1 /* $OpenBSD: src/sys/netbt/hci_event.c,v 1.7 2008/02/24 21:34:48 uwe Exp $ */
2 /* $NetBSD: hci_event.c,v 1.14 2008/02/10 17:40:54 plunky Exp $ */
3
4 /*-
5 * Copyright (c) 2005 Iain Hibbert.
6 * Copyright (c) 2006 Itronix Inc.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. The name of Itronix Inc. may not be used to endorse
18 * or promote products derived from this software without specific
19 * prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
25 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28 * ON ANY THEORY OF LIABILITY, WHETHER IN
29 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 #include <sys/param.h>
35 #include <sys/kernel.h>
36 #include <sys/malloc.h>
37 #include <sys/mbuf.h>
38 #include <sys/proc.h>
39 #include <sys/systm.h>
40 #include <sys/endian.h>
41 #include <sys/bus.h>
42
43 #include <netbt/bluetooth.h>
44 #include <netbt/hci.h>
45 #include <netbt/sco.h>
46
47 static void hci_event_inquiry_result(struct hci_unit *, struct mbuf *);
48 static void hci_event_rssi_result(struct hci_unit *, struct mbuf *);
49 static void hci_event_command_status(struct hci_unit *, struct mbuf *);
50 static void hci_event_command_compl(struct hci_unit *, struct mbuf *);
51 static void hci_event_con_compl(struct hci_unit *, struct mbuf *);
52 static void hci_event_discon_compl(struct hci_unit *, struct mbuf *);
53 static void hci_event_con_req(struct hci_unit *, struct mbuf *);
54 static void hci_event_num_compl_pkts(struct hci_unit *, struct mbuf *);
55 static void hci_event_auth_compl(struct hci_unit *, struct mbuf *);
56 static void hci_event_encryption_change(struct hci_unit *, struct mbuf *);
57 static void hci_event_change_con_link_key_compl(struct hci_unit *, struct mbuf *);
58 static void hci_event_read_clock_offset_compl(struct hci_unit *, struct mbuf *);
59 static void hci_cmd_read_bdaddr(struct hci_unit *, struct mbuf *);
60 static void hci_cmd_read_buffer_size(struct hci_unit *, struct mbuf *);
61 static void hci_cmd_read_local_features(struct hci_unit *, struct mbuf *);
62 static void hci_cmd_read_local_ver(struct hci_unit *, struct mbuf *);
63 static void hci_cmd_read_local_commands(struct hci_unit *, struct mbuf *);
64 static void hci_cmd_reset(struct hci_unit *, struct mbuf *);
65
66 #ifdef BLUETOOTH_DEBUG
67 int bluetooth_debug = BLUETOOTH_DEBUG;
68
69 static const char *hci_eventnames[] = {
70 /* 0x00 */ "NULL",
71 /* 0x01 */ "INQUIRY COMPLETE",
72 /* 0x02 */ "INQUIRY RESULT",
73 /* 0x03 */ "CONN COMPLETE",
74 /* 0x04 */ "CONN REQ",
75 /* 0x05 */ "DISCONN COMPLETE",
76 /* 0x06 */ "AUTH COMPLETE",
77 /* 0x07 */ "REMOTE NAME REQ COMPLETE",
78 /* 0x08 */ "ENCRYPTION CHANGE",
79 /* 0x09 */ "CHANGE CONN LINK KEY COMPLETE",
80 /* 0x0a */ "MASTER LINK KEY COMPLETE",
81 /* 0x0b */ "READ REMOTE FEATURES COMPLETE",
82 /* 0x0c */ "READ REMOTE VERSION INFO COMPLETE",
83 /* 0x0d */ "QoS SETUP COMPLETE",
84 /* 0x0e */ "COMMAND COMPLETE",
85 /* 0x0f */ "COMMAND STATUS",
86 /* 0x10 */ "HARDWARE ERROR",
87 /* 0x11 */ "FLUSH OCCUR",
88 /* 0x12 */ "ROLE CHANGE",
89 /* 0x13 */ "NUM COMPLETED PACKETS",
90 /* 0x14 */ "MODE CHANGE",
91 /* 0x15 */ "RETURN LINK KEYS",
92 /* 0x16 */ "PIN CODE REQ",
93 /* 0x17 */ "LINK KEY REQ",
94 /* 0x18 */ "LINK KEY NOTIFICATION",
95 /* 0x19 */ "LOOPBACK COMMAND",
96 /* 0x1a */ "DATA BUFFER OVERFLOW",
97 /* 0x1b */ "MAX SLOT CHANGE",
98 /* 0x1c */ "READ CLOCK OFFSET COMPLETE",
99 /* 0x1d */ "CONN PKT TYPE CHANGED",
100 /* 0x1e */ "QOS VIOLATION",
101 /* 0x1f */ "PAGE SCAN MODE CHANGE",
