Home | History | Annotate | Line # | Download | only in netbt
hci_link.c revision 1.18
      1  1.18    plunky /*	$NetBSD: hci_link.c,v 1.18 2008/03/16 23:14:24 plunky Exp $	*/
      2   1.1   gdamore 
      3   1.1   gdamore /*-
      4   1.1   gdamore  * Copyright (c) 2005 Iain Hibbert.
      5   1.1   gdamore  * Copyright (c) 2006 Itronix Inc.
      6   1.1   gdamore  * All rights reserved.
      7   1.1   gdamore  *
      8   1.1   gdamore  * Redistribution and use in source and binary forms, with or without
      9   1.1   gdamore  * modification, are permitted provided that the following conditions
     10   1.1   gdamore  * are met:
     11   1.1   gdamore  * 1. Redistributions of source code must retain the above copyright
     12   1.1   gdamore  *    notice, this list of conditions and the following disclaimer.
     13   1.1   gdamore  * 2. Redistributions in binary form must reproduce the above copyright
     14   1.1   gdamore  *    notice, this list of conditions and the following disclaimer in the
     15   1.1   gdamore  *    documentation and/or other materials provided with the distribution.
     16   1.1   gdamore  * 3. The name of Itronix Inc. may not be used to endorse
     17   1.1   gdamore  *    or promote products derived from this software without specific
     18   1.1   gdamore  *    prior written permission.
     19   1.1   gdamore  *
     20   1.1   gdamore  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
     21   1.1   gdamore  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     22   1.1   gdamore  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     23   1.1   gdamore  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
     24   1.1   gdamore  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     25   1.1   gdamore  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     26   1.1   gdamore  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
     27   1.1   gdamore  * ON ANY THEORY OF LIABILITY, WHETHER IN
     28   1.1   gdamore  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     29   1.1   gdamore  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30   1.1   gdamore  * POSSIBILITY OF SUCH DAMAGE.
     31   1.1   gdamore  */
     32   1.1   gdamore 
     33   1.1   gdamore #include <sys/cdefs.h>
     34  1.18    plunky __KERNEL_RCSID(0, "$NetBSD: hci_link.c,v 1.18 2008/03/16 23:14:24 plunky Exp $");
     35   1.1   gdamore 
     36   1.1   gdamore #include <sys/param.h>
     37   1.1   gdamore #include <sys/kernel.h>
     38   1.1   gdamore #include <sys/malloc.h>
     39   1.1   gdamore #include <sys/mbuf.h>
     40   1.1   gdamore #include <sys/proc.h>
     41   1.1   gdamore #include <sys/queue.h>
     42   1.1   gdamore #include <sys/systm.h>
     43   1.1   gdamore 
     44   1.1   gdamore #include <netbt/bluetooth.h>
     45   1.1   gdamore #include <netbt/hci.h>
     46   1.2      tron #include <netbt/l2cap.h>
     47   1.1   gdamore #include <netbt/sco.h>
     48   1.1   gdamore 
     49   1.1   gdamore /*******************************************************************************
     50   1.1   gdamore  *
     51   1.1   gdamore  *	HCI ACL Connections
     52   1.1   gdamore  */
     53   1.1   gdamore 
     54   1.1   gdamore /*
     55   1.1   gdamore  * Automatically expire unused ACL connections after this number of
     56   1.1   gdamore  * seconds (if zero, do not expire unused connections) [sysctl]
     57   1.1   gdamore  */
     58   1.1   gdamore int hci_acl_expiry = 10;	/* seconds */
     59   1.1   gdamore 
     60   1.1   gdamore /*
     61   1.1   gdamore  * hci_acl_open(unit, bdaddr)
     62   1.1   gdamore  *
     63   1.1   gdamore  * open ACL connection to remote bdaddr. Only one ACL connection is permitted
     64   1.1   gdamore  * between any two Bluetooth devices, so we look for an existing one before
     65   1.1   gdamore  * trying to start a new one.
     66   1.1   gdamore  */
     67   1.1   gdamore struct hci_link *
     68   1.1   gdamore hci_acl_open(struct hci_unit *unit, bdaddr_t *bdaddr)
     69   1.1   gdamore {
     70   1.1   gdamore 	struct hci_link *link;
     71   1.2      tron 	struct hci_memo *memo;
     72   1.1   gdamore 	hci_create_con_cp cp;
     73   1.1   gdamore 	int err;
     74   1.1   gdamore 
     75  1.10    plunky 	KASSERT(unit != NULL);
     76  1.10    plunky 	KASSERT(bdaddr != NULL);
     77   1.1   gdamore 
     78   1.1   gdamore 	link = hci_link_lookup_bdaddr(unit, bdaddr, HCI_LINK_ACL);
     79   1.1   gdamore 	if (link == NULL) {
     80   1.1   gdamore 		link = hci_link_alloc(unit);
     81   1.1   gdamore 		if (link == NULL)
     82   1.1   gdamore 			return NULL;
     83   1.1   gdamore 
     84   1.1   gdamore 		link->hl_type = HCI_LINK_ACL;
     85   1.1   gdamore 		bdaddr_copy(&link->hl_bdaddr, bdaddr);
     86   1.1   gdamore 	}
     87   1.1   gdamore 
     88   1.1   gdamore 	switch(link->hl_state) {
     89   1.1   gdamore 	case HCI_LINK_CLOSED:
     90   1.1   gdamore 		/*
     91   1.1   gdamore 		 * open connection to remote device
     92   1.1   gdamore 		 */
     93   1.1   gdamore 		memset(&cp, 0, sizeof(cp));
     94   1.1   gdamore 		bdaddr_copy(&cp.bdaddr, bdaddr);
     95   1.1   gdamore 		cp.pkt_type = htole16(unit->hci_packet_type);
     96   1.2      tron 
     97   1.2      tron 		memo = hci_memo_find(unit, bdaddr);
     98   1.2      tron 		if (memo != NULL) {
     99  1.13    plunky 			cp.page_scan_rep_mode = memo->page_scan_rep_mode;
    100  1.13    plunky 			cp.page_scan_mode = memo->page_scan_mode;
    101  1.13    plunky 			cp.clock_offset = memo->clock_offset;
    102   1.2      tron 		}
    103   1.2      tron 
    104   1.1   gdamore 		if (unit->hci_link_policy & HCI_LINK_POLICY_ENABLE_ROLE_SWITCH)
    105   1.1   gdamore 			cp.accept_role_switch = 1;
    106   1.1   gdamore 
    107   1.1   gdamore 		err = hci_send_cmd(unit, HCI_CMD_CREATE_CON, &cp, sizeof(cp));
    108   1.1   gdamore 		if (err) {
    109   1.1   gdamore 			hci_link_free(link, err);
    110   1.1   gdamore 			return NULL;
    111   1.1   gdamore 		}
    112   1.1   gdamore 
    113  1.17    plunky 		link->hl_flags |= HCI_LINK_CREATE_CON;
    114   1.1   gdamore 		link->hl_state = HCI_LINK_WAIT_CONNECT;
    115   1.1   gdamore 		break;
    116   1.1   gdamore 
    117   1.1   gdamore 	case HCI_LINK_WAIT_CONNECT:
    118  1.11    plunky 	case HCI_LINK_WAIT_AUTH:
    119  1.11    plunky 	case HCI_LINK_WAIT_ENCRYPT:
    120  1.11    plunky 	case HCI_LINK_WAIT_SECURE:
    121   1.1   gdamore 		/*
    122   1.1   gdamore 		 * somebody else already trying to connect, we just
    123   1.1   gdamore 		 * sit on the bench with them..
    124   1.1   gdamore 		 */
    125   1.1   gdamore 		break;
    126   1.1   gdamore 
    127   1.1   gdamore 	case HCI_LINK_OPEN:
    128   1.1   gdamore 		/*
    129   1.1   gdamore 		 * If already open, halt any expiry timeouts. We dont need
    130   1.1   gdamore 		 * to care about already invoking timeouts since refcnt >0
    131   1.1   gdamore 		 * will keep the link alive.
