1 /******************************************************************************
2 *
3 * Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains the main L2CAP entry points
22 *
23 ******************************************************************************/
24
25 #define LOG_TAG "bt_l2c_main"
26
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30
31 #include "bt_common.h"
32 #include "bt_target.h"
33 #include "btm_int.h"
34 #include "btu.h"
35 #include "device/include/controller.h"
36 #include "hcimsgs.h"
37 #include "l2c_api.h"
38 #include "l2c_int.h"
39 #include "l2cdefs.h"
40 #include "osi/include/log.h"
41 #include "osi/include/osi.h"
42
43 /******************************************************************************/
44 /* L O C A L F U N C T I O N P R O T O T Y P E S */
45 /******************************************************************************/
46 static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len);
47
48 /******************************************************************************/
49 /* G L O B A L L 2 C A P D A T A */
50 /******************************************************************************/
51 tL2C_CB l2cb;
52
53 /*******************************************************************************
54 *
55 * Function l2c_rcv_acl_data
56 *
57 * Description This function is called from the HCI Interface when an ACL
58 * data packet is received.
59 *
60 * Returns void
61 *
62 ******************************************************************************/
l2c_rcv_acl_data(BT_HDR * p_msg)63 void l2c_rcv_acl_data(BT_HDR* p_msg) {
64 uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
65 uint16_t handle, hci_len;
66 uint8_t pkt_type;
67 tL2C_LCB* p_lcb;
68 tL2C_CCB* p_ccb = NULL;
69 uint16_t l2cap_len, rcv_cid, psm;
70 uint16_t credit;
71
72 /* Extract the handle */
73 STREAM_TO_UINT16(handle, p);
74 pkt_type = HCID_GET_EVENT(handle);
75 handle = HCID_GET_HANDLE(handle);
76
77 /* Since the HCI Transport is putting segmented packets back together, we */
78 /* should never get a valid packet with the type set to "continuation" */
79 if (pkt_type != L2CAP_PKT_CONTINUE) {
80 /* Find the LCB based on the handle */
81 p_lcb = l2cu_find_lcb_by_handle(handle);
82 if (p_lcb == NULL) {
83 uint8_t cmd_code;
84
85 /* There is a slight possibility (specifically with USB) that we get an */
86 /* L2CAP connection request before we get the HCI connection complete. */
87 /* So for these types of messages, hold them for up to 2 seconds. */
88 STREAM_TO_UINT16(hci_len, p);
89 STREAM_TO_UINT16(l2cap_len, p);
90 STREAM_TO_UINT16(rcv_cid, p);
91 STREAM_TO_UINT8(cmd_code, p);
92
93 if ((p_msg->layer_specific == 0) && (rcv_cid == L2CAP_SIGNALLING_CID) &&
94 (cmd_code == L2CAP_CMD_INFO_REQ || cmd_code == L2CAP_CMD_CONN_REQ)) {
95 L2CAP_TRACE_WARNING(
96 "L2CAP - holding ACL for unknown handle:%d ls:%d"
97 " cid:%d opcode:%d cur count:%d",
98 handle, p_msg->layer_specific, rcv_cid, cmd_code,
99 list_length(l2cb.rcv_pending_q));
100 p_msg->layer_specific = 2;
101 list_append(l2cb.rcv_pending_q, p_msg);
102
103 if (list_length(l2cb.rcv_pending_q) == 1) {
104 alarm_set_on_mloop(l2cb.receive_hold_timer, BT_1SEC_TIMEOUT_MS,
105 l2c_receive_hold_timer_timeout, NULL);
106 }
107
108 return;
109 } else {
110 L2CAP_TRACE_ERROR(
111 "L2CAP - rcvd ACL for unknown handle:%d ls:%d cid:%d"
112 " opcode:%d cur count:%d",
113 handle, p_msg->layer_specific, rcv_cid, cmd_code,
114 list_length(l2cb.rcv_pending_q));
115 }
116 osi_free(p_msg);
117 return;
118 }
119 } else {
120 L2CAP_TRACE_WARNING("L2CAP - expected pkt start or complete, got: %d",
121 pkt_type);
122 osi_free(p_msg);
123 return;
124 }
125
126 /* Extract the length and update the buffer header */
127 STREAM_TO_UINT16(hci_len, p);
128 p_msg->offset += 4;
129
130 if (hci_len < L2CAP_PKT_OVERHEAD) {
131 /* Must receive at least the L2CAP length and CID */
132 L2CAP_TRACE_WARNING("L2CAP - got incorrect hci header");
133 osi_free(p_msg);
134 return;
135 }
136
137 /* Extract the length and CID */
138 STREAM_TO_UINT16(l2cap_len, p);
139 STREAM_TO_UINT16(rcv_cid, p);
140
141 /* for BLE channel, always notify connection when ACL data received on the
142 * link */
143 if (p_lcb && p_lcb->transport == BT_TRANSPORT_LE &&
144 p_lcb->link_state != LST_DISCONNECTING)
145 /* only process fixed channel data as channel open indication when link is
