1 /******************************************************************************
2 *
3 * Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains the main L2CAP entry points
22 *
23 ******************************************************************************/
24
25 #include <stdlib.h>
26 #include <string.h>
27 //#include <stdio.h>
28
29 #include "device/controller.h"
30 //#include "btcore/include/counter.h"
31 #include "common/bt_target.h"
32 #include "btm_int.h"
33 #include "stack/btu.h"
34 #include "stack/hcimsgs.h"
35 #include "stack/l2c_api.h"
36 #include "l2c_int.h"
37 #include "stack/l2cdefs.h"
38 //#include "osi/include/log.h"
39
40 /********************************************************************************/
41 /* L O C A L F U N C T I O N P R O T O T Y P E S */
42 /********************************************************************************/
43 #if (CLASSIC_BT_INCLUDED == TRUE)
44 static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len);
45 #endif ///CLASSIC_BT_INCLUDED == TRUE
46 /********************************************************************************/
47 /* G L O B A L L 2 C A P D A T A */
48 /********************************************************************************/
49 #if L2C_DYNAMIC_MEMORY == FALSE
50 tL2C_CB l2cb;
51 #else
52 tL2C_CB *l2c_cb_ptr;
53 #endif
54
55 #if BT_CLASSIC_BQB_INCLUDED
56 static BOOLEAN s_l2cap_bqb_bad_cmd_len_rej_flag = FALSE;
57 #endif /* BT_CLASSIC_BQB_INCLUDED */
58
59 #if 0 //Unused
60 /*******************************************************************************
61 **
62 ** Function l2c_bcst_msg
63 **
64 ** Description
65 **
66 ** Returns void
67 **
68 *******************************************************************************/
69 void l2c_bcst_msg( BT_HDR *p_buf, UINT16 psm )
70 {
71 UINT8 *p;
72
73 /* Ensure we have enough space in the buffer for the L2CAP and HCI headers */
74 if (p_buf->offset < L2CAP_BCST_MIN_OFFSET) {
75 L2CAP_TRACE_ERROR ("L2CAP - cannot send buffer, offset: %d", p_buf->offset);
76 osi_free (p_buf);
77 return;
78 }
79
80 /* Step back some bytes to add the headers */
81 p_buf->offset -= (HCI_DATA_PREAMBLE_SIZE + L2CAP_PKT_OVERHEAD + L2CAP_BCST_OVERHEAD);
82 p_buf->len += L2CAP_PKT_OVERHEAD + L2CAP_BCST_OVERHEAD;
83
84 /* Set the pointer to the beginning of the data */
85 p = (UINT8 *)(p_buf + 1) + p_buf->offset;
86
87 /* First, the HCI transport header */
88 UINT16_TO_STREAM (p, 0x0050 | (L2CAP_PKT_START << 12) | (2 << 14));
89
90 uint16_t acl_data_size = controller_get_interface()->get_acl_data_size_classic();
91 /* The HCI transport will segment the buffers. */
92 if (p_buf->len > acl_data_size) {
93 UINT16_TO_STREAM (p, acl_data_size);
94 } else {
95 UINT16_TO_STREAM (p, p_buf->len);
96 }
97
98 /* Now the L2CAP header */
99 UINT16_TO_STREAM (p, p_buf->len - L2CAP_PKT_OVERHEAD);
100 UINT16_TO_STREAM (p, L2CAP_CONNECTIONLESS_CID);
101 UINT16_TO_STREAM (p, psm);
102
103 p_buf->len += HCI_DATA_PREAMBLE_SIZE;
104
105 if (p_buf->len <= controller_get_interface()->get_acl_packet_size_classic()) {
106 //counter_add("l2cap.ch2.tx.bytes", p_buf->len);
107 //counter_add("l2cap.ch2.tx.pkts", 1);
108
109 bte_main_hci_send(p_buf, BT_EVT_TO_LM_HCI_ACL);
110 }
111 }
112 #endif
113
114 /*******************************************************************************
115 **
116 ** Function l2cap_bqb_bad_cmd_len_rej_ctrl
117 **
118 ** Description Control rejecting L2CAP signaling PDUs with incorrect length
119 ** for BQB test.
120 **
121 ** Returns void
122 **
123 *******************************************************************************/
124 #if BT_CLASSIC_BQB_INCLUDED
l2cap_bqb_bad_cmd_len_rej_ctrl(BOOLEAN enable)125 void l2cap_bqb_bad_cmd_len_rej_ctrl(BOOLEAN enable)
126 {
127 s_l2cap_bqb_bad_cmd_len_rej_flag = enable;
128 }
129 #endif /* BT_CLASSIC_BQB_INCLUDED */
130
131
132 /*******************************************************************************
133 **
134 ** Function l2c_rcv_acl_data
135 **
136 ** Description This function is called from the HCI Interface when an ACL
137 ** data packet is received.
