1 /* $DragonFly: src/sys/netbt/hci_link.c,v 1.2 2008/03/18 13:41:42 hasso Exp $ */
2 /* $OpenBSD: src/sys/netbt/hci_link.c,v 1.7 2008/02/24 21:34:48 uwe Exp $ */
3 /* $NetBSD: hci_link.c,v 1.16 2007/11/10 23:12:22 plunky Exp $ */
6 * Copyright (c) 2005 Iain Hibbert.
7 * Copyright (c) 2006 Itronix Inc.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. The name of Itronix Inc. may not be used to endorse
19 * or promote products derived from this software without specific
20 * prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
26 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
27 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
29 * ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32 * POSSIBILITY OF SUCH DAMAGE.
35 #include <sys/param.h>
36 #include <sys/kernel.h>
37 #include <sys/malloc.h>
40 #include <sys/queue.h>
41 #include <sys/systm.h>
42 #include <sys/endian.h>
43 #include <sys/callout.h>
47 #include <netbt/bluetooth.h>
48 #include <netbt/hci.h>
49 #include <netbt/l2cap.h>
50 #include <netbt/sco.h>
52 /*******************************************************************************
58 * Automatically expire unused ACL connections after this number of
59 * seconds (if zero, do not expire unused connections) [sysctl]
61 int hci_acl_expiry = 10; /* seconds */
64 * hci_acl_open(unit, bdaddr)
66 * open ACL connection to remote bdaddr. Only one ACL connection is permitted
67 * between any two Bluetooth devices, so we look for an existing one before
68 * trying to start a new one.
71 hci_acl_open(struct hci_unit *unit, bdaddr_t *bdaddr)
73 struct hci_link *link;
74 struct hci_memo *memo;
78 KKASSERT(unit != NULL);
79 KKASSERT(bdaddr != NULL);
81 link = hci_link_lookup_bdaddr(unit, bdaddr, HCI_LINK_ACL);
83 link = hci_link_alloc(unit);
87 link->hl_type = HCI_LINK_ACL;
88 bdaddr_copy(&link->hl_bdaddr, bdaddr);
91 switch(link->hl_state) {
94 * open connection to remote device
96 memset(&cp, 0, sizeof(cp));
97 bdaddr_copy(&cp.bdaddr, bdaddr);
98 cp.pkt_type = htole16(unit->hci_packet_type);
100 memo = hci_memo_find(unit, bdaddr);
102 cp.page_scan_rep_mode = memo->page_scan_rep_mode;
103 cp.page_scan_mode = memo->page_scan_mode;
104 cp.clock_offset = memo->clock_offset;
107 if (unit->hci_link_policy & HCI_LINK_POLICY_ENABLE_ROLE_SWITCH)
108 cp.accept_role_switch = 1;
110 err = hci_send_cmd(unit, HCI_CMD_CREATE_CON, &cp, sizeof(cp));
112 hci_link_free(link, err);
116 link->hl_state = HCI_LINK_WAIT_CONNECT;
119 case HCI_LINK_WAIT_CONNECT:
120 case HCI_LINK_WAIT_AUTH:
121 case HCI_LINK_WAIT_ENCRYPT:
122 case HCI_LINK_WAIT_SECURE:
124 * somebody else already trying to connect, we just
125 * sit on the bench with them..
131 * If already open, halt any expiry callouts. We dont need
132 * to care about already invoking callouts since refcnt >0
133 * will keep the link alive.
135 callout_stop(&link->hl_expire);
139 UNKNOWN(link->hl_state);
150 * Close ACL connection. When there are no more references to this link,
151 * we can either close it down or schedule a delayed closedown.
154 hci_acl_close(struct hci_link *link, int err)
156 KKASSERT(link != NULL);
158 if (--link->hl_refcnt == 0) {
159 if (link->hl_state == HCI_LINK_CLOSED)
160 hci_link_free(link, err);
161 else if (hci_acl_expiry > 0)
162 callout_reset(&link->hl_expire, hci_acl_expiry * hz,
163 hci_acl_timeout, link);
168 * Incoming ACL connection.