146 * not in disconnecting mode */
147 l2cble_notify_le_connection(p_lcb->remote_bd_addr);
148
149 /* Find the CCB for this CID */
150 if (rcv_cid >= L2CAP_BASE_APPL_CID) {
151 p_ccb = l2cu_find_ccb_by_cid(p_lcb, rcv_cid);
152 if (p_ccb == NULL) {
153 L2CAP_TRACE_WARNING("L2CAP - unknown CID: 0x%04x", rcv_cid);
154 osi_free(p_msg);
155 return;
156 }
157 }
158
159 p_msg->len = hci_len - L2CAP_PKT_OVERHEAD;
160 p_msg->offset += L2CAP_PKT_OVERHEAD;
161
162 if (l2cap_len != p_msg->len) {
163 L2CAP_TRACE_WARNING("L2CAP - bad length in pkt. Exp: %d Act: %d",
164 l2cap_len, p_msg->len);
165
166 osi_free(p_msg);
167 return;
168 }
169
170 /* Send the data through the channel state machine */
171 if (rcv_cid == L2CAP_SIGNALLING_CID) {
172 process_l2cap_cmd(p_lcb, p, l2cap_len);
173 osi_free(p_msg);
174 } else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) {
175 /* process_connectionless_data (p_lcb); */
176 STREAM_TO_UINT16(psm, p);
177 L2CAP_TRACE_DEBUG("GOT CONNECTIONLESS DATA PSM:%d", psm);
178
179 #if (L2CAP_UCD_INCLUDED == TRUE)
180 /* if it is not broadcast, check UCD registration */
181 if (l2c_ucd_check_rx_pkts(p_lcb, p_msg)) {
182 /* nothing to do */
183 } else
184 #endif
185 osi_free(p_msg);
186 } else if (rcv_cid == L2CAP_BLE_SIGNALLING_CID) {
187 l2cble_process_sig_cmd(p_lcb, p, l2cap_len);
188 osi_free(p_msg);
189 }
190 #if (L2CAP_NUM_FIXED_CHNLS > 0)
191 else if ((rcv_cid >= L2CAP_FIRST_FIXED_CHNL) &&
192 (rcv_cid <= L2CAP_LAST_FIXED_CHNL) &&
193 (l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL]
194 .pL2CA_FixedData_Cb != NULL)) {
195 /* If no CCB for this channel, allocate one */
196 if (p_lcb &&
197 /* only process fixed channel data when link is open or wait for data
198 indication */
199 (p_lcb->link_state != LST_DISCONNECTING) &&
200 l2cu_initialize_fixed_ccb(
201 p_lcb, rcv_cid, &l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL]
202 .fixed_chnl_opts)) {
203 p_ccb = p_lcb->p_fixed_ccbs[rcv_cid - L2CAP_FIRST_FIXED_CHNL];
204
205 if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_BASIC_MODE)
206 l2c_fcr_proc_pdu(p_ccb, p_msg);
207 else
208 (*l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(
209 rcv_cid, p_lcb->remote_bd_addr, p_msg);
210 } else
211 osi_free(p_msg);
212 }
213 #endif
214
215 else {
216 if (p_ccb == NULL)
217 osi_free(p_msg);
218 else {
219 if (p_lcb->transport == BT_TRANSPORT_LE) {
220 l2c_lcc_proc_pdu(p_ccb, p_msg);
221 // Got a pkt, valid send out credits to the peer device
222 credit = L2CAP_LE_DEFAULT_CREDIT;
223 l2c_csm_execute(p_ccb, L2CEVT_L2CA_SEND_FLOW_CONTROL_CREDIT, &credit);
224 } else {
225 /* Basic mode packets go straight to the state machine */
226 if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE)
227 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DATA, p_msg);
228 else {
229 /* eRTM or streaming mode, so we need to validate states first */
230 if ((p_ccb->chnl_state == CST_OPEN) ||
231 (p_ccb->chnl_state == CST_CONFIG))
232 l2c_fcr_proc_pdu(p_ccb, p_msg);
233 else
234 osi_free(p_msg);
235 }
236 }
237 }
238 }
239 }
240
241 /*******************************************************************************
242 *
243 * Function process_l2cap_cmd
244 *
245 * Description This function is called when a packet is received on the
246 * L2CAP signalling CID
247 *
248 * Returns void
249 *
250 ******************************************************************************/
process_l2cap_cmd(tL2C_LCB * p_lcb,uint8_t * p,uint16_t pkt_len)251 static void process_l2cap_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
252 uint8_t *p_pkt_end, *p_next_cmd, *p_cfg_end, *p_cfg_start;
253 uint8_t cmd_code, cfg_code, cfg_len, id;
254 tL2C_CONN_INFO con_info;
255 tL2CAP_CFG_INFO cfg_info;
256 uint16_t rej_reason, rej_mtu, lcid, rcid, info_type;
257 tL2C_CCB* p_ccb;
258 tL2C_RCB* p_rcb;
259 bool cfg_rej, pkt_size_rej = false;
260 uint16_t cfg_rej_len, cmd_len;
261 uint16_t result;
262 tL2C_CONN_INFO ci;
263
264 /* if l2cap command received in CID 1 on top of an LE link, ignore this
265 * command */
266 if (p_lcb->transport == BT_TRANSPORT_LE) return;
267
268 /* Reject the packet if it exceeds the default Signalling Channel MTU */
269 if (pkt_len > L2CAP_DEFAULT_MTU) {
270 /* Core Spec requires a single response to the first command found in a
271 *multi-command
272 ** L2cap packet. If only responses in the packet, then it will be ignored.
