root/netbt/l2cap_signal.c

DEFINITIONS

1. l2cap_recv_signal
2. l2cap_recv_command_rej
3. l2cap_recv_connect_req
4. l2cap_recv_connect_rsp
5. l2cap_recv_config_req
6. l2cap_recv_config_rsp
7. l2cap_recv_disconnect_req
8. l2cap_recv_disconnect_rsp
9. l2cap_recv_info_req
10. l2cap_send_signal
11. l2cap_send_command_rej
12. l2cap_send_connect_req
13. l2cap_send_config_req
14. l2cap_send_disconnect_req
15. l2cap_send_connect_rsp

    1 /*      $OpenBSD: l2cap_signal.c,v 1.2 2007/07/22 21:05:00 gwk Exp $    */
    2 /*      $NetBSD: l2cap_signal.c,v 1.8 2007/05/16 18:34:49 plunky Exp $  */
    4 /*-
    5  * Copyright (c) 2005 Iain Hibbert.
    6  * Copyright (c) 2006 Itronix Inc.
    7  * All rights reserved.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  * 3. The name of Itronix Inc. may not be used to endorse
   18  *    or promote products derived from this software without specific
   19  *    prior written permission.
   20  *
   21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
   22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
   25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
   26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
   27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
   28  * ON ANY THEORY OF LIABILITY, WHETHER IN
   29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   31  * POSSIBILITY OF SUCH DAMAGE.
   32  */
   34 #include <sys/cdefs.h>
   36 #include <sys/param.h>
   37 #include <sys/kernel.h>
   38 #include <sys/mbuf.h>
   39 #include <sys/proc.h>
   40 #include <sys/queue.h>
   41 #include <sys/systm.h>
   43 #include <netbt/bluetooth.h>
   44 #include <netbt/hci.h>
   45 #include <netbt/l2cap.h>
   47 /*******************************************************************************
   48  *
   49  *      L2CAP Signal processing
   50  */
   52 static void l2cap_recv_command_rej(struct mbuf *, struct hci_link *);
   53 static void l2cap_recv_connect_req(struct mbuf *, struct hci_link *);
   54 static void l2cap_recv_connect_rsp(struct mbuf *, struct hci_link *);
   55 static void l2cap_recv_config_req(struct mbuf *, struct hci_link *);
   56 static void l2cap_recv_config_rsp(struct mbuf *, struct hci_link *);
   57 static void l2cap_recv_disconnect_req(struct mbuf *, struct hci_link *);
   58 static void l2cap_recv_disconnect_rsp(struct mbuf *, struct hci_link *);
   59 static void l2cap_recv_info_req(struct mbuf *, struct hci_link *);
   60 static int l2cap_send_signal(struct hci_link *, uint8_t, uint8_t, uint16_t, void *);
   61 static int l2cap_send_command_rej(struct hci_link *, uint8_t, uint16_t, ...);
   63 /*
   64  * process incoming signal packets (CID 0x0001). Can contain multiple
   65  * requests/responses.
   66  */
   67 void
l2cap_recv_signal(struct mbuf *m, struct hci_link *link)
   69 {
l2cap_cmd_hdr_t cmd;
   72         for(;;) {
   73                 if (m->m_pkthdr.len == 0)
   74                         goto finish;
   76                 if (m->m_pkthdr.len < sizeof(cmd))
   77                         goto reject;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
cmd.length = letoh16(cmd.length);
   82                 if (m->m_pkthdr.len < sizeof(cmd) + cmd.length)
   83                         goto reject;
DPRINTFN(2, "(%s) code %d, ident %d, len %d\n",
link->hl_unit->hci_devname,
cmd.code, cmd.ident, cmd.length);
   89                 switch (cmd.code) {
   90                 case L2CAP_COMMAND_REJ:
   91                         if (cmd.length > sizeof(l2cap_cmd_rej_cp))
   92                                 goto finish;
l2cap_recv_command_rej(m, link);
   95                         break;
   97                 case L2CAP_CONNECT_REQ:
   98                         if (cmd.length != sizeof(l2cap_con_req_cp))
   99                                 goto reject;
l2cap_recv_connect_req(m, link);
  102                         break;
  104                 case L2CAP_CONNECT_RSP:
  105                         if (cmd.length != sizeof(l2cap_con_rsp_cp))
  106                                 goto finish;
l2cap_recv_connect_rsp(m, link);
  109                         break;
  111                 case L2CAP_CONFIG_REQ:
l2cap_recv_config_req(m, link);
  113                         break;
  115                 case L2CAP_CONFIG_RSP:
l2cap_recv_config_rsp(m, link);
  117                         break;
  119                 case L2CAP_DISCONNECT_REQ:
  120                         if (cmd.length != sizeof(l2cap_discon_req_cp))
  121                                 goto reject;
l2cap_recv_disconnect_req(m, link);
  124                         break;
  126                 case L2CAP_DISCONNECT_RSP:
  127                         if (cmd.length != sizeof(l2cap_discon_rsp_cp))
  128                                 goto finish;
l2cap_recv_disconnect_rsp(m, link);
  131                         break;
  133                 case L2CAP_ECHO_REQ:
m_adj(m, sizeof(cmd) + cmd.length);
l2cap_send_signal(link, L2CAP_ECHO_RSP, cmd.ident,
  136                                         0, NULL);
  137                         break;
  139                 case L2CAP_ECHO_RSP:
m_adj(m, sizeof(cmd) + cmd.length);
  141                         break;
  143                 case L2CAP_INFO_REQ:
  144                         if (cmd.length != sizeof(l2cap_info_req_cp))
  145                                 goto reject;
l2cap_recv_info_req(m, link);
  148                         break;
  150                 case L2CAP_INFO_RSP:
m_adj(m, sizeof(cmd) + cmd.length);
  152                         break;
  154                 default:
  155                         goto reject;
  156                 }
  157         }
  159 #ifdef DIAGNOSTIC
panic("impossible!");
  161 #endif
reject:
l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD);
finish:
m_freem(m);
  167 }
  169 /*
  170  * Process Received Command Reject. For now we dont try to recover gracefully
  171  * from this, it probably means that the link is garbled or the other end is
  172  * insufficiently capable of handling normal traffic. (not *my* fault, no way!)
  173  */
  174 static void
l2cap_recv_command_rej(struct mbuf *m, struct hci_link *link)
  176 {
  177         struct l2cap_req *req;
  178         struct l2cap_channel *chan;
l2cap_cmd_hdr_t cmd;
l2cap_cmd_rej_cp cp;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
cmd.length = letoh16(cmd.length);
m_copydata(m, 0, cmd.length, (caddr_t)&cp);
m_adj(m, cmd.length);
req = l2cap_request_lookup(link, cmd.ident);
  191         if (req == NULL)
  192                 return;
  194         switch (letoh16(cp.reason)) {
  195         case L2CAP_REJ_NOT_UNDERSTOOD:
  196                 /*
  197                  * I dont know what to do, just move up the timeout
  198                  */
timeout_add(&req->lr_rtx, 0);
  200                 break;
  202         case L2CAP_REJ_MTU_EXCEEDED:
  203                 /*
  204                  * I didnt send any commands over L2CAP_MTU_MINIMUM size, but..
  205                  *
  206                  * XXX maybe we should resend this, instead?
  207                  */
link->hl_mtu = letoh16(cp.data[0]);
timeout_add(&req->lr_rtx, 0);
  210                 break;
  212         case L2CAP_REJ_INVALID_CID:
  213                 /*
  214                  * Well, if they dont have such a channel then our channel is
  215                  * most likely closed. Make it so.
  216                  */
chan = req->lr_chan;
l2cap_request_free(req);
  219                 if (chan != NULL && chan->lc_state != L2CAP_CLOSED)
l2cap_close(chan, ECONNABORTED);
  222                 break;
  224         default:
UNKNOWN(letoh16(cp.reason));
  226                 break;
  227         }
  228 }
  230 /*
  231  * Process Received Connect Request. Find listening channel matching
  232  * psm & addr and ask upper layer for a new channel.