170 * For now, we accept all connections but it would be better to check
171 * the L2CAP listen list and only accept when there is a listener
174 * There should not be a link to the same bdaddr already, we check
175 * anyway though its left unhandled for now.
178 hci_acl_newconn(struct hci_unit *unit, bdaddr_t *bdaddr)
180 struct hci_link *link;
182 link = hci_link_lookup_bdaddr(unit, bdaddr, HCI_LINK_ACL);
186 link = hci_link_alloc(unit);
188 link->hl_state = HCI_LINK_WAIT_CONNECT;
189 link->hl_type = HCI_LINK_ACL;
190 bdaddr_copy(&link->hl_bdaddr, bdaddr);
192 if (hci_acl_expiry > 0)
193 callout_reset(&link->hl_expire, hci_acl_expiry * hz,
194 hci_acl_timeout, link);
201 hci_acl_timeout(void *arg)
203 struct hci_link *link = arg;
209 if (link->hl_refcnt > 0)
212 DPRINTF("link #%d expired\n", link->hl_handle);
214 switch (link->hl_state) {
215 case HCI_LINK_CLOSED:
216 case HCI_LINK_WAIT_CONNECT:
217 hci_link_free(link, ECONNRESET);
220 case HCI_LINK_WAIT_AUTH:
221 case HCI_LINK_WAIT_ENCRYPT:
222 case HCI_LINK_WAIT_SECURE:
224 cp.con_handle = htole16(link->hl_handle);
225 cp.reason = 0x13; /* "Remote User Terminated Connection" */
227 err = hci_send_cmd(link->hl_unit, HCI_CMD_DISCONNECT,
231 DPRINTF("error %d sending HCI_CMD_DISCONNECT\n",
238 UNKNOWN(link->hl_state);
247 * Initiate any Link Mode change requests.
250 hci_acl_setmode(struct hci_link *link)
254 KKASSERT(link != NULL);
255 KKASSERT(link->hl_unit != NULL);
257 if (link->hl_state != HCI_LINK_OPEN)
260 if ((link->hl_flags & HCI_LINK_AUTH_REQ)
261 && !(link->hl_flags & HCI_LINK_AUTH)) {
264 DPRINTF("(%s) requesting auth for handle #%d\n",
265 device_get_nameunit(link->hl_unit->hci_dev),
268 link->hl_state = HCI_LINK_WAIT_AUTH;
269 cp.con_handle = htole16(link->hl_handle);
270 err = hci_send_cmd(link->hl_unit, HCI_CMD_AUTH_REQ,
273 return (err == 0 ? EINPROGRESS : err);
276 if ((link->hl_flags & HCI_LINK_ENCRYPT_REQ)
277 && !(link->hl_flags & HCI_LINK_ENCRYPT)) {
278 hci_set_con_encryption_cp cp;
280 /* XXX we should check features for encryption capability */
282 DPRINTF("(%s) requesting encryption for handle #%d\n",
283 device_get_nameunit(link->hl_unit->hci_dev),
286 link->hl_state = HCI_LINK_WAIT_ENCRYPT;
287 cp.con_handle = htole16(link->hl_handle);
288 cp.encryption_enable = 0x01;
290 err = hci_send_cmd(link->hl_unit, HCI_CMD_SET_CON_ENCRYPTION,
293 return (err == 0 ? EINPROGRESS : err);
296 if ((link->hl_flags & HCI_LINK_SECURE_REQ)) {
297 hci_change_con_link_key_cp cp;
299 /* always change link key for SECURE requests */
300 link->hl_flags &= ~HCI_LINK_SECURE;
302 DPRINTF("(%s) changing link key for handle #%d\n",
303 device_get_nameunit(link->hl_unit->hci_dev),
306 link->hl_state = HCI_LINK_WAIT_SECURE;
307 cp.con_handle = htole16(link->hl_handle);
309 err = hci_send_cmd(link->hl_unit, HCI_CMD_CHANGE_CON_LINK_KEY,
312 return (err == 0 ? EINPROGRESS : err);
321 * This is called from event handlers when the mode change
322 * is complete. We notify upstream and restart the link.
