l2cap_signal.c revision 1.14
1 /* $NetBSD: l2cap_signal.c,v 1.14 2011/07/27 10:25:09 plunky Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: l2cap_signal.c,v 1.14 2011/07/27 10:25:09 plunky Exp $"); 35 36 #include <sys/param.h> 37 #include <sys/kernel.h> 38 #include <sys/mbuf.h> 39 #include <sys/proc.h> 40 #include <sys/queue.h> 41 #include <sys/systm.h> 42 43 #include <netbt/bluetooth.h> 44 #include <netbt/hci.h> 45 #include <netbt/l2cap.h> 46 47 /******************************************************************************* 48 * 49 * L2CAP Signal processing 50 */ 51 52 static void l2cap_recv_command_rej(struct mbuf *, struct hci_link *); 53 static void l2cap_recv_connect_req(struct mbuf *, struct hci_link *); 54 static void l2cap_recv_connect_rsp(struct mbuf *, struct hci_link *); 55 static void l2cap_recv_config_req(struct mbuf *, struct hci_link *); 56 static void l2cap_recv_config_rsp(struct mbuf *, struct hci_link *); 57 static void l2cap_recv_disconnect_req(struct mbuf *, struct hci_link *); 58 static void l2cap_recv_disconnect_rsp(struct mbuf *, struct hci_link *); 59 static void l2cap_recv_info_req(struct mbuf *, struct hci_link *); 60 static int l2cap_send_signal(struct hci_link *, uint8_t, uint8_t, uint16_t, void *); 61 static int l2cap_send_command_rej(struct hci_link *, uint8_t, uint16_t, ...); 62 63 /* 64 * process incoming signal packets (CID 0x0001). Can contain multiple 65 * requests/responses. 66 */ 67 void 68 l2cap_recv_signal(struct mbuf *m, struct hci_link *link) 69 { 70 l2cap_cmd_hdr_t cmd; 71 72 for(;;) { 73 if (m->m_pkthdr.len == 0) 74 goto finish; 75 76 if (m->m_pkthdr.len < sizeof(cmd)) 77 goto reject; 78 79 m_copydata(m, 0, sizeof(cmd), &cmd); 80 cmd.length = le16toh(cmd.length); 81 82 if (m->m_pkthdr.len < sizeof(cmd) + cmd.length) 83 goto reject; 84 85 DPRINTFN(2, "(%s) code %d, ident %d, len %d\n", 86 device_xname(link->hl_unit->hci_dev), 87 cmd.code, cmd.ident, cmd.length); 88 89 switch (cmd.code) { 90 case L2CAP_COMMAND_REJ: 91 if (cmd.length > sizeof(l2cap_cmd_rej_cp)) 92 goto finish; 93 94 l2cap_recv_command_rej(m, link); 95 break; 96 97 case L2CAP_CONNECT_REQ: 98 if (cmd.length != sizeof(l2cap_con_req_cp)) 99 goto reject; 100 101 l2cap_recv_connect_req(m, link); 102 break; 103 104 case L2CAP_CONNECT_RSP: 105 if (cmd.length != sizeof(l2cap_con_rsp_cp)) 106 goto finish; 107 108 l2cap_recv_connect_rsp(m, link); 109 break; 110 111 case L2CAP_CONFIG_REQ: 112 l2cap_recv_config_req(m, link); 113 break; 114 115 case L2CAP_CONFIG_RSP: 116 l2cap_recv_config_rsp(m, link); 117 break; 118 119 case L2CAP_DISCONNECT_REQ: 120 if (cmd.length != sizeof(l2cap_discon_req_cp)) 121 goto reject; 122 123 l2cap_recv_disconnect_req(m, link); 124 break; 125 126 case L2CAP_DISCONNECT_RSP: 127 if (cmd.length != sizeof(l2cap_discon_rsp_cp)) 128 goto finish; 129 130 l2cap_recv_disconnect_rsp(m, link); 131 break; 132 133 case L2CAP_ECHO_REQ: 134 m_adj(m, sizeof(cmd) + cmd.length); 135 l2cap_send_signal(link, L2CAP_ECHO_RSP, cmd.ident, 136 0, NULL); 137 break; 138 139 case L2CAP_ECHO_RSP: 140 m_adj(m, sizeof(cmd) + cmd.length); 141 break; 142 143 case L2CAP_INFO_REQ: 144 if (cmd.length != sizeof(l2cap_info_req_cp)) 145 goto reject; 146 147 l2cap_recv_info_req(m, link); 148 break; 149 150 case L2CAP_INFO_RSP: 151 m_adj(m, sizeof(cmd) + cmd.length); 152 break; 153 154 default: 155 goto reject; 156 } 157 } 158 panic("impossible!"); 159 160 reject: 161 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD); 162 finish: 163 m_freem(m); 164 } 165 166 /* 167 * Process Received Command Reject. For now we dont try to recover