 @@ -1,14 +1,14 @@
-/*	$NetBSD: hci_event.c,v 1.22 2010/11/22 19:56:51 plunky Exp $	*/
+/*	$NetBSD: hci_event.c,v 1.23 2011/07/27 10:25:09 plunky Exp $	*/
 /*-
  * Copyright (c) 2005 Iain Hibbert.
  * Copyright (c) 2006 Itronix Inc.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,27 +21,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: hci_event.c,v 1.22 2010/11/22 19:56:51 plunky Exp $");
+__KERNEL_RCSID(0, "$NetBSD: hci_event.c,v 1.23 2011/07/27 10:25:09 plunky Exp $");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
 #include <netbt/bluetooth.h>
 #include <netbt/hci.h>
 #include <netbt/sco.h>
 static void hci_event_inquiry_result(struct hci_unit *, struct mbuf *);
 @@ -147,41 +147,44 @@ hci_eventstr(unsigned int event)
 	case HCI_EVENT_VENDOR:		/* 0xff */
 		return "VENDOR";
+	}
 	return "UNKNOWN";
+}
 #endif	/* BLUETOOTH_DEBUG */
 /*
  * process HCI Events
+ *
  * We will free the mbuf at the end, no need for any sub
- * functions to handle that. We kind of assume that the
+ * functions to handle that.
  * device sends us valid events.
  */
 void
 hci_event(struct mbuf *m, struct hci_unit *unit)
+{
 	hci_event_hdr_t hdr;
 	KASSERT(m->m_flags & M_PKTHDR);
-	KASSERT(m->m_pkthdr.len >= sizeof(hdr));
+	if (m->m_pkthdr.len < sizeof(hdr))
 		goto done;
 	m_copydata(m, 0, sizeof(hdr), &hdr);
 	m_adj(m, sizeof(hdr));
 	KASSERT(hdr.type == HCI_EVENT_PKT);
 	if (m->m_pkthdr.len != hdr.length)
 		goto done;
 	DPRINTFN(1, "(%s) event %s\n",
 	    device_xname(unit->hci_dev), hci_eventstr(hdr.event));
 	switch(hdr.event) {
 	case HCI_EVENT_COMMAND_STATUS:
 		hci_event_command_status(unit, m);
 		break;
 	case HCI_EVENT_COMMAND_COMPL:
 		hci_event_command_compl(unit, m);
 		break;
 @@ -223,40 +226,43 @@ hci_event(struct mbuf *m, struct hci_uni
 	case HCI_EVENT_CHANGE_CON_LINK_KEY_COMPL:
 		hci_event_change_con_link_key_compl(unit, m);
 		break;
 	case HCI_EVENT_READ_CLOCK_OFFSET_COMPL:
 		hci_event_read_clock_offset_compl(unit, m);
 		break;
 	default:
 		break;
+	}
 done:
 	m_freem(m);
+}
 /*
  * Command Status
+ *
  * Restart command queue and post-process any pending commands
  */
 static void
 hci_event_command_status(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_command_status_ep ep;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	ep.opcode = le16toh(ep.opcode);
 	DPRINTFN(1, "(%s) opcode (%03x|%04x) status = 0x%x num_cmd_pkts = %d\n",
 		device_xname(unit->hci_dev),
 		HCI_OGF(ep.opcode), HCI_OCF(ep.opcode),
 		ep.status,
 		ep.num_cmd_pkts);
 	hci_num_cmds(unit, ep.num_cmd_pkts);
 @@ -282,27 +288,29 @@ hci_event_command_status(struct hci_unit
+}
 /*
  * Command Complete
+ *
  * Restart command queue and handle the completed command
  */
 static void
 hci_event_command_compl(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_command_compl_ep ep;
 	hci_status_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	DPRINTFN(1, "(%s) opcode (%03x|%04x) num_cmd_pkts = %d\n",
 		device_xname(unit->hci_dev),
 		HCI_OGF(le16toh(ep.opcode)), HCI_OCF(le16toh(ep.opcode)),
 		ep.num_cmd_pkts);
 	hci_num_cmds(unit, ep.num_cmd_pkts);
 	/*
 	 * I am not sure if this is completely correct, it is not guaranteed
 	 * that a command_complete packet will contain the status though most
 @@ -359,27 +367,29 @@ hci_event_command_compl(struct hci_unit
  * buffers are now freed up and which handle was using them. From
  * this we determine which type of buffer it was and add the qty
  * back into the relevant packet counter, then restart output on
  * links that have halted.
