1/*
2 * ng_hci_evnt.c
3 */
4
5/*-
6 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
7 *
8 * Copyright (c) Maksim Yevmenkin <m_evmenkin@yahoo.com>
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 * $Id: ng_hci_evnt.c,v 1.6 2003/09/08 18:57:51 max Exp $
33 * $FreeBSD$
34 */
35
36#include <sys/param.h>
37#include <sys/systm.h>
38#include <sys/kernel.h>
39#include <sys/endian.h>
40#include <sys/malloc.h>
41#include <sys/mbuf.h>
42#include <sys/queue.h>
43#include <netgraph/ng_message.h>
44#include <netgraph/netgraph.h>
45#include <netgraph/bluetooth/include/ng_bluetooth.h>
46#include <netgraph/bluetooth/include/ng_hci.h>
47#include <netgraph/bluetooth/hci/ng_hci_var.h>
48#include <netgraph/bluetooth/hci/ng_hci_cmds.h>
49#include <netgraph/bluetooth/hci/ng_hci_evnt.h>
50#include <netgraph/bluetooth/hci/ng_hci_ulpi.h>
51#include <netgraph/bluetooth/hci/ng_hci_misc.h>
52
53/******************************************************************************
54 ******************************************************************************
55 **                     HCI event processing module
56 ******************************************************************************
57 ******************************************************************************/
58
59/*
60 * Event processing routines
61 */
62
63static int inquiry_result             (ng_hci_unit_p, struct mbuf *);
64static int con_compl                  (ng_hci_unit_p, struct mbuf *);
65static int con_req                    (ng_hci_unit_p, struct mbuf *);
66static int discon_compl               (ng_hci_unit_p, struct mbuf *);
67static int encryption_change          (ng_hci_unit_p, struct mbuf *);
68static int read_remote_features_compl (ng_hci_unit_p, struct mbuf *);
69static int qos_setup_compl            (ng_hci_unit_p, struct mbuf *);
70static int hardware_error             (ng_hci_unit_p, struct mbuf *);
71static int role_change                (ng_hci_unit_p, struct mbuf *);
72static int num_compl_pkts             (ng_hci_unit_p, struct mbuf *);
73static int mode_change                (ng_hci_unit_p, struct mbuf *);
74static int data_buffer_overflow       (ng_hci_unit_p, struct mbuf *);
75static int read_clock_offset_compl    (ng_hci_unit_p, struct mbuf *);
76static int qos_violation              (ng_hci_unit_p, struct mbuf *);
77static int page_scan_mode_change      (ng_hci_unit_p, struct mbuf *);
78static int page_scan_rep_mode_change  (ng_hci_unit_p, struct mbuf *);
79static int sync_con_queue             (ng_hci_unit_p, ng_hci_unit_con_p, int);
80static int send_data_packets          (ng_hci_unit_p, int, int);
81static int le_event		      (ng_hci_unit_p, struct mbuf *);
82
83/*
84 * Process HCI event packet
85 */
86
87int
88ng_hci_process_event(ng_hci_unit_p unit, struct mbuf *event)
89{
90	ng_hci_event_pkt_t	*hdr = NULL;
91	int			 error = 0;
92
93	/* Get event packet header */
94	NG_HCI_M_PULLUP(event, sizeof(*hdr));
95	if (event == NULL)
96		return (ENOBUFS);
97
98	hdr = mtod(event, ng_hci_event_pkt_t *);
99
100	NG_HCI_INFO(
101"%s: %s - got HCI event=%#x, length=%d\n",
102		__func__, NG_NODE_NAME(unit->node), hdr->event, hdr->length);
103
104	/* Get rid of event header and process event */
105	m_adj(event, sizeof(*hdr));
106
107	switch (hdr->event) {
108	case NG_HCI_EVENT_INQUIRY_COMPL:
109	case NG_HCI_EVENT_RETURN_LINK_KEYS:
110	case NG_HCI_EVENT_PIN_CODE_REQ:
111	case NG_HCI_EVENT_LINK_KEY_REQ:
112	case NG_HCI_EVENT_LINK_KEY_NOTIFICATION:
113	case NG_HCI_EVENT_LOOPBACK_COMMAND:
114	case NG_HCI_EVENT_AUTH_COMPL:
115	case NG_HCI_EVENT_CHANGE_CON_LINK_KEY_COMPL:
116	case NG_HCI_EVENT_MASTER_LINK_KEY_COMPL:
117	case NG_HCI_EVENT_FLUSH_OCCUR:	/* XXX Do we have to handle it? */
118	case NG_HCI_EVENT_MAX_SLOT_CHANGE:
119	case NG_HCI_EVENT_CON_PKT_TYPE_CHANGED:
120	case NG_HCI_EVENT_BT_LOGO:
121	case NG_HCI_EVENT_VENDOR:
122	case NG_HCI_EVENT_REMOTE_NAME_REQ_COMPL:
123	case NG_HCI_EVENT_READ_REMOTE_VER_INFO_COMPL:
124		/* These do not need post processing */
125		NG_FREE_M(event);
126		break;
127	case NG_HCI_EVENT_LE:
128		error = le_event(unit, event);
129		break;
130
131	case NG_HCI_EVENT_INQUIRY_RESULT:
132		error = inquiry_result(unit, event);
133		break;
134
135	case NG_HCI_EVENT_CON_COMPL:
136		error = con_compl(unit, event);
137		break;
138
139	case NG_HCI_EVENT_CON_REQ:
140		error = con_req(unit, event);
141		break;
142
143	case NG_HCI_EVENT_DISCON_COMPL:
144		error = discon_compl(unit, event);
145		break;
146
147	case NG_HCI_EVENT_ENCRYPTION_CHANGE:
148		error = encryption_change(unit, event);
149		break;
150
151	case NG_HCI_EVENT_READ_REMOTE_FEATURES_COMPL:
152		error = read_remote_features_compl(unit, event);
153		break;
154
155	case NG_HCI_EVENT_QOS_SETUP_COMPL:
156		error = qos_setup_compl(unit, event);
157		break;
158
159	case NG_HCI_EVENT_COMMAND_COMPL:
160		error = ng_hci_process_command_complete(unit, event);
161		break;
162
163	case NG_HCI_EVENT_COMMAND_STATUS:
164		error = ng_hci_process_command_status(unit, event);
165		break;
166
167	case NG_HCI_EVENT_HARDWARE_ERROR:
168		error = hardware_error(unit, event);
169		break;
170
171	case NG_HCI_EVENT_ROLE_CHANGE:
172		error = role_change(unit, event);
