1 /******************************************************************************
2 *
3 * Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains the main L2CAP entry points
22 *
23 ******************************************************************************/
24
25 #define LOG_TAG "bt_l2c_main"
26
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30
31 #include "bt_common.h"
32 #include "bt_target.h"
33 #include "btm_int.h"
34 #include "btu.h"
35 #include "device/include/controller.h"
36 #include "hcimsgs.h"
37 #include "l2c_api.h"
38 #include "l2c_int.h"
39 #include "l2cdefs.h"
40 #include "osi/include/log.h"
41 #include "osi/include/osi.h"
42
43 extern fixed_queue_t* btu_general_alarm_queue;
44
45 /******************************************************************************/
46 /* L O C A L F U N C T I O N P R O T O T Y P E S */
47 /******************************************************************************/
48 static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len);
49
50 /******************************************************************************/
51 /* G L O B A L L 2 C A P D A T A */
52 /******************************************************************************/
53 tL2C_CB l2cb;
54
55 /*******************************************************************************
56 *
57 * Function l2c_rcv_acl_data
58 *
59 * Description This function is called from the HCI Interface when an ACL
60 * data packet is received.
61 *
62 * Returns void
63 *
64 ******************************************************************************/
l2c_rcv_acl_data(BT_HDR * p_msg)65 void l2c_rcv_acl_data(BT_HDR* p_msg) {
66 uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
67 uint16_t handle, hci_len;
68 uint8_t pkt_type;
69 tL2C_LCB* p_lcb;
70 tL2C_CCB* p_ccb = NULL;
71 uint16_t l2cap_len, rcv_cid, psm;
72 uint16_t credit;
73
74 /* Extract the handle */
75 STREAM_TO_UINT16(handle, p);
76 pkt_type = HCID_GET_EVENT(handle);
77 handle = HCID_GET_HANDLE(handle);
78
79 /* Since the HCI Transport is putting segmented packets back together, we */
80 /* should never get a valid packet with the type set to "continuation" */
81 if (pkt_type != L2CAP_PKT_CONTINUE) {
82 /* Find the LCB based on the handle */
83 p_lcb = l2cu_find_lcb_by_handle(handle);
84 if (p_lcb == NULL) {
85 uint8_t cmd_code;
86
87 /* There is a slight possibility (specifically with USB) that we get an */
88 /* L2CAP connection request before we get the HCI connection complete. */
89 /* So for these types of messages, hold them for up to 2 seconds. */
90 STREAM_TO_UINT16(hci_len, p);
91 STREAM_TO_UINT16(l2cap_len, p);
92 STREAM_TO_UINT16(rcv_cid, p);
93 STREAM_TO_UINT8(cmd_code, p);
94
95 if ((p_msg->layer_specific == 0) && (rcv_cid == L2CAP_SIGNALLING_CID) &&
96 (cmd_code == L2CAP_CMD_INFO_REQ || cmd_code == L2CAP_CMD_CONN_REQ)) {
97 L2CAP_TRACE_WARNING(
98 "L2CAP - holding ACL for unknown handle:%d ls:%d"
99 " cid:%d opcode:%d cur count:%d",
100 handle, p_msg->layer_specific, rcv_cid, cmd_code,
101 list_length(l2cb.rcv_pending_q));
102 p_msg->layer_specific = 2;
103 list_append(l2cb.rcv_pending_q, p_msg);
104
105 if (list_length(l2cb.rcv_pending_q) == 1) {
106 alarm_set_on_queue(l2cb.receive_hold_timer, BT_1SEC_TIMEOUT_MS,
107 l2c_receive_hold_timer_timeout, NULL,
108 btu_general_alarm_queue);
109 }
110
111 return;
112 } else {
113 L2CAP_TRACE_ERROR(
114 "L2CAP - rcvd ACL for unknown handle:%d ls:%d cid:%d"
115 " opcode:%d cur count:%d",
116 handle, p_msg->layer_specific, rcv_cid, cmd_code,
117 list_length(l2cb.rcv_pending_q));
118 }
119 osi_free(p_msg);
120 return;
121 }
122 } else {
123 L2CAP_TRACE_WARNING("L2CAP - expected pkt start or complete, got: %d",
124 pkt_type);
125 osi_free(p_msg);
126 return;
127 }
128
129 /* Extract the length and update the buffer header */
130 STREAM_TO_UINT16(hci_len, p);
131 p_msg->offset += 4;
132
133 if (hci_len < L2CAP_PKT_OVERHEAD) {
134 /* Must receive at least the L2CAP length and CID */
135 L2CAP_TRACE_WARNING("L2CAP - got incorrect hci header");
136 osi_free(p_msg);
137 return;
138 }
139
140 /* Extract the length and CID */
141 STREAM_TO_UINT16(l2cap_len, p);
142 STREAM_TO_UINT16(rcv_cid, p);
143
144 /* for BLE channel, always notify connection when ACL data received on the
145 * link */
146 if (p_lcb && p_lcb->transport == BT_TRANSPORT_LE &&
147 p_lcb->link_state != LST_DISCONNECTING)