gracefully 168 * from this, it probably means that the link is garbled or the other end is 169 * insufficiently capable of handling normal traffic. (not *my* fault, no way!) 170 */ 171 static void 172 l2cap_recv_command_rej(struct mbuf *m, struct hci_link *link) 173 { 174 struct l2cap_req *req; 175 struct l2cap_channel *chan; 176 l2cap_cmd_hdr_t cmd; 177 l2cap_cmd_rej_cp cp; 178 179 m_copydata(m, 0, sizeof(cmd), &cmd); 180 m_adj(m, sizeof(cmd)); 181 182 cmd.length = le16toh(cmd.length); 183 184 m_copydata(m, 0, cmd.length, &cp); 185 m_adj(m, cmd.length); 186 187 req = l2cap_request_lookup(link, cmd.ident); 188 if (req == NULL) 189 return; 190 191 switch (le16toh(cp.reason)) { 192 case L2CAP_REJ_NOT_UNDERSTOOD: 193 /* 194 * I dont know what to do, just move up the timeout 195 */ 196 callout_schedule(&req->lr_rtx, 0); 197 break; 198 199 case L2CAP_REJ_MTU_EXCEEDED: 200 /* 201 * I didnt send any commands over L2CAP_MTU_MINIMUM size, but.. 202 * 203 * XXX maybe we should resend this, instead? 204 */ 205 link->hl_mtu = le16toh(cp.data[0]); 206 callout_schedule(&req->lr_rtx, 0); 207 break; 208 209 case L2CAP_REJ_INVALID_CID: 210 /* 211 * Well, if they dont have such a channel then our channel is 212 * most likely closed. Make it so. 213 */ 214 chan = req->lr_chan; 215 l2cap_request_free(req); 216 if (chan != NULL && chan->lc_state != L2CAP_CLOSED) 217 l2cap_close(chan, ECONNABORTED); 218 219 break; 220 221 default: 222 UNKNOWN(le16toh(cp.reason)); 223 break; 224 } 225 } 226 227 /* 228 * Process Received Connect Request. Find listening channel matching 229 * psm & addr and ask upper layer for a new channel. 230 */ 231 static void 232 l2cap_recv_connect_req(struct mbuf *m, struct hci_link *link) 233 { 234 struct sockaddr_bt laddr, raddr; 235 struct l2cap_channel *chan, *new; 236 l2cap_cmd_hdr_t cmd; 237 l2cap_con_req_cp cp; 238 int err; 239 240 /* extract cmd */ 241 m_copydata(m, 0, sizeof(cmd), &cmd); 242 m_adj(m, sizeof(cmd)); 243 244 /* extract request */ 245 m_copydata(m, 0, sizeof(cp), &cp); 246 m_adj(m, sizeof(cp)); 247 248 cp.scid = le16toh(cp.scid); 249 cp.psm = le16toh(cp.psm); 250 251 memset(&laddr, 0, sizeof(struct sockaddr_bt)); 252 laddr.bt_len = sizeof(struct sockaddr_bt); 253 laddr.bt_family = AF_BLUETOOTH; 254 laddr.bt_psm = cp.psm; 255 bdaddr_copy(&laddr.bt_bdaddr, &link->hl_unit->hci_bdaddr); 256 257 memset(&raddr, 0, sizeof(struct sockaddr_bt)); 258 raddr.bt_len = sizeof(struct sockaddr_bt); 259 raddr.bt_family = AF_BLUETOOTH; 260 raddr.bt_psm = cp.psm; 261 bdaddr_copy(&raddr.bt_bdaddr, &link->hl_bdaddr); 262 263 LIST_FOREACH(chan, &l2cap_listen_list, lc_ncid) { 264 if (chan->lc_laddr.bt_psm != laddr.bt_psm) 265 continue; 266 267 if (!bdaddr_same(&laddr.bt_bdaddr, &chan->lc_laddr.bt_bdaddr) 268 && bdaddr_any(&chan->lc_laddr.bt_bdaddr) == 0) 269 continue; 270 271 new= (*chan->lc_proto->newconn)(chan->lc_upper, &laddr, &raddr); 272 if (new == NULL) 273 continue; 274 275 err = l2cap_cid_alloc(new); 276 if (err) { 277 l2cap_send_connect_rsp(link, cmd.ident, 278 0, cp.scid, 279 L2CAP_NO_RESOURCES); 280 281 (*new->lc_proto->disconnected)(new->lc_upper, err); 282 return; 283 } 284 285 new->lc_link = hci_acl_open(link->hl_unit, &link->hl_bdaddr); 286 KASSERT(new->lc_link == link); 287 288 new->lc_rcid = cp.scid; 289 new->lc_ident = cmd.ident; 290 291 memcpy(&new->lc_laddr, &laddr, sizeof(struct sockaddr_bt)); 292 memcpy(&new->lc_raddr, &raddr, sizeof(struct sockaddr_bt)); 293 294 new->lc_mode = chan->lc_mode; 295 296 err = l2cap_setmode(new); 297 if (err == EINPROGRESS) { 298 new->lc_state = L2CAP_WAIT_SEND_CONNECT_RSP; 299 (*new->lc_proto->connecting)(new->lc_upper); 300 return; 301 } 302 if (err) { 303 new->lc_state = L2CAP_CLOSED; 304 hci_acl_close(link, err); 305 new->lc_link = NULL; 306 307 l2cap_send_connect_rsp(link, cmd.ident, 308 0, cp.scid, 309 L2CAP_NO_RESOURCES); 310 311 (*new->lc_proto->disconnected)(new->lc_upper, err); 312 return; 313 } 314 315 err = l2cap_send_connect_rsp(link, cmd.ident, 316 new->lc_lcid, new->lc_rcid, 317 L2CAP_SUCCESS); 318 if (err) { 319 l2cap_close(new, err); 320 return; 321 } 322 323 new->lc_state = L2CAP_WAIT_CONFIG; 324 new->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP); 325 err = l2cap_send_config_req(new); 326 if (err) 327 l2cap_close(new, err); 328 329 return; 330 } 331 332 l2cap_send_connect_rsp(link, cmd.ident, 333 0, cp.scid, 334 L2CAP_PSM_NOT_SUPPORTED); 335 } 336 337 /* 338 * Process Received Connect Response. 339 */ 340 static void 341 l2cap_recv_connect_rsp(struct mbuf *m, struct hci_link *link) 342 { 343 l2cap_cmd_hdr_t cmd; 344 l2cap_con_rsp_cp cp; 345 struct l2cap_req *req; 346 struct l2cap_channel *chan; 347 348 m_copydata(m, 0, sizeof(cmd), &cmd); 349 m_adj(m, sizeof(cmd)); 350 351 m_copydata(m, 0, sizeof(cp), &cp); 352 m_adj(m, sizeof(cp)); 353 354 cp.scid = le16toh(cp.scid); 355 cp.dcid = le16toh(cp.dcid); 356 cp.result = le16toh(cp.result); 357 358 req = l2cap_request_lookup(link, cmd.ident); 359 if (req == NULL || req->lr_code != L2CAP_CONNECT_REQ) 360 return; 361 362 chan = req->lr_chan; 363 if (chan != NULL && chan->lc_lcid != cp.scid) 364 return; 365 366 if (chan == NULL || chan->lc_state != L2CAP_WAIT_RECV_CONNECT_RSP) { 367 l2cap_request_free(req); 368 return; 369 } 370 371 switch (cp.result) { 372 case L2CAP_SUCCESS: 373 /* 374 * Ok, at this point we have a connection to the other party. We 375 * could indicate upstream that we are ready for business and 376 * wait for a "Configure Channel Request" but I'm not so sure 377 * that is required in our case - we will proceed directly to 378 * sending our config request. We set two state bits because in 379 * the config state we are waiting for requests and responses. 380 */ 381 l2cap_request_free(req); 382 chan->lc_rcid = cp.dcid; 383 chan->lc_state = L2CAP_WAIT_CONFIG; 384 chan->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP); 385 l2cap_send_config_req(chan); 386 break; 387 388 case L2CAP_PENDING: 389 /* XXX dont release request, should start eRTX timeout? */ 390 (*chan->lc_proto->connecting)(chan->lc_upper); 391 break; 392 393 case L2CAP_PSM_NOT_SUPPORTED: 394 case L2CAP_SECURITY_BLOCK: 395 case L2CAP_NO_RESOURCES: 396 default: 397 l2cap_request_free(req); 398 l2cap_close(chan, ECONNREFUSED); 399 break; 400 } 401 } 402 403 /* 404 * Process Received Config Reqest. 405 */ 406 static void 407 l2cap_recv_config_req(struct mbuf *m, struct hci_link *link) 408 { 409 uint8_t buf[L2CAP_MTU_MINIMUM]; 410 l2cap_cmd_hdr_t cmd; 411 l2cap_cfg_req_cp cp; 412 l2cap_cfg_opt_t opt; 413 l2cap_cfg_opt_val_t val; 414 l2cap_cfg_rsp_cp rp; 415 struct l2cap_channel *chan; 416 int left, len; 417 418 m_copydata(m, 0, sizeof(cmd), &cmd); 419 m_adj(m, sizeof(cmd)); 420 left = le16toh(cmd.length); 421 422 if (left < sizeof(cp)) 423 goto reject; 424 425 m_copydata(m, 0, sizeof(cp), &cp); 426 m_adj(m, sizeof(cp)); 427 left -= sizeof(cp); 428 429 cp.dcid = le16toh(cp.dcid); 430 cp.flags = le16toh(cp.flags); 431 432 chan = l2cap_cid_lookup(cp.dcid); 433 if (chan == NULL || chan->lc_link != link 434 || chan->lc_state != L2CAP_WAIT_CONFIG 435 || (chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) { 436 /* XXX we should really accept reconfiguration