1 /****************************************************************************** 2 * 3 * Copyright (C) 1999-2012 Broadcom Corporation 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at: 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 ******************************************************************************/ 18 19 /****************************************************************************** 20 * 21 * This file contains the main L2CAP entry points 22 * 23 ******************************************************************************/ 24 25 #include "bt_target.h" 26 #include <stdlib.h> 27 #include <string.h> 28 #include <stdio.h> 29 30 #include "gki.h" 31 #include "hcimsgs.h" 32 #include "l2cdefs.h" 33 #include "l2c_int.h" 34 #include "l2c_api.h" 35 #include "btu.h" 36 #include "btm_int.h" 37 38 /********************************************************************************/ 39 /* L O C A L F U N C T I O N P R O T O T Y P E S */ 40 /********************************************************************************/ 41 static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len); 42 43 /********************************************************************************/ 44 /* G L O B A L L 2 C A P D A T A */ 45 /********************************************************************************/ 46 #if L2C_DYNAMIC_MEMORY == FALSE 47 tL2C_CB l2cb; 48 #endif 49 50 /* Temporary - until l2cap implements group management */ 51 #if (TCS_BCST_SETUP_INCLUDED == TRUE && TCS_INCLUDED == TRUE) 52 extern void tcs_proc_bcst_msg( BD_ADDR addr, BT_HDR *p_msg ) ; 53 #endif 54 /******************************************************************************* 55 ** 56 ** Function l2c_bcst_msg 57 ** 58 ** Description 59 ** 60 ** Returns void 61 ** 62 *******************************************************************************/ 63 void l2c_bcst_msg( BT_HDR *p_buf, UINT16 psm ) 64 { 65 UINT8 *p; 66 67 /* Ensure we have enough space in the buffer for the L2CAP and HCI headers */ 68 if (p_buf->offset < L2CAP_BCST_MIN_OFFSET) 69 { 70 L2CAP_TRACE_ERROR ("L2CAP - cannot send buffer, offset: %d", p_buf->offset); 71 GKI_freebuf (p_buf); 72 return; 73 } 74 75 /* Step back some bytes to add the headers */ 76 p_buf->offset -= (HCI_DATA_PREAMBLE_SIZE + L2CAP_PKT_OVERHEAD + L2CAP_BCST_OVERHEAD); 77 p_buf->len += L2CAP_PKT_OVERHEAD + L2CAP_BCST_OVERHEAD; 78 79 /* Set the pointer to the beginning of the data */ 80 p = (UINT8 *)(p_buf + 1) + p_buf->offset; 81 82 /* First, the HCI transport header */ 83 UINT16_TO_STREAM (p, 0x0050 | (L2CAP_PKT_START << 12) | (2 << 14)); 84 85 /* The HCI transport will segment the buffers. */ 86 if (p_buf->len > btu_cb.hcit_acl_data_size) 87 { 88 UINT16_TO_STREAM (p, btu_cb.hcit_acl_data_size); 89 } 90 else 91 { 92 UINT16_TO_STREAM (p, p_buf->len); 93 } 94 95 /* Now the L2CAP header */ 96 UINT16_TO_STREAM (p, p_buf->len - L2CAP_PKT_OVERHEAD); 97 UINT16_TO_STREAM (p, L2CAP_CONNECTIONLESS_CID); 98 UINT16_TO_STREAM (p, psm); 99 100 p_buf->len += HCI_DATA_PREAMBLE_SIZE; 101 102 if (p_buf->len <= btu_cb.hcit_acl_pkt_size) 103 { 104 HCI_ACL_DATA_TO_LOWER (p_buf); 105 } 106 } 107 108 109 /******************************************************************************* 110 ** 111 ** Function l2c_rcv_acl_data 112 ** 113 ** Description This function is called from the HCI Interface when an ACL 114 ** data packet is received. 