102 /* 0x20 */ "PAGE SCAN REP MODE CHANGE",
103 /* 0x21 */ "FLOW SPECIFICATION COMPLETE",
104 /* 0x22 */ "RSSI RESULT",
105 /* 0x23 */ "READ REMOTE EXT FEATURES",
106 /* 0x24 */ "UNKNOWN",
107 /* 0x25 */ "UNKNOWN",
108 /* 0x26 */ "UNKNOWN",
109 /* 0x27 */ "UNKNOWN",
110 /* 0x28 */ "UNKNOWN",
111 /* 0x29 */ "UNKNOWN",
112 /* 0x2a */ "UNKNOWN",
113 /* 0x2b */ "UNKNOWN",
114 /* 0x2c */ "SCO CON COMPLETE",
115 /* 0x2d */ "SCO CON CHANGED",
116 /* 0x2e */ "SNIFF SUBRATING",
117 /* 0x2f */ "EXTENDED INQUIRY RESULT",
118 /* 0x30 */ "ENCRYPTION KEY REFRESH",
119 /* 0x31 */ "IO CAPABILITY REQUEST",
120 /* 0x32 */ "IO CAPABILITY RESPONSE",
121 /* 0x33 */ "USER CONFIRM REQUEST",
122 /* 0x34 */ "USER PASSKEY REQUEST",
123 /* 0x35 */ "REMOTE OOB DATA REQUEST",
124 /* 0x36 */ "SIMPLE PAIRING COMPLETE",
125 /* 0x37 */ "UNKNOWN",
126 /* 0x38 */ "LINK SUPERVISION TIMEOUT CHANGED",
127 /* 0x39 */ "ENHANCED FLUSH COMPLETE",
128 /* 0x3a */ "UNKNOWN",
129 /* 0x3b */ "USER PASSKEY NOTIFICATION",
130 /* 0x3c */ "KEYPRESS NOTIFICATION",
131 /* 0x3d */ "REMOTE HOST FEATURES NOTIFICATION",
132 };
133
134 static const char *
hci_eventstr(unsigned int event)135 hci_eventstr(unsigned int event)
136 {
137
138 if (event < NELEM(hci_eventnames))
139 return hci_eventnames[event];
140
141 switch (event) {
142 case HCI_EVENT_BT_LOGO: /* 0xfe */
143 return "BT_LOGO";
144
145 case HCI_EVENT_VENDOR: /* 0xff */
146 return "VENDOR";
147 }
148
149 return "UNKNOWN";
150 }
151 #endif /* BLUETOOTH_DEBUG */
152
153 /*
154 * process HCI Events
155 *
156 * We will free the mbuf at the end, no need for any sub
157 * functions to handle that. We kind of assume that the
158 * device sends us valid events.
159 */
160 void
hci_event(struct mbuf * m,struct hci_unit * unit)161 hci_event(struct mbuf *m, struct hci_unit *unit)
162 {
163 hci_event_hdr_t hdr;
164
165 KKASSERT(m->m_flags & M_PKTHDR);
166
167 KKASSERT(m->m_pkthdr.len >= sizeof(hdr));
168 m_copydata(m, 0, sizeof(hdr), &hdr);
169 m_adj(m, sizeof(hdr));
170
171 KKASSERT(hdr.type == HCI_EVENT_PKT);
172
173 DPRINTFN(1, "(%s) event %s\n",
174 device_get_nameunit(unit->hci_dev), hci_eventstr(hdr.event));
175
176 switch(hdr.event) {
177 case HCI_EVENT_COMMAND_STATUS:
178 hci_event_command_status(unit, m);
179 break;
180
181 case HCI_EVENT_COMMAND_COMPL:
182 hci_event_command_compl(unit, m);
183 break;
184
185 case HCI_EVENT_NUM_COMPL_PKTS:
186 hci_event_num_compl_pkts(unit, m);
187 break;
188
189 case HCI_EVENT_INQUIRY_RESULT:
190 hci_event_inquiry_result(unit, m);
191 break;
192
193 case HCI_EVENT_RSSI_RESULT:
194 hci_event_rssi_result(unit, m);
195 break;
196
197 case HCI_EVENT_CON_COMPL:
198 hci_event_con_compl(unit, m);
199 break;
200
201 case HCI_EVENT_DISCON_COMPL:
202 hci_event_discon_compl(unit, m);
203 break;
204
205 case HCI_EVENT_CON_REQ:
206 hci_event_con_req(unit, m);
207 break;
208
209 case HCI_EVENT_AUTH_COMPL:
210 hci_event_auth_compl(unit, m);
211 break;
212
213 case HCI_EVENT_ENCRYPTION_CHANGE:
214 hci_event_encryption_change(unit, m);
215 break;
216
217 case HCI_EVENT_CHANGE_CON_LINK_KEY_COMPL:
218 hci_event_change_con_link_key_compl(unit, m);
219 break;
220
221 case HCI_EVENT_READ_CLOCK_OFFSET_COMPL:
222 hci_event_read_clock_offset_compl(unit, m);
223 break;
224
225 default:
226 break;
227 }
228
229 m_freem(m);
230 }
231
232 /*
233 * Command Status
234 *
235 * Update our record of num_cmd_pkts then post-process any pending commands
236 * and optionally restart cmd output on the unit.