requests */ 437 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID, 438 L2CAP_NULL_CID, cp.dcid); 439 goto out; 440 } 441 442 /* ready our response packet */ 443 rp.scid = htole16(chan->lc_rcid); 444 rp.flags = 0; /* "No Continuation" */ 445 rp.result = L2CAP_SUCCESS; 446 len = sizeof(rp); 447 448 /* 449 * Process the packet. We build the return packet on the fly adding any 450 * unacceptable parameters as we go. As we can only return one result, 451 * unknown option takes precedence so we start our return packet anew 452 * and ignore option values thereafter as they will be re-sent. 453 * 454 * Since we do not support enough options to make overflowing the min 455 * MTU size an issue in normal use, we just reject config requests that 456 * make that happen. This could be because options are repeated or the 457 * packet is corrupted in some way. 458 * 459 * If unknown option types threaten to overflow the packet, we just 460 * ignore them. We can deny them next time. 461 */ 462 while (left > 0) { 463 if (left < sizeof(opt)) 464 goto reject; 465 466 m_copydata(m, 0, sizeof(opt), &opt); 467 m_adj(m, sizeof(opt)); 468 left -= sizeof(opt); 469 470 if (left < opt.length) 471 goto reject; 472 473 switch(opt.type & L2CAP_OPT_HINT_MASK) { 474 case L2CAP_OPT_MTU: 475 if (rp.result == L2CAP_UNKNOWN_OPTION) 476 break; 477 478 if (opt.length != L2CAP_OPT_MTU_SIZE) 479 goto reject; 480 481 m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, &val); 482 val.mtu = le16toh(val.mtu); 483 484 /* 485 * XXX how do we know what the minimum acceptable MTU is 486 * for a channel? Spec says some profiles have a higher 487 * minimum but I have no way to find that out at this 488 * juncture.. 489 */ 490 if (val.mtu < L2CAP_MTU_MINIMUM) { 491 if (len + sizeof(opt) + L2CAP_OPT_MTU_SIZE > sizeof(buf)) 492 goto reject; 493 494 rp.result = L2CAP_UNACCEPTABLE_PARAMS; 495 memcpy(buf + len, &opt, sizeof(opt)); 496 len += sizeof(opt); 497 val.mtu = htole16(L2CAP_MTU_MINIMUM); 498 memcpy(buf + len, &val, L2CAP_OPT_MTU_SIZE); 499 len += L2CAP_OPT_MTU_SIZE; 500 } else 501 chan->lc_omtu = val.mtu; 502 503 break; 504 505 case L2CAP_OPT_FLUSH_TIMO: 506 if (rp.result == L2CAP_UNKNOWN_OPTION) 507 break; 508 509 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE) 510 goto reject; 511 512 /* 513 * I think that this is informational only - he is 514 * informing us of the flush timeout he will be using. 515 * I dont think this affects us in any significant way, 516 * so just ignore this value for now. 517 */ 518 break; 519 520 case L2CAP_OPT_QOS: 521 default: 522 /* ignore hints */ 523 if (opt.type & L2CAP_OPT_HINT_BIT) 524 break; 525 526 /* unknown options supercede all else */ 527 if (rp.result != L2CAP_UNKNOWN_OPTION) { 528 rp.result = L2CAP_UNKNOWN_OPTION; 529 len = sizeof(rp); 530 } 531 532 /* ignore if it don't fit */ 533 if (len + sizeof(opt) > sizeof(buf)) 534 break; 535 536 /* return unknown option type, but no data */ 537 buf[len++] = opt.type; 538 buf[len++] = 0; 539 break; 540 } 541 542 m_adj(m, opt.length); 543 left -= opt.length; 544 } 545 546 rp.result = htole16(rp.result); 547 memcpy(buf, &rp, sizeof(rp)); 548 l2cap_send_signal(link, L2CAP_CONFIG_RSP, cmd.ident, len, buf); 549 550 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0 551 && rp.result == le16toh(L2CAP_SUCCESS)) { 552 553 chan->lc_flags &= ~L2CAP_WAIT_CONFIG_REQ; 554 555 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) { 556 chan->lc_state = L2CAP_OPEN; 557 /* XXX how to distinguish REconfiguration? */ 558 (*chan->lc_proto->connected)(chan->lc_upper); 559 } 560 } 561 return; 562 563 reject: 564 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD); 565 out: 566 m_adj(m, left); 567 } 568 569 /* 570 * Process Received Config Response. 