    132   1.1   gdamore 		 */
    133   1.1   gdamore 		callout_stop(&link->hl_expire);
    134   1.1   gdamore 		break;
    135   1.1   gdamore 
    136   1.1   gdamore 	default:
    137   1.1   gdamore 		UNKNOWN(link->hl_state);
    138   1.1   gdamore 		return NULL;
    139   1.1   gdamore 	}
    140   1.1   gdamore 
    141   1.1   gdamore 	/* open */
    142   1.1   gdamore 	link->hl_refcnt++;
    143   1.1   gdamore 
    144   1.1   gdamore 	return link;
    145   1.1   gdamore }
    146   1.1   gdamore 
    147   1.1   gdamore /*
    148   1.1   gdamore  * Close ACL connection. When there are no more references to this link,
    149   1.1   gdamore  * we can either close it down or schedule a delayed closedown.
    150   1.1   gdamore  */
    151   1.1   gdamore void
    152   1.1   gdamore hci_acl_close(struct hci_link *link, int err)
    153   1.1   gdamore {
    154   1.1   gdamore 
    155  1.10    plunky 	KASSERT(link != NULL);
    156   1.1   gdamore 
    157   1.1   gdamore 	if (--link->hl_refcnt == 0) {
    158   1.1   gdamore 		if (link->hl_state == HCI_LINK_CLOSED)
    159   1.1   gdamore 			hci_link_free(link, err);
    160   1.1   gdamore 		else if (hci_acl_expiry > 0)
    161   1.1   gdamore 			callout_schedule(&link->hl_expire, hci_acl_expiry * hz);
    162   1.1   gdamore 	}
    163   1.1   gdamore }
    164   1.1   gdamore 
    165   1.1   gdamore /*
    166   1.3      tron  * Incoming ACL connection.
    167   1.3      tron  *
    168   1.3      tron  * For now, we accept all connections but it would be better to check
    169   1.3      tron  * the L2CAP listen list and only accept when there is a listener
    170   1.3      tron  * available.
    171   1.3      tron  *
    172   1.3      tron  * There should not be a link to the same bdaddr already, we check
    173   1.3      tron  * anyway though its left unhandled for now.
    174   1.1   gdamore  */
    175   1.1   gdamore struct hci_link *
    176   1.1   gdamore hci_acl_newconn(struct hci_unit *unit, bdaddr_t *bdaddr)
    177   1.1   gdamore {
    178   1.1   gdamore 	struct hci_link *link;
    179   1.1   gdamore 
    180   1.3      tron 	link = hci_link_lookup_bdaddr(unit, bdaddr, HCI_LINK_ACL);
    181   1.3      tron 	if (link != NULL)
    182   1.3      tron 		return NULL;
    183   1.3      tron 
    184   1.1   gdamore 	link = hci_link_alloc(unit);
    185   1.1   gdamore 	if (link != NULL) {
    186   1.1   gdamore 		link->hl_state = HCI_LINK_WAIT_CONNECT;
    187   1.1   gdamore 		link->hl_type = HCI_LINK_ACL;
    188   1.1   gdamore 		bdaddr_copy(&link->hl_bdaddr, bdaddr);
    189   1.1   gdamore 
    190   1.1   gdamore 		if (hci_acl_expiry > 0)
    191   1.1   gdamore 			callout_schedule(&link->hl_expire, hci_acl_expiry * hz);
    192   1.1   gdamore 	}
    193   1.1   gdamore 
    194   1.1   gdamore 	return link;
    195   1.1   gdamore }
    196   1.1   gdamore 
    197   1.1   gdamore void
    198   1.1   gdamore hci_acl_timeout(void *arg)
    199   1.1   gdamore {
    200   1.1   gdamore 	struct hci_link *link = arg;
    201   1.1   gdamore 	hci_discon_cp cp;
    202   1.1   gdamore 	int s, err;
    203   1.1   gdamore 
    204   1.1   gdamore 	s = splsoftnet();
    205   1.1   gdamore 	callout_ack(&link->hl_expire);
    206   1.1   gdamore 
    207   1.1   gdamore 	if (link->hl_refcnt > 0)
    208   1.1   gdamore 		goto out;
    209   1.1   gdamore 
    210   1.1   gdamore 	DPRINTF("link #%d expired\n", link->hl_handle);
    211   1.1   gdamore 
    212   1.1   gdamore 	switch (link->hl_state) {
    213   1.1   gdamore 	case HCI_LINK_CLOSED:
    214   1.1   gdamore 	case HCI_LINK_WAIT_CONNECT:
    215   1.1   gdamore 		hci_link_free(link, ECONNRESET);
    216   1.1   gdamore 		break;
    217   1.1   gdamore 
    218  1.11    plunky 	case HCI_LINK_WAIT_AUTH:
    219  1.11    plunky 	case HCI_LINK_WAIT_ENCRYPT:
    220  1.11    plunky 	case HCI_LINK_WAIT_SECURE:
    221   1.1   gdamore 	case HCI_LINK_OPEN:
    222   1.1   gdamore 		cp.con_handle = htole16(link->hl_handle);
    223   1.1   gdamore 		cp.reason = 0x13; /* "Remote User Terminated Connection" */
    224   1.1   gdamore 
    225   1.1   gdamore 		err = hci_send_cmd(link->hl_unit, HCI_CMD_DISCONNECT,
    226   1.1   gdamore 					&cp, sizeof(cp));
    227   1.1   gdamore 
    228   1.6  christos 		if (err) {
    229   1.1   gdamore 			DPRINTF("error %d sending HCI_CMD_DISCONNECT\n",
    230   1.6  christos 			    err);
    231   1.6  christos 		}
    232   1.1   gdamore 
    233   1.1   gdamore 		break;
    234   1.1   gdamore 
    235   1.1   gdamore 	default:
    236   1.1   gdamore 		UNKNOWN(link->hl_state);
    237   1.1   gdamore 		break;
    238   1.1   gdamore 	}
    239   1.1   gdamore 
    240   1.1   gdamore out:
    241   1.1   gdamore 	splx(s);
    242   1.1   gdamore }
    243   1.1   gdamore 
    244   1.1   gdamore /*
    245  1.11    plunky  * Initiate any Link Mode change requests.
