1 /******************************************************************************
2  *
3  *  Copyright (C) 1999-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  this file contains the functions relating to link management. A "link"
22  *  is a connection between this device and another device. Only ACL links
23  *  are managed.
24  *
25  ******************************************************************************/
26 
27 #include <stdlib.h>
28 #include <string.h>
29 //#include <stdio.h>
30 
31 #include "device/controller.h"
32 //#include "btcore/include/counter.h"
33 #include "stack/bt_types.h"
34 //#include "bt_utils.h"
35 #include "stack/hcimsgs.h"
36 #include "stack/l2cdefs.h"
37 #include "l2c_int.h"
38 #include "stack/l2c_api.h"
39 #include "stack/btu.h"
40 #include "stack/btm_api.h"
41 #include "btm_int.h"
42 
43 static BOOLEAN l2c_link_send_to_lower (tL2C_LCB *p_lcb, BT_HDR *p_buf);
44 
45 #if (BLE_50_FEATURE_SUPPORT == TRUE)
46 extern tBTM_STATUS BTM_BleStartExtAdvRestart(uint8_t handle);
47 #endif// #if (BLE_50_FEATURE_SUPPORT == TRUE)
48 extern bool btm_ble_inter_get(void);
49 
50 /*******************************************************************************
51 **
52 ** Function         l2c_link_hci_conn_req
53 **
54 ** Description      This function is called when an HCI Connection Request
55 **                  event is received.
56 **
57 ** Returns          TRUE, if accept conn
58 **
59 *******************************************************************************/
l2c_link_hci_conn_req(BD_ADDR bd_addr)60 BOOLEAN l2c_link_hci_conn_req (BD_ADDR bd_addr)
61 {
62     tL2C_LCB        *p_lcb;
63     tL2C_LCB        *p_lcb_cur;
64     BOOLEAN         no_links;
65 
66     /* See if we have a link control block for the remote device */
67     p_lcb = l2cu_find_lcb_by_bd_addr (bd_addr, BT_TRANSPORT_BR_EDR);
68 
69     /* If we don't have one, create one and accept the connection. */
70     if (!p_lcb) {
71         p_lcb = l2cu_allocate_lcb (bd_addr, FALSE, BT_TRANSPORT_BR_EDR);
72         if (!p_lcb) {
73             btsnd_hcic_reject_conn (bd_addr, HCI_ERR_HOST_REJECT_RESOURCES);
74             L2CAP_TRACE_ERROR ("L2CAP failed to allocate LCB");
75             return FALSE;
76         }
77 
78         no_links = TRUE;
79 
80         /* If we already have connection, accept as a master */
81         list_node_t *p_node = NULL;
82         for (p_node = list_begin(l2cb.p_lcb_pool); p_node; p_node = list_next(p_node)) {
83             p_lcb_cur = list_node(p_node);
84             if (p_lcb_cur == p_lcb) {
85                 continue;
86             }
87 
88             if (p_lcb_cur->in_use) {
89                 no_links = FALSE;
90                 p_lcb->link_role = HCI_ROLE_MASTER;
91                 break;
92             }
93         }
94 
95         if (no_links) {
96             if (!btm_dev_support_switch (bd_addr)) {
97                 p_lcb->link_role = HCI_ROLE_SLAVE;
98             } else {
99                 p_lcb->link_role = l2cu_get_conn_role(p_lcb);
100             }
101         }
102 
103         //counter_add("l2cap.conn.accept", 1);
104 
105         /* Tell the other side we accept the connection */
106         btsnd_hcic_accept_conn (bd_addr, p_lcb->link_role);
107 
108         p_lcb->link_state = LST_CONNECTING;
109 
110         /* Start a timer waiting for connect complete */
111         btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_LINK_CONNECT_TOUT);
112         return (TRUE);
113     }
114 
115     /* We already had a link control block to the guy. Check what state it is in */
116     if ((p_lcb->link_state == LST_CONNECTING) || (p_lcb->link_state == LST_CONNECT_HOLDING)) {
117         /* Connection collision. Accept the connection anyways. */
118 
119         if (!btm_dev_support_switch (bd_addr)) {
120             p_lcb->link_role = HCI_ROLE_SLAVE;
121         } else {
122             p_lcb->link_role = l2cu_get_conn_role(p_lcb);
123         }
124 
125         //counter_add("l2cap.conn.accept", 1);
126         btsnd_hcic_accept_conn (bd_addr, p_lcb->link_role);
127 
128         p_lcb->link_state = LST_CONNECTING;
129         return (TRUE);
130     } else if (p_lcb->link_state == LST_DISCONNECTING) {
131         /* In disconnecting state, reject the connection. */
132         //counter_add("l2cap.conn.reject.disconn", 1);
133         btsnd_hcic_reject_conn (bd_addr, HCI_ERR_HOST_REJECT_DEVICE);
134     } else {
135         L2CAP_TRACE_ERROR("L2CAP got conn_req while connected (state:%d). Reject it\n",
136                           p_lcb->link_state);
137         /* Reject the connection with ACL Connection Already exist reason */
138         //counter_add("l2cap.conn.reject.exists", 1);
139         btsnd_hcic_reject_conn (bd_addr, HCI_ERR_CONNECTION_EXISTS);
140     }
141     return (FALSE);
142 }
143 
144 /*******************************************************************************
145 **
146 ** Function         l2c_link_hci_conn_comp
147 **
148 ** Description      This function is called when an HCI Connection Complete
149 **                  event is received.
150 **
151 ** Returns          void
152 **
153 *******************************************************************************/
l2c_link_hci_conn_comp(UINT8 status,UINT16 handle,BD_ADDR p_bda)154 BOOLEAN l2c_link_hci_conn_comp (UINT8 status, UINT16 handle, BD_ADDR p_bda)
155 {
156     tL2C_CONN_INFO       ci;
157     tL2C_LCB            *p_lcb;
158 #if (CLASSIC_BT_INCLUDED == TRUE)
159     tL2C_CCB            *p_ccb;
160 #endif  ///CLASSIC_BT_INCLUDED == TRUE
161     tBTM_SEC_DEV_REC    *p_dev_info = NULL;
162 
163     btm_acl_update_busy_level (BTM_BLI_PAGE_DONE_EVT);
164 
165     /* Save the parameters */
166     ci.status       = status;
167     memcpy (ci.bd_addr, p_bda, BD_ADDR_LEN);
168 
169     /* See if we have a link control block for the remote device */
170     p_lcb = l2cu_find_lcb_by_bd_addr (ci.bd_addr, BT_TRANSPORT_BR_EDR);
171 
172     /* If we don't have one, this is an error */
173     if (!p_lcb) {
174         L2CAP_TRACE_WARNING ("L2CAP got conn_comp for unknown BD_ADDR\n");
175         return (FALSE);
176     }
177 
178     if (p_lcb->link_state != LST_CONNECTING) {
179         L2CAP_TRACE_ERROR ("L2CAP got conn_comp in bad state: %d  status: 0x%d\n", p_lcb->link_state, status);
180 
181         if (status != HCI_SUCCESS) {
182             l2c_link_hci_disc_comp (p_lcb->handle, status);
183         }
184 
185         return (FALSE);
186     }
187 
188     /* Save the handle */
189     p_lcb->handle = handle;
190 
191     if (ci.status == HCI_SUCCESS) {
192         /* Connected OK. Change state to connected */
193         p_lcb->link_state = LST_CONNECTED;
194         //counter_add("l2cap.conn.ok", 1);
195 
196         /* Get the peer information if the l2cap flow-control/rtrans is supported */
197         l2cu_send_peer_info_req (p_lcb, L2CAP_EXTENDED_FEATURES_INFO_TYPE);
198 
199         /* Tell BTM Acl management about the link */
200         if ((p_dev_info = btm_find_dev (p_bda)) != NULL) {
201             btm_acl_created (ci.bd_addr, p_dev_info->dev_class,
202                              p_dev_info->sec_bd_name, handle,
203                              p_lcb->link_role, BT_TRANSPORT_BR_EDR);
204         } else {
205             btm_acl_created (ci.bd_addr, NULL, NULL, handle, p_lcb->link_role, BT_TRANSPORT_BR_EDR);
206         }
207 
208         BTM_SetLinkSuperTout (ci.bd_addr, btm_cb.btm_def_link_super_tout);