  */
 static void
 hci_event_num_compl_pkts(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_num_compl_pkts_ep ep;
 	struct hci_link *link, *next;
 	uint16_t handle, num;
 	int num_acl = 0, num_sco = 0;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	while (ep.num_con_handles--) {
 		m_copydata(m, 0, sizeof(handle), &handle);
 		m_adj(m, sizeof(handle));
 		handle = le16toh(handle);
 		m_copydata(m, 0, sizeof(num), &num);
 		m_adj(m, sizeof(num));
 		num = le16toh(num);
 		link = hci_link_lookup_handle(unit, handle);
 @@ -429,35 +439,39 @@ hci_event_num_compl_pkts(struct hci_unit
 /*
  * Inquiry Result
+ *
  * keep a note of devices seen, so we know which unit to use
  * on outgoing connections
  */
 static void
 hci_event_inquiry_result(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_inquiry_result_ep ep;
 	hci_inquiry_response ir;
 	struct hci_memo *memo;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	DPRINTFN(1, "%d response%s\n", ep.num_responses,
 				(ep.num_responses == 1 ? "" : "s"));
 	while(ep.num_responses--) {
-		KASSERT(m->m_pkthdr.len >= sizeof(ir));
+		if (m->m_pkthdr.len < sizeof(ir))
 			return;
 		m_copydata(m, 0, sizeof(ir), &ir);
 		m_adj(m, sizeof(ir));
 		DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
 			ir.bdaddr.b[5], ir.bdaddr.b[4], ir.bdaddr.b[3],
 			ir.bdaddr.b[2], ir.bdaddr.b[1], ir.bdaddr.b[0]);
 		memo = hci_memo_new(unit, &ir.bdaddr);
 		if (memo != NULL) {
 			memo->page_scan_rep_mode = ir.page_scan_rep_mode;
 			memo->page_scan_mode = ir.page_scan_mode;
 			memo->clock_offset = ir.clock_offset;
+		}
 @@ -466,35 +480,39 @@ hci_event_inquiry_result(struct hci_unit
 /*
  * Inquiry Result with RSSI
+ *
  * as above but different packet when RSSI result is enabled
  */
 static void
 hci_event_rssi_result(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_rssi_result_ep ep;
 	hci_rssi_response rr;
 	struct hci_memo *memo;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	DPRINTFN(1, "%d response%s\n", ep.num_responses,
 				(ep.num_responses == 1 ? "" : "s"));
 	while(ep.num_responses--) {
-		KASSERT(m->m_pkthdr.len >= sizeof(rr));
+		if (m->m_pkthdr.len < sizeof(rr))
 			return;
 		m_copydata(m, 0, sizeof(rr), &rr);
 		m_adj(m, sizeof(rr));
 		DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
 			rr.bdaddr.b[5], rr.bdaddr.b[4], rr.bdaddr.b[3],
 			rr.bdaddr.b[2], rr.bdaddr.b[1], rr.bdaddr.b[0]);
 		memo = hci_memo_new(unit, &rr.bdaddr);
 		if (memo != NULL) {
 			memo->page_scan_rep_mode = rr.page_scan_rep_mode;
 			memo->page_scan_mode = 0;
 			memo->clock_offset = rr.clock_offset;
+		}
 @@ -502,27 +520,29 @@ hci_event_rssi_result(struct hci_unit *u
+}
 /*
  * Extended Inquiry Result
+ *
  * as above but provides only one response and extended service info
  */
 static void
 hci_event_extended_result(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_extended_result_ep ep;
 	struct hci_memo *memo;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	if (ep.num_responses != 1)
 		return;
 	DPRINTFN(1, "bdaddr %02x:%02x:%02x:%02x:%02x:%02x\n",
 		ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
 		ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0]);
 	memo = hci_memo_new(unit, &ep.bdaddr);
 	if (memo != NULL) {
 		memo->page_scan_rep_mode = ep.page_scan_rep_mode;
 @@ -536,27 +556,29 @@ hci_event_extended_result(struct hci_uni
+ *
  * Sent to us when a connection is made. If there is no link
  * structure already allocated for this, we must have changed
  * our mind, so just disconnect.
