Commit 818c4b56 authored Feb 08, 2013 by Toshi Kikuchi

fix bt_hc_worker_thread() sometimes transmit more than num_hci_cmd_pkts



bt_hc_worker_thread() checks the controller's outstanding HCI
command credits (maintained in num_hci_cmd_pkts) and skips the rest
of the tx queue after it has used up the credits. But the skip
condition is not correct in the loop:

      if ((tx_cmd_pkts_pending == TRUE) || (num_hci_cmd_pkts <= 0))
      {
          tx_cmd_pkts_pending = TRUE;
          // skip the rest of the packets in the tx queue
          ...
      }

Since num_hci_cmd_pkts doesn't change during the loop, this condition
never becomes true. As a result, all the HCI commands in the tx queue
are sent if num_hci_cmd_pkts > 0. That is why sometimes more than
num_hck_cmd_pkts are sent.

To check a correct skip condition, we should count how many HCI
command packets are being sent:

      if ((tx_cmd_pkts_pending == TRUE) ||
          (sending_hci_cmd_pkts_count >= num_hci_cmd_pkts))

sending_hci_cmd_pkts_count is incremented every time a HCI command is
pushed for sending. It should never go beyond num_hci_cmd_pkts.

Change-Id: I58101b2785fc3ab4171cdf22497ca97a3ae3124a
Signed-off-by: Toshi Kikuchi <toshik@google.com>

parent c17d803d

system/hci/src/bt_hci_bdroid.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -415,6 +415,7 @@ static void bt_hc_worker_thread(void arg)
		tx_cmd_pkts_pending = FALSE;
		HC_BT_HDR * sending_msg_que[64];
		int sending_msg_count = 0;
		int sending_hci_cmd_pkts_count = 0;
		utils_lock();
		p_next_msg = tx_q.p_first;
		while (p_next_msg && sending_msg_count <
		@@ -430,12 +431,14 @@ static void bt_hc_worker_thread(void arg)
		* gives back us credits through CommandCompleteEvent or
		* CommandStatusEvent.
		*/
		if ((tx_cmd_pkts_pending == TRUE) \|\| (num_hci_cmd_pkts <= 0))
		if ((tx_cmd_pkts_pending == TRUE) \|\|
		(sending_hci_cmd_pkts_count >= num_hci_cmd_pkts))
		{
		tx_cmd_pkts_pending = TRUE;
		p_next_msg = utils_getnext(p_next_msg);
		continue;
		}
		sending_hci_cmd_pkts_count++;
		}

		p_msg = p_next_msg;