138 **
139 ** Returns void
140 **
141 *******************************************************************************/
l2c_rcv_acl_data(BT_HDR * p_msg)142 void l2c_rcv_acl_data (BT_HDR *p_msg)
143 {
144 UINT8 *p = (UINT8 *)(p_msg + 1) + p_msg->offset;
145 UINT16 handle, hci_len;
146 UINT8 pkt_type;
147 tL2C_LCB *p_lcb;
148 tL2C_CCB *p_ccb = NULL;
149 UINT16 l2cap_len, rcv_cid;
150 #if (!CONFIG_BT_STACK_NO_LOG)
151 UINT16 psm;
152 #endif
153 UINT16 credit;
154
155 /* Extract the handle */
156 STREAM_TO_UINT16 (handle, p);
157 pkt_type = HCID_GET_EVENT (handle);
158 handle = HCID_GET_HANDLE (handle);
159
160 /* Since the HCI Transport is putting segmented packets back together, we */
161 /* should never get a valid packet with the type set to "continuation" */
162 if (pkt_type != L2CAP_PKT_CONTINUE) {
163 /* Find the LCB based on the handle */
164 if ((p_lcb = l2cu_find_lcb_by_handle (handle)) == NULL) {
165 UINT8 cmd_code;
166
167 /* There is a slight possibility (specifically with USB) that we get an */
168 /* L2CAP connection request before we get the HCI connection complete. */
169 /* So for these types of messages, hold them for up to 2 seconds. */
170 STREAM_TO_UINT16 (hci_len, p);
171 STREAM_TO_UINT16 (l2cap_len, p);
172 STREAM_TO_UINT16 (rcv_cid, p);
173 STREAM_TO_UINT8 (cmd_code, p);
174
175 if ((p_msg->layer_specific == 0) && (rcv_cid == L2CAP_SIGNALLING_CID)
176 && (cmd_code == L2CAP_CMD_INFO_REQ || cmd_code == L2CAP_CMD_CONN_REQ)) {
177 L2CAP_TRACE_WARNING ("L2CAP - holding ACL for unknown handle:%d ls:%d"
178 " cid:%d opcode:%d cur count:%d", handle, p_msg->layer_specific,
179 rcv_cid, cmd_code, list_length(l2cb.rcv_pending_q));
180 p_msg->layer_specific = 2;
181 list_append(l2cb.rcv_pending_q, p_msg);
182
183 if (list_length(l2cb.rcv_pending_q) == 1) {
184 btu_start_timer (&l2cb.rcv_hold_tle, BTU_TTYPE_L2CAP_HOLD, BT_1SEC_TIMEOUT);
185 }
186
187 return;
188 } else {
189 L2CAP_TRACE_ERROR ("L2CAP - rcvd ACL for unknown handle:%d ls:%d cid:%d"
190 " opcode:%d cur count:%d", handle, p_msg->layer_specific, rcv_cid,
191 cmd_code, list_length(l2cb.rcv_pending_q));
192 }
193 osi_free (p_msg);
194 return;
195 }
196 } else {
197 L2CAP_TRACE_WARNING ("L2CAP - expected pkt start or complete, got: %d", pkt_type);
198 osi_free (p_msg);
199 return;
200 }
201
202 /* Extract the length and update the buffer header */
203 STREAM_TO_UINT16 (hci_len, p);
204 p_msg->offset += 4;
205
206 /* Extract the length and CID */
207 STREAM_TO_UINT16 (l2cap_len, p);
208 STREAM_TO_UINT16 (rcv_cid, p);
209
210 #if BLE_INCLUDED == TRUE
211 /* for BLE channel, always notify connection when ACL data received on the link */
212 if (p_lcb && p_lcb->transport == BT_TRANSPORT_LE && p_lcb->link_state != LST_DISCONNECTING)
213 /* only process fixed channel data as channel open indication when link is not in disconnecting mode */
214 {
215 l2cble_notify_le_connection(p_lcb->remote_bd_addr);
216 }
217 #endif
218 L2CAP_TRACE_DEBUG ("L2CAP - rcv_cid CID: 0x%04x\n", rcv_cid);
219 /* Find the CCB for this CID */
220 if (rcv_cid >= L2CAP_BASE_APPL_CID) {
221 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, rcv_cid)) == NULL) {
222 L2CAP_TRACE_WARNING ("L2CAP - unknown CID: 0x%04x", rcv_cid);
223 osi_free (p_msg);
224 return;
225 }
226 }
227
228 if (hci_len >= L2CAP_PKT_OVERHEAD) { /* Must receive at least the L2CAP length and CID.*/
229 p_msg->len = hci_len - L2CAP_PKT_OVERHEAD;
230 p_msg->offset += L2CAP_PKT_OVERHEAD;
231 } else {
232 L2CAP_TRACE_WARNING ("L2CAP - got incorrect hci header" );
233 osi_free (p_msg);
234 return;
235 }
236
237 if (l2cap_len != p_msg->len) {
238 L2CAP_TRACE_WARNING ("L2CAP - bad length in pkt. Exp: %d Act: %d",
239 l2cap_len, p_msg->len);
240
241 osi_free (p_msg);
242 return;
243 }
244
245 /* Send the data through the channel state machine */
246 if (rcv_cid == L2CAP_SIGNALLING_CID) {
247 //counter_add("l2cap.sig.rx.bytes", l2cap_len);
248 //counter_add("l2cap.sig.rx.pkts", 1);
249 #if (CLASSIC_BT_INCLUDED == TRUE)
250 process_l2cap_cmd (p_lcb, p, l2cap_len);
251 #endif ///CLASSIC_BT_INCLUDED == TRUE
252 osi_free (p_msg);
253 } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {
254 //counter_add("l2cap.ch2.rx.bytes", l2cap_len);
255 //counter_add("l2cap.ch2.rx.pkts", 1);
256 /* process_connectionless_data (p_lcb); */
257 #if !CONFIG_BT_STACK_NO_LOG
258 STREAM_TO_UINT16 (psm, p);
259 #endif
260 L2CAP_TRACE_DEBUG( "GOT CONNECTIONLESS DATA PSM:%d", psm ) ;