  */
 static void
 hci_event_con_compl(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_con_compl_ep ep;
 	hci_write_link_policy_settings_cp cp;
 	struct hci_link *link;
 	int err;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	DPRINTFN(1, "(%s) %s connection complete for "
 		"%02x:%02x:%02x:%02x:%02x:%02x status %#x\n",
 		device_xname(unit->hci_dev),
 		(ep.link_type == HCI_LINK_ACL ? "ACL" : "SCO"),
 		ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
 		ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0],
 		ep.status);
 	link = hci_link_lookup_bdaddr(unit, &ep.bdaddr, ep.link_type);
 @@ -631,54 +653,58 @@ hci_event_con_compl(struct hci_unit *uni
 /*
  * Disconnection Complete
+ *
  * This is sent in response to a disconnection request, but also if
  * the remote device goes out of range.
  */
 static void
 hci_event_discon_compl(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_discon_compl_ep ep;
 	struct hci_link *link;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	ep.con_handle = le16toh(ep.con_handle);
 	DPRINTFN(1, "handle #%d, status=0x%x\n", ep.con_handle, ep.status);
 	link = hci_link_lookup_handle(unit, HCI_CON_HANDLE(ep.con_handle));
 	if (link)
 		hci_link_free(link, ENOLINK);
+}
 /*
  * Connect Request
+ *
  * We check upstream for appropriate listeners and accept connections
  * that are wanted.
  */
 static void
 hci_event_con_req(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_con_req_ep ep;
 	hci_accept_con_cp ap;
 	hci_reject_con_cp rp;
 	struct hci_link *link;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	DPRINTFN(1, "bdaddr %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
 		"class %2.2x%2.2x%2.2x type %s\n",
 		ep.bdaddr.b[5], ep.bdaddr.b[4], ep.bdaddr.b[3],
 		ep.bdaddr.b[2], ep.bdaddr.b[1], ep.bdaddr.b[0],
 		ep.uclass[0], ep.uclass[1], ep.uclass[2],
 		ep.link_type == HCI_LINK_ACL ? "ACL" : "SCO");
 	if (ep.link_type == HCI_LINK_ACL)
 		link = hci_acl_newconn(unit, &ep.bdaddr);
 	else
 @@ -705,27 +731,29 @@ hci_event_con_req(struct hci_unit *unit,
 /*
  * Auth Complete
+ *
  * Authentication has been completed on an ACL link. We can notify the
  * upper layer protocols unless further mode changes are pending.
  */
 static void
 hci_event_auth_compl(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_auth_compl_ep ep;
 	struct hci_link *link;
 	int err;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	ep.con_handle = HCI_CON_HANDLE(le16toh(ep.con_handle));
 	DPRINTFN(1, "handle #%d, status=0x%x\n", ep.con_handle, ep.status);
 	link = hci_link_lookup_handle(unit, ep.con_handle);
 	if (link == NULL || link->hl_type != HCI_LINK_ACL)
 		return;
 	if (ep.status == 0) {
 		link->hl_flags |= HCI_LINK_AUTH;
 @@ -747,27 +775,29 @@ hci_event_auth_compl(struct hci_unit *un
  * The encryption status has changed. Basically, we note the change
  * then notify the upper layer protocol unless further mode changes
  * are pending.
  * Note that if encryption gets disabled when it has been requested,
  * we will attempt to enable it again.. (its a feature not a bug :)
  */
 static void
 hci_event_encryption_change(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_encryption_change_ep ep;
 	struct hci_link *link;
 	int err;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	ep.con_handle = HCI_CON_HANDLE(le16toh(ep.con_handle));
 	DPRINTFN(1, "handle #%d, status=0x%x, encryption_enable=0x%x\n",
 		 ep.con_handle, ep.status, ep.encryption_enable);
 	link = hci_link_lookup_handle(unit, ep.con_handle);
 	if (link == NULL || link->hl_type != HCI_LINK_ACL)
 		return;
 	if (ep.status == 0) {
 @@ -791,27 +821,29 @@ hci_event_encryption_change(struct hci_u
  * Change Connection Link Key Complete
+ *
  * Link keys are handled in userland but if we are waiting to secure
  * this link, we should notify the upper protocols. A SECURE request
  * only needs a single key change, so we can cancel the request.