173		break;
174
175	case NG_HCI_EVENT_NUM_COMPL_PKTS:
176		error = num_compl_pkts(unit, event);
177		break;
178
179	case NG_HCI_EVENT_MODE_CHANGE:
180		error = mode_change(unit, event);
181		break;
182
183	case NG_HCI_EVENT_DATA_BUFFER_OVERFLOW:
184		error = data_buffer_overflow(unit, event);
185		break;
186
187	case NG_HCI_EVENT_READ_CLOCK_OFFSET_COMPL:
188		error = read_clock_offset_compl(unit, event);
189		break;
190
191	case NG_HCI_EVENT_QOS_VIOLATION:
192		error = qos_violation(unit, event);
193		break;
194
195	case NG_HCI_EVENT_PAGE_SCAN_MODE_CHANGE:
196		error = page_scan_mode_change(unit, event);
197		break;
198
199	case NG_HCI_EVENT_PAGE_SCAN_REP_MODE_CHANGE:
200		error = page_scan_rep_mode_change(unit, event);
201		break;
202
203	default:
204		NG_FREE_M(event);
205		error = EINVAL;
206		break;
207	}
208
209	return (error);
210} /* ng_hci_process_event */
211
212/*
213 * Send ACL and/or SCO data to the unit driver
214 */
215
216void
217ng_hci_send_data(ng_hci_unit_p unit)
218{
219	int	count;
220
221	/* Send ACL data */
222	NG_HCI_BUFF_ACL_AVAIL(unit->buffer, count);
223
224	NG_HCI_INFO(
225"%s: %s - sending ACL data packets, count=%d\n",
226		__func__, NG_NODE_NAME(unit->node), count);
227
228	if (count > 0) {
229		count = send_data_packets(unit, NG_HCI_LINK_ACL, count);
230		NG_HCI_STAT_ACL_SENT(unit->stat, count);
231		NG_HCI_BUFF_ACL_USE(unit->buffer, count);
232	}
233
234	/* Send SCO data */
235	NG_HCI_BUFF_SCO_AVAIL(unit->buffer, count);
236
237	NG_HCI_INFO(
238"%s: %s - sending SCO data packets, count=%d\n",
239		__func__, NG_NODE_NAME(unit->node), count);
240
241	if (count > 0) {
242		count = send_data_packets(unit, NG_HCI_LINK_SCO, count);
243		NG_HCI_STAT_SCO_SENT(unit->stat, count);
244		NG_HCI_BUFF_SCO_USE(unit->buffer, count);
245	}
246} /* ng_hci_send_data */
247
248/*
249 * Send data packets to the lower layer.
250 */
251
252static int
253send_data_packets(ng_hci_unit_p unit, int link_type, int limit)
254{
255	ng_hci_unit_con_p	con = NULL, winner = NULL;
256	int			reallink_type;
257	item_p			item = NULL;
258	int			min_pending, total_sent, sent, error, v;
259
260	for (total_sent = 0; limit > 0; ) {
261		min_pending = 0x0fffffff;
262		winner = NULL;
263
264		/*
265		 * Find the connection that has has data to send
266		 * and the smallest number of pending packets
267		 */
268
269		LIST_FOREACH(con, &unit->con_list, next) {
270			reallink_type = (con->link_type == NG_HCI_LINK_SCO)?
271				NG_HCI_LINK_SCO: NG_HCI_LINK_ACL;
272			if (reallink_type != link_type){
273				continue;
274			}
275			if (NG_BT_ITEMQ_LEN(&con->conq) == 0)
276				continue;
277
278			if (con->pending < min_pending) {
279				winner = con;
280				min_pending = con->pending;
281			}
282		}
283
284	        if (winner == NULL)
285			break;
286
287		/*
288		 * OK, we have a winner now send as much packets as we can
289		 * Count the number of packets we have sent and then sync
290		 * winner connection queue.
291		 */
292
293		for (sent = 0; limit > 0; limit --, total_sent ++, sent ++) {
294			NG_BT_ITEMQ_DEQUEUE(&winner->conq, item);
295			if (item == NULL)
296				break;
297
298			NG_HCI_INFO(
299"%s: %s - sending data packet, handle=%d, len=%d\n",
300				__func__, NG_NODE_NAME(unit->node),
301				winner->con_handle, NGI_M(item)->m_pkthdr.len);
302
303			/* Check if driver hook still there */
304			v = (unit->drv != NULL && NG_HOOK_IS_VALID(unit->drv));
305			if (!v || (unit->state & NG_HCI_UNIT_READY) !=
306					NG_HCI_UNIT_READY) {
307				NG_HCI_ERR(
308"%s: %s - could not send data. Hook \"%s\" is %svalid, state=%#x\n",
309					__func__, NG_NODE_NAME(unit->node),
310					NG_HCI_HOOK_DRV, ((v)? "" : "not "),
311					unit->state);
312
313				NG_FREE_ITEM(item);
314				error = ENOTCONN;
315			} else {
316				v = NGI_M(item)->m_pkthdr.len;
317
318				/* Give packet to raw hook */
319				ng_hci_mtap(unit, NGI_M(item));
320
321				/* ... and forward item to the driver */
322				NG_FWD_ITEM_HOOK(error, item, unit->drv);
323			}
324
325			if (error != 0) {
326				NG_HCI_ERR(
327"%s: %s - could not send data packet, handle=%d, error=%d\n",
328					__func__, NG_NODE_NAME(unit->node),
329					winner->con_handle, error);
330				break;
331			}
332
333			winner->pending ++;
334			NG_HCI_STAT_BYTES_SENT(unit->stat, v);
335		}
336
337		/*
338		 * Sync connection queue for the winner
339		 */
340		sync_con_queue(unit, winner, sent);
341	}
342
343	return (total_sent);
344} /* send_data_packets */
345
346/*
347 * Send flow control messages to the upper layer
348 */
349
350static int
351sync_con_queue(ng_hci_unit_p unit, ng_hci_unit_con_p con, int completed)
352{
353	hook_p				 hook = NULL;
354	struct ng_mesg			*msg = NULL;
355	ng_hci_sync_con_queue_ep	*state = NULL;
356	int				 error;
357
358	hook = (con->link_type != NG_HCI_LINK_SCO)? unit->acl : unit->sco;
359	if (hook == NULL || NG_HOOK_NOT_VALID(hook))
360		return (ENOTCONN);
361
362	NG_MKMESSAGE(msg, NGM_HCI_COOKIE, NGM_HCI_SYNC_CON_QUEUE,
363		sizeof(*state), M_NOWAIT);
364	if (msg == NULL)
365		return (ENOMEM);
366
367	state = (ng_hci_sync_con_queue_ep *)(msg->data);
368	state->con_handle = con->con_handle;
