sys/netbt/hci_event.c

   1 /* $OpenBSD: src/sys/netbt/hci_event.c,v 1.7 2008/02/24 21:34:48 uwe Exp $ */
   2 /* $NetBSD: hci_event.c,v 1.14 2008/02/10 17:40:54 plunky Exp $ */
   3
   4 /*-
   5  * Copyright (c) 2005 Iain Hibbert.
   6  * Copyright (c) 2006 Itronix Inc.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. The name of Itronix Inc. may not be used to endorse
  18  *    or promote products derived from this software without specific
  19  *    prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
  25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  28  * ON ANY THEORY OF LIABILITY, WHETHER IN
  29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  */
  33
  34 #include <sys/param.h>
  35 #include <sys/kernel.h>
  36 #include <sys/malloc.h>
  37 #include <sys/mbuf.h>
  38 #include <sys/proc.h>
  39 #include <sys/systm.h>
  40 #include <sys/endian.h>
  41 #include <sys/bus.h>
  42
  43 #include <netbt/bluetooth.h>
  44 #include <netbt/hci.h>
  45 #include <netbt/sco.h>
  46
  47 static void hci_event_inquiry_result(struct hci_unit *, struct mbuf *);
  48 static void hci_event_rssi_result(struct hci_unit *, struct mbuf *);
  49 static void hci_event_command_status(struct hci_unit *, struct mbuf *);
  50 static void hci_event_command_compl(struct hci_unit *, struct mbuf *);
  51 static void hci_event_con_compl(struct hci_unit *, struct mbuf *);
  52 static void hci_event_discon_compl(struct hci_unit *, struct mbuf *);
  53 static void hci_event_con_req(struct hci_unit *, struct mbuf *);
  54 static void hci_event_num_compl_pkts(struct hci_unit *, struct mbuf *);
  55 static void hci_event_auth_compl(struct hci_unit *, struct mbuf *);
  56 static void hci_event_encryption_change(struct hci_unit *, struct mbuf *);
  57 static void hci_event_change_con_link_key_compl(struct hci_unit *, struct mbuf *);
  58 static void hci_event_read_clock_offset_compl(struct hci_unit *, struct mbuf *);
  59 static void hci_cmd_read_bdaddr(struct hci_unit *, struct mbuf *);
  60 static void hci_cmd_read_buffer_size(struct hci_unit *, struct mbuf *);
  61 static void hci_cmd_read_local_features(struct hci_unit *, struct mbuf *);
  62 static void hci_cmd_read_local_ver(struct hci_unit *, struct mbuf *);
  63 static void hci_cmd_read_local_commands(struct hci_unit *, struct mbuf *);
  64 static void hci_cmd_reset(struct hci_unit *, struct mbuf *);
  65
  66 #ifdef BLUETOOTH_DEBUG
  67 int bluetooth_debug = BLUETOOTH_DEBUG;
  68
  69 static const char *hci_eventnames[] = {
  70 /* 0x00 */ "NULL",
  71 /* 0x01 */ "INQUIRY COMPLETE",
  72 /* 0x02 */ "INQUIRY RESULT",
  73 /* 0x03 */ "CONN COMPLETE",
  74 /* 0x04 */ "CONN REQ",
  75 /* 0x05 */ "DISCONN COMPLETE",
  76 /* 0x06 */ "AUTH COMPLETE",
  77 /* 0x07 */ "REMOTE NAME REQ COMPLETE",
  78 /* 0x08 */ "ENCRYPTION CHANGE",
  79 /* 0x09 */ "CHANGE CONN LINK KEY COMPLETE",
  80 /* 0x0a */ "MASTER LINK KEY COMPLETE",
  81 /* 0x0b */ "READ REMOTE FEATURES COMPLETE",
  82 /* 0x0c */ "READ REMOTE VERSION INFO COMPLETE",
  83 /* 0x0d */ "QoS SETUP COMPLETE",
  84 /* 0x0e */ "COMMAND COMPLETE",
  85 /* 0x0f */ "COMMAND STATUS",
  86 /* 0x10 */ "HARDWARE ERROR",
  87 /* 0x11 */ "FLUSH OCCUR",
  88 /* 0x12 */ "ROLE CHANGE",
  89 /* 0x13 */ "NUM COMPLETED PACKETS",
  90 /* 0x14 */ "MODE CHANGE",
  91 /* 0x15 */ "RETURN LINK KEYS",
  92 /* 0x16 */ "PIN CODE REQ",
  93 /* 0x17 */ "LINK KEY REQ",
  94 /* 0x18 */ "LINK KEY NOTIFICATION",
  95 /* 0x19 */ "LOOPBACK COMMAND",
  96 /* 0x1a */ "DATA BUFFER OVERFLOW",
  97 /* 0x1b */ "MAX SLOT CHANGE",
  98 /* 0x1c */ "READ CLOCK OFFSET COMPLETE",
  99 /* 0x1d */ "CONN PKT TYPE CHANGED",
 100 /* 0x1e */ "QOS VIOLATION",
 101 /* 0x1f */ "PAGE SCAN MODE CHANGE",
 102 /* 0x20 */ "PAGE SCAN REP MODE CHANGE",
 103 /* 0x21 */ "FLOW SPECIFICATION COMPLETE",
 104 /* 0x22 */ "RSSI RESULT",
 105 /* 0x23 */ "READ REMOTE EXT FEATURES",
 106 /* 0x24 */ "UNKNOWN",
 107 /* 0x25 */ "UNKNOWN",
 108 /* 0x26 */ "UNKNOWN",
 109 /* 0x27 */ "UNKNOWN",