273 ** Here we simply mark the bad packet and decide which cmd ID to reject
274 *later
275 */
276 pkt_size_rej = true;
277 L2CAP_TRACE_ERROR("L2CAP SIG MTU Pkt Len Exceeded (672) -> pkt_len: %d",
278 pkt_len);
279 }
280
281 p_next_cmd = p;
282 p_pkt_end = p + pkt_len;
283
284 memset(&cfg_info, 0, sizeof(cfg_info));
285
286 /* An L2CAP packet may contain multiple commands */
287 while (true) {
288 /* Smallest command is 4 bytes */
289 p = p_next_cmd;
290 if (p > (p_pkt_end - 4)) break;
291
292 STREAM_TO_UINT8(cmd_code, p);
293 STREAM_TO_UINT8(id, p);
294 STREAM_TO_UINT16(cmd_len, p);
295
296 if (cmd_len > BT_SMALL_BUFFER_SIZE) {
297 L2CAP_TRACE_WARNING("L2CAP - Invalid MTU Size");
298 l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_MTU_EXCEEDED, id, 0, 0);
299 return;
300 }
301
302 /* Check command length does not exceed packet length */
303 p_next_cmd = p + cmd_len;
304 if (p_next_cmd > p_pkt_end) {
305 L2CAP_TRACE_WARNING("Command len bad pkt_len: %d cmd_len: %d code: %d",
306 pkt_len, cmd_len, cmd_code);
307 break;
308 }
309
310 L2CAP_TRACE_DEBUG("cmd_code: %d, id:%d, cmd_len:%d", cmd_code, id, cmd_len);
311
312 /* Bad L2CAP packet length, look or cmd to reject */
313 if (pkt_size_rej) {
314 /* If command found rejected it and we're done, otherwise keep looking */
315 if (l2c_is_cmd_rejected(cmd_code, id, p_lcb))
316 return;
317 else
318 continue; /* Look for next cmd/response in current packet */
319 }
320
321 switch (cmd_code) {
322 case L2CAP_CMD_REJECT:
323 if (p + 2 > p_next_cmd) {
324 android_errorWriteLog(0x534e4554, "74202041");
325 return;
326 }
327 STREAM_TO_UINT16(rej_reason, p);
328 if (rej_reason == L2CAP_CMD_REJ_MTU_EXCEEDED) {
329 if (p + 2 > p_next_cmd) {
330 android_errorWriteLog(0x534e4554, "74202041");
331 return;
332 }
333 STREAM_TO_UINT16(rej_mtu, p);
334 /* What to do with the MTU reject ? We have negotiated an MTU. For now
335 */
336 /* we will ignore it and let a higher protocol timeout take care of it
337 */
338
339 L2CAP_TRACE_WARNING("L2CAP - MTU rej Handle: %d MTU: %d",
340 p_lcb->handle, rej_mtu);
341 }
342 if (rej_reason == L2CAP_CMD_REJ_INVALID_CID) {
343 if (p + 4 > p_next_cmd) {
344 android_errorWriteLog(0x534e4554, "74202041");
345 return;
346 }
347 STREAM_TO_UINT16(rcid, p);
348 STREAM_TO_UINT16(lcid, p);
349
350 L2CAP_TRACE_WARNING(
351 "L2CAP - rej with CID invalid, LCID: 0x%04x RCID: 0x%04x", lcid,
352 rcid);
353
354 /* Remote CID invalid. Treat as a disconnect */
355 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
356 if ((p_ccb != NULL) && (p_ccb->remote_cid == rcid)) {
357 /* Fake link disconnect - no reply is generated */
358 l2c_csm_execute(p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL);
359 }
360 }
361
362 /* SonyEricsson Info request Bug workaround (Continue connection) */
363 else if (rej_reason == L2CAP_CMD_REJ_NOT_UNDERSTOOD &&
364 p_lcb->w4_info_rsp) {
365 alarm_cancel(p_lcb->info_resp_timer);
366
367 p_lcb->w4_info_rsp = false;
368 ci.status = HCI_SUCCESS;
369 ci.bd_addr = p_lcb->remote_bd_addr;
370
371 /* For all channels, send the event through their FSMs */
372 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
373 p_ccb = p_ccb->p_next_ccb) {
374 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
375 }
376 }
377 break;
378
379 case L2CAP_CMD_CONN_REQ:
380 if (p + 4 > p_next_cmd) {
381 android_errorWriteLog(0x534e4554, "74202041");
382 return;
383 }
384 STREAM_TO_UINT16(con_info.psm, p);
385 STREAM_TO_UINT16(rcid, p);
386 p_rcb = l2cu_find_rcb_by_psm(con_info.psm);
387 if (p_rcb == NULL) {
388 L2CAP_TRACE_WARNING("L2CAP - rcvd conn req for unknown PSM: %d",
389 con_info.psm);
390 l2cu_reject_connection(p_lcb, rcid, id, L2CAP_CONN_NO_PSM);
391 break;
392 } else {
393 if (!p_rcb->api.pL2CA_ConnectInd_Cb) {
394 L2CAP_TRACE_WARNING(
395 "L2CAP - rcvd conn req for outgoing-only connection PSM: %d",
396 con_info.psm);
397 l2cu_reject_connection(p_lcb, rcid, id, L2CAP_CONN_NO_PSM);
