACE_DEBUG(
766             "l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   "
767             "TxSeq: %u  Expected_Seq: %u",
768             p_ccb->local_cid,
769             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
770             p_ccb->fcrb.next_seq_expected);
771 
772         /* Process the SREJ held I-frame, but do not send an RR for each
773          * individual frame */
774         process_i_frame(p_ccb, p_buf, ctrl_word, true);
775       } else
776         osi_free(p_buf);
777 
778       /* If more frames were lost during SREJ, send a REJ */
779       if (p_ccb->fcrb.rej_after_srej) {
780         p_ccb->fcrb.rej_after_srej = false;
781         p_ccb->fcrb.rej_sent = true;
782 
783         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_REJ, 0);
784       }
785     }
786     fixed_queue_free(temp_q, NULL);
787 
788     /* Now, if needed, send one RR for the whole held queue */
789     if ((!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) &&
790         (!p_ccb->fcrb.srej_sent) &&
791         (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent))
792       l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, 0);
793     else {
794       L2CAP_TRACE_DEBUG(
795           "l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d "
796           "rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
797           p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent,
798           p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
799           p_ccb->fcrb.last_ack_sent);
800     }
801   }
802 
803   /* If a window has opened, check if we can send any more packets */
804   if ((!fixed_queue_is_empty(p_ccb->fcrb.retrans_q) ||
805        !fixed_queue_is_empty(p_ccb->xmit_hold_q)) &&
806       (!p_ccb->fcrb.wait_ack) && (!l2c_fcr_is_flow_controlled(p_ccb))) {
807     l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, NULL);
808   }
809 }
810 
811 /*******************************************************************************
812  *
813  * Function         l2c_lcc_proc_pdu
814  *
815  * Description      This function is the entry point for processing of a
816  *                  received PDU when in LE Coc flow control modes.
817  *
818  * Returns          -
819  *
820  ******************************************************************************/
l2c_lcc_proc_pdu(tL2C_CCB * p_ccb,BT_HDR * p_buf)821 void l2c_lcc_proc_pdu(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
822   CHECK(p_ccb != NULL);
823   CHECK(p_buf != NULL);
824   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
825   uint16_t sdu_length;
826   BT_HDR* p_data = NULL;
827 
828   /* Buffer length should not exceed local mps */
829   if (p_buf->len > p_ccb->local_conn_cfg.mps) {
830     /* Discard the buffer */
831     osi_free(p_buf);
832     return;
833   }
834 
835   if (p_ccb->is_first_seg) {
836     if (p_buf->len < sizeof(sdu_length)) {
837       L2CAP_TRACE_ERROR("%s: buffer length=%d too small. Need at least 2.",
838                         __func__, p_buf->len);
839       android_errorWriteWithInfoLog(0x534e4554, "120665616", -1, NULL, 0);
840       /* Discard the buffer */
841       osi_free(p_buf);
842       return;
843     }
844     STREAM_TO_UINT16(sdu_length, p);
845 
846     /* Check the SDU Length with local MTU size */
847     if (sdu_length > p_ccb->local_conn_cfg.mtu) {
848       /* Discard the buffer */
849       osi_free(p_buf);
850       return;
851     }
852 
853     p_buf->len -= sizeof(sdu_length);
854     p_buf->offset += sizeof(sdu_length);
855 
856     if (sdu_length < p_buf->len) {
857       L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);
858       android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);
859       /* Discard the buffer */
860       osi_free(p_buf);
861       return;
862     }
863 
864     p_data = (BT_HDR*)osi_malloc(BT_HDR_SIZE + sdu_length);
865     if (p_data == NULL) {
866       osi_free(p_buf);
867       return;
868     }
869 
870     p_ccb->ble_sdu = p_data;
871     p_data->len = 0;
872     p_ccb->ble_sdu_length = sdu_length;
873     L2CAP_TRACE_DEBUG("%s SDU Length = %d", __func__, sdu_length);
874     p_data->offset = 0;
875 
876   } else {
877     p_data = p_ccb->ble_sdu;
878     if (p_buf->len > (p_ccb->ble_sdu_length - p_data->len)) {
879       L2CAP_TRACE_ERROR("%s: buffer length=%d too big. max=%d. Dropped",
880                         __func__, p_data->len,
881                         (p_ccb->ble_sdu_length - p_data->len));
882       android_errorWriteWithInfoLog(0x534e4554, "75298652", -1, NULL, 0);
883       osi_free(p_buf);
884 
885       /* Throw away all pending fragments and disconnects */
886       p_ccb->is_first_seg = true;
887       osi_free(p_ccb->ble_sdu);
888       p_ccb->ble_sdu = NULL;
889       p_ccb->ble_sdu_length = 0;
890       l2cu_disconnect_chnl(p_ccb);
891       return;
892     }
893   }
894 
895   memcpy((uint8_t*)(p_data + 1) + p_data->offset + p_data->len,
896          (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len);
897   p_data->len += p_buf->len;
898   p = (uint8_t*)(p_data + 1) + p_data->offset;
899   if (p_data->len == p_ccb->ble_sdu_length) {
900     l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DATA, p_data);
901     p_ccb->is_first_seg = true;
902     p_ccb->ble_sdu = NULL;
903     p_ccb->ble_sdu_length = 0;
904   } else if (p_data->len < p_ccb->ble_sdu_length) {
905     p_ccb->is_first_seg = false;
906   }
907 
908   osi_free(p_buf);
909   return;
910 }
911 
912 /*******************************************************************************
913  *
914  * Function         l2c_fcr_proc_tout
915  *
916  * Description      Handle a timeout. We should be in error recovery state.
917  *
918  * Returns          -
919  *
920  ******************************************************************************/
l2c_fcr_proc_tout(tL2C_CCB * p_ccb)921 void l2c_fcr_proc_tout(tL2C_CCB* p_ccb) {
922   CHECK(p_ccb != NULL);
923   L2CAP_TRACE_DEBUG(
924       "l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  "
925       "ack_q_count: %u",
926       p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
927       p_ccb->fcrb.wait_ack, fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
928 
929 #if (L2CAP_ERTM_STATS == TRUE)
930   p_ccb->fcrb.retrans_touts++;
931 #endif
932 
933   if ((p_ccb->peer_cfg.fcr.max_transmit != 0) &&
934       (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit)) {
935     l2cu_disconnect_chnl(p_ccb);
936   } else {
937     if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent) {
938       if (p_ccb->fcrb.local_busy)
939         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
940       else
941         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
942     }
943   }
944 }
945 
946 /*******************************************************************************
947  *
948  * Function         l2c_fcr_proc_ack_tout
949  *
950  * Description      Send RR/RNR if we have not acked I frame
951  *
952  * Returns          -
953  *
954  ******************************************************************************/
l2c_fcr_proc_ack_tout(tL2C_CCB * p_ccb)955 void l2c_fcr_proc_ack_tout(tL2C_CCB* p_ccb) {
956   CHECK(p_ccb != NULL);
957   L2CAP_TRACE_DEBUG(
958       "l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d",
959       p_ccb->local_cid, p_ccb->chnl_state, p_ccb->fcrb.wait_ack,
960       p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
961 
962   if ((p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack) &&
963       (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected)) {
964 #if (L2CAP_ERTM_STATS == TRUE)
965     p_ccb->fcrb.xmit_ack_touts++;
966 #endif
967     if (p_ccb->fcrb.local_busy)
968       l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, 0);
969     else
970       l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, 0);
971   }
972 }
973 
974 /*******************************************************************************
975  *
976  * Function         process_reqseq
977  *
978  * Description      Handle receive sequence number
979  *
980  * Returns          -
981  *
982  ******************************************************************************/
process_reqseq(tL2C_CCB * p_ccb,uint16_t ctrl_word)983 static bool process_reqseq(tL2C_CCB* p_ccb, uint16_t ctrl_word) {
984   CHECK(p_ccb != NULL);
985   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
986   uint8_t req_seq, num_bufs_acked, xx;
987   uint16_t ls;
988   uint16_t full_sdus_xmitted;
989 
990   /* Receive sequence number does not ack anything for SREJ with P-bit set to
991    * zero */
992   if ((ctrl_word & L2CAP_FCR_S_FRAME_BIT) &&
993       ((ctrl_word & L2CAP_FCR_SUP_BITS) ==
994        (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT)) &&