148 /* only process fixed channel data as channel open indication when link is
149 * not in disconnecting mode */
150 l2cble_notify_le_connection(p_lcb->remote_bd_addr);
151
152 /* Find the CCB for this CID */
153 if (rcv_cid >= L2CAP_BASE_APPL_CID) {
154 p_ccb = l2cu_find_ccb_by_cid(p_lcb, rcv_cid);
155 if (p_ccb == NULL) {
156 L2CAP_TRACE_WARNING("L2CAP - unknown CID: 0x%04x", rcv_cid);
157 osi_free(p_msg);
158 return;
159 }
160 }
161
162 p_msg->len = hci_len - L2CAP_PKT_OVERHEAD;
163 p_msg->offset += L2CAP_PKT_OVERHEAD;
164
165 if (l2cap_len != p_msg->len) {
166 L2CAP_TRACE_WARNING("L2CAP - bad length in pkt. Exp: %d Act: %d",
167 l2cap_len, p_msg->len);
168
169 osi_free(p_msg);
170 return;
171 }
172
173 /* Send the data through the channel state machine */
174 if (rcv_cid == L2CAP_SIGNALLING_CID) {
175 process_l2cap_cmd(p_lcb, p, l2cap_len);
176 osi_free(p_msg);
177 } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {
178 /* process_connectionless_data (p_lcb); */
179 STREAM_TO_UINT16(psm, p);
180 L2CAP_TRACE_DEBUG("GOT CONNECTIONLESS DATA PSM:%d", psm);
181
182 #if (L2CAP_UCD_INCLUDED == TRUE)
183 /* if it is not broadcast, check UCD registration */
184 if (l2c_ucd_check_rx_pkts(p_lcb, p_msg)) {
185 /* nothing to do */
186 } else
187 #endif
188 osi_free(p_msg);
189 } else if (rcv_cid == L2CAP_BLE_SIGNALLING_CID) {
190 l2cble_process_sig_cmd(p_lcb, p, l2cap_len);
191 osi_free(p_msg);
192 }
193 #if (L2CAP_NUM_FIXED_CHNLS > 0)
194 else if ((rcv_cid >= L2CAP_FIRST_FIXED_CHNL) &&
195 (rcv_cid <= L2CAP_LAST_FIXED_CHNL) &&
196 (l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL]
197 .pL2CA_FixedData_Cb != NULL)) {
198 /* If no CCB for this channel, allocate one */
199 if (p_lcb &&
200 /* only process fixed channel data when link is open or wait for data
201 indication */
202 (p_lcb->link_state != LST_DISCONNECTING) &&
203 l2cu_initialize_fixed_ccb(
204 p_lcb, rcv_cid, &l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL]
205 .fixed_chnl_opts)) {
206 p_ccb = p_lcb->p_fixed_ccbs[rcv_cid - L2CAP_FIRST_FIXED_CHNL];
207
208 if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_BASIC_MODE)
209 l2c_fcr_proc_pdu(p_ccb, p_msg);
210 else
211 (*l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(
212 rcv_cid, p_lcb->remote_bd_addr, p_msg);
213 } else
214 osi_free(p_msg);
215 }
216 #endif
217
218 else {
219 if (p_ccb == NULL)
220 osi_free(p_msg);
221 else {
222 if (p_lcb->transport == BT_TRANSPORT_LE) {
223 l2c_lcc_proc_pdu(p_ccb, p_msg);
224 // Got a pkt, valid send out credits to the peer device
225 credit = L2CAP_LE_DEFAULT_CREDIT;
226 l2c_csm_execute(p_ccb, L2CEVT_L2CA_SEND_FLOW_CONTROL_CREDIT, &credit);
227 } else {
228 /* Basic mode packets go straight to the state machine */
229 if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
230 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DATA, p_msg);
231 else {
232 /* eRTM or streaming mode, so we need to validate states first */
233 if ((p_ccb->chnl_state == CST_OPEN) ||
234 (p_ccb->chnl_state == CST_CONFIG))
235 l2c_fcr_proc_pdu(p_ccb, p_msg);
236 else
237 osi_free(p_msg);
238 }
239 }
240 }
241 }
242 }
243
244 /*******************************************************************************
245 *
246 * Function process_l2cap_cmd
247 *
248 * Description This function is called when a packet is received on the
249 * L2CAP signalling CID
250 *
251 * Returns void
252 *
253 ******************************************************************************/
process_l2cap_cmd(tL2C_LCB * p_lcb,uint8_t * p,uint16_t pkt_len)254 static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
255 uint8_t *p_pkt_end, *p_next_cmd, *p_cfg_end, *p_cfg_start;
256 uint8_t cmd_code, cfg_code, cfg_len, id;
257 tL2C_CONN_INFO con_info;
258 tL2CAP_CFG_INFO cfg_info;
259 uint16_t rej_reason, rej_mtu, lcid, rcid, info_type;
260 tL2C_CCB* p_ccb;
261 tL2C_RCB* p_rcb;
262 bool cfg_rej, pkt_size_rej = false;
263 uint16_t cfg_rej_len, cmd_len;
264 uint16_t result;
265 tL2C_CONN_INFO ci;
266
267 /* if l2cap command received in CID 1 on top of an LE link, ignore this
268 * command */
269 if (p_lcb->transport == BT_TRANSPORT_LE) return;
270
271 /* Reject the packet if it exceeds the default Signalling Channel MTU */
272 if (pkt_len > L2CAP_DEFAULT_MTU) {
273 /* Core Spec requires a single response to the first command found in a
274 *multi-command
275 ** L2cap packet. If only responses in the packet, then it will be ignored.