325 hci_acl_linkmode(struct hci_link *link)
327 struct l2cap_channel *chan, *next;
330 DPRINTF("(%s) handle #%d, auth %s, encrypt %s, secure %s\n",
331 device_get_nameunit(link->hl_unit->hci_dev), link->hl_handle,
332 (link->hl_flags & HCI_LINK_AUTH ? "on" : "off"),
333 (link->hl_flags & HCI_LINK_ENCRYPT ? "on" : "off"),
334 (link->hl_flags & HCI_LINK_SECURE ? "on" : "off"));
336 if (link->hl_flags & HCI_LINK_AUTH)
337 mode |= L2CAP_LM_AUTH;
339 if (link->hl_flags & HCI_LINK_ENCRYPT)
340 mode |= L2CAP_LM_ENCRYPT;
342 if (link->hl_flags & HCI_LINK_SECURE)
343 mode |= L2CAP_LM_SECURE;
346 * The link state will only be OPEN here if the mode change
347 * was successful. So, we can proceed with L2CAP connections,
348 * or notify already establshed channels, to allow any that
349 * are dissatisfied to disconnect before we restart.
351 next = LIST_FIRST(&l2cap_active_list);
352 while ((chan = next) != NULL) {
353 next = LIST_NEXT(chan, lc_ncid);
355 if (chan->lc_link != link)
358 switch(chan->lc_state) {
359 case L2CAP_WAIT_SEND_CONNECT_REQ: /* we are connecting */
360 if ((mode & chan->lc_mode) != chan->lc_mode) {
361 l2cap_close(chan, ECONNABORTED);
365 chan->lc_state = L2CAP_WAIT_RECV_CONNECT_RSP;
366 err = l2cap_send_connect_req(chan);
368 l2cap_close(chan, err);
373 case L2CAP_WAIT_SEND_CONNECT_RSP: /* they are connecting */
374 if ((mode & chan->lc_mode) != chan->lc_mode) {
375 l2cap_send_connect_rsp(link, chan->lc_ident,
377 L2CAP_SECURITY_BLOCK);
379 l2cap_close(chan, ECONNABORTED);
383 l2cap_send_connect_rsp(link, chan->lc_ident,
384 chan->lc_lcid, chan->lc_rcid,
387 chan->lc_state = L2CAP_WAIT_CONFIG;
388 chan->lc_flags |= (L2CAP_WAIT_CONFIG_RSP | L2CAP_WAIT_CONFIG_REQ);
389 err = l2cap_send_config_req(chan);
391 l2cap_close(chan, err);
396 case L2CAP_WAIT_RECV_CONNECT_RSP:
397 case L2CAP_WAIT_CONFIG:
398 case L2CAP_OPEN: /* already established */
399 (*chan->lc_proto->linkmode)(chan->lc_upper, mode);
407 link->hl_state = HCI_LINK_OPEN;
414 * we accumulate packet fragments on the hci_link structure
415 * until a full L2CAP frame is ready, then send it on.
418 hci_acl_recv(struct mbuf *m, struct hci_unit *unit)
420 struct hci_link *link;
421 hci_acldata_hdr_t hdr;
422 uint16_t handle, want;
426 KKASSERT(unit != NULL);
428 KKASSERT(m->m_pkthdr.len >= sizeof(hdr));
429 m_copydata(m, 0, sizeof(hdr), (caddr_t)&hdr);
430 m_adj(m, sizeof(hdr));
433 if (hdr.type != HCI_ACL_DATA_PKT) {
434 kprintf("%s: bad ACL packet type\n",
435 device_get_nameunit(unit->hci_dev));
439 if (m->m_pkthdr.len != letoh16(hdr.length)) {
440 kprintf("%s: bad ACL packet length (%d != %d)\n",
441 device_get_nameunit(unit->hci_dev), m->m_pkthdr.len,
442 letoh16(hdr.length));
447 hdr.length = letoh16(hdr.length);
448 hdr.con_handle = letoh16(hdr.con_handle);
449 handle = HCI_CON_HANDLE(hdr.con_handle);
450 pb = HCI_PB_FLAG(hdr.con_handle);
452 link = hci_link_lookup_handle(unit, handle);
456 DPRINTF("%s: dumping packet for unknown handle #%d\n",
457 device_get_nameunit(unit->hci_dev), handle);
460 * There is no way to find out what this connection handle is
461 * for, just get rid of it. This may happen, if a USB dongle
462 * is plugged into a self powered hub and does not reset when
463 * the system is shut down.