398 break;
399 }
400 }
401 p_ccb = l2cu_allocate_ccb(p_lcb, 0);
402 if (p_ccb == NULL) {
403 L2CAP_TRACE_ERROR("L2CAP - unable to allocate CCB");
404 l2cu_reject_connection(p_lcb, rcid, id, L2CAP_CONN_NO_RESOURCES);
405 break;
406 }
407 p_ccb->remote_id = id;
408 p_ccb->p_rcb = p_rcb;
409 p_ccb->remote_cid = rcid;
410
411 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_REQ, &con_info);
412 break;
413
414 case L2CAP_CMD_CONN_RSP:
415 if (p + 8 > p_next_cmd) {
416 android_errorWriteLog(0x534e4554, "74202041");
417 return;
418 }
419 STREAM_TO_UINT16(con_info.remote_cid, p);
420 STREAM_TO_UINT16(lcid, p);
421 STREAM_TO_UINT16(con_info.l2cap_result, p);
422 STREAM_TO_UINT16(con_info.l2cap_status, p);
423
424 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
425 if (p_ccb == NULL) {
426 L2CAP_TRACE_WARNING("L2CAP - no CCB for conn rsp, LCID: %d RCID: %d",
427 lcid, con_info.remote_cid);
428 break;
429 }
430 if (p_ccb->local_id != id) {
431 L2CAP_TRACE_WARNING("L2CAP - con rsp - bad ID. Exp: %d Got: %d",
432 p_ccb->local_id, id);
433 break;
434 }
435
436 if (con_info.l2cap_result == L2CAP_CONN_OK)
437 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP, &con_info);
438 else if (con_info.l2cap_result == L2CAP_CONN_PENDING)
439 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_PND, &con_info);
440 else
441 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_NEG, &con_info);
442
443 break;
444
445 case L2CAP_CMD_CONFIG_REQ:
446 p_cfg_end = p + cmd_len;
447 cfg_rej = false;
448 cfg_rej_len = 0;
449
450 if (p + 4 > p_next_cmd) {
451 android_errorWriteLog(0x534e4554, "74202041");
452 return;
453 }
454 STREAM_TO_UINT16(lcid, p);
455 STREAM_TO_UINT16(cfg_info.flags, p);
456
457 p_cfg_start = p;
458
459 cfg_info.flush_to_present = cfg_info.mtu_present =
460 cfg_info.qos_present = cfg_info.fcr_present = cfg_info.fcs_present =
461 false;
462
463 while (p < p_cfg_end) {
464 if (p + 2 > p_next_cmd) {
465 android_errorWriteLog(0x534e4554, "74202041");
466 return;
467 }
468 STREAM_TO_UINT8(cfg_code, p);
469 STREAM_TO_UINT8(cfg_len, p);
470
471 switch (cfg_code & 0x7F) {
472 case L2CAP_CFG_TYPE_MTU:
473 cfg_info.mtu_present = true;
474 if (cfg_len != 2) {
475 android_errorWriteLog(0x534e4554, "119870451");
476 return;
477 }
478 if (p + cfg_len > p_next_cmd) {
479 android_errorWriteLog(0x534e4554, "74202041");
480 return;
481 }
482 STREAM_TO_UINT16(cfg_info.mtu, p);
483 break;
484
485 case L2CAP_CFG_TYPE_FLUSH_TOUT:
486 cfg_info.flush_to_present = true;
487 if (cfg_len != 2) {
488 android_errorWriteLog(0x534e4554, "119870451");
489 return;
490 }
491 if (p + cfg_len > p_next_cmd) {
492 android_errorWriteLog(0x534e4554, "74202041");
493 return;
494 }
495 STREAM_TO_UINT16(cfg_info.flush_to, p);
496 break;
497
498 case L2CAP_CFG_TYPE_QOS:
499 cfg_info.qos_present = true;
500 if (cfg_len != 2 + 5 * 4) {
501 android_errorWriteLog(0x534e4554, "119870451");
502 return;
503 }
504 if (p + cfg_len > p_next_cmd) {
505 android_errorWriteLog(0x534e4554, "74202041");
506 return;
507 }
508 STREAM_TO_UINT8(cfg_info.qos.qos_flags, p);
509 STREAM_TO_UINT8(cfg_info.qos.service_type, p);
510 STREAM_TO_UINT32(cfg_info.qos.token_rate, p);
511 STREAM_TO_UINT32(cfg_info.qos.token_bucket_size, p);
512 STREAM_TO_UINT32(cfg_info.qos.peak_bandwidth, p);
513 STREAM_TO_UINT32(cfg_info.qos.latency, p);
514 STREAM_TO_UINT32(cfg_info.qos.delay_variation, p);
515 break;
516
517 case L2CAP_CFG_TYPE_FCR:
518 cfg_info.fcr_present = true;
519 if (cfg_len != 3 + 3 * 2) {
520 android_errorWriteLog(0x534e4554, "119870451");
521 return;
522 }
523 if (p + cfg_len > p_next_cmd) {
524 android_errorWriteLog(0x534e4554, "74202041");
525 return;
526 }
527 STREAM_TO_UINT8(cfg_info.fcr.mode, p);
528 STREAM_TO_UINT8(cfg_info.fcr.tx_win_sz, p);
529 STREAM_TO_UINT8(cfg_info.fcr.max_transmit, p);
530 STREAM_TO_UINT16(cfg_info.fcr.rtrans_tout, p);
531 STREAM_TO_UINT16(cfg_info.fcr.mon_tout, p);