  233  */
  234 static void
l2cap_recv_connect_req(struct mbuf *m, struct hci_link *link)
  236 {
  237         struct sockaddr_bt laddr, raddr;
  238         struct l2cap_channel *chan, *new;
l2cap_cmd_hdr_t cmd;
l2cap_con_req_cp cp;
  241         int err;
  243         /* extract cmd */
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
  247         /* extract request */
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
cp.scid = letoh16(cp.scid);
cp.psm = letoh16(cp.psm);
memset(&laddr, 0, sizeof(struct sockaddr_bt));
laddr.bt_len = sizeof(struct sockaddr_bt);
laddr.bt_family = AF_BLUETOOTH;
laddr.bt_psm = cp.psm;
bdaddr_copy(&laddr.bt_bdaddr, &link->hl_unit->hci_bdaddr);
memset(&raddr, 0, sizeof(struct sockaddr_bt));
raddr.bt_len = sizeof(struct sockaddr_bt);
raddr.bt_family = AF_BLUETOOTH;
raddr.bt_psm = cp.psm;
bdaddr_copy(&raddr.bt_bdaddr, &link->hl_bdaddr);
LIST_FOREACH(chan, &l2cap_listen_list, lc_ncid) {
  267                 if (chan->lc_laddr.bt_psm != laddr.bt_psm
  268                     && chan->lc_laddr.bt_psm != L2CAP_PSM_ANY)
  269                         continue;
  271                 if (!bdaddr_same(&laddr.bt_bdaddr, &chan->lc_laddr.bt_bdaddr)
  272                     && bdaddr_any(&chan->lc_laddr.bt_bdaddr) == 0)
  273                         continue;
new= (*chan->lc_proto->newconn)(chan->lc_upper, &laddr, &raddr);
  276                 if (new == NULL)
  277                         continue;
err = l2cap_cid_alloc(new);
  280                 if (err) {
l2cap_send_connect_rsp(link, cmd.ident,
  282                                                 0, cp.scid,
L2CAP_NO_RESOURCES);
  285                         (*new->lc_proto->disconnected)(new->lc_upper, err);
  286                         return;
  287                 }
new->lc_link = hci_acl_open(link->hl_unit, &link->hl_bdaddr);
KASSERT(new->lc_link == link);
new->lc_rcid = cp.scid;
new->lc_ident = cmd.ident;
memcpy(&new->lc_laddr, &laddr, sizeof(struct sockaddr_bt));
memcpy(&new->lc_raddr, &raddr, sizeof(struct sockaddr_bt));
new->lc_mode = chan->lc_mode;
err = l2cap_setmode(new);
  301                 if (err == EINPROGRESS) {
new->lc_state = L2CAP_WAIT_SEND_CONNECT_RSP;
  303                         (*new->lc_proto->connecting)(new->lc_upper);
  304                         return;
  305                 }
  306                 if (err) {
new->lc_state = L2CAP_CLOSED;
hci_acl_close(link, err);
new->lc_link = NULL;
l2cap_send_connect_rsp(link, cmd.ident,
  312                                                 0, cp.scid,
L2CAP_NO_RESOURCES);
  315                         (*new->lc_proto->disconnected)(new->lc_upper, err);
  316                         return;
  317                 }
err = l2cap_send_connect_rsp(link, cmd.ident,
new->lc_lcid, new->lc_rcid,
L2CAP_SUCCESS);
  322                 if (err) {
l2cap_close(new, err);
  324                         return;
  325                 }
new->lc_state = L2CAP_WAIT_CONFIG;
new->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP);
err = l2cap_send_config_req(new);
  330                 if (err)
l2cap_close(new, err);
  333                 return;
  334         }
l2cap_send_connect_rsp(link, cmd.ident,
  337                                 0, cp.scid,
L2CAP_PSM_NOT_SUPPORTED);
  339 }
  341 /*
  342  * Process Received Connect Response.
  343  */
  344 static void
l2cap_recv_connect_rsp(struct mbuf *m, struct hci_link *link)
  346 {
l2cap_cmd_hdr_t cmd;
l2cap_con_rsp_cp cp;
  349         struct l2cap_req *req;
  350         struct l2cap_channel *chan;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
cp.scid = letoh16(cp.scid);
cp.dcid = letoh16(cp.dcid);
cp.result = letoh16(cp.result);
req = l2cap_request_lookup(link, cmd.ident);
  363         if (req == NULL || req->lr_code != L2CAP_CONNECT_REQ)
  364                 return;
chan = req->lr_chan;
  367         if (chan != NULL && chan->lc_lcid != cp.scid)
  368                 return;
  370         if (chan == NULL || chan->lc_state != L2CAP_WAIT_RECV_CONNECT_RSP) {
l2cap_request_free(req);
  372                 return;
  373         }
  375         switch (cp.result) {
  376         case L2CAP_SUCCESS:
  377                 /*
  378                  * Ok, at this point we have a connection to the other party. We
  379                  * could indicate upstream that we are ready for business and
  380                  * wait for a "Configure Channel Request" but I'm not so sure
  381                  * that is required in our case - we will proceed directly to
  382                  * sending our config request. We set two state bits because in
  383                  * the config state we are waiting for requests and responses.