369	state->completed = completed;
370
371	NG_SEND_MSG_HOOK(error, unit->node, msg, hook, 0);
372
373	return (error);
374} /* sync_con_queue */
375/* le meta event */
376/* Inquiry result event */
377static int
378le_advertizing_report(ng_hci_unit_p unit, struct mbuf *event)
379{
380	ng_hci_le_advertising_report_ep	*ep = NULL;
381	ng_hci_neighbor_p		 n = NULL;
382	bdaddr_t			 bdaddr;
383	int				 error = 0;
384	int				 num_reports = 0;
385	u_int8_t event_type;
386	u_int8_t addr_type;
387
388	NG_HCI_M_PULLUP(event, sizeof(*ep));
389	if (event == NULL)
390		return (ENOBUFS);
391
392	ep = mtod(event, ng_hci_le_advertising_report_ep *);
393	num_reports = ep->num_reports;
394	m_adj(event, sizeof(*ep));
395	ep = NULL;
396
397	for (; num_reports > 0; num_reports --) {
398		/* Get remote unit address */
399		NG_HCI_M_PULLUP(event, sizeof(u_int8_t));
400		event_type = *mtod(event, u_int8_t *);
401		m_adj(event, sizeof(u_int8_t));
402		NG_HCI_M_PULLUP(event, sizeof(u_int8_t));
403		addr_type = *mtod(event, u_int8_t *);
404		m_adj(event, sizeof(u_int8_t));
405
406		m_copydata(event, 0, sizeof(bdaddr), (caddr_t) &bdaddr);
407		m_adj(event, sizeof(bdaddr));
408
409		/* Lookup entry in the cache */
410		n = ng_hci_get_neighbor(unit, &bdaddr, (addr_type) ? NG_HCI_LINK_LE_RANDOM:NG_HCI_LINK_LE_PUBLIC);
411		if (n == NULL) {
412			/* Create new entry */
413			n = ng_hci_new_neighbor(unit);
414			if (n == NULL) {
415				error = ENOMEM;
416				break;
417			}
418			bcopy(&bdaddr, &n->bdaddr, sizeof(n->bdaddr));
419			n->addrtype = (addr_type)? NG_HCI_LINK_LE_RANDOM :
420			  NG_HCI_LINK_LE_PUBLIC;
421
422		} else
423			getmicrotime(&n->updated);
424
425		{
426			/*
427			 * TODO: Make these information
428			 * Available from userland.
429			 */
430			u_int8_t length_data;
431
432			event = m_pullup(event, sizeof(u_int8_t));
433			if(event == NULL){
434				NG_HCI_WARN("%s: Event datasize Pullup Failed\n", __func__);
435				goto out;
436			}
437			length_data = *mtod(event, u_int8_t *);
438			m_adj(event, sizeof(u_int8_t));
439			n->extinq_size = (length_data < NG_HCI_EXTINQ_MAX)?
440				length_data : NG_HCI_EXTINQ_MAX;
441
442			/*Advertizement data*/
443			event = m_pullup(event, n->extinq_size);
444			if(event == NULL){
445				NG_HCI_WARN("%s: Event data pullup Failed\n", __func__);
446				goto out;
447			}
448			m_copydata(event, 0, n->extinq_size, n->extinq_data);
449			m_adj(event, n->extinq_size);
450			event = m_pullup(event, sizeof(char ));
451			/*Get RSSI*/
452			if(event == NULL){
453				NG_HCI_WARN("%s: Event rssi pull up Failed\n", __func__);
454
455				goto out;
456			}
457			n->page_scan_mode = *mtod(event, char *);
458			m_adj(event, sizeof(u_int8_t));
459		}
460	}
461 out:
462	NG_FREE_M(event);
463
464	return (error);
465} /* inquiry_result */
466
467static int le_connection_complete(ng_hci_unit_p unit, struct mbuf *event)
468{
469	int			 error = 0;
470
471	ng_hci_le_connection_complete_ep	*ep = NULL;
472	ng_hci_unit_con_p	 con = NULL;
473	int link_type;
474	uint8_t uclass[3] = {0,0,0};//dummy uclass
475
476	NG_HCI_M_PULLUP(event, sizeof(*ep));
477	if (event == NULL)
478		return (ENOBUFS);
479
480	ep = mtod(event, ng_hci_le_connection_complete_ep *);
481	link_type = (ep->address_type)? NG_HCI_LINK_LE_RANDOM :
482	  NG_HCI_LINK_LE_PUBLIC;
483	/*
484	 * Find the first connection descriptor that matches the following:
485	 *
486	 * 1) con->link_type == link_type
487	 * 2) con->state == NG_HCI_CON_W4_CONN_COMPLETE
488	 * 3) con->bdaddr == ep->address
489	 */
490	LIST_FOREACH(con, &unit->con_list, next)
491		if (con->link_type == link_type &&
492		    con->state == NG_HCI_CON_W4_CONN_COMPLETE &&
493		    bcmp(&con->bdaddr, &ep->address, sizeof(bdaddr_t)) == 0)
494			break;
495
496	/*
497	 * Two possible cases:
498	 *
499	 * 1) We have found connection descriptor. That means upper layer has
500	 *    requested this connection via LP_CON_REQ message. In this case
501	 *    connection must have timeout set. If ng_hci_con_untimeout() fails
502	 *    then timeout message already went into node's queue. In this case
503	 *    ignore Connection_Complete event and let timeout deal with it.
504	 *
505	 * 2) We do not have connection descriptor. That means upper layer
506	 *    nas not requested this connection , (less likely) we gave up
507	 *    on this connection (timeout) or as node act as slave role.
508	 *    The most likely scenario is that
509	 *    we have received LE_Create_Connection command
510	 *    from the RAW hook
511	 */
512
513	if (con == NULL) {
514		if (ep->status != 0)
515			goto out;
516
517		con = ng_hci_new_con(unit, link_type);
518		if (con == NULL) {
519			error = ENOMEM;
520			goto out;
521		}
522
523		con->state = NG_HCI_CON_W4_LP_CON_RSP;
524		ng_hci_con_timeout(con);
525
526		bcopy(&ep->address, &con->bdaddr, sizeof(con->bdaddr));
527		error = ng_hci_lp_con_ind(con, uclass);
528		if (error != 0) {
529			ng_hci_con_untimeout(con);
530			ng_hci_free_con(con);
531			goto out;
532		}
533
534	} else if ((error = ng_hci_con_untimeout(con)) != 0)
535			goto out;
536
537	/*
538	 * Update connection descriptor and send notification
539	 * to the upper layers.
