• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /******************************************************************************
2  *
3  *  Copyright (C) 2004-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains the L2CAP 1.2 Flow Control and retransmissions
22  *  functions
23  *
24  ******************************************************************************/
25 
26 #include <stdlib.h>
27 #include <string.h>
28 #include <stdio.h>
29 
30 #include "gki.h"
31 #include "bt_types.h"
32 #include "hcimsgs.h"
33 #include "l2cdefs.h"
34 #include "l2c_int.h"
35 #include "l2c_api.h"
36 #include "btu.h"
37 #include "btm_api.h"
38 #include "btm_int.h"
39 
40 
41 /* Flag passed to retransmit_i_frames() when all packets should be retransmitted */
42 #define L2C_FCR_RETX_ALL_PKTS   0xFF
43 
44 #if BT_TRACE_VERBOSE == TRUE
45 static char *SAR_types[] = { "Unsegmented", "Start", "End", "Continuation" };
46 static char *SUP_types[] = { "RR", "REJ", "RNR", "SREJ" };
47 #endif
48 
49 /* Look-up table for the CRC calculation */
50 static const unsigned short crctab[256] = {
51     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241,
52     0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
53     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40,
54     0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
55     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40,
56     0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
57     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641,
58     0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
59     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
60     0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
61     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41,
62     0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
63     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41,
64     0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
65     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640,
66     0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
67     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240,
68     0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
69     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41,
70     0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
71     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41,
72     0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
73     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640,
74     0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
75     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241,
76     0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
77     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
78     0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
79     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40,
80     0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
81     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641,
82     0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
83 };
84 
85 
86 /*******************************************************************************
87 **  Static local functions
88 */
89 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word);
90 static void    process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
91 static void    process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack);
92 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq);
93 static void    prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission);
94 static void    process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf);
95 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word);
96 
97 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
98 static BOOLEAN l2c_corrupt_the_fcr_packet (tL2C_CCB *p_ccb, BT_HDR *p_buf,
99                                            BOOLEAN is_rx, UINT16 ctrl_word);
100 static BOOLEAN l2c_bypass_sframe_packet (tL2C_CCB *p_ccb);
101 #endif
102 
103 #if (L2CAP_ERTM_STATS == TRUE)
104 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked);
105 #endif
106 
107 /*******************************************************************************
108 **
109 ** Function         l2c_fcr_updcrc
110 **
111 ** Description      This function computes the CRC using the look-up table.
112 **
113 ** Returns          CRC
114 **
115 *******************************************************************************/
l2c_fcr_updcrc(unsigned short icrc,unsigned char * icp,int icnt)116 unsigned short l2c_fcr_updcrc(unsigned short icrc, unsigned char *icp, int icnt)
117 {
118     register unsigned short crc = icrc;
119     register unsigned char  *cp = icp;
120     register          int   cnt = icnt;
121 
122     while (cnt--)
123     {
124         crc = ((crc >> 8) & 0xff) ^ crctab[(crc & 0xff) ^ *cp++];
125     }
126 
127     return(crc);
128 }
129 
130 
131 /*******************************************************************************
132 **
133 ** Function         l2c_fcr_tx_get_fcs
134 **
135 ** Description      This function computes the CRC for a frame to be TXed.
136 **
137 ** Returns          CRC
138 **
139 *******************************************************************************/
l2c_fcr_tx_get_fcs(BT_HDR * p_buf)140 UINT16 l2c_fcr_tx_get_fcs (BT_HDR *p_buf)
141 {
142     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
143 
144     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len));
145 }
146 
147 /*******************************************************************************
148 **
149 ** Function         l2c_fcr_rx_get_fcs
150 **
151 ** Description      This function computes the CRC for a received frame.
152 **
153 ** Returns          CRC
154 **
155 *******************************************************************************/
l2c_fcr_rx_get_fcs(BT_HDR * p_buf)156 UINT16 l2c_fcr_rx_get_fcs (BT_HDR *p_buf)
157 {
158     UINT8   *p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
159 
160     /* offset points past the L2CAP header, but the CRC check includes it */
161     p -= L2CAP_PKT_OVERHEAD;
162 
163     return (l2c_fcr_updcrc (L2CAP_FCR_INIT_CRC, p, p_buf->len + L2CAP_PKT_OVERHEAD));
164 }
165 
166 /*******************************************************************************
167 **
168 ** Function         l2c_fcr_start_timer
169 **
170 ** Description      This function starts the (monitor or retransmission) timer.
171 **
172 ** Returns          -
173 **
174 *******************************************************************************/
l2c_fcr_start_timer(tL2C_CCB * p_ccb)175 void l2c_fcr_start_timer (tL2C_CCB *p_ccb)
176 {
177     UINT32  tout;
178 
179     /* The timers which are in milliseconds */
180     if (p_ccb->fcrb.wait_ack)
181     {
182         tout = (UINT32)p_ccb->our_cfg.fcr.mon_tout;
183     }
184     else
185     {
186         tout = (UINT32)p_ccb->our_cfg.fcr.rtrans_tout;
187     }
188 /*
189     L2CAP_TRACE_DEBUG4 ("l2c_fcr_start_timer Tout: %u  Already Running: %u  wait_ack: %u  ack_q_count: %u",
190                         tout, p_ccb->timer_entry.in_use, p_ccb->fcrb.wait_ack, p_ccb->fcrb.waiting_for_ack_q.count);
191 */
192     /* Only start a timer that was not started */
193     if (p_ccb->fcrb.mon_retrans_timer.in_use == 0)
194         btu_start_quick_timer (&p_ccb->fcrb.mon_retrans_timer, BTU_TTYPE_L2CAP_CHNL, tout*QUICK_TIMER_TICKS_PER_SEC/1000);
195 }
196 
197 /*******************************************************************************
198 **
199 ** Function         l2c_fcr_stop_timer
200 **
201 ** Description      This function stops the (monitor or transmission) timer.
202 **
203 ** Returns          -
204 **
205 *******************************************************************************/
l2c_fcr_stop_timer(tL2C_CCB * p_ccb)206 void l2c_fcr_stop_timer (tL2C_CCB *p_ccb)
207 {
208     if (p_ccb->fcrb.mon_retrans_timer.in_use)
209     {
210 /*
211         L2CAP_TRACE_DEBUG2 ("l2c_fcr_stop_timer wait_ack: %u  ack_q_count: %u",
212                             p_ccb->fcrb.wait_ack, p_ccb->fcrb.waiting_for_ack_q.count);
213 */
214         btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
215     }
216 }
217 
218 /*******************************************************************************
219 **
220 ** Function         l2c_fcr_cleanup
221 **
222 ** Description      This function cleans up the variable used for flow-control/retrans.
223 **
224 ** Returns          -
225 **
226 *******************************************************************************/
l2c_fcr_cleanup(tL2C_CCB * p_ccb)227 void l2c_fcr_cleanup (tL2C_CCB *p_ccb)
228 {
229     tL2C_FCRB *p_fcrb = &p_ccb->fcrb;
230 
231     l2c_fcr_stop_timer (p_ccb);
232 
233     if (p_fcrb->p_rx_sdu)
234         GKI_freebuf (p_fcrb->p_rx_sdu);
235 
236     while (p_fcrb->waiting_for_ack_q.p_first)
237         GKI_freebuf (GKI_dequeue (&p_fcrb->waiting_for_ack_q));
238 
239     while (p_fcrb->srej_rcv_hold_q.p_first)
240         GKI_freebuf (GKI_dequeue (&p_fcrb->srej_rcv_hold_q));
241 
242     while (p_fcrb->retrans_q.p_first)
243         GKI_freebuf (GKI_dequeue (&p_fcrb->retrans_q));
244 
245     btu_stop_quick_timer (&p_fcrb->ack_timer);
246     btu_stop_quick_timer (&p_ccb->fcrb.mon_retrans_timer);
247 
248 #if (L2CAP_ERTM_STATS == TRUE)
249     if ( (p_ccb->local_cid >= L2CAP_BASE_APPL_CID) && (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) )
250     {
251         UINT32  dur = GKI_get_os_tick_count() - p_ccb->fcrb.connect_tick_count;
252         char    *p_str = (char *)GKI_getbuf(120);
253         UINT16  i;
254         UINT32  throughput_avg, ack_delay_avg, ack_q_count_avg;
255 
256         dur = GKI_OS_TICKS_TO_MS(dur);
257         BT_TRACE_2(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
258                    "---  L2CAP ERTM  Stats for CID: 0x%04x   Duration: %08ums", p_ccb->local_cid, dur);
259         BT_TRACE_4(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
260                    "Retransmissions:%08u Times Flow Controlled:%08u Retrans Touts:%08u Ack Touts:%08u",
261                     p_ccb->fcrb.pkts_retransmitted, p_ccb->fcrb.xmit_window_closed, p_ccb->fcrb.retrans_touts, p_ccb->fcrb.xmit_ack_touts);
262         BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
263                    "Times there is less than 2 packets in controller when flow controlled:%08u", p_ccb->fcrb.controller_idle);
264         BT_TRACE_2(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
265                    "max_held_acks:%08u, in_cfg.fcr.tx_win_sz:%08u", p_ccb->fcrb.max_held_acks, p_ccb->peer_cfg.fcr.tx_win_sz );
266         if (p_str)
267         {
268             sprintf(p_str, "Sent Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
269                 p_ccb->fcrb.ertm_pkt_counts[0], p_ccb->fcrb.ertm_byte_counts[0],
270                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[0] * 100) / (dur / 10) : 0),
271                 p_ccb->fcrb.s_frames_sent[0], p_ccb->fcrb.s_frames_sent[1], p_ccb->fcrb.s_frames_sent[2], p_ccb->fcrb.s_frames_sent[3]);
272 
273             BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
274 
275             sprintf(p_str, "Rcvd Pkts:%08u Bytes:%10u(%06u/sec) RR:%08u REJ:%08u RNR:%08u SREJ:%08u",
276                 p_ccb->fcrb.ertm_pkt_counts[1], p_ccb->fcrb.ertm_byte_counts[1],
277                 (dur >= 10 ? (p_ccb->fcrb.ertm_byte_counts[1] * 100) / (dur / 10) : 0),
278                 p_ccb->fcrb.s_frames_rcvd[0], p_ccb->fcrb.s_frames_rcvd[1], p_ccb->fcrb.s_frames_rcvd[2], p_ccb->fcrb.s_frames_rcvd[3]);
279 
280             BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
281 
282             throughput_avg  = 0;
283             ack_delay_avg   = 0;
284             ack_q_count_avg = 0;
285 
286             for (i = 0; i < L2CAP_ERTM_STATS_NUM_AVG; i++ )
287             {
288                 if (i == p_ccb->fcrb.ack_delay_avg_index )
289                 {
290                     BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
291                            "[%02u] collecting data ...", i );
292                     continue;
293                 }
294 
295                 sprintf(p_str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
296                         i, p_ccb->fcrb.throughput[i],
297                         p_ccb->fcrb.ack_delay_avg[i], p_ccb->fcrb.ack_delay_min[i], p_ccb->fcrb.ack_delay_max[i],
298                         p_ccb->fcrb.ack_q_count_avg[i], p_ccb->fcrb.ack_q_count_min[i], p_ccb->fcrb.ack_q_count_max[i] );
299 
300                 BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", p_str);
301 
302                 throughput_avg  += p_ccb->fcrb.throughput[i];
303                 ack_delay_avg   += p_ccb->fcrb.ack_delay_avg[i];
304                 ack_q_count_avg += p_ccb->fcrb.ack_q_count_avg[i];
305             }
306 
307             throughput_avg  /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
308             ack_delay_avg   /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
309             ack_q_count_avg /= (L2CAP_ERTM_STATS_NUM_AVG - 1);
310 
311             BT_TRACE_3(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
312                    "throughput_avg: %8u (kbytes/sec), ack_delay_avg: %8u ms, ack_q_count_avg: %8u",
313                     throughput_avg, ack_delay_avg, ack_q_count_avg );
314 
315             GKI_freebuf(p_str);
316         }
317 
318         BT_TRACE_0(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC,
319                    "---");
320     }
321 #endif
322 
323     memset (p_fcrb, 0, sizeof (tL2C_FCRB));
324 }
325 
326 /*******************************************************************************
327 **
328 ** Function         l2c_fcr_clone_buf
329 **
330 ** Description      This function allocates and copies requested part of a buffer
331 **                  at a new-offset.
332 **
333 ** Returns          pointer to new buffer
334 **
335 *******************************************************************************/
l2c_fcr_clone_buf(BT_HDR * p_buf,UINT16 new_offset,UINT16 no_of_bytes,UINT8 pool)336 BT_HDR *l2c_fcr_clone_buf (BT_HDR *p_buf, UINT16 new_offset, UINT16 no_of_bytes, UINT8 pool)
337 {
338     BT_HDR *p_buf2;
339 
340     /* If using the common pool, should be at least 10% free. */
341     if ( (pool == HCI_ACL_POOL_ID) && (GKI_poolutilization (pool) > 90) )
342     {
343         L2CAP_TRACE_ERROR1 ("L2CAP - failed to clone buffer on HCI_ACL_POOL_ID Utilization: %u", GKI_poolutilization(pool));
344         return (NULL);
345     }
346 
347     if ((p_buf2 = (BT_HDR *)GKI_getpoolbuf(pool)) != NULL)
348     {
349         UINT16    pool_buf_size = GKI_get_pool_bufsize (pool);
350 
351         /* Make sure buffer fits into buffer pool */
352         if ((no_of_bytes + sizeof(BT_HDR) + new_offset) > pool_buf_size)
353         {
354             L2CAP_TRACE_ERROR5("##### l2c_fcr_clone_buf (NumBytes %d) -> Exceeds poolsize %d [bytes %d + BT_HDR %d + offset %d]",
355                                (no_of_bytes + sizeof(BT_HDR) + new_offset),
356                                pool_buf_size, no_of_bytes, sizeof(BT_HDR),
357                                new_offset);
358 
359             GKI_freebuf(p_buf2);
360             return (NULL);
361         }
362 
363         p_buf2->offset = new_offset;
364         p_buf2->len    = no_of_bytes;
365 
366         memcpy (((UINT8 *)(p_buf2 + 1)) + p_buf2->offset,
367                 ((UINT8 *)(p_buf + 1))  + p_buf->offset,
368                 no_of_bytes);
369     }
370     else
371     {
372         L2CAP_TRACE_ERROR2 ("L2CAP - failed to clone buffer, Pool: %u  Count: %u", pool,  GKI_poolfreecount(pool));
373     }
374 
375     return (p_buf2);
376 }
377 
378 /*******************************************************************************
379 **
380 ** Function         l2c_fcr_is_flow_controlled
381 **
382 ** Description      This function checks if the CCB is flow controlled by peer.