209 
210         /* If dedicated bonding do not process any further */
211         if (p_lcb->is_bonding) {
212             if (l2cu_start_post_bond_timer(handle)) {
213                 return (TRUE);
214             }
215         }
216 
217         /* Update the timeouts in the hold queue */
218         l2c_process_held_packets(FALSE);
219 
220         btu_stop_timer (&p_lcb->timer_entry);
221 #if (CLASSIC_BT_INCLUDED == TRUE)
222         /* For all channels, send the event through their FSMs */
223         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
224             l2c_csm_execute (p_ccb, L2CEVT_LP_CONNECT_CFM, &ci);
225         }
226 #endif  ///CLASSIC_BT_INCLUDED == TRUE
227         if (p_lcb->p_echo_rsp_cb) {
228             l2cu_send_peer_echo_req (p_lcb, NULL, 0);
229             btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_ECHO_RSP_TOUT);
230         } else if (!p_lcb->ccb_queue.p_first_ccb) {
231             btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_LINK_STARTUP_TOUT);
232         }
233     }
234     /* Max number of acl connections.                          */
235     /* If there's an lcb disconnecting set this one to holding */
236     else if ((ci.status == HCI_ERR_MAX_NUM_OF_CONNECTIONS) && l2cu_lcb_disconnecting()) {
237         p_lcb->link_state = LST_CONNECT_HOLDING;
238         p_lcb->handle = HCI_INVALID_HANDLE;
239     } else {
240         /* Just in case app decides to try again in the callback context */
241         p_lcb->link_state = LST_DISCONNECTING;
242 #if(CLASSIC_BT_INCLUDED == TRUE)
243         /* Connection failed. For all channels, send the event through */
244         /* their FSMs. The CCBs should remove themselves from the LCB  */
245         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; ) {
246             tL2C_CCB *pn = p_ccb->p_next_ccb;
247 
248             l2c_csm_execute (p_ccb, L2CEVT_LP_CONNECT_CFM_NEG, &ci);
249 
250             p_ccb = pn;
251         }
252 #endif ///CLASSIC_BT_INCLUDED == TRUE
253         p_lcb->disc_reason = status;
254         /* Release the LCB */
255         if (p_lcb->ccb_queue.p_first_ccb == NULL) {
256             l2cu_release_lcb (p_lcb);
257         } else {                          /* there are any CCBs remaining */
258             if (ci.status == HCI_ERR_CONNECTION_EXISTS) {
259                 /* we are in collision situation, wait for connection request from controller */
260                 p_lcb->link_state = LST_CONNECTING;
261             } else {
262                 l2cu_create_conn(p_lcb, BT_TRANSPORT_BR_EDR);
263             }
264         }
265     }
266     return (TRUE);
267 }
268 
269 
270 /*******************************************************************************
271 **
272 ** Function         l2c_link_sec_comp
273 **
274 ** Description      This function is called when required security procedures
275 **                  are completed.
276 **
277 ** Returns          void
278 **
279 *******************************************************************************/
l2c_link_sec_comp(BD_ADDR p_bda,tBT_TRANSPORT transport,void * p_ref_data,UINT8 status)280 void l2c_link_sec_comp (BD_ADDR p_bda, tBT_TRANSPORT transport, void *p_ref_data, UINT8 status)
281 {
282     tL2C_CONN_INFO  ci;
283     tL2C_LCB        *p_lcb;
284     tL2C_CCB        *p_ccb;
285     tL2C_CCB        *p_next_ccb;
286 #if (CLASSIC_BT_INCLUDED == TRUE)
287     UINT8           event;
288 #endif  ///CLASSIC_BT_INCLUDED == TRUE
289     UNUSED(transport);
290 
291     L2CAP_TRACE_DEBUG ("l2c_link_sec_comp: %d, %p", status, p_ref_data);
292 
293     if (status == BTM_SUCCESS_NO_SECURITY) {
294         status = BTM_SUCCESS;
295     }
296 
297     /* Save the parameters */
298     ci.status       = status;
299     memcpy (ci.bd_addr, p_bda, BD_ADDR_LEN);
300 
301     p_lcb = l2cu_find_lcb_by_bd_addr (p_bda, BT_TRANSPORT_BR_EDR);
302 
303     /* If we don't have one, this is an error */
304     if (!p_lcb) {
305         L2CAP_TRACE_WARNING ("L2CAP got sec_comp for unknown BD_ADDR\n");
306         return;
307     }
308 
309     /* Match p_ccb with p_ref_data returned by sec manager */
310     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_next_ccb) {
311         p_next_ccb = p_ccb->p_next_ccb;
312 
313         if (p_ccb == p_ref_data) {
314             switch (status) {
315             case BTM_SUCCESS:
316                 L2CAP_TRACE_DEBUG ("ccb timer ticks: %u", p_ccb->timer_entry.ticks);
317 #if (CLASSIC_BT_INCLUDED == TRUE)
318                 event = L2CEVT_SEC_COMP;
319 #endif  ///CLASSIC_BT_INCLUDED == TRUE
320                 break;
321 
322             case BTM_DELAY_CHECK:
323                 /* start a timer - encryption change not received before L2CAP connect req */
324                 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_L2CAP_CHNL, L2CAP_DELAY_CHECK_SM4);
325                 return;
326 
327             default:
328 #if (CLASSIC_BT_INCLUDED == TRUE)
329                 event = L2CEVT_SEC_COMP_NEG;
330 #endif  ///CLASSIC_BT_INCLUDED == TRUE
331                 break;
332             }
333 #if (CLASSIC_BT_INCLUDED == TRUE)
334             l2c_csm_execute (p_ccb, event, &ci);
335 #endif  ///CLASSIC_BT_INCLUDED == TRUE
336             break;
337         }
338     }
339 }
340 
341 /*******************************************************************************
342 **
343 ** Function         l2c_link_hci_disc_comp
344 **
345 ** Description      This function is called when an HCI Disconnect Complete
346 **                  event is received.
347 **
348 ** Returns          TRUE if the link is known about, else FALSE
349 **
350 *******************************************************************************/
l2c_link_hci_disc_comp(UINT16 handle,UINT8 reason)351 BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason)
352 {
353     tL2C_LCB    *p_lcb;
354 #if (CLASSIC_BT_INCLUDED == TRUE)
355     tL2C_CCB    *p_ccb;
356 #endif  ///CLASSIC_BT_INCLUDED == TRUE
357     BOOLEAN     status = TRUE;
358     BOOLEAN     lcb_is_free = TRUE;
359     tBT_TRANSPORT   transport = BT_TRANSPORT_BR_EDR;
360 
361     /* See if we have a link control block for the connection */
362     p_lcb = l2cu_find_lcb_by_handle (handle);
363     /* If we don't have one, maybe an SCO link. Send to MM */
364     if (!p_lcb) {
365 #if (BLE_INCLUDED == TRUE)
366         /* The Directed Advertising Timeout error code indicates that directed advertising completed */
367         if (reason != HCI_ERR_DIRECTED_ADVERTISING_TIMEOUT) {
368             BTM_Recovery_Pre_State();
369         }
370         #if (BLE_50_FEATURE_SUPPORT == TRUE)
371         if(btm_ble_inter_get() && reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT) {
372             BTM_BleStartExtAdvRestart(handle);
373         }
374         #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
375 #endif  ///BLE_INCLUDED == TRUE
376         status = FALSE;
377     } else {
378         /* There can be a case when we rejected PIN code authentication */
379         /* otherwise save a new reason */
380         if (btm_cb.acl_disc_reason != HCI_ERR_HOST_REJECT_SECURITY) {
381             btm_cb.acl_disc_reason = reason;
382         }
383 
384         p_lcb->disc_reason = btm_cb.acl_disc_reason;
385 
386         /* Just in case app decides to try again in the callback context */
387         p_lcb->link_state = LST_DISCONNECTING;
388 
389 #if (BLE_INCLUDED == TRUE)
390         /* Check for BLE and handle that differently */