 110 /* 0x28 */ "UNKNOWN",
 111 /* 0x29 */ "UNKNOWN",
 112 /* 0x2a */ "UNKNOWN",
 113 /* 0x2b */ "UNKNOWN",
 114 /* 0x2c */ "SCO CON COMPLETE",
 115 /* 0x2d */ "SCO CON CHANGED",
 116 /* 0x2e */ "SNIFF SUBRATING",
 117 /* 0x2f */ "EXTENDED INQUIRY RESULT",
 118 /* 0x30 */ "ENCRYPTION KEY REFRESH",
 119 /* 0x31 */ "IO CAPABILITY REQUEST",
 120 /* 0x32 */ "IO CAPABILITY RESPONSE",
 121 /* 0x33 */ "USER CONFIRM REQUEST",
 122 /* 0x34 */ "USER PASSKEY REQUEST",
 123 /* 0x35 */ "REMOTE OOB DATA REQUEST",
 124 /* 0x36 */ "SIMPLE PAIRING COMPLETE",
 125 /* 0x37 */ "UNKNOWN",
 126 /* 0x38 */ "LINK SUPERVISION TIMEOUT CHANGED",
 127 /* 0x39 */ "ENHANCED FLUSH COMPLETE",
 128 /* 0x3a */ "UNKNOWN",
 129 /* 0x3b */ "USER PASSKEY NOTIFICATION",
 130 /* 0x3c */ "KEYPRESS NOTIFICATION",
 131 /* 0x3d */ "REMOTE HOST FEATURES NOTIFICATION",
 132 };
 133
 134 static const char *
 135 hci_eventstr(unsigned int event)
 136 {
 137
 138         if (event < NELEM(hci_eventnames))
 139                 return hci_eventnames[event];
 140
 141         switch (event) {
 142         case HCI_EVENT_BT_LOGO:         /* 0xfe */
 143                 return "BT_LOGO";
 144
 145         case HCI_EVENT_VENDOR:          /* 0xff */
 146                 return "VENDOR";
 147         }
 148
 149         return "UNKNOWN";
 150 }
 151 #endif  /* BLUETOOTH_DEBUG */
 152
 153 /*
 154  * process HCI Events
 155  *
 156  * We will free the mbuf at the end, no need for any sub
 157  * functions to handle that. We kind of assume that the
 158  * device sends us valid events.
 159  */
 160 void
 161 hci_event(struct mbuf *m, struct hci_unit *unit)
 162 {
 163         hci_event_hdr_t hdr;
 164
 165         KKASSERT(m->m_flags & M_PKTHDR);
 166
 167         KKASSERT(m->m_pkthdr.len >= sizeof(hdr));
 168         m_copydata(m, 0, sizeof(hdr), &hdr);
 169         m_adj(m, sizeof(hdr));
 170
 171         KKASSERT(hdr.type == HCI_EVENT_PKT);
 172
 173         DPRINTFN(1, "(%s) event %s\n",
 174             device_get_nameunit(unit->hci_dev), hci_eventstr(hdr.event));
 175
 176         switch(hdr.event) {
 177         case HCI_EVENT_COMMAND_STATUS:
 178                 hci_event_command_status(unit, m);
 179                 break;
 180
 181         case HCI_EVENT_COMMAND_COMPL:
 182                 hci_event_command_compl(unit, m);
 183                 break;
 184
 185         case HCI_EVENT_NUM_COMPL_PKTS:
 186                 hci_event_num_compl_pkts(unit, m);
 187                 break;
 188
 189         case HCI_EVENT_INQUIRY_RESULT:
 190                 hci_event_inquiry_result(unit, m);
 191                 break;
 192
 193         case HCI_EVENT_RSSI_RESULT:
 194                 hci_event_rssi_result(unit, m);
 195                 break;
 196
 197         case HCI_EVENT_CON_COMPL:
 198                 hci_event_con_compl(unit, m);
 199                 break;
 200
 201         case HCI_EVENT_DISCON_COMPL:
 202                 hci_event_discon_compl(unit, m);
 203                 break;
 204
 205         case HCI_EVENT_CON_REQ:
 206                 hci_event_con_req(unit, m);
 207                 break;
 208
 209         case HCI_EVENT_AUTH_COMPL:
 210                 hci_event_auth_compl(unit, m);
 211                 break;
 212
 213         case HCI_EVENT_ENCRYPTION_CHANGE:
 214                 hci_event_encryption_change(unit, m);
 215                 break;
 216
 217         case HCI_EVENT_CHANGE_CON_LINK_KEY_COMPL:
 218                 hci_event_change_con_link_key_compl(unit, m);
 219                 break;
 220
 221         case HCI_EVENT_READ_CLOCK_OFFSET_COMPL:
 222                 hci_event_read_clock_offset_compl(unit, m);
 223                 break;
 224
 225         default:
 226                 break;
 227         }
 228
 229         m_freem(m);
 230 }
 231
 232 /*
 233  * Command Status
 234  *
 235  * Update our record of num_cmd_pkts then post-process any pending commands
 236  * and optionally restart cmd output on the unit.