383 **
384 ** Returns          The control word
385 **
386 *******************************************************************************/
l2c_fcr_is_flow_controlled(tL2C_CCB * p_ccb)387 BOOLEAN l2c_fcr_is_flow_controlled (tL2C_CCB *p_ccb)
388 {
389     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
390     {
391         /* Check if remote side flowed us off or the transmit window is full */
392         if ( (p_ccb->fcrb.remote_busy == TRUE)
393          ||  (p_ccb->fcrb.waiting_for_ack_q.count >= p_ccb->peer_cfg.fcr.tx_win_sz) )
394         {
395 #if (L2CAP_ERTM_STATS == TRUE)
396             if (p_ccb->xmit_hold_q.count != 0)
397             {
398                 p_ccb->fcrb.xmit_window_closed++;
399 
400                 if ((p_ccb->p_lcb->sent_not_acked < 2)&&(l2cb.controller_xmit_window > 0))
401                     p_ccb->fcrb.controller_idle++;
402             }
403 #endif
404             return (TRUE);
405         }
406     }
407     return (FALSE);
408 }
409 
410 /*******************************************************************************
411 **
412 ** Function         prepare_I_frame
413 **
414 ** Description      This function sets the FCR variables in an I-frame that is
415 **                  about to be sent to HCI for transmission. This may be the
416 **                  first time the I-frame is sent, or a retransmission
417 **
418 ** Returns          -
419 **
420 *******************************************************************************/
prepare_I_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,BOOLEAN is_retransmission)421 static void prepare_I_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, BOOLEAN is_retransmission)
422 {
423     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
424     UINT8       *p;
425     UINT16      fcs;
426     UINT16      ctrl_word;
427     BOOLEAN     set_f_bit = p_fcrb->send_f_rsp;
428 
429     p_fcrb->send_f_rsp = FALSE;
430 
431     if (is_retransmission)
432     {
433         /* Get the old control word and clear out the old req_seq and F bits */
434         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
435 
436         STREAM_TO_UINT16 (ctrl_word, p);
437 
438         ctrl_word  &= ~(L2CAP_FCR_REQ_SEQ_BITS + L2CAP_FCR_F_BIT);
439     }
440     else
441     {
442         ctrl_word  = p_buf->layer_specific & L2CAP_FCR_SEG_BITS;                /* SAR bits */
443         ctrl_word |= (p_fcrb->next_tx_seq << L2CAP_FCR_TX_SEQ_BITS_SHIFT);      /* Tx Seq */
444 
445         p_fcrb->next_tx_seq = (p_fcrb->next_tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
446     }
447 
448     /* Set the F-bit and reqseq only if using re-transmission mode */
449     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
450     {
451         if (set_f_bit)
452             ctrl_word |= L2CAP_FCR_F_BIT;
453 
454         ctrl_word |= (p_fcrb->next_seq_expected) << L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
455 
456         p_fcrb->last_ack_sent = p_ccb->fcrb.next_seq_expected;
457 
458         if (p_ccb->fcrb.ack_timer.in_use)
459             btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
460     }
461 
462     /* Set the control word */
463     p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
464 
465     UINT16_TO_STREAM (p, ctrl_word);
466 
467     /* Compute the FCS and add to the end of the buffer if not bypassed */
468     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
469     {
470         /* length field in l2cap header has to include FCS length */
471         p = ((UINT8 *) (p_buf+1)) + p_buf->offset;
472         UINT16_TO_STREAM (p, p_buf->len + L2CAP_FCS_LEN - L2CAP_PKT_OVERHEAD);
473 
474         /* Calculate the FCS */
475         fcs = l2c_fcr_tx_get_fcs(p_buf);
476 
477         /* Point to the end of the buffer and put the FCS there */
478         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
479 
480         UINT16_TO_STREAM (p, fcs);
481 
482         p_buf->len += L2CAP_FCS_LEN;
483     }
484 
485 #if BT_TRACE_VERBOSE == TRUE
486     if (is_retransmission)
487     {
488         L2CAP_TRACE_EVENT6 ("L2CAP eRTM ReTx I-frame  CID: 0x%04x  Len: %u  SAR: %s  TxSeq: %u  ReqSeq: %u  F: %u",
489                             p_ccb->local_cid, p_buf->len,
490                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
491                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
492                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
493                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
494     }
495     else
496     {
497         L2CAP_TRACE_EVENT6 ("L2CAP eRTM Tx I-frame CID: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
498                             p_ccb->local_cid, p_buf->len,
499                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
500                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
501                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
502                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
503     }
504 #endif
505 
506     /* Start the retransmission timer if not already running */
507     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
508         l2c_fcr_start_timer (p_ccb);
509 }
510 
511 /*******************************************************************************
512 **
513 ** Function         l2c_fcr_send_S_frame
514 **
515 ** Description      This function formats and sends an S-frame for transmission.
516 **
517 ** Returns          -
518 **
519 *******************************************************************************/
l2c_fcr_send_S_frame(tL2C_CCB * p_ccb,UINT16 function_code,UINT16 pf_bit)520 void l2c_fcr_send_S_frame (tL2C_CCB *p_ccb, UINT16 function_code, UINT16 pf_bit)
521 {
522     BT_HDR      *p_buf;
523     UINT8       *p;
524     UINT16      ctrl_word;
525     UINT16      fcs;
526 
527 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
528     /* Only used for conformance testing */
529     if (l2c_bypass_sframe_packet (p_ccb))
530         return;
531 #endif
532 
533     if ((!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN))
534         return;
535 
536 #if (L2CAP_ERTM_STATS == TRUE)
537      p_ccb->fcrb.s_frames_sent[function_code]++;
538 #endif
539 
540     if (pf_bit == L2CAP_FCR_P_BIT)
541     {
542         p_ccb->fcrb.wait_ack = TRUE;
543 
544         l2c_fcr_stop_timer (p_ccb);         /* Restart the monitor timer */
545         l2c_fcr_start_timer (p_ccb);
546     }
547 
548     /* Create the control word to use */
549     ctrl_word = (function_code << L2CAP_FCR_SUP_SHIFT) | L2CAP_FCR_S_FRAME_BIT;
550     ctrl_word |= (p_ccb->fcrb.next_seq_expected << L2CAP_FCR_REQ_SEQ_BITS_SHIFT);
551     ctrl_word |= pf_bit;
552 
553     if ((p_buf = (BT_HDR *)GKI_getpoolbuf (L2CAP_CMD_POOL_ID)) != NULL)
554     {
555         p_buf->offset = HCI_DATA_PREAMBLE_SIZE;
556         p_buf->len    = L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
557 
558         /* Set the pointer to the beginning of the data */
559         p = (UINT8 *)(p_buf + 1) + p_buf->offset;
560 
561         /* Put in the L2CAP header */
562         UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD + L2CAP_FCS_LEN);
563         UINT16_TO_STREAM (p, p_ccb->remote_cid);
564         UINT16_TO_STREAM (p, ctrl_word);
565 
566         /* Compute the FCS and add to the end of the buffer if not bypassed */
567         if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
568         {
569             fcs = l2c_fcr_tx_get_fcs (p_buf);
570 
571             UINT16_TO_STREAM (p, fcs);
572             p_buf->len += L2CAP_FCS_LEN;
573         }
574         else /* rewrite the length without FCS length */
575         {
576             p -= 6;
577             UINT16_TO_STREAM (p, L2CAP_FCR_OVERHEAD);
578         }
579 
580 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
581         /* Get out if packet was dropped */
582         if (l2c_corrupt_the_fcr_packet (p_ccb, p_buf, FALSE, ctrl_word))
583             return;
584 #endif
585         /* Now, the HCI transport header */
586         p_buf->layer_specific = L2CAP_NON_FLUSHABLE_PKT;
587         l2cu_set_acl_hci_header (p_buf, p_ccb);
588 
589 #if BT_TRACE_VERBOSE == TRUE
590         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
591          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
592         {
593             L2CAP_TRACE_WARNING6 ("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
594                             p_ccb->local_cid, ctrl_word,
595                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
596                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
597                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
598                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
599             L2CAP_TRACE_WARNING1 ("                  Buf Len: %u", p_buf->len);
600         }
601         else
602         {
603             L2CAP_TRACE_EVENT6 ("L2CAP eRTM Tx S-frame  CID: 0x%04x  ctrlword: 0x%04x  Type: %s  ReqSeq: %u  P: %u  F: %u",
604                             p_ccb->local_cid, ctrl_word,
605                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
606                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
607                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
608                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
609             L2CAP_TRACE_EVENT1 ("                  Buf Len: %u", p_buf->len);
610         }
611 #endif  /* BT_TRACE_VERBOSE */
612 
613         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, p_buf);
614 
615         p_ccb->fcrb.last_ack_sent = p_ccb->fcrb.next_seq_expected;
616 
617         if (p_ccb->fcrb.ack_timer.in_use)
618             btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
619     }
620     else
621     {
622         L2CAP_TRACE_ERROR2 ("l2c_fcr_send_S_frame(No Resources) cid 0x%04x, Type: 0x%4x",
623                              p_ccb->local_cid, function_code);
624     }
625 }
626 
627 
628 /*******************************************************************************
629 **
630 ** Function         l2c_fcr_proc_pdu
631 **
632 ** Description      This function is the entry point for processing of a
633 **                  received PDU when in flow control and/or retransmission modes.
634 **
635 ** Returns          -
636 **
637 *******************************************************************************/
l2c_fcr_proc_pdu(tL2C_CCB * p_ccb,BT_HDR * p_buf)638 void l2c_fcr_proc_pdu (tL2C_CCB *p_ccb, BT_HDR *p_buf)
639 {
640     UINT8       *p;
641     UINT16      fcs;
642     UINT16      min_pdu_len;
643     UINT16      ctrl_word;
644 
645     /* Check the length */
646     min_pdu_len = (p_ccb->bypass_fcs == L2CAP_BYPASS_FCS) ?
647                   (UINT16)L2CAP_FCR_OVERHEAD : (UINT16)(L2CAP_FCS_LEN + L2CAP_FCR_OVERHEAD);
648 
649     if (p_buf->len < min_pdu_len)
650     {
651         L2CAP_TRACE_WARNING2 ("Rx L2CAP PDU: CID: 0x%04x  Len too short: %u", p_ccb->local_cid, p_buf->len);
652         GKI_freebuf (p_buf);
653         return;
654     }
655 
656     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_STREAM_MODE)
657     {
658         process_stream_frame (p_ccb, p_buf);
659         return;
660     }
661 
662 #if BT_TRACE_VERBOSE == TRUE
663     /* Get the control word */
664     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
665     STREAM_TO_UINT16 (ctrl_word, p);
666 
667     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
668     {
669         if ((((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 1)
670          || (((ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT) == 3))
671         {
672             /* REJ or SREJ */
673             L2CAP_TRACE_WARNING6 ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
674                             p_ccb->local_cid, p_buf->len,
675                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
676                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
677                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
678                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
679         }
680         else
681         {
682             L2CAP_TRACE_EVENT6 ("L2CAP eRTM Rx S-frame: cid: 0x%04x  Len: %u  Type: %s  ReqSeq: %u  P: %u  F: %u",
683                             p_ccb->local_cid, p_buf->len,
684                             SUP_types[(ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT],
685                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
686                             (ctrl_word & L2CAP_FCR_P_BIT) >> L2CAP_FCR_P_BIT_SHIFT,
687                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
688         }
689     }
690     else
691     {
692         L2CAP_TRACE_EVENT6 ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
693                             p_ccb->local_cid, p_buf->len,
694                             SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
695                             (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
696                             (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
697                             (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
698     }
699 
700     L2CAP_TRACE_EVENT6 ("      eRTM Rx Nxt_tx_seq %u, Lst_rx_ack %u, Nxt_seq_exp %u, Lst_ack_snt %u, wt_q.cnt %u, tries %u",
701                         p_ccb->fcrb.next_tx_seq, p_ccb->fcrb.last_rx_ack, p_ccb->fcrb.next_seq_expected,
702                         p_ccb->fcrb.last_ack_sent, p_ccb->fcrb.waiting_for_ack_q.count, p_ccb->fcrb.num_tries);
703 
704 #endif /* BT_TRACE_VERBOSE */
705 
706 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
707     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
708     STREAM_TO_UINT16 (ctrl_word, p);
709 
710     /* Get out if packet was dropped */
711     if (l2c_corrupt_the_fcr_packet (p_ccb, p_buf, TRUE, ctrl_word))
712         return;
713 #endif  /* L2CAP_CORRUPT_ERTM_PKTS */
714 
715     /* Verify FCS if using */
716     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
717     {
718         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
719 
720         /* Extract and drop the FCS from the packet */
721         STREAM_TO_UINT16 (fcs, p);
722         p_buf->len -= L2CAP_FCS_LEN;
723 
724         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
725         {
726             L2CAP_TRACE_WARNING1 ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
727             GKI_freebuf(p_buf);
728             return;
729         }
730     }
731 
732     /* Get the control word */
733     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
734 
735     STREAM_TO_UINT16 (ctrl_word, p);
736 
737     p_buf->len    -= L2CAP_FCR_OVERHEAD;
738     p_buf->offset += L2CAP_FCR_OVERHEAD;
739 
740     /* If we had a poll bit outstanding, check if we got a final response */
741     if (p_ccb->fcrb.wait_ack)
742     {
743         /* If final bit not set, ignore the frame unless it is a polled S-frame */
744         if ( !(ctrl_word & L2CAP_FCR_F_BIT) )
745         {
746             if ( (ctrl_word & L2CAP_FCR_P_BIT) && (ctrl_word & L2CAP_FCR_S_FRAME_BIT) )
747             {
748                 if (p_ccb->fcrb.srej_sent)
749                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
750                 else if (p_ccb->fcrb.local_busy)
751                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
752                 else
753                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
754 
755                 /* Got a poll while in wait_ack state, so re-start our timer with 1-second */
756                 /* This is a small optimization... the monitor timer is 12 secs, but we saw */
757                 /* that if the other side sends us a poll when we are waiting for a final,  */
758                 /* then it speeds up recovery significantly if we poll him back soon after his poll. */
759                 btu_start_quick_timer (&p_ccb->fcrb.mon_retrans_timer, BTU_TTYPE_L2CAP_CHNL, QUICK_TIMER_TICKS_PER_SEC);
760             }
761             GKI_freebuf (p_buf);
762             return;
763         }
764 
765         p_ccb->fcrb.wait_ack  = FALSE;
766 
767         /* P and F are mutually exclusive */
768         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
769             ctrl_word &= ~L2CAP_FCR_P_BIT;
770 
771         if (p_ccb->fcrb.waiting_for_ack_q.count == 0)
772             p_ccb->fcrb.num_tries = 0;
773 
774         l2c_fcr_stop_timer (p_ccb);
775     }
776     else
777     {
778         /* Otherwise, ensure the final bit is ignored */
779         ctrl_word &= ~L2CAP_FCR_F_BIT;
780     }
781 
782     /* Process receive sequence number */
783     if (!process_reqseq (p_ccb, ctrl_word))
784     {
785         GKI_freebuf (p_buf);
786         return;
787     }
788 
789      /* Process based on whether it is an S-frame or an I-frame */
790     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
791         process_s_frame (p_ccb, p_buf, ctrl_word);
792     else
793         process_i_frame (p_ccb, p_buf, ctrl_word, FALSE);
794 
795     /* Return if the channel got disconnected by a bad packet or max retransmissions */
796     if ( (!p_ccb->in_use) || (p_ccb->chnl_state != CST_OPEN) )
797         return;
798 
799     /* If we have some buffers held while doing SREJ, and SREJ has cleared, process them now */
800     if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.srej_sent) && (p_ccb->fcrb.srej_rcv_hold_q.count > 0) )
801     {
802         BUFFER_Q temp_q = p_ccb->fcrb.srej_rcv_hold_q;
803 
804         GKI_init_q (&p_ccb->fcrb.srej_rcv_hold_q);
805 
806         while ((p_buf = (BT_HDR *)GKI_dequeue (&temp_q)) != NULL)
807         {
808             if (p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
809             {
810                 /* Get the control word */
811                 p = ((UINT8 *)(p_buf+1)) + p_buf->offset - L2CAP_FCR_OVERHEAD;
812 
813                 STREAM_TO_UINT16 (ctrl_word, p);
814 
815                 L2CAP_TRACE_DEBUG3 ("l2c_fcr_proc_pdu() CID: 0x%04x  Process Buffer from SREJ_Hold_Q   TxSeq: %u  Expected_Seq: %u",
816                                     p_ccb->local_cid, (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
817                                     p_ccb->fcrb.next_seq_expected);
818 
819                 /* Process the SREJ held I-frame, but do not send an RR for each individual frame */
820                 process_i_frame (p_ccb, p_buf, ctrl_word, TRUE);
821             }
822             else
823                 GKI_freebuf (p_buf);
824 
825             /* If more frames were lost during SREJ, send a REJ */
826             if (p_ccb->fcrb.rej_after_srej)
827             {
828                 p_ccb->fcrb.rej_after_srej = FALSE;
829                 p_ccb->fcrb.rej_sent       = TRUE;
830 
831                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
832             }
833         }
834 
835         /* Now, if needed, send one RR for the whole held queue */
836         if ( (!p_ccb->fcrb.local_busy) && (!p_ccb->fcrb.rej_sent) && (!p_ccb->fcrb.srej_sent)
837          &&  (p_ccb->fcrb.next_seq_expected != p_ccb->fcrb.last_ack_sent) )
838             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
839         else
840         {
841             L2CAP_TRACE_DEBUG6 ("l2c_fcr_proc_pdu() not sending RR CID: 0x%04x  local_busy:%d rej_sent:%d srej_sent:%d Expected_Seq:%u Last_Ack:%u",
842                                 p_ccb->local_cid, p_ccb->fcrb.local_busy, p_ccb->fcrb.rej_sent, p_ccb->fcrb.srej_sent, p_ccb->fcrb.next_seq_expected,
843                                 p_ccb->fcrb.last_ack_sent);
844         }
845     }
846 
847     /* If a window has opened, check if we can send any more packets */
848     if ( (p_ccb->fcrb.retrans_q.count || p_ccb->xmit_hold_q.count)
849       && (p_ccb->fcrb.wait_ack == FALSE)
850       && (l2c_fcr_is_flow_controlled (p_ccb) == FALSE) )
851     {
852         l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
853     }
854 }
855 
856 /*******************************************************************************
857 **
858 ** Function         l2c_fcr_proc_tout
859 **
860 ** Description      Handle a timeout. We should be in error recovery state.