  384                  */
l2cap_request_free(req);
chan->lc_rcid = cp.dcid;
chan->lc_state = L2CAP_WAIT_CONFIG;
chan->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP);
l2cap_send_config_req(chan);
  390                 break;
  392         case L2CAP_PENDING:
  393                 /* XXX dont release request, should start eRTX timeout? */
  394                 (*chan->lc_proto->connecting)(chan->lc_upper);
  395                 break;
  397         case L2CAP_PSM_NOT_SUPPORTED:
  398         case L2CAP_SECURITY_BLOCK:
  399         case L2CAP_NO_RESOURCES:
  400         default:
l2cap_request_free(req);
l2cap_close(chan, ECONNREFUSED);
  403                 break;
  404         }
  405 }
  407 /*
  408  * Process Received Config Reqest.
  409  */
  410 static void
l2cap_recv_config_req(struct mbuf *m, struct hci_link *link)
  412 {
uint8_t buf[L2CAP_MTU_MINIMUM];
l2cap_cmd_hdr_t cmd;
l2cap_cfg_req_cp cp;
l2cap_cfg_opt_t opt;
l2cap_cfg_opt_val_t val;
l2cap_cfg_rsp_cp rp;
  419         struct l2cap_channel *chan;
  420         int left, len;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
left = letoh16(cmd.length);
  426         if (left < sizeof(cp))
  427                 goto reject;
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
left -= sizeof(cp);
cp.dcid = letoh16(cp.dcid);
cp.flags = letoh16(cp.flags);
chan = l2cap_cid_lookup(cp.dcid);
  437         if (chan == NULL || chan->lc_link != link
  438             || chan->lc_state != L2CAP_WAIT_CONFIG
  439             || (chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) {
  440                 /* XXX we should really accept reconfiguration requests */
l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID,
L2CAP_NULL_CID, cp.dcid);
  443                 goto out;
  444         }
  446         /* ready our response packet */
rp.scid = htole16(chan->lc_rcid);
rp.flags = 0;   /* "No Continuation" */
rp.result = L2CAP_SUCCESS;
len = sizeof(rp);
  452         /*
  453          * Process the packet. We build the return packet on the fly adding any
  454          * unacceptable parameters as we go. As we can only return one result,
  455          * unknown option takes precedence so we start our return packet anew
  456          * and ignore option values thereafter as they will be re-sent.
  457          *
  458          * Since we do not support enough options to make overflowing the min
  459          * MTU size an issue in normal use, we just reject config requests that
  460          * make that happen. This could be because options are repeated or the
  461          * packet is corrupted in some way.
  462          *
  463          * If unknown option types threaten to overflow the packet, we just
  464          * ignore them. We can deny them next time.
  465          */
  466         while (left > 0) {
  467                 if (left < sizeof(opt))
  468                         goto reject;
m_copydata(m, 0, sizeof(opt), (caddr_t)&opt);
m_adj(m, sizeof(opt));
left -= sizeof(opt);
  474                 if (left < opt.length)
  475                         goto reject;
  477                 switch(opt.type & L2CAP_OPT_HINT_MASK) {
  478                 case L2CAP_OPT_MTU:
  479                         if (rp.result == L2CAP_UNKNOWN_OPTION)
  480                                 break;
  482                         if (opt.length != L2CAP_OPT_MTU_SIZE)
  483                                 goto reject;
m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, (caddr_t)&val);
val.mtu = letoh16(val.mtu);
  488                         /*
  489                          * XXX how do we know what the minimum acceptable MTU is
  490                          * for a channel? Spec says some profiles have a higher
  491                          * minimum but I have no way to find that out at this
  492                          * juncture..
  493                          */
  494                         if (val.mtu < L2CAP_MTU_MINIMUM) {
  495                                 if (len + sizeof(opt) + L2CAP_OPT_MTU_SIZE > sizeof(buf))
  496                                         goto reject;
rp.result = L2CAP_UNACCEPTABLE_PARAMS;
memcpy(buf + len, &opt, sizeof(opt));
len += sizeof(opt);
val.mtu = htole16(L2CAP_MTU_MINIMUM);
memcpy(buf + len, &val, L2CAP_OPT_MTU_SIZE);
len += L2CAP_OPT_MTU_SIZE;
  504                         } else
chan->lc_omtu = val.mtu;
  507                         break;
  509                 case L2CAP_OPT_FLUSH_TIMO:
  510                         if (rp.result == L2CAP_UNKNOWN_OPTION)
  511                                 break;
  513                         if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE)
  514                                 goto reject;
  516                         /*
  517                          * I think that this is informational only - he is
  518                          * informing us of the flush timeout he will be using.
  519                          * I dont think this affects us in any significant way,
  520                          * so just ignore this value for now.