 237  */
 238 static void
 239 hci_event_command_status(struct hci_unit *unit, struct mbuf *m)
 240 {
 241         hci_command_status_ep ep;
 242         struct hci_link *link;
 243
 244         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 245         m_copydata(m, 0, sizeof(ep), &ep);
 246         m_adj(m, sizeof(ep));
 247
 248         DPRINTFN(1, "(%s) opcode (%03x|%04x) status = 0x%x num_cmd_pkts = %d\n",
 249                 device_get_nameunit(unit->hci_dev),
 250                 HCI_OGF(letoh16(ep.opcode)), HCI_OCF(letoh16(ep.opcode)),
 251                 ep.status,
 252                 ep.num_cmd_pkts);
 253
 254         if (ep.status > 0)
 255                 kprintf("%s: CommandStatus opcode (%03x|%04x) failed "
 256                     "(status=0x%02x)\n", device_get_nameunit(unit->hci_dev),
 257                     HCI_OGF(letoh16(ep.opcode)),
 258                     HCI_OCF(letoh16(ep.opcode)), ep.status);
 259
 260         unit->hci_num_cmd_pkts = ep.num_cmd_pkts;
 261
 262         /*
 263          * post processing of pending commands
 264          */
 265         switch(letoh16(ep.opcode)) {
 266         case HCI_CMD_CREATE_CON:
 267                 switch (ep.status) {
 268                 case 0x12:      /* Invalid HCI command parameters */
 269                         DPRINTF("(%s) Invalid HCI command parameters\n",
 270                             device_get_nameunit(unit->hci_dev));
 271                         while ((link = hci_link_lookup_state(unit,
 272                             HCI_LINK_ACL, HCI_LINK_WAIT_CONNECT)) != NULL)
 273                                 hci_link_free(link, ECONNABORTED);
 274                         break;
 275                 }
 276                 break;
 277         default:
 278                 break;
 279         }
 280
 281         while (unit->hci_num_cmd_pkts > 0 && !IF_QEMPTY(&unit->hci_cmdwait)) {
 282                 IF_DEQUEUE(&unit->hci_cmdwait, m);
 283                 hci_output_cmd(unit, m);
 284         }
 285 }
 286
 287 /*
 288  * Command Complete
 289  *
 290  * Update our record of num_cmd_pkts then handle the completed command,
 291  * and optionally restart cmd output on the unit.
 292  */
 293 static void
 294 hci_event_command_compl(struct hci_unit *unit, struct mbuf *m)
 295 {
 296         hci_command_compl_ep ep;
 297         hci_status_rp rp;
 298
 299         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 300         m_copydata(m, 0, sizeof(ep), &ep);
 301         m_adj(m, sizeof(ep));
 302
 303         DPRINTFN(1, "(%s) opcode (%03x|%04x) num_cmd_pkts = %d\n",
 304                 device_get_nameunit(unit->hci_dev),
 305                 HCI_OGF(letoh16(ep.opcode)), HCI_OCF(letoh16(ep.opcode)),
 306                 ep.num_cmd_pkts);
 307
 308         /*
 309          * I am not sure if this is completely correct, it is not guaranteed
 310          * that a command_complete packet will contain the status though most
 311          * do seem to.
 312          */
 313         m_copydata(m, 0, sizeof(rp), &rp);
 314         if (rp.status > 0)
 315                 kprintf("%s: CommandComplete opcode (%03x|%04x) failed (status=0x%02x)\n",
 316                     device_get_nameunit(unit->hci_dev), HCI_OGF(letoh16(ep.opcode)),
 317                     HCI_OCF(letoh16(ep.opcode)), rp.status);
 318
 319         unit->hci_num_cmd_pkts = ep.num_cmd_pkts;
 320
 321         /*
 322          * post processing of completed commands
 323          */
 324         switch(letoh16(ep.opcode)) {
 325         case HCI_CMD_READ_BDADDR:
 326                 hci_cmd_read_bdaddr(unit, m);
 327                 break;
 328
 329         case HCI_CMD_READ_BUFFER_SIZE:
 330                 hci_cmd_read_buffer_size(unit, m);
 331                 break;
 332
 333         case HCI_CMD_READ_LOCAL_FEATURES:
 334                 hci_cmd_read_local_features(unit, m);
 335                 break;
 336
 337         case HCI_CMD_READ_LOCAL_VER:
 338                 hci_cmd_read_local_ver(unit, m);
 339                 break;
 340
 341         case HCI_CMD_READ_LOCAL_COMMANDS:
 342                 hci_cmd_read_local_commands(unit, m);
 343                 break;
 344
 345         case HCI_CMD_RESET:
 346                 hci_cmd_reset(unit, m);
 347                 break;
 348
 349         default:
 350                 break;
 351         }
 352
 353         while (unit->hci_num_cmd_pkts > 0 && !IF_QEMPTY(&unit->hci_cmdwait)) {
 354                 IF_DEQUEUE(&unit->hci_cmdwait, m);
 355                 hci_output_cmd(unit, m);
 356         }
 357 }
 358
 359 /*
 360  * Number of Completed Packets
 361  *
 362  * This is sent periodically by the Controller telling us how many
 363  * buffers are now freed up and which handle was using them. From
 364  * this we determine which type of buffer it was and add the qty
 365  * back into the relevant packet counter, then restart output on
 366  * links that have halted.