276 ** Here we simply mark the bad packet and decide which cmd ID to reject
277 *later
278 */
279 pkt_size_rej = true;
280 L2CAP_TRACE_ERROR("L2CAP SIG MTU Pkt Len Exceeded (672) -> pkt_len: %d",
281 pkt_len);
282 }
283
284 p_next_cmd = p;
285 p_pkt_end = p + pkt_len;
286
287 memset(&cfg_info, 0, sizeof(cfg_info));
288
289 /* An L2CAP packet may contain multiple commands */
290 while (true) {
291 /* Smallest command is 4 bytes */
292 p = p_next_cmd;
293 if (p > (p_pkt_end - 4)) break;
294
295 STREAM_TO_UINT8(cmd_code, p);
296 STREAM_TO_UINT8(id, p);
297 STREAM_TO_UINT16(cmd_len, p);
298
299 if (cmd_len > BT_SMALL_BUFFER_SIZE) {
300 L2CAP_TRACE_WARNING("L2CAP - Invalid MTU Size");
301 l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_MTU_EXCEEDED, id, 0, 0);
302 return;
303 }
304
305 /* Check command length does not exceed packet length */
306 p_next_cmd = p + cmd_len;
307 if (p_next_cmd > p_pkt_end) {
308 L2CAP_TRACE_WARNING("Command len bad pkt_len: %d cmd_len: %d code: %d",
309 pkt_len, cmd_len, cmd_code);
310 break;
311 }
312
313 L2CAP_TRACE_DEBUG("cmd_code: %d, id:%d, cmd_len:%d", cmd_code, id, cmd_len);
314
315 /* Bad L2CAP packet length, look or cmd to reject */
316 if (pkt_size_rej) {
317 /* If command found rejected it and we're done, otherwise keep looking */
318 if (l2c_is_cmd_rejected(cmd_code, id, p_lcb))
319 return;
320 else
321 continue; /* Look for next cmd/response in current packet */
322 }
323
324 switch (cmd_code) {
325 case L2CAP_CMD_REJECT:
326 STREAM_TO_UINT16(rej_reason, p);
327 if (rej_reason == L2CAP_CMD_REJ_MTU_EXCEEDED) {
328 STREAM_TO_UINT16(rej_mtu, p);
329 /* What to do with the MTU reject ? We have negotiated an MTU. For now
330 */
331 /* we will ignore it and let a higher protocol timeout take care of it
332 */
333
334 L2CAP_TRACE_WARNING("L2CAP - MTU rej Handle: %d MTU: %d",
335 p_lcb->handle, rej_mtu);
336 }
337 if (rej_reason == L2CAP_CMD_REJ_INVALID_CID) {
338 STREAM_TO_UINT16(rcid, p);
339 STREAM_TO_UINT16(lcid, p);
340
341 L2CAP_TRACE_WARNING(
342 "L2CAP - rej with CID invalid, LCID: 0x%04x RCID: 0x%04x", lcid,
343 rcid);
344
345 /* Remote CID invalid. Treat as a disconnect */
346 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
347 if ((p_ccb != NULL) && (p_ccb->remote_cid == rcid)) {
348 /* Fake link disconnect - no reply is generated */
349 l2c_csm_execute(p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
350 }
351 }
352
353 /* SonyEricsson Info request Bug workaround (Continue connection) */
354 else if (rej_reason == L2CAP_CMD_REJ_NOT_UNDERSTOOD &&
355 p_lcb->w4_info_rsp) {
356 alarm_cancel(p_lcb->info_resp_timer);
357
358 p_lcb->w4_info_rsp = false;
359 ci.status = HCI_SUCCESS;
360 memcpy(ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR));
361
362 /* For all channels, send the event through their FSMs */
363 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
364 p_ccb = p_ccb->p_next_ccb) {
365 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
366 }
367 }
368 break;
369
370 case L2CAP_CMD_CONN_REQ:
371 STREAM_TO_UINT16(con_info.psm, p);
372 STREAM_TO_UINT16(rcid, p);
373 p_rcb = l2cu_find_rcb_by_psm(con_info.psm);
374 if (p_rcb == NULL) {
375 L2CAP_TRACE_WARNING("L2CAP - rcvd conn req for unknown PSM: %d",
376 con_info.psm);
377 l2cu_reject_connection(p_lcb, rcid, id, L2CAP_CONN_NO_PSM);
378 break;
379 } else {
380 if (!p_rcb->api.pL2CA_ConnectInd_Cb) {
381 L2CAP_TRACE_WARNING(
382 "L2CAP - rcvd conn req for outgoing-only connection PSM: %d",