261
262 #if (L2CAP_UCD_INCLUDED == TRUE)
263 /* if it is not broadcast, check UCD registration */
264 if ( l2c_ucd_check_rx_pkts( p_lcb, p_msg ) ) {
265 /* nothing to do */
266 } else
267 #endif
268 {
269 osi_free (p_msg);
270 }
271 }
272 #if (BLE_INCLUDED == TRUE)
273 else if (rcv_cid == L2CAP_BLE_SIGNALLING_CID) {
274 //counter_add("l2cap.ble.rx.bytes", l2cap_len);
275 //counter_add("l2cap.ble.rx.pkts", 1);
276 l2cble_process_sig_cmd (p_lcb, p, l2cap_len);
277 osi_free (p_msg);
278 }
279 #endif
280 #if (L2CAP_NUM_FIXED_CHNLS > 0)
281 else if ((rcv_cid >= L2CAP_FIRST_FIXED_CHNL) && (rcv_cid <= L2CAP_LAST_FIXED_CHNL) &&
282 (l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb != NULL) ) {
283 //counter_add("l2cap.fix.rx.bytes", l2cap_len);
284 //counter_add("l2cap.fix.rx.pkts", 1);
285 /* If no CCB for this channel, allocate one */
286 if (p_lcb &&
287 /* only process fixed channel data when link is open or wait for data indication */
288 (p_lcb->link_state != LST_DISCONNECTING) &&
289 l2cu_initialize_fixed_ccb (p_lcb, rcv_cid, &l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].fixed_chnl_opts)) {
290 p_ccb = p_lcb->p_fixed_ccbs[rcv_cid - L2CAP_FIRST_FIXED_CHNL];
291
292 if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_BASIC_MODE) {
293 #if (CLASSIC_BT_INCLUDED == TRUE)
294 l2c_fcr_proc_pdu (p_ccb, p_msg);
295 #endif ///CLASSIC_BT_INCLUDED == TRUE
296 } else {
297 (*l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)
298 (rcv_cid, p_lcb->remote_bd_addr, p_msg);
299 }
300 } else {
301 osi_free (p_msg);
302 }
303 }
304 #endif
305
306 else {
307 //counter_add("l2cap.dyn.rx.bytes", l2cap_len);
308 //counter_add("l2cap.dyn.rx.pkts", 1);
309 if (p_ccb == NULL) {
310 osi_free (p_msg);
311 } else {
312 if (p_lcb->transport == BT_TRANSPORT_LE) {
313 // Got a pkt, valid send out credits to the peer device
314 credit = L2CAP_LE_DEFAULT_CREDIT;
315 L2CAP_TRACE_DEBUG("%s Credits received %d",__func__, credit);
316 if((p_ccb->peer_conn_cfg.credits + credit) > L2CAP_LE_MAX_CREDIT) {
317 /* we have received credits more than max coc credits,
318 * so disconnecting the Le Coc Channel
319 */
320 #if (BLE_INCLUDED == TRUE)
321 l2cble_send_peer_disc_req (p_ccb);
322 #endif ///BLE_INCLUDED == TRUE
323 } else {
324 p_ccb->peer_conn_cfg.credits += credit;
325 l2c_link_check_send_pkts (p_ccb->p_lcb, NULL, NULL);
326 }
327 }
328 /* Basic mode packets go straight to the state machine */
329 if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE) {
330 #if (CLASSIC_BT_INCLUDED == TRUE)
331 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_msg);
332 #endif ///CLASSIC_BT_INCLUDED == TRUE
333 } else {
334 /* eRTM or streaming mode, so we need to validate states first */
335 if ((p_ccb->chnl_state == CST_OPEN) || (p_ccb->chnl_state == CST_CONFIG)) {
336 #if (CLASSIC_BT_INCLUDED == TRUE)
337 l2c_fcr_proc_pdu (p_ccb, p_msg);
338 #endif ///CLASSIC_BT_INCLUDED == TRUE
339 } else {
340 osi_free (p_msg);
341 }
342 }
343 }
344 }
345 }
346
347 /*******************************************************************************
348 **
349 ** Function process_l2cap_cmd
350 **
351 ** Description This function is called when a packet is received on the
352 ** L2CAP signalling CID
353 **
354 ** Returns void
355 **
356 *******************************************************************************/
357 #if (CLASSIC_BT_INCLUDED == TRUE)
process_l2cap_cmd(tL2C_LCB * p_lcb,UINT8 * p,UINT16 pkt_len)358 static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len)
359 {
360 UINT8 *p_pkt_end, *p_next_cmd, *p_cfg_end, *p_cfg_start;
361 UINT8 cmd_code, cfg_code, cfg_len, id;
362 tL2C_CONN_INFO con_info;
363 tL2CAP_CFG_INFO cfg_info;
364 UINT16 rej_reason, rej_mtu, lcid, rcid, info_type;
365 tL2C_CCB *p_ccb;
366 tL2C_RCB *p_rcb;
367 BOOLEAN cfg_rej, pkt_size_rej = FALSE;
368 UINT16 cfg_rej_len, cmd_len;
369 UINT16 result;
370 tL2C_CONN_INFO ci;
371
372 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
373 /* if l2cap command received in CID 1 on top of an LE link, ignore this command */
374 if (p_lcb->transport == BT_TRANSPORT_LE) {
375 return;
376 }
377 #endif
378
379 /* Reject the packet if it exceeds the default Signalling Channel MTU */
380 if (pkt_len > L2CAP_DEFAULT_MTU) {
381 /* Core Spec requires a single response to the first command found in a multi-command
382 ** L2cap packet. If only responses in the packet, then it will be ignored.