465 cp.con_handle = htole16(handle);
466 cp.reason = 0x13; /* "Remote User Terminated Connection" */
467 hci_send_cmd(unit, HCI_CMD_DISCONNECT, &cp, sizeof(cp));
472 case HCI_PACKET_START:
473 if (link->hl_rxp != NULL)
474 kprintf("%s: dropped incomplete ACL packet\n",
475 device_get_nameunit(unit->hci_dev));
477 if (m->m_pkthdr.len < sizeof(l2cap_hdr_t)) {
478 kprintf("%s: short ACL packet\n",
479 device_get_nameunit(unit->hci_dev));
485 got = m->m_pkthdr.len;
488 case HCI_PACKET_FRAGMENT:
489 if (link->hl_rxp == NULL) {
490 kprintf("%s: unexpected packet fragment\n",
491 device_get_nameunit(unit->hci_dev));
496 got = m->m_pkthdr.len + link->hl_rxp->m_pkthdr.len;
497 m_cat(link->hl_rxp, m);
499 m->m_pkthdr.len = got;
503 kprintf("%s: unknown packet type\n",
504 device_get_nameunit(unit->hci_dev));
509 m_copydata(m, 0, sizeof(want), (caddr_t)&want);
510 want = letoh16(want) + sizeof(l2cap_hdr_t) - got;
518 l2cap_recv_frame(m, link);
527 * Send ACL data on link
529 * We must fragment packets into chunks of less than unit->hci_max_acl_size and
530 * prepend a relevant ACL header to each fragment. We keep a PDU structure
531 * attached to the link, so that completed fragments can be marked off and
532 * more data requested from above once the PDU is sent.
535 hci_acl_send(struct mbuf *m, struct hci_link *link,
536 struct l2cap_channel *chan)
538 struct l2cap_pdu *pdu;
539 struct mbuf *n = NULL;
540 int plen, mlen, num = 0;
542 KKASSERT(link != NULL);
544 KKASSERT(m->m_flags & M_PKTHDR);
545 KKASSERT(m->m_pkthdr.len > 0);
547 if (link->hl_state == HCI_LINK_CLOSED) {
552 pdu = zalloc(l2cap_pdu_pool);
556 bzero(pdu, sizeof *pdu);
560 plen = m->m_pkthdr.len;
561 mlen = link->hl_unit->hci_max_acl_size;
563 DPRINTFN(5, "%s: handle #%d, plen = %d, max = %d\n",
564 device_get_nameunit(link->hl_unit->hci_dev),
565 link->hl_handle, plen, mlen);
569 n = m_split(m, mlen, MB_DONTWAIT);
577 m->m_flags |= M_PROTO1; /* tag first fragment */
579 DPRINTFN(10, "(%s) chunk of %d (plen = %d) bytes\n",
580 device_get_nameunit(link->hl_unit->hci_dev), mlen, plen);
581 IF_ENQUEUE(&pdu->lp_data, m);
586 TAILQ_INSERT_TAIL(&link->hl_txq, pdu, lp_next);
587 link->hl_txqlen += num;
596 IF_DRAIN(&pdu->lp_data);
597 zfree(l2cap_pdu_pool, pdu);
604 * Start sending ACL data on link.
606 * This is called when the queue may need restarting: as new data
607 * is queued, after link mode changes have completed, or when device
608 * buffers have cleared.
610 * We may use all the available packet slots. The reason that we add
611 * the ACL encapsulation here rather than in hci_acl_send() is that L2CAP
612 * signal packets may be queued before the handle is given to us..