995       ((ctrl_word & L2CAP_FCR_P_BIT) == 0)) {
996     /* If anything still waiting for ack, restart the timer if it was stopped */
997     if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
998       l2c_fcr_start_timer(p_ccb);
999 
1000     return (true);
1001   }
1002 
1003   /* Extract the receive sequence number from the control word */
1004   req_seq =
1005       (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
1006 
1007   num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
1008 
1009   /* Verify the request sequence is in range before proceeding */
1010   if (num_bufs_acked > fixed_queue_length(p_fcrb->waiting_for_ack_q)) {
1011     /* The channel is closed if ReqSeq is not in range */
1012     L2CAP_TRACE_WARNING(
1013         "L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  "
1014         "last_rx_ack: 0x%02x  QCount: %u",
1015         ctrl_word, req_seq, p_fcrb->last_rx_ack,
1016         fixed_queue_length(p_fcrb->waiting_for_ack_q));
1017 
1018     l2cu_disconnect_chnl(p_ccb);
1019     return (false);
1020   }
1021 
1022   p_fcrb->last_rx_ack = req_seq;
1023 
1024   /* Now we can release all acknowledged frames, and restart the retransmission
1025    * timer if needed */
1026   if (num_bufs_acked != 0) {
1027     p_fcrb->num_tries = 0;
1028     full_sdus_xmitted = 0;
1029 
1030 #if (L2CAP_ERTM_STATS == TRUE)
1031     l2c_fcr_collect_ack_delay(p_ccb, num_bufs_acked);
1032 #endif
1033 
1034     for (xx = 0; xx < num_bufs_acked; xx++) {
1035       BT_HDR* p_tmp =
1036           (BT_HDR*)fixed_queue_try_dequeue(p_fcrb->waiting_for_ack_q);
1037       ls = p_tmp->layer_specific & L2CAP_FCR_SAR_BITS;
1038 
1039       if ((ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU))
1040         full_sdus_xmitted++;
1041 
1042       osi_free(p_tmp);
1043     }
1044 
1045     /* If we are still in a wait_ack state, do not mess with the timer */
1046     if (!p_ccb->fcrb.wait_ack) l2c_fcr_stop_timer(p_ccb);
1047 
1048     /* Check if we need to call the "packet_sent" callback */
1049     if ((p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) &&
1050         (full_sdus_xmitted)) {
1051       /* Special case for eRTM, if all packets sent, send 0xFFFF */
1052       if (fixed_queue_is_empty(p_fcrb->waiting_for_ack_q) &&
1053           fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
1054         full_sdus_xmitted = 0xFFFF;
1055       }
1056 
1057       (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid,
1058                                                full_sdus_xmitted);
1059     }
1060   }
1061 
1062   /* If anything still waiting for ack, restart the timer if it was stopped */
1063   if (!fixed_queue_is_empty(p_fcrb->waiting_for_ack_q))
1064     l2c_fcr_start_timer(p_ccb);
1065   return (true);
1066 }
1067 
1068 /*******************************************************************************
1069  *
1070  * Function         process_s_frame
1071  *
1072  * Description      Process an S frame
1073  *
1074  * Returns          -
1075  *
1076  ******************************************************************************/
process_s_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,uint16_t ctrl_word)1077 static void process_s_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf,
1078                             uint16_t ctrl_word) {
1079   CHECK(p_ccb != NULL);
1080   CHECK(p_buf != NULL);
1081 
1082   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
1083   uint16_t s_frame_type =
1084       (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
1085   bool remote_was_busy;
1086   bool all_ok = true;
1087 
1088   if (p_buf->len != 0) {
1089     L2CAP_TRACE_WARNING("Incorrect S-frame Length (%d)", p_buf->len);
1090   }
1091 
1092   L2CAP_TRACE_DEBUG("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d",
1093                     ctrl_word, p_fcrb->remote_busy);
1094 
1095 #if (L2CAP_ERTM_STATS == TRUE)
1096   p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
1097 #endif
1098 
1099   if (ctrl_word & L2CAP_FCR_P_BIT) {
1100     p_fcrb->rej_sent = false;  /* After checkpoint, we can send anoher REJ */
1101     p_fcrb->send_f_rsp = true; /* Set a flag in case an I-frame is pending */
1102   }
1103 
1104   switch (s_frame_type) {
1105     case L2CAP_FCR_SUP_RR:
1106       remote_was_busy = p_fcrb->remote_busy;
1107       p_fcrb->remote_busy = false;
1108 
1109       if ((ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy))
1110         all_ok = retransmit_i_frames(p_ccb, L2C_FCR_RETX_ALL_PKTS);
1111       break;
1112 
1113     case L2CAP_FCR_SUP_REJ:
1114       p_fcrb->remote_busy = false;
1115       all_ok = retransmit_i_frames(p_ccb, L2C_FCR_RETX_ALL_PKTS);
1116       break;
1117 
1118     case L2CAP_FCR_SUP_RNR:
1119       p_fcrb->remote_busy = true;
1120       l2c_fcr_stop_timer(p_ccb);
1121       break;
1122 
1123     case L2CAP_FCR_SUP_SREJ:
1124       p_fcrb->remote_busy = false;
1125       all_ok = retransmit_i_frames(
1126           p_ccb, (uint8_t)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >>
1127                            L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
1128       break;
1129   }
1130 
1131   if (all_ok) {
1132     /* If polled, we need to respond with F-bit. Note, we may have sent a
1133      * I-frame with the F-bit */
1134     if (p_fcrb->send_f_rsp) {
1135       if (p_fcrb->srej_sent)
1136         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
1137       else if (p_fcrb->local_busy)
1138         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
1139       else
1140         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
1141 
1142       p_fcrb->send_f_rsp = false;
1143     }
1144   } else {
1145     L2CAP_TRACE_DEBUG("process_s_frame hit_max_retries");
1146   }
1147 
1148   osi_free(p_buf);
1149 }
1150 
1151 /*******************************************************************************
1152  *
1153  * Function         process_i_frame
1154  *
1155  * Description      Process an I frame
1156  *
1157  * Returns          -
1158  *
1159  ******************************************************************************/
process_i_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,uint16_t ctrl_word,bool delay_ack)1160 static void process_i_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf, uint16_t ctrl_word,
1161                             bool delay_ack) {
1162   CHECK(p_ccb != NULL);
1163   CHECK(p_buf != NULL);
1164 
1165   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
1166   uint8_t tx_seq, num_lost, num_to_ack, next_srej;
1167 
1168   /* If we were doing checkpoint recovery, first retransmit all unacked I-frames
1169    */
1170   if (ctrl_word & L2CAP_FCR_F_BIT) {
1171     if (!retransmit_i_frames(p_ccb, L2C_FCR_RETX_ALL_PKTS)) {
1172       osi_free(p_buf);
1173       return;
1174     }
1175   }
1176 
1177 #if (L2CAP_ERTM_STATS == TRUE)
1178   p_ccb->fcrb.ertm_pkt_counts[1]++;
1179   p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
1180 #endif
1181 
1182   /* Extract the sequence number */
1183   tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1184 
1185   /* If we have flow controlled the peer, ignore any bad I-frames from him */
1186   if ((tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy)) {
1187     L2CAP_TRACE_WARNING("Dropping bad I-Frame since we flowed off, tx_seq:%u",
1188                         tx_seq);
1189     l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, 0);
1190     osi_free(p_buf);
1191     return;
1192   }
1193 
1194   /* Check if tx-sequence is the expected one */
1195   if (tx_seq != p_fcrb->next_seq_expected) {
1196     num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
1197 
1198     /* Is the frame a duplicate ? If so, just drop it */
1199     if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz) {
1200       /* Duplicate - simply drop it */
1201       L2CAP_TRACE_WARNING(
1202           "process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq "
1203           "%u",
1204           tx_seq, p_fcrb->next_seq_expected);
1205       osi_free(p_buf);
1206     } else {
1207       L2CAP_TRACE_WARNING(
1208           "process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  "
1209           "Rej: %u  SRej: %u",
1210           p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected,
1211           p_fcrb->rej_sent, p_fcrb->srej_sent);
1212 
1213       if (p_fcrb->srej_sent) {
1214         /* If SREJ sent, save the frame for later processing as long as it is in
1215          * sequence */
1216         next_srej =
1217             (((BT_HDR*)fixed_queue_try_peek_last(p_fcrb->srej_rcv_hold_q))
1218                  ->layer_specific +
1219              1) &
1220             L2CAP_FCR_SEQ_MODULO;
1221 
1222         if ((tx_seq == next_srej) &&
1223             (fixed_queue_length(p_fcrb->srej_rcv_hold_q) <