383 ** Here we simply mark the bad packet and decide which cmd ID to reject later
384 */
385 pkt_size_rej = TRUE;
386 L2CAP_TRACE_ERROR ("L2CAP SIG MTU Pkt Len Exceeded (672) -> pkt_len: %d", pkt_len);
387 }
388
389 p_next_cmd = p;
390 p_pkt_end = p + pkt_len;
391
392 memset (&cfg_info, 0, sizeof(cfg_info));
393
394 /* An L2CAP packet may contain multiple commands */
395 while (TRUE) {
396 /* Smallest command is 4 bytes */
397 if ((p = p_next_cmd) > (p_pkt_end - 4)) {
398 break;
399 }
400
401 STREAM_TO_UINT8 (cmd_code, p);
402 STREAM_TO_UINT8 (id, p);
403 STREAM_TO_UINT16 (cmd_len, p);
404
405 /* Check command length does not exceed packet length */
406 if ((p_next_cmd = p + cmd_len) > p_pkt_end) {
407 L2CAP_TRACE_WARNING ("Command len bad pkt_len: %d cmd_len: %d code: %d",
408 pkt_len, cmd_len, cmd_code);
409 break;
410 }
411
412 L2CAP_TRACE_DEBUG ("cmd_code: %d, id:%d, cmd_len:%d", cmd_code, id, cmd_len);
413
414 /* Bad L2CAP packet length, look or cmd to reject */
415 if (pkt_size_rej) {
416 /* If command found rejected it and we're done, otherwise keep looking */
417 if (l2c_is_cmd_rejected(cmd_code, id, p_lcb)) {
418 return;
419 } else {
420 continue; /* Look for next cmd/response in current packet */
421 }
422 }
423
424 switch (cmd_code) {
425 case L2CAP_CMD_REJECT:
426 STREAM_TO_UINT16 (rej_reason, p);
427 if (rej_reason == L2CAP_CMD_REJ_MTU_EXCEEDED) {
428 STREAM_TO_UINT16 (rej_mtu, p);
429 /* What to do with the MTU reject ? We have negotiated an MTU. For now */
430 /* we will ignore it and let a higher protocol timeout take care of it */
431 L2CAP_TRACE_WARNING ("L2CAP - MTU rej Handle: %d MTU: %d", p_lcb->handle, rej_mtu);
432 }
433 if (rej_reason == L2CAP_CMD_REJ_INVALID_CID) {
434 STREAM_TO_UINT16 (rcid, p);
435 STREAM_TO_UINT16 (lcid, p);
436
437 L2CAP_TRACE_WARNING ("L2CAP - rej with CID invalid, LCID: 0x%04x RCID: 0x%04x", lcid, rcid);
438
439 /* Remote CID invalid. Treat as a disconnect */
440 if (((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL)
441 && (p_ccb->remote_cid == rcid)) {
442 /* Fake link disconnect - no reply is generated */
443 l2c_csm_execute (p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
444 }
445 }
446
447 /* SonyEricsson Info request Bug workaround (Continue connection) */
448 else if (rej_reason == L2CAP_CMD_REJ_NOT_UNDERSTOOD && p_lcb->w4_info_rsp) {
449 btu_stop_timer (&p_lcb->info_timer_entry);
450
451 p_lcb->w4_info_rsp = FALSE;
452 ci.status = HCI_SUCCESS;
453 memcpy (ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR));
454
455 /* For all channels, send the event through their FSMs */
456 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
457 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
458 }
459 }
460 break;
461
462 case L2CAP_CMD_CONN_REQ:
463 STREAM_TO_UINT16 (con_info.psm, p);
464 STREAM_TO_UINT16 (rcid, p);
465 if ((p_rcb = l2cu_find_rcb_by_psm (con_info.psm)) == NULL) {
466 L2CAP_TRACE_WARNING ("L2CAP - rcvd conn req for unknown PSM: %d", con_info.psm);
467 l2cu_reject_connection (p_lcb, rcid, id, L2CAP_CONN_NO_PSM);
468 break;
469 } else {
470 if (!p_rcb->api.pL2CA_ConnectInd_Cb) {
471 L2CAP_TRACE_WARNING ("L2CAP - rcvd conn req for outgoing-only connection PSM: %d", con_info.psm);
472 l2cu_reject_connection (p_lcb, rcid, id, L2CAP_CONN_NO_PSM);
473 break;
474 }
475 }
476 if ((p_ccb = l2cu_allocate_ccb (p_lcb, 0)) == NULL) {
477 L2CAP_TRACE_ERROR ("L2CAP - unable to allocate CCB");
478 l2cu_reject_connection (p_lcb, rcid, id, L2CAP_CONN_NO_RESOURCES);
479 break;
480 }
481 p_ccb->remote_id = id;
482 p_ccb->p_rcb = p_rcb;
483 p_ccb->remote_cid = rcid;
484
485 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_REQ, &con_info);
486 #if BT_CLASSIC_BQB_INCLUDED
487 // L2CAP/COS/CED/BI-02-C
488 if (s_l2cap_bqb_bad_cmd_len_rej_flag) {
489 l2cu_send_peer_cmd_reject (p_lcb, L2CAP_CMD_REJ_NOT_UNDERSTOOD, id, 0, 0);
490 }
491 #endif /* BT_CLASSIC_BQB_INCLUDED */
492 break;
493
494 case L2CAP_CMD_CONN_RSP:
495 STREAM_TO_UINT16 (con_info.remote_cid, p);
496 STREAM_TO_UINT16 (lcid, p);
497 STREAM_TO_UINT16 (con_info.l2cap_result, p);
498 STREAM_TO_UINT16 (con_info.l2cap_status, p);
499
500 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) == NULL) {
501 L2CAP_TRACE_WARNING ("L2CAP - no CCB for conn rsp, LCID: %d RCID: %d",
502 lcid, con_info.remote_cid);
503 break;
504 }
505 if (p_ccb->local_id != id) {
506 L2CAP_TRACE_WARNING ("L2CAP - con rsp - bad ID. Exp: %d Got: %d",
507 p_ccb->local_id, id);
508 break;
509 }
510
511 if (con_info.l2cap_result == L2CAP_CONN_OK) {
512 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP, &con_info);
513 } else if (con_info.l2cap_result == L2CAP_CONN_PENDING) {