237 */
238 static void
hci_event_command_status(struct hci_unit * unit,struct mbuf * m)239 hci_event_command_status(struct hci_unit *unit, struct mbuf *m)
240 {
241 hci_command_status_ep ep;
242 struct hci_link *link;
243
244 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
245 m_copydata(m, 0, sizeof(ep), &ep);
246 m_adj(m, sizeof(ep));
247
248 DPRINTFN(1, "(%s) opcode (%03x|%04x) status = 0x%x num_cmd_pkts = %d\n",
249 device_get_nameunit(unit->hci_dev),
250 HCI_OGF(letoh16(ep.opcode)), HCI_OCF(letoh16(ep.opcode)),
251 ep.status,
252 ep.num_cmd_pkts);
253
254 if (ep.status > 0)
255 kprintf("%s: CommandStatus opcode (%03x|%04x) failed "
256 "(status=0x%02x)\n", device_get_nameunit(unit->hci_dev),
257 HCI_OGF(letoh16(ep.opcode)),
258 HCI_OCF(letoh16(ep.opcode)), ep.status);
259
260 unit->hci_num_cmd_pkts = ep.num_cmd_pkts;
261
262 /*
263 * post processing of pending commands
264 */
265 switch(letoh16(ep.opcode)) {
266 case HCI_CMD_CREATE_CON:
267 switch (ep.status) {
268 case 0x12: /* Invalid HCI command parameters */
269 DPRINTF("(%s) Invalid HCI command parameters\n",
270 device_get_nameunit(unit->hci_dev));
271 while ((link = hci_link_lookup_state(unit,
272 HCI_LINK_ACL, HCI_LINK_WAIT_CONNECT)) != NULL)
273 hci_link_free(link, ECONNABORTED);
274 break;
275 }
276 break;
277 default:
278 break;
279 }
280
281 while (unit->hci_num_cmd_pkts > 0 && !IF_QEMPTY(&unit->hci_cmdwait)) {
282 IF_DEQUEUE(&unit->hci_cmdwait, m);
283 hci_output_cmd(unit, m);
284 }
285 }
286
287 /*
288 * Command Complete
289 *
290 * Update our record of num_cmd_pkts then handle the completed command,
291 * and optionally restart cmd output on the unit.
292 */
293 static void
hci_event_command_compl(struct hci_unit * unit,struct mbuf * m)294 hci_event_command_compl(struct hci_unit *unit, struct mbuf *m)
295 {
296 hci_command_compl_ep ep;
297 hci_status_rp rp;
298
299 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
300 m_copydata(m, 0, sizeof(ep), &ep);
301 m_adj(m, sizeof(ep));
302
303 DPRINTFN(1, "(%s) opcode (%03x|%04x) num_cmd_pkts = %d\n",
304 device_get_nameunit(unit->hci_dev),
305 HCI_OGF(letoh16(ep.opcode)), HCI_OCF(letoh16(ep.opcode)),
306 ep.num_cmd_pkts);
307
308 /*
309 * I am not sure if this is completely correct, it is not guaranteed
310 * that a command_complete packet will contain the status though most
311 * do seem to.
312 */
313 m_copydata(m, 0, sizeof(rp), &rp);
314 if (rp.status > 0)
315 kprintf("%s: CommandComplete opcode (%03x|%04x) failed (status=0x%02x)\n",
316 device_get_nameunit(unit->hci_dev), HCI_OGF(letoh16(ep.opcode)),
317 HCI_OCF(letoh16(ep.opcode)), rp.status);
318
319 unit->hci_num_cmd_pkts = ep.num_cmd_pkts;
320
321 /*
322 * post processing of completed commands
323 */
324 switch(letoh16(ep.opcode)) {
325 case HCI_CMD_READ_BDADDR:
326 hci_cmd_read_bdaddr(unit, m);
327 break;
328
329 case HCI_CMD_READ_BUFFER_SIZE:
330 hci_cmd_read_buffer_size(unit, m);
331 break;
332
333 case HCI_CMD_READ_LOCAL_FEATURES:
334 hci_cmd_read_local_features(unit, m);
335 break;
336
337 case HCI_CMD_READ_LOCAL_VER:
338 hci_cmd_read_local_ver(unit, m);
339 break;
340
341 case HCI_CMD_READ_LOCAL_COMMANDS:
342 hci_cmd_read_local_commands(unit, m);
343 break;
344
345 case HCI_CMD_RESET:
346 hci_cmd_reset(unit, m);
347 break;
348
349 default:
350 break;
351 }
352
353 while (unit->hci_num_cmd_pkts > 0 && !IF_QEMPTY(&unit->hci_cmdwait)) {
354 IF_DEQUEUE(&unit->hci_cmdwait, m);
355 hci_output_cmd(unit, m);
356 }
357 }
358
359 /*
360 * Number of Completed Packets
361 *
362 * This is sent periodically by the Controller telling us how many
363 * buffers are now freed up and which handle was using them. From
364 * this we determine which type of buffer it was and add the qty
365 * back into the relevant packet counter, then restart output on
366 * links that have halted.
367 */
368 static void
hci_event_num_compl_pkts(struct hci_unit * unit,struct mbuf * m)369 hci_event_num_compl_pkts(struct hci_unit *unit, struct mbuf *m)
370 {
371 hci_num_compl_pkts_ep ep;
372 struct hci_link *link, *next;
373 uint16_t handle, num;
374 int num_acl = 0, num_sco = 0;
375
376 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
377 m_copydata(m, 0, sizeof(ep), &ep);
378 m_adj(m, sizeof(ep));
379
380 while (ep.num_con_handles--) {
381 m_copydata(m, 0, sizeof(handle), &handle);
382 m_adj(m, sizeof(handle));
383 handle = letoh16(handle);
384
385 m_copydata(m, 0, sizeof(num), &num);
386 m_adj(m, sizeof(num));
387 num = letoh16(num);
388
389 link = hci_link_lookup_handle(unit, handle);
390 if (link) {
391 if (link->hl_type == HCI_LINK_ACL) {
392 num_acl += num;
393 hci_acl_complete(link, num);
394 } else {
395 num_sco += num;
396 hci_sco_complete(link, num);
397 }
398 } else {
399 /* XXX need to issue Read_Buffer_Size or Reset? */
400 kprintf("%s: unknown handle %d! "
401 "(losing track of %d packet buffer%s)\n",
402 device_get_nameunit(unit->hci_dev), handle,
403 num, (num == 1 ? "" : "s"));
404 }
405 }
406
407 /*
408 * Move up any queued packets. When a link has sent data, it will move
409 * to the back of the queue - technically then if a link had something
410 * to send and there were still buffers available it could get started
411 * twice but it seemed more important to to handle higher loads fairly
412 * than worry about wasting cycles when we are not busy.