1224              p_ccb->our_cfg.fcr.tx_win_sz)) {
1225           /* If user gave us a pool for held rx buffers, use that */
1226           /* TODO: Could that happen? Get rid of this code. */
1227           if (p_ccb->ertm_info.fcr_rx_buf_size != L2CAP_FCR_RX_BUF_SIZE) {
1228             BT_HDR* p_buf2;
1229 
1230             /* Adjust offset and len so that control word is copied */
1231             p_buf->offset -= L2CAP_FCR_OVERHEAD;
1232             p_buf->len += L2CAP_FCR_OVERHEAD;
1233 
1234             p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
1235 
1236             if (p_buf2) {
1237               osi_free(p_buf);
1238               p_buf = p_buf2;
1239             }
1240             p_buf->offset += L2CAP_FCR_OVERHEAD;
1241             p_buf->len -= L2CAP_FCR_OVERHEAD;
1242           }
1243           L2CAP_TRACE_DEBUG(
1244               "process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  "
1245               "SRej1",
1246               num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
1247 
1248           p_buf->layer_specific = tx_seq;
1249           fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
1250         } else {
1251           L2CAP_TRACE_WARNING(
1252               "process_i_frame() CID: 0x%04x  frame dropped in Srej Sent "
1253               "next_srej:%u  hold_q.count:%u  win_sz:%u",
1254               p_ccb->local_cid, next_srej,
1255               fixed_queue_length(p_fcrb->srej_rcv_hold_q),
1256               p_ccb->our_cfg.fcr.tx_win_sz);
1257 
1258           p_fcrb->rej_after_srej = true;
1259           osi_free(p_buf);
1260         }
1261       } else if (p_fcrb->rej_sent) {
1262         L2CAP_TRACE_WARNING(
1263             "process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  "
1264             "Rej: 1  SRej: %u",
1265             p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected,
1266             p_fcrb->srej_sent);
1267 
1268         /* If REJ sent, just drop the frame */
1269         osi_free(p_buf);
1270       } else {
1271         L2CAP_TRACE_DEBUG(
1272             "process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
1273             p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected,
1274             p_fcrb->rej_sent);
1275 
1276         /* If only one lost, we will send SREJ, otherwise we will send REJ */
1277         if (num_lost > 1) {
1278           osi_free(p_buf);
1279           p_fcrb->rej_sent = true;
1280           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_REJ, 0);
1281         } else {
1282           if (!fixed_queue_is_empty(p_fcrb->srej_rcv_hold_q)) {
1283             L2CAP_TRACE_ERROR(
1284                 "process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d "
1285                 "hold_q.count:%u",
1286                 p_ccb->local_cid, tx_seq,
1287                 fixed_queue_length(p_fcrb->srej_rcv_hold_q));
1288           }
1289           p_buf->layer_specific = tx_seq;
1290           fixed_queue_enqueue(p_fcrb->srej_rcv_hold_q, p_buf);
1291           p_fcrb->srej_sent = true;
1292           l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_SREJ, 0);
1293         }
1294         alarm_cancel(p_ccb->fcrb.ack_timer);
1295       }
1296     }
1297     return;
1298   }
1299 
1300   /* Seq number is the next expected. Clear possible reject exception in case it
1301    * occured */
1302   p_fcrb->rej_sent = p_fcrb->srej_sent = false;
1303 
1304   /* Adjust the next_seq, so that if the upper layer sends more data in the
1305      callback
1306      context, the received frame is acked by an I-frame. */
1307   p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
1308 
1309   /* If any SAR problem in eRTM mode, spec says disconnect. */
1310   if (!do_sar_reassembly(p_ccb, p_buf, ctrl_word)) {
1311     L2CAP_TRACE_WARNING("process_i_frame() CID: 0x%04x  reassembly failed",
1312                         p_ccb->local_cid);
1313     l2cu_disconnect_chnl(p_ccb);
1314     return;
1315   }
1316 
1317   /* RR optimization - if peer can still send us more, then start an ACK timer
1318    */
1319   num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) &
1320                L2CAP_FCR_SEQ_MODULO;
1321 
1322   if ((num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy))
1323     delay_ack = true;
1324 
1325   /* We should neve never ack frame if we are not in OPEN state */
1326   if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN)) {
1327     /* If no frames are awaiting transmission or are held, send an RR or RNR
1328      * S-frame for ack */
1329     if (delay_ack) {
1330       /* If it is the first I frame we did not ack, start ack timer */
1331       if (!alarm_is_scheduled(p_ccb->fcrb.ack_timer)) {
1332         alarm_set_on_mloop(p_ccb->fcrb.ack_timer, L2CAP_FCR_ACK_TIMEOUT_MS,
1333                            l2c_fcrb_ack_timer_timeout, p_ccb);
1334       }
1335     } else if ((fixed_queue_is_empty(p_ccb->xmit_hold_q) ||
1336                 l2c_fcr_is_flow_controlled(p_ccb)) &&
1337                fixed_queue_is_empty(p_ccb->fcrb.srej_rcv_hold_q)) {
1338       if (p_fcrb->local_busy)
1339         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RNR, 0);
1340       else
1341         l2c_fcr_send_S_frame(p_ccb, L2CAP_FCR_SUP_RR, 0);
1342     }
1343   }
1344 }
1345 
1346 /*******************************************************************************
1347  *
1348  * Function         process_stream_frame
1349  *
1350  * Description      This function processes frames in streaming mode
1351  *
1352  * Returns          -
1353  *
1354  ******************************************************************************/
process_stream_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf)1355 static void process_stream_frame(tL2C_CCB* p_ccb, BT_HDR* p_buf) {
1356   CHECK(p_ccb != NULL);
1357   CHECK(p_buf != NULL);
1358 
1359   uint16_t ctrl_word;
1360   uint16_t fcs;
1361   uint8_t* p;
1362   uint8_t tx_seq;
1363 
1364   /* Verify FCS if using */
1365   if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
1366     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
1367 
1368     /* Extract and drop the FCS from the packet */
1369     STREAM_TO_UINT16(fcs, p);
1370     p_buf->len -= L2CAP_FCS_LEN;
1371 
1372     if (l2c_fcr_rx_get_fcs(p_buf) != fcs) {
1373       L2CAP_TRACE_WARNING("Rx L2CAP PDU: CID: 0x%04x  BAD FCS",
1374                           p_ccb->local_cid);
1375       osi_free(p_buf);
1376       return;
1377     }
1378   }
1379 
1380   /* Get the control word */
1381   p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
1382 
1383   STREAM_TO_UINT16(ctrl_word, p);
1384 
1385   p_buf->len -= L2CAP_FCR_OVERHEAD;
1386   p_buf->offset += L2CAP_FCR_OVERHEAD;
1387 
1388   /* Make sure it is an I-frame */
1389   if (ctrl_word & L2CAP_FCR_S_FRAME_BIT) {
1390     L2CAP_TRACE_WARNING(
1391         "Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: "
1392         "0x%04x",
1393         p_ccb->local_cid, ctrl_word);
1394     osi_free(p_buf);
1395     return;
1396   }
1397 
1398   L2CAP_TRACE_EVENT(
1399       "L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  "
1400       "ReqSeq: %u  F: %u",
1401       p_ccb->local_cid, p_buf->len,
1402       SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
1403       (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
1404       (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
1405       (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
1406 
1407   /* Extract the sequence number */
1408   tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1409 
1410   /* Check if tx-sequence is the expected one */
1411   if (tx_seq != p_ccb->fcrb.next_seq_expected) {
1412     L2CAP_TRACE_WARNING(
1413         "Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: "
1414         "0x%08x",
1415         p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq,
1416         p_ccb->fcrb.p_rx_sdu);
1417 
1418     /* Lost one or more packets, so flush the SAR queue */
1419     osi_free_and_reset((void**)&p_ccb->fcrb.p_rx_sdu);
1420   }
1421 
1422   p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
1423 
1424   if (!do_sar_reassembly(p_ccb, p_buf, ctrl_word)) {
1425     /* Some sort of SAR error, so flush the SAR queue */
1426     osi_free_and_reset((void**)&p_ccb->fcrb.p_rx_sdu);
1427   }
1428 }
1429 
1430 /*******************************************************************************
1431  *
1432  * Function         do_sar_reassembly
1433  *
1434  * Description      Process SAR bits and re-assemble frame
1435  *
1436  * Returns          true if all OK, else false
1437  *
1438  ******************************************************************************/
do_sar_reassembly(tL2C_CCB * p_ccb,BT_HDR * p_buf,uint16_t ctrl_word)1439 static bool do_sar_reassembly(tL2C_CCB* p_ccb, BT_HDR* p_buf,