514 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_PND, &con_info);
515 } else {
516 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_NEG, &con_info);
517 }
518
519 break;
520
521 case L2CAP_CMD_CONFIG_REQ:
522 p_cfg_end = p + cmd_len;
523 cfg_rej = FALSE;
524 cfg_rej_len = 0;
525
526 STREAM_TO_UINT16 (lcid, p);
527 STREAM_TO_UINT16 (cfg_info.flags, p);
528
529 p_cfg_start = p;
530
531 cfg_info.flush_to_present = cfg_info.mtu_present = cfg_info.qos_present =
532 cfg_info.fcr_present = cfg_info.fcs_present = FALSE;
533
534 while (p < p_cfg_end) {
535 STREAM_TO_UINT8 (cfg_code, p);
536 STREAM_TO_UINT8 (cfg_len, p);
537
538 switch (cfg_code & 0x7F) {
539 case L2CAP_CFG_TYPE_MTU:
540 cfg_info.mtu_present = TRUE;
541 STREAM_TO_UINT16 (cfg_info.mtu, p);
542 break;
543
544 case L2CAP_CFG_TYPE_FLUSH_TOUT:
545 cfg_info.flush_to_present = TRUE;
546 STREAM_TO_UINT16 (cfg_info.flush_to, p);
547 break;
548
549 case L2CAP_CFG_TYPE_QOS:
550 cfg_info.qos_present = TRUE;
551 STREAM_TO_UINT8 (cfg_info.qos.qos_flags, p);
552 STREAM_TO_UINT8 (cfg_info.qos.service_type, p);
553 STREAM_TO_UINT32 (cfg_info.qos.token_rate, p);
554 STREAM_TO_UINT32 (cfg_info.qos.token_bucket_size, p);
555 STREAM_TO_UINT32 (cfg_info.qos.peak_bandwidth, p);
556 STREAM_TO_UINT32 (cfg_info.qos.latency, p);
557 STREAM_TO_UINT32 (cfg_info.qos.delay_variation, p);
558 break;
559
560 case L2CAP_CFG_TYPE_FCR:
561 cfg_info.fcr_present = TRUE;
562 STREAM_TO_UINT8 (cfg_info.fcr.mode, p);
563 STREAM_TO_UINT8 (cfg_info.fcr.tx_win_sz, p);
564 STREAM_TO_UINT8 (cfg_info.fcr.max_transmit, p);
565 STREAM_TO_UINT16 (cfg_info.fcr.rtrans_tout, p);
566 STREAM_TO_UINT16 (cfg_info.fcr.mon_tout, p);
567 STREAM_TO_UINT16 (cfg_info.fcr.mps, p);
568 break;
569
570 case L2CAP_CFG_TYPE_FCS:
571 cfg_info.fcs_present = TRUE;
572 STREAM_TO_UINT8 (cfg_info.fcs, p);
573 break;
574
575 case L2CAP_CFG_TYPE_EXT_FLOW:
576 cfg_info.ext_flow_spec_present = TRUE;
577 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.id, p);
578 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.stype, p);
579 STREAM_TO_UINT16 (cfg_info.ext_flow_spec.max_sdu_size, p);
580 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.sdu_inter_time, p);
581 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.access_latency, p);
582 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.flush_timeout, p);
583 break;
584
585 default:
586 /* sanity check option length */
587 if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len) {
588 p += cfg_len;
589 if ((cfg_code & 0x80) == 0) {
590 cfg_rej_len += cfg_len + L2CAP_CFG_OPTION_OVERHEAD;
591 cfg_rej = TRUE;
592 }
593 }
594 /* bad length; force loop exit */
595 else {
596 p = p_cfg_end;
597 cfg_rej = TRUE;
598 }
599 break;
600 }
601 }
602
603 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) {
604 p_ccb->remote_id = id;
605 if (cfg_rej) {
606 l2cu_send_peer_config_rej (p_ccb, p_cfg_start, (UINT16) (cmd_len - L2CAP_CONFIG_REQ_LEN), cfg_rej_len);
607 } else {
608 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_CONFIG_REQ, &cfg_info);
609 }
610 } else {
611 /* updated spec says send command reject on invalid cid */
612 l2cu_send_peer_cmd_reject (p_lcb, L2CAP_CMD_REJ_INVALID_CID, id, 0, 0);
613 }
614 break;
615
616 case L2CAP_CMD_CONFIG_RSP:
617 p_cfg_end = p + cmd_len;
618 STREAM_TO_UINT16 (lcid, p);
619 STREAM_TO_UINT16 (cfg_info.flags, p);
620 STREAM_TO_UINT16 (cfg_info.result, p);
621
622 cfg_info.flush_to_present = cfg_info.mtu_present = cfg_info.qos_present =
623 cfg_info.fcr_present = cfg_info.fcs_present = FALSE;
624
625 while (p < p_cfg_end) {
626 STREAM_TO_UINT8 (cfg_code, p);
627 STREAM_TO_UINT8 (cfg_len, p);
628
629 switch (cfg_code & 0x7F) {
630 case L2CAP_CFG_TYPE_MTU:
631 cfg_info.mtu_present = TRUE;
632 STREAM_TO_UINT16 (cfg_info.mtu, p);
633 break;
634
635 case L2CAP_CFG_TYPE_FLUSH_TOUT:
636 cfg_info.flush_to_present = TRUE;
637 STREAM_TO_UINT16 (cfg_info.flush_to, p);
638 break;
639
640 case L2CAP_CFG_TYPE_QOS:
641 cfg_info.qos_present = TRUE;
642 STREAM_TO_UINT8 (cfg_info.qos.qos_flags, p);
643 STREAM_TO_UINT8 (cfg_info.qos.service_type, p);
644 STREAM_TO_UINT32 (cfg_info.qos.token_rate, p);
645 STREAM_TO_UINT32 (cfg_info.qos.token_bucket_size, p);
646 STREAM_TO_UINT32 (cfg_info.qos.peak_bandwidth, p);
647 STREAM_TO_UINT32 (cfg_info.qos.latency, p);
648 STREAM_TO_UINT32 (cfg_info.qos.delay_variation, p);
649 break;
650
651 case L2CAP_CFG_TYPE_FCR:
652 cfg_info.fcr_present = TRUE;
653 STREAM_TO_UINT8 (cfg_info.fcr.mode, p);
654 STREAM_TO_UINT8 (cfg_info.fcr.tx_win_sz, p);
655 STREAM_TO_UINT8 (cfg_info.fcr.max_transmit, p);
656 STREAM_TO_UINT16 (cfg_info.fcr.rtrans_tout, p);
657 STREAM_TO_UINT16 (cfg_info.fcr.mon_tout, p);
