1 /*
2  * ng_hci_cmds.c
3  */
4 
5 /*-
6  * Copyright (c) Maksim Yevmenkin <m_evmenkin@yahoo.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $Id: ng_hci_cmds.c,v 1.4 2003/09/08 18:57:51 max Exp $
31  * $FreeBSD: src/sys/netgraph/bluetooth/hci/ng_hci_cmds.c,v 1.7 2005/01/07 01:45:43 imp Exp $
32  */
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/kernel.h>
37 #include <sys/endian.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/queue.h>
41 #include <netgraph7/ng_message.h>
42 #include <netgraph7/netgraph.h>
43 #include <netgraph7/bluetooth/include/ng_bluetooth.h>
44 #include <netgraph7/bluetooth/include/ng_hci.h>
45 #include <netgraph7/bluetooth/hci/ng_hci_var.h>
46 #include <netgraph7/bluetooth/hci/ng_hci_cmds.h>
47 #include <netgraph7/bluetooth/hci/ng_hci_evnt.h>
48 #include <netgraph7/bluetooth/hci/ng_hci_ulpi.h>
49 #include <netgraph7/bluetooth/hci/ng_hci_misc.h>
50 
51 /******************************************************************************
52  ******************************************************************************
53  **                     HCI commands processing module
54  ******************************************************************************
55  ******************************************************************************/
56 
57 #undef	min
58 #define	min(a, b)	((a) < (b))? (a) : (b)
59 
60 static int  complete_command (ng_hci_unit_p, int, struct mbuf **);
61 
62 static int process_link_control_params
63 	(ng_hci_unit_p, u_int16_t, struct mbuf *, struct mbuf *);
64 static int process_link_policy_params
65 	(ng_hci_unit_p, u_int16_t, struct mbuf *, struct mbuf *);
66 static int process_hc_baseband_params
67 	(ng_hci_unit_p, u_int16_t, struct mbuf *, struct mbuf *);
68 static int process_info_params
69 	(ng_hci_unit_p, u_int16_t, struct mbuf *, struct mbuf *);
70 static int process_status_params
71 	(ng_hci_unit_p, u_int16_t, struct mbuf *, struct mbuf *);
72 static int process_testing_params
73 	(ng_hci_unit_p, u_int16_t, struct mbuf *, struct mbuf *);
74 
75 static int process_link_control_status
76 	(ng_hci_unit_p, ng_hci_command_status_ep *, struct mbuf *);
77 static int process_link_policy_status
78 	(ng_hci_unit_p, ng_hci_command_status_ep *, struct mbuf *);
79 
80 /*
81  * Send HCI command to the driver.
82  */
83 
84 int
85 ng_hci_send_command(ng_hci_unit_p unit)
86 {
87 	struct mbuf	*m0 = NULL, *m = NULL;
88 	int		 free, error = 0;
89 
90 	/* Check if other command is pending */
91 	if (unit->state & NG_HCI_UNIT_COMMAND_PENDING)
92 		return (0);
93 
94 	/* Check if unit can accept our command */
95 	NG_HCI_BUFF_CMD_GET(unit->buffer, free);
96 	if (free == 0)
97 		return (0);
98 
99 	/* Check if driver hook is still ok */
100 	if (unit->drv == NULL || NG_HOOK_NOT_VALID(unit->drv)) {
101 		NG_HCI_WARN(
102 "%s: %s - hook \"%s\" is not connected or valid\n",
103 			__func__, NG_NODE_NAME(unit->node), NG_HCI_HOOK_DRV);
104 
105 		NG_BT_MBUFQ_DRAIN(&unit->cmdq);
106 
107 		return (ENOTCONN);
108 	}
109 
110 	/*
111 	 * Get first command from queue, give it to RAW hook then
112 	 * make copy of it and send it to the driver
113 	 */
114 
115 	m0 = NG_BT_MBUFQ_FIRST(&unit->cmdq);
116 	if (m0 == NULL)
117 		return (0);
118 
119 	ng_hci_mtap(unit, m0);
120 
121 	m = m_dup(m0, M_NOWAIT);
122 	if (m != NULL)
123 		NG_SEND_DATA_ONLY(error, unit->drv, m);
124 	else
125 		error = ENOBUFS;
126 
127 	if (error != 0)
128 		NG_HCI_ERR(
129 "%s: %s - could not send HCI command, error=%d\n",
130 			__func__, NG_NODE_NAME(unit->node), error);
131 
132 	/*
133 	 * Even if we were not able to send command we still pretend
134 	 * that everything is OK and let timeout handle that.