532 STREAM_TO_UINT16(cfg_info.fcr.mps, p);
533 break;
534
535 case L2CAP_CFG_TYPE_FCS:
536 cfg_info.fcs_present = true;
537 if (cfg_len != 1) {
538 android_errorWriteLog(0x534e4554, "119870451");
539 return;
540 }
541 if (p + cfg_len > p_next_cmd) {
542 android_errorWriteLog(0x534e4554, "74202041");
543 return;
544 }
545 STREAM_TO_UINT8(cfg_info.fcs, p);
546 break;
547
548 case L2CAP_CFG_TYPE_EXT_FLOW:
549 cfg_info.ext_flow_spec_present = true;
550 if (cfg_len != 2 + 2 + 3 * 4) {
551 android_errorWriteLog(0x534e4554, "119870451");
552 return;
553 }
554 if (p + cfg_len > p_next_cmd) {
555 android_errorWriteLog(0x534e4554, "74202041");
556 return;
557 }
558 STREAM_TO_UINT8(cfg_info.ext_flow_spec.id, p);
559 STREAM_TO_UINT8(cfg_info.ext_flow_spec.stype, p);
560 STREAM_TO_UINT16(cfg_info.ext_flow_spec.max_sdu_size, p);
561 STREAM_TO_UINT32(cfg_info.ext_flow_spec.sdu_inter_time, p);
562 STREAM_TO_UINT32(cfg_info.ext_flow_spec.access_latency, p);
563 STREAM_TO_UINT32(cfg_info.ext_flow_spec.flush_timeout, p);
564 break;
565
566 default:
567 /* sanity check option length */
568 if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len) {
569 if (p + cfg_len > p_next_cmd) {
570 android_errorWriteLog(0x534e4554, "79488381");
571 return;
572 }
573 p += cfg_len;
574 if ((cfg_code & 0x80) == 0) {
575 cfg_rej_len += cfg_len + L2CAP_CFG_OPTION_OVERHEAD;
576 cfg_rej = true;
577 }
578 }
579 /* bad length; force loop exit */
580 else {
581 p = p_cfg_end;
582 cfg_rej = true;
583 }
584 break;
585 }
586 }
587
588 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
589 if (p_ccb != NULL) {
590 p_ccb->remote_id = id;
591 if (cfg_rej) {
592 l2cu_send_peer_config_rej(
593 p_ccb, p_cfg_start, (uint16_t)(cmd_len - L2CAP_CONFIG_REQ_LEN),
594 cfg_rej_len);
595 } else {
596 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONFIG_REQ, &cfg_info);
597 }
598 } else {
599 /* updated spec says send command reject on invalid cid */
600 l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_INVALID_CID, id, 0, 0);
601 }
602 break;
603
604 case L2CAP_CMD_CONFIG_RSP:
605 p_cfg_end = p + cmd_len;
606 if (p + 6 > p_next_cmd) {
607 android_errorWriteLog(0x534e4554, "74202041");
608 return;
609 }
610 STREAM_TO_UINT16(lcid, p);
611 STREAM_TO_UINT16(cfg_info.flags, p);
612 STREAM_TO_UINT16(cfg_info.result, p);
613
614 cfg_info.flush_to_present = cfg_info.mtu_present =
615 cfg_info.qos_present = cfg_info.fcr_present = cfg_info.fcs_present =
616 false;
617
618 while (p < p_cfg_end) {
619 if (p + 2 > p_next_cmd) {
620 android_errorWriteLog(0x534e4554, "74202041");
621 return;
622 }
623 STREAM_TO_UINT8(cfg_code, p);
624 STREAM_TO_UINT8(cfg_len, p);
625
626 switch (cfg_code & 0x7F) {
627 case L2CAP_CFG_TYPE_MTU:
628 cfg_info.mtu_present = true;
629 if (p + 2 > p_next_cmd) {
630 android_errorWriteLog(0x534e4554, "74202041");
631 return;
632 }
633 STREAM_TO_UINT16(cfg_info.mtu, p);
634 break;
635
636 case L2CAP_CFG_TYPE_FLUSH_TOUT:
637 cfg_info.flush_to_present = true;
638 if (p + 2 > p_next_cmd) {
639 android_errorWriteLog(0x534e4554, "74202041");
640 return;
641 }
642 STREAM_TO_UINT16(cfg_info.flush_to, p);
643 break;
644
645 case L2CAP_CFG_TYPE_QOS:
646 cfg_info.qos_present = true;
647 if (p + 2 + 5 * 4 > p_next_cmd) {
648 android_errorWriteLog(0x534e4554, "74202041");
649 return;
650 }
651 STREAM_TO_UINT8(cfg_info.qos.qos_flags, p);
652 STREAM_TO_UINT8(cfg_info.qos.service_type, p);
653 STREAM_TO_UINT32(cfg_info.qos.token_rate, p);
654 STREAM_TO_UINT32(cfg_info.qos.token_bucket_size, p);
655 STREAM_TO_UINT32(cfg_info.qos.peak_bandwidth, p);
656 STREAM_TO_UINT32(cfg_info.qos.latency, p);
657 STREAM_TO_UINT32(cfg_info.qos.delay_variation, p);
658 break;
659
660 case L2CAP_CFG_TYPE_FCR:
661 cfg_info.fcr_present = true;
662 if (p + 3 + 3 * 2 > p_next_cmd) {
663 android_errorWriteLog(0x534e4554, "74202041");
664 return;
665 }
666 STREAM_TO_UINT8(cfg_info.fcr.mode, p);