658 STREAM_TO_UINT16 (cfg_info.fcr.mps, p);
659 break;
660
661 case L2CAP_CFG_TYPE_FCS:
662 cfg_info.fcs_present = TRUE;
663 STREAM_TO_UINT8 (cfg_info.fcs, p);
664 break;
665
666 case L2CAP_CFG_TYPE_EXT_FLOW:
667 cfg_info.ext_flow_spec_present = TRUE;
668 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.id, p);
669 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.stype, p);
670 STREAM_TO_UINT16 (cfg_info.ext_flow_spec.max_sdu_size, p);
671 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.sdu_inter_time, p);
672 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.access_latency, p);
673 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.flush_timeout, p);
674 break;
675 }
676 }
677
678 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) {
679 if (p_ccb->local_id != id) {
680 L2CAP_TRACE_WARNING ("L2CAP - cfg rsp - bad ID. Exp: %d Got: %d",
681 p_ccb->local_id, id);
682 break;
683 }
684 if ( (cfg_info.result == L2CAP_CFG_OK) || (cfg_info.result == L2CAP_CFG_PENDING) ) {
685 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_CONFIG_RSP, &cfg_info);
686 } else {
687 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_CONFIG_RSP_NEG, &cfg_info);
688 }
689 } else {
690 L2CAP_TRACE_WARNING ("L2CAP - rcvd cfg rsp for unknown CID: 0x%04x", lcid);
691 }
692 break;
693
694
695 case L2CAP_CMD_DISC_REQ:
696 STREAM_TO_UINT16 (lcid, p);
697 STREAM_TO_UINT16 (rcid, p);
698
699 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) {
700 if (p_ccb->remote_cid == rcid) {
701 p_ccb->remote_id = id;
702 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DISCONNECT_REQ, &con_info);
703 }
704 } else {
705 l2cu_send_peer_disc_rsp (p_lcb, id, lcid, rcid);
706 }
707
708 break;
709
710 case L2CAP_CMD_DISC_RSP:
711 STREAM_TO_UINT16 (rcid, p);
712 STREAM_TO_UINT16 (lcid, p);
713
714 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) {
715 if ((p_ccb->remote_cid == rcid) && (p_ccb->local_id == id)) {
716 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DISCONNECT_RSP, &con_info);
717 }
718 }
719 break;
720
721 case L2CAP_CMD_ECHO_REQ:
722 l2cu_send_peer_echo_rsp (p_lcb, id, NULL, 0);
723 break;
724
725 case L2CAP_CMD_ECHO_RSP:
726 if (p_lcb->p_echo_rsp_cb) {
727 tL2CA_ECHO_RSP_CB *p_cb = p_lcb->p_echo_rsp_cb;
728
729 /* Zero out the callback in case app immediately calls us again */
730 p_lcb->p_echo_rsp_cb = NULL;
731
732 (*p_cb) (L2CAP_PING_RESULT_OK);
733 }
734 break;
735
736 case L2CAP_CMD_INFO_REQ:
737 STREAM_TO_UINT16 (info_type, p);
738 l2cu_send_peer_info_rsp (p_lcb, id, info_type);
739 break;
740
741 case L2CAP_CMD_INFO_RSP:
742 /* Stop the link connect timer if sent before L2CAP connection is up */
743 if (p_lcb->w4_info_rsp) {
744 btu_stop_timer (&p_lcb->info_timer_entry);
745 p_lcb->w4_info_rsp = FALSE;
746 }
747
748 STREAM_TO_UINT16 (info_type, p);
749 STREAM_TO_UINT16 (result, p);
750
751 p_lcb->info_rx_bits |= (1 << info_type);
752
753 if ( (info_type == L2CAP_EXTENDED_FEATURES_INFO_TYPE)
754 && (result == L2CAP_INFO_RESP_RESULT_SUCCESS) ) {
755 STREAM_TO_UINT32( p_lcb->peer_ext_fea, p );
756
757 #if (L2CAP_NUM_FIXED_CHNLS > 0)
758 if (p_lcb->peer_ext_fea & L2CAP_EXTFEA_FIXED_CHNLS) {
759 l2cu_send_peer_info_req (p_lcb, L2CAP_FIXED_CHANNELS_INFO_TYPE);
760 break;
761 } else {
762 l2cu_process_fixed_chnl_resp (p_lcb);
763 }
764 #endif
765 }
766
767
768 #if (L2CAP_NUM_FIXED_CHNLS > 0)
769 if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {
770 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
771 memcpy (p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);
772 }
773
774 l2cu_process_fixed_chnl_resp (p_lcb);
775 }
776 #endif
777 #if (L2CAP_UCD_INCLUDED == TRUE)
778 else if (info_type == L2CAP_CONNLESS_MTU_INFO_TYPE) {
779 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
780 STREAM_TO_UINT16 (p_lcb->ucd_mtu, p);
781 }
782 }
783 #endif
784
785 ci.status = HCI_SUCCESS;
786 memcpy (ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR));
787 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
788 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
789 }
790 break;
791
792 default:
793 L2CAP_TRACE_WARNING ("L2CAP - bad cmd code: %d", cmd_code);
794 l2cu_send_peer_cmd_reject (p_lcb, L2CAP_CMD_REJ_NOT_UNDERSTOOD, id, 0, 0);
795 return;
796 }
797 }
798
799 UNUSED(rej_mtu);
800 }
801 #endif ///CLASSIC_BT_INCLUDED == TRUE
802
803
804 /*******************************************************************************
805 **
806 ** Function l2c_process_held_packets
807 **
808 ** Description This function processes any L2CAP packets that arrived before
809 ** the HCI connection complete arrived. It is a work around for
810 ** badly behaved controllers.