135 	 */
136 
137 	NG_HCI_BUFF_CMD_USE(unit->buffer, 1);
138 	NG_HCI_STAT_CMD_SENT(unit->stat);
139 	NG_HCI_STAT_BYTES_SENT(unit->stat, m0->m_pkthdr.len);
140 
141 	/*
142 	 * Note: ng_hci_command_timeout() will set
143 	 * NG_HCI_UNIT_COMMAND_PENDING flag
144 	 */
145 
146 	ng_hci_command_timeout(unit);
147 
148 	return (0);
149 } /* ng_hci_send_command */
150 
151 /*
152  * Process HCI Command_Compete event. Complete HCI command, and do post
153  * processing on the command parameters (cp) and command return parameters
154  * (e) if required (for example adjust state).
155  */
156 
157 int
158 ng_hci_process_command_complete(ng_hci_unit_p unit, struct mbuf *e)
159 {
160 	ng_hci_command_compl_ep		*ep = NULL;
161 	struct mbuf			*cp = NULL;
162 	int				 error = 0;
163 
164 	/* Get event packet and update command buffer info */
165 	NG_HCI_M_PULLUP(e, sizeof(*ep));
166 	if (e == NULL)
167 		return (ENOBUFS); /* XXX this is bad */
168 
169 	ep = mtod(e, ng_hci_command_compl_ep *);
170         NG_HCI_BUFF_CMD_SET(unit->buffer, ep->num_cmd_pkts);
171 
172 	/* Check for special NOOP command */
173 	if (ep->opcode == 0x0000) {
174 		NG_FREE_M(e);
175 		goto out;
176 	}
177 
178 	/* Try to match first command item in the queue */
179 	error = complete_command(unit, ep->opcode, &cp);
180 	if (error != 0) {
181 		NG_FREE_M(e);
182 		goto out;
183 	}
184 
185 	/*
186 	 * Perform post processing on command parameters and return parameters
187 	 * do it only if status is OK (status == 0). Status is the first byte
188 	 * of any command return parameters.
189 	 */
190 
191 	ep->opcode = le16toh(ep->opcode);
192 	m_adj(e, sizeof(*ep));
193 
194 	if (*mtod(e, u_int8_t *) == 0) { /* XXX m_pullup here? */
195 		switch (NG_HCI_OGF(ep->opcode)) {
196 		case NG_HCI_OGF_LINK_CONTROL:
197 			error = process_link_control_params(unit,
198 					NG_HCI_OCF(ep->opcode), cp, e);
199 			break;
200 
201 		case NG_HCI_OGF_LINK_POLICY:
202 			error = process_link_policy_params(unit,
203 					NG_HCI_OCF(ep->opcode), cp, e);
204 			break;
205 
206 		case NG_HCI_OGF_HC_BASEBAND:
207 			error = process_hc_baseband_params(unit,
208 					NG_HCI_OCF(ep->opcode), cp, e);
209 			break;
210 
211 		case NG_HCI_OGF_INFO:
212 			error = process_info_params(unit,
213 					NG_HCI_OCF(ep->opcode), cp, e);
214 			break;
215 
216 		case NG_HCI_OGF_STATUS:
217 			error = process_status_params(unit,
218 					NG_HCI_OCF(ep->opcode), cp, e);
219 			break;
220 
221 		case NG_HCI_OGF_TESTING:
222 			error = process_testing_params(unit,
223 					NG_HCI_OCF(ep->opcode), cp, e);
224 			break;
225 
226 		case NG_HCI_OGF_BT_LOGO:
227 		case NG_HCI_OGF_VENDOR:
228 			NG_FREE_M(cp);
229 			NG_FREE_M(e);
230 			break;
231 
232 		default:
233 			NG_FREE_M(cp);
234 			NG_FREE_M(e);
235 			error = EINVAL;
236 			break;
237 		}
238 	} else {
239 		NG_HCI_ERR(
240 "%s: %s - HCI command failed, OGF=%#x, OCF=%#x, status=%#x\n",
241 			__func__, NG_NODE_NAME(unit->node),
242 			NG_HCI_OGF(ep->opcode), NG_HCI_OCF(ep->opcode),
243 			*mtod(e, u_int8_t *));
244 
245 		NG_FREE_M(cp);
246 		NG_FREE_M(e);
247 	}
248 out:
249 	ng_hci_send_command(unit);
250 
251 	return (error);
252 } /* ng_hci_process_command_complete */
253 
254 /*
255  * Process HCI Command_Status event. Check the status (mst) and do post
256  * processing (if required).