  */
 static void
 hci_event_change_con_link_key_compl(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_change_con_link_key_compl_ep ep;
 	struct hci_link *link;
 	int err;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	ep.con_handle = HCI_CON_HANDLE(le16toh(ep.con_handle));
 	DPRINTFN(1, "handle #%d, status=0x%x\n", ep.con_handle, ep.status);
 	link = hci_link_lookup_handle(unit, ep.con_handle);
 	if (link == NULL || link->hl_type != HCI_LINK_ACL)
 		return;
 	link->hl_flags &= ~HCI_LINK_SECURE_REQ;
 @@ -831,76 +863,82 @@ hci_event_change_con_link_key_compl(stru
 /*
  * Read Clock Offset Complete
+ *
  * We keep a note of the clock offset of remote devices when a
  * link is made, in order to facilitate reconnections to the device
  */
 static void
 hci_event_read_clock_offset_compl(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_clock_offset_compl_ep ep;
 	struct hci_link *link;
-	KASSERT(m->m_pkthdr.len >= sizeof(ep));
+	if (m->m_pkthdr.len < sizeof(ep))
 		return;
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 	DPRINTFN(1, "handle #%d, offset=%u, status=0x%x\n",
 		le16toh(ep.con_handle), le16toh(ep.clock_offset), ep.status);
 	ep.con_handle = HCI_CON_HANDLE(le16toh(ep.con_handle));
 	link = hci_link_lookup_handle(unit, ep.con_handle);
 	if (link == NULL || link->hl_type != HCI_LINK_ACL)
 		return;
 	if (ep.status == 0)
 		link->hl_clock = ep.clock_offset;
+}
 /*
  * process results of read_bdaddr command_complete event
  */
 static void
 hci_cmd_read_bdaddr(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_bdaddr_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status > 0)
 		return;
 	if ((unit->hci_flags & BTF_INIT_BDADDR) == 0)
 		return;
 	bdaddr_copy(&unit->hci_bdaddr, &rp.bdaddr);
 	unit->hci_flags &= ~BTF_INIT_BDADDR;
 	cv_broadcast(&unit->hci_init);
+}
 /*
  * process results of read_buffer_size command_complete event
  */
 static void
 hci_cmd_read_buffer_size(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_buffer_size_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status > 0)
 		return;
 	if ((unit->hci_flags & BTF_INIT_BUFFER_SIZE) == 0)
 		return;
 	unit->hci_max_acl_size = le16toh(rp.max_acl_size);
 	unit->hci_num_acl_pkts = le16toh(rp.num_acl_pkts);
 	unit->hci_max_acl_pkts = le16toh(rp.num_acl_pkts);
 	unit->hci_max_sco_size = rp.max_sco_size;
 @@ -910,27 +948,29 @@ hci_cmd_read_buffer_size(struct hci_unit
 	unit->hci_flags &= ~BTF_INIT_BUFFER_SIZE;
 	cv_broadcast(&unit->hci_init);
+}
 /*
  * process results of read_local_features command_complete event
  */
 static void
 hci_cmd_read_local_features(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_local_features_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status > 0)
 		return;
 	if ((unit->hci_flags & BTF_INIT_FEATURES) == 0)
 		return;
 	memcpy(unit->hci_feat0, rp.features, HCI_FEATURES_SIZE);
 	unit->hci_lmp_mask = 0;
 @@ -1019,27 +1059,29 @@ hci_cmd_read_local_features(struct hci_u
 	unit->hci_flags &= ~BTF_INIT_FEATURES;
 	cv_broadcast(&unit->hci_init);
+}
 /*
  * process results of read_local_extended_features command_complete event
  */
 static void
 hci_cmd_read_local_extended_features(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_local_extended_features_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status > 0)
 		return;
 	if ((unit->hci_flags & BTF_INIT_FEATURES) == 0)
 		return;
 	DPRINTFN(1, "%s: page %d of %d\n", device_xname(unit->hci_dev),
 	    rp.page, rp.max_page);
 	switch (rp.page) {
 @@ -1066,54 +1108,58 @@ hci_cmd_read_local_extended_features(str
 	cv_broadcast(&unit->hci_init);
+}
 /*
  * process results of read_local_ver command_complete event
+ *
  * reading local supported commands is only supported from 1.2 spec
  */
 static void
 hci_cmd_read_local_ver(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_local_ver_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status != 0)
 		return;
 	if ((unit->hci_flags & BTF_INIT_COMMANDS) == 0)
 		return;
 	if (rp.hci_version < HCI_SPEC_V12) {
 		unit->hci_flags &= ~BTF_INIT_COMMANDS;
 		cv_broadcast(&unit->hci_init);
 		return;
+	}
 	hci_send_cmd(unit, HCI_CMD_READ_LOCAL_COMMANDS, NULL, 0);
+}
 /*
  * process results of read_local_commands command_complete event
  */
 static void
 hci_cmd_read_local_commands(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_read_local_commands_rp rp;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status != 0)
 		return;
 	if ((unit->hci_flags & BTF_INIT_COMMANDS) == 0)
 		return;
 	unit->hci_flags &= ~BTF_INIT_COMMANDS;
 	memcpy(unit->hci_cmds, rp.commands, HCI_COMMANDS_SIZE);
 	cv_broadcast(&unit->hci_init);
 @@ -1122,27 +1168,29 @@ hci_cmd_read_local_commands(struct hci_u
 /*
  * process results of reset command_complete event
+ *
  * This has killed all the connections, so close down anything we have left,
  * and reinitialise the unit.