 367  */
 368 static void
 369 hci_event_num_compl_pkts(struct hci_unit *unit, struct mbuf *m)
 370 {
 371         hci_num_compl_pkts_ep ep;
 372         struct hci_link *link, *next;
 373         uint16_t handle, num;
 374         int num_acl = 0, num_sco = 0;
 375
 376         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 377         m_copydata(m, 0, sizeof(ep), &ep);
 378         m_adj(m, sizeof(ep));
 379
 380         while (ep.num_con_handles--) {
 381                 m_copydata(m, 0, sizeof(handle), &handle);
 382                 m_adj(m, sizeof(handle));
 383                 handle = letoh16(handle);
 384
 385                 m_copydata(m, 0, sizeof(num), &num);
 386                 m_adj(m, sizeof(num));
 387                 num = letoh16(num);
 388
 389                 link = hci_link_lookup_handle(unit, handle);
 390                 if (link) {
 391                         if (link->hl_type == HCI_LINK_ACL) {
 392                                 num_acl += num;
 393                                 hci_acl_complete(link, num);
 394                         } else {
 395                                 num_sco += num;
 396                                 hci_sco_complete(link, num);
 397                         }
 398                 } else {
 399                         /* XXX need to issue Read_Buffer_Size or Reset? */
 400                         kprintf("%s: unknown handle %d! "
 401                             "(losing track of %d packet buffer%s)\n",
 402                             device_get_nameunit(unit->hci_dev), handle,
 403                             num, (num == 1 ? "" : "s"));
 404                 }
 405         }
 406
 407         /*
 408          * Move up any queued packets. When a link has sent data, it will move
 409          * to the back of the queue - technically then if a link had something
 410          * to send and there were still buffers available it could get started
 411          * twice but it seemed more important to to handle higher loads fairly
 412          * than worry about wasting cycles when we are not busy.
 413          */
 414
 415         unit->hci_num_acl_pkts += num_acl;
 416         unit->hci_num_sco_pkts += num_sco;
 417
 418         link = TAILQ_FIRST(&unit->hci_links);
 419         while (link && (unit->hci_num_acl_pkts > 0 || unit->hci_num_sco_pkts > 0)) {
 420                 next = TAILQ_NEXT(link, hl_next);
 421
 422                 if (link->hl_type == HCI_LINK_ACL) {
 423                         if (unit->hci_num_acl_pkts > 0 && link->hl_txqlen > 0)
 424                                 hci_acl_start(link);
 425                 } else {
 426                         if (unit->hci_num_sco_pkts > 0 && link->hl_txqlen > 0)
 427                                 hci_sco_start(link);
 428                 }
 429
 430                 link = next;
 431         }
 432 }
 433
 434 /*
 435  * Inquiry Result
 436  *
 437  * keep a note of devices seen, so we know which unit to use
 438  * on outgoing connections
 439  */
 440 static void
 441 hci_event_inquiry_result(struct hci_unit *unit, struct mbuf *m)
 442 {
 443         hci_inquiry_result_ep ep;
 444         hci_inquiry_response ir;
 445         struct hci_memo *memo;
 446
 447         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 448         m_copydata(m, 0, sizeof(ep), &ep);
 449         m_adj(m, sizeof(ep));
 450
 451         DPRINTFN(1, "(%s) %d response%s\n", device_get_nameunit(unit->hci_dev),
 452             ep.num_responses, (ep.num_responses == 1 ? "" : "s"));
 453
 454         while(ep.num_responses--) {
 455                 KKASSERT(m->m_pkthdr.len >= sizeof(ir));
 456                 m_copydata(m, 0, sizeof(ir), &ir);
 457                 m_adj(m, sizeof(ir));
 458
 459                 DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
 460                         ir.bdaddr.b[5], ir.bdaddr.b[4], ir.bdaddr.b[3],
 461                         ir.bdaddr.b[2], ir.bdaddr.b[1], ir.bdaddr.b[0]);
 462
 463                 memo = hci_memo_new(unit, &ir.bdaddr);
 464                 if (memo != NULL) {
 465                         memo->page_scan_rep_mode = ir.page_scan_rep_mode;
 466                         memo->page_scan_mode = ir.page_scan_mode;
 467                         memo->clock_offset = ir.clock_offset;
 468                 }
 469         }
 470 }
 471
 472 /*
 473  * Inquiry Result with RSSI
 474  *
 475  * as above but different packet when RSSI result is enabled
 476  */
 477 static void
 478 hci_event_rssi_result(struct hci_unit *unit, struct mbuf *m)
 479 {
 480         hci_rssi_result_ep ep;
 481         hci_rssi_response rr;
 482         struct hci_memo *memo;
 483
 484         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 485         m_copydata(m, 0, sizeof(ep), &ep);
 486         m_adj(m, sizeof(ep));
 487
 488         DPRINTFN(1, "%d response%s\n", ep.num_responses,
 489                                 (ep.num_responses == 1 ? "" : "s"));
 490
 491         while(ep.num_responses--) {
 492                 KKASSERT(m->m_pkthdr.len >= sizeof(rr));
 493                 m_copydata(m, 0, sizeof(rr), &rr);
 494                 m_adj(m, sizeof(rr));
 495
 496                 DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
 497                         rr.bdaddr.b[5], rr.bdaddr.b[4], rr.bdaddr.b[3],
 498                         rr.bdaddr.b[2], rr.bdaddr.b[1], rr.bdaddr.b[0]);
 499
 500                 memo = hci_memo_new(unit, &rr.bdaddr);
 501                 if (memo != NULL) {
 502                         memo->page_scan_rep_mode = rr.page_scan_rep_mode;
 503                         memo->page_scan_mode = 0;
 504                         memo->clock_offset = rr.clock_offset;
 505                 }
 506         }
 507 }
 508
 509 /*
 510  * Connection Complete
 511  *
 512  * Sent to us when a connection is made. If there is no link
 513  * structure already allocated for this, we must have changed
 514  * our mind, so just disconnect.