571 */ 572 static void 573 l2cap_recv_config_rsp(struct mbuf *m, struct hci_link *link) 574 { 575 l2cap_cmd_hdr_t cmd; 576 l2cap_cfg_rsp_cp cp; 577 l2cap_cfg_opt_t opt; 578 l2cap_cfg_opt_val_t val; 579 struct l2cap_req *req; 580 struct l2cap_channel *chan; 581 int left; 582 583 m_copydata(m, 0, sizeof(cmd), &cmd); 584 m_adj(m, sizeof(cmd)); 585 left = le16toh(cmd.length); 586 587 if (left < sizeof(cp)) 588 goto out; 589 590 m_copydata(m, 0, sizeof(cp), &cp); 591 m_adj(m, sizeof(cp)); 592 left -= sizeof(cp); 593 594 cp.scid = le16toh(cp.scid); 595 cp.flags = le16toh(cp.flags); 596 cp.result = le16toh(cp.result); 597 598 req = l2cap_request_lookup(link, cmd.ident); 599 if (req == NULL || req->lr_code != L2CAP_CONFIG_REQ) 600 goto out; 601 602 chan = req->lr_chan; 603 if (chan != NULL && chan->lc_lcid != cp.scid) 604 goto out; 605 606 l2cap_request_free(req); 607 608 if (chan == NULL || chan->lc_state != L2CAP_WAIT_CONFIG 609 || (chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) 610 goto out; 611 612 if ((cp.flags & L2CAP_OPT_CFLAG_BIT)) { 613 l2cap_cfg_req_cp rp; 614 615 /* 616 * They have more to tell us and want another ID to 617 * use, so send an empty config request 618 */ 619 if (l2cap_request_alloc(chan, L2CAP_CONFIG_REQ)) 620 goto discon; 621 622 rp.dcid = htole16(cp.scid); 623 rp.flags = 0; 624 625 if (l2cap_send_signal(link, L2CAP_CONFIG_REQ, link->hl_lastid, 626 sizeof(rp), &rp)) 627 goto discon; 628 } 629 630 switch(cp.result) { 631 case L2CAP_SUCCESS: 632 /* 633 * If continuation flag was not set, our config request was 634 * accepted. We may have to wait for their config request to 635 * complete, so check that but otherwise we are open 636 * 637 * There may be 'advisory' values in the packet but we just 638 * ignore those.. 639 */ 640 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) { 641 chan->lc_flags &= ~L2CAP_WAIT_CONFIG_RSP; 642 643 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) { 644 chan->lc_state = L2CAP_OPEN; 645 /* XXX how to distinguish REconfiguration? */ 646 (*chan->lc_proto->connected)(chan->lc_upper); 647 } 648 } 649 goto out; 650 651 case L2CAP_UNACCEPTABLE_PARAMS: 652 /* 653 * Packet contains unacceptable parameters with preferred values 654 */ 655 while (left > 0) { 656 if (left < sizeof(opt)) 657 goto discon; 658 659 m_copydata(m, 0, sizeof(opt), &opt); 660 m_adj(m, sizeof(opt)); 661 left -= sizeof(opt); 662 663 if (left < opt.length) 664 goto discon; 665 666 switch (opt.type) { 667 case L2CAP_OPT_MTU: 668 if (opt.length != L2CAP_OPT_MTU_SIZE) 669 goto discon; 670 671 m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, &val); 672 chan->lc_imtu = le16toh(val.mtu); 673 if (chan->lc_imtu < L2CAP_MTU_MINIMUM) 674 chan->lc_imtu = L2CAP_MTU_DEFAULT; 675 break; 676 677 case L2CAP_OPT_FLUSH_TIMO: 678 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE) 679 goto discon; 680 681 /* 682 * Spec says: If we cannot honor proposed value, 683 * either disconnect or try again with original 684 * value. I can't really see why they want to 685 * interfere with OUR flush timeout in any case 686 * so we just punt for now. 687 */ 688 goto discon; 689 690 case L2CAP_OPT_QOS: 691 break; 692 693 default: 694 UNKNOWN(opt.type); 695 goto discon; 696 } 697 698 m_adj(m, opt.length); 699 left -= opt.length; 700 } 701 702 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) 703 l2cap_send_config_req(chan); /* no state change */ 704 705 goto out; 706 707 case L2CAP_REJECT: 708 goto discon; 709 710 case L2CAP_UNKNOWN_OPTION: 711 /* 712 * Packet contains options not understood. Turn off unknown 713 * options by setting them to default values (means they will 714 * not be requested again). 