fix bt_hc_worker_thread() sometimes transmit more than num_hci_cmd_pkts

bt_hc_worker_thread() checks the controller's outstanding HCI
command credits (maintained in num_hci_cmd_pkts) and skips the rest
of the tx queue after it has used up the credits. But the skip
condition is not correct in the loop:

      if ((tx_cmd_pkts_pending == TRUE) || (num_hci_cmd_pkts <= 0))
      {
          tx_cmd_pkts_pending = TRUE;
          // skip the rest of the packets in the tx queue
          ...
      }

Since num_hci_cmd_pkts doesn't change during the loop, this condition
never becomes true. As a result, all the HCI commands in the tx queue
are sent if num_hci_cmd_pkts > 0. That is why sometimes more than
num_hck_cmd_pkts are sent.

To check a correct skip condition, we should count how many HCI
command packets are being sent:

      if ((tx_cmd_pkts_pending == TRUE) ||
          (sending_hci_cmd_pkts_count >= num_hci_cmd_pkts))

sending_hci_cmd_pkts_count is incremented every time a HCI command is
pushed for sending. It should never go beyond num_hci_cmd_pkts.

Change-Id: I58101b2785fc3ab4171cdf22497ca97a3ae3124a
Signed-off-by: Toshi Kikuchi <toshik@google.com>

diff --git a/hci/src/bt_hci_bdroid.c b/hci/src/bt_hci_bdroid.c
index 7b14eb3..8a04d47 100644 (file)
--- a/hci/src/bt_hci_bdroid.c
+++ b/hci/src/bt_hci_bdroid.c
@@ -415,6 +415,7 @@ static void *bt_hc_worker_thread(void *arg)
             tx_cmd_pkts_pending = FALSE;
             HC_BT_HDR * sending_msg_que[64];
             int sending_msg_count = 0;
+            int sending_hci_cmd_pkts_count = 0;
             utils_lock();
             p_next_msg = tx_q.p_first;
             while (p_next_msg && sending_msg_count <
@@ -430,12 +431,14 @@ static void *bt_hc_worker_thread(void *arg)
                      *  gives back us credits through CommandCompleteEvent or
                      *  CommandStatusEvent.
                      */
-                    if ((tx_cmd_pkts_pending == TRUE) || (num_hci_cmd_pkts <= 0))
+                    if ((tx_cmd_pkts_pending == TRUE) ||
+                        (sending_hci_cmd_pkts_count >= num_hci_cmd_pkts))
                     {
                         tx_cmd_pkts_pending = TRUE;
                         p_next_msg = utils_getnext(p_next_msg);
                         continue;
                     }
+                    sending_hci_cmd_pkts_count++;
                 }
 
                 p_msg = p_next_msg;