 515  */
 516 static void
 517 hci_event_con_compl(struct hci_unit *unit, struct mbuf *m)
 518 {
 519         hci_con_compl_ep ep;
 520         hci_write_link_policy_settings_cp cp;
 521         struct hci_link *link;
 522         int err;
 523
 524         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 525         m_copydata(m, 0, sizeof(ep), &ep);
 526         m_adj(m, sizeof(ep));
 527
 528         DPRINTFN(1, "(%s) %s connection complete for "
 529                 "%02x:%02x:%02x:%02x:%02x:%02x status %#x\n",
 530                 device_get_nameunit(unit->hci_dev),
 531                 (ep.link_type == HCI_LINK_ACL ? "ACL" : "SCO"),
 532                 ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
 533                 ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0],
 534                 ep.status);
 535
 536         link = hci_link_lookup_bdaddr(unit, &ep.bdaddr, ep.link_type);
 537
 538         if (ep.status) {
 539                 if (link != NULL) {
 540                         switch (ep.status) {
 541                         case 0x04: /* "Page Timeout" */
 542                                 err = EHOSTDOWN;
 543                                 break;
 544
 545                         case 0x08: /* "Connection Timed Out" */
 546                         case 0x10: /* "Connection Accept Timeout Exceeded" */
 547                                 err = ETIMEDOUT;
 548                                 break;
 549
 550                         case 0x16: /* "Connection Terminated by Local Host" */
 551                                 err = 0;
 552                                 break;
 553
 554                         default:
 555                                 err = ECONNREFUSED;
 556                                 break;
 557                         }
 558
 559                         hci_link_free(link, err);
 560                 }
 561
 562                 return;
 563         }
 564
 565         if (link == NULL) {
 566                 hci_discon_cp dp;
 567
 568                 dp.con_handle = ep.con_handle;
 569                 dp.reason = 0x13; /* "Remote User Terminated Connection" */
 570
 571                 hci_send_cmd(unit, HCI_CMD_DISCONNECT, &dp, sizeof(dp));
 572                 return;
 573         }
 574
 575         /* XXX could check auth_enable here */
 576
 577         if (ep.encryption_mode)
 578                 link->hl_flags |= (HCI_LINK_AUTH | HCI_LINK_ENCRYPT);
 579
 580         link->hl_state = HCI_LINK_OPEN;
 581         link->hl_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
 582
 583         if (ep.link_type == HCI_LINK_ACL) {
 584                 cp.con_handle = ep.con_handle;
 585                 cp.settings = htole16(unit->hci_link_policy);
 586                 err = hci_send_cmd(unit, HCI_CMD_WRITE_LINK_POLICY_SETTINGS,
 587                                                 &cp, sizeof(cp));
 588                 if (err)
 589                         kprintf("%s: Warning, could not write link policy\n",
 590                             device_get_nameunit(unit->hci_dev));
 591
 592                 err = hci_send_cmd(unit, HCI_CMD_READ_CLOCK_OFFSET,
 593                                     &cp.con_handle, sizeof(cp.con_handle));
 594                 if (err)
 595                         kprintf("%s: Warning, could not read clock offset\n",
 596                             device_get_nameunit(unit->hci_dev));
 597
 598                 err = hci_acl_setmode(link);
 599                 if (err == EINPROGRESS)
 600                         return;
 601
 602                 hci_acl_linkmode(link);
 603         } else {
 604                 (*link->hl_sco->sp_proto->connected)(link->hl_sco->sp_upper);
 605         }
 606 }
 607
 608 /*
 609  * Disconnection Complete
 610  *
 611  * This is sent in response to a disconnection request, but also if
 612  * the remote device goes out of range.
 613  */
 614 static void
 615 hci_event_discon_compl(struct hci_unit *unit, struct mbuf *m)
 616 {
 617         hci_discon_compl_ep ep;
 618         struct hci_link *link;
 619
 620         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 621         m_copydata(m, 0, sizeof(ep), &ep);
 622         m_adj(m, sizeof(ep));
 623
 624         ep.con_handle = letoh16(ep.con_handle);
 625
 626         DPRINTFN(1, "(%s) handle #%d, status=0x%x\n",
 627             device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status);
 628
 629         link = hci_link_lookup_handle(unit, HCI_CON_HANDLE(ep.con_handle));
 630         if (link)
 631                 hci_link_free(link, ENOENT); /* XXX NetBSD used ENOLINK here */
 632 }
 633
 634 /*
 635  * Connect Request
 636  *
 637  * We check upstream for appropriate listeners and accept connections
 638  * that are wanted.
 639  */
 640 static void
 641 hci_event_con_req(struct hci_unit *unit, struct mbuf *m)
 642 {
 643         hci_con_req_ep ep;
 644         hci_accept_con_cp ap;
 645         hci_reject_con_cp rp;
 646         struct hci_link *link;
 647
 648         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 649         m_copydata(m, 0, sizeof(ep), &ep);
 650         m_adj(m, sizeof(ep));
 651
 652         DPRINTFN(1, "(%s) bdaddr %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
 653                 "class %2.2x%2.2x%2.2x type %s\n",
 654             device_get_nameunit(unit->hci_dev),
 655             ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
 656             ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0],
 657             ep.uclass[0], ep.uclass[1], ep.uclass[2],
 658             ep.link_type == HCI_LINK_ACL ? "ACL" : "SCO");
 659
 660         if (ep.link_type == HCI_LINK_ACL)
 661                 link = hci_acl_newconn(unit, &ep.bdaddr);
 662         else
 663                 link = hci_sco_newconn(unit, &ep.bdaddr);
 664
 665         if (link == NULL) {
 666                 memset(&rp, 0, sizeof(rp));
 667                 bdaddr_copy(&rp.bdaddr, &ep.bdaddr);
 668                 rp.reason = 0x0f;       /* Unacceptable BD_ADDR */
 669
 670                 hci_send_cmd(unit, HCI_CMD_REJECT_CON, &rp, sizeof(rp));
 671         } else {
 672                 memset(&ap, 0, sizeof(ap));
 673                 bdaddr_copy(&ap.bdaddr, &ep.bdaddr);
 674                 if (unit->hci_link_policy & HCI_LINK_POLICY_ENABLE_ROLE_SWITCH)
 675                         ap.role = HCI_ROLE_MASTER;
 676                 else
 677                         ap.role = HCI_ROLE_SLAVE;
 678
 679                 hci_send_cmd(unit, HCI_CMD_ACCEPT_CON, &ap, sizeof(ap));
 680         }
 681 }
 682
 683 /*
 684  * Auth Complete
 685  *
 686  * Authentication has been completed on an ACL link. We can notify the
 687  * upper layer protocols unless further mode changes are pending.