383 con_info.psm);
384 l2cu_reject_connection(p_lcb, rcid, id, L2CAP_CONN_NO_PSM);
385 break;
386 }
387 }
388 p_ccb = l2cu_allocate_ccb(p_lcb, 0);
389 if (p_ccb == NULL) {
390 L2CAP_TRACE_ERROR("L2CAP - unable to allocate CCB");
391 l2cu_reject_connection(p_lcb, rcid, id, L2CAP_CONN_NO_RESOURCES);
392 break;
393 }
394 p_ccb->remote_id = id;
395 p_ccb->p_rcb = p_rcb;
396 p_ccb->remote_cid = rcid;
397
398 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_REQ, &con_info);
399 break;
400
401 case L2CAP_CMD_CONN_RSP:
402 STREAM_TO_UINT16(con_info.remote_cid, p);
403 STREAM_TO_UINT16(lcid, p);
404 STREAM_TO_UINT16(con_info.l2cap_result, p);
405 STREAM_TO_UINT16(con_info.l2cap_status, p);
406
407 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
408 if (p_ccb == NULL) {
409 L2CAP_TRACE_WARNING("L2CAP - no CCB for conn rsp, LCID: %d RCID: %d",
410 lcid, con_info.remote_cid);
411 break;
412 }
413 if (p_ccb->local_id != id) {
414 L2CAP_TRACE_WARNING("L2CAP - con rsp - bad ID. Exp: %d Got: %d",
415 p_ccb->local_id, id);
416 break;
417 }
418
419 if (con_info.l2cap_result == L2CAP_CONN_OK)
420 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP, &con_info);
421 else if (con_info.l2cap_result == L2CAP_CONN_PENDING)
422 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_PND, &con_info);
423 else
424 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_NEG, &con_info);
425
426 break;
427
428 case L2CAP_CMD_CONFIG_REQ:
429 p_cfg_end = p + cmd_len;
430 cfg_rej = false;
431 cfg_rej_len = 0;
432
433 STREAM_TO_UINT16(lcid, p);
434 STREAM_TO_UINT16(cfg_info.flags, p);
435
436 p_cfg_start = p;
437
438 cfg_info.flush_to_present = cfg_info.mtu_present =
439 cfg_info.qos_present = cfg_info.fcr_present = cfg_info.fcs_present =
440 false;
441
442 while (p < p_cfg_end) {
443 STREAM_TO_UINT8(cfg_code, p);
444 STREAM_TO_UINT8(cfg_len, p);
445
446 switch (cfg_code & 0x7F) {
447 case L2CAP_CFG_TYPE_MTU:
448 cfg_info.mtu_present = true;
449 STREAM_TO_UINT16(cfg_info.mtu, p);
450 break;
451
452 case L2CAP_CFG_TYPE_FLUSH_TOUT:
453 cfg_info.flush_to_present = true;
454 STREAM_TO_UINT16(cfg_info.flush_to, p);
455 break;
456
457 case L2CAP_CFG_TYPE_QOS:
458 cfg_info.qos_present = true;
459 STREAM_TO_UINT8(cfg_info.qos.qos_flags, p);
460 STREAM_TO_UINT8(cfg_info.qos.service_type, p);
461 STREAM_TO_UINT32(cfg_info.qos.token_rate, p);
462 STREAM_TO_UINT32(cfg_info.qos.token_bucket_size, p);
463 STREAM_TO_UINT32(cfg_info.qos.peak_bandwidth, p);
464 STREAM_TO_UINT32(cfg_info.qos.latency, p);
465 STREAM_TO_UINT32(cfg_info.qos.delay_variation, p);
466 break;
467
468 case L2CAP_CFG_TYPE_FCR:
469 cfg_info.fcr_present = true;
470 STREAM_TO_UINT8(cfg_info.fcr.mode, p);
471 STREAM_TO_UINT8(cfg_info.fcr.tx_win_sz, p);
472 STREAM_TO_UINT8(cfg_info.fcr.max_transmit, p);
473 STREAM_TO_UINT16(cfg_info.fcr.rtrans_tout, p);
474 STREAM_TO_UINT16(cfg_info.fcr.mon_tout, p);
475 STREAM_TO_UINT16(cfg_info.fcr.mps, p);
476 break;
477
478 case L2CAP_CFG_TYPE_FCS:
479 cfg_info.fcs_present = true;
480 STREAM_TO_UINT8(cfg_info.fcs, p);
481 break;
482
483 case L2CAP_CFG_TYPE_EXT_FLOW:
484 cfg_info.ext_flow_spec_present = true;
485 STREAM_TO_UINT8(cfg_info.ext_flow_spec.id, p);
486 STREAM_TO_UINT8(cfg_info.ext_flow_spec.stype, p);
487 STREAM_TO_UINT16(cfg_info.ext_flow_spec.max_sdu_size, p);
488 STREAM_TO_UINT32(cfg_info.ext_flow_spec.sdu_inter_time, p);
489 STREAM_TO_UINT32(cfg_info.ext_flow_spec.access_latency, p);
490 STREAM_TO_UINT32(cfg_info.ext_flow_spec.flush_timeout, p);