861 **
862 ** Returns          -
863 **
864 *******************************************************************************/
l2c_fcr_proc_tout(tL2C_CCB * p_ccb)865 void l2c_fcr_proc_tout (tL2C_CCB *p_ccb)
866 {
867     L2CAP_TRACE_DEBUG5 ("l2c_fcr_proc_tout:  CID: 0x%04x  num_tries: %u (max: %u)  wait_ack: %u  ack_q_count: %u",
868                         p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
869                         p_ccb->fcrb.wait_ack, p_ccb->fcrb.waiting_for_ack_q.count);
870 
871 #if (L2CAP_ERTM_STATS == TRUE)
872     p_ccb->fcrb.retrans_touts++;
873 #endif
874 
875     if ( (p_ccb->peer_cfg.fcr.max_transmit != 0) && (++p_ccb->fcrb.num_tries > p_ccb->peer_cfg.fcr.max_transmit) )
876     {
877         l2cu_disconnect_chnl (p_ccb);
878     }
879     else
880     {
881         if (!p_ccb->fcrb.srej_sent && !p_ccb->fcrb.rej_sent)
882         {
883             if (p_ccb->fcrb.local_busy)
884                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_P_BIT);
885             else
886                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_P_BIT);
887         }
888     }
889 }
890 
891 
892 /*******************************************************************************
893 **
894 ** Function         l2c_fcr_proc_ack_tout
895 **
896 ** Description      Send RR/RNR if we have not acked I frame
897 **
898 ** Returns          -
899 **
900 *******************************************************************************/
l2c_fcr_proc_ack_tout(tL2C_CCB * p_ccb)901 void l2c_fcr_proc_ack_tout (tL2C_CCB *p_ccb)
902 {
903     L2CAP_TRACE_DEBUG5 ("l2c_fcr_proc_ack_tout:  CID: 0x%04x State: %u  Wack:%u  Rq:%d  Acked:%d", p_ccb->local_cid,
904                         p_ccb->chnl_state, p_ccb->fcrb.wait_ack, p_ccb->fcrb.next_seq_expected, p_ccb->fcrb.last_ack_sent);
905 
906     if ( (p_ccb->chnl_state == CST_OPEN) && (!p_ccb->fcrb.wait_ack)
907       && (p_ccb->fcrb.last_ack_sent != p_ccb->fcrb.next_seq_expected) )
908     {
909 #if (L2CAP_ERTM_STATS == TRUE)
910         p_ccb->fcrb.xmit_ack_touts++;
911 #endif
912         if (p_ccb->fcrb.local_busy)
913             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
914         else
915             l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
916     }
917 }
918 
919 
920 /*******************************************************************************
921 **
922 ** Function         process_reqseq
923 **
924 ** Description      Handle receive sequence number
925 **
926 ** Returns          -
927 **
928 *******************************************************************************/
process_reqseq(tL2C_CCB * p_ccb,UINT16 ctrl_word)929 static BOOLEAN process_reqseq (tL2C_CCB *p_ccb, UINT16 ctrl_word)
930 {
931     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
932     UINT8       req_seq, num_bufs_acked, xx;
933     UINT16      ls;
934     UINT16      full_sdus_xmitted;
935 
936     /* Receive sequence number does not ack anything for SREJ with P-bit set to zero */
937     if ( (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
938      &&  ((ctrl_word & L2CAP_FCR_SUP_BITS) == (L2CAP_FCR_SUP_SREJ << L2CAP_FCR_SUP_SHIFT))
939      &&  ((ctrl_word & L2CAP_FCR_P_BIT) == 0) )
940     {
941         /* If anything still waiting for ack, restart the timer if it was stopped */
942         if (p_fcrb->waiting_for_ack_q.count)
943             l2c_fcr_start_timer (p_ccb);
944 
945         return (TRUE);
946     }
947 
948     /* Extract the receive sequence number from the control word */
949     req_seq = (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT;
950 
951     num_bufs_acked = (req_seq - p_fcrb->last_rx_ack) & L2CAP_FCR_SEQ_MODULO;
952 
953     /* Verify the request sequence is in range before proceeding */
954     if (num_bufs_acked > p_fcrb->waiting_for_ack_q.count)
955     {
956         /* The channel is closed if ReqSeq is not in range */
957         L2CAP_TRACE_WARNING4 ("L2CAP eRTM Frame BAD Req_Seq - ctrl_word: 0x%04x  req_seq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
958                                ctrl_word, req_seq, p_fcrb->last_rx_ack, p_fcrb->waiting_for_ack_q.count);
959 
960         l2cu_disconnect_chnl (p_ccb);
961         return (FALSE);
962     }
963 
964 /*
965     L2CAP_TRACE_DEBUG3 ("L2CAP process_reqseq 0x%02x  last_rx_ack: 0x%02x  QCount: %u",
966                            req_seq, p_fcrb->last_rx_ack, p_fcrb->waiting_for_ack_q.count);
967 */
968     p_fcrb->last_rx_ack = req_seq;
969 
970     /* Now we can release all acknowledged frames, and restart the retransmission timer if needed */
971     if (num_bufs_acked != 0)
972     {
973         p_fcrb->num_tries = 0;
974         full_sdus_xmitted = 0;
975 
976 #if (L2CAP_ERTM_STATS == TRUE)
977         l2c_fcr_collect_ack_delay (p_ccb, num_bufs_acked);
978 #endif
979 
980         for (xx = 0; xx < num_bufs_acked; xx++)
981         {
982             ls = ((BT_HDR *)(p_fcrb->waiting_for_ack_q.p_first))->layer_specific & L2CAP_FCR_SAR_BITS;
983 
984             if ( (ls == L2CAP_FCR_UNSEG_SDU) || (ls == L2CAP_FCR_END_SDU) )
985                 full_sdus_xmitted++;
986 
987             GKI_freebuf (GKI_dequeue (&p_fcrb->waiting_for_ack_q));
988         }
989 
990         /* If we are still in a wait_ack state, do not mess with the timer */
991         if (!p_ccb->fcrb.wait_ack)
992             l2c_fcr_stop_timer (p_ccb);
993 
994         /* Check if we need to call the "packet_sent" callback */
995         if ( (p_ccb->p_rcb) && (p_ccb->p_rcb->api.pL2CA_TxComplete_Cb) && (full_sdus_xmitted) )
996         {
997             /* Special case for eRTM, if all packets sent, send 0xFFFF */
998             if ( (p_fcrb->waiting_for_ack_q.count == 0) && (p_ccb->xmit_hold_q.count == 0) )
999                 full_sdus_xmitted = 0xFFFF;
1000 
1001             (*p_ccb->p_rcb->api.pL2CA_TxComplete_Cb)(p_ccb->local_cid, full_sdus_xmitted);
1002         }
1003     }
1004 
1005     /* If anything still waiting for ack, restart the timer if it was stopped */
1006     if (p_fcrb->waiting_for_ack_q.count)
1007         l2c_fcr_start_timer (p_ccb);
1008 
1009     return (TRUE);
1010 }
1011 
1012 
1013 /*******************************************************************************
1014 **
1015 ** Function         process_s_frame
1016 **
1017 ** Description      Process an S frame
1018 **
1019 ** Returns          -
1020 **
1021 *******************************************************************************/
process_s_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,UINT16 ctrl_word)1022 static void process_s_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
1023 {
1024     tL2C_FCRB   *p_fcrb      = &p_ccb->fcrb;
1025     UINT16      s_frame_type = (ctrl_word & L2CAP_FCR_SUP_BITS) >> L2CAP_FCR_SUP_SHIFT;
1026     BOOLEAN     remote_was_busy;
1027     BOOLEAN     all_ok = TRUE;
1028 
1029     if (p_buf->len != 0)
1030     {
1031         L2CAP_TRACE_WARNING1 ("Incorrect S-frame Length (%d)", p_buf->len);
1032     }
1033 
1034     L2CAP_TRACE_DEBUG2 ("process_s_frame ctrl_word 0x%04x fcrb_remote_busy:%d", ctrl_word, p_fcrb->remote_busy);
1035 
1036 #if (L2CAP_ERTM_STATS == TRUE)
1037     p_ccb->fcrb.s_frames_rcvd[s_frame_type]++;
1038 #endif
1039 
1040     if (ctrl_word & L2CAP_FCR_P_BIT)
1041     {
1042         p_fcrb->rej_sent   = FALSE;             /* After checkpoint, we can send anoher REJ */
1043         p_fcrb->send_f_rsp = TRUE;              /* Set a flag in case an I-frame is pending */
1044     }
1045 
1046     switch (s_frame_type)
1047     {
1048     case L2CAP_FCR_SUP_RR:
1049         remote_was_busy     = p_fcrb->remote_busy;
1050         p_fcrb->remote_busy = FALSE;
1051 
1052         if ( (ctrl_word & L2CAP_FCR_F_BIT) || (remote_was_busy) )
1053             all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
1054         break;
1055 
1056     case L2CAP_FCR_SUP_REJ:
1057         p_fcrb->remote_busy = FALSE;
1058         all_ok = retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS);
1059         break;
1060 
1061     case L2CAP_FCR_SUP_RNR:
1062         p_fcrb->remote_busy = TRUE;
1063         l2c_fcr_stop_timer (p_ccb);
1064         break;
1065 
1066     case L2CAP_FCR_SUP_SREJ:
1067         p_fcrb->remote_busy = FALSE;
1068         all_ok = retransmit_i_frames (p_ccb, (UINT8)((ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT));
1069         break;
1070     }
1071 
1072     if (all_ok)
1073     {
1074         /* If polled, we need to respond with F-bit. Note, we may have sent a I-frame with the F-bit */
1075         if (p_fcrb->send_f_rsp)
1076         {
1077             if (p_fcrb->srej_sent)
1078                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, L2CAP_FCR_F_BIT);
1079             else if (p_fcrb->local_busy)
1080                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, L2CAP_FCR_F_BIT);
1081             else
1082                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, L2CAP_FCR_F_BIT);
1083 
1084             p_fcrb->send_f_rsp = FALSE;
1085         }
1086     }
1087     else
1088     {
1089         L2CAP_TRACE_DEBUG0 ("process_s_frame hit_max_retries");
1090     }
1091 
1092     GKI_freebuf (p_buf);
1093 }
1094 
1095 
1096 /*******************************************************************************
1097 **
1098 ** Function         process_i_frame
1099 **
1100 ** Description      Process an I frame
1101 **
1102 ** Returns          -
1103 **
1104 *******************************************************************************/
process_i_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf,UINT16 ctrl_word,BOOLEAN delay_ack)1105 static void process_i_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word, BOOLEAN delay_ack)
1106 {
1107     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
1108     UINT8       tx_seq, num_lost, num_to_ack, next_srej;
1109 
1110     /* If we were doing checkpoint recovery, first retransmit all unacked I-frames */
1111     if (ctrl_word & L2CAP_FCR_F_BIT)
1112     {
1113         if (!retransmit_i_frames (p_ccb, L2C_FCR_RETX_ALL_PKTS))
1114         {
1115             GKI_freebuf(p_buf);
1116             return;
1117         }
1118     }
1119 
1120 #if (L2CAP_ERTM_STATS == TRUE)
1121     p_ccb->fcrb.ertm_pkt_counts[1]++;
1122     p_ccb->fcrb.ertm_byte_counts[1] += p_buf->len;
1123 #endif
1124 
1125     /* Extract the sequence number */
1126     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1127 
1128     /* If we have flow controlled the peer, ignore any bad I-frames from him */
1129     if ( (tx_seq != p_fcrb->next_seq_expected) && (p_fcrb->local_busy) )
1130     {
1131         L2CAP_TRACE_WARNING1 ("Dropping bad I-Frame since we flowed off, tx_seq:%u", tx_seq);
1132         l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
1133         GKI_freebuf(p_buf);
1134         return;
1135     }
1136 
1137     /* If there are no free buffers in the user Rx queue, drop the  */
1138     /* received buffer now before we update any sequence numbers    */
1139     if (GKI_poolfreecount (p_ccb->ertm_info.user_rx_pool_id) == 0)
1140     {
1141         L2CAP_TRACE_WARNING4 ("L2CAP CID: 0x%04x  Dropping I-Frame seq: %u  User RX Pool: %u  (Size: %u)  has no free buffers!!",
1142                               p_ccb->local_cid, tx_seq, p_ccb->ertm_info.user_rx_pool_id,
1143                               GKI_poolcount (p_ccb->ertm_info.user_rx_pool_id));
1144         GKI_freebuf(p_buf);
1145         return;
1146     }
1147 
1148     /* Check if tx-sequence is the expected one */
1149     if (tx_seq != p_fcrb->next_seq_expected)
1150     {
1151         num_lost = (tx_seq - p_fcrb->next_seq_expected) & L2CAP_FCR_SEQ_MODULO;
1152 
1153         /* Is the frame a duplicate ? If so, just drop it */
1154         if (num_lost >= p_ccb->our_cfg.fcr.tx_win_sz)
1155         {
1156             /* Duplicate - simply drop it */
1157             L2CAP_TRACE_WARNING2 ("process_i_frame() Dropping Duplicate Frame tx_seq:%u  ExpectedTxSeq %u", tx_seq, p_fcrb->next_seq_expected);
1158             GKI_freebuf(p_buf);
1159         }
1160         else
1161         {
1162             L2CAP_TRACE_WARNING6 ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej: %u",
1163                                  p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent, p_fcrb->srej_sent);
1164 
1165             if (p_fcrb->srej_sent)
1166             {
1167                 /* If SREJ sent, save the frame for later processing as long as it is in sequence */
1168                 next_srej = (((BT_HDR *)p_fcrb->srej_rcv_hold_q.p_last)->layer_specific + 1) & L2CAP_FCR_SEQ_MODULO;
1169 
1170                 if ( (tx_seq == next_srej) && (p_fcrb->srej_rcv_hold_q.count < p_ccb->our_cfg.fcr.tx_win_sz) )
1171                 {
1172                     /* If user gave us a pool for held rx buffers, use that */
1173                     if (p_ccb->ertm_info.fcr_rx_pool_id != HCI_ACL_POOL_ID)
1174                     {
1175                         BT_HDR *p_buf2;
1176 
1177                         /* Adjust offset and len so that control word is copied */
1178                         p_buf->offset -= L2CAP_FCR_OVERHEAD;
1179                         p_buf->len    += L2CAP_FCR_OVERHEAD;
1180 
1181                         p_buf2 = l2c_fcr_clone_buf (p_buf, p_buf->offset, p_buf->len, p_ccb->ertm_info.fcr_rx_pool_id);
1182 
1183                         if (p_buf2)
1184                         {
1185                             GKI_freebuf (p_buf);
1186                             p_buf = p_buf2;
1187                         }
1188                         p_buf->offset += L2CAP_FCR_OVERHEAD;
1189                         p_buf->len -= L2CAP_FCR_OVERHEAD;
1190                     }