391         if (p_lcb->transport == BT_TRANSPORT_LE) {
392             btm_ble_update_link_topology_mask(p_lcb->link_role, FALSE);
393         }
394 #endif
395 #if (CLASSIC_BT_INCLUDED == TRUE)
396         /* Link is disconnected. For all channels, send the event through */
397         /* their FSMs. The CCBs should remove themselves from the LCB     */
398         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; ) {
399             tL2C_CCB *pn = p_ccb->p_next_ccb;
400 
401             /* Keep connect pending control block (if exists)
402              * Possible Race condition when a reconnect occurs
403              * on the channel during a disconnect of link. This
404              * ccb will be automatically retried after link disconnect
405              * arrives
406              */
407             if (p_ccb != p_lcb->p_pending_ccb) {
408                 l2c_csm_execute (p_ccb, L2CEVT_LP_DISCONNECT_IND, &reason);
409             }
410             p_ccb = pn;
411         }
412 #endif  ///CLASSIC_BT_INCLUDED == TRUE
413 #if (BTM_SCO_INCLUDED == TRUE)
414 #if (BLE_INCLUDED == TRUE)
415         if (p_lcb->transport == BT_TRANSPORT_BR_EDR)
416 #endif
417         {
418             /* Tell SCO management to drop any SCOs on this ACL */
419             btm_sco_acl_removed (p_lcb->remote_bd_addr);
420         }
421 #endif
422 
423         /* If waiting for disconnect and reconnect is pending start the reconnect now
424            race condition where layer above issued connect request on link that was
425            disconnecting
426          */
427         if (p_lcb->ccb_queue.p_first_ccb != NULL || p_lcb->p_pending_ccb) {
428             L2CAP_TRACE_DEBUG("l2c_link_hci_disc_comp: Restarting pending ACL request");
429             transport = p_lcb->transport;
430 #if BLE_INCLUDED == TRUE
431             /* for LE link, always drop and re-open to ensure to get LE remote feature */
432             if (p_lcb->transport == BT_TRANSPORT_LE) {
433                 l2cb.is_ble_connecting = FALSE;
434                 btm_acl_removed (p_lcb->remote_bd_addr, p_lcb->transport);
435                 /* Release any held buffers */
436                 BT_HDR *p_buf;
437                 while (!list_is_empty(p_lcb->link_xmit_data_q)) {
438                     p_buf = list_front(p_lcb->link_xmit_data_q);
439                     list_remove(p_lcb->link_xmit_data_q, p_buf);
440                     osi_free(p_buf);
441                 }
442             } else
443 #endif
444             {
445 #if (L2CAP_NUM_FIXED_CHNLS > 0)
446                 /* If we are going to reuse the LCB without dropping it, release all fixed channels
447                 here */
448                 int xx;
449                 for (xx = 0; xx < L2CAP_NUM_FIXED_CHNLS; xx++) {
450                     if (p_lcb->p_fixed_ccbs[xx] && p_lcb->p_fixed_ccbs[xx] != p_lcb->p_pending_ccb) {
451 #if BLE_INCLUDED == TRUE
452                         (*l2cb.fixed_reg[xx].pL2CA_FixedConn_Cb)(xx + L2CAP_FIRST_FIXED_CHNL,
453                                 p_lcb->remote_bd_addr, FALSE, p_lcb->disc_reason, p_lcb->transport);
454 #else
455                         (*l2cb.fixed_reg[xx].pL2CA_FixedConn_Cb)(xx + L2CAP_FIRST_FIXED_CHNL,
456                                 p_lcb->remote_bd_addr, FALSE, p_lcb->disc_reason, BT_TRANSPORT_BR_EDR);
457 #endif
458                         l2cu_release_ccb (p_lcb->p_fixed_ccbs[xx]);
459 
460                         p_lcb->p_fixed_ccbs[xx] = NULL;
461                     }
462                 }
463 #endif
464             }
465             if (l2cu_create_conn(p_lcb, transport)) {
466                 lcb_is_free = FALSE;    /* still using this lcb */
467             }
468         }
469 
470         p_lcb->p_pending_ccb = NULL;
471 #if (BLE_INCLUDED == TRUE)
472         if(reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT && p_lcb->transport == BT_TRANSPORT_LE) {
473             #if (GATTC_CONNECT_RETRY_EN == TRUE)
474             if(p_lcb->link_role == HCI_ROLE_MASTER && p_lcb->retry_create_con < GATTC_CONNECT_RETRY_COUNT) {
475                 L2CAP_TRACE_DEBUG("master retry connect, retry count %d reason 0x%x\n",  p_lcb->retry_create_con, reason);
476                 p_lcb->retry_create_con ++;
477                 // create connection retry
478                 if (l2cu_create_conn(p_lcb, BT_TRANSPORT_LE)) {
479                     btm_acl_removed (p_lcb->remote_bd_addr, BT_TRANSPORT_LE);
480                     lcb_is_free = FALSE;    /* still using this lcb */
481                 }
482             }
483             #endif // (GATTC_CONNECT_RETRY_EN == TRUE)
484 
485             #if (BLE_50_FEATURE_SUPPORT == TRUE)
486             if(btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE) {
487                 p_lcb->retry_create_con ++;
488                 L2CAP_TRACE_DEBUG("slave restart extend adv, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason);
489                 BTM_BleStartExtAdvRestart(handle);
490             }
491             #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
492 
493             #if (BLE_42_FEATURE_SUPPORT == TRUE)
494             if(!btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE) {
495                 p_lcb->retry_create_con ++;
496                 L2CAP_TRACE_DEBUG("slave resatrt adv, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason);
497                 btm_ble_start_adv();
498             }
499             #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
500         }
501 
502 
503 #endif // #if (BLE_INCLUDED == TRUE)
504         /* Release the LCB */
505         if (lcb_is_free) {
506             l2cu_release_lcb (p_lcb);
507         }
508     }
509 
510     /* Now that we have a free acl connection, see if any lcbs are pending */
511     if (lcb_is_free && ((p_lcb = l2cu_find_lcb_by_state(LST_CONNECT_HOLDING)) != NULL)) {
512         /* we found one-- create a connection */
513         l2cu_create_conn(p_lcb, BT_TRANSPORT_BR_EDR);
514     }
515 
516     return status;
517 }
518 
519 
520 /*******************************************************************************
521 **
522 ** Function         l2c_link_hci_qos_violation
523 **
524 ** Description      This function is called when an HCI QOS Violation
525 **                  event is received.
526 **
527 ** Returns          TRUE if the link is known about, else FALSE
528 **
529 *******************************************************************************/
l2c_link_hci_qos_violation(UINT16 handle)530 BOOLEAN l2c_link_hci_qos_violation (UINT16 handle)
531 {
532     tL2C_LCB        *p_lcb;
533 #if (CLASSIC_BT_INCLUDED == TRUE)
534     tL2C_CCB        *p_ccb;
535 #endif  ///CLASSIC_BT_INCLUDED == TRUE
536     /* See if we have a link control block for the connection */
537     p_lcb = l2cu_find_lcb_by_handle (handle);
538 
539     /* If we don't have one, maybe an SCO link. */
540     if (!p_lcb) {
541         return (FALSE);
542     }
543 #if (CLASSIC_BT_INCLUDED == TRUE)
544     /* For all channels, tell the upper layer about it */
545     for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
546         if (p_ccb->p_rcb->api.pL2CA_QoSViolationInd_Cb) {
547             l2c_csm_execute (p_ccb, L2CEVT_LP_QOS_VIOLATION_IND, NULL);
548         }
549     }
550 #endif  ///CLASSIC_BT_INCLUDED == TRUE
551     return (TRUE);
552 }
553 
554 
555 
556 /*******************************************************************************