  521                          */
  522                         break;
  524                 case L2CAP_OPT_QOS:
  525                 default:
  526                         /* ignore hints */
  527                         if (opt.type & L2CAP_OPT_HINT_BIT)
  528                                 break;
  530                         /* unknown options supercede all else */
  531                         if (rp.result != L2CAP_UNKNOWN_OPTION) {
rp.result = L2CAP_UNKNOWN_OPTION;
len = sizeof(rp);
  534                         }
  536                         /* ignore if it don't fit */
  537                         if (len + sizeof(opt) > sizeof(buf))
  538                                 break;
  540                         /* return unknown option type, but no data */
buf[len++] = opt.type;
buf[len++] = 0;
  543                         break;
  544                 }
m_adj(m, opt.length);
left -= opt.length;
  548         }
rp.result = htole16(rp.result);
memcpy(buf, &rp, sizeof(rp));
l2cap_send_signal(link, L2CAP_CONFIG_RSP, cmd.ident, len, buf);
  554         if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0
  555             && rp.result == letoh16(L2CAP_SUCCESS)) {
chan->lc_flags &= ~L2CAP_WAIT_CONFIG_REQ;
  559                 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) {
chan->lc_state = L2CAP_OPEN;
  561                         /* XXX how to distinguish REconfiguration? */
  562                         (*chan->lc_proto->connected)(chan->lc_upper);
  563                 }
  564         }
  565         return;
reject:
l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD);
out:
m_adj(m, left);
  571 }
  573 /*
  574  * Process Received Config Response.
  575  */
  576 static void
l2cap_recv_config_rsp(struct mbuf *m, struct hci_link *link)
  578 {
l2cap_cmd_hdr_t cmd;
l2cap_cfg_rsp_cp cp;
l2cap_cfg_opt_t opt;
l2cap_cfg_opt_val_t val;
  583         struct l2cap_req *req;
  584         struct l2cap_channel *chan;
  585         int left;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
left = letoh16(cmd.length);
  591         if (left < sizeof(cp))
  592                 goto out;
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
left -= sizeof(cp);
cp.scid = letoh16(cp.scid);
cp.flags = letoh16(cp.flags);
cp.result = letoh16(cp.result);
req = l2cap_request_lookup(link, cmd.ident);
  603         if (req == NULL || req->lr_code != L2CAP_CONFIG_REQ)
  604                 goto out;
chan = req->lr_chan;
  607         if (chan != NULL && chan->lc_lcid != cp.scid)
  608                 goto out;
l2cap_request_free(req);
  612         if (chan == NULL || chan->lc_state != L2CAP_WAIT_CONFIG
  613             || (chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0)
  614                 goto out;
  616         if ((cp.flags & L2CAP_OPT_CFLAG_BIT)) {
l2cap_cfg_req_cp rp;
  619                 /*
  620                  * They have more to tell us and want another ID to
  621                  * use, so send an empty config request
  622                  */
  623                 if (l2cap_request_alloc(chan, L2CAP_CONFIG_REQ))
  624                         goto discon;
rp.dcid = htole16(cp.scid);
rp.flags = 0;
  629                 if (l2cap_send_signal(link, L2CAP_CONFIG_REQ, link->hl_lastid,
  630                                         sizeof(rp), &rp))
  631                         goto discon;
  632         }
  634         switch(cp.result) {
  635         case L2CAP_SUCCESS:
  636                 /*
  637                  * If continuation flag was not set, our config request was
  638                  * accepted. We may have to wait for their config request to
  639                  * complete, so check that but otherwise we are open
  640                  *
  641                  * There may be 'advisory' values in the packet but we just
  642                  * ignore those..
  643                  */
  644                 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) {
chan->lc_flags &= ~L2CAP_WAIT_CONFIG_RSP;
  647                         if ((chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) {
chan->lc_state = L2CAP_OPEN;
  649                                 /* XXX how to distinguish REconfiguration? */
  650                                 (*chan->lc_proto->connected)(chan->lc_upper);
  651                         }
  652                 }
  653                 goto out;
  655         case L2CAP_UNACCEPTABLE_PARAMS:
  656                 /*
  657                  * Packet contains unacceptable parameters with preferred values
  658                  */
  659                 while (left > 0) {
  660                         if (left < sizeof(opt))
  661                                 goto discon;
m_copydata(m, 0, sizeof(opt), (caddr_t)&opt);
m_adj(m, sizeof(opt));
left -= sizeof(opt);
  667                         if (left < opt.length)
  668                                 goto discon;
  670                         switch (opt.type) {
  671                         case L2CAP_OPT_MTU:
  672                                 if (opt.length != L2CAP_OPT_MTU_SIZE)
  673                                         goto discon;
m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, (caddr_t)&val);
chan->lc_imtu = letoh16(val.mtu);
  677                                 if (chan->lc_imtu < L2CAP_MTU_MINIMUM)
chan->lc_imtu = L2CAP_MTU_DEFAULT;
  679                                 break;
  681                         case L2CAP_OPT_FLUSH_TIMO:
  682                                 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE)
  683                                         goto discon;
  685                                 /*
  686                                  * Spec says: If we cannot honor proposed value,
  687                                  * either disconnect or try again with original
  688                                  * value. I can't really see why they want to
  689                                  * interfere with OUR flush timeout in any case
  690                                  * so we just punt for now.