    246  1.11    plunky  */
    247  1.11    plunky int
    248  1.11    plunky hci_acl_setmode(struct hci_link *link)
    249  1.11    plunky {
    250  1.11    plunky 	int err;
    251  1.11    plunky 
    252  1.11    plunky 	KASSERT(link != NULL);
    253  1.11    plunky 	KASSERT(link->hl_unit != NULL);
    254  1.11    plunky 
    255  1.11    plunky 	if (link->hl_state != HCI_LINK_OPEN)
    256  1.11    plunky 		return EINPROGRESS;
    257  1.11    plunky 
    258  1.11    plunky 	if ((link->hl_flags & HCI_LINK_AUTH_REQ)
    259  1.11    plunky 	    && !(link->hl_flags & HCI_LINK_AUTH)) {
    260  1.11    plunky 		hci_auth_req_cp cp;
    261  1.11    plunky 
    262  1.11    plunky 		DPRINTF("requesting auth for handle #%d\n",
    263  1.11    plunky 			link->hl_handle);
    264  1.11    plunky 
    265  1.11    plunky 		link->hl_state = HCI_LINK_WAIT_AUTH;
    266  1.11    plunky 		cp.con_handle = htole16(link->hl_handle);
    267  1.11    plunky 		err = hci_send_cmd(link->hl_unit, HCI_CMD_AUTH_REQ,
    268  1.11    plunky 				   &cp, sizeof(cp));
    269  1.11    plunky 
    270  1.11    plunky 		return (err == 0 ? EINPROGRESS : err);
    271  1.11    plunky 	}
    272  1.11    plunky 
    273  1.11    plunky 	if ((link->hl_flags & HCI_LINK_ENCRYPT_REQ)
    274  1.11    plunky 	    && !(link->hl_flags & HCI_LINK_ENCRYPT)) {
    275  1.11    plunky 		hci_set_con_encryption_cp cp;
    276  1.11    plunky 
    277  1.11    plunky 		/* XXX we should check features for encryption capability */
    278  1.11    plunky 
    279  1.11    plunky 		DPRINTF("requesting encryption for handle #%d\n",
    280  1.11    plunky 			link->hl_handle);
    281  1.11    plunky 
    282  1.11    plunky 		link->hl_state = HCI_LINK_WAIT_ENCRYPT;
    283  1.11    plunky 		cp.con_handle = htole16(link->hl_handle);
    284  1.11    plunky 		cp.encryption_enable = 0x01;
    285  1.11    plunky 
    286  1.11    plunky 		err = hci_send_cmd(link->hl_unit, HCI_CMD_SET_CON_ENCRYPTION,
    287  1.11    plunky 				   &cp, sizeof(cp));
    288  1.11    plunky 
    289  1.11    plunky 		return (err == 0 ? EINPROGRESS : err);
    290  1.11    plunky 	}
    291  1.11    plunky 
    292  1.11    plunky 	if ((link->hl_flags & HCI_LINK_SECURE_REQ)) {
    293  1.11    plunky 		hci_change_con_link_key_cp cp;
    294  1.11    plunky 
    295  1.11    plunky 		/* always change link key for SECURE requests */
    296  1.11    plunky 		link->hl_flags &= ~HCI_LINK_SECURE;
    297  1.11    plunky 
    298  1.11    plunky 		DPRINTF("changing link key for handle #%d\n",
    299  1.11    plunky 			link->hl_handle);
    300  1.11    plunky 
    301  1.11    plunky 		link->hl_state = HCI_LINK_WAIT_SECURE;
    302  1.11    plunky 		cp.con_handle = htole16(link->hl_handle);
    303  1.11    plunky 
    304  1.11    plunky 		err = hci_send_cmd(link->hl_unit, HCI_CMD_CHANGE_CON_LINK_KEY,
    305  1.11    plunky 				   &cp, sizeof(cp));
    306  1.11    plunky 
    307  1.11    plunky 		return (err == 0 ? EINPROGRESS : err);
    308  1.11    plunky 	}
    309  1.11    plunky 
    310  1.11    plunky 	return 0;
    311  1.11    plunky }
    312  1.11    plunky 
    313  1.11    plunky /*
    314  1.11    plunky  * Link Mode changed.
    315  1.11    plunky  *
    316  1.11    plunky  * This is called from event handlers when the mode change
    317  1.11    plunky  * is complete. We notify upstream and restart the link.
    318  1.11    plunky  */
    319  1.11    plunky void
    320  1.11    plunky hci_acl_linkmode(struct hci_link *link)
    321  1.11    plunky {
    322  1.11    plunky 	struct l2cap_channel *chan, *next;
    323  1.11    plunky 	int err, mode = 0;
    324  1.11    plunky 
    325  1.11    plunky 	DPRINTF("handle #%d, auth %s, encrypt %s, secure %s\n",
    326  1.11    plunky 		link->hl_handle,
    327  1.11    plunky 		(link->hl_flags & HCI_LINK_AUTH ? "on" : "off"),
    328  1.11    plunky 		(link->hl_flags & HCI_LINK_ENCRYPT ? "on" : "off"),
    329  1.11    plunky 		(link->hl_flags & HCI_LINK_SECURE ? "on" : "off"));
    330  1.11    plunky 
    331  1.11    plunky 	if (link->hl_flags & HCI_LINK_AUTH)
    332  1.11    plunky 		mode |= L2CAP_LM_AUTH;
    333  1.11    plunky 
    334  1.11    plunky 	if (link->hl_flags & HCI_LINK_ENCRYPT)
    335  1.11    plunky 		mode |= L2CAP_LM_ENCRYPT;
    336  1.11    plunky 
    337  1.11    plunky 	if (link->hl_flags & HCI_LINK_SECURE)
    338  1.11    plunky 		mode |= L2CAP_LM_SECURE;
    339  1.11    plunky 
    340  1.11    plunky 	/*
    341  1.11    plunky 	 * The link state will only be OPEN here if the mode change
    342  1.11    plunky 	 * was successful. So, we can proceed with L2CAP connections,
    343  1.11    plunky 	 * or notify already establshed channels, to allow any that
    344  1.11    plunky 	 * are dissatisfied to disconnect before we restart.
    345  1.11    plunky 	 */
    346  1.11    plunky 	next = LIST_FIRST(&l2cap_active_list);
    347  1.11    plunky 	while ((chan = next) != NULL) {
    348  1.11    plunky 		next = LIST_NEXT(chan, lc_ncid);
    349  1.11    plunky 
    350  1.11    plunky 		if (chan->lc_link != link)
    351  1.11    plunky 			continue;
    352  1.11    plunky 
    353  1.11    plunky 		switch(chan->lc_state) {
    354  1.11    plunky 		case L2CAP_WAIT_SEND_CONNECT_REQ: /* we are connecting */
    355  1.11    plunky 			if ((mode & chan->lc_mode) != chan->lc_mode) {
    356  1.11    plunky 				l2cap_close(chan, ECONNABORTED);
    357  1.11    plunky 				break;
    358  1.11    plunky 			}
    359  1.11    plunky 
    360  1.11    plunky 			chan->lc_state = L2CAP_WAIT_RECV_CONNECT_RSP;
    361  1.11    plunky 			err = l2cap_send_connect_req(chan);
    362  1.11    plunky 			if (err) {
    363  1.11    plunky 				l2cap_close(chan, err);
    364  1.11    plunky 				break;
    365  1.11    plunky 			}
    366  1.11    plunky 			break;
    367  1.11    plunky 
    368  1.11    plunky 		case L2CAP_WAIT_SEND_CONNECT_RSP: /* they are connecting */
    369  1.11    plunky 			if ((mode & chan->lc_mode) != chan->lc_mode) {
    370  1.11    plunky 				l2cap_send_connect_rsp(link, chan->lc_ident,
    371  1.11    plunky 							0, chan->lc_rcid,
    372  1.11    plunky 							L2CAP_SECURITY_BLOCK);
    373  1.11    plunky 
    374  1.11    plunky 				l2cap_close(chan, ECONNABORTED);
    375  1.11    plunky 				break;
    376  1.11    plunky 			}
    377  1.11    plunky 
    378  1.11    plunky 			l2cap_send_connect_rsp(link, chan->lc_ident,
    379  1.11    plunky 						chan->lc_lcid, chan->lc_rcid,
    380  1.11    plunky 						L2CAP_SUCCESS);
    381  1.11    plunky 
    382  1.11    plunky 			chan->lc_state = L2CAP_WAIT_CONFIG;
    383  1.11    plunky 			chan->lc_flags |= (L2CAP_WAIT_CONFIG_RSP | L2CAP_WAIT_CONFIG_REQ);
    384  1.11    plunky 			err = l2cap_send_config_req(chan);
    385  1.11    plunky 			if (err) {
    386  1.11    plunky 				l2cap_close(chan, err);
    387  1.11    plunky 				break;
    388  1.11    plunky 			}
    389  1.11    plunky 			break;
    390  1.11    plunky 
    391  1.11    plunky 		case L2CAP_WAIT_RECV_CONNECT_RSP:
    392  1.11    plunky 		case L2CAP_WAIT_CONFIG:
    393  1.11    plunky 		case L2CAP_OPEN: /* already established */
    394  1.11    plunky 			(*chan->lc_proto->linkmode)(chan->lc_upper, mode);
    395  1.11    plunky 			break;
    396  1.11    plunky 
    397  1.11    plunky 		default:
    398  1.11    plunky 			break;
    399  1.11    plunky 		}
    400  1.11    plunky 	}
    401  1.11    plunky 
    402  1.11    plunky 	link->hl_state = HCI_LINK_OPEN;
    403  1.11    plunky 	hci_acl_start(link);
    404  1.11    plunky }
    405  1.11    plunky 
    406  1.11    plunky /*
    407   1.1   gdamore  * Receive ACL Data
    408   1.1   gdamore  *
    409   1.1   gdamore  * we accumulate packet fragments on the hci_link structure
    410   1.1   gdamore  * until a full L2CAP frame is ready, then send it on.