540	 */
541
542	con->con_handle = NG_HCI_CON_HANDLE(le16toh(ep->handle));
543	con->encryption_mode = NG_HCI_ENCRYPTION_MODE_NONE;
544
545	ng_hci_lp_con_cfm(con, ep->status);
546
547	/* Adjust connection state */
548	if (ep->status != 0)
549		ng_hci_free_con(con);
550	else {
551		con->state = NG_HCI_CON_OPEN;
552
553		/*
554		 * Change link policy for the ACL connections. Enable all
555		 * supported link modes. Enable Role switch as well if
556		 * device supports it.
557		 */
558	}
559
560out:
561	NG_FREE_M(event);
562
563	return (error);
564
565}
566
567static int le_connection_update(ng_hci_unit_p unit, struct mbuf *event)
568{
569	int error = 0;
570	/*TBD*/
571
572	NG_FREE_M(event);
573	return error;
574
575}
576static int
577le_event(ng_hci_unit_p unit, struct mbuf *event)
578{
579	int error = 0;
580	ng_hci_le_ep *lep;
581
582	NG_HCI_M_PULLUP(event, sizeof(*lep));
583	if(event ==NULL){
584		return ENOBUFS;
585	}
586	lep = mtod(event, ng_hci_le_ep *);
587	m_adj(event, sizeof(*lep));
588	switch(lep->subevent_code){
589	case NG_HCI_LEEV_CON_COMPL:
590		le_connection_complete(unit, event);
591		break;
592	case NG_HCI_LEEV_ADVREP:
593		le_advertizing_report(unit, event);
594		break;
595	case NG_HCI_LEEV_CON_UPDATE_COMPL:
596		le_connection_update(unit, event);
597		break;
598	case NG_HCI_LEEV_READ_REMOTE_FEATURES_COMPL:
599		//TBD
600	  /*FALLTHROUGH*/
601	case NG_HCI_LEEV_LONG_TERM_KEY_REQUEST:
602		//TBD
603	  /*FALLTHROUGH*/
604	default:
605	  	NG_FREE_M(event);
606	}
607	return error;
608}
609
610/* Inquiry result event */
611static int
612inquiry_result(ng_hci_unit_p unit, struct mbuf *event)
613{
614	ng_hci_inquiry_result_ep	*ep = NULL;
615	ng_hci_neighbor_p		 n = NULL;
616	bdaddr_t			 bdaddr;
617	int				 error = 0;
618
619	NG_HCI_M_PULLUP(event, sizeof(*ep));
620	if (event == NULL)
621		return (ENOBUFS);
622
623	ep = mtod(event, ng_hci_inquiry_result_ep *);
624	m_adj(event, sizeof(*ep));
625
626	for (; ep->num_responses > 0; ep->num_responses --) {
627		/* Get remote unit address */
628		m_copydata(event, 0, sizeof(bdaddr), (caddr_t) &bdaddr);
629		m_adj(event, sizeof(bdaddr));
630
631		/* Lookup entry in the cache */
632		n = ng_hci_get_neighbor(unit, &bdaddr, NG_HCI_LINK_ACL);
633		if (n == NULL) {
634			/* Create new entry */
635			n = ng_hci_new_neighbor(unit);
636			if (n == NULL) {
637				error = ENOMEM;
638				break;
639			}
640		} else
641			getmicrotime(&n->updated);
642
643		bcopy(&bdaddr, &n->bdaddr, sizeof(n->bdaddr));
644		n->addrtype = NG_HCI_LINK_ACL;
645
646		/* XXX call m_pullup here? */
647
648		n->page_scan_rep_mode = *mtod(event, u_int8_t *);
649		m_adj(event, sizeof(u_int8_t));
650
651		/* page_scan_period_mode */
652		m_adj(event, sizeof(u_int8_t));
653
654		n->page_scan_mode = *mtod(event, u_int8_t *);
655		m_adj(event, sizeof(u_int8_t));
656
657		/* class */
658		m_adj(event, NG_HCI_CLASS_SIZE);
659
660		/* clock offset */
661		m_copydata(event, 0, sizeof(n->clock_offset),
662			(caddr_t) &n->clock_offset);
663		n->clock_offset = le16toh(n->clock_offset);
664	}
665
666	NG_FREE_M(event);
667
668	return (error);
669} /* inquiry_result */
670
671/* Connection complete event */
672static int
673con_compl(ng_hci_unit_p unit, struct mbuf *event)
674{
675	ng_hci_con_compl_ep	*ep = NULL;
676	ng_hci_unit_con_p	 con = NULL;
677	int			 error = 0;
678
679	NG_HCI_M_PULLUP(event, sizeof(*ep));
680	if (event == NULL)
681		return (ENOBUFS);
682
683	ep = mtod(event, ng_hci_con_compl_ep *);
684
685	/*
686	 * Find the first connection descriptor that matches the following:
687	 *
688	 * 1) con->link_type == ep->link_type
689	 * 2) con->state == NG_HCI_CON_W4_CONN_COMPLETE
690	 * 3) con->bdaddr == ep->bdaddr
691	 */
692
693	LIST_FOREACH(con, &unit->con_list, next)
694		if (con->link_type == ep->link_type &&
695		    con->state == NG_HCI_CON_W4_CONN_COMPLETE &&
696		    bcmp(&con->bdaddr, &ep->bdaddr, sizeof(bdaddr_t)) == 0)
697			break;
698
699	/*
700	 * Two possible cases:
701	 *
702	 * 1) We have found connection descriptor. That means upper layer has
703	 *    requested this connection via LP_CON_REQ message. In this case
704	 *    connection must have timeout set. If ng_hci_con_untimeout() fails
705	 *    then timeout message already went into node's queue. In this case
706	 *    ignore Connection_Complete event and let timeout deal with it.