1440                               uint16_t ctrl_word) {
1441   CHECK(p_ccb != NULL);
1442   CHECK(p_buf != NULL);
1443 
1444   tL2C_FCRB* p_fcrb = &p_ccb->fcrb;
1445   uint16_t sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
1446   bool packet_ok = true;
1447   uint8_t* p;
1448 
1449   /* Check if the SAR state is correct */
1450   if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU)) {
1451     if (p_fcrb->p_rx_sdu != NULL) {
1452       L2CAP_TRACE_WARNING(
1453           "SAR - got unexpected unsegmented or start SDU  Expected len: %u  "
1454           "Got so far: %u",
1455           p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
1456 
1457       packet_ok = false;
1458     }
1459     /* Check the length of the packet */
1460     if ((sar_type == L2CAP_FCR_START_SDU) &&
1461         (p_buf->len < L2CAP_SDU_LEN_OVERHEAD)) {
1462       L2CAP_TRACE_WARNING("SAR start packet too short: %u", p_buf->len);
1463       packet_ok = false;
1464     }
1465   } else {
1466     if (p_fcrb->p_rx_sdu == NULL) {
1467       L2CAP_TRACE_WARNING("SAR - got unexpected cont or end SDU");
1468       packet_ok = false;
1469     }
1470   }
1471 
1472   if ((packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU)) {
1473     p = ((uint8_t*)(p_buf + 1)) + p_buf->offset;
1474 
1475     /* For start SDU packet, extract the SDU length */
1476     if (sar_type == L2CAP_FCR_START_SDU) {
1477       /* Get the SDU length */
1478       STREAM_TO_UINT16(p_fcrb->rx_sdu_len, p);
1479       p_buf->offset += 2;
1480       p_buf->len -= 2;
1481 
1482       if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu) {
1483         L2CAP_TRACE_WARNING("SAR - SDU len: %u  larger than MTU: %u",
1484                             p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
1485         packet_ok = false;
1486       } else {
1487         p_fcrb->p_rx_sdu = (BT_HDR*)osi_malloc(
1488             BT_HDR_SIZE + OBX_BUF_MIN_OFFSET + p_fcrb->rx_sdu_len);
1489         p_fcrb->p_rx_sdu->offset = OBX_BUF_MIN_OFFSET;
1490         p_fcrb->p_rx_sdu->len = 0;
1491       }
1492     }
1493 
1494     if (packet_ok) {
1495       if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len) {
1496         L2CAP_TRACE_ERROR(
1497             "SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u", sar_type,
1498             p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
1499         packet_ok = false;
1500       } else if ((sar_type == L2CAP_FCR_END_SDU) &&
1501                  ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len)) {
1502         L2CAP_TRACE_WARNING("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
1503                             p_fcrb->p_rx_sdu->len, p_buf->len,
1504                             p_fcrb->rx_sdu_len);
1505         packet_ok = false;
1506       } else {
1507         memcpy(((uint8_t*)(p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset +
1508                    p_fcrb->p_rx_sdu->len,
1509                p, p_buf->len);
1510 
1511         p_fcrb->p_rx_sdu->len += p_buf->len;
1512 
1513         osi_free(p_buf);
1514         p_buf = NULL;
1515 
1516         if (sar_type == L2CAP_FCR_END_SDU) {
1517           p_buf = p_fcrb->p_rx_sdu;
1518           p_fcrb->p_rx_sdu = NULL;
1519         }
1520       }
1521     }
1522   }
1523 
1524   if (!packet_ok) {
1525     osi_free(p_buf);
1526   } else if (p_buf != NULL) {
1527 #if (L2CAP_NUM_FIXED_CHNLS > 0)
1528     if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
1529         (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL &&
1530          p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL)) {
1531       if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL]
1532               .pL2CA_FixedData_Cb)
1533         (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL]
1534               .pL2CA_FixedData_Cb)(p_ccb->local_cid,
1535                                    p_ccb->p_lcb->remote_bd_addr, p_buf);
1536     } else
1537 #endif
1538       l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DATA, p_buf);
1539   }
1540 
1541   return (packet_ok);
1542 }
1543 
1544 /*******************************************************************************
1545  *
1546  * Function         retransmit_i_frames
1547  *
1548  * Description      This function retransmits i-frames awaiting acks.
1549  *
1550  * Returns          bool    - true if retransmitted
1551  *
1552  ******************************************************************************/
retransmit_i_frames(tL2C_CCB * p_ccb,uint8_t tx_seq)1553 static bool retransmit_i_frames(tL2C_CCB* p_ccb, uint8_t tx_seq) {
1554   CHECK(p_ccb != NULL);
1555 
1556   BT_HDR* p_buf = NULL;
1557   uint8_t* p;
1558   uint8_t buf_seq;
1559   uint16_t ctrl_word;
1560 
1561   if ((!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q)) &&
1562       (p_ccb->peer_cfg.fcr.max_transmit != 0) &&
1563       (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit)) {
1564     L2CAP_TRACE_EVENT(
1565         "Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: "
1566         "%u) ack_q_count: %u",
1567         p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries,
1568         p_ccb->peer_cfg.fcr.max_transmit,
1569         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
1570 
1571     l2cu_disconnect_chnl(p_ccb);
1572     return (false);
1573   }
1574 
1575   /* tx_seq indicates whether to retransmit a specific sequence or all (if ==
1576    * L2C_FCR_RETX_ALL_PKTS) */
1577   list_t* list_ack = NULL;
1578   const list_node_t* node_ack = NULL;
1579   if (!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q)) {
1580     list_ack = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
1581     node_ack = list_begin(list_ack);
1582   }
1583   if (tx_seq != L2C_FCR_RETX_ALL_PKTS) {
1584     /* If sending only one, the sequence number tells us which one. Look for it.
1585     */
1586     if (list_ack != NULL) {
1587       for (; node_ack != list_end(list_ack); node_ack = list_next(node_ack)) {
1588         p_buf = (BT_HDR*)list_node(node_ack);
1589         /* Get the old control word */
1590         p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
1591 
1592         STREAM_TO_UINT16(ctrl_word, p);
1593 
1594         buf_seq =
1595             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1596 
1597         L2CAP_TRACE_DEBUG(
1598             "retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq,
1599             tx_seq);
1600 
1601         if (tx_seq == buf_seq) break;
1602       }
1603     }
1604 
1605     if (!p_buf) {
1606       L2CAP_TRACE_ERROR("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u",
1607                         tx_seq,
1608                         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q));
1609       return (true);
1610     }
1611   } else {
1612     // Iterate though list and flush the amount requested from
1613     // the transmit data queue that satisfy the layer and event conditions.
1614     for (list_node_t* node_tmp = list_begin(p_ccb->p_lcb->link_xmit_data_q);
1615          node_tmp != list_end(p_ccb->p_lcb->link_xmit_data_q);) {
1616       BT_HDR* p_tmp = (BT_HDR*)list_node(node_tmp);
1617       node_tmp = list_next(node_tmp);
1618 
1619       /* Do not flush other CIDs or partial segments */
1620       if ((p_tmp->layer_specific == 0) && (p_tmp->event == p_ccb->local_cid)) {
1621         list_remove(p_ccb->p_lcb->link_xmit_data_q, p_tmp);
1622         osi_free(p_tmp);
1623       }
1624     }
1625 
1626     /* Also flush our retransmission queue */
1627     while (!fixed_queue_is_empty(p_ccb->fcrb.retrans_q))
1628       osi_free(fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q));
1629 
1630     if (list_ack != NULL) node_ack = list_begin(list_ack);
1631   }
1632 
1633   if (list_ack != NULL) {
1634     while (node_ack != list_end(list_ack)) {
1635       p_buf = (BT_HDR*)list_node(node_ack);
1636       node_ack = list_next(node_ack);
1637 
1638       BT_HDR* p_buf2 = l2c_fcr_clone_buf(p_buf, p_buf->offset, p_buf->len);
1639       if (p_buf2) {
1640         p_buf2->layer_specific = p_buf->layer_specific;
1641 
1642         fixed_queue_enqueue(p_ccb->fcrb.retrans_q, p_buf2);
1643       }
1644 
1645       if ((tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL)) break;
1646     }
1647   }
1648 
1649   l2c_link_check_send_pkts(p_ccb->p_lcb, NULL, NULL);
1650 
1651   if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q)) {
1652     p_ccb->fcrb.num_tries++;
1653     l2c_fcr_start_timer(p_ccb);
1654   }
1655 
1656   return (true);
1657 }
1658 
1659 /*******************************************************************************
1660  *
1661  * Function         l2c_fcr_get_next_xmit_sdu_seg
1662  *
1663  * Description      Get the next SDU segment to transmit.