557 **
558 ** Function         l2c_link_timeout
559 **
560 ** Description      This function is called when a link timer expires
561 **
562 ** Returns          void
563 **
564 *******************************************************************************/
l2c_link_timeout(tL2C_LCB * p_lcb)565 void l2c_link_timeout (tL2C_LCB *p_lcb)
566 {
567 #if (CLASSIC_BT_INCLUDED == TRUE)
568     tL2C_CCB   *p_ccb;
569 #endif  ///CLASSIC_BT_INCLUDED == TRUE
570 #if (SMP_INCLUDED == TRUE)
571     UINT16      timeout;
572     tBTM_STATUS rc;
573 #endif  ///SMP_INCLUDED == TRUE
574     L2CAP_TRACE_EVENT ("L2CAP - l2c_link_timeout() link state %d first CCB %p is_bonding:%d",
575                        p_lcb->link_state, p_lcb->ccb_queue.p_first_ccb, p_lcb->is_bonding);
576 
577     /* If link was connecting or disconnecting, clear all channels and drop the LCB */
578     if ((p_lcb->link_state == LST_CONNECTING_WAIT_SWITCH) ||
579             (p_lcb->link_state == LST_CONNECTING) ||
580             (p_lcb->link_state == LST_CONNECT_HOLDING) ||
581             (p_lcb->link_state == LST_DISCONNECTING)) {
582         p_lcb->p_pending_ccb = NULL;
583 #if (CLASSIC_BT_INCLUDED == TRUE)
584         /* For all channels, send a disconnect indication event through */
585         /* their FSMs. The CCBs should remove themselves from the LCB   */
586         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; ) {
587             tL2C_CCB *pn = p_ccb->p_next_ccb;
588 
589             l2c_csm_execute (p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
590 
591             p_ccb = pn;
592         }
593 #endif  ///CLASSIC_BT_INCLUDED == TRUE
594 #if (BLE_INCLUDED == TRUE)
595         if (p_lcb->link_state == LST_CONNECTING &&
596                 l2cb.is_ble_connecting == TRUE) {
597             L2CA_CancelBleConnectReq(l2cb.ble_connecting_bda);
598         }
599 #endif
600         /* Release the LCB */
601         l2cu_release_lcb (p_lcb);
602     }
603 
604     /* If link is connected, check for inactivity timeout */
605     if (p_lcb->link_state == LST_CONNECTED) {
606         /* Check for ping outstanding */
607         if (p_lcb->p_echo_rsp_cb) {
608             tL2CA_ECHO_RSP_CB *p_cb = p_lcb->p_echo_rsp_cb;
609 
610             /* Zero out the callback in case app immediately calls us again */
611             p_lcb->p_echo_rsp_cb = NULL;
612 
613             (*p_cb) (L2CAP_PING_RESULT_NO_RESP);
614 
615             L2CAP_TRACE_WARNING ("L2CAP - ping timeout");
616 #if (CLASSIC_BT_INCLUDED == TRUE)
617             /* For all channels, send a disconnect indication event through */
618             /* their FSMs. The CCBs should remove themselves from the LCB   */
619             for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; ) {
620                 tL2C_CCB *pn = p_ccb->p_next_ccb;
621 
622                 l2c_csm_execute (p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
623 
624                 p_ccb = pn;
625             }
626 #endif  ///CLASSIC_BT_INCLUDED == TRUE
627         }
628 
629 #if (SMP_INCLUDED == TRUE)
630         /* If no channels in use, drop the link. */
631         if (!p_lcb->ccb_queue.p_first_ccb) {
632             rc = btm_sec_disconnect (p_lcb->handle, HCI_ERR_PEER_USER);
633 
634             if (rc == BTM_CMD_STORED) {
635                 /* Security Manager will take care of disconnecting, state will be updated at that time */
636                 timeout = 0xFFFF;
637             } else if (rc == BTM_CMD_STARTED) {
638                 p_lcb->link_state = LST_DISCONNECTING;
639                 timeout = L2CAP_LINK_DISCONNECT_TOUT;
640             } else if (rc == BTM_SUCCESS) {
641                 l2cu_process_fixed_disc_cback(p_lcb);
642                 /* BTM SEC will make sure that link is release (probably after pairing is done) */
643                 p_lcb->link_state = LST_DISCONNECTING;
644                 timeout = 0xFFFF;
645             } else if (rc == BTM_BUSY) {
646                 /* BTM is still executing security process. Let lcb stay as connected */
647                 timeout = 0xFFFF;
648             } else if ((p_lcb->is_bonding)
649                        && (btsnd_hcic_disconnect (p_lcb->handle, HCI_ERR_PEER_USER))) {
650                 l2cu_process_fixed_disc_cback(p_lcb);
651                 p_lcb->link_state = LST_DISCONNECTING;
652                 timeout = L2CAP_LINK_DISCONNECT_TOUT;
653             } else {
654                 /* probably no buffer to send disconnect */
655                 timeout = BT_1SEC_TIMEOUT;
656             }
657 
658             if (timeout != 0xFFFF) {
659                 btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, timeout);
660             }
661         } else {
662             /* Check in case we were flow controlled */
663             l2c_link_check_send_pkts (p_lcb, NULL, NULL);
664         }
665 #endif  ///SMP_INCLUDED == TRUE
666     }
667 }
668 
669 /*******************************************************************************
670 **
671 ** Function         l2c_info_timeout
672 **
673 ** Description      This function is called when an info request times out
674 **
675 ** Returns          void
676 **
677 *******************************************************************************/
l2c_info_timeout(tL2C_LCB * p_lcb)678 void l2c_info_timeout (tL2C_LCB *p_lcb)
679 {
680     tL2C_CCB   *p_ccb;
681 #if (CLASSIC_BT_INCLUDED == TRUE)
682     tL2C_CONN_INFO  ci;
683 #endif  ///CLASSIC_BT_INCLUDED == TRUE
684     /* If we timed out waiting for info response, just continue using basic if allowed */
685     if (p_lcb->w4_info_rsp) {
686         /* If waiting for security complete, restart the info response timer */
687         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
688             if ( (p_ccb->chnl_state == CST_ORIG_W4_SEC_COMP) || (p_ccb->chnl_state == CST_TERM_W4_SEC_COMP) ) {
689                 btu_start_timer (&p_lcb->info_timer_entry, BTU_TTYPE_L2CAP_INFO, L2CAP_WAIT_INFO_RSP_TOUT);
690                 return;
691             }
692         }
693 
694         p_lcb->w4_info_rsp = FALSE;
695 #if (CLASSIC_BT_INCLUDED == TRUE)
696         /* If link is in process of being brought up */
697         if ((p_lcb->link_state != LST_DISCONNECTED) &&
698                 (p_lcb->link_state != LST_DISCONNECTING)) {
699             /* Notify active channels that peer info is finished */
700             if (p_lcb->ccb_queue.p_first_ccb) {
701                 ci.status = HCI_SUCCESS;
702                 memcpy (ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR));
703 
704                 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
705                     l2c_csm_execute (p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
706                 }
707             }
708         }
709 #endif  ///CLASSIC_BT_INCLUDED == TRUE
710     }
711 }
712 
713 /*******************************************************************************
714 **
715 ** Function         l2c_link_adjust_allocation
716 **
717 ** Description      This function is called when a link is created or removed
718 **                  to calculate the amount of packets each link may send to
719 **                  the HCI without an ack coming back.
720 **
721 **                  Currently, this is a simple allocation, dividing the
722 **                  number of Controller Packets by the number of links. In
723 **                  the future, QOS configuration should be examined.