715 * 716 * If our option was already off then fail (paranoia?) 717 * 718 * XXX Should we consider that options were set for a reason? 719 */ 720 while (left > 0) { 721 if (left < sizeof(opt)) 722 goto discon; 723 724 m_copydata(m, 0, sizeof(opt), &opt); 725 m_adj(m, sizeof(opt)); 726 left -= sizeof(opt); 727 728 if (left < opt.length) 729 goto discon; 730 731 m_adj(m, opt.length); 732 left -= opt.length; 733 734 switch(opt.type) { 735 case L2CAP_OPT_MTU: 736 if (chan->lc_imtu == L2CAP_MTU_DEFAULT) 737 goto discon; 738 739 chan->lc_imtu = L2CAP_MTU_DEFAULT; 740 break; 741 742 case L2CAP_OPT_FLUSH_TIMO: 743 if (chan->lc_flush == L2CAP_FLUSH_TIMO_DEFAULT) 744 goto discon; 745 746 chan->lc_flush = L2CAP_FLUSH_TIMO_DEFAULT; 747 break; 748 749 case L2CAP_OPT_QOS: 750 break; 751 752 default: 753 UNKNOWN(opt.type); 754 goto discon; 755 } 756 } 757 758 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) 759 l2cap_send_config_req(chan); /* no state change */ 760 761 goto out; 762 763 default: 764 UNKNOWN(cp.result); 765 goto discon; 766 } 767 768 DPRINTF("how did I get here!?\n"); 769 770 discon: 771 l2cap_send_disconnect_req(chan); 772 l2cap_close(chan, ECONNABORTED); 773 774 out: 775 m_adj(m, left); 776 } 777 778 /* 779 * Process Received Disconnect Request. We must validate scid and dcid 780 * just in case but otherwise this connection is finished. 781 */ 782 static void 783 l2cap_recv_disconnect_req(struct mbuf *m, struct hci_link *link) 784 { 785 l2cap_cmd_hdr_t cmd; 786 l2cap_discon_req_cp cp; 787 l2cap_discon_rsp_cp rp; 788 struct l2cap_channel *chan; 789 790 m_copydata(m, 0, sizeof(cmd), &cmd); 791 m_adj(m, sizeof(cmd)); 792 793 m_copydata(m, 0, sizeof(cp), &cp); 794 m_adj(m, sizeof(cp)); 795 796 cp.scid = le16toh(cp.scid); 797 cp.dcid = le16toh(cp.dcid); 798 799 chan = l2cap_cid_lookup(cp.dcid); 800 if (chan == NULL || chan->lc_link != link || chan->lc_rcid != cp.scid) { 801 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID, 802 cp.dcid, cp.scid); 803 return; 804 } 805 806 rp.dcid = htole16(chan->lc_lcid); 807 rp.scid = htole16(chan->lc_rcid); 808 l2cap_send_signal(link, L2CAP_DISCONNECT_RSP, cmd.ident, 809 sizeof(rp), &rp); 810 811 if (chan->lc_state != L2CAP_CLOSED) 812 l2cap_close(chan, 0); 813 } 814 815 /* 816 * Process Received Disconnect Response. We must validate scid and dcid but 817 * unless we were waiting for this signal, ignore it. 818 */ 819 static void 820 l2cap_recv_disconnect_rsp(struct mbuf *m, struct hci_link *link) 821 { 822 l2cap_cmd_hdr_t cmd; 823 l2cap_discon_rsp_cp cp; 824 struct l2cap_req *req; 825 struct l2cap_channel *chan; 826 827 m_copydata(m, 0, sizeof(cmd), &cmd); 828 m_adj(m, sizeof(cmd)); 829 830 m_copydata(m, 0, sizeof(cp), &cp); 831 m_adj(m, sizeof(cp)); 832 833 cp.scid = le16toh(cp.scid); 834 cp.dcid = le16toh(cp.dcid); 835 836 req = l2cap_request_lookup(link, cmd.ident); 837 if (req == NULL || req->lr_code != L2CAP_DISCONNECT_REQ) 838 return; 839 840 chan = req->lr_chan; 841 if (chan == NULL 842 || chan->lc_lcid != cp.scid 843 || chan->lc_rcid != cp.dcid) 844 return; 845 846 l2cap_request_free(req); 847 848 if (chan->lc_state != L2CAP_WAIT_DISCONNECT) 849 return; 850 851 l2cap_close(chan, 0); 852 } 853 854 /* 855 * Process Received Info Request. 