615 hci_acl_start(struct hci_link *link)
617 struct hci_unit *unit;
618 hci_acldata_hdr_t *hdr;
619 struct l2cap_pdu *pdu;
623 KKASSERT(link != NULL);
625 unit = link->hl_unit;
626 KKASSERT(unit != NULL);
628 /* this is mainly to block ourselves (below) */
629 if (link->hl_state != HCI_LINK_OPEN)
632 if (link->hl_txqlen == 0 || unit->hci_num_acl_pkts == 0)
635 /* find first PDU with data to send */
636 pdu = TAILQ_FIRST(&link->hl_txq);
641 if (!IF_QEMPTY(&pdu->lp_data))
644 pdu = TAILQ_NEXT(pdu, lp_next);
647 while (unit->hci_num_acl_pkts > 0) {
648 IF_DEQUEUE(&pdu->lp_data, m);
651 if (m->m_flags & M_PROTO1)
652 handle = HCI_MK_CON_HANDLE(link->hl_handle,
653 HCI_PACKET_START, 0);
655 handle = HCI_MK_CON_HANDLE(link->hl_handle,
656 HCI_PACKET_FRAGMENT, 0);
658 M_PREPEND(m, sizeof(*hdr), MB_DONTWAIT);
662 hdr = mtod(m, hci_acldata_hdr_t *);
663 hdr->type = HCI_ACL_DATA_PKT;
664 hdr->con_handle = htole16(handle);
665 hdr->length = htole16(m->m_pkthdr.len - sizeof(*hdr));
670 hci_output_acl(unit, m);
672 if (IF_QEMPTY(&pdu->lp_data)) {
675 * This should enable streaming of PDUs - when
676 * we have placed all the fragments on the acl
677 * output queue, we trigger the L2CAP layer to
678 * send us down one more. Use a false state so
679 * we dont run into ourselves coming back from
682 link->hl_state = HCI_LINK_BLOCK;
683 l2cap_start(pdu->lp_chan);
684 link->hl_state = HCI_LINK_OPEN;
687 pdu = TAILQ_NEXT(pdu, lp_next);
694 * We had our turn now, move to the back of the queue to let
695 * other links have a go at the output buffers..
697 if (TAILQ_NEXT(link, hl_next)) {
698 TAILQ_REMOVE(&unit->hci_links, link, hl_next);
699 TAILQ_INSERT_TAIL(&unit->hci_links, link, hl_next);
704 * Confirm ACL packets cleared from Controller buffers. We scan our PDU
705 * list to clear pending fragments and signal upstream for more data
706 * when a PDU is complete.
709 hci_acl_complete(struct hci_link *link, int num)
711 struct l2cap_pdu *pdu;
712 struct l2cap_channel *chan;
714 DPRINTFN(5, "(%s) handle #%d (%d)\n",
715 device_get_nameunit(link->hl_unit->hci_dev), link->hl_handle, num);
718 pdu = TAILQ_FIRST(&link->hl_txq);
720 kprintf("%s: %d packets completed on handle #%x "
721 "but none pending!\n",
722 device_get_nameunit(link->hl_unit->hci_dev),
723 num, link->hl_handle);
727 if (num >= pdu->lp_pending) {
728 num -= pdu->lp_pending;
731 if (IF_QEMPTY(&pdu->lp_data)) {
732 TAILQ_REMOVE(&link->hl_txq, pdu, lp_next);
736 (*chan->lc_proto->complete)
739 if (chan->lc_pending == 0)
743 zfree(l2cap_pdu_pool, pdu);
746 pdu->lp_pending -= num;
752 /*******************************************************************************
754 * HCI SCO Connections
758 * Incoming SCO Connection. We check the list for anybody willing
762 hci_sco_newconn(struct hci_unit *unit, bdaddr_t *bdaddr)
764 struct sockaddr_bt laddr, raddr;
765 struct sco_pcb *pcb, *new;
766 struct hci_link *sco, *acl;
768 memset(&laddr, 0, sizeof(laddr));
769 laddr.bt_len = sizeof(laddr);
770 laddr.bt_family = AF_BLUETOOTH;
771 bdaddr_copy(&laddr.bt_bdaddr, &unit->hci_bdaddr);
773 memset(&raddr, 0, sizeof(raddr));
774 raddr.bt_len = sizeof(raddr);
775 raddr.bt_family = AF_BLUETOOTH;
776 bdaddr_copy(&raddr.bt_bdaddr, bdaddr);
779 * There should already be an ACL link up and running before
780 * the controller sends us SCO connection requests, but you
783 acl = hci_link_lookup_bdaddr(unit, bdaddr, HCI_LINK_ACL);
784 if (acl == NULL || acl->hl_state != HCI_LINK_OPEN)
787 LIST_FOREACH(pcb, &sco_pcb, sp_next) {
788 if ((pcb->sp_flags & SP_LISTENING) == 0)
791 new = (*pcb->sp_proto->newconn)(pcb->sp_upper, &laddr, &raddr);
796 * Ok, got new pcb so we can start a new link and fill
797 * in all the details.