257  */
258 
259 int
260 ng_hci_process_command_status(ng_hci_unit_p unit, struct mbuf *e)
261 {
262 	ng_hci_command_status_ep	*ep = NULL;
263 	struct mbuf			*cp = NULL;
264 	int				 error = 0;
265 
266 	/* Update command buffer info */
267 	NG_HCI_M_PULLUP(e, sizeof(*ep));
268 	if (e == NULL)
269 		return (ENOBUFS); /* XXX this is bad */
270 
271 	ep = mtod(e, ng_hci_command_status_ep *);
272 	NG_HCI_BUFF_CMD_SET(unit->buffer, ep->num_cmd_pkts);
273 
274 	/* Check for special NOOP command */
275 	if (ep->opcode == 0x0000)
276 		goto out;
277 
278 	/* Try to match first command item in the queue */
279 	error = complete_command(unit, ep->opcode, &cp);
280         if (error != 0)
281 		goto out;
282 
283 	/*
284 	 * Perform post processing on HCI Command_Status event
285 	 */
286 
287 	ep->opcode = le16toh(ep->opcode);
288 
289 	switch (NG_HCI_OGF(ep->opcode)) {
290 	case NG_HCI_OGF_LINK_CONTROL:
291 		error = process_link_control_status(unit, ep, cp);
292 		break;
293 
294 	case NG_HCI_OGF_LINK_POLICY:
295 		error = process_link_policy_status(unit, ep, cp);
296 		break;
297 
298 	case NG_HCI_OGF_BT_LOGO:
299 	case NG_HCI_OGF_VENDOR:
300 		NG_FREE_M(cp);
301 		break;
302 
303 	case NG_HCI_OGF_HC_BASEBAND:
304 	case NG_HCI_OGF_INFO:
305 	case NG_HCI_OGF_STATUS:
306 	case NG_HCI_OGF_TESTING:
307 	default:
308 		NG_FREE_M(cp);
309 		error = EINVAL;
310 		break;
311 	}
312 out:
313 	NG_FREE_M(e);
314 	ng_hci_send_command(unit);
315 
316 	return (error);
317 } /* ng_hci_process_command_status */
318 
319 /*
320  * Complete queued HCI command.
321  */
322 
323 static int
324 complete_command(ng_hci_unit_p unit, int opcode, struct mbuf **cp)
325 {
326 	struct mbuf	*m = NULL;
327 
328 	/* Check unit state */
329 	if (!(unit->state & NG_HCI_UNIT_COMMAND_PENDING)) {
330 		NG_HCI_ALERT(
331 "%s: %s - no pending command, state=%#x\n",
332 			__func__, NG_NODE_NAME(unit->node), unit->state);
333 
334 		return (EINVAL);
335 	}
336 
337 	/* Get first command in the queue */
338 	m = NG_BT_MBUFQ_FIRST(&unit->cmdq);
339 	if (m == NULL) {
340 		NG_HCI_ALERT(
341 "%s: %s - empty command queue?!\n", __func__, NG_NODE_NAME(unit->node));
342 
343 		return (EINVAL);
344 	}
345 
346 	/*
347 	 * Match command opcode, if does not match - do nothing and
348 	 * let timeout handle that.
349 	 */
350 
351 	if (mtod(m, ng_hci_cmd_pkt_t *)->opcode != opcode) {
352 		NG_HCI_ALERT(
353 "%s: %s - command queue is out of sync\n", __func__, NG_NODE_NAME(unit->node));
354 
355 		return (EINVAL);
356 	}
357 
358 	/*
359 	 * Now we can remove command timeout, dequeue completed command
360 	 * and return command parameters. ng_hci_command_untimeout will
361 	 * drop NG_HCI_UNIT_COMMAND_PENDING flag.
362 	 * Note: if ng_hci_command_untimeout() fails (returns non-zero)
363 	 * then timeout aready happened and timeout message went info node
364 	 * queue. In this case we ignore command completion and pretend
365 	 * there is a timeout.