1191                     L2CAP_TRACE_DEBUG4 ("process_i_frame() Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: %u  SRej1",
1192                                          num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
1193 
1194                     p_buf->layer_specific = tx_seq;
1195                     GKI_enqueue (&p_fcrb->srej_rcv_hold_q, p_buf);
1196                 }
1197                 else
1198                 {
1199                     L2CAP_TRACE_WARNING4 ("process_i_frame() CID: 0x%04x  frame dropped in Srej Sent next_srej:%u  hold_q.count:%u  win_sz:%u",
1200                                          p_ccb->local_cid, next_srej, p_fcrb->srej_rcv_hold_q.count, p_ccb->our_cfg.fcr.tx_win_sz);
1201 
1202                     p_fcrb->rej_after_srej = TRUE;
1203                     GKI_freebuf (p_buf);
1204                 }
1205             }
1206             else if (p_fcrb->rej_sent)
1207             {
1208                 L2CAP_TRACE_WARNING5 ("process_i_frame() CID: 0x%04x  Lost: %u  tx_seq:%u  ExpTxSeq %u  Rej: 1  SRej: %u",
1209                                      p_ccb->local_cid, num_lost, tx_seq, p_fcrb->next_seq_expected, p_fcrb->srej_sent);
1210 
1211                 /* If REJ sent, just drop the frame */
1212                 GKI_freebuf (p_buf);
1213             }
1214             else
1215             {
1216                 L2CAP_TRACE_DEBUG4 ("process_i_frame() CID: 0x%04x  tx_seq:%u  ExpTxSeq %u  Rej: %u",
1217                                      p_ccb->local_cid, tx_seq, p_fcrb->next_seq_expected, p_fcrb->rej_sent);
1218 
1219                 /* If only one lost, we will send SREJ, otherwise we will send REJ */
1220                 if (num_lost > 1)
1221                 {
1222                     GKI_freebuf (p_buf);
1223                     p_fcrb->rej_sent = TRUE;
1224                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_REJ, 0);
1225                 }
1226                 else
1227                 {
1228                     if (p_fcrb->srej_rcv_hold_q.count != 0)
1229                     {
1230                         L2CAP_TRACE_ERROR3 ("process_i_frame() CID: 0x%04x  sending SREJ tx_seq:%d hold_q.count:%u",
1231                                              p_ccb->local_cid, tx_seq, p_fcrb->srej_rcv_hold_q.count);
1232                     }
1233                     p_buf->layer_specific = tx_seq;
1234                     GKI_enqueue (&p_fcrb->srej_rcv_hold_q, p_buf);
1235                     p_fcrb->srej_sent = TRUE;
1236                     l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_SREJ, 0);
1237                 }
1238                 btu_stop_quick_timer (&p_ccb->fcrb.ack_timer);
1239             }
1240         }
1241         return;
1242     }
1243 
1244     /* Seq number is the next expected. Clear possible reject exception in case it occured */
1245     p_fcrb->rej_sent = p_fcrb->srej_sent = FALSE;
1246 
1247     /* Adjust the next_seq, so that if the upper layer sends more data in the callback
1248        context, the received frame is acked by an I-frame. */
1249     p_fcrb->next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
1250 
1251     /* If any SAR problem in eRTM mode, spec says disconnect. */
1252     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
1253     {
1254         L2CAP_TRACE_WARNING1 ("process_i_frame() CID: 0x%04x  reassembly failed", p_ccb->local_cid);
1255         l2cu_disconnect_chnl (p_ccb);
1256         return;
1257     }
1258 
1259     /* RR optimization - if peer can still send us more, then start an ACK timer */
1260     num_to_ack = (p_fcrb->next_seq_expected - p_fcrb->last_ack_sent) & L2CAP_FCR_SEQ_MODULO;
1261 
1262     if ( (num_to_ack < p_ccb->fcrb.max_held_acks) && (!p_fcrb->local_busy) )
1263         delay_ack = TRUE;
1264 
1265     /* We should neve never ack frame if we are not in OPEN state */
1266     if ((num_to_ack != 0) && p_ccb->in_use && (p_ccb->chnl_state == CST_OPEN))
1267     {
1268         /* If no frames are awaiting transmission or are held, send an RR or RNR S-frame for ack */
1269         if (delay_ack)
1270         {
1271             /* If it is the first I frame we did not ack, start ack timer */
1272             if (!p_ccb->fcrb.ack_timer.in_use)
1273             {
1274                 btu_start_quick_timer (&p_ccb->fcrb.ack_timer, BTU_TTYPE_L2CAP_FCR_ACK,
1275                                         (L2CAP_FCR_ACK_TOUT*QUICK_TIMER_TICKS_PER_SEC)/1000);
1276             }
1277         }
1278         else if ( ((p_ccb->xmit_hold_q.count == 0) || (l2c_fcr_is_flow_controlled (p_ccb)))
1279                &&  (p_ccb->fcrb.srej_rcv_hold_q.count == 0) )
1280         {
1281             if (p_fcrb->local_busy)
1282                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RNR, 0);
1283             else
1284                 l2c_fcr_send_S_frame (p_ccb, L2CAP_FCR_SUP_RR, 0);
1285         }
1286     }
1287 }
1288 
1289 
1290 /*******************************************************************************
1291 **
1292 ** Function         process_stream_frame
1293 **
1294 ** Description      This function processes frames in streaming mode
1295 **
1296 ** Returns          -
1297 **
1298 *******************************************************************************/
process_stream_frame(tL2C_CCB * p_ccb,BT_HDR * p_buf)1299 static void process_stream_frame (tL2C_CCB *p_ccb, BT_HDR *p_buf)
1300 {
1301     UINT16      ctrl_word;
1302     UINT16      fcs;
1303     UINT8       *p;
1304     UINT8       tx_seq;
1305 
1306     /* Verify FCS if using */
1307     if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
1308     {
1309         p = ((UINT8 *)(p_buf+1)) + p_buf->offset + p_buf->len - L2CAP_FCS_LEN;
1310 
1311         /* Extract and drop the FCS from the packet */
1312         STREAM_TO_UINT16 (fcs, p);
1313         p_buf->len -= L2CAP_FCS_LEN;
1314 
1315         if (l2c_fcr_rx_get_fcs(p_buf) != fcs)
1316         {
1317             L2CAP_TRACE_WARNING1 ("Rx L2CAP PDU: CID: 0x%04x  BAD FCS", p_ccb->local_cid);
1318             GKI_freebuf(p_buf);
1319             return;
1320         }
1321     }
1322 
1323     /* Get the control word */
1324     p = ((UINT8 *)(p_buf+1)) + p_buf->offset;
1325 
1326     STREAM_TO_UINT16 (ctrl_word, p);
1327 
1328     p_buf->len    -= L2CAP_FCR_OVERHEAD;
1329     p_buf->offset += L2CAP_FCR_OVERHEAD;
1330 
1331     /* Make sure it is an I-frame */
1332     if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
1333     {
1334         L2CAP_TRACE_WARNING2 ("Rx L2CAP PDU: CID: 0x%04x  BAD S-frame in streaming mode  ctrl_word: 0x%04x", p_ccb->local_cid, ctrl_word);
1335         GKI_freebuf (p_buf);
1336         return;
1337     }
1338 
1339 #if BT_TRACE_VERBOSE == TRUE
1340     L2CAP_TRACE_EVENT6 ("L2CAP eRTM Rx I-frame: cid: 0x%04x  Len: %u  SAR: %-12s  TxSeq: %u  ReqSeq: %u  F: %u",
1341                         p_ccb->local_cid, p_buf->len,
1342                         SAR_types[(ctrl_word & L2CAP_FCR_SAR_BITS) >> L2CAP_FCR_SAR_BITS_SHIFT],
1343                         (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT,
1344                         (ctrl_word & L2CAP_FCR_REQ_SEQ_BITS) >> L2CAP_FCR_REQ_SEQ_BITS_SHIFT,
1345                         (ctrl_word & L2CAP_FCR_F_BIT) >> L2CAP_FCR_F_BIT_SHIFT);
1346 #endif
1347 
1348     /* Extract the sequence number */
1349     tx_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1350 
1351     /* Check if tx-sequence is the expected one */
1352     if (tx_seq != p_ccb->fcrb.next_seq_expected)
1353     {
1354         L2CAP_TRACE_WARNING4 ("Rx L2CAP PDU: CID: 0x%04x  Lost frames Exp: %u  Got: %u  p_rx_sdu: 0x%08x",
1355                                 p_ccb->local_cid, p_ccb->fcrb.next_seq_expected, tx_seq, p_ccb->fcrb.p_rx_sdu);
1356 
1357         /* Lost one or more packets, so flush the SAR queue */
1358         if (p_ccb->fcrb.p_rx_sdu != NULL)
1359         {
1360             GKI_freebuf (p_ccb->fcrb.p_rx_sdu);
1361             p_ccb->fcrb.p_rx_sdu = NULL;
1362         }
1363     }
1364 
1365     p_ccb->fcrb.next_seq_expected = (tx_seq + 1) & L2CAP_FCR_SEQ_MODULO;
1366 
1367     if (!do_sar_reassembly (p_ccb, p_buf, ctrl_word))
1368     {
1369         /* Some sort of SAR error, so flush the SAR queue */
1370         if (p_ccb->fcrb.p_rx_sdu != NULL)
1371         {
1372             GKI_freebuf (p_ccb->fcrb.p_rx_sdu);
1373             p_ccb->fcrb.p_rx_sdu = NULL;
1374         }
1375     }
1376 }
1377 
1378 
1379 /*******************************************************************************
1380 **
1381 ** Function         do_sar_reassembly
1382 **
1383 ** Description      Process SAR bits and re-assemble frame
1384 **
1385 ** Returns          TRUE if all OK, else FALSE
1386 **
1387 *******************************************************************************/
do_sar_reassembly(tL2C_CCB * p_ccb,BT_HDR * p_buf,UINT16 ctrl_word)1388 static BOOLEAN do_sar_reassembly (tL2C_CCB *p_ccb, BT_HDR *p_buf, UINT16 ctrl_word)
1389 {
1390     tL2C_FCRB   *p_fcrb = &p_ccb->fcrb;
1391     UINT16      sar_type = ctrl_word & L2CAP_FCR_SEG_BITS;
1392     BOOLEAN     packet_ok = TRUE;
1393     UINT8       *p;
1394 
1395     /* Check if the SAR state is correct */
1396     if ((sar_type == L2CAP_FCR_UNSEG_SDU) || (sar_type == L2CAP_FCR_START_SDU))
1397     {
1398         if (p_fcrb->p_rx_sdu != NULL)
1399         {
1400             L2CAP_TRACE_WARNING2 ("SAR - got unexpected unsegmented or start SDU  Expected len: %u  Got so far: %u",
1401                                   p_fcrb->rx_sdu_len, p_fcrb->p_rx_sdu->len);
1402 
1403             packet_ok = FALSE;
1404         }
1405         /* Check the length of the packet */
1406         if ( (sar_type == L2CAP_FCR_START_SDU) && (p_buf->len < L2CAP_SDU_LEN_OVERHEAD) )
1407         {
1408             L2CAP_TRACE_WARNING1 ("SAR start packet too short: %u", p_buf->len);
1409             packet_ok = FALSE;
1410         }
1411     }
1412     else
1413     {
1414         if (p_fcrb->p_rx_sdu == NULL)
1415         {
1416             L2CAP_TRACE_WARNING0 ("SAR - got unexpected cont or end SDU");
1417             packet_ok = FALSE;
1418         }
1419     }
1420 
1421     if ( (packet_ok) && (sar_type != L2CAP_FCR_UNSEG_SDU) )
1422     {
1423         p = ((UINT8 *)(p_buf + 1)) + p_buf->offset;
1424 
1425         /* For start SDU packet, extract the SDU length */
1426         if (sar_type == L2CAP_FCR_START_SDU)
1427         {
1428             /* Get the SDU length */
1429             STREAM_TO_UINT16 (p_fcrb->rx_sdu_len, p);
1430             p_buf->offset += 2;
1431             p_buf->len    -= 2;
1432 
1433             if (p_fcrb->rx_sdu_len > p_ccb->max_rx_mtu)
1434             {
1435                 L2CAP_TRACE_WARNING2 ("SAR - SDU len: %u  larger than MTU: %u", p_fcrb->rx_sdu_len, p_fcrb->rx_sdu_len);
1436                 packet_ok = FALSE;
1437             }
1438             else if ((p_fcrb->p_rx_sdu = (BT_HDR *)GKI_getpoolbuf (p_ccb->ertm_info.user_rx_pool_id)) == NULL)
1439             {
1440                 L2CAP_TRACE_ERROR1 ("SAR - no buffer for SDU start user_rx_pool_id:%d", p_ccb->ertm_info.user_rx_pool_id);
1441                 packet_ok = FALSE;
1442             }
1443             else
1444             {
1445                 p_fcrb->p_rx_sdu->offset = 4; /* this is the minimal offset required by OBX to process incoming packets */
1446                 p_fcrb->p_rx_sdu->len    = 0;
1447             }
1448         }
1449 
1450         if (packet_ok)
1451         {
1452             if ((p_fcrb->p_rx_sdu->len + p_buf->len) > p_fcrb->rx_sdu_len)
1453             {
1454                 L2CAP_TRACE_ERROR4 ("SAR - SDU len exceeded  Type: %u   Lengths: %u %u %u",
1455                                     sar_type, p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
1456                 packet_ok = FALSE;
1457             }
1458             else if ( (sar_type == L2CAP_FCR_END_SDU) && ((p_fcrb->p_rx_sdu->len + p_buf->len) != p_fcrb->rx_sdu_len) )
1459             {
1460                 L2CAP_TRACE_WARNING3 ("SAR - SDU end rcvd but SDU incomplete: %u %u %u",
1461                                       p_fcrb->p_rx_sdu->len, p_buf->len, p_fcrb->rx_sdu_len);
1462                 packet_ok = FALSE;
1463             }
1464             else
1465             {
1466                 memcpy (((UINT8 *) (p_fcrb->p_rx_sdu + 1)) + p_fcrb->p_rx_sdu->offset + p_fcrb->p_rx_sdu->len, p, p_buf->len);
1467 
1468                 p_fcrb->p_rx_sdu->len += p_buf->len;
1469 
1470                 GKI_freebuf (p_buf);
1471                 p_buf = NULL;
1472 
1473                 if (sar_type == L2CAP_FCR_END_SDU)
1474                 {
1475                     p_buf            = p_fcrb->p_rx_sdu;
1476                     p_fcrb->p_rx_sdu = NULL;
1477                 }
1478             }
1479         }
1480     }
1481 
1482     if (packet_ok == FALSE)
1483     {
1484         GKI_freebuf (p_buf);
1485     }
1486     else if (p_buf != NULL)
1487     {
1488 #if (L2CAP_NUM_FIXED_CHNLS > 0)
1489         if (p_ccb->local_cid < L2CAP_BASE_APPL_CID &&
1490             (p_ccb->local_cid >= L2CAP_FIRST_FIXED_CHNL && p_ccb->local_cid <= L2CAP_LAST_FIXED_CHNL))
1491         {
1492             if (l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
1493                 (*l2cb.fixed_reg[p_ccb->local_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(p_ccb->p_lcb->remote_bd_addr, p_buf);
1494         }
1495         else
1496 #endif
1497             l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
1498     }
1499 
1500     return (packet_ok);
1501 }
1502 
1503 
1504 /*******************************************************************************
1505 **
1506 ** Function         retransmit_i_frames
1507 **
1508 ** Description      This function retransmits i-frames awaiting acks.
