xref: /netbsd-src/sys/dev/bluetooth/bthidev.c (revision 5bbd2a12505d72a8177929a37b5cee489d0a1cfd)
1 /*	$NetBSD: bthidev.c,v 1.22 2012/04/03 09:32:53 plunky Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006 Itronix Inc.
5  * All rights reserved.
6  *
7  * Written by Iain Hibbert for Itronix Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of Itronix Inc. may not be used to endorse
18  *    or promote products derived from this software without specific
19  *    prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28  * ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: bthidev.c,v 1.22 2012/04/03 09:32:53 plunky Exp $");
36 
37 #include <sys/param.h>
38 #include <sys/condvar.h>
39 #include <sys/conf.h>
40 #include <sys/device.h>
41 #include <sys/fcntl.h>
42 #include <sys/kernel.h>
43 #include <sys/kthread.h>
44 #include <sys/queue.h>
45 #include <sys/malloc.h>
46 #include <sys/mbuf.h>
47 #include <sys/mutex.h>
48 #include <sys/proc.h>
49 #include <sys/socketvar.h>
50 #include <sys/systm.h>
51 
52 #include <prop/proplib.h>
53 
54 #include <netbt/bluetooth.h>
55 #include <netbt/l2cap.h>
56 
57 #include <dev/usb/hid.h>
58 #include <dev/bluetooth/btdev.h>
59 #include <dev/bluetooth/bthid.h>
60 #include <dev/bluetooth/bthidev.h>
61 
62 #include "locators.h"
63 
64 /*****************************************************************************
65  *
66  *	Bluetooth HID device
67  */
68 
69 #define MAX_DESCRIPTOR_LEN	1024		/* sanity check */
70 
71 /* bthidev softc */
72 struct bthidev_softc {
73 	uint16_t		sc_state;
74 	uint16_t		sc_flags;
75 	device_t		sc_dev;
76 
77 	bdaddr_t		sc_laddr;	/* local address */
78 	bdaddr_t		sc_raddr;	/* remote address */
79 	struct sockopt		sc_mode;	/* link mode sockopt */
80 
81 	uint16_t		sc_ctlpsm;	/* control PSM */
82 	struct l2cap_channel	*sc_ctl;	/* control channel */
83 	struct l2cap_channel	*sc_ctl_l;	/* control listen */
84 
85 	uint16_t		sc_intpsm;	/* interrupt PSM */
86 	struct l2cap_channel	*sc_int;	/* interrupt channel */
87 	struct l2cap_channel	*sc_int_l;	/* interrupt listen */
88 
89 	MBUFQ_HEAD()		sc_inq;		/* input queue */
90 	kmutex_t		sc_lock;	/* input queue lock */
91 	kcondvar_t		sc_cv;		/* input queue trigger */
92 	lwp_t			*sc_lwp;	/* input queue processor */
93 	int			sc_detach;
94 
95 	LIST_HEAD(,bthidev)	sc_list;	/* child list */
96 
97 	callout_t		sc_reconnect;
98 	int			sc_attempts;	/* connection attempts */
99 };
100 
101 /* sc_flags */
102 #define BTHID_RECONNECT		(1 << 0)	/* reconnect on link loss */
103 #define BTHID_CONNECTING	(1 << 1)	/* we are connecting */
104 
105 /* device state */
106 #define BTHID_CLOSED		0
107 #define BTHID_WAIT_CTL		1
108 #define BTHID_WAIT_INT		2
109 #define BTHID_OPEN		3
110 
111 #define	BTHID_RETRY_INTERVAL	5	/* seconds between connection attempts */
112 
113 /* bthidev internals */
114 static void bthidev_timeout(void *);
115 static int  bthidev_listen(struct bthidev_softc *);
116 static int  bthidev_connect(struct bthidev_softc *);
117 static int  bthidev_output(struct bthidev *, uint8_t *, int);
118 static void bthidev_null(struct bthidev *, uint8_t *, int);