366 	 */
367 
368 	if (ng_hci_command_untimeout(unit) != 0)
369 		return (ETIMEDOUT);
370 
371 	NG_BT_MBUFQ_DEQUEUE(&unit->cmdq, *cp);
372 	m_adj(*cp, sizeof(ng_hci_cmd_pkt_t));
373 
374 	return (0);
375 } /* complete_command */
376 
377 /*
378  * Process HCI command timeout
379  */
380 
381 void
382 ng_hci_process_command_timeout(node_p node, hook_p hook, void *arg1, int arg2)
383 {
384 	ng_hci_unit_p	 unit = NULL;
385 	struct mbuf	*m = NULL;
386 	u_int16_t	 opcode;
387 
388 	if (NG_NODE_NOT_VALID(node)) {
389 		kprintf("%s: Netgraph node is not valid\n", __func__);
390 		return;
391 	}
392 
393 	unit = (ng_hci_unit_p) NG_NODE_PRIVATE(node);
394 
395 	if (unit->state & NG_HCI_UNIT_COMMAND_PENDING) {
396 		unit->state &= ~NG_HCI_UNIT_COMMAND_PENDING;
397 
398 		NG_BT_MBUFQ_DEQUEUE(&unit->cmdq, m);
399 		if (m == NULL) {
400 			NG_HCI_ALERT(
401 "%s: %s - command queue is out of sync!\n", __func__, NG_NODE_NAME(unit->node));
402 
403 			return;
404 		}
405 
406 		opcode = le16toh(mtod(m, ng_hci_cmd_pkt_t *)->opcode);
407 		NG_FREE_M(m);
408 
409 		NG_HCI_ERR(
410 "%s: %s - unable to complete HCI command OGF=%#x, OCF=%#x. Timeout\n",
411 			__func__, NG_NODE_NAME(unit->node), NG_HCI_OGF(opcode),
412 			NG_HCI_OCF(opcode));
413 
414 		/* Try to send more commands */
415  		NG_HCI_BUFF_CMD_SET(unit->buffer, 1);
416 		ng_hci_send_command(unit);
417 	} else
418 		NG_HCI_ALERT(
419 "%s: %s - no pending command\n", __func__, NG_NODE_NAME(unit->node));
420 } /* ng_hci_process_command_timeout */
421 
422 /*
423  * Process link command return parameters
424  */
425 
426 static int
427 process_link_control_params(ng_hci_unit_p unit, u_int16_t ocf,
428 		struct mbuf *mcp, struct mbuf *mrp)
429 {
430 	int	error  = 0;
431 
432 	switch (ocf) {
433 	case NG_HCI_OCF_INQUIRY_CANCEL:
434 	case NG_HCI_OCF_PERIODIC_INQUIRY:
435 	case NG_HCI_OCF_EXIT_PERIODIC_INQUIRY:
436 	case NG_HCI_OCF_LINK_KEY_REP:
437 	case NG_HCI_OCF_LINK_KEY_NEG_REP:
438 	case NG_HCI_OCF_PIN_CODE_REP:
439 	case NG_HCI_OCF_PIN_CODE_NEG_REP:
440 		/* These do not need post processing */
441 		break;
442 
443 	case NG_HCI_OCF_INQUIRY:
444 	case NG_HCI_OCF_CREATE_CON:
445 	case NG_HCI_OCF_DISCON:
446 	case NG_HCI_OCF_ADD_SCO_CON:
447 	case NG_HCI_OCF_ACCEPT_CON:
448 	case NG_HCI_OCF_REJECT_CON:
449 	case NG_HCI_OCF_CHANGE_CON_PKT_TYPE:
450 	case NG_HCI_OCF_AUTH_REQ:
451 	case NG_HCI_OCF_SET_CON_ENCRYPTION:
452 	case NG_HCI_OCF_CHANGE_CON_LINK_KEY:
453 	case NG_HCI_OCF_MASTER_LINK_KEY:
454 	case NG_HCI_OCF_REMOTE_NAME_REQ:
455 	case NG_HCI_OCF_READ_REMOTE_FEATURES:
456 	case NG_HCI_OCF_READ_REMOTE_VER_INFO:
457 	case NG_HCI_OCF_READ_CLOCK_OFFSET:
458 	default:
459 
460 		/*
461 		 * None of these command was supposed to generate
462 		 * Command_Complete event. Instead Command_Status event
463 		 * should have been generated and then appropriate event
464 		 * should have been sent to indicate the final result.