1509 **
1510 ** Returns          BOOLEAN - TRUE if retransmitted
1511 **
1512 *******************************************************************************/
retransmit_i_frames(tL2C_CCB * p_ccb,UINT8 tx_seq)1513 static BOOLEAN retransmit_i_frames (tL2C_CCB *p_ccb, UINT8 tx_seq)
1514 {
1515     BT_HDR      *p_buf, *p_buf2;
1516     UINT8       *p;
1517     UINT8       buf_seq;
1518     UINT16      ctrl_word;
1519 
1520     if ( (p_ccb->fcrb.waiting_for_ack_q.p_first)
1521      &&  (p_ccb->peer_cfg.fcr.max_transmit != 0)
1522      &&  (p_ccb->fcrb.num_tries >= p_ccb->peer_cfg.fcr.max_transmit) )
1523     {
1524         L2CAP_TRACE_EVENT5 ("Max Tries Exceeded:  (last_acq: %d  CID: 0x%04x  num_tries: %u (max: %u) ack_q_count: %u",
1525                 p_ccb->fcrb.last_rx_ack, p_ccb->local_cid, p_ccb->fcrb.num_tries, p_ccb->peer_cfg.fcr.max_transmit,
1526                 p_ccb->fcrb.waiting_for_ack_q.count);
1527 
1528         l2cu_disconnect_chnl (p_ccb);
1529         return (FALSE);
1530     }
1531 
1532     /* tx_seq indicates whether to retransmit a specific sequence or all (if == L2C_FCR_RETX_ALL_PKTS) */
1533     if (tx_seq != L2C_FCR_RETX_ALL_PKTS)
1534     {
1535         /* If sending only one, the sequence number tells us which one. Look for it.
1536         */
1537         for (p_buf = (BT_HDR *)p_ccb->fcrb.waiting_for_ack_q.p_first; p_buf; p_buf = (BT_HDR *)GKI_getnext (p_buf))
1538         {
1539             /* Get the old control word */
1540             p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
1541 
1542             STREAM_TO_UINT16 (ctrl_word, p);
1543 
1544             buf_seq = (ctrl_word & L2CAP_FCR_TX_SEQ_BITS) >> L2CAP_FCR_TX_SEQ_BITS_SHIFT;
1545 
1546             L2CAP_TRACE_DEBUG2 ("retransmit_i_frames()   cur seq: %u  looking for: %u", buf_seq, tx_seq);
1547 
1548             if (tx_seq == buf_seq)
1549                 break;
1550         }
1551 
1552         if (!p_buf)
1553         {
1554             L2CAP_TRACE_ERROR2 ("retransmit_i_frames() UNKNOWN seq: %u  q_count: %u", tx_seq, p_ccb->fcrb.waiting_for_ack_q.count);
1555             return (TRUE);
1556         }
1557     }
1558     else
1559     {
1560         /* Retransmitting everything. Flush buffers we already put in the link xmit queue.
1561         */
1562         p_buf = (BT_HDR *)p_ccb->p_lcb->link_xmit_data_q.p_first;
1563 
1564         while (p_buf != NULL)
1565         {
1566             /* Do not flush other CIDs or partial segments */
1567             if ( (p_buf->layer_specific == 0) && (p_buf->event == p_ccb->local_cid) )
1568             {
1569                 p_buf2 = p_buf;
1570                 p_buf = (BT_HDR *)GKI_getnext (p_buf);
1571 
1572                 GKI_remove_from_queue (&p_ccb->p_lcb->link_xmit_data_q, p_buf2);
1573                 GKI_freebuf (p_buf2);
1574             }
1575             else
1576                 p_buf = (BT_HDR *)GKI_getnext (p_buf);
1577         }
1578 
1579         /* Also flush our retransmission queue */
1580         while (p_ccb->fcrb.retrans_q.p_first)
1581             GKI_freebuf (GKI_dequeue (&p_ccb->fcrb.retrans_q));
1582 
1583         p_buf = (BT_HDR *)p_ccb->fcrb.waiting_for_ack_q.p_first;
1584     }
1585 
1586     while (p_buf != NULL)
1587     {
1588         p_buf2 = l2c_fcr_clone_buf (p_buf, p_buf->offset, p_buf->len, p_ccb->ertm_info.fcr_tx_pool_id);
1589 
1590         if (p_buf2)
1591         {
1592             p_buf2->layer_specific = p_buf->layer_specific;
1593 
1594             GKI_enqueue (&p_ccb->fcrb.retrans_q, p_buf2);
1595         }
1596 
1597         if ( (tx_seq != L2C_FCR_RETX_ALL_PKTS) || (p_buf2 == NULL) )
1598             break;
1599         else
1600             p_buf = (BT_HDR *)GKI_getnext (p_buf);
1601     }
1602 
1603     l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
1604 
1605     if (p_ccb->fcrb.waiting_for_ack_q.count)
1606     {
1607         p_ccb->fcrb.num_tries++;
1608         l2c_fcr_start_timer (p_ccb);
1609     }
1610 
1611     return (TRUE);
1612 }
1613 
1614 
1615 /*******************************************************************************
1616 **
1617 ** Function         l2c_fcr_get_next_xmit_sdu_seg
1618 **
1619 ** Description      Get the next SDU segment to transmit.
1620 **
1621 ** Returns          pointer to buffer with segment or NULL
1622 **
1623 *******************************************************************************/
l2c_fcr_get_next_xmit_sdu_seg(tL2C_CCB * p_ccb,UINT16 max_packet_length)1624 BT_HDR *l2c_fcr_get_next_xmit_sdu_seg (tL2C_CCB *p_ccb, UINT16 max_packet_length)
1625 {
1626     BOOLEAN     first_seg    = FALSE,       /* The segment is the first part of data  */
1627                 mid_seg      = FALSE,       /* The segment is the middle part of data */
1628                 last_seg     = FALSE;       /* The segment is the last part of data   */
1629     UINT16      sdu_len = 0;
1630     BT_HDR      *p_buf, *p_xmit;
1631     UINT8       *p;
1632     UINT16      max_pdu = p_ccb->tx_mps /* Needed? - L2CAP_MAX_HEADER_FCS*/;
1633 
1634     /* If there is anything in the retransmit queue, that goes first
1635     */
1636     if (p_ccb->fcrb.retrans_q.p_first)
1637     {
1638         p_buf = (BT_HDR *)GKI_dequeue (&p_ccb->fcrb.retrans_q);
1639 
1640         /* Update Rx Seq and FCS if we acked some packets while this one was queued */
1641         prepare_I_frame (p_ccb, p_buf, TRUE);
1642 
1643         p_buf->event = p_ccb->local_cid;
1644 
1645 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
1646         /* Use sdu_len to hold the control word */
1647         p = ((UINT8 *) (p_buf+1)) + p_buf->offset + L2CAP_PKT_OVERHEAD;
1648         STREAM_TO_UINT16 (sdu_len, p);
1649 
1650         /* Get out if packet was dropped; just pretend it went out */
1651         if (l2c_corrupt_the_fcr_packet (p_ccb, p_buf, FALSE, sdu_len))
1652             return (NULL);
1653 #endif  /* L2CAP_CORRUPT_ERTM_PKTS */
1654 
1655 #if (L2CAP_ERTM_STATS == TRUE)
1656         p_ccb->fcrb.pkts_retransmitted++;
1657         p_ccb->fcrb.ertm_pkt_counts[0]++;
1658         p_ccb->fcrb.ertm_byte_counts[0] += (p_buf->len - 8);
1659 #endif
1660         return (p_buf);
1661     }
1662 
1663     /* For BD/EDR controller, max_packet_length is set to 0             */
1664     /* For AMP controller, max_packet_length is set by available blocks */
1665     if ( (max_packet_length > L2CAP_MAX_HEADER_FCS)
1666       && (max_pdu + L2CAP_MAX_HEADER_FCS > max_packet_length) )
1667     {
1668         max_pdu = max_packet_length - L2CAP_MAX_HEADER_FCS;
1669     }
1670 
1671     p_buf = (BT_HDR *)p_ccb->xmit_hold_q.p_first;
1672 
1673     /* If there is more data than the MPS, it requires segmentation */
1674     if (p_buf->len > max_pdu)
1675     {
1676         /* We are using the "event" field to tell is if we already started segmentation */
1677         if (p_buf->event == 0)
1678         {
1679             first_seg = TRUE;
1680             sdu_len   = p_buf->len;
1681         }
1682         else
1683             mid_seg = TRUE;
1684 
1685         /* Get a new buffer and copy the data that can be sent in a PDU */
1686         p_xmit = l2c_fcr_clone_buf (p_buf, L2CAP_MIN_OFFSET + L2CAP_SDU_LEN_OFFSET,
1687                                     max_pdu, p_ccb->ertm_info.fcr_tx_pool_id);
1688 
1689         if (p_xmit != NULL)
1690         {
1691             p_buf->event  = p_ccb->local_cid;
1692             p_xmit->event = p_ccb->local_cid;
1693 
1694             p_buf->len    -= max_pdu;
1695             p_buf->offset += max_pdu;
1696 
1697             /* copy PBF setting */
1698             p_xmit->layer_specific = p_buf->layer_specific;
1699         }
1700         else /* Should never happen if the application has configured buffers correctly */
1701         {
1702             L2CAP_TRACE_ERROR1 ("L2CAP - cannot get buffer, for segmentation, pool: %u", p_ccb->ertm_info.fcr_tx_pool_id);
1703             return (NULL);
1704         }
1705     }
1706     else    /* Use the original buffer if no segmentation, or the last segment */
1707     {
1708         p_xmit = (BT_HDR *)GKI_dequeue (&p_ccb->xmit_hold_q);
1709 
1710         if (p_xmit->event != 0)
1711             last_seg = TRUE;
1712 
1713         p_xmit->event = p_ccb->local_cid;
1714     }
1715 
1716     /* Step back to add the L2CAP headers */
1717     p_xmit->offset -= (L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD);
1718     p_xmit->len    += L2CAP_PKT_OVERHEAD + L2CAP_FCR_OVERHEAD;
1719 
1720     if (first_seg)
1721     {
1722         p_xmit->offset -= L2CAP_SDU_LEN_OVERHEAD;
1723         p_xmit->len    += L2CAP_SDU_LEN_OVERHEAD;
1724     }
1725 
1726     /* Set the pointer to the beginning of the data */
1727     p = (UINT8 *)(p_xmit + 1) + p_xmit->offset;
1728 
1729     /* Now the L2CAP header */
1730 
1731     /* Note: if FCS has to be included then the length is recalculated later */
1732     UINT16_TO_STREAM (p, p_xmit->len - L2CAP_PKT_OVERHEAD);
1733 
1734     UINT16_TO_STREAM (p, p_ccb->remote_cid);
1735 
1736     if (first_seg)
1737     {
1738         /* Skip control word and add SDU length */
1739         p += 2;
1740         UINT16_TO_STREAM (p, sdu_len);
1741 
1742         /* We will store the SAR type in layer-specific */
1743         /* layer_specific is shared with flushable flag(bits 0-1), don't clear it */
1744         p_xmit->layer_specific |= L2CAP_FCR_START_SDU;
1745 
1746         first_seg = FALSE;
1747     }
1748     else if (mid_seg)
1749         p_xmit->layer_specific |= L2CAP_FCR_CONT_SDU;
1750     else if (last_seg)
1751         p_xmit->layer_specific |= L2CAP_FCR_END_SDU;
1752     else
1753         p_xmit->layer_specific |= L2CAP_FCR_UNSEG_SDU;
1754 
1755     prepare_I_frame (p_ccb, p_xmit, FALSE);
1756 
1757     if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
1758     {
1759         BT_HDR *p_wack = l2c_fcr_clone_buf (p_xmit, HCI_DATA_PREAMBLE_SIZE, p_xmit->len, p_ccb->ertm_info.fcr_tx_pool_id);
1760 
1761         if (!p_wack)
1762         {
1763             L2CAP_TRACE_ERROR3 ("L2CAP - no buffer for xmit cloning, CID: 0x%04x  Pool: %u  Count: %u",
1764                                 p_ccb->local_cid, p_ccb->ertm_info.fcr_tx_pool_id,  GKI_poolfreecount(p_ccb->ertm_info.fcr_tx_pool_id));
1765 
1766             /* We will not save the FCS in case we reconfigure and change options */
1767             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
1768                 p_xmit->len -= L2CAP_FCS_LEN;
1769 
1770             /* Pretend we sent it and it got lost */
1771             GKI_enqueue (&p_ccb->fcrb.waiting_for_ack_q, p_xmit);
1772             return (NULL);
1773         }
1774         else
1775         {
1776 #if (L2CAP_ERTM_STATS == TRUE)
1777             /* set timestamp at the end of tx I-frame to get acking delay */
1778             p = ((UINT8 *) (p_wack+1)) + p_wack->offset + p_wack->len;
1779             UINT32_TO_STREAM (p, GKI_get_os_tick_count());
1780 #endif
1781             /* We will not save the FCS in case we reconfigure and change options */
1782             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
1783                 p_wack->len -= L2CAP_FCS_LEN;
1784 
1785             p_wack->layer_specific = p_xmit->layer_specific;
1786             GKI_enqueue (&p_ccb->fcrb.waiting_for_ack_q, p_wack);
1787         }
1788 
1789 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
1790         {
1791             UINT16 ctrl_word;
1792             p = ((UINT8 *) (p_xmit+1)) + p_xmit->offset + L2CAP_PKT_OVERHEAD;
1793             STREAM_TO_UINT16 (ctrl_word, p);
1794 
1795             /* Get out if packet was dropped; pretend it was sent */
1796             if (l2c_corrupt_the_fcr_packet (p_ccb, p_xmit, FALSE, ctrl_word))
1797                 return (NULL);
1798         }
1799 #endif
1800 #if (L2CAP_ERTM_STATS == TRUE)
1801         p_ccb->fcrb.ertm_pkt_counts[0]++;
1802         p_ccb->fcrb.ertm_byte_counts[0] += (p_xmit->len - 8);
1803 #endif
1804 
1805     }
1806 
1807     return (p_xmit);
1808 }
1809 
1810 
1811 /*******************************************************************************
1812 ** Configuration negotiation functions
1813 **
1814 ** The following functions are used in negotiating channel modes during
1815 ** configuration
1816 ********************************************************************************/
1817 
1818 /*******************************************************************************
1819 **
1820 ** Function         l2c_fcr_chk_chan_modes
1821 **
1822 ** Description      Validates and adjusts if necessary, the FCR options
1823 **                  based on remote EXT features.