491 break;
492
493 default:
494 /* sanity check option length */
495 if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len) {
496 p += cfg_len;
497 if ((cfg_code & 0x80) == 0) {
498 cfg_rej_len += cfg_len + L2CAP_CFG_OPTION_OVERHEAD;
499 cfg_rej = true;
500 }
501 }
502 /* bad length; force loop exit */
503 else {
504 p = p_cfg_end;
505 cfg_rej = true;
506 }
507 break;
508 }
509 }
510
511 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
512 if (p_ccb != NULL) {
513 p_ccb->remote_id = id;
514 if (cfg_rej) {
515 l2cu_send_peer_config_rej(
516 p_ccb, p_cfg_start, (uint16_t)(cmd_len - L2CAP_CONFIG_REQ_LEN),
517 cfg_rej_len);
518 } else {
519 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONFIG_REQ, &cfg_info);
520 }
521 } else {
522 /* updated spec says send command reject on invalid cid */
523 l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_INVALID_CID, id, 0, 0);
524 }
525 break;
526
527 case L2CAP_CMD_CONFIG_RSP:
528 p_cfg_end = p + cmd_len;
529 STREAM_TO_UINT16(lcid, p);
530 STREAM_TO_UINT16(cfg_info.flags, p);
531 STREAM_TO_UINT16(cfg_info.result, p);
532
533 cfg_info.flush_to_present = cfg_info.mtu_present =
534 cfg_info.qos_present = cfg_info.fcr_present = cfg_info.fcs_present =
535 false;
536
537 while (p < p_cfg_end) {
538 STREAM_TO_UINT8(cfg_code, p);
539 STREAM_TO_UINT8(cfg_len, p);
540
541 switch (cfg_code & 0x7F) {
542 case L2CAP_CFG_TYPE_MTU:
543 cfg_info.mtu_present = true;
544 STREAM_TO_UINT16(cfg_info.mtu, p);
545 break;
546
547 case L2CAP_CFG_TYPE_FLUSH_TOUT:
548 cfg_info.flush_to_present = true;
549 STREAM_TO_UINT16(cfg_info.flush_to, p);
550 break;
551
552 case L2CAP_CFG_TYPE_QOS:
553 cfg_info.qos_present = true;
554 STREAM_TO_UINT8(cfg_info.qos.qos_flags, p);
555 STREAM_TO_UINT8(cfg_info.qos.service_type, p);
556 STREAM_TO_UINT32(cfg_info.qos.token_rate, p);
557 STREAM_TO_UINT32(cfg_info.qos.token_bucket_size, p);
558 STREAM_TO_UINT32(cfg_info.qos.peak_bandwidth, p);
559 STREAM_TO_UINT32(cfg_info.qos.latency, p);
560 STREAM_TO_UINT32(cfg_info.qos.delay_variation, p);
561 break;
562
563 case L2CAP_CFG_TYPE_FCR:
564 cfg_info.fcr_present = true;
565 STREAM_TO_UINT8(cfg_info.fcr.mode, p);
566 STREAM_TO_UINT8(cfg_info.fcr.tx_win_sz, p);
567 STREAM_TO_UINT8(cfg_info.fcr.max_transmit, p);
568 STREAM_TO_UINT16(cfg_info.fcr.rtrans_tout, p);
569 STREAM_TO_UINT16(cfg_info.fcr.mon_tout, p);
570 STREAM_TO_UINT16(cfg_info.fcr.mps, p);
571 break;
572
573 case L2CAP_CFG_TYPE_FCS:
574 cfg_info.fcs_present = true;
575 STREAM_TO_UINT8(cfg_info.fcs, p);
576 break;
577
578 case L2CAP_CFG_TYPE_EXT_FLOW:
579 cfg_info.ext_flow_spec_present = true;
580 STREAM_TO_UINT8(cfg_info.ext_flow_spec.id, p);
581 STREAM_TO_UINT8(cfg_info.ext_flow_spec.stype, p);
582 STREAM_TO_UINT16(cfg_info.ext_flow_spec.max_sdu_size, p);
583 STREAM_TO_UINT32(cfg_info.ext_flow_spec.sdu_inter_time, p);
584 STREAM_TO_UINT32(cfg_info.ext_flow_spec.access_latency, p);
585 STREAM_TO_UINT32(cfg_info.ext_flow_spec.flush_timeout, p);
586 break;
587 }
588 }
589
590 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
591 if (p_ccb != NULL) {
592 if (p_ccb->local_id != id) {
593 L2CAP_TRACE_WARNING("L2CAP - cfg rsp - bad ID. Exp: %d Got: %d",
594 p_ccb->local_id, id);
595 break;
596 }
597 if ((cfg_info.result == L2CAP_CFG_OK) ||
598 (cfg_info.result == L2CAP_CFG_PENDING))
599 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONFIG_RSP, &cfg_info);
600 else
601 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONFIG_RSP_NEG, &cfg_info);