  */
 static void
 hci_cmd_reset(struct hci_unit *unit, struct mbuf *m)
+{
 	hci_reset_rp rp;
 	struct hci_link *link, *next;
 	int acl;
-	KASSERT(m->m_pkthdr.len >= sizeof(rp));
+	if (m->m_pkthdr.len < sizeof(rp))
 		return;
 	m_copydata(m, 0, sizeof(rp), &rp);
 	m_adj(m, sizeof(rp));
 	if (rp.status != 0)
 		return;
 	/*
 	 * release SCO links first, since they may be holding
 	 * an ACL link reference.
 	 */
 	for (acl = 0 ; acl < 2 ; acl++) {
 		next = TAILQ_FIRST(&unit->hci_links);
 		while ((link = next) != NULL) {

 @@ -1,14 +1,14 @@
-/*	$NetBSD: hci_link.c,v 1.22 2010/10/14 07:05:03 plunky Exp $	*/
+/*	$NetBSD: hci_link.c,v 1.23 2011/07/27 10:25:09 plunky Exp $	*/
 /*-
  * Copyright (c) 2005 Iain Hibbert.
  * Copyright (c) 2006 Itronix Inc.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,27 +21,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: hci_link.c,v 1.22 2010/10/14 07:05:03 plunky Exp $");
+__KERNEL_RCSID(0, "$NetBSD: hci_link.c,v 1.23 2011/07/27 10:25:09 plunky Exp $");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>
 #include <sys/queue.h>
 #include <sys/systm.h>
 #include <netbt/bluetooth.h>
 #include <netbt/hci.h>
 #include <netbt/l2cap.h>
 #include <netbt/sco.h>
 @@ -422,49 +422,42 @@ hci_acl_linkmode(struct hci_link *link)
  * until a full L2CAP frame is ready, then send it on.
  */
 void
 hci_acl_recv(struct mbuf *m, struct hci_unit *unit)
+{
 	struct hci_link *link;
 	hci_acldata_hdr_t hdr;
 	uint16_t handle, want;
 	int pb, got;
 	KASSERT(m != NULL);
 	KASSERT(unit != NULL);
-	KASSERT(m->m_pkthdr.len >= sizeof(hdr));
+	if (m->m_pkthdr.len < sizeof(hdr))
 		goto bad;
 	m_copydata(m, 0, sizeof(hdr), &hdr);
 	m_adj(m, sizeof(hdr));
-#ifdef DIAGNOSTIC
+	KASSERT(hdr.type == HCI_ACL_DATA_PKT);
 	if (hdr.type != HCI_ACL_DATA_PKT) {
 		aprint_error_dev(unit->hci_dev, "bad ACL packet type\n");
 		goto bad;
 	if (m->m_pkthdr.len != le16toh(hdr.length)) {
 		aprint_error_dev(unit->hci_dev,
 		    "bad ACL packet length (%d != %d)\n",
 		    m->m_pkthdr.len, le16toh(hdr.length));
 		goto bad;
 #endif
 	hdr.length = le16toh(hdr.length);
 	hdr.con_handle = le16toh(hdr.con_handle);
 	handle = HCI_CON_HANDLE(hdr.con_handle);
 	pb = HCI_PB_FLAG(hdr.con_handle);
 	if (m->m_pkthdr.len != hdr.length)
 		goto bad;
 	link = hci_link_lookup_handle(unit, handle);
 	if (link == NULL) {
 		hci_discon_cp cp;
 		DPRINTF("%s: dumping packet for unknown handle #%d\n",
 			device_xname(unit->hci_dev), handle);
 		/*
 		 * There is no way to find out what this connection handle is
 		 * for, just get rid of it. This may happen, if a USB dongle
 		 * is plugged into a self powered hub and does not reset when
 		 * the system is shut down.