 688  */
 689 static void
 690 hci_event_auth_compl(struct hci_unit *unit, struct mbuf *m)
 691 {
 692         hci_auth_compl_ep ep;
 693         struct hci_link *link;
 694         int err;
 695
 696         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 697         m_copydata(m, 0, sizeof(ep), &ep);
 698         m_adj(m, sizeof(ep));
 699
 700         ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
 701
 702         DPRINTFN(1, "(%s) handle #%d, status=0x%x\n",
 703             device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status);
 704
 705         link = hci_link_lookup_handle(unit, ep.con_handle);
 706         if (link == NULL || link->hl_type != HCI_LINK_ACL)
 707                 return;
 708
 709         if (ep.status == 0) {
 710                 link->hl_flags |= HCI_LINK_AUTH;
 711
 712                 if (link->hl_state == HCI_LINK_WAIT_AUTH)
 713                         link->hl_state = HCI_LINK_OPEN;
 714
 715                 err = hci_acl_setmode(link);
 716                 if (err == EINPROGRESS)
 717                         return;
 718         }
 719
 720         hci_acl_linkmode(link);
 721 }
 722
 723 /*
 724  * Encryption Change
 725  *
 726  * The encryption status has changed. Basically, we note the change
 727  * then notify the upper layer protocol unless further mode changes
 728  * are pending.
 729  * Note that if encryption gets disabled when it has been requested,
 730  * we will attempt to enable it again.. (its a feature not a bug :)
 731  */
 732 static void
 733 hci_event_encryption_change(struct hci_unit *unit, struct mbuf *m)
 734 {
 735         hci_encryption_change_ep ep;
 736         struct hci_link *link;
 737         int err;
 738
 739         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 740         m_copydata(m, 0, sizeof(ep), &ep);
 741         m_adj(m, sizeof(ep));
 742
 743         ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
 744
 745         DPRINTFN(1, "(%s) handle #%d, status=0x%x, encryption_enable=0x%x\n",
 746             device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status,
 747             ep.encryption_enable);
 748
 749         link = hci_link_lookup_handle(unit, ep.con_handle);
 750         if (link == NULL || link->hl_type != HCI_LINK_ACL)
 751                 return;
 752
 753         if (ep.status == 0) {
 754                 if (ep.encryption_enable == 0)
 755                         link->hl_flags &= ~HCI_LINK_ENCRYPT;
 756                 else
 757                         link->hl_flags |= (HCI_LINK_AUTH | HCI_LINK_ENCRYPT);
 758
 759                 if (link->hl_state == HCI_LINK_WAIT_ENCRYPT)
 760                         link->hl_state = HCI_LINK_OPEN;
 761
 762                 err = hci_acl_setmode(link);
 763                 if (err == EINPROGRESS)
 764                         return;
 765         }
 766
 767         hci_acl_linkmode(link);
 768 }
 769
 770 /*
 771  * Change Connection Link Key Complete
 772  *
 773  * Link keys are handled in userland but if we are waiting to secure
 774  * this link, we should notify the upper protocols. A SECURE request
 775  * only needs a single key change, so we can cancel the request.