1824 **
1825 **                  Note: This assumes peer EXT Features have been received.
1826 **                      Basic mode is used if FCR Options have not been received
1827 **
1828 ** Returns          UINT8 - nonzero if can continue, '0' if no compatible channels
1829 **
1830 *******************************************************************************/
l2c_fcr_chk_chan_modes(tL2C_CCB * p_ccb)1831 UINT8 l2c_fcr_chk_chan_modes (tL2C_CCB *p_ccb)
1832 {
1833     /* Remove nonbasic options that the peer does not support */
1834     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_ENH_RETRANS))
1835         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_ERTM;
1836 
1837     if (!(p_ccb->p_lcb->peer_ext_fea & L2CAP_EXTFEA_STREAM_MODE))
1838         p_ccb->ertm_info.allowed_modes &= ~L2CAP_FCR_CHAN_OPT_STREAM;
1839 
1840     /* At least one type needs to be set (Basic, ERTM, STM) to continue */
1841     if (!p_ccb->ertm_info.allowed_modes)
1842     {
1843         L2CAP_TRACE_WARNING0 ("L2CAP - Peer does not support our desired channel types");
1844     }
1845 
1846     return (p_ccb->ertm_info.allowed_modes);
1847 }
1848 
1849 /*******************************************************************************
1850 **
1851 ** Function         l2c_fcr_adj_our_req_options
1852 **
1853 ** Description      Validates and sets up the FCR options passed in from
1854 **                  L2CA_ConfigReq based on remote device's features.
1855 **
1856 ** Returns          TRUE if no errors, Otherwise FALSE
1857 **
1858 *******************************************************************************/
l2c_fcr_adj_our_req_options(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)1859 BOOLEAN l2c_fcr_adj_our_req_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
1860 {
1861     tL2CAP_FCR_OPTS *p_fcr = &p_cfg->fcr;
1862 
1863     if (p_fcr->mode != p_ccb->ertm_info.preferred_mode)
1864     {
1865         L2CAP_TRACE_WARNING2 ("l2c_fcr_adj_our_req_options - preferred_mode (%d), does not match mode (%d)",
1866                             p_ccb->ertm_info.preferred_mode, p_fcr->mode);
1867 
1868         /* The preferred mode is passed in through tL2CAP_ERTM_INFO, so override this one */
1869         p_fcr->mode = p_ccb->ertm_info.preferred_mode;
1870     }
1871 
1872     /* If upper layer did not request eRTM mode, BASIC must be used */
1873     if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
1874     {
1875         if (p_cfg->fcr_present && p_fcr->mode != L2CAP_FCR_BASIC_MODE)
1876         {
1877             L2CAP_TRACE_WARNING1 ("l2c_fcr_adj_our_req_options (mode %d): ERROR: No FCR options set using BASIC mode", p_fcr->mode);
1878         }
1879         p_fcr->mode = L2CAP_FCR_BASIC_MODE;
1880     }
1881 
1882     /* Process the FCR options if initial channel bring-up (not a reconfig request)
1883     ** Determine initial channel mode to try based on our options and remote's features
1884     */
1885     if (p_cfg->fcr_present && !(p_ccb->config_done & RECONFIG_FLAG))
1886     {
1887         /* We need to have at least one mode type common with the peer */
1888         if (!l2c_fcr_chk_chan_modes(p_ccb))
1889         {
1890             /* Two channels have incompatible supported types */
1891             l2cu_disconnect_chnl (p_ccb);
1892             return (FALSE);
1893         }
1894 
1895         /* Basic is the only common channel mode between the two devices */
1896         else if (p_ccb->ertm_info.allowed_modes == L2CAP_FCR_CHAN_OPT_BASIC)
1897         {
1898             /* We only want to try Basic, so bypass sending the FCR options entirely */
1899             p_cfg->fcr_present = FALSE;
1900             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
1901             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
1902         }
1903 
1904         /* We have at least one non-basic mode available
1905          * Override mode from available mode options based on preference, if needed
1906          */
1907         else
1908         {
1909             /* If peer does not support STREAMING, try ERTM */
1910             if (p_fcr->mode == L2CAP_FCR_STREAM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_STREAM))
1911             {
1912                 L2CAP_TRACE_DEBUG0 ("L2C CFG: mode is STREAM, but peer does not support; Try ERTM");
1913                 p_fcr->mode = L2CAP_FCR_ERTM_MODE;
1914             }
1915 
1916             /* If peer does not support ERTM, try BASIC (will support this if made it here in the code) */
1917             if (p_fcr->mode == L2CAP_FCR_ERTM_MODE && !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM))
1918             {
1919                 L2CAP_TRACE_DEBUG0 ("L2C CFG: mode is ERTM, but peer does not support; Try BASIC");
1920                 p_fcr->mode = L2CAP_FCR_BASIC_MODE;
1921             }
1922         }
1923 
1924         if (p_fcr->mode != L2CAP_FCR_BASIC_MODE)
1925         {
1926             /* MTU must be smaller than buffer size */
1927             if ( (p_cfg->mtu_present) && (p_cfg->mtu > p_ccb->max_rx_mtu) )
1928             {
1929                 L2CAP_TRACE_WARNING2 ("L2CAP - MTU: %u  larger than buf size: %u", p_cfg->mtu, p_ccb->max_rx_mtu);
1930                 return (FALSE);
1931             }
1932 
1933             /* application want to use the default MPS */
1934             if (p_fcr->mps == L2CAP_DEFAULT_ERM_MPS)
1935             {
1936                 p_fcr->mps = L2CAP_MPS_OVER_BR_EDR;
1937             }
1938             /* MPS must be less than MTU */
1939             else if (p_fcr->mps > p_ccb->max_rx_mtu)
1940             {
1941                 L2CAP_TRACE_WARNING2 ("L2CAP - MPS  %u  invalid  MTU: %u", p_fcr->mps, p_ccb->max_rx_mtu);
1942                 return (FALSE);
1943             }
1944 
1945             /* We always initially read into the HCI buffer pool, so make sure it fits */
1946             if (p_fcr->mps > (L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS))
1947                 p_fcr->mps = L2CAP_MTU_SIZE - L2CAP_MAX_HEADER_FCS;
1948         }
1949         else
1950         {
1951             p_cfg->fcs_present = FALSE;             /* Illegal to use FCS option in basic mode */
1952             p_cfg->ext_flow_spec_present = FALSE;   /* Illegal to use extended flow spec in basic mode */
1953         }
1954 
1955         p_ccb->our_cfg.fcr = *p_fcr;
1956     }
1957     else    /* Not sure how to send a reconfiguration(??) should fcr be included? */
1958     {
1959         p_ccb->our_cfg.fcr_present = FALSE;
1960     }
1961 
1962     return (TRUE);
1963 }
1964 
1965 
1966 /*******************************************************************************
1967 **
1968 ** Function         l2c_fcr_adj_monitor_retran_timeout
1969 **
1970 ** Description      Overrides monitor/retrans timer value based on controller
1971 **
1972 ** Returns          None
1973 **
1974 *******************************************************************************/
l2c_fcr_adj_monitor_retran_timeout(tL2C_CCB * p_ccb)1975 void l2c_fcr_adj_monitor_retran_timeout (tL2C_CCB *p_ccb)
1976 {
1977     /* adjust our monitor/retran timeout */
1978     if (p_ccb->out_cfg_fcr_present)
1979     {
1980         /*
1981         ** if we requestd ERTM or accepted ERTM
1982         ** We may accept ERTM even if we didn't request ERTM, in case of requesting STREAM
1983         */
1984         if ((p_ccb->our_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE)
1985           ||(p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_ERTM_MODE))
1986         {
1987             /* upper layer setting is ignored */
1988             p_ccb->our_cfg.fcr.mon_tout    = L2CAP_MIN_MONITOR_TOUT;
1989             p_ccb->our_cfg.fcr.rtrans_tout = L2CAP_MIN_RETRANS_TOUT;
1990         }
1991         else
1992         {
1993             p_ccb->our_cfg.fcr.mon_tout    = 0;
1994             p_ccb->our_cfg.fcr.rtrans_tout = 0;
1995         }
1996 
1997         L2CAP_TRACE_DEBUG2 ("l2c_fcr_adj_monitor_retran_timeout: mon_tout:%d, rtrans_tout:%d",
1998                              p_ccb->our_cfg.fcr.mon_tout, p_ccb->our_cfg.fcr.rtrans_tout);
1999     }
2000 }
2001 /*******************************************************************************
2002 **
2003 ** Function         l2c_fcr_adj_our_rsp_options
2004 **
2005 ** Description      Overrides any neccesary FCR options passed in from
2006 **                  L2CA_ConfigRsp based on our FCR options.
2007 **                  Only makes adjustments if channel is in ERTM mode.
2008 **
2009 ** Returns          None
2010 **
2011 *******************************************************************************/
l2c_fcr_adj_our_rsp_options(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2012 void l2c_fcr_adj_our_rsp_options (tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
2013 {
2014     /* adjust our monitor/retran timeout */
2015     l2c_fcr_adj_monitor_retran_timeout(p_ccb);
2016 
2017     p_cfg->fcr_present = p_ccb->out_cfg_fcr_present;
2018 
2019     if (p_cfg->fcr_present)
2020     {
2021 // btla-specific ++
2022         /* Temporary - until a better algorithm is implemented */
2023         /* If peer's tx_wnd_sz requires too many buffers for us to support, then adjust it. For now, respond with our own tx_wnd_sz. */
2024         /* Note: peer is not guaranteed to obey our adjustment */
2025         if (p_ccb->peer_cfg.fcr.tx_win_sz > p_ccb->our_cfg.fcr.tx_win_sz)
2026         {
2027             L2CAP_TRACE_DEBUG3 ("%s: adjusting requested tx_win_sz from %i to %i", __FUNCTION__, p_ccb->peer_cfg.fcr.tx_win_sz, p_ccb->our_cfg.fcr.tx_win_sz);
2028             p_ccb->peer_cfg.fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
2029         }
2030 // btla-specific --
2031 
2032         p_cfg->fcr.mode         = p_ccb->peer_cfg.fcr.mode;
2033         p_cfg->fcr.tx_win_sz    = p_ccb->peer_cfg.fcr.tx_win_sz;
2034         p_cfg->fcr.max_transmit = p_ccb->peer_cfg.fcr.max_transmit;
2035         p_cfg->fcr.mps          = p_ccb->peer_cfg.fcr.mps;
2036         p_cfg->fcr.rtrans_tout  = p_ccb->our_cfg.fcr.rtrans_tout;
2037         p_cfg->fcr.mon_tout     = p_ccb->our_cfg.fcr.mon_tout;
2038     }
2039 }
2040 
2041 /*******************************************************************************
2042 **
2043 ** Function         l2c_fcr_renegotiate_chan
2044 **
2045 ** Description      Called upon unsuccessful peer response to config request.
2046 **                  If the error is because of the channel mode, it will try
2047 **                  to resend using another supported optional channel.
2048 **
2049 ** Returns          TRUE if resent configuration, False if channel matches or
2050 **                  cannot match.