413 */
414
415 unit->hci_num_acl_pkts += num_acl;
416 unit->hci_num_sco_pkts += num_sco;
417
418 link = TAILQ_FIRST(&unit->hci_links);
419 while (link && (unit->hci_num_acl_pkts > 0 || unit->hci_num_sco_pkts > 0)) {
420 next = TAILQ_NEXT(link, hl_next);
421
422 if (link->hl_type == HCI_LINK_ACL) {
423 if (unit->hci_num_acl_pkts > 0 && link->hl_txqlen > 0)
424 hci_acl_start(link);
425 } else {
426 if (unit->hci_num_sco_pkts > 0 && link->hl_txqlen > 0)
427 hci_sco_start(link);
428 }
429
430 link = next;
431 }
432 }
433
434 /*
435 * Inquiry Result
436 *
437 * keep a note of devices seen, so we know which unit to use
438 * on outgoing connections
439 */
440 static void
hci_event_inquiry_result(struct hci_unit * unit,struct mbuf * m)441 hci_event_inquiry_result(struct hci_unit *unit, struct mbuf *m)
442 {
443 hci_inquiry_result_ep ep;
444 hci_inquiry_response ir;
445 struct hci_memo *memo;
446
447 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
448 m_copydata(m, 0, sizeof(ep), &ep);
449 m_adj(m, sizeof(ep));
450
451 DPRINTFN(1, "(%s) %d response%s\n", device_get_nameunit(unit->hci_dev),
452 ep.num_responses, (ep.num_responses == 1 ? "" : "s"));
453
454 while(ep.num_responses--) {
455 KKASSERT(m->m_pkthdr.len >= sizeof(ir));
456 m_copydata(m, 0, sizeof(ir), &ir);
457 m_adj(m, sizeof(ir));
458
459 DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
460 ir.bdaddr.b[5], ir.bdaddr.b[4], ir.bdaddr.b[3],
461 ir.bdaddr.b[2], ir.bdaddr.b[1], ir.bdaddr.b[0]);
462
463 memo = hci_memo_new(unit, &ir.bdaddr);
464 if (memo != NULL) {
465 memo->page_scan_rep_mode = ir.page_scan_rep_mode;
466 memo->page_scan_mode = ir.page_scan_mode;
467 memo->clock_offset = ir.clock_offset;
468 }
469 }
470 }
471
472 /*
473 * Inquiry Result with RSSI
474 *
475 * as above but different packet when RSSI result is enabled
476 */
477 static void
hci_event_rssi_result(struct hci_unit * unit,struct mbuf * m)478 hci_event_rssi_result(struct hci_unit *unit, struct mbuf *m)
479 {
480 hci_rssi_result_ep ep;
481 hci_rssi_response rr;
482 struct hci_memo *memo;
483
484 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
485 m_copydata(m, 0, sizeof(ep), &ep);
486 m_adj(m, sizeof(ep));
487
488 DPRINTFN(1, "%d response%s\n", ep.num_responses,
489 (ep.num_responses == 1 ? "" : "s"));
490
491 while(ep.num_responses--) {
492 KKASSERT(m->m_pkthdr.len >= sizeof(rr));
493 m_copydata(m, 0, sizeof(rr), &rr);
494 m_adj(m, sizeof(rr));
495
496 DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
497 rr.bdaddr.b[5], rr.bdaddr.b[4], rr.bdaddr.b[3],
498 rr.bdaddr.b[2], rr.bdaddr.b[1], rr.bdaddr.b[0]);
499
500 memo = hci_memo_new(unit, &rr.bdaddr);
501 if (memo != NULL) {
502 memo->page_scan_rep_mode = rr.page_scan_rep_mode;
503 memo->page_scan_mode = 0;
504 memo->clock_offset = rr.clock_offset;
505 }
506 }
507 }
508
509 /*
510 * Connection Complete
511 *
512 * Sent to us when a connection is made. If there is no link
513 * structure already allocated for this, we must have changed
514 * our mind, so just disconnect.