119 static void bthidev_process(void *);
120 static void bthidev_process_one(struct bthidev_softc *, struct mbuf *);
121 
122 /* autoconf(9) glue */
123 static int  bthidev_match(device_t, cfdata_t, void *);
124 static void bthidev_attach(device_t, device_t, void *);
125 static int  bthidev_detach(device_t, int);
126 static int  bthidev_print(void *, const char *);
127 
128 CFATTACH_DECL_NEW(bthidev, sizeof(struct bthidev_softc),
129     bthidev_match, bthidev_attach, bthidev_detach, NULL);
130 
131 /* bluetooth(9) protocol methods for L2CAP */
132 static void  bthidev_connecting(void *);
133 static void  bthidev_ctl_connected(void *);
134 static void  bthidev_int_connected(void *);
135 static void  bthidev_ctl_disconnected(void *, int);
136 static void  bthidev_int_disconnected(void *, int);
137 static void *bthidev_ctl_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
138 static void *bthidev_int_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
139 static void  bthidev_complete(void *, int);
140 static void  bthidev_linkmode(void *, int);
141 static void  bthidev_input(void *, struct mbuf *);
142 
143 static const struct btproto bthidev_ctl_proto = {
144 	bthidev_connecting,
145 	bthidev_ctl_connected,
146 	bthidev_ctl_disconnected,
147 	bthidev_ctl_newconn,
148 	bthidev_complete,
149 	bthidev_linkmode,
150 	bthidev_input,
151 };
152 
153 static const struct btproto bthidev_int_proto = {
154 	bthidev_connecting,
155 	bthidev_int_connected,
156 	bthidev_int_disconnected,
157 	bthidev_int_newconn,
158 	bthidev_complete,
159 	bthidev_linkmode,
160 	bthidev_input,
161 };
162 
163 /*****************************************************************************
164  *
165  *	bthidev autoconf(9) routines
166  */
167 
168 static int
169 bthidev_match(device_t self, cfdata_t cfdata, void *aux)
170 {
171 	prop_dictionary_t dict = aux;
172 	prop_object_t obj;
173 
174 	obj = prop_dictionary_get(dict, BTDEVservice);
175 	if (prop_string_equals_cstring(obj, "HID"))
176 		return 1;
177 
178 	return 0;
179 }
180 
181 static void
182 bthidev_attach(device_t parent, device_t self, void *aux)
183 {
184 	struct bthidev_softc *sc = device_private(self);
185 	prop_dictionary_t dict = aux;
186 	prop_object_t obj;
187 	device_t dev;
188 	struct bthidev_attach_args bha;
189 	struct bthidev *hidev;
190 	struct hid_data *d;
191 	struct hid_item h;
192 	const void *desc;
193 	int locs[BTHIDBUSCF_NLOCS];
194 	int maxid, rep, dlen;
195 	int vendor, product;
196 
197 	/*
198 	 * Init softc
199 	 */
200 	sc->sc_dev = self;
201 	LIST_INIT(&sc->sc_list);
202 	MBUFQ_INIT(&sc->sc_inq);
203 	callout_init(&sc->sc_reconnect, 0);
204 	callout_setfunc(&sc->sc_reconnect, bthidev_timeout, sc);
205 	sc->sc_state = BTHID_CLOSED;
206 	sc->sc_flags = BTHID_CONNECTING;
207 	sc->sc_ctlpsm = L2CAP_PSM_HID_CNTL;
208 	sc->sc_intpsm = L2CAP_PSM_HID_INTR;
209 
210 	sockopt_init(&sc->sc_mode, BTPROTO_L2CAP, SO_L2CAP_LM, 0);
211 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NONE);
212 	cv_init(&sc->sc_cv, device_xname(self));
213 
214 	/*
215 	 * extract config from proplist
216 	 */
217 	obj = prop_dictionary_get(dict, BTDEVladdr);