115 ** 116 ** Returns void 117 ** 118 *******************************************************************************/ 119 void l2c_rcv_acl_data (BT_HDR *p_msg) 120 { 121 UINT8 *p = (UINT8 *)(p_msg + 1) + p_msg->offset; 122 UINT16 handle, hci_len; 123 UINT8 pkt_type; 124 tL2C_LCB *p_lcb; 125 tL2C_CCB *p_ccb = NULL; 126 UINT16 l2cap_len, rcv_cid, psm; 127 128 /* Extract the handle */ 129 STREAM_TO_UINT16 (handle, p); 130 pkt_type = HCID_GET_EVENT (handle); 131 handle = HCID_GET_HANDLE (handle); 132 133 /* Since the HCI Transport is putting segmented packets back together, we */ 134 /* should never get a valid packet with the type set to "continuation" */ 135 if (pkt_type != L2CAP_PKT_CONTINUE) 136 { 137 /* Find the LCB based on the handle */ 138 if ((p_lcb = l2cu_find_lcb_by_handle (handle)) == NULL) 139 { 140 UINT8 cmd_code; 141 142 /* There is a slight possibility (specifically with USB) that we get an */ 143 /* L2CAP connection request before we get the HCI connection complete. */ 144 /* So for these types of messages, hold them for up to 2 seconds. */ 145 STREAM_TO_UINT16 (hci_len, p); 146 STREAM_TO_UINT16 (l2cap_len, p); 147 STREAM_TO_UINT16 (rcv_cid, p); 148 STREAM_TO_UINT8 (cmd_code, p); 149 150 if ((p_msg->layer_specific == 0) && (rcv_cid == L2CAP_SIGNALLING_CID) 151 && (cmd_code == L2CAP_CMD_INFO_REQ || cmd_code == L2CAP_CMD_CONN_REQ)) 152 { 153 L2CAP_TRACE_WARNING ("L2CAP - holding ACL for unknown handle:%d ls:%d cid:%d opcode:%d cur count:%d", 154 handle, p_msg->layer_specific, rcv_cid, cmd_code, 155 l2cb.rcv_hold_q.count); 156 p_msg->layer_specific = 2; 157 GKI_enqueue (&l2cb.rcv_hold_q, p_msg); 158 159 if (l2cb.rcv_hold_q.count == 1) 160 btu_start_timer (&l2cb.rcv_hold_tle, BTU_TTYPE_L2CAP_HOLD, BT_1SEC_TIMEOUT); 161 162 return; 163 } 164 else 165 { 166 L2CAP_TRACE_ERROR ("L2CAP - rcvd ACL for unknown handle:%d ls:%d cid:%d opcode:%d cur count:%d", 167 handle, p_msg->layer_specific, rcv_cid, cmd_code, l2cb.rcv_hold_q.count); 168 } 169 GKI_freebuf (p_msg); 170 return; 171 } 172 } 173 else 174 { 175 L2CAP_TRACE_WARNING ("L2CAP - expected pkt start or complete, got: %d", pkt_type); 176 GKI_freebuf (p_msg); 177 return; 178 } 179 180 /* Extract the length and update the buffer header */ 181 STREAM_TO_UINT16 (hci_len, p); 182 p_msg->offset += 4; 183 184 #if (L2CAP_HOST_FLOW_CTRL == TRUE) 185 /* Send ack if we hit the threshold */ 186 if (++p_lcb->link_pkts_unacked >= p_lcb->link_ack_thresh) 187 btu_hcif_send_host_rdy_for_data(); 188 #endif 189 190 /* Extract the length and CID */ 191 STREAM_TO_UINT16 (l2cap_len, p); 192 STREAM_TO_UINT16 (rcv_cid, p); 193 194 /* Find the CCB for this CID */ 195 if (rcv_cid >= L2CAP_BASE_APPL_CID) 196 { 197 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, rcv_cid)) == NULL) 198 { 199 L2CAP_TRACE_WARNING ("L2CAP - unknown CID: 0x%04x", rcv_cid); 200 GKI_freebuf (p_msg); 201 return; 202 } 203 } 204 205 if (hci_len >= L2CAP_PKT_OVERHEAD) /* Must receive at least the L2CAP length and CID.*/ 206 { 207 p_msg->len = hci_len - L2CAP_PKT_OVERHEAD; 208 p_msg->offset += L2CAP_PKT_OVERHEAD; 209 } 210 else 211 { 212 L2CAP_TRACE_WARNING ("L2CAP - got incorrect hci header" ); 213 GKI_freebuf (p_msg); 214 return; 215 } 216 217 if (l2cap_len != p_msg->len) 218 { 219 L2CAP_TRACE_WARNING ("L2CAP - bad length in pkt. Exp: %d Act: %d", 220 l2cap_len, p_msg->len); 221 222 GKI_freebuf (p_msg); 223 return; 224 } 225 226 /* Send the data through the channel state machine */ 227 if (rcv_cid == L2CAP_SIGNALLING_CID) 228 { 229 process_l2cap_cmd (p_lcb, p, l2cap_len); 230 GKI_freebuf (p_msg); 231 } 232 else if (rcv_cid == L2CAP_CONNECTIONLESS_CID) 233 { 234 /* process_connectionless_data (p_lcb); */ 235 STREAM_TO_UINT16 (psm, p); 236 L2CAP_TRACE_DEBUG( "GOT CONNECTIONLESS DATA PSM:%d", psm ) ; 237 #if (TCS_BCST_SETUP_INCLUDED == TRUE && TCS_INCLUDED == TRUE) 238 if (psm == TCS_PSM_INTERCOM || psm == TCS_PSM_CORDLESS) 239 { 240 p_msg->offset += L2CAP_BCST_OVERHEAD; 241 p_msg->len -= L2CAP_BCST_OVERHEAD; 242 tcs_proc_bcst_msg( p_lcb->remote_bd_addr, p_msg ) ; 243 GKI_freebuf (p_msg); 244 } 245 else 246 #endif 247 248 #if (L2CAP_UCD_INCLUDED == TRUE) 249 /* if it is not broadcast, check UCD registration */ 250 if ( l2c_ucd_check_rx_pkts( p_lcb, p_msg ) ) 251 { 252 /* nothing to do */ 253 } 254 else 255 #endif 256 GKI_freebuf (p_msg); 257 } 258 #if (BLE_INCLUDED == TRUE) 259 else if (rcv_cid == L2CAP_BLE_SIGNALLING_CID) 260 { 261 l2cble_process_sig_cmd (p_lcb, p, l2cap_len); 262 GKI_freebuf (p_msg); 263 } 264 #endif 265 #if (L2CAP_NUM_FIXED_CHNLS > 0) 266 else if ((rcv_cid >= L2CAP_FIRST_FIXED_CHNL) && (rcv_cid <= L2CAP_LAST_FIXED_CHNL) && 267 (l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb != NULL) ) 268 { 269 /* If no CCB for this channel, allocate one */ 270 if (p_lcb && l2cu_initialize_fixed_ccb (p_lcb, rcv_cid, 271 &l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].fixed_chnl_opts)) 272 { 273 #if(defined BLE_INCLUDED && (BLE_INCLUDED == TRUE)) 274 l2cble_notify_le_connection(p_lcb->remote_bd_addr); 275 #endif 276 p_ccb = p_lcb->p_fixed_ccbs[rcv_cid - L2CAP_FIRST_FIXED_CHNL]; 277 278 if (p_ccb->peer_cfg.fcr.mode != L2CAP_FCR_BASIC_MODE) 279 l2c_fcr_proc_pdu (p_ccb, p_msg); 280 else 281 (*l2cb.fixed_reg[rcv_cid - L2CAP_FIRST_FIXED_CHNL].pL2CA_FixedData_Cb)(p_lcb->remote_bd_addr, p_msg); 282 } 283 else 284 GKI_freebuf (p_msg); 285 } 286 #endif 287 288 else 289 { 290 if (p_ccb == NULL) 291 GKI_freebuf (p_msg); 292 else 293 { 294 /* Basic mode packets go straight to the state machine */ 295 if (p_ccb->peer_cfg.fcr.mode == L2CAP_FCR_BASIC_MODE) 296 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_msg); 297 else 298 { 299 /* eRTM or streaming mode, so we need to validate states first */ 300 if ((p_ccb->chnl_state == CST_OPEN) || (p_ccb->chnl_state == CST_CONFIG)) 301 l2c_fcr_proc_pdu (p_ccb, p_msg); 302 else 303 GKI_freebuf (p_msg); 304 } 305 } 306 } 307 } 308 309 /******************************************************************************* 310 ** 311 ** Function process_l2cap_cmd 312 ** 313 ** Description This function is called when a packet is received on the 314 ** L2CAP signalling CID 315 ** 316 ** Returns void 317 ** 318 *******************************************************************************/ 319 static void process_l2cap_cmd (tL2C_LCB *p_lcb, UINT8 *p, UINT16 pkt_len) 320 { 321 UINT8 *p_pkt_end, *p_next_cmd, *p_cfg_end, *p_cfg_start; 322 UINT8 cmd_code, cfg_code, cfg_len, id; 323 tL2C_CONN_INFO con_info; 324 tL2CAP_CFG_INFO cfg_info; 325 UINT16 rej_reason, rej_mtu, lcid, rcid, info_type; 326 tL2C_CCB *p_ccb; 327 tL2C_RCB *p_rcb, *p_rcb2; 328 BOOLEAN cfg_rej, pkt_size_rej = FALSE; 329 UINT16 cfg_rej_len, cmd_len; 330 UINT16 result; 331 tL2C_CONN_INFO ci; 332 333 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE) 334 /* if l2cap command received in CID 1 on top of an LE link, ignore this command */ 335 if (p_lcb->transport == BT_TRANSPORT_LE) 336 return; 337 #endif 338 339 /* Reject the packet if it exceeds the default Signalling Channel MTU */ 340 if (pkt_len > L2CAP_DEFAULT_MTU) 341 { 342 /* Core Spec requires a single response to the first command found in a multi-command 343 ** L2cap packet. If only responses in the packet, then it will be ignored. 344 ** Here we simply mark the bad packet and decide which cmd ID to reject later 345 */ 346 pkt_size_rej = TRUE; 347 L2CAP_TRACE_ERROR ("L2CAP SIG MTU Pkt Len Exceeded (672) -> pkt_len: %d", pkt_len); 348 } 349 350 p_next_cmd = p; 351 p_pkt_end = p + pkt_len; 352 353 memset (&cfg_info, 0, sizeof(cfg_info)); 354 355 /* An L2CAP packet may contain multiple commands */ 356 while (TRUE) 357 { 358 /* Smallest command is 4 bytes */ 359 if ((p = p_next_cmd) > (p_pkt_end - 4)) 360 break; 361 362 STREAM_TO_UINT8 (cmd_code, p); 363 STREAM_TO_UINT8 (id, p); 364 STREAM_TO_UINT16 (cmd_len, p); 365 366 /* Check command length does not exceed packet length */ 367 if ((p_next_cmd = p + cmd_len) > p_pkt_end) 368 { 369 L2CAP_TRACE_WARNING ("Command len bad pkt_len: %d cmd_len: %d code: %d", 370 pkt_len, cmd_len, cmd_code); 371 break; 372 } 373 374 L2CAP_TRACE_DEBUG ("cmd_code: %d, id:%d, cmd_len:%d", cmd_code, id, cmd_len); 375 376 /* Bad L2CAP packet length, look or cmd to reject */ 377 if (pkt_size_rej) 378 { 379 /* If command found rejected it and we're done, otherwise keep looking */ 380 if (l2c_is_cmd_rejected(cmd_code, id, p_lcb)) 381 return; 382 else 383 continue; /* Look for next cmd/response in current packet */ 384 } 385 386 switch (cmd_code) 387 { 388 case L2CAP_CMD_REJECT: 389 STREAM_TO_UINT16 (rej_reason, p); 390 if (rej_reason == L2CAP_CMD_REJ_MTU_EXCEEDED) 391 { 392 STREAM_TO_UINT16 (rej_mtu, p); 393 /* What to do with the MTU reject ? We have negotiated an MTU. For now */ 394 /* we will ignore it and let a higher protocol timeout take care of it */ 395 396 L2CAP_TRACE_WARNING ("L2CAP - MTU rej Handle: %d MTU: %d", p_lcb->handle, rej_mtu); 397 } 398 if (rej_reason == L2CAP_CMD_REJ_INVALID_CID) 399 { 400 STREAM_TO_UINT16 (rcid, p); 401 STREAM_TO_UINT16 (lcid, p); 402 403 L2CAP_TRACE_WARNING ("L2CAP - rej with CID invalid, LCID: 0x%04x RCID: 0x%04x", lcid, rcid); 404 405 /* Remote CID invalid. Treat as a disconnect */ 406 if (((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) 407 && (p_ccb->remote_cid == rcid)) 408 { 409 /* Fake link disconnect - no reply is generated */ 410 l2c_csm_execute (p_ccb, L2CEVT_LP_DISCONNECT_IND, NULL); 411 } 412 } 413 414 /* SonyEricsson Info request Bug workaround (Continue connection) */ 415 else if (rej_reason == L2CAP_CMD_REJ_NOT_UNDERSTOOD && p_lcb->w4_info_rsp) 416 { 417 btu_stop_timer (&p_lcb->info_timer_entry); 418 419 p_lcb->w4_info_rsp = FALSE; 420 ci.status = HCI_SUCCESS; 421 memcpy (ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR)); 422 423 /* For all channels, send the event through their FSMs */ 424 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) 425 { 426 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci); 427 } 428 } 429 break; 430 431 case L2CAP_CMD_CONN_REQ: 432 STREAM_TO_UINT16 (con_info.psm, p); 433 STREAM_TO_UINT16 (rcid, p); 434 if ((p_rcb = l2cu_find_rcb_by_psm (con_info.psm)) == NULL) 435 { 436 L2CAP_TRACE_WARNING ("L2CAP - rcvd conn req for unknown PSM: %d", con_info.psm); 437 l2cu_reject_connection (p_lcb, rcid, id, L2CAP_CONN_NO_PSM); 438 break; 439 } 440 else 441 { 442 if (!p_rcb->api.pL2CA_ConnectInd_Cb) 443 { 444 L2CAP_TRACE_WARNING ("L2CAP - rcvd conn req for outgoing-only connection PSM: %d", con_info.psm); 445 l2cu_reject_connection (p_lcb, rcid, id, L2CAP_CONN_NO_PSM); 446 break; 447 } 448 } 449 if ((p_ccb = l2cu_allocate_ccb (p_lcb, 0)) == NULL) 450 { 451 L2CAP_TRACE_ERROR ("L2CAP - unable to allocate CCB"); 452 l2cu_reject_connection (p_lcb, rcid, id, L2CAP_CONN_NO_RESOURCES); 453 break; 454 } 455 p_ccb->remote_id = id; 456 p_ccb->p_rcb = p_rcb; 457 p_ccb->remote_cid = rcid; 458 459 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_REQ, &con_info); 460 break; 461 462 case L2CAP_CMD_CONN_RSP: 463 STREAM_TO_UINT16 (con_info.remote_cid, p); 464 STREAM_TO_UINT16 (lcid, p); 465 STREAM_TO_UINT16 (con_info.l2cap_result, p); 466 STREAM_TO_UINT16 (con_info.l2cap_status, p); 467 468 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) == NULL) 469 { 470 L2CAP_TRACE_WARNING ("L2CAP - no CCB for conn rsp, LCID: %d RCID: %d", 471 lcid, con_info.remote_cid); 472 break; 473 } 474 if (p_ccb->local_id != id) 475 { 476 L2CAP_TRACE_WARNING ("L2CAP - con rsp - bad ID. Exp: %d Got: %d", 477 p_ccb->local_id, id); 478 break; 479 } 480 481 if (con_info.l2cap_result == L2CAP_CONN_OK) 482 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP, &con_info); 483 else if (con_info.l2cap_result == L2CAP_CONN_PENDING) 484 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_PND, &con_info); 485 else 486 