465 		 */
466 
467 		error = EINVAL;
468 		break;
469 	}
470 
471 	NG_FREE_M(mcp);
472 	NG_FREE_M(mrp);
473 
474 	return (error);
475 } /* process_link_control_params */
476 
477 /*
478  * Process link policy command return parameters
479  */
480 
481 static int
482 process_link_policy_params(ng_hci_unit_p unit, u_int16_t ocf,
483 		struct mbuf *mcp, struct mbuf *mrp)
484 {
485 	int	error = 0;
486 
487 	switch (ocf){
488 	case NG_HCI_OCF_ROLE_DISCOVERY: {
489 		ng_hci_role_discovery_rp	*rp = NULL;
490 		ng_hci_unit_con_t		*con = NULL;
491 		u_int16_t			 h;
492 
493 		NG_HCI_M_PULLUP(mrp, sizeof(*rp));
494 		if (mrp != NULL) {
495 			rp = mtod(mrp, ng_hci_role_discovery_rp *);
496 
497 			h = NG_HCI_CON_HANDLE(le16toh(rp->con_handle));
498 			con = ng_hci_con_by_handle(unit, h);
499 			if (con == NULL) {
500 				NG_HCI_ALERT(
501 "%s: %s - invalid connection handle=%d\n",
502 					__func__, NG_NODE_NAME(unit->node), h);
503 				error = ENOENT;
504 			} else if (con->link_type != NG_HCI_LINK_ACL) {
505 				NG_HCI_ALERT(
506 "%s: %s - invalid link type=%d\n", __func__, NG_NODE_NAME(unit->node),
507 					con->link_type);
508 				error = EINVAL;
509 			} else
510 				con->role = rp->role;
511 		} else
512 			error = ENOBUFS;
513 		} break;
514 
515 	case NG_HCI_OCF_READ_LINK_POLICY_SETTINGS:
516 	case NG_HCI_OCF_WRITE_LINK_POLICY_SETTINGS:
517 		/* These do not need post processing */
518 		break;
519 
520 	case NG_HCI_OCF_HOLD_MODE:
521 	case NG_HCI_OCF_SNIFF_MODE:
522 	case NG_HCI_OCF_EXIT_SNIFF_MODE:
523 	case NG_HCI_OCF_PARK_MODE:
524 	case NG_HCI_OCF_EXIT_PARK_MODE:
525 	case NG_HCI_OCF_QOS_SETUP:
526 	case NG_HCI_OCF_SWITCH_ROLE:
527 	default:
528 
529 		/*
530 		 * None of these command was supposed to generate
531 		 * Command_Complete event. Instead Command_Status event
532 		 * should have been generated and then appropriate event
533 		 * should have been sent to indicate the final result.
534 		 */
535 
536 		error = EINVAL;
537 		break;
538 	}
539 
540 	NG_FREE_M(mcp);
541 	NG_FREE_M(mrp);
542 
543 	return (error);
544 } /* process_link_policy_params */
545 
546 /*
547  * Process HC and baseband command return parameters
548  */
549 
550 int
551 process_hc_baseband_params(ng_hci_unit_p unit, u_int16_t ocf,
552 		struct mbuf *mcp, struct mbuf *mrp)
553 {
554 	int	error = 0;
555 
556 	switch (ocf) {
557 	case NG_HCI_OCF_SET_EVENT_MASK:
558 	case NG_HCI_OCF_SET_EVENT_FILTER:
559 	case NG_HCI_OCF_FLUSH:	/* XXX Do we need to handle that? */
560 	case NG_HCI_OCF_READ_PIN_TYPE:
561 	case NG_HCI_OCF_WRITE_PIN_TYPE:
562 	case NG_HCI_OCF_CREATE_NEW_UNIT_KEY:
563 	case NG_HCI_OCF_WRITE_STORED_LINK_KEY:
564 	case NG_HCI_OCF_WRITE_CON_ACCEPT_TIMO:
565 	case NG_HCI_OCF_WRITE_PAGE_TIMO:
566 	case NG_HCI_OCF_READ_SCAN_ENABLE:
567 	case NG_HCI_OCF_WRITE_SCAN_ENABLE:
568 	case NG_HCI_OCF_WRITE_PAGE_SCAN_ACTIVITY:
569 	case NG_HCI_OCF_WRITE_INQUIRY_SCAN_ACTIVITY:
570 	case NG_HCI_OCF_READ_AUTH_ENABLE:
571 	case NG_HCI_OCF_WRITE_AUTH_ENABLE:
572 	case NG_HCI_OCF_READ_ENCRYPTION_MODE:
573 	case NG_HCI_OCF_WRITE_ENCRYPTION_MODE:
574 	case NG_HCI_OCF_WRITE_VOICE_SETTINGS:
575 	case NG_HCI_OCF_READ_NUM_BROADCAST_RETRANS:
576 	case NG_HCI_OCF_WRITE_NUM_BROADCAST_RETRANS:
577 	case NG_HCI_OCF_READ_HOLD_MODE_ACTIVITY:
578 	case NG_HCI_OCF_WRITE_HOLD_MODE_ACTIVITY:
579 	case NG_HCI_OCF_READ_SCO_FLOW_CONTROL:
580 	case NG_HCI_OCF_WRITE_SCO_FLOW_CONTROL:
581 	case NG_HCI_OCF_H2HC_FLOW_CONTROL: /* XXX Not supported this time */
582 	case NG_HCI_OCF_HOST_BUFFER_SIZE:
583 	case NG_HCI_OCF_READ_IAC_LAP:
584 	case NG_HCI_OCF_WRITE_IAC_LAP:
585 	case NG_HCI_OCF_READ_PAGE_SCAN_PERIOD:
586 	case NG_HCI_OCF_WRITE_PAGE_SCAN_PERIOD:
587 	case NG_HCI_OCF_READ_PAGE_SCAN:
588 	case NG_HCI_OCF_WRITE_PAGE_SCAN:
589 	case NG_HCI_OCF_READ_LINK_SUPERVISION_TIMO:
590 	case NG_HCI_OCF_WRITE_LINK_SUPERVISION_TIMO:
591 	case NG_HCI_OCF_READ_SUPPORTED_IAC_NUM:
592 	case NG_HCI_OCF_READ_STORED_LINK_KEY:
593 	case NG_HCI_OCF_DELETE_STORED_LINK_KEY:
594 	case NG_HCI_OCF_READ_CON_ACCEPT_TIMO:
595 	case NG_HCI_OCF_READ_PAGE_TIMO:
596 	case NG_HCI_OCF_READ_PAGE_SCAN_ACTIVITY:
597 	case NG_HCI_OCF_READ_INQUIRY_SCAN_ACTIVITY:
598 	case NG_HCI_OCF_READ_VOICE_SETTINGS:
599 	case NG_HCI_OCF_READ_AUTO_FLUSH_TIMO:
600 	case NG_HCI_OCF_WRITE_AUTO_FLUSH_TIMO:
601 	case NG_HCI_OCF_READ_XMIT_LEVEL:
602 	case NG_HCI_OCF_HOST_NUM_COMPL_PKTS:	/* XXX Can get here? */
603 	case NG_HCI_OCF_CHANGE_LOCAL_NAME:
604 	case NG_HCI_OCF_READ_LOCAL_NAME:
605 	case NG_HCI_OCF_READ_UNIT_CLASS:
606 	case NG_HCI_OCF_WRITE_UNIT_CLASS:
607 		/* These do not need post processing */
608 		break;
609 
610 	case NG_HCI_OCF_RESET: {
611 		ng_hci_unit_con_p	con = NULL;
612 		int			size;
613 
614 		/*
615 		 * XXX
616 		 *
617 		 * After RESET command unit goes into standby mode
618 		 * and all operational state is lost. Host controller
619 		 * will revert to default values for all parameters.
620 		 *
621 		 * For now we shall terminate all connections and drop
622 		 * inited bit. After RESET unit must be re-initialized.