218 	bdaddr_copy(&sc->sc_laddr, prop_data_data_nocopy(obj));
219 
220 	obj = prop_dictionary_get(dict, BTDEVraddr);
221 	bdaddr_copy(&sc->sc_raddr, prop_data_data_nocopy(obj));
222 
223 	obj = prop_dictionary_get(dict, BTDEVvendor);
224 	vendor = (int)prop_number_integer_value(obj);
225 
226 	obj = prop_dictionary_get(dict, BTDEVproduct);
227 	product = (int)prop_number_integer_value(obj);
228 
229 	obj = prop_dictionary_get(dict, BTDEVmode);
230 	if (prop_object_type(obj) == PROP_TYPE_STRING) {
231 		if (prop_string_equals_cstring(obj, BTDEVauth))
232 			sockopt_setint(&sc->sc_mode, L2CAP_LM_AUTH);
233 		else if (prop_string_equals_cstring(obj, BTDEVencrypt))
234 			sockopt_setint(&sc->sc_mode, L2CAP_LM_ENCRYPT);
235 		else if (prop_string_equals_cstring(obj, BTDEVsecure))
236 			sockopt_setint(&sc->sc_mode, L2CAP_LM_SECURE);
237 		else  {
238 			aprint_error(" unknown %s\n", BTDEVmode);
239 			return;
240 		}
241 
242 		aprint_verbose(" %s %s", BTDEVmode,
243 					 prop_string_cstring_nocopy(obj));
244 	}
245 
246 	obj = prop_dictionary_get(dict, BTHIDEVcontrolpsm);
247 	if (prop_object_type(obj) == PROP_TYPE_NUMBER) {
248 		sc->sc_ctlpsm = prop_number_integer_value(obj);
249 		if (L2CAP_PSM_INVALID(sc->sc_ctlpsm)) {
250 			aprint_error(" invalid %s\n", BTHIDEVcontrolpsm);
251 			return;
252 		}
253 	}
254 
255 	obj = prop_dictionary_get(dict, BTHIDEVinterruptpsm);
256 	if (prop_object_type(obj) == PROP_TYPE_NUMBER) {
257 		sc->sc_intpsm = prop_number_integer_value(obj);
258 		if (L2CAP_PSM_INVALID(sc->sc_intpsm)) {
259 			aprint_error(" invalid %s\n", BTHIDEVinterruptpsm);
260 			return;
261 		}
262 	}
263 
264 	obj = prop_dictionary_get(dict, BTHIDEVdescriptor);
265 	if (prop_object_type(obj) == PROP_TYPE_DATA) {
266 		dlen = prop_data_size(obj);
267 		desc = prop_data_data_nocopy(obj);
268 	} else {
269 		aprint_error(" no %s\n", BTHIDEVdescriptor);
270 		return;
271 	}
272 
273 	obj = prop_dictionary_get(dict, BTHIDEVreconnect);
274 	if (prop_object_type(obj) == PROP_TYPE_BOOL
275 	    && !prop_bool_true(obj))
276 		sc->sc_flags |= BTHID_RECONNECT;
277 
278 	/*
279 	 * Parse the descriptor and attach child devices, one per report.
280 	 */
281 	maxid = -1;
282 	h.report_ID = 0;
283 	d = hid_start_parse(desc, dlen, hid_none);
284 	while (hid_get_item(d, &h)) {
285 		if (h.report_ID > maxid)
286 			maxid = h.report_ID;
287 	}
288 	hid_end_parse(d);
289 
290 	if (maxid < 0) {
291 		aprint_error(" no reports found\n");
292 		return;
293 	}
294 
295 	aprint_normal("\n");
296 
297 	if (kthread_create(PRI_NONE, KTHREAD_MUSTJOIN, NULL, bthidev_process,
298 	    sc, &sc->sc_lwp, "%s", device_xname(self)) != 0) {
299 		aprint_error_dev(self, "failed to create input thread\n");
300 		return;
301 	}
302 
303 	for (rep = 0 ; rep <= maxid ; rep++) {
304 		if (hid_report_size(desc, dlen, hid_feature, rep) == 0
305 		    && hid_report_size(desc, dlen, hid_input, rep) == 0
306 		    && hid_report_size(desc, dlen, hid_output, rep) == 0)
307 			continue;
308 
309 		bha.ba_vendor = vendor;
310 		bha.ba_product = product;
311 		bha.ba_desc = desc;
312 		bha.ba_dlen = dlen;