1664  *
1665  * Returns          pointer to buffer with segment or NULL
1666  *
1667  ******************************************************************************/
l2c_fcr_get_next_xmit_sdu_seg(tL2C_CCB * p_ccb,uint16_t max_packet_length)1668 BT_HDR* l2c_fcr_get_next_xmit_sdu_seg(tL2C_CCB* p_ccb,
1669                                       uint16_t max_packet_length) {
1670   CHECK(p_ccb != NULL);
1671 
1672   bool first_seg = false, /* The segment is the first part of data  */
1673       mid_seg = false,    /* The segment is the middle part of data */
1674       last_seg = false;   /* The segment is the last part of data   */
1675   uint16_t sdu_len = 0;
1676   BT_HDR *p_buf, *p_xmit;
1677   uint8_t* p;
1678   uint16_t max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
1679 
1680   /* If there is anything in the retransmit queue, that goes first
1681   */
1682   p_buf = (BT_HDR*)fixed_queue_try_dequeue(p_ccb->fcrb.retrans_q);
1683   if (p_buf != NULL) {
1684     /* Update Rx Seq and FCS if we acked some packets while this one was queued
1685      */
1686     prepare_I_frame(p_ccb, p_buf, true);
1687 
1688     p_buf->event = p_ccb->local_cid;
1689 
1690 #if (L2CAP_ERTM_STATS == TRUE)
1691     p_ccb->fcrb.pkts_retransmitted++;
1692     p_ccb->fcrb.ertm_pkt_counts[0]++;
1693     p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
1694 #endif
1695     return (p_buf);
1696   }
1697 
1698   /* For BD/EDR controller, max_packet_length is set to 0             */
1699   /* For AMP controller, max_packet_length is set by available blocks */
1700   if ((max_packet_length > L2CAP_MAX_HEADER_FCS) &&
1701       (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length)) {
1702     max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
1703   }
1704 
1705   p_buf = (BT_HDR*)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
1706 
1707   /* If there is more data than the MPS, it requires segmentation */
1708   if (p_buf->len > max_pdu) {
1709     /* We are using the "event" field to tell is if we already started
1710      * segmentation */
1711     if (p_buf->event == 0) {
1712       first_seg = true;
1713       sdu_len = p_buf->len;
1714     } else
1715       mid_seg = true;
1716 
1717     /* Get a new buffer and copy the data that can be sent in a PDU */
1718     p_xmit = l2c_fcr_clone_buf(p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
1719                                max_pdu);
1720 
1721     if (p_xmit != NULL) {
1722       p_buf->event = p_ccb->local_cid;
1723       p_xmit->event = p_ccb->local_cid;
1724 
1725       p_buf->len -= max_pdu;
1726       p_buf->offset += max_pdu;
1727 
1728       /* copy PBF setting */
1729       p_xmit->layer_specific = p_buf->layer_specific;
1730     } else /* Should never happen if the application has configured buffers
1731               correctly */
1732     {
1733       L2CAP_TRACE_ERROR(
1734           "L2CAP - cannot get buffer for segmentation, max_pdu: %u", max_pdu);
1735       return (NULL);
1736     }
1737   } else /* Use the original buffer if no segmentation, or the last segment */
1738   {
1739     p_xmit = (BT_HDR*)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
1740 
1741     if (p_xmit->event != 0) last_seg = true;
1742 
1743     p_xmit->event = p_ccb->local_cid;
1744   }
1745 
1746   /* Step back to add the L2CAP headers */
1747   p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
1748   p_xmit->len += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
1749 
1750   if (first_seg) {
1751     p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
1752     p_xmit->len += L2CAP_SDU_LEN_OVERHEAD;
1753   }
1754 
1755   /* Set the pointer to the beginning of the data */
1756   p = (uint8_t*)(p_xmit + 1) + p_xmit->offset;
1757 
1758   /* Now the L2CAP header */
1759 
1760   /* Note: if FCS has to be included then the length is recalculated later */
1761   UINT16_TO_STREAM(p, p_xmit->len - L2CAP_PKT_OVERHEAD);
1762 
1763   UINT16_TO_STREAM(p, p_ccb->remote_cid);
1764 
1765   if (first_seg) {
1766     /* Skip control word and add SDU length */
1767     p += 2;
1768     UINT16_TO_STREAM(p, sdu_len);
1769 
1770     /* We will store the SAR type in layer-specific */
1771     /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
1772     p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
1773 
1774     first_seg = false;
1775   } else if (mid_seg)
1776     p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
1777   else if (last_seg)
1778     p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
1779   else
1780     p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
1781 
1782   prepare_I_frame(p_ccb, p_xmit, false);
1783 
1784   if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
1785     BT_HDR* p_wack =
1786         l2c_fcr_clone_buf(p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len);
1787 
1788     if (!p_wack) {
1789       L2CAP_TRACE_ERROR(
1790           "L2CAP - no buffer for xmit cloning, CID: 0x%04x  Length: %u",
1791           p_ccb->local_cid, p_xmit->len);
1792 
1793       /* We will not save the FCS in case we reconfigure and change options */
1794       if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) p_xmit->len -= L2CAP_FCS_LEN;
1795 
1796       /* Pretend we sent it and it got lost */
1797       fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_xmit);
1798       return (NULL);
1799     } else {
1800 #if (L2CAP_ERTM_STATS == TRUE)
1801       /* set timestamp at the end of tx I-frame to get acking delay */
1802       /*
1803        * NOTE: Here we assume the allocate buffer is large enough
1804        * to include extra 4 octets at the end.