724 **
725 ** Returns          void
726 **
727 *******************************************************************************/
l2c_link_adjust_allocation(void)728 void l2c_link_adjust_allocation (void)
729 {
730     UINT16      qq, qq_remainder;
731     tL2C_LCB    *p_lcb;
732     UINT16      hi_quota, low_quota;
733     UINT16      num_lowpri_links = 0;
734     UINT16      num_hipri_links  = 0;
735     UINT16      controller_xmit_quota = l2cb.num_lm_acl_bufs;
736     UINT16      high_pri_link_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA_A;
737     list_node_t *p_node = NULL;
738 
739     /* If no links active, reset buffer quotas and controller buffers */
740     if (l2cb.num_links_active == 0) {
741         l2cb.controller_xmit_window = l2cb.num_lm_acl_bufs;
742         l2cb.round_robin_quota = l2cb.round_robin_unacked = 0;
743         return;
744     }
745 
746     /* First, count the links */
747     for (p_node = list_begin(l2cb.p_lcb_pool); p_node; p_node = list_next(p_node)) {
748         p_lcb = list_node(p_node);
749         if (p_lcb->in_use) {
750             if (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) {
751                 num_hipri_links++;
752             } else {
753                 num_lowpri_links++;
754             }
755         }
756     }
757 
758     /* now adjust high priority link quota */
759     low_quota = num_lowpri_links ? 1 : 0;
760     while ( (num_hipri_links * high_pri_link_quota + low_quota) > controller_xmit_quota ) {
761         high_pri_link_quota--;
762     }
763 
764     /* Work out the xmit quota and buffer quota high and low priorities */
765     hi_quota  = num_hipri_links * high_pri_link_quota;
766     low_quota = (hi_quota < controller_xmit_quota) ? controller_xmit_quota - hi_quota : 1;
767 
768     /* Work out and save the HCI xmit quota for each low priority link */
769 
770     /* If each low priority link cannot have at least one buffer */
771     if (num_lowpri_links > low_quota) {
772         l2cb.round_robin_quota = low_quota;
773         qq = qq_remainder = 1;
774     }
775     /* If each low priority link can have at least one buffer */
776     else if (num_lowpri_links > 0) {
777         l2cb.round_robin_quota = 0;
778         l2cb.round_robin_unacked = 0;
779         qq = low_quota / num_lowpri_links;
780         qq_remainder = low_quota % num_lowpri_links;
781     }
782     /* If no low priority link */
783     else {
784         l2cb.round_robin_quota = 0;
785         l2cb.round_robin_unacked = 0;
786         qq = qq_remainder = 1;
787     }
788 
789     L2CAP_TRACE_EVENT ("l2c_link_adjust_allocation  num_hipri: %u  num_lowpri: %u  low_quota: %u  round_robin_quota: %u  qq: %u\n",
790                        num_hipri_links, num_lowpri_links, low_quota,
791                        l2cb.round_robin_quota, qq);
792 
793     /* Now, assign the quotas to each link */
794     p_node = NULL;
795     for (p_node = list_begin(l2cb.p_lcb_pool); p_node; p_node = list_next(p_node)) {
796         p_lcb = list_node(p_node);
797         if (p_lcb->in_use) {
798             if (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) {
799                 p_lcb->link_xmit_quota   = high_pri_link_quota;
800             } else {
801                 /* Safety check in case we switched to round-robin with something outstanding */
802                 /* if sent_not_acked is added into round_robin_unacked then don't add it again */
803                 /* l2cap keeps updating sent_not_acked for exiting from round robin */
804                 if (( p_lcb->link_xmit_quota > 0 ) && ( qq == 0 )) {
805                     l2cb.round_robin_unacked += p_lcb->sent_not_acked;
806                 }
807 
808                 p_lcb->link_xmit_quota   = qq;
809                 if (qq_remainder > 0) {
810                     p_lcb->link_xmit_quota++;
811                     qq_remainder--;
812                 }
813             }
814 
815             L2CAP_TRACE_EVENT ("l2c_link_adjust_allocation   Priority: %d  XmitQuota: %d\n",
816                                p_lcb->acl_priority, p_lcb->link_xmit_quota);
817 
818             L2CAP_TRACE_EVENT ("        SentNotAcked: %d  RRUnacked: %d\n",
819                                p_lcb->sent_not_acked, l2cb.round_robin_unacked);
820 
821             /* There is a special case where we have readjusted the link quotas and  */
822             /* this link may have sent anything but some other link sent packets so  */
823             /* so we may need a timer to kick off this link's transmissions.         */
824             if ( (p_lcb->link_state == LST_CONNECTED)
825                     && (!list_is_empty(p_lcb->link_xmit_data_q))
826                     && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota) ) {
827                 btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_LINK_FLOW_CONTROL_TOUT);
828             }
829         }
830     }
831 
832 }
833 
834 /*******************************************************************************
835 **
836 ** Function         l2c_link_adjust_chnl_allocation
837 **
838 ** Description      This function is called to calculate the amount of packets each
839 **                  non-F&EC channel may have outstanding.
840 **
841 **                  Currently, this is a simple allocation, dividing the number
842 **                  of packets allocated to the link by the number of channels. In
843 **                  the future, QOS configuration should be examined.
844 **
845 ** Returns          void
846 **
847 *******************************************************************************/
848 
l2c_chnl_allocation_in_ccb_list(void * p_ccb_node,void * context)849 bool l2c_chnl_allocation_in_ccb_list (void *p_ccb_node, void *context)
850 {
851     UNUSED(context);
852     tL2C_CCB *p_ccb = (tL2C_CCB *)p_ccb_node;
853     if (p_ccb->in_use) {
854         tL2CAP_CHNL_DATA_RATE data_rate = p_ccb->tx_data_rate + p_ccb->rx_data_rate;
855         p_ccb->buff_quota = L2CAP_CBB_DEFAULT_DATA_RATE_BUFF_QUOTA * data_rate;
856         L2CAP_TRACE_EVENT("CID:0x%04x FCR Mode:%u Priority:%u TxDataRate:%u RxDataRate:%u Quota:%u",
857                       p_ccb->local_cid, p_ccb->peer_cfg.fcr.mode,
858                       p_ccb->ccb_priority, p_ccb->tx_data_rate,
859                       p_ccb->rx_data_rate, p_ccb->buff_quota);
860 
861         /* quota may be change so check congestion */
862         l2cu_check_channel_congestion (p_ccb);
863     }
864     return false;
865 }
l2c_link_adjust_chnl_allocation(void)866 void l2c_link_adjust_chnl_allocation (void)
867 {
868 
869     L2CAP_TRACE_DEBUG ("l2c_link_adjust_chnl_allocation");
870 
871     /* assign buffer quota to each channel based on its data rate requirement */
872     list_foreach(l2cb.p_ccb_pool, l2c_chnl_allocation_in_ccb_list, NULL);
873 }
874 
875 /*******************************************************************************
876 **
877 ** Function         l2c_link_processs_num_bufs
878 **
879 ** Description      This function is called when a "controller buffer size"
880 **                  event is first received from the controller. It updates
881 **                  the L2CAP values.
882 **
883 ** Returns          void
884 **
885 *******************************************************************************/
l2c_link_processs_num_bufs(UINT16 num_lm_acl_bufs)886 void l2c_link_processs_num_bufs (UINT16 num_lm_acl_bufs)
887 {
888     l2cb.num_lm_acl_bufs = l2cb.controller_xmit_window = num_lm_acl_bufs;
889 
890 }
891 
892 /*******************************************************************************
893 **
894 ** Function         l2c_link_pkts_rcvd
895 **
896 ** Description      This function is called from the HCI transport when it is time
897 **                  tto send a "Host ready for packets" command. This is only when
898 **                  host to controller flow control is used. If fills in the arrays
899 **                  of numbers of packets and handles.
900 **
901 ** Returns          count of number of entries filled in
902 **
903 *******************************************************************************/
l2c_link_pkts_rcvd(UINT16 * num_pkts,UINT16 * handles)904 UINT8 l2c_link_pkts_rcvd (UINT16 *num_pkts, UINT16 *handles)
905 {
906     UINT8       num_found = 0;
907 
908     UNUSED(num_pkts);
909     UNUSED(handles);
910 
911     return (num_found);
912 }
913 
914 /*******************************************************************************
915 **
916 ** Function         l2c_link_role_changed
917 **
918 ** Description      This function is called when a link's master/slave role change
919 **                  event is received. It simply updates the link control block.
920 **
921 ** Returns          void
922 **
923 *******************************************************************************/
l2c_link_role_changed(BD_ADDR bd_addr,UINT8 new_role,UINT8 hci_status)924 void l2c_link_role_changed (BD_ADDR bd_addr, UINT8 new_role, UINT8 hci_status)
925 {
926     tL2C_LCB *p_lcb;
927 
928     /* Make sure not called from HCI Command Status (bd_addr and new_role are invalid) */
929     if (bd_addr) {
930         /* If here came form hci role change event */
931         p_lcb = l2cu_find_lcb_by_bd_addr (bd_addr, BT_TRANSPORT_BR_EDR);
932         if (p_lcb) {
933             p_lcb->link_role = new_role;
934 
935             /* Reset high priority link if needed */
936             if (hci_status == HCI_SUCCESS) {
937                 l2cu_set_acl_priority(bd_addr, p_lcb->acl_priority, TRUE);
938             }
939         }
940     }
941 
942     /* Check if any LCB was waiting for switch to be completed */
943     list_node_t *p_node = NULL;
944     for (p_node = list_begin(l2cb.p_lcb_pool); p_node; p_node = list_next(p_node)) {
945         p_lcb = list_node(p_node);
946         if ((p_lcb->in_use) && (p_lcb->link_state == LST_CONNECTING_WAIT_SWITCH)) {
947             l2cu_create_conn_after_switch (p_lcb);
948         }
949     }
950 }
951 
952 /*******************************************************************************
953 **
954 ** Function         l2c_pin_code_request
955 **
956 ** Description      This function is called when a pin-code request is received
957 **                  on a connection. If there are no channels active yet on the
958 **                  link, it extends the link first connection timer.  Make sure
959 **                  that inactivity timer is not extended if PIN code happens
960 **                  to be after last ccb released.