  691                                  */
  692                                 goto discon;
  694                         case L2CAP_OPT_QOS:
  695                                 break;
  697                         default:
UNKNOWN(opt.type);
  699                                 goto discon;
  700                         }
m_adj(m, opt.length);
left -= opt.length;
  704                 }
  706                 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0)
l2cap_send_config_req(chan);    /* no state change */
  709                 goto out;
  711         case L2CAP_REJECT:
  712                 goto discon;
  714         case L2CAP_UNKNOWN_OPTION:
  715                 /*
  716                  * Packet contains options not understood. Turn off unknown
  717                  * options by setting them to default values (means they will
  718                  * not be requested again).
  719                  *
  720                  * If our option was already off then fail (paranoia?)
  721                  *
  722                  * XXX Should we consider that options were set for a reason?
  723                  */
  724                 while (left > 0) {
  725                         if (left < sizeof(opt))
  726                                 goto discon;
m_copydata(m, 0, sizeof(opt), (caddr_t)&opt);
m_adj(m, sizeof(opt));
left -= sizeof(opt);
  732                         if (left < opt.length)
  733                                 goto discon;
m_adj(m, opt.length);
left -= opt.length;
  738                         switch(opt.type) {
  739                         case L2CAP_OPT_MTU:
  740                                 if (chan->lc_imtu == L2CAP_MTU_DEFAULT)
  741                                         goto discon;
chan->lc_imtu = L2CAP_MTU_DEFAULT;
  744                                 break;
  746                         case L2CAP_OPT_FLUSH_TIMO:
  747                                 if (chan->lc_flush == L2CAP_FLUSH_TIMO_DEFAULT)
  748                                         goto discon;
chan->lc_flush = L2CAP_FLUSH_TIMO_DEFAULT;
  751                                 break;
  753                         case L2CAP_OPT_QOS:
  754                                 break;
  756                         default:
UNKNOWN(opt.type);
  758                                 goto discon;
  759                         }
  760                 }
  762                 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0)
l2cap_send_config_req(chan);    /* no state change */
  765                 goto out;
  767         default:
UNKNOWN(cp.result);
  769                 goto discon;
  770         }
DPRINTF("how did I get here!?\n");
discon:
l2cap_send_disconnect_req(chan);
l2cap_close(chan, ECONNABORTED);
out:
m_adj(m, left);
  780 }
  782 /*
  783  * Process Received Disconnect Request. We must validate scid and dcid
  784  * just in case but otherwise this connection is finished.
  785  */
  786 static void
l2cap_recv_disconnect_req(struct mbuf *m, struct hci_link *link)
  788 {
l2cap_cmd_hdr_t cmd;
l2cap_discon_req_cp cp;
l2cap_discon_rsp_cp rp;
  792         struct l2cap_channel *chan;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
cp.scid = letoh16(cp.scid);
cp.dcid = letoh16(cp.dcid);
chan = l2cap_cid_lookup(cp.dcid);
  804         if (chan == NULL || chan->lc_link != link || chan->lc_rcid != cp.scid) {
l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID,
cp.dcid, cp.scid);
  807                 return;
  808         }
rp.dcid = htole16(chan->lc_lcid);
rp.scid = htole16(chan->lc_rcid);
l2cap_send_signal(link, L2CAP_DISCONNECT_RSP, cmd.ident,
  813                                 sizeof(rp), &rp);
  815         if (chan->lc_state != L2CAP_CLOSED)
l2cap_close(chan, ECONNRESET);
  817 }
  819 /*
  820  * Process Received Disconnect Response. We must validate scid and dcid but
  821  * unless we were waiting for this signal, ignore it.