1805        */
1806       p = ((uint8_t*)(p_wack + 1)) + p_wack->offset + p_wack->len;
1807       // Have to cast to uint32_t which wraps in 49.7 days
1808       UINT32_TO_STREAM(p, static_cast<uint32_t>(
1809                               bluetooth::common::time_get_os_boottime_ms()));
1810 #endif
1811       /* We will not save the FCS in case we reconfigure and change options */
1812       if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) p_wack->len -= L2CAP_FCS_LEN;
1813 
1814       p_wack->layer_specific = p_xmit->layer_specific;
1815       fixed_queue_enqueue(p_ccb->fcrb.waiting_for_ack_q, p_wack);
1816     }
1817 
1818 #if (L2CAP_ERTM_STATS == TRUE)
1819     p_ccb->fcrb.ertm_pkt_counts[0]++;
1820     p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
1821 #endif
1822   }
1823 
1824   return (p_xmit);
1825 }
1826 
1827 /** Get the next PDU to transmit for LE connection oriented channel. Returns
1828  * pointer to buffer with PDU. |last_piece_of_sdu| will be set to true, if
1829  * returned PDU is last piece from this SDU.*/
l2c_lcc_get_next_xmit_sdu_seg(tL2C_CCB * p_ccb,bool * last_piece_of_sdu)1830 BT_HDR* l2c_lcc_get_next_xmit_sdu_seg(tL2C_CCB* p_ccb,
1831                                       bool* last_piece_of_sdu) {
1832   uint16_t max_pdu = p_ccb->peer_conn_cfg.mps - 4 /* Length and CID */;
1833 
1834   BT_HDR* p_buf = (BT_HDR*)fixed_queue_try_peek_first(p_ccb->xmit_hold_q);
1835   bool first_pdu = (p_buf->event == 0) ? true : false;
1836 
1837   uint16_t no_of_bytes_to_send = std::min(
1838       p_buf->len,
1839       (uint16_t)(first_pdu ? (max_pdu - L2CAP_LCC_SDU_LENGTH) : max_pdu));
1840   bool last_pdu = (no_of_bytes_to_send == p_buf->len);
1841 
1842   /* Get a new buffer and copy the data that can be sent in a PDU */
1843   BT_HDR* p_xmit =
1844       l2c_fcr_clone_buf(p_buf, first_pdu ? L2CAP_LCC_OFFSET : L2CAP_MIN_OFFSET,
1845                         no_of_bytes_to_send);
1846 
1847   p_buf->event = p_ccb->local_cid;
1848   p_xmit->event = p_ccb->local_cid;
1849 
1850   if (first_pdu) {
1851     p_xmit->offset -= L2CAP_LCC_SDU_LENGTH; /* for writing the SDU length. */
1852     uint8_t* p = (uint8_t*)(p_xmit + 1) + p_xmit->offset;
1853     UINT16_TO_STREAM(p, p_buf->len);
1854     p_xmit->len += L2CAP_LCC_SDU_LENGTH;
1855   }
1856 
1857   p_buf->len -= no_of_bytes_to_send;
1858   p_buf->offset += no_of_bytes_to_send;
1859 
1860   /* copy PBF setting */
1861   p_xmit->layer_specific = p_buf->layer_specific;
1862 
1863   if (last_piece_of_sdu) *last_piece_of_sdu = last_pdu;
1864 
1865   if (last_pdu) {
1866     p_buf = (BT_HDR*)fixed_queue_try_dequeue(p_ccb->xmit_hold_q);
1867     osi_free(p_buf);
1868   }
1869 
1870   /* Step back to add the L2CAP headers */
1871   p_xmit->offset -= L2CAP_PKT_OVERHEAD;
1872   p_xmit->len += L2CAP_PKT_OVERHEAD;
1873 
1874   /* Set the pointer to the beginning of the data */
1875   uint8_t* p = (uint8_t*)(p_xmit + 1) + p_xmit->offset;
1876 
1877   /* Note: if FCS has to be included then the length is recalculated later */
1878   UINT16_TO_STREAM(p, p_xmit->len - L2CAP_PKT_OVERHEAD);
1879   UINT16_TO_STREAM(p, p_ccb->remote_cid);
1880   return (p_xmit);
1881 }
1882 
1883 /*******************************************************************************
1884  * Configuration negotiation functions
1885  *
1886  * The following functions are used in negotiating channel modes during
1887  * configuration
1888  ******************************************************************************/
1889 
1890 /*******************************************************************************
1891  *
1892  * Function         l2c_fcr_chk_chan_modes
1893  *
1894  * Description      Validates and adjusts if necessary, the FCR options
1895  *                  based on remote EXT features.
1896  *
1897  *                  Note: This assumes peer EXT Features have been received.
1898  *                      Basic mode is used if FCR Options have not been received
1899  *
1900  * Returns          uint8_t - nonzero if can continue, '0' if no compatible
1901  *                            channels
1902  *
1903  ******************************************************************************/
l2c_fcr_chk_chan_modes(tL2C_CCB * p_ccb)1904 uint8_t l2c_fcr_chk_chan_modes(tL2C_CCB* p_ccb) {
1905   CHECK(p_ccb != NULL);
1906 
1907   /* Remove nonbasic options that the peer does not support */
1908   if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
1909     p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
1910 
1911   if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
1912     p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
1913 
1914   /* At least one type needs to be set (Basic, ERTM, STM) to continue */
1915   if (!p_ccb->ertm_info.allowed_modes) {
1916     L2CAP_TRACE_WARNING(
1917         "L2CAP - Peer does not support our desired channel types");
1918   }
1919 
1920   return (p_ccb->ertm_info.allowed_modes);
1921 }
1922 
1923 /*******************************************************************************
1924  *
1925  * Function         l2c_fcr_adj_our_req_options
1926  *
1927  * Description      Validates and sets up the FCR options passed in from
1928  *                  L2CA_ConfigReq based on remote device's features.
1929  *
1930  * Returns          true if no errors, Otherwise false
1931  *
1932  ******************************************************************************/
l2c_fcr_adj_our_req_options(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)1933 bool l2c_fcr_adj_our_req_options(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
1934   CHECK(p_ccb != NULL);
1935   CHECK(p_cfg != NULL);
1936 
1937   tL2CAP_FCR_OPTS* p_fcr = &p_cfg->fcr;
1938 
1939   if (p_fcr->mode != p_ccb->ertm_info.preferred_mode) {
1940     L2CAP_TRACE_WARNING(
1941         "l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match "
1942         "mode (%d)",
1943         p_ccb->ertm_info.preferred_mode, p_fcr->mode);
1944 
1945     /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override
1946      * this one */
1947     p_fcr->mode = p_ccb->ertm_info.preferred_mode;
1948   }
1949 
1950   /* If upper layer did not request eRTM mode, BASIC must be used */
1951   if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC) {
1952     if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE) {
1953       L2CAP_TRACE_WARNING(
1954           "l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set "
1955           "using BASIC mode",
1956           p_fcr->mode);
1957     }
1958     p_fcr->mode = L2CAP_FCR_BASIC_MODE;
1959   }
1960 
1961   /* Process the FCR options if initial channel bring-up (not a reconfig
1962   *request)
1963   ** Determine initial channel mode to try based on our options and remote's
1964   *features
1965   */
1966   if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG)) {
1967     /* We need to have at least one mode type common with the peer */
1968     if (!l2c_fcr_chk_chan_modes(p_ccb)) {
1969       /* Two channels have incompatible supported types */
1970       l2cu_disconnect_chnl(p_ccb);
1971       return (false);
1972     }
1973 
1974     /* Basic is the only common channel mode between the two devices */
1975     else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC) {
1976       /* We only want to try Basic, so bypass sending the FCR options entirely
1977        */
1978       p_cfg->fcr_present = false;
1979       p_cfg->fcs_present = false; /* Illegal to use FCS option in basic mode */
1980       p_cfg->ext_flow_spec_present =
1981           false; /* Illegal to use extended flow spec in basic mode */
1982     }
1983 
1984     /* We have at least one non-basic mode available
1985      * Override mode from available mode options based on preference, if needed
1986      */
1987     else {
1988       /* If peer does not support STREAMING, try ERTM */
1989       if (p_fcr->mode == L2CAP_FCR_STREAM_MODE &&
1990           !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM)) {
1991         L2CAP_TRACE_DEBUG(
1992             "L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
1993         p_fcr->mode = L2CAP_FCR_ERTM_MODE;
1994       }
1995 
1996       /* If peer does not support ERTM, try BASIC (will support this if made it
1997        * here in the code) */
1998       if (p_fcr->mode == L2CAP_FCR_ERTM_MODE &&
1999           !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
2000         L2CAP_TRACE_DEBUG(
2001             "L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
2002         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
2003       }
2004     }
2005 
2006     if (p_fcr->mode != L2CAP_FCR_BASIC_MODE) {
2007       /* MTU must be smaller than buffer size */
2008       if ((p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu)) {
2009         L2CAP_TRACE_WARNING("L2CAP - MTU: %u  larger than buf size: %u",
2010                             p_cfg->mtu, p_ccb->max_rx_mtu);
2011         return (false);
2012       }
2013 
2014       /* application want to use the default MPS */
2015       if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS) {
2016         p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
2017       }
2018       /* MPS must be less than MTU */
2019       else if (p_fcr->mps > p_ccb->max_rx_mtu) {
2020         L2CAP_TRACE_WARNING("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps,
2021                             p_ccb->max_rx_mtu);
2022         return (false);
2023       }
2024 
2025       /* We always initially read into the HCI buffer pool, so make sure it fits
2026        */
2027       if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
2028         p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
2029     } else {
2030       p_cfg->fcs_present = false; /* Illegal to use FCS option in basic mode */
2031       p_cfg->ext_flow_spec_present =
2032           false; /* Illegal to use extended flow spec in basic mode */
2033     }
2034 
2035     p_ccb->our_cfg.fcr = *p_fcr;
2036   } else /* Not sure how to send a reconfiguration(??) should fcr be included?