+		 *
 @@ -476,51 +469,51 @@ hci_acl_recv(struct mbuf *m, struct hci_
 			cp.con_handle = htole16(handle);
 			cp.reason = 0x13;/*"Remote User Terminated Connection"*/
 			hci_send_cmd(unit, HCI_CMD_DISCONNECT, &cp, sizeof(cp));
+		}
 		goto bad;
+	}
 	switch (pb) {
 	case HCI_PACKET_START:
 		if (link->hl_rxp != NULL)
 			aprint_error_dev(unit->hci_dev,
 			    "dropped incomplete ACL packet\n");
-		if (m->m_pkthdr.len < sizeof(l2cap_hdr_t)) {
+		if (m->m_pkthdr.len < sizeof(l2cap_hdr_t))
 			aprint_error_dev(unit->hci_dev, "short ACL packet\n");
 			goto bad;
 		link->hl_rxp = m;
 		got = m->m_pkthdr.len;
 		break;
 	case HCI_PACKET_FRAGMENT:
 		if (link->hl_rxp == NULL) {
 			aprint_error_dev(unit->hci_dev,
 			    "unexpected packet fragment\n");
 			goto bad;
+		}
 		got = m->m_pkthdr.len + link->hl_rxp->m_pkthdr.len;
 		m_cat(link->hl_rxp, m);
 		m = link->hl_rxp;
 		m->m_pkthdr.len = got;
 		break;
 	default:
-		aprint_error_dev(unit->hci_dev, "unknown packet type\n");
+		DPRINTF("%s: unknown packet type\n",
 		    device_xname(unit->hci_dev));
 		goto bad;
+	}
 	m_copydata(m, 0, sizeof(want), &want);
 	want = le16toh(want) + sizeof(l2cap_hdr_t) - got;
 	if (want > 0)
 		return;
 	link->hl_rxp = NULL;
 	if (want == 0) {
 		l2cap_recv_frame(m, link);
 @@ -827,48 +820,40 @@ hci_sco_newconn(struct hci_unit *unit, b
  * receive SCO packet, we only need to strip the header and send
  * it to the right handler
  */
 void
 hci_sco_recv(struct mbuf *m, struct hci_unit *unit)
+{
 	struct hci_link *link;
 	hci_scodata_hdr_t hdr;
 	uint16_t handle;
 	KASSERT(m != NULL);
 	KASSERT(unit != NULL);
-	KASSERT(m->m_pkthdr.len >= sizeof(hdr));
+	if (m->m_pkthdr.len < sizeof(hdr))
 	m_copydata(m, 0, sizeof(hdr), &hdr);
 	m_adj(m, sizeof(hdr));
 #ifdef DIAGNOSTIC
 	if (hdr.type != HCI_SCO_DATA_PKT) {
 		aprint_error_dev(unit->hci_dev, "bad SCO packet type\n");
 		goto bad;
-	if (m->m_pkthdr.len != hdr.length) {
+	m_copydata(m, 0, sizeof(hdr), &hdr);
-		aprint_error_dev(unit->hci_dev,
+	m_adj(m, sizeof(hdr));
 		    "bad SCO packet length (%d != %d)\n",
 		    m->m_pkthdr.len, hdr.length);
-		goto bad;
+	KASSERT(hdr.type == HCI_SCO_DATA_PKT);
 #endif
 	hdr.con_handle = le16toh(hdr.con_handle);
 	handle = HCI_CON_HANDLE(hdr.con_handle);
 	if (m->m_pkthdr.len != hdr.length)
 		goto bad;
 	link = hci_link_lookup_handle(unit, handle);
 	if (link == NULL || link->hl_type == HCI_LINK_ACL) {
 		DPRINTF("%s: dumping packet for unknown handle #%d\n",
 			device_xname(unit->hci_dev), handle);
 		goto bad;
+	}
 	(*link->hl_sco->sp_proto->input)(link->hl_sco->sp_upper, m);
 	return;
 bad:
 	m_freem(m);