799 bdaddr_copy(&new->sp_laddr, &unit->hci_bdaddr);
800 bdaddr_copy(&new->sp_raddr, bdaddr);
802 sco = hci_link_alloc(unit);
808 sco->hl_type = HCI_LINK_SCO;
809 bdaddr_copy(&sco->hl_bdaddr, bdaddr);
811 sco->hl_link = hci_acl_open(unit, bdaddr);
812 KKASSERT(sco->hl_link == acl);
817 new->sp_mtu = unit->hci_max_sco_size;
825 * receive SCO packet, we only need to strip the header and send
826 * it to the right handler
829 hci_sco_recv(struct mbuf *m, struct hci_unit *unit)
831 struct hci_link *link;
832 hci_scodata_hdr_t hdr;
836 KKASSERT(unit != NULL);
838 KKASSERT(m->m_pkthdr.len >= sizeof(hdr));
839 m_copydata(m, 0, sizeof(hdr), (caddr_t)&hdr);
840 m_adj(m, sizeof(hdr));
843 if (hdr.type != HCI_SCO_DATA_PKT) {
844 kprintf("%s: bad SCO packet type\n",
845 device_get_nameunit(unit->hci_dev));
849 if (m->m_pkthdr.len != hdr.length) {
850 kprintf("%s: bad SCO packet length (%d != %d)\n",
851 device_get_nameunit(unit->hci_dev), m->m_pkthdr.len,
857 hdr.con_handle = letoh16(hdr.con_handle);
858 handle = HCI_CON_HANDLE(hdr.con_handle);
860 link = hci_link_lookup_handle(unit, handle);
861 if (link == NULL || link->hl_type == HCI_LINK_ACL) {
862 DPRINTF("%s: dumping packet for unknown handle #%d\n",
863 device_get_nameunit(unit->hci_dev), handle);
868 (*link->hl_sco->sp_proto->input)(link->hl_sco->sp_upper, m);
876 hci_sco_start(struct hci_link *link)
881 * SCO packets have completed at the controller, so we can
882 * signal up to free the buffer space.
885 hci_sco_complete(struct hci_link *link, int num)
888 DPRINTFN(5, "handle #%d (num=%d)\n", link->hl_handle, num);
889 link->hl_sco->sp_pending--;
890 (*link->hl_sco->sp_proto->complete)(link->hl_sco->sp_upper, num);
893 /*******************************************************************************
895 * Generic HCI Connection alloc/free/lookup etc
899 hci_link_alloc(struct hci_unit *unit)
901 struct hci_link *link;
903 KKASSERT(unit != NULL);
905 link = kmalloc(sizeof *link, M_BLUETOOTH, M_NOWAIT | M_ZERO);
909 link->hl_unit = unit;
910 link->hl_state = HCI_LINK_CLOSED;
912 /* init ACL portion */
913 callout_init(&link->hl_expire);
916 TAILQ_INIT(&link->hl_txq); /* outgoing packets */
917 TAILQ_INIT(&link->hl_reqs); /* request queue */
919 link->hl_mtu = L2CAP_MTU_DEFAULT; /* L2CAP signal mtu */
920 link->hl_flush = L2CAP_FLUSH_TIMO_DEFAULT; /* flush timeout */
922 /* init SCO portion */
923 /* &link->hl_data is already zero-initialized. */
926 TAILQ_INSERT_HEAD(&unit->hci_links, link, hl_next);
932 hci_link_free(struct hci_link *link, int err)
934 struct l2cap_req *req;
935 struct l2cap_pdu *pdu;
936 struct l2cap_channel *chan, *next;
938 KKASSERT(link != NULL);
940 DPRINTF("(%s) #%d, type = %d, state = %d, refcnt = %d\n",
941 device_get_nameunit(link->hl_unit->hci_dev), link->hl_handle,