 776  */
 777 static void
 778 hci_event_change_con_link_key_compl(struct hci_unit *unit, struct mbuf *m)
 779 {
 780         hci_change_con_link_key_compl_ep ep;
 781         struct hci_link *link;
 782         int err;
 783
 784         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 785         m_copydata(m, 0, sizeof(ep), &ep);
 786         m_adj(m, sizeof(ep));
 787
 788         ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
 789
 790         DPRINTFN(1, "(%s) handle #%d, status=0x%x\n",
 791             device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status);
 792
 793         link = hci_link_lookup_handle(unit, ep.con_handle);
 794         if (link == NULL || link->hl_type != HCI_LINK_ACL)
 795                 return;
 796
 797         link->hl_flags &= ~HCI_LINK_SECURE_REQ;
 798
 799         if (ep.status == 0) {
 800                 link->hl_flags |= (HCI_LINK_AUTH | HCI_LINK_SECURE);
 801
 802                 if (link->hl_state == HCI_LINK_WAIT_SECURE)
 803                         link->hl_state = HCI_LINK_OPEN;
 804
 805                 err = hci_acl_setmode(link);
 806                 if (err == EINPROGRESS)
 807                         return;
 808         }
 809
 810         hci_acl_linkmode(link);
 811 }
 812
 813 /*
 814  * Read Clock Offset Complete
 815  *
 816  * We keep a note of the clock offset of remote devices when a
 817  * link is made, in order to facilitate reconnections to the device
 818  */
 819 static void
 820 hci_event_read_clock_offset_compl(struct hci_unit *unit, struct mbuf *m)
 821 {
 822         hci_read_clock_offset_compl_ep ep;
 823         struct hci_link *link;
 824
 825         KKASSERT(m->m_pkthdr.len >= sizeof(ep));
 826         m_copydata(m, 0, sizeof(ep), &ep);
 827         m_adj(m, sizeof(ep));
 828
 829         DPRINTFN(1, "handle #%d, offset=%u, status=0x%x\n",
 830             letoh16(ep.con_handle), letoh16(ep.clock_offset), ep.status);
 831
 832         ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
 833         link = hci_link_lookup_handle(unit, ep.con_handle);
 834
 835         if (ep.status != 0 || link == NULL)
 836                 return;
 837
 838         link->hl_clock = ep.clock_offset;
 839 }
 840
 841 /*
 842  * process results of read_bdaddr command_complete event
 843  */
 844 static void
 845 hci_cmd_read_bdaddr(struct hci_unit *unit, struct mbuf *m)
 846 {
 847         hci_read_bdaddr_rp rp;
 848
 849         KKASSERT(m->m_pkthdr.len >= sizeof(rp));
 850         m_copydata(m, 0, sizeof(rp), &rp);
 851         m_adj(m, sizeof(rp));
 852
 853         if (rp.status > 0)
 854                 return;
 855
 856         if ((unit->hci_flags & BTF_INIT_BDADDR) == 0)
 857                 return;
 858
 859         bdaddr_copy(&unit->hci_bdaddr, &rp.bdaddr);
 860
 861         unit->hci_flags &= ~BTF_INIT_BDADDR;
 862
 863         wakeup(unit);
 864 }
 865
 866 /*
 867  * process results of read_buffer_size command_complete event
 868  */
 869 static void
 870 hci_cmd_read_buffer_size(struct hci_unit *unit, struct mbuf *m)
 871 {
 872         hci_read_buffer_size_rp rp;
 873
 874         KKASSERT(m->m_pkthdr.len >= sizeof(rp));
 875         m_copydata(m, 0, sizeof(rp), &rp);
 876         m_adj(m, sizeof(rp));
 877
 878         if (rp.status > 0)
 879                 return;
 880
 881         if ((unit->hci_flags & BTF_INIT_BUFFER_SIZE) == 0)
 882                 return;
 883
 884         unit->hci_max_acl_size = letoh16(rp.max_acl_size);
 885         unit->hci_num_acl_pkts = letoh16(rp.num_acl_pkts);
 886         unit->hci_max_sco_size = rp.max_sco_size;
 887         unit->hci_num_sco_pkts = letoh16(rp.num_sco_pkts);
 888
 889         unit->hci_flags &= ~BTF_INIT_BUFFER_SIZE;
 890
 891         wakeup(unit);
 892 }
 893
 894 /*
 895  * process results of read_local_features command_complete event
 896  */
 897 static void
 898 hci_cmd_read_local_features(struct hci_unit *unit, struct mbuf *m)
 899 {
 900         hci_read_local_features_rp rp;
 901
 902         KKASSERT(m->m_pkthdr.len >= sizeof(rp));
 903         m_copydata(m, 0, sizeof(rp), &rp);
 904         m_adj(m, sizeof(rp));
 905
 906         if (rp.status > 0)
 907                 return;
 908
 909         if ((unit->hci_flags & BTF_INIT_FEATURES) == 0)
 910                 return;
 911
 912         unit->hci_lmp_mask = 0;
 913
 914         if (rp.features[0] & HCI_LMP_ROLE_SWITCH)
 915                 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_ROLE_SWITCH;
 916
 917         if (rp.features[0] & HCI_LMP_HOLD_MODE)
 918                 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_HOLD_MODE;
 919
 920         if (rp.features[0] & HCI_LMP_SNIFF_MODE)
 921                 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_SNIFF_MODE;
 922
 923         if (rp.features[1] & HCI_LMP_PARK_MODE)
 924                 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_PARK_MODE;
 925
 926         /* ACL packet mask */
 927         unit->hci_acl_mask = HCI_PKT_DM1 | HCI_PKT_DH1;
 928
 929         if (rp.features[0] & HCI_LMP_3SLOT)
 930                 unit->hci_acl_mask |= HCI_PKT_DM3 | HCI_PKT_DH3;
 931
 932         if (rp.features[0] & HCI_LMP_5SLOT)
 933                 unit->hci_acl_mask |= HCI_PKT_DM5 | HCI_PKT_DH5;
 934