    411   1.1   gdamore  */
    412   1.1   gdamore void
    413   1.1   gdamore hci_acl_recv(struct mbuf *m, struct hci_unit *unit)
    414   1.1   gdamore {
    415   1.1   gdamore 	struct hci_link *link;
    416   1.1   gdamore 	hci_acldata_hdr_t hdr;
    417   1.1   gdamore 	uint16_t handle, want;
    418   1.1   gdamore 	int pb, got;
    419   1.1   gdamore 
    420  1.10    plunky 	KASSERT(m != NULL);
    421  1.10    plunky 	KASSERT(unit != NULL);
    422   1.1   gdamore 
    423   1.1   gdamore 	KASSERT(m->m_pkthdr.len >= sizeof(hdr));
    424   1.1   gdamore 	m_copydata(m, 0, sizeof(hdr), &hdr);
    425   1.1   gdamore 	m_adj(m, sizeof(hdr));
    426   1.1   gdamore 
    427   1.1   gdamore #ifdef DIAGNOSTIC
    428   1.1   gdamore 	if (hdr.type != HCI_ACL_DATA_PKT) {
    429  1.16    plunky 		aprint_error_dev(unit->hci_dev, "bad ACL packet type\n");
    430   1.1   gdamore 		goto bad;
    431   1.1   gdamore 	}
    432   1.1   gdamore 
    433   1.1   gdamore 	if (m->m_pkthdr.len != le16toh(hdr.length)) {
    434  1.16    plunky 		aprint_error_dev(unit->hci_dev,
    435  1.16    plunky 		    "bad ACL packet length (%d != %d)\n",
    436  1.16    plunky 		    m->m_pkthdr.len, le16toh(hdr.length));
    437   1.1   gdamore 		goto bad;
    438   1.1   gdamore 	}
    439   1.1   gdamore #endif
    440   1.1   gdamore 
    441   1.1   gdamore 	hdr.length = le16toh(hdr.length);
    442   1.1   gdamore 	hdr.con_handle = le16toh(hdr.con_handle);
    443   1.1   gdamore 	handle = HCI_CON_HANDLE(hdr.con_handle);
    444   1.1   gdamore 	pb = HCI_PB_FLAG(hdr.con_handle);
    445   1.1   gdamore 
    446   1.1   gdamore 	link = hci_link_lookup_handle(unit, handle);
    447   1.1   gdamore 	if (link == NULL) {
    448   1.1   gdamore 		hci_discon_cp cp;
    449   1.1   gdamore 
    450   1.1   gdamore 		DPRINTF("%s: dumping packet for unknown handle #%d\n",
    451  1.16    plunky 			device_xname(unit->hci_dev), handle);
    452   1.1   gdamore 
    453   1.1   gdamore 		/*
    454   1.1   gdamore 		 * There is no way to find out what this connection handle is
    455   1.1   gdamore 		 * for, just get rid of it. This may happen, if a USB dongle
    456   1.1   gdamore 		 * is plugged into a self powered hub and does not reset when
    457   1.1   gdamore 		 * the system is shut down.
    458   1.1   gdamore 		 */
    459   1.1   gdamore 		cp.con_handle = htole16(handle);
    460   1.1   gdamore 		cp.reason = 0x13; /* "Remote User Terminated Connection" */
    461   1.1   gdamore 		hci_send_cmd(unit, HCI_CMD_DISCONNECT, &cp, sizeof(cp));
    462   1.1   gdamore 		goto bad;
    463   1.1   gdamore 	}
    464   1.1   gdamore 
    465   1.1   gdamore 	switch (pb) {
    466   1.1   gdamore 	case HCI_PACKET_START:
    467   1.1   gdamore 		if (link->hl_rxp != NULL)
    468  1.16    plunky 			aprint_error_dev(unit->hci_dev,
    469  1.16    plunky 			    "dropped incomplete ACL packet\n");
    470   1.1   gdamore 
    471   1.1   gdamore 		if (m->m_pkthdr.len < sizeof(l2cap_hdr_t)) {
    472  1.16    plunky 			aprint_error_dev(unit->hci_dev, "short ACL packet\n");
    473   1.1   gdamore 			goto bad;
    474   1.1   gdamore 		}
    475   1.1   gdamore 
    476   1.1   gdamore 		link->hl_rxp = m;
    477   1.1   gdamore 		got = m->m_pkthdr.len;
    478   1.1   gdamore 		break;
    479   1.1   gdamore 
    480   1.1   gdamore 	case HCI_PACKET_FRAGMENT:
    481   1.1   gdamore 		if (link->hl_rxp == NULL) {
    482  1.16    plunky 			aprint_error_dev(unit->hci_dev,
    483  1.16    plunky 			    "unexpected packet fragment\n");
    484   1.1   gdamore 
    485   1.1   gdamore 			goto bad;
    486   1.1   gdamore 		}
    487   1.1   gdamore 
    488   1.1   gdamore 		got = m->m_pkthdr.len + link->hl_rxp->m_pkthdr.len;
    489   1.1   gdamore 		m_cat(link->hl_rxp, m);
    490   1.1   gdamore 		m = link->hl_rxp;
    491   1.1   gdamore 		m->m_pkthdr.len = got;
    492   1.1   gdamore 		break;
    493   1.1   gdamore 
    494   1.1   gdamore 	default:
    495  1.16    plunky 		aprint_error_dev(unit->hci_dev, "unknown packet type\n");
    496   1.1   gdamore 		goto bad;
    497   1.1   gdamore 	}
    498   1.1   gdamore 
    499   1.1   gdamore 	m_copydata(m, 0, sizeof(want), &want);
    500   1.1   gdamore 	want = le16toh(want) + sizeof(l2cap_hdr_t) - got;
    501   1.1   gdamore 
    502   1.1   gdamore 	if (want > 0)
    503   1.1   gdamore 		return;
    504   1.1   gdamore 
    505   1.1   gdamore 	link->hl_rxp = NULL;
    506   1.1   gdamore 
    507   1.1   gdamore 	if (want == 0) {
    508   1.1   gdamore 		l2cap_recv_frame(m, link);
    509   1.1   gdamore 		return;
    510   1.1   gdamore 	}
    511   1.1   gdamore 
    512   1.1   gdamore bad:
    513   1.1   gdamore 	m_freem(m);
    514   1.1   gdamore }
    515   1.1   gdamore 
    516   1.1   gdamore /*
    517   1.1   gdamore  * Send ACL data on link
    518   1.1   gdamore  *
    519   1.1   gdamore  * We must fragment packets into chunks of less than unit->hci_max_acl_size and
    520   1.1   gdamore  * prepend a relevant ACL header to each fragment. We keep a PDU structure
    521   1.1   gdamore  * attached to the link, so that completed fragments can be marked off and
    522   1.1   gdamore  * more data requested from above once the PDU is sent.