515 */
516 static void
hci_event_con_compl(struct hci_unit * unit,struct mbuf * m)517 hci_event_con_compl(struct hci_unit *unit, struct mbuf *m)
518 {
519 hci_con_compl_ep ep;
520 hci_write_link_policy_settings_cp cp;
521 struct hci_link *link;
522 int err;
523
524 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
525 m_copydata(m, 0, sizeof(ep), &ep);
526 m_adj(m, sizeof(ep));
527
528 DPRINTFN(1, "(%s) %s connection complete for "
529 "%02x:%02x:%02x:%02x:%02x:%02x status %#x\n",
530 device_get_nameunit(unit->hci_dev),
531 (ep.link_type == HCI_LINK_ACL ? "ACL" : "SCO"),
532 ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
533 ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0],
534 ep.status);
535
536 link = hci_link_lookup_bdaddr(unit, &ep.bdaddr, ep.link_type);
537
538 if (ep.status) {
539 if (link != NULL) {
540 switch (ep.status) {
541 case 0x04: /* "Page Timeout" */
542 err = EHOSTDOWN;
543 break;
544
545 case 0x08: /* "Connection Timed Out" */
546 case 0x10: /* "Connection Accept Timeout Exceeded" */
547 err = ETIMEDOUT;
548 break;
549
550 case 0x16: /* "Connection Terminated by Local Host" */
551 err = 0;
552 break;
553
554 default:
555 err = ECONNREFUSED;
556 break;
557 }
558
559 hci_link_free(link, err);
560 }
561
562 return;
563 }
564
565 if (link == NULL) {
566 hci_discon_cp dp;
567
568 dp.con_handle = ep.con_handle;
569 dp.reason = 0x13; /* "Remote User Terminated Connection" */
570
571 hci_send_cmd(unit, HCI_CMD_DISCONNECT, &dp, sizeof(dp));
572 return;
573 }
574
575 /* XXX could check auth_enable here */
576
577 if (ep.encryption_mode)
578 link->hl_flags |= (HCI_LINK_AUTH | HCI_LINK_ENCRYPT);
579
580 link->hl_state = HCI_LINK_OPEN;
581 link->hl_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
582
583 if (ep.link_type == HCI_LINK_ACL) {
584 cp.con_handle = ep.con_handle;
585 cp.settings = htole16(unit->hci_link_policy);
586 err = hci_send_cmd(unit, HCI_CMD_WRITE_LINK_POLICY_SETTINGS,
587 &cp, sizeof(cp));
588 if (err)
589 kprintf("%s: Warning, could not write link policy\n",
590 device_get_nameunit(unit->hci_dev));
591
592 err = hci_send_cmd(unit, HCI_CMD_READ_CLOCK_OFFSET,
593 &cp.con_handle, sizeof(cp.con_handle));
594 if (err)
595 kprintf("%s: Warning, could not read clock offset\n",
596 device_get_nameunit(unit->hci_dev));
597
598 err = hci_acl_setmode(link);
599 if (err == EINPROGRESS)
600 return;
601
602 hci_acl_linkmode(link);
603 } else {
604 (*link->hl_sco->sp_proto->connected)(link->hl_sco->sp_upper);
605 }
606 }
607
608 /*
609 * Disconnection Complete
610 *
611 * This is sent in response to a disconnection request, but also if
612 * the remote device goes out of range.
613 */
614 static void
hci_event_discon_compl(struct hci_unit * unit,struct mbuf * m)615 hci_event_discon_compl(struct hci_unit *unit, struct mbuf *m)
616 {
617 hci_discon_compl_ep ep;
618 struct hci_link *link;
619
620 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
621 m_copydata(m, 0, sizeof(ep), &ep);
622 m_adj(m, sizeof(ep));
623
624 ep.con_handle = letoh16(ep.con_handle);
625
626 DPRINTFN(1, "(%s) handle #%d, status=0x%x\n",
627 device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status);
628
629 link = hci_link_lookup_handle(unit, HCI_CON_HANDLE(ep.con_handle));
630 if (link)
631 hci_link_free(link, ENOENT); /* XXX NetBSD used ENOLINK here */
632 }
633
634 /*
635 * Connect Request
636 *
637 * We check upstream for appropriate listeners and accept connections
638 * that are wanted.
639 */
640 static void
hci_event_con_req(struct hci_unit * unit,struct mbuf * m)641 hci_event_con_req(struct hci_unit *unit, struct mbuf *m)
642 {
643 hci_con_req_ep ep;
644 hci_accept_con_cp ap;
645 hci_reject_con_cp rp;
646 struct hci_link *link;
647
648 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
649 m_copydata(m, 0, sizeof(ep), &ep);
650 m_adj(m, sizeof(ep));
651
652 DPRINTFN(1, "(%s) bdaddr %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
653 "class %2.2x%2.2x%2.2x type %s\n",
654 device_get_nameunit(unit->hci_dev),
655 ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
656 ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0],
657 ep.uclass[0], ep.uclass[1], ep.uclass[2],
658 ep.link_type == HCI_LINK_ACL ? "ACL" : "SCO");
659
660 if (ep.link_type == HCI_LINK_ACL)
661 link = hci_acl_newconn(unit, &ep.bdaddr);
662 else
663 link = hci_sco_newconn(unit, &ep.bdaddr);
664
665 if (link == NULL) {
666 memset(&rp, 0, sizeof(rp));
667 bdaddr_copy(&rp.bdaddr, &ep.bdaddr);
668 rp.reason = 0x0f; /* Unacceptable BD_ADDR */
669
670 hci_send_cmd(unit, HCI_CMD_REJECT_CON, &rp, sizeof(rp));
671 } else {
672 memset(&ap, 0, sizeof(ap));
673 bdaddr_copy(&ap.bdaddr, &ep.bdaddr);
674 if (unit->hci_link_policy & HCI_LINK_POLICY_ENABLE_ROLE_SWITCH)
675 ap.role = HCI_ROLE_MASTER;
676 else
677 ap.role = HCI_ROLE_SLAVE;
678
679 hci_send_cmd(unit, HCI_CMD_ACCEPT_CON, &ap, sizeof(ap));
680 }
681 }
682
683 /*
684 * Auth Complete
685 *
686 * Authentication has been completed on an ACL link. We can notify the
687 * upper layer protocols unless further mode changes are pending.