 935         if ((rp.features[3] & HCI_LMP_EDR_ACL_2MBPS) == 0)
 936                 unit->hci_acl_mask |= HCI_PKT_2MBPS_DH1
 937                                     | HCI_PKT_2MBPS_DH3
 938                                     | HCI_PKT_2MBPS_DH5;
 939
 940         if ((rp.features[3] & HCI_LMP_EDR_ACL_3MBPS) == 0)
 941                 unit->hci_acl_mask |= HCI_PKT_3MBPS_DH1
 942                                     | HCI_PKT_3MBPS_DH3
 943                                     | HCI_PKT_3MBPS_DH5;
 944
 945         if ((rp.features[4] & HCI_LMP_3SLOT_EDR_ACL) == 0)
 946                 unit->hci_acl_mask |= HCI_PKT_2MBPS_DH3
 947                                     | HCI_PKT_3MBPS_DH3;
 948
 949         if ((rp.features[5] & HCI_LMP_5SLOT_EDR_ACL) == 0)
 950                 unit->hci_acl_mask |= HCI_PKT_2MBPS_DH5
 951                                     | HCI_PKT_3MBPS_DH5;
 952
 953         unit->hci_packet_type = unit->hci_acl_mask;
 954
 955         /* SCO packet mask */
 956         unit->hci_sco_mask = 0;
 957         if (rp.features[1] & HCI_LMP_SCO_LINK)
 958                 unit->hci_sco_mask |= HCI_PKT_HV1;
 959
 960         if (rp.features[1] & HCI_LMP_HV2_PKT)
 961                 unit->hci_sco_mask |= HCI_PKT_HV2;
 962
 963         if (rp.features[1] & HCI_LMP_HV3_PKT)
 964                 unit->hci_sco_mask |= HCI_PKT_HV3;
 965
 966         if (rp.features[3] & HCI_LMP_EV3_PKT)
 967                 unit->hci_sco_mask |= HCI_PKT_EV3;
 968
 969         if (rp.features[4] & HCI_LMP_EV4_PKT)
 970                 unit->hci_sco_mask |= HCI_PKT_EV4;
 971
 972         if (rp.features[4] & HCI_LMP_EV5_PKT)
 973                 unit->hci_sco_mask |= HCI_PKT_EV5;
 974
 975         /* XXX what do 2MBPS/3MBPS/3SLOT eSCO mean? */
 976
 977         unit->hci_flags &= ~BTF_INIT_FEATURES;
 978
 979         wakeup(unit);
 980
 981         DPRINTFN(1, "%s: lmp_mask %4.4x, acl_mask %4.4x, sco_mask %4.4x\n",
 982                 device_get_nameunit(unit->hci_dev), unit->hci_lmp_mask,
 983                 unit->hci_acl_mask, unit->hci_sco_mask);
 984 }
 985
 986 /*
 987  * process results of read_local_ver command_complete event
 988  *
 989  * reading local supported commands is only supported from 1.2 spec
 990  */
 991 static void
 992 hci_cmd_read_local_ver(struct hci_unit *unit, struct mbuf *m)
 993 {
 994         hci_read_local_ver_rp rp;
 995
 996         KKASSERT(m->m_pkthdr.len >= sizeof(rp));
 997         m_copydata(m, 0, sizeof(rp), &rp);
 998         m_adj(m, sizeof(rp));
 999
1000         if (rp.status != 0)
1001                 return;
1002
1003         if ((unit->hci_flags & BTF_INIT_COMMANDS) == 0)
1004                 return;
1005
1006         if (rp.hci_version < HCI_SPEC_V12) {
1007                 unit->hci_flags &= ~BTF_INIT_COMMANDS;
1008                 wakeup(unit);
1009                 return;
1010         }
1011
1012         hci_send_cmd(unit, HCI_CMD_READ_LOCAL_COMMANDS, NULL, 0);
1013 }
1014
1015 /*
1016  * process results of read_local_commands command_complete event
1017  */
1018 static void
1019 hci_cmd_read_local_commands(struct hci_unit *unit, struct mbuf *m)
1020 {
1021         hci_read_local_commands_rp rp;
1022
1023         KKASSERT(m->m_pkthdr.len >= sizeof(rp));
1024         m_copydata(m, 0, sizeof(rp), &rp);
1025         m_adj(m, sizeof(rp));
1026
1027         if (rp.status != 0)
1028                 return;
1029
1030         if ((unit->hci_flags & BTF_INIT_COMMANDS) == 0)
1031                 return;
1032
1033         unit->hci_flags &= ~BTF_INIT_COMMANDS;
1034         memcpy(unit->hci_cmds, rp.commands, HCI_COMMANDS_SIZE);
1035
1036         wakeup(unit);
1037 }
1038
1039 /*
1040  * process results of reset command_complete event
1041  *
1042  * This has killed all the connections, so close down anything we have left,
1043  * and reinitialise the unit.
1044  */
1045 static void
1046 hci_cmd_reset(struct hci_unit *unit, struct mbuf *m)
1047 {
1048         hci_reset_rp rp;
1049         struct hci_link *link, *next;
1050         int acl;
1051
1052         KKASSERT(m->m_pkthdr.len >= sizeof(rp));
1053         m_copydata(m, 0, sizeof(rp), &rp);
1054         m_adj(m, sizeof(rp));
1055
1056         if (rp.status != 0)
1057                 return;
1058
1059         /*
1060          * release SCO links first, since they may be holding
1061          * an ACL link reference.
1062          */
1063         for (acl = 0 ; acl < 2 ; acl++) {
1064                 next = TAILQ_FIRST(&unit->hci_links);
1065                 while ((link = next) != NULL) {
1066                         next = TAILQ_NEXT(link, hl_next);
1067                         if (acl || link->hl_type != HCI_LINK_ACL)
1068                                 hci_link_free(link, ECONNABORTED);
1069                 }
1070         }
1071
1072         unit->hci_num_acl_pkts = 0;
1073         unit->hci_num_sco_pkts = 0;
1074
1075         if (hci_send_cmd(unit, HCI_CMD_READ_BDADDR, NULL, 0))
1076                 return;
1077
1078         if (hci_send_cmd(unit, HCI_CMD_READ_BUFFER_SIZE, NULL, 0))
1079                 return;
1080
1081         if (hci_send_cmd(unit, HCI_CMD_READ_LOCAL_FEATURES, NULL, 0))
1082                 return;
1083
1084         if (hci_send_cmd(unit, HCI_CMD_READ_LOCAL_VER, NULL, 0))
1085                 return;
1086 }