    523   1.1   gdamore  */
    524   1.1   gdamore int
    525   1.1   gdamore hci_acl_send(struct mbuf *m, struct hci_link *link,
    526   1.1   gdamore 		struct l2cap_channel *chan)
    527   1.1   gdamore {
    528   1.1   gdamore 	struct l2cap_pdu *pdu;
    529   1.1   gdamore 	struct mbuf *n = NULL;
    530   1.1   gdamore 	int plen, mlen, num = 0;
    531   1.1   gdamore 
    532  1.10    plunky 	KASSERT(link != NULL);
    533  1.10    plunky 	KASSERT(m != NULL);
    534   1.1   gdamore 	KASSERT(m->m_flags & M_PKTHDR);
    535   1.1   gdamore 	KASSERT(m->m_pkthdr.len > 0);
    536   1.1   gdamore 
    537   1.1   gdamore 	if (link->hl_state == HCI_LINK_CLOSED) {
    538   1.1   gdamore 		m_freem(m);
    539   1.1   gdamore 		return ENETDOWN;
    540   1.1   gdamore 	}
    541   1.1   gdamore 
    542   1.1   gdamore 	pdu = pool_get(&l2cap_pdu_pool, PR_NOWAIT);
    543   1.1   gdamore 	if (pdu == NULL)
    544   1.1   gdamore 		goto nomem;
    545   1.1   gdamore 
    546   1.1   gdamore 	pdu->lp_chan = chan;
    547   1.1   gdamore 	pdu->lp_pending = 0;
    548   1.1   gdamore 	MBUFQ_INIT(&pdu->lp_data);
    549   1.1   gdamore 
    550   1.1   gdamore 	plen = m->m_pkthdr.len;
    551   1.1   gdamore 	mlen = link->hl_unit->hci_max_acl_size;
    552   1.1   gdamore 
    553   1.1   gdamore 	DPRINTFN(5, "%s: handle #%d, plen = %d, max = %d\n",
    554  1.16    plunky 		device_xname(link->hl_unit->hci_dev), link->hl_handle, plen, mlen);
    555   1.1   gdamore 
    556   1.1   gdamore 	while (plen > 0) {
    557   1.1   gdamore 		if (plen > mlen) {
    558   1.1   gdamore 			n = m_split(m, mlen, M_DONTWAIT);
    559   1.1   gdamore 			if (n == NULL)
    560   1.1   gdamore 				goto nomem;
    561   1.1   gdamore 		} else {
    562   1.1   gdamore 			mlen = plen;
    563   1.1   gdamore 		}
    564   1.1   gdamore 
    565   1.1   gdamore 		if (num++ == 0)
    566   1.1   gdamore 			m->m_flags |= M_PROTO1;	/* tag first fragment */
    567   1.1   gdamore 
    568   1.1   gdamore 		DPRINTFN(10, "chunk of %d (plen = %d) bytes\n", mlen, plen);
    569   1.1   gdamore 		MBUFQ_ENQUEUE(&pdu->lp_data, m);
    570   1.1   gdamore 		m = n;
    571   1.1   gdamore 		plen -= mlen;
    572   1.1   gdamore 	}
    573   1.1   gdamore 
    574   1.1   gdamore 	TAILQ_INSERT_TAIL(&link->hl_txq, pdu, lp_next);
    575   1.1   gdamore 	link->hl_txqlen += num;
    576   1.1   gdamore 
    577   1.1   gdamore 	hci_acl_start(link);
    578   1.1   gdamore 
    579   1.1   gdamore 	return 0;
    580   1.1   gdamore 
    581   1.1   gdamore nomem:
    582   1.1   gdamore 	if (m) m_freem(m);
    583   1.1   gdamore 	if (pdu) {
    584   1.1   gdamore 		MBUFQ_DRAIN(&pdu->lp_data);
    585   1.1   gdamore 		pool_put(&l2cap_pdu_pool, pdu);
    586   1.1   gdamore 	}
    587   1.1   gdamore 
    588   1.1   gdamore 	return ENOMEM;
    589   1.1   gdamore }
    590   1.1   gdamore 
    591   1.1   gdamore /*
    592   1.1   gdamore  * Start sending ACL data on link.
    593   1.1   gdamore  *
    594  1.11    plunky  *	This is called when the queue may need restarting: as new data
    595  1.11    plunky  * is queued, after link mode changes have completed, or when device
    596  1.11    plunky  * buffers have cleared.
    597  1.11    plunky  *
    598   1.1   gdamore  *	We may use all the available packet slots. The reason that we add
    599   1.1   gdamore  * the ACL encapsulation here rather than in hci_acl_send() is that L2CAP
    600   1.1   gdamore  * signal packets may be queued before the handle is given to us..
    601   1.1   gdamore  */
    602   1.1   gdamore void
    603   1.1   gdamore hci_acl_start(struct hci_link *link)
    604   1.1   gdamore {
    605   1.1   gdamore 	struct hci_unit *unit;
    606   1.1   gdamore 	hci_acldata_hdr_t *hdr;
    607   1.1   gdamore 	struct l2cap_pdu *pdu;
    608   1.1   gdamore 	struct mbuf *m;
    609   1.1   gdamore 	uint16_t handle;
    610   1.1   gdamore 
    611  1.10    plunky 	KASSERT(link != NULL);
    612   1.1   gdamore 
    613   1.1   gdamore 	unit = link->hl_unit;
    614  1.10    plunky 	KASSERT(unit != NULL);
    615   1.1   gdamore 
    616   1.1   gdamore 	/* this is mainly to block ourselves (below) */
    617   1.1   gdamore 	if (link->hl_state != HCI_LINK_OPEN)
    618   1.1   gdamore 		return;
    619   1.1   gdamore 
    620   1.1   gdamore 	if (link->hl_txqlen == 0 || unit->hci_num_acl_pkts == 0)
    621   1.1   gdamore 		return;
    622   1.1   gdamore 
    623   1.1   gdamore 	/* find first PDU with data to send */
    624   1.1   gdamore 	pdu = TAILQ_FIRST(&link->hl_txq);
    625   1.1   gdamore 	for (;;) {
    626   1.1   gdamore 		if (pdu == NULL)
    627   1.1   gdamore 			return;
    628   1.1   gdamore 
    629   1.1   gdamore 		if (MBUFQ_FIRST(&pdu->lp_data) != NULL)
    630   1.1   gdamore 			break;
    631   1.1   gdamore 
    632   1.1   gdamore 		pdu = TAILQ_NEXT(pdu, lp_next);
    633   1.1   gdamore 	}
    634   1.1   gdamore 
    635   1.1   gdamore 	while (unit->hci_num_acl_pkts > 0) {
    636   1.1   gdamore 		MBUFQ_DEQUEUE(&pdu->lp_data, m);
    637   1.1   gdamore 		KASSERT(m != NULL);
    638   1.1   gdamore 
    639   1.1   gdamore 		if (m->m_flags & M_PROTO1)
    640   1.1   gdamore 			handle = HCI_MK_CON_HANDLE(link->hl_handle,
    641   1.1   gdamore 						HCI_PACKET_START, 0);
    642   1.1   gdamore 		else
    643   1.1   gdamore 			handle = HCI_MK_CON_HANDLE(link->hl_handle,
    644   1.1   gdamore 						HCI_PACKET_FRAGMENT, 0);
    645   1.1   gdamore 
    646   1.1   gdamore 		M_PREPEND(m, sizeof(*hdr), M_DONTWAIT);
    647   1.1   gdamore 		if (m == NULL)
    648   1.1   gdamore 			break;
    649   1.1   gdamore 
    650   1.1   gdamore 		hdr = mtod(m, hci_acldata_hdr_t *);
    651   1.1   gdamore 		hdr->type = HCI_ACL_DATA_PKT;
    652   1.1   gdamore 		hdr->con_handle = htole16(handle);
    653   1.1   gdamore 		hdr->length = htole16(m->m_pkthdr.len - sizeof(*hdr));
    654   1.1   gdamore 
    655   1.1   gdamore 		link->hl_txqlen--;
    656   1.1   gdamore 		pdu->lp_pending++;
    657   1.1   gdamore 
    658   1.1   gdamore 		hci_output_acl(unit, m);
    659   1.1   gdamore 
    660   1.1   gdamore 		if (MBUFQ_FIRST(&pdu->lp_data) == NULL) {
    661   1.1   gdamore 			if (pdu->lp_chan) {
    662   1.1   gdamore 				/*
    663   1.1   gdamore 				 * This should enable streaming of PDUs - when
    664   1.1   gdamore 				 * we have placed all the fragments on the acl
    665   1.1   gdamore 				 * output queue, we trigger the L2CAP layer to
    666   1.1   gdamore 				 * send us down one more. Use a false state so
    667   1.1   gdamore 				 * we dont run into ourselves coming back from
    668   1.1   gdamore 				 * the future..