602 } else {
603 L2CAP_TRACE_WARNING("L2CAP - rcvd cfg rsp for unknown CID: 0x%04x",
604 lcid);
605 }
606 break;
607
608 case L2CAP_CMD_DISC_REQ:
609 STREAM_TO_UINT16(lcid, p);
610 STREAM_TO_UINT16(rcid, p);
611
612 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
613 if (p_ccb != NULL) {
614 if (p_ccb->remote_cid == rcid) {
615 p_ccb->remote_id = id;
616 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DISCONNECT_REQ, &con_info);
617 }
618 } else
619 l2cu_send_peer_disc_rsp(p_lcb, id, lcid, rcid);
620
621 break;
622
623 case L2CAP_CMD_DISC_RSP:
624 STREAM_TO_UINT16(rcid, p);
625 STREAM_TO_UINT16(lcid, p);
626
627 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
628 if (p_ccb != NULL) {
629 if ((p_ccb->remote_cid == rcid) && (p_ccb->local_id == id)) {
630 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DISCONNECT_RSP, &con_info);
631 }
632 }
633 break;
634
635 case L2CAP_CMD_ECHO_REQ:
636 l2cu_send_peer_echo_rsp(p_lcb, id, p, cmd_len);
637 break;
638
639 case L2CAP_CMD_ECHO_RSP:
640 if (p_lcb->p_echo_rsp_cb) {
641 tL2CA_ECHO_RSP_CB* p_cb = p_lcb->p_echo_rsp_cb;
642
643 /* Zero out the callback in case app immediately calls us again */
644 p_lcb->p_echo_rsp_cb = NULL;
645
646 (*p_cb)(L2CAP_PING_RESULT_OK);
647 }
648 break;
649
650 case L2CAP_CMD_INFO_REQ:
651 STREAM_TO_UINT16(info_type, p);
652 l2cu_send_peer_info_rsp(p_lcb, id, info_type);
653 break;
654
655 case L2CAP_CMD_INFO_RSP:
656 /* Stop the link connect timer if sent before L2CAP connection is up */
657 if (p_lcb->w4_info_rsp) {
658 alarm_cancel(p_lcb->info_resp_timer);
659 p_lcb->w4_info_rsp = false;
660 }
661
662 STREAM_TO_UINT16(info_type, p);
663 STREAM_TO_UINT16(result, p);
664
665 p_lcb->info_rx_bits |= (1 << info_type);
666
667 if ((info_type == L2CAP_EXTENDED_FEATURES_INFO_TYPE) &&
668 (result == L2CAP_INFO_RESP_RESULT_SUCCESS)) {
669 STREAM_TO_UINT32(p_lcb->peer_ext_fea, p);
670
671 #if (L2CAP_NUM_FIXED_CHNLS > 0)
672 if (p_lcb->peer_ext_fea & L2CAP_EXTFEA_FIXED_CHNLS) {
673 l2cu_send_peer_info_req(p_lcb, L2CAP_FIXED_CHANNELS_INFO_TYPE);
674 break;
675 } else {
676 l2cu_process_fixed_chnl_resp(p_lcb);
677 }
678 #endif
679 }
680
681 #if (L2CAP_NUM_FIXED_CHNLS > 0)
682 if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {
683 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
684 memcpy(p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);
685 }
686
687 l2cu_process_fixed_chnl_resp(p_lcb);
688 }
689 #endif
690 #if (L2CAP_UCD_INCLUDED == TRUE)
691 else if (info_type == L2CAP_CONNLESS_MTU_INFO_TYPE) {
692 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
693 STREAM_TO_UINT16(p_lcb->ucd_mtu, p);
694 }
695 }
696 #endif
697
698 ci.status = HCI_SUCCESS;
699 memcpy(ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR));
700 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
701 p_ccb = p_ccb->p_next_ccb) {
702 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
703 }
704 break;
705
706 default:
707 L2CAP_TRACE_WARNING("L2CAP - bad cmd code: %d", cmd_code);
708 l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_NOT_UNDERSTOOD, id, 0,
709 0);
710 return;
711 }
712 }
713 }
714
715 /*******************************************************************************
716 *
717 * Function l2c_process_held_packets
718 *
719 * Description This function processes any L2CAP packets that arrived
720 * before the HCI connection complete arrived. It is a work
721 * around for badly behaved controllers.