2037             */
2038   {
2039     p_ccb->our_cfg.fcr_present = false;
2040   }
2041 
2042   return (true);
2043 }
2044 
2045 /*******************************************************************************
2046  *
2047  * Function         l2c_fcr_adj_monitor_retran_timeout
2048  *
2049  * Description      Overrides monitor/retrans timer value based on controller
2050  *
2051  * Returns          None
2052  *
2053  ******************************************************************************/
l2c_fcr_adj_monitor_retran_timeout(tL2C_CCB * p_ccb)2054 void l2c_fcr_adj_monitor_retran_timeout(tL2C_CCB* p_ccb) {
2055   CHECK(p_ccb != NULL);
2056 
2057   /* adjust our monitor/retran timeout */
2058   if (p_ccb->out_cfg_fcr_present) {
2059     /*
2060     ** if we requestd ERTM or accepted ERTM
2061     ** We may accept ERTM even if we didn't request ERTM, in case of requesting
2062     *STREAM
2063     */
2064     if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) ||
2065         (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)) {
2066       /* upper layer setting is ignored */
2067       p_ccb->our_cfg.fcr.mon_tout = L2CAP_MIN_MONITOR_TOUT;
2068       p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
2069     } else {
2070       p_ccb->our_cfg.fcr.mon_tout = 0;
2071       p_ccb->our_cfg.fcr.rtrans_tout = 0;
2072     }
2073 
2074     L2CAP_TRACE_DEBUG(
2075         "l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
2076         p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
2077   }
2078 }
2079 /*******************************************************************************
2080  *
2081  * Function         l2c_fcr_adj_our_rsp_options
2082  *
2083  * Description      Overrides any neccesary FCR options passed in from
2084  *                  L2CA_ConfigRsp based on our FCR options.
2085  *                  Only makes adjustments if channel is in ERTM mode.
2086  *
2087  * Returns          None
2088  *
2089  ******************************************************************************/
l2c_fcr_adj_our_rsp_options(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2090 void l2c_fcr_adj_our_rsp_options(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
2091   CHECK(p_ccb != NULL);
2092   CHECK(p_cfg != NULL);
2093 
2094   /* adjust our monitor/retran timeout */
2095   l2c_fcr_adj_monitor_retran_timeout(p_ccb);
2096 
2097   p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
2098 
2099   if (p_cfg->fcr_present) {
2100     /* Temporary - until a better algorithm is implemented */
2101     /* If peer's tx_wnd_sz requires too many buffers for us to support, then
2102      * adjust it. For now, respond with our own tx_wnd_sz. */
2103     /* Note: peer is not guaranteed to obey our adjustment */
2104     if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz) {
2105       L2CAP_TRACE_DEBUG("%s: adjusting requested tx_win_sz from %i to %i",
2106                         __func__, p_ccb->peer_cfg.fcr.tx_win_sz,
2107                         p_ccb->our_cfg.fcr.tx_win_sz);
2108       p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
2109     }
2110 
2111     p_cfg->fcr.mode = p_ccb->peer_cfg.fcr.mode;
2112     p_cfg->fcr.tx_win_sz = p_ccb->peer_cfg.fcr.tx_win_sz;
2113     p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
2114     p_cfg->fcr.mps = p_ccb->peer_cfg.fcr.mps;
2115     p_cfg->fcr.rtrans_tout = p_ccb->our_cfg.fcr.rtrans_tout;
2116     p_cfg->fcr.mon_tout = p_ccb->our_cfg.fcr.mon_tout;
2117   }
2118 }
2119 
2120 /*******************************************************************************
2121  *
2122  * Function         l2c_fcr_renegotiate_chan
2123  *
2124  * Description      Called upon unsuccessful peer response to config request.
2125  *                  If the error is because of the channel mode, it will try
2126  *                  to resend using another supported optional channel.
2127  *
2128  * Returns          true if resent configuration, False if channel matches or
2129  *                  cannot match.
2130  *
2131  ******************************************************************************/
l2c_fcr_renegotiate_chan(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2132 bool l2c_fcr_renegotiate_chan(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
2133   CHECK(p_ccb != NULL);
2134   CHECK(p_cfg != NULL);
2135 
2136   uint8_t peer_mode = p_ccb->our_cfg.fcr.mode;
2137   bool can_renegotiate;
2138 
2139   /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned
2140    */
2141   if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
2142     return (false);
2143 
2144   /* Only retry if there are more channel options to try */
2145   if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS) {
2146     peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
2147 
2148     if (p_ccb->our_cfg.fcr.mode != peer_mode) {
2149       if ((--p_ccb->fcr_cfg_tries) == 0) {
2150         p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
2151         L2CAP_TRACE_WARNING("l2c_fcr_renegotiate_chan (Max retries exceeded)");
2152       }
2153 
2154       can_renegotiate = false;
2155 
2156       /* Try another supported mode if available based on our last attempted
2157        * channel */
2158       switch (p_ccb->our_cfg.fcr.mode) {
2159         /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
2160         case L2CAP_FCR_STREAM_MODE:
2161           /* Peer wants ERTM and we support it */
2162           if ((peer_mode == L2CAP_FCR_ERTM_MODE) &&
2163               (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
2164             L2CAP_TRACE_DEBUG("%s(Trying ERTM)", __func__);
2165             p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
2166             can_renegotiate = true;
2167           } else if (p_ccb->ertm_info.allowed_modes &
2168                      L2CAP_FCR_CHAN_OPT_BASIC) {
2169             /* We can try basic for any other peer mode if we support it */
2170             L2CAP_TRACE_DEBUG("%s(Trying Basic)", __func__);
2171             can_renegotiate = true;
2172             p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
2173           }
2174           break;
2175         case L2CAP_FCR_ERTM_MODE:
2176           /* We can try basic for any other peer mode if we support it */
2177           if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) {
2178             L2CAP_TRACE_DEBUG("%s(Trying Basic)", __func__);
2179             can_renegotiate = true;
2180             p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
2181           }
2182           break;
2183 
2184         default:
2185           /* All other scenarios cannot be renegotiated */
2186           break;
2187       }
2188 
2189       if (can_renegotiate) {
2190         p_ccb->our_cfg.fcr_present = true;
2191 
2192         if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE) {
2193           p_ccb->our_cfg.fcs_present = false;
2194           p_ccb->our_cfg.ext_flow_spec_present = false;
2195 
2196           /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
2197           if ((p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE)) {
2198             L2CAP_TRACE_WARNING("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
2199             p_cfg->mtu = L2CAP_MTU_SIZE;
2200           }
2201         }
2202 
2203         l2cu_process_our_cfg_req(p_ccb, &p_ccb->our_cfg);
2204         l2cu_send_peer_config_req(p_ccb, &p_ccb->our_cfg);
2205         alarm_set_on_mloop(p_ccb->l2c_ccb_timer, L2CAP_CHNL_CFG_TIMEOUT_MS,
2206                            l2c_ccb_timer_timeout, p_ccb);
2207         return (true);
2208       }
2209     }
2210   }
2211 
2212   /* Disconnect if the channels do not match */
2213   if (p_ccb->our_cfg.fcr.mode != peer_mode) {
2214     L2CAP_TRACE_WARNING("L2C CFG:  Channels incompatible (local %d, peer %d)",
2215                         p_ccb->our_cfg.fcr.mode, peer_mode);
2216     l2cu_disconnect_chnl(p_ccb);
2217   }
2218 
2219   return (false);
2220 }
2221 
2222 /*******************************************************************************
2223  *
2224  * Function         l2c_fcr_process_peer_cfg_req
2225  *
2226  * Description      This function is called to process the FCR options passed
2227  *                  in the peer's configuration request.
2228  *
2229  * Returns          uint8_t - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
2230  *                          or L2CAP_PEER_CFG_DISCONNECT.
2231  *
2232  ******************************************************************************/
l2c_fcr_process_peer_cfg_req(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2233 uint8_t l2c_fcr_process_peer_cfg_req(tL2C_CCB* p_ccb, tL2CAP_CFG_INFO* p_cfg) {
2234   CHECK(p_ccb != NULL);
2235   CHECK(p_cfg != NULL);
2236 
2237   uint16_t max_retrans_size;
2238   uint8_t fcr_ok = L2CAP_PEER_CFG_OK;
2239 
2240   p_ccb->p_lcb->w4_info_rsp =
2241       false; /* Handles T61x SonyEricsson Bug in Info Request */
2242 
2243   L2CAP_TRACE_EVENT(
2244       "l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR "
2245       "mode:%d preferred: %u allowed:%u",
2246       p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode,
2247       p_ccb->ertm_info.preferred_mode, p_ccb->ertm_info.allowed_modes);
2248 
2249   /* If Peer wants basic, we are done (accept it or disconnect) */
2250   if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE) {
2251     /* If we do not allow basic, disconnect */
2252     if (!(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC))
2253       fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2254   }
2255 
2256   /* Need to negotiate if our modes are not the same */
2257   else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode) {
2258     /* If peer wants a mode that we don't support then retry our mode (ex.