707	 *
708	 * 2) We do not have connection descriptor. That means upper layer
709	 *    nas not requested this connection or (less likely) we gave up
710	 *    on this connection (timeout). The most likely scenario is that
711	 *    we have received Create_Connection/Add_SCO_Connection command
712	 *    from the RAW hook
713	 */
714
715	if (con == NULL) {
716		if (ep->status != 0)
717			goto out;
718
719		con = ng_hci_new_con(unit, ep->link_type);
720		if (con == NULL) {
721			error = ENOMEM;
722			goto out;
723		}
724
725		bcopy(&ep->bdaddr, &con->bdaddr, sizeof(con->bdaddr));
726	} else if ((error = ng_hci_con_untimeout(con)) != 0)
727			goto out;
728
729	/*
730	 * Update connection descriptor and send notification
731	 * to the upper layers.
732	 */
733
734	con->con_handle = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
735	con->encryption_mode = ep->encryption_mode;
736
737	ng_hci_lp_con_cfm(con, ep->status);
738
739	/* Adjust connection state */
740	if (ep->status != 0)
741		ng_hci_free_con(con);
742	else {
743		con->state = NG_HCI_CON_OPEN;
744
745		/*
746		 * Change link policy for the ACL connections. Enable all
747		 * supported link modes. Enable Role switch as well if
748		 * device supports it.
749		 */
750
751		if (ep->link_type == NG_HCI_LINK_ACL) {
752			struct __link_policy {
753				ng_hci_cmd_pkt_t			 hdr;
754				ng_hci_write_link_policy_settings_cp	 cp;
755			} __attribute__ ((packed))			*lp;
756			struct mbuf					*m;
757
758			MGETHDR(m, M_NOWAIT, MT_DATA);
759			if (m != NULL) {
760				m->m_pkthdr.len = m->m_len = sizeof(*lp);
761				lp = mtod(m, struct __link_policy *);
762
763				lp->hdr.type = NG_HCI_CMD_PKT;
764				lp->hdr.opcode = htole16(NG_HCI_OPCODE(
765					NG_HCI_OGF_LINK_POLICY,
766					NG_HCI_OCF_WRITE_LINK_POLICY_SETTINGS));
767				lp->hdr.length = sizeof(lp->cp);
768
769				lp->cp.con_handle = ep->con_handle;
770
771				lp->cp.settings = 0;
772				if ((unit->features[0] & NG_HCI_LMP_SWITCH) &&
773				    unit->role_switch)
774					lp->cp.settings |= 0x1;
775				if (unit->features[0] & NG_HCI_LMP_HOLD_MODE)
776					lp->cp.settings |= 0x2;
777				if (unit->features[0] & NG_HCI_LMP_SNIFF_MODE)
778					lp->cp.settings |= 0x4;
779				if (unit->features[1] & NG_HCI_LMP_PARK_MODE)
780					lp->cp.settings |= 0x8;
781
782				lp->cp.settings &= unit->link_policy_mask;
783				lp->cp.settings = htole16(lp->cp.settings);
784
785				NG_BT_MBUFQ_ENQUEUE(&unit->cmdq, m);
786				if (!(unit->state & NG_HCI_UNIT_COMMAND_PENDING))
787					ng_hci_send_command(unit);
788			}
789		}
790	}
791out:
792	NG_FREE_M(event);
793
794	return (error);
795} /* con_compl */
796
797/* Connection request event */
798static int
799con_req(ng_hci_unit_p unit, struct mbuf *event)
800{
801	ng_hci_con_req_ep	*ep = NULL;
802	ng_hci_unit_con_p	 con = NULL;
803	int			 error = 0;
804
805	NG_HCI_M_PULLUP(event, sizeof(*ep));
806	if (event == NULL)
807		return (ENOBUFS);
808
809	ep = mtod(event, ng_hci_con_req_ep *);
810
811	/*
812	 * Find the first connection descriptor that matches the following:
813	 *
814	 * 1) con->link_type == ep->link_type
815	 *
816	 * 2) con->state == NG_HCI_CON_W4_LP_CON_RSP ||
817	 *    con->state == NG_HCI_CON_W4_CONN_COMPL
818	 *
819	 * 3) con->bdaddr == ep->bdaddr
820	 *
821	 * Possible cases:
822	 *
823	 * 1) We do not have connection descriptor. This is simple. Create
824	 *    new fresh connection descriptor and send notification to the
825	 *    appropriate upstream hook (based on link_type).
826	 *
827	 * 2) We found connection handle. This is more complicated.
828	 *
829	 * 2.1) ACL links
830	 *
831	 *      Since only one ACL link can exist between each pair of
832	 *      units then we have a race. Our upper layer has requested
833	 *      an ACL connection to the remote unit, but we did not send
834	 *      command yet. At the same time the remote unit has requested
835	 *      an ACL connection from us. In this case we will ignore
836	 *	Connection_Request event. This probably will cause connect
837	 *      failure	on both units.
838	 *
839	 * 2.2) SCO links
840	 *
841	 *      The spec on page 45 says :
842	 *
843	 *      "The master can support up to three SCO links to the same
844	 *       slave or to different slaves. A slave can support up to
845	 *       three SCO links from the same master, or two SCO links if
846	 *       the links originate from different masters."
847	 *
848	 *      The only problem is how to handle multiple SCO links between
849	 *      matster and slave. For now we will assume that multiple SCO
850	 *      links MUST be opened one after another.
851	 */
852
853	LIST_FOREACH(con, &unit->con_list, next)
854		if (con->link_type == ep->link_type &&
855		    (con->state == NG_HCI_CON_W4_LP_CON_RSP ||
856		     con->state == NG_HCI_CON_W4_CONN_COMPLETE) &&
857		    bcmp(&con->bdaddr, &ep->bdaddr, sizeof(bdaddr_t)) == 0)
858			break;
859
860	if (con == NULL) {
861		con = ng_hci_new_con(unit, ep->link_type);
862		if (con != NULL) {
863			bcopy(&ep->bdaddr, &con->bdaddr, sizeof(con->bdaddr));
864
865			con->state = NG_HCI_CON_W4_LP_CON_RSP;
866			ng_hci_con_timeout(con);
867
868			error = ng_hci_lp_con_ind(con, ep->uclass);
869			if (error != 0) {
870				ng_hci_con_untimeout(con);
871				ng_hci_free_con(con);
872			}
873		} else
874			error = ENOMEM;
875	}
876
877	NG_FREE_M(event);
878
879	return (error);
880} /* con_req */
881
882/* Disconnect complete event */
883static int
884discon_compl(ng_hci_unit_p unit, struct mbuf *event)
885{
886	ng_hci_discon_compl_ep	*ep = NULL;
887	ng_hci_unit_con_p	 con = NULL;
888	int			 error = 0;
889	u_int16_t		 h;
890
891	NG_HCI_M_PULLUP(event, sizeof(*ep));
892	if (event == NULL)
893		return (ENOBUFS);
894
895	ep = mtod(event, ng_hci_discon_compl_ep *);
896
897	/*
898	 * XXX
899	 * Do we have to send notification if ep->status != 0?