811 **
812 ** Returns void
813 **
814 *******************************************************************************/
l2c_process_held_packets(BOOLEAN timed_out)815 void l2c_process_held_packets(BOOLEAN timed_out)
816 {
817 if (list_is_empty(l2cb.rcv_pending_q)) {
818 return;
819 }
820
821 if (!timed_out) {
822 btu_stop_timer(&l2cb.rcv_hold_tle);
823 L2CAP_TRACE_WARNING("L2CAP HOLD CONTINUE");
824 } else {
825 L2CAP_TRACE_WARNING("L2CAP HOLD TIMEOUT");
826 }
827
828 for (const list_node_t *node = list_begin(l2cb.rcv_pending_q);
829 node != list_end(l2cb.rcv_pending_q);) {
830 BT_HDR *p_buf = list_node(node);
831 node = list_next(node);
832 if (!timed_out || (!p_buf->layer_specific) || (--p_buf->layer_specific == 0)) {
833 list_remove(l2cb.rcv_pending_q, p_buf);
834 p_buf->layer_specific = 0xFFFF;
835 l2c_rcv_acl_data(p_buf);
836 }
837 }
838
839 /* If anyone still in the queue, restart the timeout */
840 if (!list_is_empty(l2cb.rcv_pending_q)) {
841 btu_start_timer (&l2cb.rcv_hold_tle, BTU_TTYPE_L2CAP_HOLD, BT_1SEC_TIMEOUT);
842 }
843 }
844
845
846 /*******************************************************************************
847 **
848 ** Function l2c_init
849 **
850 ** Description This function is called once at startup to initialize
851 ** all the L2CAP structures
852 **
853 ** Returns void
854 **
855 *******************************************************************************/
l2c_init(void)856 void l2c_init (void)
857 {
858 #if L2C_DYNAMIC_MEMORY
859 l2c_cb_ptr = (tL2C_CB *)osi_malloc(sizeof(tL2C_CB));
860 #endif /* #if L2C_DYNAMIC_MEMORY */
861 memset (&l2cb, 0, sizeof (tL2C_CB));
862 /* the psm is increased by 2 before being used */
863 l2cb.dyn_psm = 0xFFF;
864
865 l2cb.p_ccb_pool = list_new(osi_free_func);
866 if (l2cb.p_ccb_pool == NULL) {
867 L2CAP_TRACE_ERROR("%s unable to allocate memory for L2CAP channel control block", __func__);
868 }
869 l2cb.p_lcb_pool = list_new(osi_free_func);
870 if (l2cb.p_lcb_pool == NULL) {
871 L2CAP_TRACE_ERROR("%s unable to allocate memory for L2CAP Link control block", __func__);
872 }
873
874 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
875 /* it will be set to L2CAP_PKT_START_NON_FLUSHABLE if controller supports */
876 l2cb.non_flushable_pbf = L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT;
877 #endif
878
879
880
881 #ifdef L2CAP_DESIRED_LINK_ROLE
882 l2cb.desire_role = L2CAP_DESIRED_LINK_ROLE;
883 #else
884 l2cb.desire_role = HCI_ROLE_SLAVE;
885 #endif
886
887 /* Set the default idle timeout */
888 l2cb.idle_timeout = L2CAP_LINK_INACTIVITY_TOUT;
889
890 #if defined(L2CAP_INITIAL_TRACE_LEVEL)
891 l2cb.l2cap_trace_level = L2CAP_INITIAL_TRACE_LEVEL;
892 #else
893 l2cb.l2cap_trace_level = BT_TRACE_LEVEL_NONE; /* No traces */
894 #endif
895
896 #if L2CAP_CONFORMANCE_TESTING == TRUE
897 /* Conformance testing needs a dynamic response */
898 l2cb.test_info_resp = L2CAP_EXTFEA_SUPPORTED_MASK;
899 #endif
900
901 /* Number of ACL buffers to use for high priority channel */
902 #if (defined(L2CAP_HIGH_PRI_CHAN_QUOTA_IS_CONFIGURABLE) && (L2CAP_HIGH_PRI_CHAN_QUOTA_IS_CONFIGURABLE == TRUE))
903 l2cb.high_pri_min_xmit_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA;
904 #endif
905
906 #if BLE_INCLUDED == TRUE
907 l2cb.l2c_ble_fixed_chnls_mask =
908 L2CAP_FIXED_CHNL_ATT_BIT | L2CAP_FIXED_CHNL_BLE_SIG_BIT | L2CAP_FIXED_CHNL_SMP_BIT;
909 #endif
910
911 l2cb.rcv_pending_q = list_new(NULL);
912 if (l2cb.rcv_pending_q == NULL) {
913 L2CAP_TRACE_ERROR("%s unable to allocate memory for link layer control block", __func__);
914 }
915 #if BLE_INCLUDED == TRUE
916 l2ble_update_att_acl_pkt_num(L2CA_BUFF_INI, NULL);
917 #endif
918 }
l2c_free_p_lcb_pool(void)919 void l2c_free_p_lcb_pool(void)
920 {
921 list_node_t *p_node = NULL;
922 tL2C_LCB *p_lcb = NULL;
923 for (p_node = list_begin(l2cb.p_lcb_pool); p_node; p_node = list_next(p_node)) {
924 p_lcb = list_node(p_node);
925 if (p_lcb) {
926 l2cu_release_lcb (p_lcb);
927 }
928 }
929
930 list_free(l2cb.p_lcb_pool);
931 }
932
l2c_free_p_ccb_pool(void)933 void l2c_free_p_ccb_pool(void)
934 {
935 list_node_t *p_node = NULL;
936 tL2C_CCB *p_ccb = NULL;
937 for (p_node = list_begin(l2cb.p_ccb_pool); p_node; p_node = list_next(p_node)) {