l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_NEG, &con_info); 487 488 break; 489 490 case L2CAP_CMD_CONFIG_REQ: 491 p_cfg_end = p + cmd_len; 492 cfg_rej = FALSE; 493 cfg_rej_len = 0; 494 495 STREAM_TO_UINT16 (lcid, p); 496 STREAM_TO_UINT16 (cfg_info.flags, p); 497 498 p_cfg_start = p; 499 500 cfg_info.flush_to_present = cfg_info.mtu_present = cfg_info.qos_present = 501 cfg_info.fcr_present = cfg_info.fcs_present = FALSE; 502 503 while (p < p_cfg_end) 504 { 505 STREAM_TO_UINT8 (cfg_code, p); 506 STREAM_TO_UINT8 (cfg_len, p); 507 508 switch (cfg_code & 0x7F) 509 { 510 case L2CAP_CFG_TYPE_MTU: 511 cfg_info.mtu_present = TRUE; 512 STREAM_TO_UINT16 (cfg_info.mtu, p); 513 break; 514 515 case L2CAP_CFG_TYPE_FLUSH_TOUT: 516 cfg_info.flush_to_present = TRUE; 517 STREAM_TO_UINT16 (cfg_info.flush_to, p); 518 break; 519 520 case L2CAP_CFG_TYPE_QOS: 521 cfg_info.qos_present = TRUE; 522 STREAM_TO_UINT8 (cfg_info.qos.qos_flags, p); 523 STREAM_TO_UINT8 (cfg_info.qos.service_type, p); 524 STREAM_TO_UINT32 (cfg_info.qos.token_rate, p); 525 STREAM_TO_UINT32 (cfg_info.qos.token_bucket_size, p); 526 STREAM_TO_UINT32 (cfg_info.qos.peak_bandwidth, p); 527 STREAM_TO_UINT32 (cfg_info.qos.latency, p); 528 STREAM_TO_UINT32 (cfg_info.qos.delay_variation, p); 529 break; 530 531 case L2CAP_CFG_TYPE_FCR: 532 cfg_info.fcr_present = TRUE; 533 STREAM_TO_UINT8 (cfg_info.fcr.mode, p); 534 STREAM_TO_UINT8 (cfg_info.fcr.tx_win_sz, p); 535 STREAM_TO_UINT8 (cfg_info.fcr.max_transmit, p); 536 STREAM_TO_UINT16 (cfg_info.fcr.rtrans_tout, p); 537 STREAM_TO_UINT16 (cfg_info.fcr.mon_tout, p); 538 STREAM_TO_UINT16 (cfg_info.fcr.mps, p); 539 break; 540 541 case L2CAP_CFG_TYPE_FCS: 542 cfg_info.fcs_present = TRUE; 543 STREAM_TO_UINT8 (cfg_info.fcs, p); 544 break; 545 546 case L2CAP_CFG_TYPE_EXT_FLOW: 547 cfg_info.ext_flow_spec_present = TRUE; 548 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.id, p); 549 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.stype, p); 550 STREAM_TO_UINT16 (cfg_info.ext_flow_spec.max_sdu_size, p); 551 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.sdu_inter_time, p); 552 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.access_latency, p); 553 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.flush_timeout, p); 554 break; 555 556 default: 557 /* sanity check option length */ 558 if ((cfg_len + L2CAP_CFG_OPTION_OVERHEAD) <= cmd_len) 559 { 560 p += cfg_len; 561 if ((cfg_code & 0x80) == 0) 562 { 563 cfg_rej_len += cfg_len + L2CAP_CFG_OPTION_OVERHEAD; 564 cfg_rej = TRUE; 565 } 566 } 567 /* bad length; force loop exit */ 568 else 569 { 570 p = p_cfg_end; 571 cfg_rej = TRUE; 572 } 573 break; 574 } 575 } 576 577 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) 578 { 579 p_ccb->remote_id = id; 580 if (cfg_rej) 581 { 582 l2cu_send_peer_config_rej (p_ccb, p_cfg_start, (UINT16) (cmd_len - L2CAP_CONFIG_REQ_LEN), cfg_rej_len); 583 } 584 else 585 { 586 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_CONFIG_REQ, &cfg_info); 587 } 588 } 589 else 590 { 591 /* updated spec says send command reject on invalid cid */ 592 l2cu_send_peer_cmd_reject (p_lcb, L2CAP_CMD_REJ_INVALID_CID, id, 0, 0); 593 } 594 break; 595 596 case L2CAP_CMD_CONFIG_RSP: 597 p_cfg_end = p + cmd_len; 598 STREAM_TO_UINT16 (lcid, p); 599 STREAM_TO_UINT16 (cfg_info.flags, p); 600 STREAM_TO_UINT16 (cfg_info.result, p); 601 602 cfg_info.flush_to_present = cfg_info.mtu_present = cfg_info.qos_present = 603 cfg_info.fcr_present = cfg_info.fcs_present = FALSE; 604 605 while (p < p_cfg_end) 606 { 607 STREAM_TO_UINT8 (cfg_code, p); 608 STREAM_TO_UINT8 (cfg_len, p); 609 610 switch (cfg_code & 0x7F) 611 { 612 case L2CAP_CFG_TYPE_MTU: 613 cfg_info.mtu_present = TRUE; 614 STREAM_TO_UINT16 (cfg_info.mtu, p); 615 break; 616 617 case L2CAP_CFG_TYPE_FLUSH_TOUT: 618 cfg_info.flush_to_present = TRUE; 619 STREAM_TO_UINT16 (cfg_info.flush_to, p); 620 break; 621 622 case L2CAP_CFG_TYPE_QOS: 623 cfg_info.qos_present = TRUE; 624 STREAM_TO_UINT8 (cfg_info.qos.qos_flags, p); 625 STREAM_TO_UINT8 (cfg_info.qos.service_type, p); 626 STREAM_TO_UINT32 (cfg_info.qos.token_rate, p); 627 STREAM_TO_UINT32 (cfg_info.qos.token_bucket_size, p); 628 STREAM_TO_UINT32 (cfg_info.qos.peak_bandwidth, p); 629 STREAM_TO_UINT32 (cfg_info.qos.latency, p); 630 STREAM_TO_UINT32 (cfg_info.qos.delay_variation, p); 631 break; 632 633 case L2CAP_CFG_TYPE_FCR: 634 cfg_info.fcr_present = TRUE; 635 STREAM_TO_UINT8 (cfg_info.fcr.mode, p); 636 STREAM_TO_UINT8 (cfg_info.fcr.tx_win_sz, p); 637 STREAM_TO_UINT8 (cfg_info.fcr.max_transmit, p); 638 STREAM_TO_UINT16 (cfg_info.fcr.rtrans_tout, p); 639 STREAM_TO_UINT16 (cfg_info.fcr.mon_tout, p); 640 STREAM_TO_UINT16 (cfg_info.fcr.mps, p); 641 break; 642 643 case L2CAP_CFG_TYPE_FCS: 644 cfg_info.fcs_present = TRUE; 645 STREAM_TO_UINT8 (cfg_info.fcs, p); 646 break; 647 648 case L2CAP_CFG_TYPE_EXT_FLOW: 649 cfg_info.ext_flow_spec_present = TRUE; 650 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.id, p); 651 STREAM_TO_UINT8 (cfg_info.ext_flow_spec.stype, p); 652 STREAM_TO_UINT16 (cfg_info.ext_flow_spec.max_sdu_size, p); 653 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.sdu_inter_time, p); 654 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.access_latency, p); 655 STREAM_TO_UINT32 (cfg_info.ext_flow_spec.flush_timeout, p); 656 break; 657 } 658 } 659 660 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) 661 { 662 if (p_ccb->local_id != id) 663 { 664 L2CAP_TRACE_WARNING ("L2CAP - cfg rsp - bad ID. Exp: %d Got: %d", 665 p_ccb->local_id, id); 666 break; 667 } 668 if ( (cfg_info.result == L2CAP_CFG_OK) || (cfg_info.result == L2CAP_CFG_PENDING) ) 669 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_CONFIG_RSP, &cfg_info); 670 else 671 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_CONFIG_RSP_NEG, &cfg_info); 672 } 673 else 674 { 675 L2CAP_TRACE_WARNING ("L2CAP - rcvd cfg rsp for unknown CID: 0x%04x", lcid); 676 } 677 break; 678 679 680 case L2CAP_CMD_DISC_REQ: 681 STREAM_TO_UINT16 (lcid, p); 682 STREAM_TO_UINT16 (rcid, p); 683 684 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) 685 { 686 if (p_ccb->remote_cid == rcid) 687 { 688 p_ccb->remote_id = id; 689 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DISCONNECT_REQ, &con_info); 690 } 691 } 692 else 693 l2cu_send_peer_disc_rsp (p_lcb, id, lcid, rcid); 694 695 break; 696 697 case L2CAP_CMD_DISC_RSP: 698 STREAM_TO_UINT16 (rcid, p); 699 STREAM_TO_UINT16 (lcid, p); 700 701 if ((p_ccb = l2cu_find_ccb_by_cid (p_lcb, lcid)) != NULL) 702 { 703 if ((p_ccb->remote_cid == rcid) && (p_ccb->local_id == id)) 704 { 705 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DISCONNECT_RSP, &con_info); 706 } 707 } 708 break; 709 710 case L2CAP_CMD_ECHO_REQ: 711 l2cu_send_peer_echo_rsp (p_lcb, id, NULL, 0); 712 break; 713 714 case L2CAP_CMD_ECHO_RSP: 715 if (p_lcb->p_echo_rsp_cb) 716 { 717 tL2CA_ECHO_RSP_CB *p_cb = p_lcb->p_echo_rsp_cb; 718 719 /* Zero out the callback in case app immediately calls us again */ 720 p_lcb->p_echo_rsp_cb = NULL; 721 722 (*p_cb) (L2CAP_PING_RESULT_OK); 723 } 724 break; 725 726 case L2CAP_CMD_INFO_REQ: 727 STREAM_TO_UINT16 (info_type, p); 728 l2cu_send_peer_info_rsp (p_lcb, id, info_type); 729 break; 730 731 case L2CAP_CMD_INFO_RSP: 732 /* Stop the link connect timer if sent before L2CAP connection is up */ 733 if (p_lcb->w4_info_rsp) 734 { 735 btu_stop_timer (&p_lcb->info_timer_entry); 736 p_lcb->w4_info_rsp = FALSE; 737 } 738 739 STREAM_TO_UINT16 (info_type, p); 740 STREAM_TO_UINT16 (result, p); 741 742 p_lcb->info_rx_bits |= (1 << info_type); 743 744 if ( (info_type == L2CAP_EXTENDED_FEATURES_INFO_TYPE) 745 && (result == L2CAP_INFO_RESP_RESULT_SUCCESS) ) 746 { 747 STREAM_TO_UINT32( p_lcb->peer_ext_fea, p ); 748 749 #if (L2CAP_NUM_FIXED_CHNLS > 0) 750 if (p_lcb->peer_ext_fea & L2CAP_EXTFEA_FIXED_CHNLS) 751 { 752 l2cu_send_peer_info_req (p_lcb, L2CAP_FIXED_CHANNELS_INFO_TYPE); 753 break; 754 } 755 else 756 { 757 l2cu_process_fixed_chnl_resp (p_lcb); 758 } 759 #endif 760 } 761 762 763 #if (L2CAP_NUM_FIXED_CHNLS > 0) 764 if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) 765 { 766 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) 767 { 768 memcpy (p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE); 769 } 770 771 l2cu_process_fixed_chnl_resp (p_lcb); 772 } 773 #endif 774 #if (L2CAP_UCD_INCLUDED == TRUE) 775 else if (info_type == L2CAP_CONNLESS_MTU_INFO_TYPE) 776 { 777 if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) 778 { 779 STREAM_TO_UINT16 (p_lcb->ucd_mtu, p); 780 } 781 } 782 #endif 783 784 ci.status = HCI_SUCCESS; 785 memcpy (ci.bd_addr, p_lcb->remote_bd_addr, sizeof(BD_ADDR)); 786 for (p_ccb = p_lcb->ccb_queue.p_first_ccb; p_ccb; p_ccb = p_ccb->p_next_ccb) 787 { 788 l2c_csm_execute (p_ccb, L2CEVT_L2CAP_INFO_RSP, &ci); 789 } 790 break; 791 792 default: 793 L2CAP_TRACE_WARNING ("L2CAP - bad cmd code: %d", cmd_code); 794 l2cu_send_peer_cmd_reject (p_lcb, L2CAP_CMD_REJ_NOT_UNDERSTOOD, id, 0, 0); 795 return; 796 } 797 } 798 } 799 800 /******************************************************************************* 801 ** 802 ** Function l2c_process_held_packets 803 ** 804 ** Description This function processes any L2CAP packets that arrived before 805 ** the HCI connection complete arrived. It is a work around for 806 ** badly behaved controllers. 807 ** 808 ** Returns void 809 ** 810 *******************************************************************************/ 811 void l2c_process_held_packets (BOOLEAN timed_out) 812 { 813 BT_HDR *p_buf, *p_buf1; 814 BUFFER_Q *p_rcv_hold_q = &l2cb.rcv_hold_q; 815 816 if (!p_rcv_hold_q->count) 817 return; 818 819 if (!timed_out) 820 { 821 btu_stop_timer(&l2cb.rcv_hold_tle); 822 L2CAP_TRACE_WARNING("L2CAP HOLD CONTINUE"); 823 } 824 else 825 { 826 L2CAP_TRACE_WARNING("L2CAP HOLD TIMEOUT"); 827 } 828 829 /* Update the timeouts in the hold queue */ 830 for (p_buf = (BT_HDR *)GKI_getfirst (p_rcv_hold_q); p_buf; p_buf = p_buf1) 831 { 832 p_buf1 = (BT_HDR *)GKI_getnext (p_buf); 833 if (!timed_out || (!p_buf->layer_specific) || (--p_buf->layer_specific == 0)) 834 { 835 GKI_remove_from_queue (p_rcv_hold_q, p_buf); 836 p_buf->layer_specific = 0xFFFF; 837 l2c_rcv_acl_data (p_buf); 838 } 839 } 840 841 /* If anyone still in the queue, restart the timeout */ 842 if (p_rcv_hold_q->count) 843 btu_start_timer (&l2cb.rcv_hold_tle, BTU_TTYPE_L2CAP_HOLD, BT_1SEC_TIMEOUT); 844 } 845 846 847 /******************************************************************************* 848 ** 849 ** Function l2c_init 850 ** 851 ** Description This function is called once at startup to initialize 852 ** all the L2CAP structures 853 ** 854 ** Returns void 855 ** 856 *******************************************************************************/ 857 void l2c_init (void) 858 { 859 INT16 xx; 860 861 memset (&l2cb, 0, sizeof (tL2C_CB)); 862 /* the psm is increased by 2 before being used */ 863 l2cb.dyn_psm = 0xFFF; 864 865 /* Put all the channel control blocks on the free queue */ 866 for (xx = 0; xx < MAX_L2CAP_CHANNELS - 1; xx++) 867 { 868 l2cb.ccb_pool[xx].p_next_ccb = &l2cb.ccb_pool[xx + 1]; 869 } 870 871 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE) 872 /* it will be set to L2CAP_PKT_START_NON_FLUSHABLE if controller supports */ 873 l2cb.non_flushable_pbf = L2CAP_PKT_START << L2CAP_PKT_TYPE_SHIFT; 874 #endif 875 876 877 l2cb.p_free_ccb_first = &l2cb.ccb_pool[0]; 878 l2cb.p_free_ccb_last = &l2cb.ccb_pool[MAX_L2CAP_CHANNELS - 1]; 879 880 #ifdef L2CAP_DESIRED_LINK_ROLE 881 l2cb.desire_role = L2CAP_DESIRED_LINK_ROLE; 882 #else 883 l2cb.desire_role = HCI_ROLE_SLAVE; 884 #endif 885 886 /* Set the default idle timeout */ 887 l2cb.idle_timeout = L2CAP_LINK_INACTIVITY_TOUT; 888 889 #if defined(L2CAP_INITIAL_TRACE_LEVEL) 890 l2cb.l2cap_trace_level = L2CAP_INITIAL_TRACE_LEVEL; 891 #else 892 l2cb.l2cap_trace_level = BT_TRACE_LEVEL_NONE; /* No traces */ 893 #endif 894 895 #if L2CAP_CONFORMANCE_TESTING == TRUE 896 /* Conformance testing needs a dynamic response */ 897 l2cb.test_info_resp = L2CAP_EXTFEA_SUPPORTED_MASK; 898 #endif 899 900 /* Number of ACL buffers to use for high priority channel */ 901 #if (defined(L2CAP_HIGH_PRI_CHAN_QUOTA_IS_CONFIGURABLE) && (L2CAP_HIGH_PRI_CHAN_QUOTA_IS_CONFIGURABLE == TRUE)) 902 l2cb.high_pri_min_xmit_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA; 903 #endif 904 905 } 906 907 /******************************************************************************* 908 ** 909 ** Function l2c_process_timeout 910 ** 911 ** Description This function is called when an L2CAP-related timeout occurs 912 ** 913 ** Returns void 914 ** 915 *******************************************************************************/ 916 void l2c_process_timeout (TIMER_LIST_ENT *p_tle) 917 { 918 /* What type of timeout ? */ 919 switch (p_tle->event) 920 { 921 case BTU_TTYPE_L2CAP_LINK: 922 l2c_link_timeout ((tL2C_LCB *)p_tle->param); 923 break; 924 925 case BTU_TTYPE_L2CAP_CHNL: 926 l2c_csm_execute (((tL2C_CCB *)p_tle->param), L2CEVT_TIMEOUT, NULL); 927 break; 928 929 case BTU_TTYPE_L2CAP_FCR_ACK: 930 l2c_csm_execute (((tL2C_CCB *)p_tle->param), L2CEVT_ACK_TIMEOUT, NULL); 931 break; 932 933 case BTU_TTYPE_L2CAP_HOLD: 934 /* Update the timeouts in the hold queue */ 935 l2c_process_held_packets(TRUE); 936 break; 937 938 case BTU_TTYPE_L2CAP_INFO: 939 l2c_info_timeout((tL2C_LCB *)p_tle->param); 940 break; 941 } 942 } 943 944 /******************************************************************************* 945 ** 946 ** Function l2c_data_write 947 ** 948 ** Description API functions call this function to write data. 949 ** 950 ** Returns L2CAP_DW_SUCCESS, if data accepted, else FALSE 951 ** L2CAP_DW_CONGESTED, if data accepted and the channel is congested 952 ** L2CAP_DW_FAILED, if error 953 ** 954 *******************************************************************************/ 955 UINT8 l2c_data_write (UINT16 cid, BT_HDR *p_data, UINT16 flags) 956 { 957 tL2C_CCB *p_ccb; 958 959 /* Find the channel control block. We don't know the link it is on. */ 960 if ((p_ccb = l2cu_find_ccb_by_cid (NULL, cid)) == NULL) 961 { 962 L2CAP_TRACE_WARNING ("L2CAP - no CCB for L2CA_DataWrite, CID: %d", cid); 963 GKI_freebuf (p_data); 964 return (L2CAP_DW_FAILED); 965 } 966 967 #ifndef TESTER /* Tester may send any amount of data. otherwise sending message 968 bigger than mtu size of peer is a violation of protocol */ 969 if (p_data->len > p_ccb->peer_cfg.mtu) 970 { 971 L2CAP_TRACE_WARNING ("L2CAP - CID: 0x%04x cannot send message bigger than peer's mtu size", cid); 972 GKI_freebuf (p_data); 973 return (L2CAP_DW_FAILED); 974 } 975 #endif 976 977 /* channel based, packet based flushable or non-flushable */ 978 p_data->layer_specific = flags; 979 980 /* If already congested, do not accept any more packets */ 981 if (p_ccb->cong_sent) 982 { 983 L2CAP_TRACE_ERROR ("L2CAP - CID: 0x%04x cannot send, already congested xmit_hold_q.count: %u buff_quota: %u", 984 p_ccb->local_cid, p_ccb->xmit_hold_q.count, p_ccb->buff_quota); 985 986 GKI_freebuf (p_data); 987 return (L2CAP_DW_FAILED); 988 } 989 990 l2c_csm_execute (p_ccb, L2CEVT_L2CA_DATA_WRITE, p_data); 991 992 if (p_ccb->cong_sent) 993 return (L2CAP_DW_CONGESTED); 994 995 return (L2CAP_DW_SUCCESS); 996 } 997 998