688 */
689 static void
hci_event_auth_compl(struct hci_unit * unit,struct mbuf * m)690 hci_event_auth_compl(struct hci_unit *unit, struct mbuf *m)
691 {
692 hci_auth_compl_ep ep;
693 struct hci_link *link;
694 int err;
695
696 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
697 m_copydata(m, 0, sizeof(ep), &ep);
698 m_adj(m, sizeof(ep));
699
700 ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
701
702 DPRINTFN(1, "(%s) handle #%d, status=0x%x\n",
703 device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status);
704
705 link = hci_link_lookup_handle(unit, ep.con_handle);
706 if (link == NULL || link->hl_type != HCI_LINK_ACL)
707 return;
708
709 if (ep.status == 0) {
710 link->hl_flags |= HCI_LINK_AUTH;
711
712 if (link->hl_state == HCI_LINK_WAIT_AUTH)
713 link->hl_state = HCI_LINK_OPEN;
714
715 err = hci_acl_setmode(link);
716 if (err == EINPROGRESS)
717 return;
718 }
719
720 hci_acl_linkmode(link);
721 }
722
723 /*
724 * Encryption Change
725 *
726 * The encryption status has changed. Basically, we note the change
727 * then notify the upper layer protocol unless further mode changes
728 * are pending.
729 * Note that if encryption gets disabled when it has been requested,
730 * we will attempt to enable it again.. (its a feature not a bug :)
731 */
732 static void
hci_event_encryption_change(struct hci_unit * unit,struct mbuf * m)733 hci_event_encryption_change(struct hci_unit *unit, struct mbuf *m)
734 {
735 hci_encryption_change_ep ep;
736 struct hci_link *link;
737 int err;
738
739 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
740 m_copydata(m, 0, sizeof(ep), &ep);
741 m_adj(m, sizeof(ep));
742
743 ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
744
745 DPRINTFN(1, "(%s) handle #%d, status=0x%x, encryption_enable=0x%x\n",
746 device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status,
747 ep.encryption_enable);
748
749 link = hci_link_lookup_handle(unit, ep.con_handle);
750 if (link == NULL || link->hl_type != HCI_LINK_ACL)
751 return;
752
753 if (ep.status == 0) {
754 if (ep.encryption_enable == 0)
755 link->hl_flags &= ~HCI_LINK_ENCRYPT;
756 else
757 link->hl_flags |= (HCI_LINK_AUTH | HCI_LINK_ENCRYPT);
758
759 if (link->hl_state == HCI_LINK_WAIT_ENCRYPT)
760 link->hl_state = HCI_LINK_OPEN;
761
762 err = hci_acl_setmode(link);
763 if (err == EINPROGRESS)
764 return;
765 }
766
767 hci_acl_linkmode(link);
768 }
769
770 /*
771 * Change Connection Link Key Complete
772 *
773 * Link keys are handled in userland but if we are waiting to secure
774 * this link, we should notify the upper protocols. A SECURE request
775 * only needs a single key change, so we can cancel the request.
776 */
777 static void
hci_event_change_con_link_key_compl(struct hci_unit * unit,struct mbuf * m)778 hci_event_change_con_link_key_compl(struct hci_unit *unit, struct mbuf *m)
779 {
780 hci_change_con_link_key_compl_ep ep;
781 struct hci_link *link;
782 int err;
783
784 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
785 m_copydata(m, 0, sizeof(ep), &ep);
786 m_adj(m, sizeof(ep));
787
788 ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
789
790 DPRINTFN(1, "(%s) handle #%d, status=0x%x\n",
791 device_get_nameunit(unit->hci_dev), ep.con_handle, ep.status);
792
793 link = hci_link_lookup_handle(unit, ep.con_handle);
794 if (link == NULL || link->hl_type != HCI_LINK_ACL)
795 return;
796
797 link->hl_flags &= ~HCI_LINK_SECURE_REQ;
798
799 if (ep.status == 0) {
800 link->hl_flags |= (HCI_LINK_AUTH | HCI_LINK_SECURE);
801
802 if (link->hl_state == HCI_LINK_WAIT_SECURE)
803 link->hl_state = HCI_LINK_OPEN;
804
805 err = hci_acl_setmode(link);
806 if (err == EINPROGRESS)
807 return;
808 }
809
810 hci_acl_linkmode(link);
811 }
812
813 /*
814 * Read Clock Offset Complete
815 *
816 * We keep a note of the clock offset of remote devices when a