313 		bha.ba_input = bthidev_null;
314 		bha.ba_feature = bthidev_null;
315 		bha.ba_output = bthidev_output;
316 		bha.ba_id = rep;
317 
318 		locs[BTHIDBUSCF_REPORTID] = rep;
319 
320 		dev = config_found_sm_loc(self, "bthidbus",
321 					locs, &bha, bthidev_print, config_stdsubmatch);
322 		if (dev != NULL) {
323 			hidev = device_private(dev);
324 			hidev->sc_dev = dev;
325 			hidev->sc_parent = self;
326 			hidev->sc_id = rep;
327 			hidev->sc_input = bha.ba_input;
328 			hidev->sc_feature = bha.ba_feature;
329 			LIST_INSERT_HEAD(&sc->sc_list, hidev, sc_next);
330 		}
331 	}
332 
333 	pmf_device_register(self, NULL, NULL);
334 
335 	/*
336 	 * start bluetooth connections
337 	 */
338 	mutex_enter(bt_lock);
339 	if ((sc->sc_flags & BTHID_RECONNECT) == 0)
340 		bthidev_listen(sc);
341 
342 	if (sc->sc_flags & BTHID_CONNECTING)
343 		bthidev_connect(sc);
344 	mutex_exit(bt_lock);
345 }
346 
347 static int
348 bthidev_detach(device_t self, int flags)
349 {
350 	struct bthidev_softc *sc = device_private(self);
351 	struct bthidev *hidev;
352 
353 	mutex_enter(bt_lock);
354 	sc->sc_flags = 0;	/* disable reconnecting */
355 
356 	/* release interrupt listen */
357 	if (sc->sc_int_l != NULL) {
358 		l2cap_detach(&sc->sc_int_l);
359 		sc->sc_int_l = NULL;
360 	}
361 
362 	/* release control listen */
363 	if (sc->sc_ctl_l != NULL) {
364 		l2cap_detach(&sc->sc_ctl_l);
365 		sc->sc_ctl_l = NULL;
366 	}
367 
368 	/* close interrupt channel */
369 	if (sc->sc_int != NULL) {
370 		l2cap_disconnect(sc->sc_int, 0);
371 		l2cap_detach(&sc->sc_int);
372 		sc->sc_int = NULL;
373 	}
374 
375 	/* close control channel */
376 	if (sc->sc_ctl != NULL) {
377 		l2cap_disconnect(sc->sc_ctl, 0);
378 		l2cap_detach(&sc->sc_ctl);
379 		sc->sc_ctl = NULL;
380 	}
381 
382 	callout_halt(&sc->sc_reconnect, bt_lock);
383 	callout_destroy(&sc->sc_reconnect);
384 
385 	mutex_exit(bt_lock);
386 
387 	pmf_device_deregister(self);
388 
389 	/* kill off the input processor */
390 	if (sc->sc_lwp != NULL) {
391 		mutex_enter(&sc->sc_lock);
392 		sc->sc_detach = 1;
393 		cv_signal(&sc->sc_cv);
394 		mutex_exit(&sc->sc_lock);
395 		kthread_join(sc->sc_lwp);
396 		sc->sc_lwp = NULL;
397 	}
398 
399 	/* detach children */
400 	while ((hidev = LIST_FIRST(&sc->sc_list)) != NULL) {
401 		LIST_REMOVE(hidev, sc_next);
402 		config_detach(hidev->sc_dev, flags);
403 	}
404 
405 	MBUFQ_DRAIN(&sc->sc_inq);
406 	cv_destroy(&sc->sc_cv);
407 	mutex_destroy(&sc->sc_lock);
408 	sockopt_destroy(&sc->sc_mode);
409 
410 	return 0;
411 }
412 
413 /*
414  * bthidev config print
415  */
416 static int
417 bthidev_print(void *aux, const char *pnp)
418 {
419 	struct bthidev_attach_args *ba = aux;
420 
421 	if (pnp != NULL)
422 		aprint_normal("%s:", pnp);
423 
424 	if (ba->ba_id > 0)
425 		aprint_normal(" reportid %d", ba->ba_id);
426 
427 	return UNCONF;
428 }
429 
430 /*****************************************************************************
431  *
432  *	bluetooth(4) HID attach/detach routines
433  */
434 
435 /*
436  * callouts are scheduled after connections have been lost, in order
437  * to clean up and reconnect.