667 STREAM_TO_UINT8(cfg_info.fcr.tx_win_sz, p);
668 STREAM_TO_UINT8(cfg_info.fcr.max_transmit, p);
669 STREAM_TO_UINT16(cfg_info.fcr.rtrans_tout, p);
670 STREAM_TO_UINT16(cfg_info.fcr.mon_tout, p);
671 STREAM_TO_UINT16(cfg_info.fcr.mps, p);
672 break;
673
674 case L2CAP_CFG_TYPE_FCS:
675 cfg_info.fcs_present = true;
676 if (p + 1 > p_next_cmd) {
677 android_errorWriteLog(0x534e4554, "74202041");
678 return;
679 }
680 STREAM_TO_UINT8(cfg_info.fcs, p);
681 break;
682
683 case L2CAP_CFG_TYPE_EXT_FLOW:
684 cfg_info.ext_flow_spec_present = true;
685 if (p + 2 + 2 + 3 * 4 > p_next_cmd) {
686 android_errorWriteLog(0x534e4554, "74202041");
687 return;
688 }
689 STREAM_TO_UINT8(cfg_info.ext_flow_spec.id, p);
690 STREAM_TO_UINT8(cfg_info.ext_flow_spec.stype, p);
691 STREAM_TO_UINT16(cfg_info.ext_flow_spec.max_sdu_size, p);
692 STREAM_TO_UINT32(cfg_info.ext_flow_spec.sdu_inter_time, p);
693 STREAM_TO_UINT32(cfg_info.ext_flow_spec.access_latency, p);
694 STREAM_TO_UINT32(cfg_info.ext_flow_spec.flush_timeout, p);
695 break;
696 }
697 }
698
699 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
700 if (p_ccb != NULL) {
701 if (p_ccb->local_id != id) {
702 L2CAP_TRACE_WARNING("L2CAP - cfg rsp - bad ID. Exp: %d Got: %d",
703 p_ccb->local_id, id);
704 break;
705 }
706 if ((cfg_info.result == L2CAP_CFG_OK) ||
707 (cfg_info.result == L2CAP_CFG_PENDING))
708 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONFIG_RSP, &cfg_info);
709 else
710 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONFIG_RSP_NEG, &cfg_info);
711 } else {
712 L2CAP_TRACE_WARNING("L2CAP - rcvd cfg rsp for unknown CID: 0x%04x",
713 lcid);
714 }
715 break;
716
717 case L2CAP_CMD_DISC_REQ:
718 if (p + 4 > p_next_cmd) {
719 android_errorWriteLog(0x534e4554, "74202041");
720 return;
721 }
722 STREAM_TO_UINT16(lcid, p);
723 STREAM_TO_UINT16(rcid, p);
724
725 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
726 if (p_ccb != NULL) {
727 if (p_ccb->remote_cid == rcid) {
728 p_ccb->remote_id = id;
729 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DISCONNECT_REQ, &con_info);
730 }
731 } else
732 l2cu_send_peer_disc_rsp(p_lcb, id, lcid, rcid);
733
734 break;
735
736 case L2CAP_CMD_DISC_RSP:
737 if (p + 4 > p_next_cmd) {
738 android_errorWriteLog(0x534e4554, "74202041");
739 return;
740 }
741 STREAM_TO_UINT16(rcid, p);
742 STREAM_TO_UINT16(lcid, p);
743
744 p_ccb = l2cu_find_ccb_by_cid(p_lcb, lcid);
745 if (p_ccb != NULL) {
746 if ((p_ccb->remote_cid == rcid) && (p_ccb->local_id == id)) {
747 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_DISCONNECT_RSP, &con_info);
748 }
749 }
750 break;
751
752 case L2CAP_CMD_ECHO_REQ:
753 l2cu_send_peer_echo_rsp(p_lcb, id, p, cmd_len);
754 break;
755
756 case L2CAP_CMD_ECHO_RSP:
757 if (p_lcb->p_echo_rsp_cb) {
758 tL2CA_ECHO_RSP_CB* p_cb = p_lcb->p_echo_rsp_cb;
759
760 /* Zero out the callback in case app immediately calls us again */
761 p_lcb->p_echo_rsp_cb = NULL;
762
763 (*p_cb)(L2CAP_PING_RESULT_OK);
764 }
765 break;
766
767 case L2CAP_CMD_INFO_REQ:
768 if (p + 2 > p_next_cmd) {
769 android_errorWriteLog(0x534e4554, "74202041");
770 return;
771 }
772 STREAM_TO_UINT16(info_type, p);
773 l2cu_send_peer_info_rsp(p_lcb, id, info_type);
774 break;
775
776 case L2CAP_CMD_INFO_RSP:
777 /* Stop the link connect timer if sent before L2CAP connection is up */
778 if (p_lcb->w4_info_rsp) {
779 alarm_cancel(p_lcb->info_resp_timer);
780 p_lcb->w4_info_rsp = false;
781 }
782
783 if (p + 4 > p_next_cmd) {
784 android_errorWriteLog(0x534e4554, "74202041");
785 return;
786 }
787 STREAM_TO_UINT16(info_type, p);
788 STREAM_TO_UINT16(result, p);
789
790 p_lcb->info_rx_bits |= (1 << info_type);
791
792 if ((info_type == L2CAP_EXTENDED_FEATURES_INFO_TYPE) &&
793 (result == L2CAP_INFO_RESP_RESULT_SUCCESS)) {
794 if (p + 4 > p_next_cmd) {
795 android_errorWriteLog(0x534e4554, "74202041");
796 return;
797 }
798 STREAM_TO_UINT32(p_lcb->peer_ext_fea, p);