817 * link is made, in order to facilitate reconnections to the device
818 */
819 static void
hci_event_read_clock_offset_compl(struct hci_unit * unit,struct mbuf * m)820 hci_event_read_clock_offset_compl(struct hci_unit *unit, struct mbuf *m)
821 {
822 hci_read_clock_offset_compl_ep ep;
823 struct hci_link *link;
824
825 KKASSERT(m->m_pkthdr.len >= sizeof(ep));
826 m_copydata(m, 0, sizeof(ep), &ep);
827 m_adj(m, sizeof(ep));
828
829 DPRINTFN(1, "handle #%d, offset=%u, status=0x%x\n",
830 letoh16(ep.con_handle), letoh16(ep.clock_offset), ep.status);
831
832 ep.con_handle = HCI_CON_HANDLE(letoh16(ep.con_handle));
833 link = hci_link_lookup_handle(unit, ep.con_handle);
834
835 if (ep.status != 0 || link == NULL)
836 return;
837
838 link->hl_clock = ep.clock_offset;
839 }
840
841 /*
842 * process results of read_bdaddr command_complete event
843 */
844 static void
hci_cmd_read_bdaddr(struct hci_unit * unit,struct mbuf * m)845 hci_cmd_read_bdaddr(struct hci_unit *unit, struct mbuf *m)
846 {
847 hci_read_bdaddr_rp rp;
848
849 KKASSERT(m->m_pkthdr.len >= sizeof(rp));
850 m_copydata(m, 0, sizeof(rp), &rp);
851 m_adj(m, sizeof(rp));
852
853 if (rp.status > 0)
854 return;
855
856 if ((unit->hci_flags & BTF_INIT_BDADDR) == 0)
857 return;
858
859 bdaddr_copy(&unit->hci_bdaddr, &rp.bdaddr);
860
861 unit->hci_flags &= ~BTF_INIT_BDADDR;
862
863 wakeup(unit);
864 }
865
866 /*
867 * process results of read_buffer_size command_complete event
868 */
869 static void
hci_cmd_read_buffer_size(struct hci_unit * unit,struct mbuf * m)870 hci_cmd_read_buffer_size(struct hci_unit *unit, struct mbuf *m)
871 {
872 hci_read_buffer_size_rp rp;
873
874 KKASSERT(m->m_pkthdr.len >= sizeof(rp));
875 m_copydata(m, 0, sizeof(rp), &rp);
876 m_adj(m, sizeof(rp));
877
878 if (rp.status > 0)
879 return;
880
881 if ((unit->hci_flags & BTF_INIT_BUFFER_SIZE) == 0)
882 return;
883
884 unit->hci_max_acl_size = letoh16(rp.max_acl_size);
885 unit->hci_num_acl_pkts = letoh16(rp.num_acl_pkts);
886 unit->hci_max_sco_size = rp.max_sco_size;
887 unit->hci_num_sco_pkts = letoh16(rp.num_sco_pkts);
888
889 unit->hci_flags &= ~BTF_INIT_BUFFER_SIZE;
890
891 wakeup(unit);
892 }
893
894 /*
895 * process results of read_local_features command_complete event
896 */
897 static void
hci_cmd_read_local_features(struct hci_unit * unit,struct mbuf * m)898 hci_cmd_read_local_features(struct hci_unit *unit, struct mbuf *m)
899 {
900 hci_read_local_features_rp rp;
901
902 KKASSERT(m->m_pkthdr.len >= sizeof(rp));
903 m_copydata(m, 0, sizeof(rp), &rp);
904 m_adj(m, sizeof(rp));
905
906 if (rp.status > 0)
907 return;
908
909 if ((unit->hci_flags & BTF_INIT_FEATURES) == 0)
910 return;
911
912 unit->hci_lmp_mask = 0;
913
914 if (rp.features[0] & HCI_LMP_ROLE_SWITCH)
915 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_ROLE_SWITCH;
916
917 if (rp.features[0] & HCI_LMP_HOLD_MODE)
918 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_HOLD_MODE;
919
920 if (rp.features[0] & HCI_LMP_SNIFF_MODE)
921 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_SNIFF_MODE;
922
923 if (rp.features[1] & HCI_LMP_PARK_MODE)
924 unit->hci_lmp_mask |= HCI_LINK_POLICY_ENABLE_PARK_MODE;
925
926 /* ACL packet mask */
927 unit->hci_acl_mask = HCI_PKT_DM1 | HCI_PKT_DH1;
928
929 if (rp.features[0] & HCI_LMP_3SLOT)
930 unit->hci_acl_mask |= HCI_PKT_DM3 | HCI_PKT_DH3;
931
932 if (rp.features[0] & HCI_LMP_5SLOT)
933 unit->hci_acl_mask |= HCI_PKT_DM5 | HCI_PKT_DH5;
934
935 if ((rp.features[3] & HCI_LMP_EDR_ACL_2MBPS) == 0)
936 unit->hci_acl_mask |= HCI_PKT_2MBPS_DH1
937 | HCI_PKT_2MBPS_DH3
938 | HCI_PKT_2MBPS_DH5;
939
940 if ((rp.features[3] & HCI_LMP_EDR_ACL_3MBPS) == 0)
941 unit->hci_acl_mask |= HCI_PKT_3MBPS_DH1
942 | HCI_PKT_3MBPS_DH3
943 | HCI_PKT_3MBPS_DH5;
944
945 if ((rp.features[4] & HCI_LMP_3SLOT_EDR_ACL) == 0)
946 unit->hci_acl_mask |= HCI_PKT_2MBPS_DH3