938 p_ccb = list_node(p_node);
939 if (p_ccb) {
940 l2cu_release_ccb (p_ccb);
941 }
942 }
943
944 list_free(l2cb.p_ccb_pool);
945 }
946
l2c_free(void)947 void l2c_free(void)
948 {
949 list_free(l2cb.rcv_pending_q);
950 l2cb.rcv_pending_q = NULL;
951 l2c_free_p_lcb_pool();
952 l2c_free_p_ccb_pool();
953 #if L2C_DYNAMIC_MEMORY
954 FREE_AND_RESET(l2c_cb_ptr);
955 #endif
956 #if BLE_INCLUDED == TRUE
957 l2ble_update_att_acl_pkt_num(L2CA_BUFF_DEINIT, NULL);
958 #endif
959 }
960
961 /*******************************************************************************
962 **
963 ** Function l2c_process_timeout
964 **
965 ** Description This function is called when an L2CAP-related timeout occurs
966 **
967 ** Returns void
968 **
969 *******************************************************************************/
l2c_process_timeout(TIMER_LIST_ENT * p_tle)970 void l2c_process_timeout (TIMER_LIST_ENT *p_tle)
971 {
972 /* What type of timeout ? */
973 switch (p_tle->event) {
974 case BTU_TTYPE_L2CAP_LINK:
975 l2c_link_timeout ((tL2C_LCB *)p_tle->param);
976 break;
977 #if (CLASSIC_BT_INCLUDED == TRUE)
978 case BTU_TTYPE_L2CAP_CHNL:
979 l2c_csm_execute (((tL2C_CCB *)p_tle->param), L2CEVT_TIMEOUT, NULL);
980 break;
981
982 case BTU_TTYPE_L2CAP_FCR_ACK:
983 l2c_csm_execute (((tL2C_CCB *)p_tle->param), L2CEVT_ACK_TIMEOUT, NULL);
984 break;
985 #endif ///CLASSIC_BT_INCLUDED == TRUE
986 case BTU_TTYPE_L2CAP_HOLD:
987 /* Update the timeouts in the hold queue */
988 l2c_process_held_packets(TRUE);
989 break;
990
991 case BTU_TTYPE_L2CAP_INFO:
992 l2c_info_timeout((tL2C_LCB *)p_tle->param);
993 break;
994 case BTU_TTYPE_L2CAP_UPDA_CONN_PARAMS: {
995 #if (BLE_INCLUDED == TRUE)
996 UINT8 status = HCI_ERR_HOST_TIMEOUT;
997 tL2C_LCB *p_lcb = (tL2C_LCB *)p_tle->param;
998 if (p_lcb){
999 p_lcb->conn_update_mask &= ~L2C_BLE_UPDATE_PENDING;
1000 p_lcb->conn_update_mask &= ~L2C_BLE_UPDATE_PARAM_FULL;
1001 l2c_send_update_conn_params_cb(p_lcb, status);
1002 }
1003 #endif ///BLE_INCLUDED == TRUE
1004 break;
1005 }
1006 }
1007 }
1008
1009 /*******************************************************************************
1010 **
1011 ** Function l2c_data_write
1012 **
1013 ** Description API functions call this function to write data.
1014 **
1015 ** Returns L2CAP_DW_SUCCESS, if data accepted, else FALSE
1016 ** L2CAP_DW_CONGESTED, if data accepted and the channel is congested
1017 ** L2CAP_DW_FAILED, if error
1018 **
1019 *******************************************************************************/
1020 #if (CLASSIC_BT_INCLUDED == TRUE)
l2c_data_write(UINT16 cid,BT_HDR * p_data,UINT16 flags)1021 UINT8 l2c_data_write (UINT16 cid, BT_HDR *p_data, UINT16 flags)
1022 {
1023 tL2C_CCB *p_ccb;
1024
1025 /* Find the channel control block. We don't know the link it is on. */
1026 if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL) {
1027 L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_DataWrite, CID: %d", cid);
1028 osi_free (p_data);
1029 return (L2CAP_DW_FAILED);
1030 }
1031
1032 #ifndef TESTER /* Tester may send any amount of data. otherwise sending message
1033 bigger than mtu size of peer is a violation of protocol */
1034 if (p_data->len > p_ccb->peer_cfg.mtu) {
1035 L2CAP_TRACE_WARNING ("L2CAP - CID: 0x%04x cannot send message bigger than peer's mtu size", cid);
1036 osi_free (p_data);
1037 return (L2CAP_DW_FAILED);
1038 }
1039 #endif
1040
1041 /* channel based, packet based flushable or non-flushable */
1042 p_data->layer_specific = flags;
1043
1044 /* If already congested, do not accept any more packets */
1045 if (p_ccb->cong_sent) {
1046 L2CAP_TRACE_DEBUG ("L2CAP - CID: 0x%04x cannot send, already congested xmit_hold_q.count: %u buff_quota: %u",
1047 p_ccb->local_cid,
1048 fixed_queue_length(p_ccb->xmit_hold_q),
1049 p_ccb->buff_quota);
1050
1051 osi_free (p_data);
1052 return (L2CAP_DW_FAILED);
1053 }
1054
1055 //counter_add("l2cap.dyn.tx.bytes", p_data->len);
1056 //counter_add("l2cap.dyn.tx.pkts", 1);
1057
1058 l2c_csm_execute (p_ccb, L2CEVT_L2CA_DATA_WRITE, p_data);
1059
1060 if (p_ccb->cong_sent) {
1061 return (L2CAP_DW_CONGESTED);
1062 }
1063 return (L2CAP_DW_SUCCESS);
1064 }
1065 #endif ///CLASSIC_BT_INCLUDED == TRUE
1066