799
800 #if (L2CAP_NUM_FIXED_CHNLS > 0)
801 if (p_lcb->peer_ext_fea & L2CAP_EXTFEA_FIXED_CHNLS) {
802 l2cu_send_peer_info_req(p_lcb, L2CAP_FIXED_CHANNELS_INFO_TYPE);
803 break;
804 } else {
805 l2cu_process_fixed_chnl_resp(p_lcb);
806 }
807 #endif
808 }
809
810 #if (L2CAP_NUM_FIXED_CHNLS > 0)
811 if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {
812 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
813 memcpy(p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);
814 }
815
816 l2cu_process_fixed_chnl_resp(p_lcb);
817 }
818 #endif
819 #if (L2CAP_UCD_INCLUDED == TRUE)
820 else if (info_type == L2CAP_CONNLESS_MTU_INFO_TYPE) {
821 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
822 STREAM_TO_UINT16(p_lcb->ucd_mtu, p);
823 }
824 }
825 #endif
826
827 ci.status = HCI_SUCCESS;
828 ci.bd_addr = p_lcb->remote_bd_addr;
829 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb;
830 p_ccb = p_ccb->p_next_ccb) {
831 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci);
832 }
833 break;
834
835 default:
836 L2CAP_TRACE_WARNING("L2CAP - bad cmd code: %d", cmd_code);
837 l2cu_send_peer_cmd_reject(p_lcb, L2CAP_CMD_REJ_NOT_UNDERSTOOD, id, 0,
838 0);
839 return;
840 }
841 }
842 }
843
844 /*******************************************************************************
845 *
846 * Function l2c_process_held_packets
847 *
848 * Description This function processes any L2CAP packets that arrived
849 * before the HCI connection complete arrived. It is a work
850 * around for badly behaved controllers.
851 *
852 * Returns void
853 *
854 ******************************************************************************/
l2c_process_held_packets(bool timed_out)855 void l2c_process_held_packets(bool timed_out) {
856 if (list_is_empty(l2cb.rcv_pending_q)) return;
857
858 if (!timed_out) {
859 alarm_cancel(l2cb.receive_hold_timer);
860 L2CAP_TRACE_WARNING("L2CAP HOLD CONTINUE");
861 } else {
862 L2CAP_TRACE_WARNING("L2CAP HOLD TIMEOUT");
863 }
864
865 for (const list_node_t* node = list_begin(l2cb.rcv_pending_q);
866 node != list_end(l2cb.rcv_pending_q);) {
867 BT_HDR* p_buf = static_cast<BT_HDR*>(list_node(node));
868 node = list_next(node);
869 if (!timed_out || (!p_buf->layer_specific) ||
870 (--p_buf->layer_specific == 0)) {
871 list_remove(l2cb.rcv_pending_q, p_buf);
872 p_buf->layer_specific = 0xFFFF;
873 l2c_rcv_acl_data(p_buf);
874 }
875 }
876
877 /* If anyone still in the queue, restart the timeout */
878 if (!list_is_empty(l2cb.rcv_pending_q)) {
879 alarm_set_on_mloop(l2cb.receive_hold_timer, BT_1SEC_TIMEOUT_MS,
880 l2c_receive_hold_timer_timeout, NULL);
881 }
882 }
883
884 /*******************************************************************************
885 *
886 * Function l2c_init
887 *
888 * Description This function is called once at startup to initialize
889 * all the L2CAP structures
890 *
891 * Returns void
892 *
893 ******************************************************************************/
l2c_init(void)894 void l2c_init(void) {
895 int16_t xx;
896
897 memset(&l2cb, 0, sizeof(tL2C_CB));
898 /* the psm is increased by 2 before being used */
899 l2cb.dyn_psm = 0xFFF;
900
901 /* Put all the channel control blocks on the free queue */
902 for (xx = 0; xx < MAX_L2CAP_CHANNELS - 1; xx++) {
903 l2cb.ccb_pool[xx].p_next_ccb = &l2cb.ccb_pool[xx + 1];
904 }
905
906 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
907 /* it will be set to L2CAP_PKT_START_NON_FLUSHABLE if controller supports */
908 l2cb.non_flushable_pbf = L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT;
909 #endif
910
911 l2cb.p_free_ccb_first = &l2cb.ccb_pool[0];
912 l2cb.p_free_ccb_last = &l2cb.ccb_pool[MAX_L2CAP_CHANNELS - 1];
913
914 #ifdef L2CAP_DESIRED_LINK_ROLE
915 l2cb.desire_role = L2CAP_DESIRED_LINK_ROLE;
916 #else
917 l2cb.desire_role = HCI_ROLE_SLAVE;
918 #endif
919
920 /* Set the default idle timeout */
921 l2cb.idle_timeout = L2CAP_LINK_INACTIVITY_TOUT;