856 */ 857 static void 858 l2cap_recv_info_req(struct mbuf *m, struct hci_link *link) 859 { 860 l2cap_cmd_hdr_t cmd; 861 l2cap_info_req_cp cp; 862 uint8_t rsp[12]; 863 864 m_copydata(m, 0, sizeof(cmd), &cmd); 865 m_adj(m, sizeof(cmd)); 866 867 m_copydata(m, 0, sizeof(cp), &cp); 868 m_adj(m, sizeof(cp)); 869 870 cp.type = le16toh(cp.type); 871 switch(cp.type) { 872 case L2CAP_EXTENDED_FEATURES: 873 /* 874 * 32-bit data field, unused bits set to zero 875 * 876 * octet bit feature 877 * 0 0 Flow control mode 878 * 0 1 Retransmission mode 879 * 0 2 Bi-directional QoS 880 * 0 3 Enhanced retransmission mode 881 * 0 4 Streaming mode 882 * 0 5 FCS option 883 * 0 6 Extended flow specification for BR/EDR 884 * 0 7 Fixed channels (SET) 885 * 1 0 Extended window size 886 * 1 1 Unicast connectionless data reception 887 */ 888 le16enc(rsp + 0, cp.type); 889 le16enc(rsp + 2, L2CAP_SUCCESS); 890 le32enc(rsp + 4, 0x00000080); 891 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 8, rsp); 892 break; 893 894 case L2CAP_FIXED_CHANNELS: 895 /* 896 * 64-bit data field, unused bits set to zero 897 * 898 * octet bit channel 899 * 0 0 0x0000 Null 900 * 0 1 0x0001 L2CAP Signalling Channel (SET) 901 * 0 2 0x0002 Connectionless Reception 902 * 0 3 0x0003 AMP Manager Protocol Channel 903 */ 904 le16enc(rsp + 0, cp.type); 905 le16enc(rsp + 2, L2CAP_SUCCESS); 906 le64enc(rsp + 4, 0x0000000000000002); 907 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 12, rsp); 908 break; 909 910 case L2CAP_CONNLESS_MTU: 911 default: 912 le16enc(rsp + 0, cp.type); 913 le16enc(rsp + 2, L2CAP_NOT_SUPPORTED); 914 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 4, rsp); 915 break; 916 } 917 } 918 919 /* 920 * Construct signal and wrap in C-Frame for link. 921 */ 922 static int 923 l2cap_send_signal(struct hci_link *link, uint8_t code, uint8_t ident, 924 uint16_t length, void *data) 925 { 926 struct mbuf *m; 927 l2cap_hdr_t *hdr; 928 l2cap_cmd_hdr_t *cmd; 929 930 KASSERT(link != NULL); 931 KASSERT(sizeof(l2cap_cmd_hdr_t) + length <= link->hl_mtu); 932 933 m = m_gethdr(M_DONTWAIT, MT_DATA); 934 if (m == NULL) 935 return ENOMEM; 936 937 hdr = mtod(m, l2cap_hdr_t *); 938 cmd = (l2cap_cmd_hdr_t *)(hdr + 1); 939 940 m->m_len = m->m_pkthdr.len = MHLEN; 941 942 /* Command Data */ 943 if (length > 0) 944 m_copyback(m, sizeof(*hdr) + sizeof(*cmd), length, data); 945 946 /* Command Header */ 947 cmd->code = code; 948 cmd->ident = ident; 949 cmd->length = htole16(length); 950 length += sizeof(*cmd); 951 952 /* C-Frame Header */ 953 hdr->length = htole16(length); 954 hdr->dcid = htole16(L2CAP_SIGNAL_CID); 955 length += sizeof(*hdr); 956 957 if (m->m_pkthdr.len != MAX(MHLEN, length)) { 958 m_freem(m); 959 return ENOMEM; 960 } 961 962 m->m_pkthdr.len = length; 963 m->m_len = MIN(length, MHLEN); 964 965 DPRINTFN(2, "(%s) code %d, ident %d, len %d\n", 966 device_xname(link->hl_unit->hci_dev), code, ident, length); 967 968 return hci_acl_send(m, link, NULL); 969 } 970 971 /* 972 * Send Command Reject packet. 973 */ 974 static int 975 l2cap_send_command_rej(struct hci_link *link, uint8_t ident, 976 uint16_t reason, ...) 977 { 978 l2cap_cmd_rej_cp cp; 979 int len = 0; 980 va_list ap; 981 982 va_start(ap, reason); 983 984 cp.reason = htole16(reason); 985 986 switch (reason) { 987 case L2CAP_REJ_NOT_UNDERSTOOD: 988 len = 2; 989 break; 990 991 case L2CAP_REJ_MTU_EXCEEDED: 992 len = 4; 993 cp.data[0] = va_arg(ap, int); /* SigMTU */ 994 cp.data[0] = htole16(cp.data[0]); 995 break; 996 997 case L2CAP_REJ_INVALID_CID: 998 len = 6; 999 cp.data[0] = va_arg(ap, int); /* dcid */ 1000 cp.data[0] = htole16(cp.data[0]); 1001 cp.data[1] = va_arg(ap, int); /* scid */ 1002 cp.data[1] = htole16(cp.data[1]); 