961 **
962 ** Returns          void
963 **
964 *******************************************************************************/
l2c_pin_code_request(BD_ADDR bd_addr)965 void l2c_pin_code_request (BD_ADDR bd_addr)
966 {
967     tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr (bd_addr, BT_TRANSPORT_BR_EDR);
968 
969     if ( (p_lcb) && (!p_lcb->ccb_queue.p_first_ccb) ) {
970         btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_LINK_CONNECT_TOUT_EXT);
971     }
972 }
973 
974 #if L2CAP_WAKE_PARKED_LINK == TRUE
975 /*******************************************************************************
976 **
977 ** Function         l2c_link_check_power_mode
978 **
979 ** Description      This function is called to check power mode.
980 **
981 ** Returns          TRUE if link is going to be active from park
982 **                  FALSE if nothing to send or not in park mode
983 **
984 *******************************************************************************/
l2c_link_check_power_mode(tL2C_LCB * p_lcb)985 BOOLEAN l2c_link_check_power_mode (tL2C_LCB *p_lcb)
986 {
987     tBTM_PM_MODE     mode;
988     tL2C_CCB    *p_ccb;
989     BOOLEAN need_to_active = FALSE;
990 
991     /*
992      * We only switch park to active only if we have unsent packets
993      */
994     if (list_is_empty(p_lcb->link_xmit_data_q)) {
995         for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) {
996             if (!fixed_queue_is_empty(p_ccb->xmit_hold_q)) {
997                 need_to_active = TRUE;
998                 break;
999             }
1000         }
1001     } else {
1002         need_to_active = TRUE;
1003     }
1004 
1005     /* if we have packets to send */
1006     if ( need_to_active ) {
1007         /* check power mode */
1008         if (BTM_ReadPowerMode(p_lcb->remote_bd_addr, &mode) == BTM_SUCCESS) {
1009             if ( mode == BTM_PM_STS_PENDING ) {
1010                 L2CAP_TRACE_DEBUG ("LCB(0x%x) is in PM pending state\n", p_lcb->handle);
1011 
1012                 return TRUE;
1013             }
1014         }
1015     }
1016     return FALSE;
1017 }
1018 #endif /* L2CAP_WAKE_PARKED_LINK == TRUE) */
1019 
1020 /*******************************************************************************
1021 **
1022 ** Function         l2c_link_check_send_pkts
1023 **
1024 ** Description      This function is called to check if it can send packets
1025 **                  to the Host Controller. It may be passed the address of
1026 **                  a packet to send.
1027 **
1028 ** Returns          void
1029 **
1030 *******************************************************************************/
l2c_link_check_send_pkts(tL2C_LCB * p_lcb,tL2C_CCB * p_ccb,BT_HDR * p_buf)1031 void l2c_link_check_send_pkts (tL2C_LCB *p_lcb, tL2C_CCB *p_ccb, BT_HDR *p_buf)
1032 {
1033     BOOLEAN     single_write = FALSE;
1034     L2CAP_TRACE_DEBUG("%s",__func__);
1035     /* Save the channel ID for faster counting */
1036     if (p_buf) {
1037         if (p_ccb != NULL) {
1038             p_buf->event = p_ccb->local_cid;
1039             single_write = TRUE;
1040         } else {
1041             p_buf->event = 0;
1042         }
1043 
1044         p_buf->layer_specific = 0;
1045         list_append(p_lcb->link_xmit_data_q, p_buf);
1046 
1047         if (p_lcb->link_xmit_quota == 0) {
1048 #if BLE_INCLUDED == TRUE
1049             if (p_lcb->transport == BT_TRANSPORT_LE) {
1050                 l2cb.ble_check_round_robin = TRUE;
1051             } else
1052 #endif
1053             {
1054                 l2cb.check_round_robin = TRUE;
1055             }
1056         }
1057     }
1058 
1059     /* If this is called from uncongested callback context break recursive calling.
1060     ** This LCB will be served when receiving number of completed packet event.
1061     */
1062     if (l2cb.is_cong_cback_context) {
1063         L2CAP_TRACE_ERROR("l2cab is_cong_cback_context");
1064         return;
1065     }
1066 
1067     /* If we are in a scenario where there are not enough buffers for each link to
1068     ** have at least 1, then do a round-robin for all the LCBs
1069     */
1070     if ( (p_lcb == NULL) || (p_lcb->link_xmit_quota == 0) ) {
1071         list_node_t *p_node   = NULL;
1072 	tL2C_LCB    *p_lcb_cur = NULL;
1073         if (p_lcb == NULL) {
1074             p_node = list_begin(l2cb.p_lcb_pool);
1075 	    p_lcb = list_node(p_node);
1076         } else if (!single_write) {
1077 	    for (p_node = list_begin(l2cb.p_lcb_pool); p_node; p_node = list_next(p_node)) {
1078 	        p_lcb_cur = list_node(p_node);
1079 		if (p_lcb_cur == p_lcb) {
1080 		    p_node = list_next(p_node);
1081 		    p_lcb = list_node(p_node);
1082 		    break;
1083 		}
1084 	    }
1085         }
1086 
1087         /* Loop through, starting at the next */
1088         for ( ; p_node; p_node = list_next(p_node)) {
1089 	    p_lcb = list_node(p_node);
1090 #if (BLE_INCLUDED == TRUE)
1091             L2CAP_TRACE_DEBUG("window = %d,robin_unacked = %d,robin_quota=%d",l2cb.controller_le_xmit_window,l2cb.ble_round_robin_unacked,l2cb.ble_round_robin_quota);
1092 #endif  ///BLE_INCLUDED == TRUE
1093             /* If controller window is full, nothing to do */
1094             if (((l2cb.controller_xmit_window == 0 ||
1095                     (l2cb.round_robin_unacked >= l2cb.round_robin_quota))
1096 #if (BLE_INCLUDED == TRUE)
1097                     && (p_lcb->transport == BT_TRANSPORT_BR_EDR)
1098                 )
1099                     || (p_lcb->transport == BT_TRANSPORT_LE &&
1100                         (l2cb.ble_round_robin_unacked >= l2cb.ble_round_robin_quota ||
1101                          l2cb.controller_le_xmit_window == 0 )))
1102 #else
1103                 ))
1104 #endif  ///BLE_INCLUDED == TRUE
1105                 break;
1106 
1107 
1108             /* Check for wraparound */
1109 	    if (p_node == list_end(l2cb.p_lcb_pool)) {
1110                 p_node = list_begin(l2cb.p_lcb_pool);
1111 		p_lcb = list_node(p_node);
1112 	    }
1113             L2CAP_TRACE_DEBUG("in_use=%d,segment_being_sent=%d,link_state=%d,link_xmit_quota=%d",p_lcb->in_use,p_lcb->partial_segment_being_sent,p_lcb->link_state,p_lcb->link_xmit_quota);
1114             if ( (!p_lcb->in_use)
1115                     || (p_lcb->partial_segment_being_sent)
1116                     || (p_lcb->link_state != LST_CONNECTED)
1117                     || (p_lcb->link_xmit_quota != 0)
1118                     || (L2C_LINK_CHECK_POWER_MODE (p_lcb)) ) {
1119                 continue;
1120             }
1121 
1122             /* See if we can send anything from the Link Queue */
1123             if (!list_is_empty(p_lcb->link_xmit_data_q)) {
1124                 p_buf = (BT_HDR *)list_front(p_lcb->link_xmit_data_q);
1125                 list_remove(p_lcb->link_xmit_data_q, p_buf);
1126                 l2c_link_send_to_lower (p_lcb, p_buf);
1127             } else if (single_write) {
1128                 /* If only doing one write, break out */
1129                 break;
1130             }
1131             /* If nothing on the link queue, check the channel queue */
1132             else if ((p_buf = l2cu_get_next_buffer_to_send (p_lcb)) != NULL) {
1133                 l2c_link_send_to_lower (p_lcb, p_buf);
1134             }
1135         }
1136 
1137         /* If we finished without using up our quota, no need for a safety check */
1138         if ( (l2cb.controller_xmit_window > 0)
1139                 && (l2cb.round_robin_unacked < l2cb.round_robin_quota)
1140 #if (BLE_INCLUDED == TRUE)
1141                 && (p_lcb->transport == BT_TRANSPORT_BR_EDR)
1142 #endif
1143            ) {
1144             l2cb.check_round_robin = FALSE;
1145         }
1146 
1147 #if (BLE_INCLUDED == TRUE)
1148         if ( (l2cb.controller_le_xmit_window > 0)
1149                 && (l2cb.ble_round_robin_unacked < l2cb.ble_round_robin_quota)
1150                 && (p_lcb->transport == BT_TRANSPORT_LE)) {
1151             l2cb.ble_check_round_robin = FALSE;
1152         }
1153 #endif
1154     } else { /* if this is not round-robin service */
1155         /* If a partial segment is being sent, can't send anything else */
1156         L2CAP_TRACE_DEBUG("partial_segment_being_sent=%d,link_state=%d,power_mode=%d",p_lcb->partial_segment_being_sent,p_lcb->link_state,L2C_LINK_CHECK_POWER_MODE (p_lcb));
1157         if ( (p_lcb->partial_segment_being_sent)