623 		 */
624 
625 		while (!LIST_EMPTY(&unit->con_list)) {
626 			con = LIST_FIRST(&unit->con_list);
627 
628 			/* Remove all timeouts (if any) */
629 			if (con->flags & NG_HCI_CON_TIMEOUT_PENDING)
630 				ng_hci_con_untimeout(con);
631 
632 			/* Connection terminated by local host */
633 			ng_hci_lp_discon_ind(con, 0x16);
634 			ng_hci_free_con(con);
635 		}
636 
637 		NG_HCI_BUFF_ACL_TOTAL(unit->buffer, size);
638 		NG_HCI_BUFF_ACL_FREE(unit->buffer, size);
639 
640 		NG_HCI_BUFF_SCO_TOTAL(unit->buffer, size);
641 		NG_HCI_BUFF_SCO_FREE(unit->buffer, size);
642 
643 		unit->state &= ~NG_HCI_UNIT_INITED;
644 		} break;
645 
646 	default:
647 		error = EINVAL;
648 		break;
649 	}
650 
651 	NG_FREE_M(mcp);
652 	NG_FREE_M(mrp);
653 
654 	return (error);
655 } /* process_hc_baseband_params */
656 
657 /*
658  * Process info command return parameters
659  */
660 
661 static int
662 process_info_params(ng_hci_unit_p unit, u_int16_t ocf, struct mbuf *mcp,
663 		struct mbuf *mrp)
664 {
665 	int	error = 0, len;
666 
667 	switch (ocf) {
668 	case NG_HCI_OCF_READ_LOCAL_VER:
669 	case NG_HCI_OCF_READ_COUNTRY_CODE:
670 		break;
671 
672 	case NG_HCI_OCF_READ_LOCAL_FEATURES:
673 		m_adj(mrp, sizeof(u_int8_t));
674 		len = min(mrp->m_pkthdr.len, sizeof(unit->features));
675 		m_copydata(mrp, 0, len, unit->features);
676 		break;
677 
678 	case NG_HCI_OCF_READ_BUFFER_SIZE: {
679 		ng_hci_read_buffer_size_rp	*rp = NULL;
680 
681 		/* Do not update buffer descriptor if node was initialized */
682 		if ((unit->state & NG_HCI_UNIT_READY) == NG_HCI_UNIT_READY)
683 			break;
684 
685 		NG_HCI_M_PULLUP(mrp, sizeof(*rp));
686 		if (mrp != NULL) {
687 			rp = mtod(mrp, ng_hci_read_buffer_size_rp *);
688 
689 			NG_HCI_BUFF_ACL_SET(
690 				unit->buffer,
691 				le16toh(rp->num_acl_pkt),  /* number */
692 				le16toh(rp->max_acl_size), /* size */
693 				le16toh(rp->num_acl_pkt)   /* free */
694 			);
695 
696 			NG_HCI_BUFF_SCO_SET(
697 				unit->buffer,
698 				le16toh(rp->num_sco_pkt), /* number */
699 				rp->max_sco_size,         /* size */
700 				le16toh(rp->num_sco_pkt)  /* free */
701 			);
702 
703 			/* Let upper layers know */
704 			ng_hci_node_is_up(unit->node, unit->acl, NULL, 0);
705 			ng_hci_node_is_up(unit->node, unit->sco, NULL, 0);
706 		} else
707 			error = ENOBUFS;
708 		} break;
709 
710 	case NG_HCI_OCF_READ_BDADDR:
711 		/* Do not update BD_ADDR if node was initialized */
712 		if ((unit->state & NG_HCI_UNIT_READY) == NG_HCI_UNIT_READY)
713 			break;
714 
715 		m_adj(mrp, sizeof(u_int8_t));
716 		len = min(mrp->m_pkthdr.len, sizeof(unit->bdaddr));
717 		m_copydata(mrp, 0, len, &unit->bdaddr);
718 
719 		/* Let upper layers know */
720 		ng_hci_node_is_up(unit->node, unit->acl, NULL, 0);
721 		ng_hci_node_is_up(unit->node, unit->sco, NULL, 0);
722 		break;
723 
724 	default:
725 		error = EINVAL;
726 		break;
727 	}
728 
729 	NG_FREE_M(mcp);
730 	NG_FREE_M(mrp);
731 
732 	return (error);
733 } /* process_info_params */
734 
735 /*
736  * Process status command return parameters
737  */
738 
739 static int
740 process_status_params(ng_hci_unit_p unit, u_int16_t ocf, struct mbuf *mcp,
741 		struct mbuf *mrp)
742 {
743 	int	error = 0;
744 
745 	switch (ocf) {
746 	case NG_HCI_OCF_READ_FAILED_CONTACT_CNTR:
747 	case NG_HCI_OCF_RESET_FAILED_CONTACT_CNTR:
748 	case NG_HCI_OCF_GET_LINK_QUALITY:
749 	case NG_HCI_OCF_READ_RSSI:
750 		/* These do not need post processing */
751 		break;
752 
753 	default:
754 		error = EINVAL;
755 		break;
756 	}
757 
758 	NG_FREE_M(mcp);
759 	NG_FREE_M(mrp);
760 
761 	return (error);
762 } /* process_status_params */
763 
764 /*
765  * Process testing command return parameters
766  */
767 
768 int
769 process_testing_params(ng_hci_unit_p unit, u_int16_t ocf, struct mbuf *mcp,
770 		struct mbuf *mrp)
771 {
772 	int	error = 0;
773 
774 	switch (ocf) {
775 
776 	/*
777 	 * XXX FIXME
778 	 * We do not support these features at this time. However,
779 	 * HCI node could support this and do something smart. At least
780 	 * node can change unit state.