    669   1.1   gdamore 				 */
    670   1.1   gdamore 				link->hl_state = HCI_LINK_BLOCK;
    671   1.1   gdamore 				l2cap_start(pdu->lp_chan);
    672   1.1   gdamore 				link->hl_state = HCI_LINK_OPEN;
    673   1.1   gdamore 			}
    674   1.1   gdamore 
    675   1.1   gdamore 			pdu = TAILQ_NEXT(pdu, lp_next);
    676   1.1   gdamore 			if (pdu == NULL)
    677   1.1   gdamore 				break;
    678   1.1   gdamore 		}
    679   1.1   gdamore 	}
    680   1.1   gdamore 
    681   1.1   gdamore 	/*
    682   1.1   gdamore 	 * We had our turn now, move to the back of the queue to let
    683   1.1   gdamore 	 * other links have a go at the output buffers..
    684   1.1   gdamore 	 */
    685   1.1   gdamore 	if (TAILQ_NEXT(link, hl_next)) {
    686   1.1   gdamore 		TAILQ_REMOVE(&unit->hci_links, link, hl_next);
    687   1.1   gdamore 		TAILQ_INSERT_TAIL(&unit->hci_links, link, hl_next);
    688   1.1   gdamore 	}
    689   1.1   gdamore }
    690   1.1   gdamore 
    691   1.1   gdamore /*
    692   1.1   gdamore  * Confirm ACL packets cleared from Controller buffers. We scan our PDU
    693   1.1   gdamore  * list to clear pending fragments and signal upstream for more data
    694   1.1   gdamore  * when a PDU is complete.
    695   1.1   gdamore  */
    696   1.1   gdamore void
    697   1.1   gdamore hci_acl_complete(struct hci_link *link, int num)
    698   1.1   gdamore {
    699   1.1   gdamore 	struct l2cap_pdu *pdu;
    700   1.1   gdamore 	struct l2cap_channel *chan;
    701   1.1   gdamore 
    702   1.1   gdamore 	DPRINTFN(5, "handle #%d (%d)\n", link->hl_handle, num);
    703   1.1   gdamore 
    704   1.1   gdamore 	while (num > 0) {
    705   1.1   gdamore 		pdu = TAILQ_FIRST(&link->hl_txq);
    706   1.1   gdamore 		if (pdu == NULL) {
    707  1.16    plunky 			aprint_error_dev(link->hl_unit->hci_dev,
    708  1.16    plunky 			    "%d packets completed on handle #%x but none pending!\n",
    709  1.16    plunky 			    num, link->hl_handle);
    710  1.16    plunky 
    711   1.1   gdamore 			return;
    712   1.1   gdamore 		}
    713   1.1   gdamore 
    714   1.1   gdamore 		if (num >= pdu->lp_pending) {
    715   1.1   gdamore 			num -= pdu->lp_pending;
    716   1.1   gdamore 			pdu->lp_pending = 0;
    717   1.1   gdamore 
    718   1.1   gdamore 			if (MBUFQ_FIRST(&pdu->lp_data) == NULL) {
    719   1.1   gdamore 				TAILQ_REMOVE(&link->hl_txq, pdu, lp_next);
    720   1.1   gdamore 				chan = pdu->lp_chan;
    721   1.1   gdamore 				if (chan != NULL) {
    722   1.1   gdamore 					chan->lc_pending--;
    723   1.1   gdamore 					(*chan->lc_proto->complete)
    724   1.1   gdamore 							(chan->lc_upper, 1);
    725   1.1   gdamore 
    726   1.1   gdamore 					if (chan->lc_pending == 0)
    727   1.1   gdamore 						l2cap_start(chan);
    728   1.1   gdamore 				}
    729   1.1   gdamore 
    730   1.1   gdamore 				pool_put(&l2cap_pdu_pool, pdu);
    731   1.1   gdamore 			}
    732   1.1   gdamore 		} else {
    733   1.1   gdamore 			pdu->lp_pending -= num;
    734   1.1   gdamore 			num = 0;
    735   1.1   gdamore 		}
    736   1.1   gdamore 	}
    737   1.1   gdamore }
    738   1.1   gdamore 
    739   1.1   gdamore /*******************************************************************************
    740   1.1   gdamore  *
    741   1.1   gdamore  *	HCI SCO Connections
    742   1.1   gdamore  */
    743   1.1   gdamore 
    744   1.1   gdamore /*
    745   1.3      tron  * Incoming SCO Connection. We check the list for anybody willing
    746   1.3      tron  * to take it.
    747   1.1   gdamore  */
    748   1.1   gdamore struct hci_link *
    749   1.1   gdamore hci_sco_newconn(struct hci_unit *unit, bdaddr_t *bdaddr)
    750   1.1   gdamore {
    751   1.3      tron 	struct sockaddr_bt laddr, raddr;
    752   1.3      tron 	struct sco_pcb *pcb, *new;
    753   1.3      tron 	struct hci_link *sco, *acl;
    754   1.3      tron 
    755   1.3      tron 	memset(&laddr, 0, sizeof(laddr));
    756   1.3      tron 	laddr.bt_len = sizeof(laddr);
    757   1.3      tron 	laddr.bt_family = AF_BLUETOOTH;
    758   1.3      tron 	bdaddr_copy(&laddr.bt_bdaddr, &unit->hci_bdaddr);
    759   1.3      tron 
    760   1.3      tron 	memset(&raddr, 0, sizeof(raddr));
    761   1.3      tron 	raddr.bt_len = sizeof(raddr);
    762   1.3      tron 	raddr.bt_family = AF_BLUETOOTH;
    763   1.3      tron 	bdaddr_copy(&raddr.bt_bdaddr, bdaddr);
    764   1.3      tron 
    765   1.3      tron 	/*
    766   1.3      tron 	 * There should already be an ACL link up and running before
    767   1.3      tron 	 * the controller sends us SCO connection requests, but you
    768   1.3      tron 	 * never know..
    769   1.3      tron 	 */
    770   1.3      tron 	acl = hci_link_lookup_bdaddr(unit, bdaddr, HCI_LINK_ACL);
    771   1.3      tron 	if (acl == NULL || acl->hl_state != HCI_LINK_OPEN)
    772   1.3      tron 		return NULL;
    773   1.3      tron 
    774   1.3      tron 	LIST_FOREACH(pcb, &sco_pcb, sp_next) {
    775   1.3      tron 		if ((pcb->sp_flags & SP_LISTENING) == 0)
    776   1.3      tron 			continue;
    777   1.3      tron 
    778   1.3      tron 		new = (*pcb->sp_proto->newconn)(pcb->sp_upper, &laddr, &raddr);
    779   1.3      tron 		if (new == NULL)
    780   1.3      tron 			continue;
    781   1.3      tron 
    782   1.3      tron 		/*
    783   1.3      tron 		 * Ok, got new pcb so we can start a new link and fill
    784   1.3      tron 		 * in all the details.