722 *
723 * Returns void
724 *
725 ******************************************************************************/
l2c_process_held_packets(bool timed_out)726 void l2c_process_held_packets(bool timed_out) {
727 if (list_is_empty(l2cb.rcv_pending_q)) return;
728
729 if (!timed_out) {
730 alarm_cancel(l2cb.receive_hold_timer);
731 L2CAP_TRACE_WARNING("L2CAP HOLD CONTINUE");
732 } else {
733 L2CAP_TRACE_WARNING("L2CAP HOLD TIMEOUT");
734 }
735
736 for (const list_node_t* node = list_begin(l2cb.rcv_pending_q);
737 node != list_end(l2cb.rcv_pending_q);) {
738 BT_HDR* p_buf = static_cast<BT_HDR*>(list_node(node));
739 node = list_next(node);
740 if (!timed_out || (!p_buf->layer_specific) ||
741 (--p_buf->layer_specific == 0)) {
742 list_remove(l2cb.rcv_pending_q, p_buf);
743 p_buf->layer_specific = 0xFFFF;
744 l2c_rcv_acl_data(p_buf);
745 }
746 }
747
748 /* If anyone still in the queue, restart the timeout */
749 if (!list_is_empty(l2cb.rcv_pending_q)) {
750 alarm_set_on_queue(l2cb.receive_hold_timer, BT_1SEC_TIMEOUT_MS,
751 l2c_receive_hold_timer_timeout, NULL,
752 btu_general_alarm_queue);
753 }
754 }
755
756 /*******************************************************************************
757 *
758 * Function l2c_init
759 *
760 * Description This function is called once at startup to initialize
761 * all the L2CAP structures
762 *
763 * Returns void
764 *
765 ******************************************************************************/
l2c_init(void)766 void l2c_init(void) {
767 int16_t xx;
768
769 memset(&l2cb, 0, sizeof(tL2C_CB));
770 /* the psm is increased by 2 before being used */
771 l2cb.dyn_psm = 0xFFF;
772
773 /* Put all the channel control blocks on the free queue */
774 for (xx = 0; xx < MAX_L2CAP_CHANNELS - 1; xx++) {
775 l2cb.ccb_pool[xx].p_next_ccb = &l2cb.ccb_pool[xx + 1];
776 }
777
778 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
779 /* it will be set to L2CAP_PKT_START_NON_FLUSHABLE if controller supports */
780 l2cb.non_flushable_pbf = L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT;
781 #endif
782
783 l2cb.p_free_ccb_first = &l2cb.ccb_pool[0];
784 l2cb.p_free_ccb_last = &l2cb.ccb_pool[MAX_L2CAP_CHANNELS - 1];
785
786 #ifdef L2CAP_DESIRED_LINK_ROLE
787 l2cb.desire_role = L2CAP_DESIRED_LINK_ROLE;
788 #else
789 l2cb.desire_role = HCI_ROLE_SLAVE;
790 #endif
791
792 /* Set the default idle timeout */
793 l2cb.idle_timeout = L2CAP_LINK_INACTIVITY_TOUT;
794
795 #if defined(L2CAP_INITIAL_TRACE_LEVEL)
796 l2cb.l2cap_trace_level = L2CAP_INITIAL_TRACE_LEVEL;
797 #else
798 l2cb.l2cap_trace_level = BT_TRACE_LEVEL_NONE; /* No traces */
799 #endif
800
801 #if (L2CAP_CONFORMANCE_TESTING == TRUE)
802 /* Conformance testing needs a dynamic response */
803 l2cb.test_info_resp = L2CAP_EXTFEA_SUPPORTED_MASK;
804 #endif
805
806 /* Number of ACL buffers to use for high priority channel */
807 #if (L2CAP_HIGH_PRI_CHAN_QUOTA_IS_CONFIGURABLE == TRUE)
808 l2cb.high_pri_min_xmit_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA;
809 #endif
810
811 l2cb.l2c_ble_fixed_chnls_mask = L2CAP_FIXED_CHNL_ATT_BIT |
812 L2CAP_FIXED_CHNL_BLE_SIG_BIT |
813 L2CAP_FIXED_CHNL_SMP_BIT;