  822  */
  823 static void
l2cap_recv_disconnect_rsp(struct mbuf *m, struct hci_link *link)
  825 {
l2cap_cmd_hdr_t cmd;
l2cap_discon_rsp_cp cp;
  828         struct l2cap_req *req;
  829         struct l2cap_channel *chan;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
cp.scid = letoh16(cp.scid);
cp.dcid = letoh16(cp.dcid);
req = l2cap_request_lookup(link, cmd.ident);
  841         if (req == NULL || req->lr_code != L2CAP_DISCONNECT_REQ)
  842                 return;
chan = req->lr_chan;
  845         if (chan == NULL
  846             || chan->lc_lcid != cp.scid
  847             || chan->lc_rcid != cp.dcid)
  848                 return;
l2cap_request_free(req);
  852         if (chan->lc_state != L2CAP_WAIT_DISCONNECT)
  853                 return;
l2cap_close(chan, 0);
  856 }
  858 /*
  859  * Process Received Info Request. We must respond but alas dont
  860  * support anything as yet so thats easy.
  861  */
  862 static void
l2cap_recv_info_req(struct mbuf *m, struct hci_link *link)
  864 {
l2cap_cmd_hdr_t cmd;
l2cap_info_req_cp cp;
l2cap_info_rsp_cp rp;
m_copydata(m, 0, sizeof(cmd), (caddr_t)&cmd);
m_adj(m, sizeof(cmd));
m_copydata(m, 0, sizeof(cp), (caddr_t)&cp);
m_adj(m, sizeof(cp));
  875         switch(letoh16(cp.type)) {
  876         case L2CAP_CONNLESS_MTU:
  877         case L2CAP_EXTENDED_FEATURES:
  878         default:
rp.type = cp.type;
rp.result = htole16(L2CAP_NOT_SUPPORTED);
l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident,
  883                                         sizeof(rp), &rp);
  884                 break;
  885         }
  886 }
  888 /*
  889  * Construct signal and wrap in C-Frame for link.
  890  */
  891 static int
l2cap_send_signal(struct hci_link *link, uint8_t code, uint8_t ident,
uint16_t length, void *data)
  894 {
  895         struct mbuf *m;
l2cap_hdr_t *hdr;
l2cap_cmd_hdr_t *cmd;
  899 #ifdef DIAGNOSTIC
  900         if (link == NULL)
  901                 return ENETDOWN;
  903         if (sizeof(l2cap_cmd_hdr_t) + length > link->hl_mtu)
printf("(%s) exceeding L2CAP Signal MTU for link!\n",
link->hl_unit->hci_devname);
  906 #endif
m = m_gethdr(M_DONTWAIT, MT_DATA);
  909         if (m == NULL)
  910                 return ENOMEM;
hdr = mtod(m, l2cap_hdr_t *);
cmd = (l2cap_cmd_hdr_t *)(hdr + 1);
m->m_len = m->m_pkthdr.len = MHLEN;
  917         /* Command Data */
  918         if (length > 0)
m_copyback(m, sizeof(*hdr) + sizeof(*cmd), length, data);
  921         /* Command Header */
cmd->code = code;
cmd->ident = ident;
cmd->length = htole16(length);
length += sizeof(*cmd);
  927         /* C-Frame Header */
hdr->length = htole16(length);
hdr->dcid = htole16(L2CAP_SIGNAL_CID);
length += sizeof(*hdr);
  932         if (m->m_pkthdr.len != MAX(MHLEN, length)) {
m_freem(m);
  934                 return ENOMEM;
  935         }
m->m_pkthdr.len = length;
m->m_len = MIN(length, MHLEN);
DPRINTFN(2, "(%s) code %d, ident %d, len %d\n",
link->hl_unit->hci_devname, code, ident, length);
  943         return hci_acl_send(m, link, NULL);
  944 }
  946 /*
  947  * Send Command Reject packet.
  948  */
  949 static int
l2cap_send_command_rej(struct hci_link *link, uint8_t ident,
uint16_t reason, ...)