    785   1.3      tron 		 */
    786   1.3      tron 		bdaddr_copy(&new->sp_laddr, &unit->hci_bdaddr);
    787   1.3      tron 		bdaddr_copy(&new->sp_raddr, bdaddr);
    788   1.3      tron 
    789   1.3      tron 		sco = hci_link_alloc(unit);
    790   1.3      tron 		if (sco == NULL) {
    791   1.3      tron 			sco_detach(&new);
    792   1.3      tron 			return NULL;
    793   1.3      tron 		}
    794   1.3      tron 
    795   1.3      tron 		sco->hl_type = HCI_LINK_SCO;
    796   1.3      tron 		bdaddr_copy(&sco->hl_bdaddr, bdaddr);
    797   1.3      tron 
    798   1.3      tron 		sco->hl_link = hci_acl_open(unit, bdaddr);
    799   1.3      tron 		KASSERT(sco->hl_link == acl);
    800   1.3      tron 
    801   1.3      tron 		sco->hl_sco = new;
    802   1.3      tron 		new->sp_link = sco;
    803   1.3      tron 
    804   1.3      tron 		new->sp_mtu = unit->hci_max_sco_size;
    805   1.3      tron 		return sco;
    806   1.3      tron 	}
    807   1.1   gdamore 
    808   1.1   gdamore 	return NULL;
    809   1.1   gdamore }
    810   1.1   gdamore 
    811   1.1   gdamore /*
    812   1.1   gdamore  * receive SCO packet, we only need to strip the header and send
    813   1.1   gdamore  * it to the right handler
    814   1.1   gdamore  */
    815   1.1   gdamore void
    816   1.1   gdamore hci_sco_recv(struct mbuf *m, struct hci_unit *unit)
    817   1.1   gdamore {
    818   1.1   gdamore 	struct hci_link *link;
    819   1.1   gdamore 	hci_scodata_hdr_t hdr;
    820   1.1   gdamore 	uint16_t handle;
    821   1.1   gdamore 
    822  1.10    plunky 	KASSERT(m != NULL);
    823  1.10    plunky 	KASSERT(unit != NULL);
    824   1.1   gdamore 
    825   1.1   gdamore 	KASSERT(m->m_pkthdr.len >= sizeof(hdr));
    826   1.1   gdamore 	m_copydata(m, 0, sizeof(hdr), &hdr);
    827   1.1   gdamore 	m_adj(m, sizeof(hdr));
    828   1.1   gdamore 
    829   1.1   gdamore #ifdef DIAGNOSTIC
    830   1.1   gdamore 	if (hdr.type != HCI_SCO_DATA_PKT) {
    831  1.16    plunky 		aprint_error_dev(unit->hci_dev, "bad SCO packet type\n");
    832   1.1   gdamore 		goto bad;
    833   1.1   gdamore 	}
    834   1.1   gdamore 
    835   1.1   gdamore 	if (m->m_pkthdr.len != hdr.length) {
    836  1.16    plunky 		aprint_error_dev(unit->hci_dev,
    837  1.16    plunky 		    "bad SCO packet length (%d != %d)\n",
    838  1.16    plunky 		    m->m_pkthdr.len, hdr.length);
    839  1.16    plunky 
    840   1.1   gdamore 		goto bad;
    841   1.1   gdamore 	}
    842   1.1   gdamore #endif
    843   1.1   gdamore 
    844   1.1   gdamore 	hdr.con_handle = le16toh(hdr.con_handle);
    845   1.1   gdamore 	handle = HCI_CON_HANDLE(hdr.con_handle);
    846   1.1   gdamore 
    847   1.1   gdamore 	link = hci_link_lookup_handle(unit, handle);
    848   1.1   gdamore 	if (link == NULL || link->hl_type == HCI_LINK_ACL) {
    849   1.1   gdamore 		DPRINTF("%s: dumping packet for unknown handle #%d\n",
    850  1.16    plunky 			device_xname(unit->hci_dev), handle);
    851   1.1   gdamore 
    852   1.1   gdamore 		goto bad;
    853   1.1   gdamore 	}
    854   1.1   gdamore 
    855   1.1   gdamore 	(*link->hl_sco->sp_proto->input)(link->hl_sco->sp_upper, m);
    856   1.1   gdamore 	return;
    857   1.1   gdamore 
    858   1.1   gdamore bad:
    859   1.1   gdamore 	m_freem(m);
    860   1.1   gdamore }
    861   1.1   gdamore 
    862   1.1   gdamore void
    863   1.8  christos hci_sco_start(struct hci_link *link)
    864   1.1   gdamore {
    865   1.1   gdamore }
    866   1.1   gdamore 
    867   1.1   gdamore /*
    868   1.1   gdamore  * SCO packets have completed at the controller, so we can
    869   1.1   gdamore  * signal up to free the buffer space.
    870   1.1   gdamore  */
    871   1.1   gdamore void
    872   1.1   gdamore hci_sco_complete(struct hci_link *link, int num)
    873   1.1   gdamore {
    874   1.1   gdamore 
    875   1.1   gdamore 	DPRINTFN(5, "handle #%d (num=%d)\n", link->hl_handle, num);
    876   1.1   gdamore 	link->hl_sco->sp_pending--;
    877   1.1   gdamore 	(*link->hl_sco->sp_proto->complete)(link->hl_sco->sp_upper, num);
    878   1.1   gdamore }
    879   1.1   gdamore 
    880   1.1   gdamore /*******************************************************************************
    881   1.1   gdamore  *
    882   1.1   gdamore  *	Generic HCI Connection alloc/free/lookup etc
    883   1.1   gdamore  */
    884   1.1   gdamore 
    885   1.1   gdamore struct hci_link *
    886   1.1   gdamore hci_link_alloc(struct hci_unit *unit)
    887   1.1   gdamore {
    888   1.1   gdamore 	struct hci_link *link;
    889   1.1   gdamore 
    890  1.10    plunky 	KASSERT(unit != NULL);
    891   1.1   gdamore 
    892   1.1   gdamore 	link = malloc(sizeof(struct hci_link), M_BLUETOOTH, M_NOWAIT | M_ZERO);
    893   1.1   gdamore 	if (link == NULL)
    894   1.1   gdamore 		return NULL;
    895   1.1   gdamore 
    896   1.1   gdamore 	link->hl_unit = unit;
    897   1.1   gdamore 	link->hl_state = HCI_LINK_CLOSED;
    898   1.1   gdamore 
    899   1.1   gdamore 	/* init ACL portion */
    900  1.12        ad 	callout_init(&link->hl_expire, 0);
    901   1.1   gdamore 	callout_setfunc(&link->hl_expire, hci_acl_timeout, link);
    902   1.1   gdamore 
    903   1.1   gdamore 	TAILQ_INIT(&link->hl_txq);	/* outgoing packets */
    904   1.1   gdamore 	TAILQ_INIT(&link->hl_reqs);	/* request queue */
    905   1.1   gdamore 
    906   1.1   gdamore 	link->hl_mtu = L2CAP_MTU_DEFAULT;		/* L2CAP signal mtu */
    907   1.1   gdamore 	link->hl_flush = L2CAP_FLUSH_TIMO_DEFAULT;	/* flush timeout */
    908   1.1   gdamore 
    909   1.1   gdamore 	/* init SCO portion */
    910   1.1   gdamore 	MBUFQ_INIT(&link->hl_data);
    911   1.1   gdamore 
    912   1.1   gdamore 	/* attach to unit */
    913  1.18    plunky 	TAILQ_INSERT_TAIL(&unit->hci_links, link, hl_next);
    914   1.1   gdamore 	return link;
    915   1.1   gdamore }
    916   1.1   gdamore 
    917   1.1   gdamore void
    918   1.1   gdamore hci_link_free(struct hci_link *link, int err)
    919   1.1   gdamore {
    920   1.1   gdamore 	struct l2cap_req *req;