781 	 */
782 
783 	case NG_HCI_OCF_READ_LOOPBACK_MODE:
784 	case NG_HCI_OCF_WRITE_LOOPBACK_MODE:
785 	case NG_HCI_OCF_ENABLE_UNIT_UNDER_TEST:
786 		break;
787 
788 	default:
789 		error = EINVAL;
790 		break;
791 	}
792 
793 	NG_FREE_M(mcp);
794 	NG_FREE_M(mrp);
795 
796 	return (error);
797 } /* process_testing_params */
798 
799 /*
800  * Process link control command status
801  */
802 
803 static int
804 process_link_control_status(ng_hci_unit_p unit, ng_hci_command_status_ep *ep,
805 		struct mbuf *mcp)
806 {
807 	int	error = 0;
808 
809 	switch (NG_HCI_OCF(ep->opcode)) {
810 	case NG_HCI_OCF_INQUIRY:
811 	case NG_HCI_OCF_DISCON:		/* XXX */
812 	case NG_HCI_OCF_REJECT_CON:	/* XXX */
813 	case NG_HCI_OCF_CHANGE_CON_PKT_TYPE:
814 	case NG_HCI_OCF_AUTH_REQ:
815 	case NG_HCI_OCF_SET_CON_ENCRYPTION:
816 	case NG_HCI_OCF_CHANGE_CON_LINK_KEY:
817 	case NG_HCI_OCF_MASTER_LINK_KEY:
818 	case NG_HCI_OCF_REMOTE_NAME_REQ:
819 	case NG_HCI_OCF_READ_REMOTE_FEATURES:
820 	case NG_HCI_OCF_READ_REMOTE_VER_INFO:
821 	case NG_HCI_OCF_READ_CLOCK_OFFSET:
822 		/* These do not need post processing */
823 		break;
824 
825 	case NG_HCI_OCF_CREATE_CON:
826 		break;
827 
828 	case NG_HCI_OCF_ADD_SCO_CON:
829 		break;
830 
831 	case NG_HCI_OCF_ACCEPT_CON:
832 		break;
833 
834 	case NG_HCI_OCF_INQUIRY_CANCEL:
835 	case NG_HCI_OCF_PERIODIC_INQUIRY:
836 	case NG_HCI_OCF_EXIT_PERIODIC_INQUIRY:
837 	case NG_HCI_OCF_LINK_KEY_REP:
838 	case NG_HCI_OCF_LINK_KEY_NEG_REP:
839 	case NG_HCI_OCF_PIN_CODE_REP:
840 	case NG_HCI_OCF_PIN_CODE_NEG_REP:
841 	default:
842 
843 		/*
844 		 * None of these command was supposed to generate
845 		 * Command_Status event. Instead Command_Complete event
846 		 * should have been sent.
847 		 */
848 
849 		error = EINVAL;
850 		break;
851 	}
852 
853 	NG_FREE_M(mcp);
854 
855 	return (error);
856 } /* process_link_control_status */
857 
858 /*
859  * Process link policy command status
860  */
861 
862 static int
863 process_link_policy_status(ng_hci_unit_p unit, ng_hci_command_status_ep *ep,
864 		struct mbuf *mcp)
865 {
866 	int	error = 0;
867 
868 	switch (NG_HCI_OCF(ep->opcode)) {
869 	case NG_HCI_OCF_HOLD_MODE:
870 	case NG_HCI_OCF_SNIFF_MODE:
871 	case NG_HCI_OCF_EXIT_SNIFF_MODE:
872 	case NG_HCI_OCF_PARK_MODE:
873 	case NG_HCI_OCF_EXIT_PARK_MODE:
874 	case NG_HCI_OCF_SWITCH_ROLE:
875 		/* These do not need post processing */
876 		break;
877 
878 	case NG_HCI_OCF_QOS_SETUP:
879 		break;
880 
881 	case NG_HCI_OCF_ROLE_DISCOVERY:
882 	case NG_HCI_OCF_READ_LINK_POLICY_SETTINGS:
883 	case NG_HCI_OCF_WRITE_LINK_POLICY_SETTINGS:
884 	default:
885 
886 		/*
887 		 * None of these command was supposed to generate
888 		 * Command_Status event. Instead Command_Complete event
889 		 * should have been sent.
890 		 */
891 
892 		error = EINVAL;
893 		break;
894 	}
895 
896 	NG_FREE_M(mcp);
897 
898 	return (error);
899 } /* process_link_policy_status */
900 
901