  952 {
l2cap_cmd_rej_cp cp;
  954         int len = 0;
va_list ap;
va_start(ap, reason);
cp.reason = htole16(reason);
  961         switch (reason) {
  962         case L2CAP_REJ_NOT_UNDERSTOOD:
len = 2;
  964                 break;
  966         case L2CAP_REJ_MTU_EXCEEDED:
len = 4;
cp.data[0] = va_arg(ap, int);           /* SigMTU */
cp.data[0] = htole16(cp.data[0]);
  970                 break;
  972         case L2CAP_REJ_INVALID_CID:
len = 6;
cp.data[0] = va_arg(ap, int);           /* dcid */
cp.data[0] = htole16(cp.data[0]);
cp.data[1] = va_arg(ap, int);           /* scid */
cp.data[1] = htole16(cp.data[1]);
  978                 break;
  980         default:
UNKNOWN(reason);
  982                 return EINVAL;
  983         }
va_end(ap);
  987         return l2cap_send_signal(link, L2CAP_COMMAND_REJ, ident, len, &cp);
  988 }
  990 /*
  991  * Send Connect Request
  992  */
  993 int
l2cap_send_connect_req(struct l2cap_channel *chan)
  995 {
l2cap_con_req_cp cp;
  997         int err;
err = l2cap_request_alloc(chan, L2CAP_CONNECT_REQ);
 1000         if (err)
 1001                 return err;
cp.psm = htole16(chan->lc_raddr.bt_psm);
cp.scid = htole16(chan->lc_lcid);
 1006         return l2cap_send_signal(chan->lc_link, L2CAP_CONNECT_REQ,
chan->lc_link->hl_lastid, sizeof(cp), &cp);
 1008 }
 1010 /*
 1011  * Send Config Request
 1012  *
 1013  * For outgoing config request, we only put options in the packet if they
 1014  * differ from the default and would have to be actioned. We dont support
 1015  * enough option types to make overflowing SigMTU an issue so it can all
 1016  * go in one packet.
 1017  */
 1018 int
l2cap_send_config_req(struct l2cap_channel *chan)
 1020 {
l2cap_cfg_req_cp *cp;
l2cap_cfg_opt_t *opt;
l2cap_cfg_opt_val_t *val;
uint8_t *next, buf[L2CAP_MTU_MINIMUM];
 1025         int err;
err = l2cap_request_alloc(chan, L2CAP_CONFIG_REQ);
 1028         if (err)
 1029                 return err;
 1031         /* Config Header (4 octets) */
cp = (l2cap_cfg_req_cp *)buf;
cp->dcid = htole16(chan->lc_rcid);
cp->flags = 0;  /* "No Continuation" */
next = buf + sizeof(l2cap_cfg_req_cp);
 1038         /* Incoming MTU (4 octets) */
 1039         if (chan->lc_imtu != L2CAP_MTU_DEFAULT) {
opt = (l2cap_cfg_opt_t *)next;
opt->type = L2CAP_OPT_MTU;
opt->length = L2CAP_OPT_MTU_SIZE;
val = (l2cap_cfg_opt_val_t *)(opt + 1);
val->mtu = htole16(chan->lc_imtu);
next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_MTU_SIZE;
 1048         }
 1050         /* Flush Timeout (4 octets) */
 1051         if (chan->lc_flush != L2CAP_FLUSH_TIMO_DEFAULT) {
opt = (l2cap_cfg_opt_t *)next;
opt->type = L2CAP_OPT_FLUSH_TIMO;
opt->length = L2CAP_OPT_FLUSH_TIMO_SIZE;
val = (l2cap_cfg_opt_val_t *)(opt + 1);
val->flush_timo = htole16(chan->lc_flush);
next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_FLUSH_TIMO_SIZE;
 1060         }
 1062         /* Outgoing QoS Flow (24 octets) */
 1063         /* Retransmission & Flow Control (11 octets) */
 1064         /*
 1065          * From here we need to start paying attention to SigMTU as we have
 1066          * possibly overflowed the minimum supported..
 1067          */
 1069         return l2cap_send_signal(chan->lc_link, L2CAP_CONFIG_REQ,
chan->lc_link->hl_lastid, (int)(next - buf), buf);
 1071 }
 1073 /*
 1074  * Send Disconnect Request
 1075  */
 1076 int
l2cap_send_disconnect_req(struct l2cap_channel *chan)
 1078 {
l2cap_discon_req_cp cp;
 1080         int err;
err = l2cap_request_alloc(chan, L2CAP_DISCONNECT_REQ);
 1083         if (err)
 1084                 return err;
cp.dcid = htole16(chan->lc_rcid);
cp.scid = htole16(chan->lc_lcid);
 1089         return l2cap_send_signal(chan->lc_link, L2CAP_DISCONNECT_REQ,
chan->lc_link->hl_lastid, sizeof(cp), &cp);
 1091 }
 1093 /*
 1094  * Send Connect Response
 1095  */
 1096 int
l2cap_send_connect_rsp(struct hci_link *link, uint8_t ident, uint16_t dcid,
uint16_t scid, uint16_t result)
 1099 {
l2cap_con_rsp_cp cp;
memset(&cp, 0, sizeof(cp));
cp.dcid = htole16(dcid);
cp.scid = htole16(scid);
cp.result = htole16(result);
 1107         return l2cap_send_signal(link, L2CAP_CONNECT_RSP, ident, sizeof(cp), &cp);
 1108 }