    921   1.1   gdamore 	struct l2cap_pdu *pdu;
    922   1.4    plunky 	struct l2cap_channel *chan, *next;
    923   1.1   gdamore 
    924  1.10    plunky 	KASSERT(link != NULL);
    925   1.1   gdamore 
    926   1.1   gdamore 	DPRINTF("#%d, type = %d, state = %d, refcnt = %d\n",
    927   1.1   gdamore 		link->hl_handle, link->hl_type,
    928   1.1   gdamore 		link->hl_state, link->hl_refcnt);
    929   1.1   gdamore 
    930   1.1   gdamore 	/* ACL reference count */
    931   1.1   gdamore 	if (link->hl_refcnt > 0) {
    932   1.4    plunky 		next = LIST_FIRST(&l2cap_active_list);
    933   1.4    plunky 		while ((chan = next) != NULL) {
    934   1.4    plunky 			next = LIST_NEXT(chan, lc_ncid);
    935   1.1   gdamore 			if (chan->lc_link == link)
    936   1.1   gdamore 				l2cap_close(chan, err);
    937   1.1   gdamore 		}
    938   1.1   gdamore 	}
    939   1.1   gdamore 	KASSERT(link->hl_refcnt == 0);
    940   1.1   gdamore 
    941   1.1   gdamore 	/* ACL L2CAP requests.. */
    942   1.1   gdamore 	while ((req = TAILQ_FIRST(&link->hl_reqs)) != NULL)
    943   1.1   gdamore 		l2cap_request_free(req);
    944   1.1   gdamore 
    945   1.1   gdamore 	KASSERT(TAILQ_EMPTY(&link->hl_reqs));
    946   1.1   gdamore 
    947   1.1   gdamore 	/* ACL outgoing data queue */
    948   1.1   gdamore 	while ((pdu = TAILQ_FIRST(&link->hl_txq)) != NULL) {
    949   1.1   gdamore 		TAILQ_REMOVE(&link->hl_txq, pdu, lp_next);
    950   1.1   gdamore 		MBUFQ_DRAIN(&pdu->lp_data);
    951   1.1   gdamore 		if (pdu->lp_pending)
    952   1.1   gdamore 			link->hl_unit->hci_num_acl_pkts += pdu->lp_pending;
    953   1.1   gdamore 
    954   1.1   gdamore 		pool_put(&l2cap_pdu_pool, pdu);
    955   1.1   gdamore 	}
    956   1.1   gdamore 
    957   1.1   gdamore 	KASSERT(TAILQ_EMPTY(&link->hl_txq));
    958   1.1   gdamore 
    959   1.1   gdamore 	/* ACL incoming data packet */
    960   1.1   gdamore 	if (link->hl_rxp != NULL) {
    961   1.1   gdamore 		m_freem(link->hl_rxp);
    962   1.1   gdamore 		link->hl_rxp = NULL;
    963   1.1   gdamore 	}
    964   1.1   gdamore 
    965   1.1   gdamore 	/* SCO master ACL link */
    966   1.1   gdamore 	if (link->hl_link != NULL) {
    967   1.1   gdamore 		hci_acl_close(link->hl_link, err);
    968   1.1   gdamore 		link->hl_link = NULL;
    969   1.1   gdamore 	}
    970   1.1   gdamore 
    971   1.1   gdamore 	/* SCO pcb */
    972   1.1   gdamore 	if (link->hl_sco != NULL) {
    973   1.1   gdamore 		struct sco_pcb *pcb;
    974   1.1   gdamore 
    975   1.1   gdamore 		pcb = link->hl_sco;
    976   1.1   gdamore 		pcb->sp_link = NULL;
    977   1.1   gdamore 		link->hl_sco = NULL;
    978   1.1   gdamore 		(*pcb->sp_proto->disconnected)(pcb->sp_upper, err);
    979   1.1   gdamore 	}
    980   1.1   gdamore 
    981   1.1   gdamore 	/* flush any SCO data */
    982   1.1   gdamore 	MBUFQ_DRAIN(&link->hl_data);
    983   1.1   gdamore 
    984   1.1   gdamore 	/*
    985   1.1   gdamore 	 * Halt the callout - if its already running we cannot free the
    986   1.1   gdamore 	 * link structure but the timeout function will call us back in
    987   1.1   gdamore 	 * any case.
    988   1.1   gdamore 	 */
    989   1.1   gdamore 	link->hl_state = HCI_LINK_CLOSED;
    990   1.1   gdamore 	callout_stop(&link->hl_expire);
    991   1.1   gdamore 	if (callout_invoking(&link->hl_expire))
    992   1.1   gdamore 		return;
    993   1.1   gdamore 
    994  1.15    plunky 	callout_destroy(&link->hl_expire);
    995  1.15    plunky 
    996  1.14    plunky 	/*
    997  1.14    plunky 	 * If we made a note of clock offset, keep it in a memo
    998  1.14    plunky 	 * to facilitate reconnections to this device
    999  1.14    plunky 	 */
   1000  1.14    plunky 	if (link->hl_clock != 0) {
   1001  1.14    plunky 		struct hci_memo *memo;
   1002  1.14    plunky 
   1003  1.14    plunky 		memo = hci_memo_new(link->hl_unit, &link->hl_bdaddr);
   1004  1.14    plunky 		if (memo != NULL)
   1005  1.14    plunky 			memo->clock_offset = link->hl_clock;
   1006  1.14    plunky 	}
   1007  1.14    plunky 
   1008   1.1   gdamore 	TAILQ_REMOVE(&link->hl_unit->hci_links, link, hl_next);
   1009   1.1   gdamore 	free(link, M_BLUETOOTH);
   1010   1.1   gdamore }
   1011   1.1   gdamore 
   1012   1.1   gdamore /*
   1013   1.1   gdamore  * Lookup HCI link by address and type. Note that for SCO links there may
   1014   1.1   gdamore  * be more than one link per address, so we only return links with no
   1015   1.1   gdamore  * handle (ie new links)
   1016   1.1   gdamore  */
   1017   1.1   gdamore struct hci_link *
   1018   1.1   gdamore hci_link_lookup_bdaddr(struct hci_unit *unit, bdaddr_t *bdaddr, uint16_t type)
   1019   1.1   gdamore {
   1020   1.1   gdamore 	struct hci_link *link;
   1021   1.1   gdamore 
   1022  1.10    plunky 	KASSERT(unit != NULL);
   1023  1.10    plunky 	KASSERT(bdaddr != NULL);
   1024   1.1   gdamore 
   1025   1.1   gdamore 	TAILQ_FOREACH(link, &unit->hci_links, hl_next) {
   1026   1.1   gdamore 		if (link->hl_type != type)
   1027   1.1   gdamore 			continue;
   1028   1.1   gdamore 
   1029   1.1   gdamore 		if (type == HCI_LINK_SCO && link->hl_handle != 0)
   1030   1.1   gdamore 			continue;
   1031   1.1   gdamore 
   1032   1.1   gdamore 		if (bdaddr_same(&link->hl_bdaddr, bdaddr))
   1033   1.1   gdamore 			break;
   1034   1.1   gdamore 	}
   1035   1.1   gdamore 
   1036   1.1   gdamore 	return link;
   1037   1.1   gdamore }
   1038   1.1   gdamore 
   1039   1.1   gdamore struct hci_link *
   1040   1.1   gdamore hci_link_lookup_handle(struct hci_unit *unit, uint16_t handle)
   1041   1.1   gdamore {
   1042   1.1   gdamore 	struct hci_link *link;
   1043   1.1   gdamore 
   1044  1.10    plunky 	KASSERT(unit != NULL);
   1045   1.1   gdamore 
   1046   1.1   gdamore 	TAILQ_FOREACH(link, &unit->hci_links, hl_next) {
   1047   1.1   gdamore 		if (handle == link->hl_handle)
   1048   1.1   gdamore 			break;
   1049   1.1   gdamore 	}
   1050   1.1   gdamore 
   1051   1.1   gdamore 	return link;
   1052   1.1   gdamore }
   1053