1003 break; 1004 1005 default: 1006 UNKNOWN(reason); 1007 return EINVAL; 1008 } 1009 1010 va_end(ap); 1011 1012 return l2cap_send_signal(link, L2CAP_COMMAND_REJ, ident, len, &cp); 1013 } 1014 1015 /* 1016 * Send Connect Request 1017 */ 1018 int 1019 l2cap_send_connect_req(struct l2cap_channel *chan) 1020 { 1021 l2cap_con_req_cp cp; 1022 int err; 1023 1024 err = l2cap_request_alloc(chan, L2CAP_CONNECT_REQ); 1025 if (err) 1026 return err; 1027 1028 cp.psm = htole16(chan->lc_raddr.bt_psm); 1029 cp.scid = htole16(chan->lc_lcid); 1030 1031 return l2cap_send_signal(chan->lc_link, L2CAP_CONNECT_REQ, 1032 chan->lc_link->hl_lastid, sizeof(cp), &cp); 1033 } 1034 1035 /* 1036 * Send Config Request 1037 * 1038 * For outgoing config request, we only put options in the packet if they 1039 * differ from the default and would have to be actioned. We dont support 1040 * enough option types to make overflowing SigMTU an issue so it can all 1041 * go in one packet. 1042 */ 1043 int 1044 l2cap_send_config_req(struct l2cap_channel *chan) 1045 { 1046 l2cap_cfg_req_cp *cp; 1047 l2cap_cfg_opt_t *opt; 1048 l2cap_cfg_opt_val_t *val; 1049 uint8_t *next, buf[L2CAP_MTU_MINIMUM]; 1050 int err; 1051 1052 err = l2cap_request_alloc(chan, L2CAP_CONFIG_REQ); 1053 if (err) 1054 return err; 1055 1056 /* Config Header (4 octets) */ 1057 cp = (l2cap_cfg_req_cp *)buf; 1058 cp->dcid = htole16(chan->lc_rcid); 1059 cp->flags = 0; /* "No Continuation" */ 1060 1061 next = buf + sizeof(l2cap_cfg_req_cp); 1062 1063 /* Incoming MTU (4 octets) */ 1064 if (chan->lc_imtu != L2CAP_MTU_DEFAULT) { 1065 opt = (l2cap_cfg_opt_t *)next; 1066 opt->type = L2CAP_OPT_MTU; 1067 opt->length = L2CAP_OPT_MTU_SIZE; 1068 1069 val = (l2cap_cfg_opt_val_t *)(opt + 1); 1070 val->mtu = htole16(chan->lc_imtu); 1071 1072 next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_MTU_SIZE; 1073 } 1074 1075 /* Flush Timeout (4 octets) */ 1076 if (chan->lc_flush != L2CAP_FLUSH_TIMO_DEFAULT) { 1077 opt = (l2cap_cfg_opt_t *)next; 1078 opt->type = L2CAP_OPT_FLUSH_TIMO; 1079 opt->length = L2CAP_OPT_FLUSH_TIMO_SIZE; 1080 1081 val = (l2cap_cfg_opt_val_t *)(opt + 1); 1082 val->flush_timo = htole16(chan->lc_flush); 1083 1084 next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_FLUSH_TIMO_SIZE; 1085 } 1086 1087 /* Outgoing QoS Flow (24 octets) */ 1088 /* Retransmission & Flow Control (11 octets) */ 1089 /* 1090 * From here we need to start paying attention to SigMTU as we have 1091 * possibly overflowed the minimum supported.. 1092 */ 1093 1094 return l2cap_send_signal(chan->lc_link, L2CAP_CONFIG_REQ, 1095 chan->lc_link->hl_lastid, (int)(next - buf), buf); 1096 } 1097 1098 /* 1099 * Send Disconnect Request 1100 */ 1101 int 1102 l2cap_send_disconnect_req(struct l2cap_channel *chan) 1103 { 1104 l2cap_discon_req_cp cp; 1105 int err; 1106 1107 err = l2cap_request_alloc(chan, L2CAP_DISCONNECT_REQ); 1108 if (err) 1109 return err; 1110 1111 cp.dcid = htole16(chan->lc_rcid); 1112 cp.scid = htole16(chan->lc_lcid); 1113 1114 return l2cap_send_signal(chan->lc_link, L2CAP_DISCONNECT_REQ, 1115 chan->lc_link->hl_lastid, sizeof(cp), &cp); 1116 } 1117 1118 /* 1119 * Send Connect Response 1120 */ 1121 int 1122 l2cap_send_connect_rsp(struct hci_link *link, uint8_t ident, uint16_t dcid, uint16_t scid, uint16_t result) 1123 { 1124 l2cap_con_rsp_cp cp; 1125 1126 memset(&cp, 0, sizeof(cp)); 1127 cp.dcid = htole16(dcid); 1128 cp.scid = htole16(scid); 1129 cp.result = htole16(result); 1130 1131 return l2cap_send_signal(link, L2CAP_CONNECT_RSP, ident, sizeof(cp), &cp); 1132 } 1133
Indexes created Fri Sep 26 20:09:58 GMT 2025