900	 * For now we will send notification for both ACL and SCO connections
901	 * ONLY if ep->status == 0.
902	 */
903
904	if (ep->status == 0) {
905		h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
906		con = ng_hci_con_by_handle(unit, h);
907		if (con != NULL) {
908			error = ng_hci_lp_discon_ind(con, ep->reason);
909
910			/* Remove all timeouts (if any) */
911			if (con->flags & NG_HCI_CON_TIMEOUT_PENDING)
912				ng_hci_con_untimeout(con);
913
914			ng_hci_free_con(con);
915		} else {
916			NG_HCI_ALERT(
917"%s: %s - invalid connection handle=%d\n",
918				__func__, NG_NODE_NAME(unit->node), h);
919			error = ENOENT;
920		}
921	}
922
923	NG_FREE_M(event);
924
925	return (error);
926} /* discon_compl */
927
928/* Encryption change event */
929static int
930encryption_change(ng_hci_unit_p unit, struct mbuf *event)
931{
932	ng_hci_encryption_change_ep	*ep = NULL;
933	ng_hci_unit_con_p		 con = NULL;
934	int				 error = 0;
935	u_int16_t	h;
936
937	NG_HCI_M_PULLUP(event, sizeof(*ep));
938	if (event == NULL)
939		return (ENOBUFS);
940
941	ep = mtod(event, ng_hci_encryption_change_ep *);
942	h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
943	con = ng_hci_con_by_handle(unit, h);
944
945	if (ep->status == 0) {
946		if (con == NULL) {
947			NG_HCI_ALERT(
948"%s: %s - invalid connection handle=%d\n",
949				__func__, NG_NODE_NAME(unit->node), h);
950			error = ENOENT;
951		} else if (con->link_type == NG_HCI_LINK_SCO) {
952			NG_HCI_ALERT(
953"%s: %s - invalid link type=%d\n",
954				__func__, NG_NODE_NAME(unit->node),
955				con->link_type);
956			error = EINVAL;
957		} else if (ep->encryption_enable)
958			/* XXX is that true? */
959			con->encryption_mode = NG_HCI_ENCRYPTION_MODE_P2P;
960		else
961			con->encryption_mode = NG_HCI_ENCRYPTION_MODE_NONE;
962	} else
963		NG_HCI_ERR(
964"%s: %s - failed to change encryption mode, status=%d\n",
965			__func__, NG_NODE_NAME(unit->node), ep->status);
966
967	/*Anyway, propagete encryption status to upper layer*/
968	ng_hci_lp_enc_change(con, con->encryption_mode);
969
970	NG_FREE_M(event);
971
972	return (error);
973} /* encryption_change */
974
975/* Read remote feature complete event */
976static int
977read_remote_features_compl(ng_hci_unit_p unit, struct mbuf *event)
978{
979	ng_hci_read_remote_features_compl_ep	*ep = NULL;
980	ng_hci_unit_con_p			 con = NULL;
981	ng_hci_neighbor_p			 n = NULL;
982	u_int16_t				 h;
983	int					 error = 0;
984
985	NG_HCI_M_PULLUP(event, sizeof(*ep));
986	if (event == NULL)
987		return (ENOBUFS);
988
989	ep = mtod(event, ng_hci_read_remote_features_compl_ep *);
990
991	if (ep->status == 0) {
992		/* Check if we have this connection handle */
993		h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
994		con = ng_hci_con_by_handle(unit, h);
995		if (con == NULL) {
996			NG_HCI_ALERT(
997"%s: %s - invalid connection handle=%d\n",
998				__func__, NG_NODE_NAME(unit->node), h);
999			error = ENOENT;
1000			goto out;
1001		}
1002
1003		/* Update cache entry */
1004		n = ng_hci_get_neighbor(unit, &con->bdaddr, NG_HCI_LINK_ACL);
1005		if (n == NULL) {
1006			n = ng_hci_new_neighbor(unit);
1007			if (n == NULL) {
1008				error = ENOMEM;
1009				goto out;
1010			}
1011
1012			bcopy(&con->bdaddr, &n->bdaddr, sizeof(n->bdaddr));
1013			n->addrtype = NG_HCI_LINK_ACL;
1014		} else
1015			getmicrotime(&n->updated);
1016
1017		bcopy(ep->features, n->features, sizeof(n->features));
1018	} else
1019		NG_HCI_ERR(
1020"%s: %s - failed to read remote unit features, status=%d\n",
1021			__func__, NG_NODE_NAME(unit->node), ep->status);
1022out:
1023	NG_FREE_M(event);
1024
1025	return (error);
1026} /* read_remote_features_compl */
1027
1028/* QoS setup complete event */
1029static int
1030qos_setup_compl(ng_hci_unit_p unit, struct mbuf *event)
1031{
1032	ng_hci_qos_setup_compl_ep	*ep = NULL;
1033	ng_hci_unit_con_p		 con = NULL;
1034	u_int16_t			 h;
1035	int				 error = 0;
1036
1037	NG_HCI_M_PULLUP(event, sizeof(*ep));
1038	if (event == NULL)
1039		return (ENOBUFS);
1040
1041	ep = mtod(event, ng_hci_qos_setup_compl_ep *);
1042
1043	/* Check if we have this connection handle */
1044	h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
1045	con = ng_hci_con_by_handle(unit, h);
1046	if (con == NULL) {
1047		NG_HCI_ALERT(
1048"%s: %s - invalid connection handle=%d\n",
1049			__func__, NG_NODE_NAME(unit->node), h);
1050		error = ENOENT;
1051	} else if (con->link_type != NG_HCI_LINK_ACL) {
1052		NG_HCI_ALERT(
1053"%s: %s - invalid link type=%d, handle=%d\n",
1054			__func__, NG_NODE_NAME(unit->node), con->link_type, h);
1055		error = EINVAL;
1056	} else if (con->state != NG_HCI_CON_OPEN) {
1057		NG_HCI_ALERT(
1058"%s: %s - invalid connection state=%d, handle=%d\n",
1059			__func__, NG_NODE_NAME(unit->node),