2259     *rtx/flc), OR
2260     ** If we want ERTM and they wanted streaming retry our mode.
2261     ** Note: If we have already determined they support our mode previously
2262     **       from their EXF mask.
2263     */
2264     if ((((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0) ||
2265         (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE)) {
2266       p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
2267       p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
2268       p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
2269       fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
2270     }
2271 
2272     /* If we wanted basic, then try to renegotiate it */
2273     else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE) {
2274       p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
2275       p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
2276       p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
2277       p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout =
2278           p_ccb->our_cfg.fcr.mps = 0;
2279       fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
2280     }
2281 
2282     /* Only other valid case is if they want ERTM and we wanted STM which should
2283        be
2284        accepted if we support it; otherwise the channel should be disconnected
2285        */
2286     else if ((p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE) ||
2287              !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
2288       fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2289     }
2290   }
2291 
2292   /* Configuration for FCR channels so make any adjustments and fwd to upper
2293    * layer */
2294   if (fcr_ok == L2CAP_PEER_CFG_OK) {
2295     /* by default don't need to send params in the response */
2296     p_ccb->out_cfg_fcr_present = false;
2297 
2298     /* Make any needed adjustments for the response to the peer */
2299     if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE) {
2300       /* Peer desires to bypass FCS check, and streaming or ERTM mode */
2301       if (p_cfg->fcs_present) {
2302         p_ccb->peer_cfg.fcs = p_cfg->fcs;
2303         p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
2304         if (p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
2305           p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
2306       }
2307 
2308       max_retrans_size = p_ccb->ertm_info.fcr_tx_buf_size - sizeof(BT_HDR) -
2309                          L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET -
2310                          L2CAP_FCS_LEN;
2311 
2312       /* Ensure the MPS is not bigger than the MTU */
2313       if ((p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu)) {
2314         p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
2315         p_ccb->out_cfg_fcr_present = true;
2316       }
2317 
2318       /* Ensure the MPS is not bigger than our retransmission buffer */
2319       if (p_cfg->fcr.mps > max_retrans_size) {
2320         L2CAP_TRACE_DEBUG("CFG: Overriding MPS to %d (orig %d)",
2321                           max_retrans_size, p_cfg->fcr.mps);
2322 
2323         p_cfg->fcr.mps = max_retrans_size;
2324         p_ccb->out_cfg_fcr_present = true;
2325       }
2326 
2327       if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE ||
2328           p_cfg->fcr.mode == L2CAP_FCR_STREAM_MODE) {
2329         /* Always respond with FCR ERTM parameters */
2330         p_ccb->out_cfg_fcr_present = true;
2331       }
2332     }
2333 
2334     /* Everything ok, so save the peer's adjusted fcr options */
2335     p_ccb->peer_cfg.fcr = p_cfg->fcr;
2336 
2337     if (p_cfg->fcr_present) p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
2338   } else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE) {
2339     /* Allow peer only one retry for mode */
2340     if (p_ccb->peer_cfg_already_rejected)
2341       fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2342     else
2343       p_ccb->peer_cfg_already_rejected = true;
2344   }
2345 
2346   return (fcr_ok);
2347 }
2348 
2349 #if (L2CAP_ERTM_STATS == TRUE)
2350 /*******************************************************************************
2351  *
2352  * Function         l2c_fcr_collect_ack_delay
2353  *
2354  * Description      collect throughput, delay, queue size of waiting ack
2355  *
2356  * Parameters
2357  *                  tL2C_CCB
2358  *
2359  * Returns          void
2360  *
2361  ******************************************************************************/
l2c_fcr_collect_ack_delay(tL2C_CCB * p_ccb,uint8_t num_bufs_acked)2362 static void l2c_fcr_collect_ack_delay(tL2C_CCB* p_ccb, uint8_t num_bufs_acked) {
2363   uint32_t index;
2364   BT_HDR* p_buf;
2365   uint8_t* p;
2366   uint32_t timestamp, delay;
2367   uint8_t xx;
2368   uint8_t str[120];
2369 
2370   index = p_ccb->fcrb.ack_delay_avg_index;
2371 
2372   /* update sum, max and min of waiting for ack queue size */
2373   p_ccb->fcrb.ack_q_count_avg[index] +=
2374       fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
2375 
2376   if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) >
2377       p_ccb->fcrb.ack_q_count_max[index])
2378     p_ccb->fcrb.ack_q_count_max[index] =
2379         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
2380 
2381   if (fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q) <
2382       p_ccb->fcrb.ack_q_count_min[index])
2383     p_ccb->fcrb.ack_q_count_min[index] =
2384         fixed_queue_length(p_ccb->fcrb.waiting_for_ack_q);
2385 
2386   /* update sum, max and min of round trip delay of acking */
2387   list_t* list = NULL;
2388   if (!fixed_queue_is_empty(p_ccb->fcrb.waiting_for_ack_q))
2389     list = fixed_queue_get_list(p_ccb->fcrb.waiting_for_ack_q);
2390   if (list != NULL) {
2391     for (const list_node_t *node = list_begin(list), xx = 0;
2392          (node != list_end(list)) && (xx < num_bufs_acked);
2393          node = list_next(node), xx++) {
2394       p_buf = list_node(node);
2395       /* adding up length of acked I-frames to get throughput */
2396       p_ccb->fcrb.throughput[index] += p_buf->len - 8;
2397 
2398       if (xx == num_bufs_acked - 1) {
2399         /* get timestamp from tx I-frame that receiver is acking */
2400         p = ((uint8_t*)(p_buf + 1)) + p_buf->offset + p_buf->len;
2401         if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS) {
2402           p += L2CAP_FCS_LEN;
2403         }
2404 
2405         STREAM_TO_UINT32(timestamp, p);
2406         delay = static_cast<uint32_t>(
2407                     bluetooth::common::time_get_os_boottime_ms()) -
2408                 timestamp;
2409 
2410         p_ccb->fcrb.ack_delay_avg[index] += delay;
2411         if (delay > p_ccb->fcrb.ack_delay_max[index])
2412           p_ccb->fcrb.ack_delay_max[index] = delay;
2413         if (delay < p_ccb->fcrb.ack_delay_min[index])
2414           p_ccb->fcrb.ack_delay_min[index] = delay;
2415       }
2416     }
2417   }
2418 
2419   p_ccb->fcrb.ack_delay_avg_count++;
2420 
2421   /* calculate average and initialize next avg, min and max */
2422   if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES) {
2423     p_ccb->fcrb.ack_delay_avg_count = 0;
2424 
2425     p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
2426     p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
2427 
2428     /* calculate throughput */
2429     timestamp = bluetooth::common::time_get_os_boottime_ms();
2430     if (timestamp - p_ccb->fcrb.throughput_start > 0)
2431       p_ccb->fcrb.throughput[index] /=
2432           (timestamp - p_ccb->fcrb.throughput_start);
2433 
2434     p_ccb->fcrb.throughput_start = timestamp;
2435 
2436     snprintf(
2437         str, sizeof(str),
2438         "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, "
2439         "ack_q_count avg:%3u, min:%3u, max:%3u",
2440         index, p_ccb->fcrb.throughput[index], p_ccb->fcrb.ack_delay_avg[index],
2441         p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
2442         p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index],
2443         p_ccb->fcrb.ack_q_count_max[index]);
2444 
2445     BT_TRACE(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI,
2446              TRACE_TYPE_GENERIC, "%s", str);
2447 
2448     index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
2449     p_ccb->fcrb.ack_delay_avg_index = index;
2450 
2451     p_ccb->fcrb.ack_q_count_max[index] = 0;
2452     p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
2453     p_ccb->fcrb.ack_q_count_avg[index] = 0;
2454 
2455     p_ccb->fcrb.ack_delay_max[index] = 0;
2456     p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
2457     p_ccb->fcrb.ack_delay_avg[index] = 0;
2458 
2459     p_ccb->fcrb.throughput[index] = 0;
2460   }
2461 }
2462 #endif
2463