922
923 #if defined(L2CAP_INITIAL_TRACE_LEVEL)
924 l2cb.l2cap_trace_level = L2CAP_INITIAL_TRACE_LEVEL;
925 #else
926 l2cb.l2cap_trace_level = BT_TRACE_LEVEL_NONE; /* No traces */
927 #endif
928
929 #if (L2CAP_CONFORMANCE_TESTING == TRUE)
930 /* Conformance testing needs a dynamic response */
931 l2cb.test_info_resp = L2CAP_EXTFEA_SUPPORTED_MASK;
932 #endif
933
934 /* Number of ACL buffers to use for high priority channel */
935 #if (L2CAP_HIGH_PRI_CHAN_QUOTA_IS_CONFIGURABLE == TRUE)
936 l2cb.high_pri_min_xmit_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA;
937 #endif
938
939 l2cb.l2c_ble_fixed_chnls_mask = L2CAP_FIXED_CHNL_ATT_BIT |
940 L2CAP_FIXED_CHNL_BLE_SIG_BIT |
941 L2CAP_FIXED_CHNL_SMP_BIT;
942
943 l2cb.rcv_pending_q = list_new(NULL);
944 CHECK(l2cb.rcv_pending_q != NULL);
945
946 l2cb.receive_hold_timer = alarm_new("l2c.receive_hold_timer");
947 }
948
l2c_free(void)949 void l2c_free(void) {
950 list_free(l2cb.rcv_pending_q);
951 l2cb.rcv_pending_q = NULL;
952 }
953
l2c_receive_hold_timer_timeout(UNUSED_ATTR void * data)954 void l2c_receive_hold_timer_timeout(UNUSED_ATTR void* data) {
955 /* Update the timeouts in the hold queue */
956 l2c_process_held_packets(true);
957 }
958
l2c_ccb_timer_timeout(void * data)959 void l2c_ccb_timer_timeout(void* data) {
960 tL2C_CCB* p_ccb = (tL2C_CCB*)data;
961
962 l2c_csm_execute(p_ccb, L2CEVT_TIMEOUT, NULL);
963 }
964
l2c_fcrb_ack_timer_timeout(void * data)965 void l2c_fcrb_ack_timer_timeout(void* data) {
966 tL2C_CCB* p_ccb = (tL2C_CCB*)data;
967
968 l2c_csm_execute(p_ccb, L2CEVT_ACK_TIMEOUT, NULL);
969 }
970
l2c_lcb_timer_timeout(void * data)971 void l2c_lcb_timer_timeout(void* data) {
972 tL2C_LCB* p_lcb = (tL2C_LCB*)data;
973
974 l2c_link_timeout(p_lcb);
975 }
976
977 /*******************************************************************************
978 *
979 * Function l2c_data_write
980 *
981 * Description API functions call this function to write data.
982 *
983 * Returns L2CAP_DW_SUCCESS, if data accepted, else false
984 * L2CAP_DW_CONGESTED, if data accepted and the channel is
985 * congested
986 * L2CAP_DW_FAILED, if error
987 *
988 ******************************************************************************/
l2c_data_write(uint16_t cid,BT_HDR * p_data,uint16_t flags)989 uint8_t l2c_data_write(uint16_t cid, BT_HDR* p_data, uint16_t flags) {
990 tL2C_CCB* p_ccb;
991
992 /* Find the channel control block. We don't know the link it is on. */
993 p_ccb = l2cu_find_ccb_by_cid(NULL, cid);
994 if (p_ccb == NULL) {
995 L2CAP_TRACE_WARNING("L2CAP - no CCB for L2CA_DataWrite, CID: %d", cid);
996 osi_free(p_data);
997 return (L2CAP_DW_FAILED);
998 }
999
1000 #ifndef TESTER /* Tester may send any amount of data. otherwise sending \
1001 message \
1002 bigger than mtu size of peer is a violation of protocol */
1003 uint16_t mtu;
1004
1005 if (p_ccb->p_lcb->transport == BT_TRANSPORT_LE)
1006 mtu = p_ccb->peer_conn_cfg.mtu;
1007 else
1008 mtu = p_ccb->peer_cfg.mtu;
1009
1010 if (p_data->len > mtu) {
1011 L2CAP_TRACE_WARNING(
1012 "L2CAP - CID: 0x%04x cannot send message bigger than peer's mtu size: "
1013 "len=%u mtu=%u",
1014 cid, p_data->len, mtu);
1015 osi_free(p_data);
1016 return (L2CAP_DW_FAILED);
1017 }
1018 #endif
1019
1020 /* channel based, packet based flushable or non-flushable */
1021 p_data->layer_specific = flags;
1022
1023 /* If already congested, do not accept any more packets */
1024 if (p_ccb->cong_sent) {
1025 L2CAP_TRACE_ERROR(
1026 "L2CAP - CID: 0x%04x cannot send, already congested "
1027 "xmit_hold_q.count: %u buff_quota: %u",
1028 p_ccb->local_cid, fixed_queue_length(p_ccb->xmit_hold_q),
1029 p_ccb->buff_quota);
1030
1031 osi_free(p_data);
1032 return (L2CAP_DW_FAILED);
1033 }
1034
1035 l2c_csm_execute(p_ccb, L2CEVT_L2CA_DATA_WRITE, p_data);
1036
1037 if (p_ccb->cong_sent) return (L2CAP_DW_CONGESTED);
1038
1039 return (L2CAP_DW_SUCCESS);
1040 }
1041