947 | HCI_PKT_3MBPS_DH3;
948
949 if ((rp.features[5] & HCI_LMP_5SLOT_EDR_ACL) == 0)
950 unit->hci_acl_mask |= HCI_PKT_2MBPS_DH5
951 | HCI_PKT_3MBPS_DH5;
952
953 unit->hci_packet_type = unit->hci_acl_mask;
954
955 /* SCO packet mask */
956 unit->hci_sco_mask = 0;
957 if (rp.features[1] & HCI_LMP_SCO_LINK)
958 unit->hci_sco_mask |= HCI_PKT_HV1;
959
960 if (rp.features[1] & HCI_LMP_HV2_PKT)
961 unit->hci_sco_mask |= HCI_PKT_HV2;
962
963 if (rp.features[1] & HCI_LMP_HV3_PKT)
964 unit->hci_sco_mask |= HCI_PKT_HV3;
965
966 if (rp.features[3] & HCI_LMP_EV3_PKT)
967 unit->hci_sco_mask |= HCI_PKT_EV3;
968
969 if (rp.features[4] & HCI_LMP_EV4_PKT)
970 unit->hci_sco_mask |= HCI_PKT_EV4;
971
972 if (rp.features[4] & HCI_LMP_EV5_PKT)
973 unit->hci_sco_mask |= HCI_PKT_EV5;
974
975 /* XXX what do 2MBPS/3MBPS/3SLOT eSCO mean? */
976
977 unit->hci_flags &= ~BTF_INIT_FEATURES;
978
979 wakeup(unit);
980
981 DPRINTFN(1, "%s: lmp_mask %4.4x, acl_mask %4.4x, sco_mask %4.4x\n",
982 device_get_nameunit(unit->hci_dev), unit->hci_lmp_mask,
983 unit->hci_acl_mask, unit->hci_sco_mask);
984 }
985
986 /*
987 * process results of read_local_ver command_complete event
988 *
989 * reading local supported commands is only supported from 1.2 spec
990 */
991 static void
hci_cmd_read_local_ver(struct hci_unit * unit,struct mbuf * m)992 hci_cmd_read_local_ver(struct hci_unit *unit, struct mbuf *m)
993 {
994 hci_read_local_ver_rp rp;
995
996 KKASSERT(m->m_pkthdr.len >= sizeof(rp));
997 m_copydata(m, 0, sizeof(rp), &rp);
998 m_adj(m, sizeof(rp));
999
1000 if (rp.status != 0)
1001 return;
1002
1003 if ((unit->hci_flags & BTF_INIT_COMMANDS) == 0)
1004 return;
1005
1006 if (rp.hci_version < HCI_SPEC_V12) {
1007 unit->hci_flags &= ~BTF_INIT_COMMANDS;
1008 wakeup(unit);
1009 return;
1010 }
1011
1012 hci_send_cmd(unit, HCI_CMD_READ_LOCAL_COMMANDS, NULL, 0);
1013 }
1014
1015 /*
1016 * process results of read_local_commands command_complete event
1017 */
1018 static void
hci_cmd_read_local_commands(struct hci_unit * unit,struct mbuf * m)1019 hci_cmd_read_local_commands(struct hci_unit *unit, struct mbuf *m)
1020 {
1021 hci_read_local_commands_rp rp;
1022
1023 KKASSERT(m->m_pkthdr.len >= sizeof(rp));
1024 m_copydata(m, 0, sizeof(rp), &rp);
1025 m_adj(m, sizeof(rp));
1026
1027 if (rp.status != 0)
1028 return;
1029
1030 if ((unit->hci_flags & BTF_INIT_COMMANDS) == 0)
1031 return;
1032
1033 unit->hci_flags &= ~BTF_INIT_COMMANDS;
1034 memcpy(unit->hci_cmds, rp.commands, HCI_COMMANDS_SIZE);
1035
1036 wakeup(unit);
1037 }
1038
1039 /*
1040 * process results of reset command_complete event
1041 *
1042 * This has killed all the connections, so close down anything we have left,
1043 * and reinitialise the unit.
1044 */
1045 static void
hci_cmd_reset(struct hci_unit * unit,struct mbuf * m)1046 hci_cmd_reset(struct hci_unit *unit, struct mbuf *m)
1047 {
1048 hci_reset_rp rp;
1049 struct hci_link *link, *next;
1050 int acl;
1051
1052 KKASSERT(m->m_pkthdr.len >= sizeof(rp));
1053 m_copydata(m, 0, sizeof(rp), &rp);
1054 m_adj(m, sizeof(rp));
1055
1056 if (rp.status != 0)
1057 return;
1058
1059 /*
1060 * release SCO links first, since they may be holding
1061 * an ACL link reference.
1062 */
1063 for (acl = 0 ; acl < 2 ; acl++) {
1064 next = TAILQ_FIRST(&unit->hci_links);
1065 while ((link = next) != NULL) {
1066 next = TAILQ_NEXT(link, hl_next);
1067 if (acl || link->hl_type != HCI_LINK_ACL)
1068 hci_link_free(link, ECONNABORTED);
1069 }
1070 }
1071
1072 unit->hci_num_acl_pkts = 0;
1073 unit->hci_num_sco_pkts = 0;
1074
1075 if (hci_send_cmd(unit, HCI_CMD_READ_BDADDR, NULL, 0))
1076 return;
1077
1078 if (hci_send_cmd(unit, HCI_CMD_READ_BUFFER_SIZE, NULL, 0))
1079 return;
1080
1081 if (hci_send_cmd(unit, HCI_CMD_READ_LOCAL_FEATURES, NULL, 0))
1082 return;
1083
1084 if (hci_send_cmd(unit, HCI_CMD_READ_LOCAL_VER, NULL, 0))
1085 return;
1086 }
1087