1158                 || (p_lcb->link_state != LST_CONNECTED)
1159                 || (L2C_LINK_CHECK_POWER_MODE (p_lcb)) ) {
1160             return;
1161         }
1162 
1163         /* See if we can send anything from the link queue */
1164 #if (BLE_INCLUDED == TRUE)
1165         while ( ((l2cb.controller_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
1166                  (l2cb.controller_le_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_LE)))
1167                 && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
1168 #else
1169         while ( (l2cb.controller_xmit_window != 0)
1170                 && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
1171 #endif
1172         {
1173             if (list_is_empty(p_lcb->link_xmit_data_q)) {
1174                 break;
1175             }
1176 
1177             p_buf = (BT_HDR *)list_front(p_lcb->link_xmit_data_q);
1178             list_remove(p_lcb->link_xmit_data_q, p_buf);
1179             if (!l2c_link_send_to_lower (p_lcb, p_buf)) {
1180                 break;
1181             }
1182         }
1183 
1184         if (!single_write) {
1185             /* See if we can send anything for any channel */
1186 #if (BLE_INCLUDED == TRUE)
1187             while ( ((l2cb.controller_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
1188                      (l2cb.controller_le_xmit_window != 0 && (p_lcb->transport == BT_TRANSPORT_LE)))
1189                     && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
1190 #else
1191             while ((l2cb.controller_xmit_window != 0) && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota))
1192 #endif
1193             {
1194                 //need check flag: partial_segment_being_sent
1195                 if ( (p_lcb->partial_segment_being_sent)
1196                         || (p_lcb->link_state != LST_CONNECTED)
1197                         || (L2C_LINK_CHECK_POWER_MODE (p_lcb)) ) {
1198                     break;
1199                 }
1200                 //L2CAP_TRACE_DEBUG("l2cu_get_next_buffer_to_send = %p",l2cu_get_next_buffer_to_send(p_lcb));
1201                 if ((p_buf = l2cu_get_next_buffer_to_send (p_lcb)) == NULL) {
1202                     break;
1203                 }
1204 
1205                 if (!l2c_link_send_to_lower (p_lcb, p_buf)) {
1206                     break;
1207                 }
1208             }
1209         }
1210 
1211         /* There is a special case where we have readjusted the link quotas and  */
1212         /* this link may have sent anything but some other link sent packets so  */
1213         /* so we may need a timer to kick off this link's transmissions.         */
1214         if ( (!list_is_empty(p_lcb->link_xmit_data_q)) && (p_lcb->sent_not_acked < p_lcb->link_xmit_quota) ) {
1215             btu_start_timer (&p_lcb->timer_entry, BTU_TTYPE_L2CAP_LINK, L2CAP_LINK_FLOW_CONTROL_TOUT);
1216         }
1217     }
1218 
1219 }
1220 
1221 /*******************************************************************************
1222 **
1223 ** Function         l2c_link_send_to_lower
1224 **
1225 ** Description      This function queues the buffer for HCI transmission
1226 **
1227 ** Returns          TRUE for success, FALSE for fail
1228 **
1229 *******************************************************************************/
l2c_link_send_to_lower(tL2C_LCB * p_lcb,BT_HDR * p_buf)1230 static BOOLEAN l2c_link_send_to_lower (tL2C_LCB *p_lcb, BT_HDR *p_buf)
1231 {
1232     UINT16      num_segs;
1233     UINT16      xmit_window, acl_data_size;
1234     const controller_t *controller = controller_get_interface();
1235     L2CAP_TRACE_DEBUG("%s",__func__);
1236     if ((p_buf->len <= controller->get_acl_packet_size_classic()
1237 #if (BLE_INCLUDED == TRUE)
1238             && (p_lcb->transport == BT_TRANSPORT_BR_EDR)) ||
1239             ((p_lcb->transport == BT_TRANSPORT_LE) && (p_buf->len <= controller->get_acl_packet_size_ble()))
1240 #else
1241         )
1242 #endif
1243        ) {
1244         if (p_lcb->link_xmit_quota == 0) {
1245 #if (BLE_INCLUDED == TRUE)
1246             if (p_lcb->transport == BT_TRANSPORT_LE) {
1247                 l2cb.ble_round_robin_unacked++;
1248             } else
1249 #endif
1250                 l2cb.round_robin_unacked++;
1251         }
1252         p_lcb->sent_not_acked++;
1253         p_buf->layer_specific = 0;
1254 
1255 #if (BLE_INCLUDED == TRUE)
1256         if (p_lcb->transport == BT_TRANSPORT_LE) {
1257             l2cb.controller_le_xmit_window--;
1258             bte_main_hci_send(p_buf, (UINT16)(BT_EVT_TO_LM_HCI_ACL | LOCAL_BLE_CONTROLLER_ID));
1259         } else
1260 #endif
1261         {
1262             l2cb.controller_xmit_window--;
1263             bte_main_hci_send(p_buf, BT_EVT_TO_LM_HCI_ACL);
1264         }
1265     } else {
1266 #if BLE_INCLUDED == TRUE
1267         if (p_lcb->transport == BT_TRANSPORT_LE) {
1268             acl_data_size = controller->get_acl_data_size_ble();
1269             xmit_window = l2cb.controller_le_xmit_window;
1270 
1271         } else
1272 #endif
1273         {
1274             acl_data_size = controller->get_acl_data_size_classic();
1275             xmit_window = l2cb.controller_xmit_window;
1276         }
1277         num_segs = (p_buf->len - HCI_DATA_PREAMBLE_SIZE + acl_data_size - 1) / acl_data_size;
1278 
1279 
1280         /* If doing round-robin, then only 1 segment each time */
1281         if (p_lcb->link_xmit_quota == 0) {
1282             num_segs = 1;
1283             p_lcb->partial_segment_being_sent = TRUE;
1284         } else {
1285             /* Multi-segment packet. Make sure it can fit */
1286             if (num_segs > xmit_window) {
1287                 num_segs = xmit_window;
1288                 p_lcb->partial_segment_being_sent = TRUE;
1289             }
1290 
1291             if (num_segs > (p_lcb->link_xmit_quota - p_lcb->sent_not_acked)) {
1292                 num_segs = (p_lcb->link_xmit_quota - p_lcb->sent_not_acked);
1293                 p_lcb->partial_segment_being_sent = TRUE;
1294             }
1295         }
1296 
1297         p_buf->layer_specific        = num_segs;
1298 #if BLE_INCLUDED == TRUE
1299         if (p_lcb->transport == BT_TRANSPORT_LE) {
1300             l2cb.controller_le_xmit_window -= num_segs;
1301             if (p_lcb->link_xmit_quota == 0) {
1302                 l2cb.ble_round_robin_unacked += num_segs;
1303             }
1304         } else
1305 #endif
1306         {
1307             l2cb.controller_xmit_window -= num_segs;
1308 
1309             if (p_lcb->link_xmit_quota == 0) {
1310                 l2cb.round_robin_unacked += num_segs;
1311             }
1312         }
1313 
1314         p_lcb->sent_not_acked += num_segs;
1315 #if BLE_INCLUDED == TRUE
1316         if (p_lcb->transport == BT_TRANSPORT_LE) {
1317             bte_main_hci_send(p_buf, (UINT16)(BT_EVT_TO_LM_HCI_ACL | LOCAL_BLE_CONTROLLER_ID));
1318         } else
1319 #endif
1320         {
1321             bte_main_hci_send(p_buf, BT_EVT_TO_LM_HCI_ACL);
1322         }
1323     }
1324 
1325 #if (L2CAP_HCI_FLOW_CONTROL_DEBUG == TRUE)
1326 #if (BLE_INCLUDED == TRUE)
1327     if (p_lcb->transport == BT_TRANSPORT_LE) {
1328         L2CAP_TRACE_DEBUG ("TotalWin=%d,Hndl=0x%x,Quota=%d,Unack=%d,RRQuota=%d,RRUnack=%d",
1329                            l2cb.controller_le_xmit_window,
1330                            p_lcb->handle,
1331                            p_lcb->link_xmit_quota, p_lcb->sent_not_acked,
1332                            l2cb.ble_round_robin_quota, l2cb.ble_round_robin_unacked);
1333     } else
1334 #endif
1335     {
1336         L2CAP_TRACE_DEBUG ("TotalWin=%d,Hndl=0x%x,Quota=%d,Unack=%d,RRQuota=%d,RRUnack=%d",
1337                            l2cb.controller_xmit_window,
1338                            p_lcb->handle,
1339                            p_lcb->link_xmit_quota, p_lcb->sent_not_acked,
1340                            l2cb.round_robin_quota, l2cb.round_robin_unacked);
1341     }
1342 #endif
1343 
1344     return TRUE;
1345 }
1346 
1347 /*******************************************************************************
1348 **
1349 ** Function         l2c_link_process_num_completed_pkts
1350 **
1351 ** Description      This function is called when a "number-of-completed-packets"
1352 **                  event is received from the controller. It updates all the
1353 **                  LCB transmit counts.