1060			con->state, h);
1061		error = EINVAL;
1062	} else /* Notify upper layer */
1063		error = ng_hci_lp_qos_cfm(con, ep->status);
1064
1065	NG_FREE_M(event);
1066
1067	return (error);
1068} /* qos_setup_compl */
1069
1070/* Hardware error event */
1071static int
1072hardware_error(ng_hci_unit_p unit, struct mbuf *event)
1073{
1074	NG_HCI_ALERT(
1075"%s: %s - hardware error %#x\n",
1076		__func__, NG_NODE_NAME(unit->node), *mtod(event, u_int8_t *));
1077
1078	NG_FREE_M(event);
1079
1080	return (0);
1081} /* hardware_error */
1082
1083/* Role change event */
1084static int
1085role_change(ng_hci_unit_p unit, struct mbuf *event)
1086{
1087	ng_hci_role_change_ep	*ep = NULL;
1088	ng_hci_unit_con_p	 con = NULL;
1089
1090	NG_HCI_M_PULLUP(event, sizeof(*ep));
1091	if (event == NULL)
1092		return (ENOBUFS);
1093
1094	ep = mtod(event, ng_hci_role_change_ep *);
1095
1096	if (ep->status == 0) {
1097		/* XXX shoud we also change "role" for SCO connections? */
1098		con = ng_hci_con_by_bdaddr(unit, &ep->bdaddr, NG_HCI_LINK_ACL);
1099		if (con != NULL)
1100			con->role = ep->role;
1101		else
1102			NG_HCI_ALERT(
1103"%s: %s - ACL connection does not exist, bdaddr=%x:%x:%x:%x:%x:%x\n",
1104				__func__, NG_NODE_NAME(unit->node),
1105				ep->bdaddr.b[5], ep->bdaddr.b[4],
1106				ep->bdaddr.b[3], ep->bdaddr.b[2],
1107				ep->bdaddr.b[1], ep->bdaddr.b[0]);
1108	} else
1109		NG_HCI_ERR(
1110"%s: %s - failed to change role, status=%d, bdaddr=%x:%x:%x:%x:%x:%x\n",
1111			__func__, NG_NODE_NAME(unit->node), ep->status,
1112			ep->bdaddr.b[5], ep->bdaddr.b[4], ep->bdaddr.b[3],
1113			ep->bdaddr.b[2], ep->bdaddr.b[1], ep->bdaddr.b[0]);
1114
1115	NG_FREE_M(event);
1116
1117	return (0);
1118} /* role_change */
1119
1120/* Number of completed packets event */
1121static int
1122num_compl_pkts(ng_hci_unit_p unit, struct mbuf *event)
1123{
1124	ng_hci_num_compl_pkts_ep	*ep = NULL;
1125	ng_hci_unit_con_p		 con = NULL;
1126	u_int16_t			 h, p;
1127
1128	NG_HCI_M_PULLUP(event, sizeof(*ep));
1129	if (event == NULL)
1130		return (ENOBUFS);
1131
1132	ep = mtod(event, ng_hci_num_compl_pkts_ep *);
1133	m_adj(event, sizeof(*ep));
1134
1135	for (; ep->num_con_handles > 0; ep->num_con_handles --) {
1136		/* Get connection handle */
1137		m_copydata(event, 0, sizeof(h), (caddr_t) &h);
1138		m_adj(event, sizeof(h));
1139		h = NG_HCI_CON_HANDLE(le16toh(h));
1140
1141		/* Get number of completed packets */
1142		m_copydata(event, 0, sizeof(p), (caddr_t) &p);
1143		m_adj(event, sizeof(p));
1144		p = le16toh(p);
1145
1146		/* Check if we have this connection handle */
1147		con = ng_hci_con_by_handle(unit, h);
1148		if (con != NULL) {
1149			con->pending -= p;
1150			if (con->pending < 0) {
1151				NG_HCI_WARN(
1152"%s: %s - pending packet counter is out of sync! " \
1153"handle=%d, pending=%d, ncp=%d\n",	__func__, NG_NODE_NAME(unit->node),
1154					con->con_handle, con->pending, p);
1155
1156				con->pending = 0;
1157			}
1158
1159			/* Update buffer descriptor */
1160			if (con->link_type != NG_HCI_LINK_SCO)
1161				NG_HCI_BUFF_ACL_FREE(unit->buffer, p);
1162			else
1163				NG_HCI_BUFF_SCO_FREE(unit->buffer, p);
1164		} else
1165			NG_HCI_ALERT(
1166"%s: %s - invalid connection handle=%d\n",
1167				__func__, NG_NODE_NAME(unit->node), h);
1168	}
1169
1170	NG_FREE_M(event);
1171
1172	/* Send more data */
1173	ng_hci_send_data(unit);
1174
1175	return (0);
1176} /* num_compl_pkts */
1177
1178/* Mode change event */
1179static int
1180mode_change(ng_hci_unit_p unit, struct mbuf *event)
1181{
1182	ng_hci_mode_change_ep	*ep = NULL;
1183	ng_hci_unit_con_p	 con = NULL;
1184	int			 error = 0;
1185
1186	NG_HCI_M_PULLUP(event, sizeof(*ep));
1187	if (event == NULL)
1188		return (ENOBUFS);
1189
1190	ep = mtod(event, ng_hci_mode_change_ep *);
1191
1192	if (ep->status == 0) {
1193		u_int16_t	h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
1194
1195		con = ng_hci_con_by_handle(unit, h);
1196		if (con == NULL) {
1197			NG_HCI_ALERT(
1198"%s: %s - invalid connection handle=%d\n",
1199				__func__, NG_NODE_NAME(unit->node), h);
1200			error = ENOENT;
1201		} else if (con->link_type != NG_HCI_LINK_ACL) {
1202			NG_HCI_ALERT(
1203"%s: %s - invalid link type=%d\n",
1204				__func__, NG_NODE_NAME(unit->node),
1205				con->link_type);
1206			error = EINVAL;
1207		} else
1208			con->mode = ep->unit_mode;
1209	} else
1210		NG_HCI_ERR(
1211"%s: %s - failed to change mode, status=%d\n",
1212			__func__, NG_NODE_NAME(unit->node), ep->status);
1213
1214	NG_FREE_M(event);
1215
1216	return (error);
1217} /* mode_change */
1218
1219/* Data buffer overflow event */
1220static int
1221data_buffer_overflow(ng_hci_unit_p unit, struct mbuf *event)
1222{
1223	NG_HCI_ALERT(
1224"%s: %s - %s data buffer overflow\n",
1225		__func__, NG_NODE_NAME(unit->node),