942 link->hl_type, link->hl_state, link->hl_refcnt);
944 /* ACL reference count */
945 if (link->hl_refcnt > 0) {
946 next = LIST_FIRST(&l2cap_active_list);
947 while ((chan = next) != NULL) {
948 next = LIST_NEXT(chan, lc_ncid);
949 if (chan->lc_link == link)
950 l2cap_close(chan, err);
953 KKASSERT(link->hl_refcnt == 0);
955 /* ACL L2CAP requests.. */
956 while ((req = TAILQ_FIRST(&link->hl_reqs)) != NULL)
957 l2cap_request_free(req);
959 KKASSERT(TAILQ_EMPTY(&link->hl_reqs));
961 /* ACL outgoing data queue */
962 while ((pdu = TAILQ_FIRST(&link->hl_txq)) != NULL) {
963 TAILQ_REMOVE(&link->hl_txq, pdu, lp_next);
964 IF_DRAIN(&pdu->lp_data);
966 link->hl_unit->hci_num_acl_pkts += pdu->lp_pending;
968 zfree(l2cap_pdu_pool, pdu);
971 KKASSERT(TAILQ_EMPTY(&link->hl_txq));
973 /* ACL incoming data packet */
974 if (link->hl_rxp != NULL) {
975 m_freem(link->hl_rxp);
979 /* SCO master ACL link */
980 if (link->hl_link != NULL) {
981 hci_acl_close(link->hl_link, err);
982 link->hl_link = NULL;
986 if (link->hl_sco != NULL) {
992 (*pcb->sp_proto->disconnected)(pcb->sp_upper, err);
995 /* flush any SCO data */
997 IF_DRAIN(&link->hl_data);
1001 * Halt the timeout - if its already running we cannot free the
1002 * link structure but the timeout function will call us back in
1005 link->hl_state = HCI_LINK_CLOSED;
1006 callout_stop(&link->hl_expire);
1007 if (callout_active(&link->hl_expire))
1011 * If we made a note of clock offset, keep it in a memo
1012 * to facilitate reconnections to this device
1014 if (link->hl_clock != 0) {
1015 struct hci_memo *memo;
1017 memo = hci_memo_new(link->hl_unit, &link->hl_bdaddr);
1019 memo->clock_offset = link->hl_clock;
1023 TAILQ_REMOVE(&link->hl_unit->hci_links, link, hl_next);
1025 kfree(link, M_BLUETOOTH);
1029 * Lookup HCI link by type and state.
1032 hci_link_lookup_state(struct hci_unit *unit, uint16_t type, uint16_t state)
1034 struct hci_link *link;
1036 TAILQ_FOREACH(link, &unit->hci_links, hl_next) {
1037 if (link->hl_type == type && link->hl_state == state)
1045 * Lookup HCI link by address and type. Note that for SCO links there may
1046 * be more than one link per address, so we only return links with no
1047 * handle (ie new links)
1050 hci_link_lookup_bdaddr(struct hci_unit *unit, bdaddr_t *bdaddr, uint16_t type)
1052 struct hci_link *link;
1054 KKASSERT(unit != NULL);
1055 KKASSERT(bdaddr != NULL);
1057 TAILQ_FOREACH(link, &unit->hci_links, hl_next) {
1058 if (link->hl_type != type)
1061 if (type == HCI_LINK_SCO && link->hl_handle != 0)
1064 if (bdaddr_same(&link->hl_bdaddr, bdaddr))
1072 hci_link_lookup_handle(struct hci_unit *unit, uint16_t handle)
1074 struct hci_link *link;
1076 KKASSERT(unit != NULL);
1078 TAILQ_FOREACH(link, &unit->hci_links, hl_next) {
1079 if (handle == link->hl_handle)