2051 **
2052 *******************************************************************************/
l2c_fcr_renegotiate_chan(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2053 BOOLEAN l2c_fcr_renegotiate_chan(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
2054 {
2055     UINT8   peer_mode = p_ccb->our_cfg.fcr.mode;
2056     BOOLEAN can_renegotiate;
2057 
2058     /* Skip if this is a reconfiguration from OPEN STATE or if FCR is not returned */
2059     if (!p_cfg->fcr_present || (p_ccb->config_done & RECONFIG_FLAG))
2060         return (FALSE);
2061 
2062     /* Only retry if there are more channel options to try */
2063     if (p_cfg->result == L2CAP_CFG_UNACCEPTABLE_PARAMS)
2064     {
2065         peer_mode = (p_cfg->fcr_present) ? p_cfg->fcr.mode : L2CAP_FCR_BASIC_MODE;
2066 
2067         if (p_ccb->our_cfg.fcr.mode != peer_mode)
2068         {
2069 
2070             if ((--p_ccb->fcr_cfg_tries) == 0)
2071             {
2072                 p_cfg->result = L2CAP_CFG_FAILED_NO_REASON;
2073                 L2CAP_TRACE_WARNING0 ("l2c_fcr_renegotiate_chan (Max retries exceeded)");
2074             }
2075 
2076             can_renegotiate = FALSE;
2077 
2078             /* Try another supported mode if available based on our last attempted channel */
2079             switch (p_ccb->our_cfg.fcr.mode)
2080             {
2081                 /* Our Streaming mode request was unnacceptable; try ERTM or Basic */
2082             case L2CAP_FCR_STREAM_MODE:
2083                 /* Peer wants ERTM and we support it */
2084                 if ( (peer_mode == L2CAP_FCR_ERTM_MODE) && (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
2085                 {
2086                     L2CAP_TRACE_DEBUG0 ("l2c_fcr_renegotiate_chan(Trying ERTM)");
2087                     p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
2088                     can_renegotiate = TRUE;
2089                 }
2090                 else    /* Falls through */
2091 
2092             case L2CAP_FCR_ERTM_MODE:
2093                 {
2094                     /* We can try basic for any other peer mode if we support it */
2095                     if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC)
2096                     {
2097                         L2CAP_TRACE_DEBUG0 ("l2c_fcr_renegotiate_chan(Trying Basic)");
2098                         can_renegotiate = TRUE;
2099                         p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
2100                     }
2101                 }
2102                 break;
2103 
2104             default:
2105                 /* All other scenarios cannot be renegotiated */
2106                 break;
2107             }
2108 
2109             if (can_renegotiate)
2110             {
2111                 p_ccb->our_cfg.fcr_present = TRUE;
2112 
2113                 if (p_ccb->our_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
2114                 {
2115                     p_ccb->our_cfg.fcs_present = FALSE;
2116                     p_ccb->our_cfg.ext_flow_spec_present = FALSE;
2117 
2118                     /* Basic Mode uses ACL Data Pool, make sure the MTU fits */
2119                     if ( (p_cfg->mtu_present) && (p_cfg->mtu > L2CAP_MTU_SIZE) )
2120                     {
2121                         L2CAP_TRACE_WARNING1 ("L2CAP - adjust MTU: %u too large", p_cfg->mtu);
2122                         p_cfg->mtu = L2CAP_MTU_SIZE;
2123                     }
2124                 }
2125 
2126                 l2cu_process_our_cfg_req (p_ccb, &p_ccb->our_cfg);
2127                 l2cu_send_peer_config_req (p_ccb, &p_ccb->our_cfg);
2128                 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_L2CAP_CHNL, L2CAP_CHNL_CFG_TIMEOUT);
2129                 return (TRUE);
2130             }
2131         }
2132     }
2133 
2134     /* Disconnect if the channels do not match */
2135     if (p_ccb->our_cfg.fcr.mode != peer_mode)
2136     {
2137         L2CAP_TRACE_WARNING2 ("L2C CFG:  Channels incompatible (local %d, peer %d)",
2138                               p_ccb->our_cfg.fcr.mode, peer_mode);
2139         l2cu_disconnect_chnl (p_ccb);
2140     }
2141 
2142     return (FALSE);
2143 }
2144 
2145 
2146 /*******************************************************************************
2147 **
2148 ** Function         l2c_fcr_process_peer_cfg_req
2149 **
2150 ** Description      This function is called to process the FCR options passed
2151 **                  in the peer's configuration request.
2152 **
2153 ** Returns          UINT8 - L2CAP_PEER_CFG_OK, L2CAP_PEER_CFG_UNACCEPTABLE,
2154 **                          or L2CAP_PEER_CFG_DISCONNECT.
2155 **
2156 *******************************************************************************/
l2c_fcr_process_peer_cfg_req(tL2C_CCB * p_ccb,tL2CAP_CFG_INFO * p_cfg)2157 UINT8 l2c_fcr_process_peer_cfg_req(tL2C_CCB *p_ccb, tL2CAP_CFG_INFO *p_cfg)
2158 {
2159     UINT16 max_retrans_size;
2160     UINT8  fcr_ok = L2CAP_PEER_CFG_OK;
2161 
2162     p_ccb->p_lcb->w4_info_rsp = FALSE;      /* Handles T61x SonyEricsson Bug in Info Request */
2163 
2164     L2CAP_TRACE_EVENT5 ("l2c_fcr_process_peer_cfg_req() CFG fcr_present:%d fcr.mode:%d CCB FCR mode:%d preferred: %u allowed:%u",
2165                         p_cfg->fcr_present, p_cfg->fcr.mode, p_ccb->our_cfg.fcr.mode, p_ccb->ertm_info.preferred_mode,
2166                         p_ccb->ertm_info.allowed_modes);
2167 
2168     /* If Peer wants basic, we are done (accept it or disconnect) */
2169     if (p_cfg->fcr.mode == L2CAP_FCR_BASIC_MODE)
2170     {
2171         /* If we do not allow basic, disconnect */
2172         if ( !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) )
2173             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2174     }
2175 
2176     /* Need to negotiate if our modes are not the same */
2177     else if (p_cfg->fcr.mode != p_ccb->ertm_info.preferred_mode)
2178     {
2179         /* If peer wants a mode that we don't support then retry our mode (ex. rtx/flc), OR
2180         ** If we want ERTM and they wanted streaming retry our mode.
2181         ** Note: If we have already determined they support our mode previously
2182         **       from their EXF mask.
2183         */
2184         if ( (((1 << p_cfg->fcr.mode) & L2CAP_FCR_CHAN_OPT_ALL_MASK) == 0)
2185             || (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_ERTM_MODE) )
2186         {
2187             p_cfg->fcr.mode = p_ccb->our_cfg.fcr.mode;
2188             p_cfg->fcr.tx_win_sz = p_ccb->our_cfg.fcr.tx_win_sz;
2189             p_cfg->fcr.max_transmit = p_ccb->our_cfg.fcr.max_transmit;
2190             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
2191         }
2192 
2193         /* If we wanted basic, then try to renegotiate it */
2194         else if (p_ccb->ertm_info.preferred_mode == L2CAP_FCR_BASIC_MODE)
2195         {
2196             p_cfg->fcr.mode = L2CAP_FCR_BASIC_MODE;
2197             p_cfg->fcr.max_transmit = p_cfg->fcr.tx_win_sz = 0;
2198             p_cfg->fcr.rtrans_tout = p_cfg->fcr.mon_tout = p_cfg->fcr.mps = 0;
2199             p_ccb->our_cfg.fcr.rtrans_tout = p_ccb->our_cfg.fcr.mon_tout = p_ccb->our_cfg.fcr.mps = 0;
2200             fcr_ok = L2CAP_PEER_CFG_UNACCEPTABLE;
2201         }
2202 
2203         /* Only other valid case is if they want ERTM and we wanted STM which should be
2204            accepted if we support it; otherwise the channel should be disconnected */
2205         else if ( (p_cfg->fcr.mode != L2CAP_FCR_ERTM_MODE)
2206               || !(p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM) )
2207         {
2208             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2209         }
2210     }
2211 
2212     /* Configuration for FCR channels so make any adjustments and fwd to upper layer */
2213     if (fcr_ok == L2CAP_PEER_CFG_OK)
2214     {
2215         /* by default don't need to send params in the response */
2216         p_ccb->out_cfg_fcr_present = FALSE;
2217 
2218         /* Make any needed adjustments for the response to the peer */
2219         if (p_cfg->fcr_present && p_cfg->fcr.mode != L2CAP_FCR_BASIC_MODE)
2220         {
2221             /* Peer desires to bypass FCS check, and streaming or ERTM mode */
2222             if (p_cfg->fcs_present)
2223             {
2224                 p_ccb->peer_cfg.fcs = p_cfg->fcs;
2225                 p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCS;
2226                 if( p_cfg->fcs == L2CAP_CFG_FCS_BYPASS)
2227                     p_ccb->bypass_fcs |= L2CAP_CFG_FCS_PEER;
2228             }
2229 
2230             max_retrans_size = GKI_get_pool_bufsize (p_ccb->ertm_info.fcr_tx_pool_id) - sizeof(BT_HDR)
2231                                             - L2CAP_MIN_OFFSET - L2CAP_SDU_LEN_OFFSET - L2CAP_FCS_LEN;
2232 
2233             /* Ensure the MPS is not bigger than the MTU */
2234             if ( (p_cfg->fcr.mps == 0) || (p_cfg->fcr.mps > p_ccb->peer_cfg.mtu) )
2235             {
2236                 p_cfg->fcr.mps = p_ccb->peer_cfg.mtu;
2237                 p_ccb->out_cfg_fcr_present = TRUE;
2238             }
2239 
2240             /* Ensure the MPS is not bigger than our retransmission buffer */
2241             if (p_cfg->fcr.mps > max_retrans_size)
2242             {
2243                 L2CAP_TRACE_DEBUG2("CFG: Overriding MPS to %d (orig %d)", max_retrans_size, p_cfg->fcr.mps);
2244 
2245                 p_cfg->fcr.mps = max_retrans_size;
2246                 p_ccb->out_cfg_fcr_present = TRUE;
2247             }
2248 
2249             if (p_cfg->fcr.mode == L2CAP_FCR_ERTM_MODE)
2250             {
2251                 /* Always respond with FCR ERTM parameters */
2252                 p_ccb->out_cfg_fcr_present = TRUE;
2253             }
2254         }
2255 
2256         /* Everything ok, so save the peer's adjusted fcr options */
2257         p_ccb->peer_cfg.fcr = p_cfg->fcr;
2258 
2259         if (p_cfg->fcr_present)
2260             p_ccb->peer_cfg_bits |= L2CAP_CH_CFG_MASK_FCR;
2261     }
2262     else if (fcr_ok == L2CAP_PEER_CFG_UNACCEPTABLE)
2263     {
2264         /* Allow peer only one retry for mode */
2265         if (p_ccb->peer_cfg_already_rejected)
2266             fcr_ok = L2CAP_PEER_CFG_DISCONNECT;
2267         else
2268             p_ccb->peer_cfg_already_rejected = TRUE;
2269     }
2270 
2271     return (fcr_ok);
2272 }
2273 
2274 
2275 #if L2CAP_CORRUPT_ERTM_PKTS == TRUE
2276 /*******************************************************************************
2277 **  Functions used for testing ERTM mode
2278 */
2279 /* If FALSE, will also corrupt cid, length, control word, etc. */
2280 #ifndef L2CAP_CORR_FCS_ONLY
2281 #define L2CAP_CORR_FCS_ONLY TRUE
2282 #endif
2283 
2284 #define L2C_DISP_FRAME_SIZE 16
2285 /*******************************************************************************
2286 **
2287 ** Function         l2c_corrupt_the_fcr_packet
2288 **
2289 ** Description      This function is used for testing purposes only.
2290 **                  It systematically or randomly corrupts packets used with
2291 **                  ERTM channels.
2292 **
2293 ** Returns          BOOLEAN   TRUE if packet was dropped,
2294 **                            FALSE if fcs corrupted or no corruption
2295 **
2296 *******************************************************************************/
l2c_corrupt_the_fcr_packet(tL2C_CCB * p_ccb,BT_HDR * p_buf,BOOLEAN is_rx,UINT16 ctrl_word)2297 static BOOLEAN l2c_corrupt_the_fcr_packet (tL2C_CCB *p_ccb, BT_HDR *p_buf,
2298                                            BOOLEAN is_rx, UINT16 ctrl_word)
2299 {
2300     tL2C_FCR_TEST_CFG *p_cfg;
2301     UINT32   tc;
2302     UINT8   *p;
2303     UINT32   xx;
2304     char     buf[L2C_DISP_FRAME_SIZE];
2305 
2306     if (!p_ccb || !p_ccb->fcrb.test_cb.cfg.in_use)
2307         return FALSE;
2308 
2309     /* Prepare bad FCS */
2310     p = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
2311     tc = GKI_get_os_tick_count();
2312     tc ^= p[p_buf->len - 1];
2313     xx = tc % 47;
2314 
2315     p_cfg = &p_ccb->fcrb.test_cb.cfg;
2316 #if 0
2317     L2CAP_TRACE_DEBUG4 ("testcfg: type: %d, freq: %d (NRM-0, RDM-1), is_rx: %d, count: %d",
2318         p_cfg->type, p_cfg->freq, p_cfg->is_rx, p_cfg->count);
2319 #endif
2320     /* If not time to corrupt get out */
2321     if (p_cfg->freq == L2CAP_FCR_FREQ_RANDOM)
2322     {
2323         if (xx != 0)
2324             return FALSE;
2325     }
2326     else    /* check test criteria before corrupting */
2327     {
2328         if ( (p_cfg->count == 0)
2329           || (p_cfg->is_rx != is_rx)
2330           || ((UINT8)(ctrl_word & L2CAP_FCR_S_FRAME_BIT) != p_cfg->type) )
2331         {
2332             return FALSE;
2333         }
2334 
2335         /* Turn off if done */
2336         if (--(p_cfg->count) == 0)
2337         {
2338             p_ccb->fcrb.test_cb.cfg.in_use = FALSE;
2339         }
2340     }
2341 
2342 #if L2CAP_CORR_FCS_ONLY == TRUE
2343     /* Corrupt the FCS check */
2344     p[p_buf->len - 1] = p[p_buf->len - 2] = 0;
2345 #else
2346     /* If made it this far packet needs to be corrupted */
2347     xx = tc % p_buf->len;
2348 
2349     /* Make sure the value was changed */
2350     if (p[xx + 1] == 0)
2351         p[xx + 1] = 0x5A;
2352 
2353     p[xx] = p[xx] ^ p[xx + 1];
2354 
2355 #if 1   /* Enable if not wishing to corrupting frame type */
2356     {
2357         UINT8 *p_temp = ((UINT8 *) (p_buf + 1)) + p_buf->offset;
2358         p_temp += L2CAP_PKT_OVERHEAD;
2359         if ((UINT16)((*p_temp) & 0x01) != (ctrl_word & 0x0001))
2360         {
2361             (*p_temp) |= (UINT8)(ctrl_word & 0x0001);
2362         }
2363     }
2364 #endif
2365 #endif
2366 
2367     if (is_rx)
2368     {
2369         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
2370             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Rx S-Frame");
2371         else
2372             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Rx I-Frame");
2373     }
2374     else
2375     {
2376         if (ctrl_word & L2CAP_FCR_S_FRAME_BIT)
2377             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Tx S-Frame");
2378         else
2379             BCM_STRCPY_S(buf, L2C_DISP_FRAME_SIZE, "Tx I-Frame");
2380     }
2381 
2382     /* Lastly, just drop packet if FCS is not being used or if Tx */
2383     if (!is_rx || p_ccb->bypass_fcs == L2CAP_BYPASS_FCS)
2384     {
2385         L2CAP_TRACE_ERROR6 ("-=-=-=-=-=-=-=-   Dropping %s packet (0x%04x) tc: %u  Buf Len: %u  xx: %u  count: %d",
2386                         buf, (UINT32)p_buf, tc, p_buf->len, xx, p_cfg->count);
2387         GKI_freebuf(p_buf);
2388         return TRUE;
2389     }
2390     else
2391     {
2392         L2CAP_TRACE_ERROR6 ("-=-=-=-=-=-=-=-   Corrupting %s packet (0x%04x) tc: %u  Buf Len: %u  xx: %u  count: %d",
2393                         buf, (UINT32)p_buf, tc, p_buf->len, xx, p_cfg->count);
2394     }
2395 
2396     return FALSE;
2397 }
2398 
2399 
2400 /*******************************************************************************
2401 **
2402 ** Function         L2CA_SetupErtmTest
2403 **
2404 ** Description      This function is used for testing purposes only.