1226		(*mtod(event, u_int8_t *) == NG_HCI_LINK_ACL)? "ACL" : "SCO");
1227
1228	NG_FREE_M(event);
1229
1230	return (0);
1231} /* data_buffer_overflow */
1232
1233/* Read clock offset complete event */
1234static int
1235read_clock_offset_compl(ng_hci_unit_p unit, struct mbuf *event)
1236{
1237	ng_hci_read_clock_offset_compl_ep	*ep = NULL;
1238	ng_hci_unit_con_p			 con = NULL;
1239	ng_hci_neighbor_p			 n = NULL;
1240	int					 error = 0;
1241
1242	NG_HCI_M_PULLUP(event, sizeof(*ep));
1243	if (event == NULL)
1244		return (ENOBUFS);
1245
1246	ep = mtod(event, ng_hci_read_clock_offset_compl_ep *);
1247
1248	if (ep->status == 0) {
1249		u_int16_t	h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
1250
1251		con = ng_hci_con_by_handle(unit, h);
1252		if (con == NULL) {
1253			NG_HCI_ALERT(
1254"%s: %s - invalid connection handle=%d\n",
1255				__func__, NG_NODE_NAME(unit->node), h);
1256			error = ENOENT;
1257			goto out;
1258		}
1259
1260		/* Update cache entry */
1261		n = ng_hci_get_neighbor(unit, &con->bdaddr, NG_HCI_LINK_ACL);
1262		if (n == NULL) {
1263			n = ng_hci_new_neighbor(unit);
1264			if (n == NULL) {
1265				error = ENOMEM;
1266				goto out;
1267			}
1268
1269			bcopy(&con->bdaddr, &n->bdaddr, sizeof(n->bdaddr));
1270			n->addrtype = NG_HCI_LINK_ACL;
1271		} else
1272			getmicrotime(&n->updated);
1273
1274		n->clock_offset = le16toh(ep->clock_offset);
1275	} else
1276		NG_HCI_ERR(
1277"%s: %s - failed to Read Remote Clock Offset, status=%d\n",
1278			__func__, NG_NODE_NAME(unit->node), ep->status);
1279out:
1280	NG_FREE_M(event);
1281
1282	return (error);
1283} /* read_clock_offset_compl */
1284
1285/* QoS violation event */
1286static int
1287qos_violation(ng_hci_unit_p unit, struct mbuf *event)
1288{
1289	ng_hci_qos_violation_ep	*ep = NULL;
1290	ng_hci_unit_con_p	 con = NULL;
1291	u_int16_t		 h;
1292	int			 error = 0;
1293
1294	NG_HCI_M_PULLUP(event, sizeof(*ep));
1295	if (event == NULL)
1296		return (ENOBUFS);
1297
1298	ep = mtod(event, ng_hci_qos_violation_ep *);
1299
1300	/* Check if we have this connection handle */
1301	h = NG_HCI_CON_HANDLE(le16toh(ep->con_handle));
1302	con = ng_hci_con_by_handle(unit, h);
1303	if (con == NULL) {
1304		NG_HCI_ALERT(
1305"%s: %s - invalid connection handle=%d\n",
1306			__func__, NG_NODE_NAME(unit->node), h);
1307		error = ENOENT;
1308	} else if (con->link_type != NG_HCI_LINK_ACL) {
1309		NG_HCI_ALERT(
1310"%s: %s - invalid link type=%d\n",
1311			__func__, NG_NODE_NAME(unit->node), con->link_type);
1312		error = EINVAL;
1313	} else if (con->state != NG_HCI_CON_OPEN) {
1314		NG_HCI_ALERT(
1315"%s: %s - invalid connection state=%d, handle=%d\n",
1316			__func__, NG_NODE_NAME(unit->node), con->state, h);
1317		error = EINVAL;
1318	} else /* Notify upper layer */
1319		error = ng_hci_lp_qos_ind(con);
1320
1321	NG_FREE_M(event);
1322
1323	return (error);
1324} /* qos_violation */
1325
1326/* Page scan mode change event */
1327static int
1328page_scan_mode_change(ng_hci_unit_p unit, struct mbuf *event)
1329{
1330	ng_hci_page_scan_mode_change_ep	*ep = NULL;
1331	ng_hci_neighbor_p		 n = NULL;
1332	int				 error = 0;
1333
1334	NG_HCI_M_PULLUP(event, sizeof(*ep));
1335	if (event == NULL)
1336		return (ENOBUFS);
1337
1338	ep = mtod(event, ng_hci_page_scan_mode_change_ep *);
1339
1340	/* Update cache entry */
1341	n = ng_hci_get_neighbor(unit, &ep->bdaddr, NG_HCI_LINK_ACL);
1342	if (n == NULL) {
1343		n = ng_hci_new_neighbor(unit);
1344		if (n == NULL) {
1345			error = ENOMEM;
1346			goto out;
1347		}
1348
1349		bcopy(&ep->bdaddr, &n->bdaddr, sizeof(n->bdaddr));
1350		n->addrtype = NG_HCI_LINK_ACL;
1351	} else
1352		getmicrotime(&n->updated);
1353
1354	n->page_scan_mode = ep->page_scan_mode;
1355out:
1356	NG_FREE_M(event);
1357
1358	return (error);
1359} /* page_scan_mode_change */
1360
1361/* Page scan repetition mode change event */
1362static int
1363page_scan_rep_mode_change(ng_hci_unit_p unit, struct mbuf *event)
1364{
1365	ng_hci_page_scan_rep_mode_change_ep	*ep = NULL;
1366	ng_hci_neighbor_p			 n = NULL;
1367	int					 error = 0;
1368
1369	NG_HCI_M_PULLUP(event, sizeof(*ep));
1370	if (event == NULL)
1371		return (ENOBUFS);
1372
1373	ep = mtod(event, ng_hci_page_scan_rep_mode_change_ep *);
1374
1375	/* Update cache entry */
1376	n = ng_hci_get_neighbor(unit, &ep->bdaddr, NG_HCI_LINK_ACL);
1377	if (n == NULL) {
1378		n = ng_hci_new_neighbor(unit);
1379		if (n == NULL) {
1380			error = ENOMEM;
1381			goto out;
1382		}
1383
1384		bcopy(&ep->bdaddr, &n->bdaddr, sizeof(n->bdaddr));
1385		n->addrtype = NG_HCI_LINK_ACL;
1386	} else
1387		getmicrotime(&n->updated);
1388
1389	n->page_scan_rep_mode = ep->page_scan_rep_mode;
1390out:
1391	NG_FREE_M(event);
1392
1393	return (error);
1394} /* page_scan_rep_mode_change */
1395