1354 **
1355 ** Returns          void
1356 **
1357 *******************************************************************************/
l2c_link_process_num_completed_pkts(UINT8 * p)1358 void l2c_link_process_num_completed_pkts (UINT8 *p)
1359 {
1360     UINT8       num_handles, xx;
1361     UINT16      handle;
1362     UINT16      num_sent;
1363     tL2C_LCB    *p_lcb;
1364 
1365     STREAM_TO_UINT8 (num_handles, p);
1366 
1367     for (xx = 0; xx < num_handles; xx++) {
1368         STREAM_TO_UINT16 (handle, p);
1369         STREAM_TO_UINT16 (num_sent, p);
1370 
1371         p_lcb = l2cu_find_lcb_by_handle (handle);
1372 
1373         /* Callback for number of completed packet event    */
1374         /* Originally designed for [3DSG]                   */
1375         if ((p_lcb != NULL) && (p_lcb->p_nocp_cb)) {
1376             L2CAP_TRACE_DEBUG ("L2CAP - calling NoCP callback");
1377             (*p_lcb->p_nocp_cb)(p_lcb->remote_bd_addr);
1378         }
1379 
1380         if (p_lcb) {
1381 #if (BLE_INCLUDED == TRUE)
1382             if (p_lcb && (p_lcb->transport == BT_TRANSPORT_LE)) {
1383                 l2cb.controller_le_xmit_window += num_sent;
1384             } else
1385 #endif
1386             {
1387                 /* Maintain the total window to the controller */
1388                 l2cb.controller_xmit_window += num_sent;
1389             }
1390             /* If doing round-robin, adjust communal counts */
1391             if (p_lcb->link_xmit_quota == 0) {
1392 #if BLE_INCLUDED == TRUE
1393                 if (p_lcb->transport == BT_TRANSPORT_LE) {
1394                     /* Don't go negative */
1395                     if (l2cb.ble_round_robin_unacked > num_sent) {
1396                         l2cb.ble_round_robin_unacked -= num_sent;
1397                     } else {
1398                         l2cb.ble_round_robin_unacked = 0;
1399                     }
1400                 } else
1401 #endif
1402                 {
1403                     /* Don't go negative */
1404                     if (l2cb.round_robin_unacked > num_sent) {
1405                         l2cb.round_robin_unacked -= num_sent;
1406                     } else {
1407                         l2cb.round_robin_unacked = 0;
1408                     }
1409                 }
1410             }
1411 
1412             /* Don't go negative */
1413             if (p_lcb->sent_not_acked > num_sent) {
1414                 p_lcb->sent_not_acked -= num_sent;
1415             } else {
1416                 p_lcb->sent_not_acked = 0;
1417             }
1418 
1419             l2c_link_check_send_pkts (p_lcb, NULL, NULL);
1420 
1421             /* If we were doing round-robin for low priority links, check 'em */
1422             if ( (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH)
1423                     && (l2cb.check_round_robin)
1424                     && (l2cb.round_robin_unacked < l2cb.round_robin_quota) ) {
1425                 l2c_link_check_send_pkts (NULL, NULL, NULL);
1426             }
1427 #if BLE_INCLUDED == TRUE
1428             if ((p_lcb->transport == BT_TRANSPORT_LE)
1429                     && (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH)
1430                     && ((l2cb.ble_check_round_robin)
1431                         && (l2cb.ble_round_robin_unacked < l2cb.ble_round_robin_quota))) {
1432                 l2c_link_check_send_pkts (NULL, NULL, NULL);
1433             }
1434 #endif
1435         }
1436 
1437 #if (L2CAP_HCI_FLOW_CONTROL_DEBUG == TRUE)
1438         if (p_lcb) {
1439 #if (BLE_INCLUDED == TRUE)
1440             if (p_lcb->transport == BT_TRANSPORT_LE) {
1441                 L2CAP_TRACE_DEBUG ("TotalWin=%d,LinkUnack(0x%x)=%d,RRCheck=%d,RRUnack=%d\n",
1442                                    l2cb.controller_le_xmit_window,
1443                                    p_lcb->handle, p_lcb->sent_not_acked,
1444                                    l2cb.ble_check_round_robin, l2cb.ble_round_robin_unacked);
1445             } else
1446 #endif
1447             {
1448                 L2CAP_TRACE_DEBUG ("TotalWin=%d,LinkUnack(0x%x)=%d,RRCheck=%d,RRUnack=%d\n",
1449                                    l2cb.controller_xmit_window,
1450                                    p_lcb->handle, p_lcb->sent_not_acked,
1451                                    l2cb.check_round_robin, l2cb.round_robin_unacked);
1452 
1453             }
1454         } else {
1455 #if (BLE_INCLUDED == TRUE)
1456             L2CAP_TRACE_DEBUG ("TotalWin=%d  LE_Win: %d, Handle=0x%x, RRCheck=%d, RRUnack=%d\n",
1457                                l2cb.controller_xmit_window,
1458                                l2cb.controller_le_xmit_window,
1459                                handle,
1460                                l2cb.ble_check_round_robin, l2cb.ble_round_robin_unacked);
1461 #else
1462             L2CAP_TRACE_DEBUG ("TotalWin=%d  Handle=0x%x  RRCheck=%d  RRUnack=%d\n",
1463                                l2cb.controller_xmit_window,
1464                                handle,
1465                                l2cb.check_round_robin, l2cb.round_robin_unacked);
1466 #endif
1467         }
1468 #endif
1469     }
1470 
1471 #if (defined(HCILP_INCLUDED) && HCILP_INCLUDED == TRUE)
1472     /* only full stack can enable sleep mode */
1473     btu_check_bt_sleep ();
1474 #endif
1475 }
1476 
1477 /*******************************************************************************
1478 **
1479 ** Function         l2c_link_segments_xmitted
1480 **
1481 ** Description      This function is called from the HCI Interface when an ACL
1482 **                  data packet segment is transmitted.
1483 **
1484 ** Returns          void
1485 **
1486 *******************************************************************************/
l2c_link_segments_xmitted(BT_HDR * p_msg)1487 void l2c_link_segments_xmitted (BT_HDR *p_msg)
1488 {
1489     UINT8       *p = (UINT8 *)(p_msg + 1) + p_msg->offset;
1490     UINT16      handle;
1491     tL2C_LCB    *p_lcb;
1492 
1493     /* Extract the handle */
1494     STREAM_TO_UINT16 (handle, p);
1495     handle   = HCID_GET_HANDLE (handle);
1496 
1497     /* Find the LCB based on the handle */
1498     if ((p_lcb = l2cu_find_lcb_by_handle (handle)) == NULL) {
1499         L2CAP_TRACE_WARNING ("L2CAP - rcvd segment complete, unknown handle: %d\n", handle);
1500         osi_free (p_msg);
1501         return;
1502     }
1503 
1504     if (p_lcb->link_state == LST_CONNECTED) {
1505         /* Enqueue the buffer to the head of the transmit queue, and see */
1506         /* if we can transmit anything more.                             */
1507         list_prepend(p_lcb->link_xmit_data_q, p_msg);
1508 
1509         p_lcb->partial_segment_being_sent = FALSE;
1510 
1511         l2c_link_check_send_pkts (p_lcb, NULL, NULL);
1512     } else {
1513         osi_free (p_msg);
1514     }
1515 }
1516