814
815 l2cb.rcv_pending_q = list_new(NULL);
816 CHECK(l2cb.rcv_pending_q != NULL);
817
818 l2cb.receive_hold_timer = alarm_new("l2c.receive_hold_timer");
819 }
820
l2c_free(void)821 void l2c_free(void) {
822 list_free(l2cb.rcv_pending_q);
823 l2cb.rcv_pending_q = NULL;
824 }
825
l2c_receive_hold_timer_timeout(UNUSED_ATTR void * data)826 void l2c_receive_hold_timer_timeout(UNUSED_ATTR void* data) {
827 /* Update the timeouts in the hold queue */
828 l2c_process_held_packets(true);
829 }
830
l2c_ccb_timer_timeout(void * data)831 void l2c_ccb_timer_timeout(void* data) {
832 tL2C_CCB* p_ccb = (tL2C_CCB*)data;
833
834 l2c_csm_execute(p_ccb, L2CEVT_TIMEOUT, NULL);
835 }
836
l2c_fcrb_ack_timer_timeout(void * data)837 void l2c_fcrb_ack_timer_timeout(void* data) {
838 tL2C_CCB* p_ccb = (tL2C_CCB*)data;
839
840 l2c_csm_execute(p_ccb, L2CEVT_ACK_TIMEOUT, NULL);
841 }
842
l2c_lcb_timer_timeout(void * data)843 void l2c_lcb_timer_timeout(void* data) {
844 tL2C_LCB* p_lcb = (tL2C_LCB*)data;
845
846 l2c_link_timeout(p_lcb);
847 }
848
849 /*******************************************************************************
850 *
851 * Function l2c_data_write
852 *
853 * Description API functions call this function to write data.
854 *
855 * Returns L2CAP_DW_SUCCESS, if data accepted, else false
856 * L2CAP_DW_CONGESTED, if data accepted and the channel is
857 * congested
858 * L2CAP_DW_FAILED, if error
859 *
860 ******************************************************************************/
l2c_data_write(uint16_t cid,BT_HDR * p_data,uint16_t flags)861 uint8_t l2c_data_write(uint16_t cid, BT_HDR* p_data, uint16_t flags) {
862 tL2C_CCB* p_ccb;
863
864 /* Find the channel control block. We don't know the link it is on. */
865 p_ccb = l2cu_find_ccb_by_cid(NULL, cid);
866 if (p_ccb == NULL) {
867 L2CAP_TRACE_WARNING("L2CAP - no CCB for L2CA_DataWrite, CID: %d", cid);
868 osi_free(p_data);
869 return (L2CAP_DW_FAILED);
870 }
871
872 #ifndef TESTER /* Tester may send any amount of data. otherwise sending \
873 message \
874 bigger than mtu size of peer is a violation of protocol */
875 uint16_t mtu;
876
877 if (p_ccb->p_lcb->transport == BT_TRANSPORT_LE)
878 mtu = p_ccb->peer_conn_cfg.mtu;
879 else
880 mtu = p_ccb->peer_cfg.mtu;
881
882 if (p_data->len > mtu) {
883 L2CAP_TRACE_WARNING(
884 "L2CAP - CID: 0x%04x cannot send message bigger than peer's mtu size: "
885 "len=%u mtu=%u",
886 cid, p_data->len, mtu);
887 osi_free(p_data);
888 return (L2CAP_DW_FAILED);
889 }
890 #endif
891
892 /* channel based, packet based flushable or non-flushable */
893 p_data->layer_specific = flags;
894
895 /* If already congested, do not accept any more packets */
896 if (p_ccb->cong_sent) {
897 L2CAP_TRACE_ERROR(
898 "L2CAP - CID: 0x%04x cannot send, already congested "
899 "xmit_hold_q.count: %u buff_quota: %u",
900 p_ccb->local_cid, fixed_queue_length(p_ccb->xmit_hold_q),
901 p_ccb->buff_quota);
902
903 osi_free(p_data);
904 return (L2CAP_DW_FAILED);
905 }
906
907 l2c_csm_execute(p_ccb, L2CEVT_L2CA_DATA_WRITE, p_data);
908
909 if (p_ccb->cong_sent) return (L2CAP_DW_CONGESTED);
910
911 return (L2CAP_DW_SUCCESS);
912 }
913