2405 **                  It corrupts or drops one or more packets used with ERTM channels.
2406 **
2407 ** Parameters
2408 **                  cid - channel ID  (0 uses RFCOMM PSM's CID)
2409 **
2410 **                  type - type of test to run (L2CAP_FCR_TTYPE_CORR_IFRAMES
2411 **                                              L2CAP_FCR_TTYPE_CORR_SFRAME
2412 **                                              L2CAP_FCR_TTYPE_STOP_TEST
2413 **                                              L2CAP_FCR_TTYPE_GET_CID - returns rfcomm cid only)
2414 **
2415 **                  is_rx  - TRUE to corrupt Rx packet, FALSE for Tx packet)
2416 **
2417 **                  freq - L2CAP_FCR_FREQ_RANDOM    (turns on random corruptions/drops)
2418 **                         L2CAP_FCR_FREQ_NORMAL    (turns on test with "count" corruptions/drops)
2419 **
2420 **                  count - number of packets in a row to drop or corrupt
2421 **
2422 ** Returns          CID of channel running test
2423 **
2424 *******************************************************************************/
L2CA_SetupErtmTest(UINT16 cid,UINT8 type,BOOLEAN is_rx,UINT8 freq,UINT16 count)2425 UINT16 L2CA_SetupErtmTest (UINT16 cid, UINT8 type, BOOLEAN is_rx, UINT8 freq, UINT16 count)
2426 {
2427     tL2C_CCB *p_ccb = NULL;
2428     tL2C_CCB *p_temp_ccb;
2429     tL2C_FCR_TEST_CB *p_test_cb;
2430     UINT16 xx;
2431 
2432     /* If '0' tests run on top of RFCOMM CID if active */
2433     if (cid == 0)
2434     {
2435         p_temp_ccb = l2cb.ccb_pool;
2436         for (xx = 0; xx < MAX_L2CAP_CHANNELS; xx++, p_temp_ccb++)
2437         {
2438             /* Fixed channels don't have p_rcb's */
2439             if (p_temp_ccb->in_use && p_temp_ccb->p_rcb && p_temp_ccb->p_rcb->psm == BT_PSM_RFCOMM)
2440             {
2441                 p_ccb = p_temp_ccb;
2442                 cid = L2CAP_BASE_APPL_CID + xx;
2443                 break;
2444             }
2445         }
2446     }
2447     else
2448         p_ccb = l2cu_find_ccb_by_cid (NULL, cid);
2449 
2450     if (!p_ccb || type == L2CAP_FCR_TTYPE_GET_CID)
2451     {
2452         if (type == L2CAP_FCR_TTYPE_GET_CID)
2453         {
2454             L2CAP_TRACE_API1 ("L2CA_SetupErtmTest (GET_CID): cid = 0x%04x", cid);
2455         }
2456         return (cid);
2457     }
2458 
2459     p_test_cb = &p_ccb->fcrb.test_cb;
2460 
2461     /* Turn off the current test */
2462     if (type == L2CAP_FCR_TTYPE_STOP_TEST)
2463     {
2464         if (p_test_cb->cfg.in_use)
2465         {
2466             L2CAP_TRACE_ERROR1 ("L2CA_SetupErtmTest (OFF): cid 0x%04x", cid);
2467         }
2468         p_test_cb->cfg.in_use = FALSE;
2469         p_test_cb->cfg.count = 0;
2470     }
2471 
2472     /* Process the new request */
2473     else if (!p_test_cb->cfg.in_use)
2474     {
2475         /* count must be positive unless random is used */
2476         if (!count && freq != L2CAP_FCR_FREQ_RANDOM)
2477         {
2478             L2CAP_TRACE_ERROR1 ("L2CA_SetupErtmTest (FAIL): Count = 0, freq = %d", freq);
2479             return (cid);
2480         }
2481 
2482         L2CAP_TRACE_ERROR5 ("L2CA_SetupErtmTest (START): cid 0x%04x, type %d, is_rx %d, freq %d, count %d",
2483                             cid, type, is_rx, freq, count);
2484 
2485         p_test_cb->cfg.in_use = TRUE;
2486         p_test_cb->cfg.freq = freq;
2487         p_test_cb->cfg.type = type;
2488         p_test_cb->cfg.is_rx = is_rx;
2489         p_test_cb->cfg.count = count;
2490     }
2491     else /* Test already in progress so ignore */
2492     {
2493         L2CAP_TRACE_ERROR5 ("L2CA_SetupErtmTest (ignoring): cid 0x%04x, type %d, is_rx %d, freq %d, count %d",
2494                             cid, type, is_rx, freq, count);
2495     }
2496 
2497     return (cid);
2498 }
2499 
2500 
2501 /*******************************************************************************
2502 ** The following routines are only used in conjunction with Conformance testing
2503 ********************************************************************************/
2504 
2505 /*******************************************************************************
2506 **
2507 ** Function         L2CA_SendPolledSFrame
2508 **
2509 ** Description      This function is used for testing purposes only.
2510 **                  It Sends a Polled RR or RNR to the peer
2511 **
2512 ** Parameters
2513 **                  cid - channel ID
2514 **
2515 **                  sup_type - (L2CAP_FCR_SUP_RR or L2CAP_FCR_SUP_RNR)
2516 **
2517 ** Returns          void
2518 **
2519 *******************************************************************************/
L2CA_SendPolledSFrame(UINT16 cid,UINT16 sup_type)2520 void L2CA_SendPolledSFrame (UINT16 cid, UINT16 sup_type)
2521 {
2522     tL2C_CCB *p_ccb = l2cu_find_ccb_by_cid (NULL, cid);
2523 
2524     if (p_ccb && (sup_type == L2CAP_FCR_SUP_RR || sup_type == L2CAP_FCR_SUP_RNR))
2525     {
2526         l2c_fcr_send_S_frame (p_ccb, sup_type, L2CAP_FCR_P_BIT);
2527     }
2528     else
2529     {
2530         L2CAP_TRACE_ERROR2 ("L2CA_SendPolledSFrame(ERROR): sup_type %u, p_ccb 0x%07x",
2531                             sup_type, (UINT32)p_ccb);
2532     }
2533 }
2534 
2535 /*******************************************************************************
2536 **
2537 ** Function         l2c_bypass_sframe_packet
2538 **
2539 ** Description      This function is used for testing purposes only.
2540 **                  It returns TRUE if S-Frame should be bypassed.
2541 **
2542 ** Returns          void
2543 **
2544 *******************************************************************************/
l2c_bypass_sframe_packet(tL2C_CCB * p_ccb)2545 static BOOLEAN l2c_bypass_sframe_packet (tL2C_CCB *p_ccb)
2546 {
2547     if (p_ccb && p_ccb->fcrb.test_cb.cfm.in_use)
2548     {
2549         if (p_ccb->fcrb.test_cb.cfm.skip_sframe_count > 0)
2550         {
2551             L2CAP_TRACE_ERROR1 ("l2c_bypass_sframe_packet (count %d)",
2552                                 p_ccb->fcrb.test_cb.cfm.skip_sframe_count);
2553 
2554             if (--p_ccb->fcrb.test_cb.cfm.skip_sframe_count == 0)
2555                 p_ccb->fcrb.test_cb.cfm.in_use = FALSE;
2556 
2557             /* Bypass sending S-Frame */
2558             return TRUE;
2559         }
2560         else
2561             p_ccb->fcrb.test_cb.cfm.in_use = FALSE;
2562     }
2563 
2564     return FALSE;
2565 }
2566 
2567 /*******************************************************************************
2568 **
2569 ** Function         L2CA_BypassSFrame
2570 **
2571 ** Description      This function is used for testing purposes only.
2572 **                  It skips sending 'count' S-Frames.
2573 **
2574 ** Parameters
2575 **                  cid - channel ID
2576 **
2577 **                  count - Number of S-Frames to skip sending
2578 **
2579 ** Returns          void
2580 **
2581 *******************************************************************************/
L2CA_BypassSFrame(UINT16 cid,UINT8 count)2582 void L2CA_BypassSFrame (UINT16 cid, UINT8 count)
2583 {
2584     tL2C_CCB *p_ccb = l2cu_find_ccb_by_cid (NULL, cid);
2585     tL2C_FCR_CFM_TEST_CB *p_test_cb;
2586 
2587     if (!p_ccb)
2588     {
2589         L2CAP_TRACE_WARNING1 ("L2CA_BypassSFrame(ERROR): no p_ccb (0x%07x)", (UINT32)p_ccb);
2590         return;
2591     }
2592 
2593     p_test_cb = &p_ccb->fcrb.test_cb.cfm;
2594 
2595     /* Initiate test if not active */
2596     if (!p_test_cb->in_use)
2597     {
2598         p_test_cb->in_use = TRUE;
2599         p_test_cb->skip_sframe_count = count;
2600     }
2601     else
2602     {
2603         L2CAP_TRACE_WARNING0 ("L2CA_BypassSFrame(ERROR): already in use (ignoring...)");
2604     }
2605 }
2606 
2607 #endif  /* L2CAP_CORRUPT_ERTM_PKTS == TRUE */
2608 
2609 #if (L2CAP_ERTM_STATS == TRUE)
2610 /*******************************************************************************
2611 **
2612 ** Function         l2c_fcr_collect_ack_delay
2613 **
2614 ** Description      collect throughput, delay, queue size of waiting ack
2615 **
2616 ** Parameters
2617 **                  tL2C_CCB
2618 **
2619 ** Returns          void
2620 **
2621 *******************************************************************************/
l2c_fcr_collect_ack_delay(tL2C_CCB * p_ccb,UINT8 num_bufs_acked)2622 static void l2c_fcr_collect_ack_delay (tL2C_CCB *p_ccb, UINT8 num_bufs_acked)
2623 {
2624     UINT32  index;
2625     BT_HDR *p_buf;
2626     UINT8  *p;
2627     UINT32  timestamp, delay;
2628     UINT8   xx;
2629     UINT8   str[120];
2630 
2631     index = p_ccb->fcrb.ack_delay_avg_index;
2632 
2633     /* update sum, max and min of waiting for ack queue size */
2634     p_ccb->fcrb.ack_q_count_avg[index] += p_ccb->fcrb.waiting_for_ack_q.count;
2635 
2636     if ( p_ccb->fcrb.waiting_for_ack_q.count > p_ccb->fcrb.ack_q_count_max[index] )
2637         p_ccb->fcrb.ack_q_count_max[index] = p_ccb->fcrb.waiting_for_ack_q.count;
2638 
2639     if ( p_ccb->fcrb.waiting_for_ack_q.count < p_ccb->fcrb.ack_q_count_min[index] )
2640         p_ccb->fcrb.ack_q_count_min[index] = p_ccb->fcrb.waiting_for_ack_q.count;
2641 
2642     /* update sum, max and min of round trip delay of acking */
2643     p_buf = (BT_HDR *)(p_ccb->fcrb.waiting_for_ack_q.p_first);
2644     for (xx = 0; (xx < num_bufs_acked)&&(p_buf); xx++)
2645     {
2646         /* adding up length of acked I-frames to get throughput */
2647         p_ccb->fcrb.throughput[index] += p_buf->len - 8;
2648 
2649         if ( xx == num_bufs_acked - 1 )
2650         {
2651             /* get timestamp from tx I-frame that receiver is acking */
2652             p = ((UINT8 *) (p_buf+1)) + p_buf->offset + p_buf->len;
2653             if (p_ccb->bypass_fcs != L2CAP_BYPASS_FCS)
2654             {
2655                 p += L2CAP_FCS_LEN;
2656             }
2657 
2658             STREAM_TO_UINT32 (timestamp, p);
2659             delay = GKI_get_os_tick_count() - timestamp;
2660 
2661             p_ccb->fcrb.ack_delay_avg[index] += delay;
2662             if ( delay > p_ccb->fcrb.ack_delay_max[index] )
2663                 p_ccb->fcrb.ack_delay_max[index] = delay;
2664             if ( delay < p_ccb->fcrb.ack_delay_min[index] )
2665                 p_ccb->fcrb.ack_delay_min[index] = delay;
2666         }
2667 
2668         p_buf = GKI_getnext(p_buf);
2669     }
2670 
2671     p_ccb->fcrb.ack_delay_avg_count++;
2672 
2673     /* calculate average and initialize next avg, min and max */
2674     if (p_ccb->fcrb.ack_delay_avg_count > L2CAP_ERTM_STATS_AVG_NUM_SAMPLES)
2675     {
2676         p_ccb->fcrb.ack_delay_avg_count = 0;
2677 
2678         p_ccb->fcrb.ack_q_count_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
2679         p_ccb->fcrb.ack_delay_avg[index] /= L2CAP_ERTM_STATS_AVG_NUM_SAMPLES;
2680 
2681         /* calculate throughput */
2682         timestamp = GKI_get_os_tick_count();
2683         if (timestamp - p_ccb->fcrb.throughput_start > 0 )
2684             p_ccb->fcrb.throughput[index] /= (timestamp - p_ccb->fcrb.throughput_start);
2685 
2686         p_ccb->fcrb.throughput_start = timestamp;
2687 
2688         sprintf(str, "[%02u] throughput: %5u, ack_delay avg:%3u, min:%3u, max:%3u, ack_q_count avg:%3u, min:%3u, max:%3u",
2689                 index, p_ccb->fcrb.throughput[index],
2690                 p_ccb->fcrb.ack_delay_avg[index], p_ccb->fcrb.ack_delay_min[index], p_ccb->fcrb.ack_delay_max[index],
2691                 p_ccb->fcrb.ack_q_count_avg[index], p_ccb->fcrb.ack_q_count_min[index], p_ccb->fcrb.ack_q_count_max[index] );
2692 
2693         BT_TRACE_1(TRACE_CTRL_GENERAL | TRACE_LAYER_GKI | TRACE_ORG_GKI , TRACE_TYPE_GENERIC, "%s", str);
2694 
2695         index = (index + 1) % L2CAP_ERTM_STATS_NUM_AVG;
2696         p_ccb->fcrb.ack_delay_avg_index = index;
2697 
2698         p_ccb->fcrb.ack_q_count_max[index] = 0;
2699         p_ccb->fcrb.ack_q_count_min[index] = 0xFFFFFFFF;
2700         p_ccb->fcrb.ack_q_count_avg[index] = 0;
2701 
2702 
2703         p_ccb->fcrb.ack_delay_max[index] = 0;
2704         p_ccb->fcrb.ack_delay_min[index] = 0xFFFFFFFF;
2705         p_ccb->fcrb.ack_delay_avg[index] = 0;
2706 
2707         p_ccb->fcrb.throughput[index] = 0;
2708     }
2709 }
2710 #endif
2711 
2712 
2713 
2714