438  */
439 static void
440 bthidev_timeout(void *arg)
441 {
442 	struct bthidev_softc *sc = arg;
443 
444 	mutex_enter(bt_lock);
445 	callout_ack(&sc->sc_reconnect);
446 
447 	switch (sc->sc_state) {
448 	case BTHID_CLOSED:
449 		if (sc->sc_int != NULL) {
450 			l2cap_disconnect(sc->sc_int, 0);
451 			break;
452 		}
453 
454 		if (sc->sc_ctl != NULL) {
455 			l2cap_disconnect(sc->sc_ctl, 0);
456 			break;
457 		}
458 
459 		if (sc->sc_flags & BTHID_RECONNECT) {
460 			sc->sc_flags |= BTHID_CONNECTING;
461 			bthidev_connect(sc);
462 			break;
463 		}
464 
465 		break;
466 
467 	case BTHID_WAIT_CTL:
468 		break;
469 
470 	case BTHID_WAIT_INT:
471 		break;
472 
473 	case BTHID_OPEN:
474 		break;
475 
476 	default:
477 		break;
478 	}
479 	mutex_exit(bt_lock);
480 }
481 
482 /*
483  * listen for our device
484  */
485 static int
486 bthidev_listen(struct bthidev_softc *sc)
487 {
488 	struct sockaddr_bt sa;
489 	int err;
490 
491 	memset(&sa, 0, sizeof(sa));
492 	sa.bt_len = sizeof(sa);
493 	sa.bt_family = AF_BLUETOOTH;
494 	bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
495 
496 	/*
497 	 * Listen on control PSM
498 	 */
499 	err = l2cap_attach(&sc->sc_ctl_l, &bthidev_ctl_proto, sc);
500 	if (err)
501 		return err;
502 
503 	err = l2cap_setopt(sc->sc_ctl_l, &sc->sc_mode);
504 	if (err)
505 		return err;
506 
507 	sa.bt_psm = sc->sc_ctlpsm;
508 	err = l2cap_bind(sc->sc_ctl_l, &sa);
509 	if (err)
510 		return err;
511 
512 	err = l2cap_listen(sc->sc_ctl_l);
513 	if (err)
514 		return err;
515 
516 	/*
517 	 * Listen on interrupt PSM
518 	 */
519 	err = l2cap_attach(&sc->sc_int_l, &bthidev_int_proto, sc);
520 	if (err)
521 		return err;
522 
523 	err = l2cap_setopt(sc->sc_int_l, &sc->sc_mode);
524 	if (err)
525 		return err;
526 
527 	sa.bt_psm = sc->sc_intpsm;
528 	err = l2cap_bind(sc->sc_int_l, &sa);
529 	if (err)
530 		return err;
531 
532 	err = l2cap_listen(sc->sc_int_l);
533 	if (err)
534 		return err;
535 
536 	sc->sc_state = BTHID_WAIT_CTL;
537 	return 0;
538 }
539 
540 /*
541  * start connecting to our device
542  */
543 static int
544 bthidev_connect(struct bthidev_softc *sc)
545 {
546 	struct sockaddr_bt sa;
547 	int err;
548 
549 	if (sc->sc_attempts++ > 0)
550 		aprint_verbose_dev(sc->sc_dev, "connect (#%d)\n", sc->sc_attempts);
551 
552 	memset(&sa, 0, sizeof(sa));
553 	sa.bt_len = sizeof(sa);
554 	sa.bt_family = AF_BLUETOOTH;
555 
556 	err = l2cap_attach(&sc->sc_ctl, &bthidev_ctl_proto, sc);
557 	if (err) {
558 		aprint_error_dev(sc->sc_dev, "l2cap_attach failed (%d)\n", err);
559 		return err;
560 	}
561 
562 	err = l2cap_setopt(sc->sc_ctl, &sc->sc_mode);
563 	if (err)
564 		return err;
565 
566 	bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
567 	err = l2cap_bind(sc->sc_ctl, &sa);
568 	if (err) {
569 		aprint_error_dev(sc->sc_dev, "l2cap_bind failed (%d)\n", err);
570 		return err;
571 	}
572 
573 	sa.bt_psm = sc->sc_ctlpsm;
574 	bdaddr_copy(&sa.bt_bdaddr, &sc->sc_raddr);
575 	err = l2cap_connect(sc->sc_ctl, &sa);
576 	if (err) {
577 		aprint_error_dev(sc->sc_dev, "l2cap_connect failed (%d)\n", err);
578 		return err;
579 	}
580 
581 	sc->sc_state = BTHID_WAIT_CTL;
582 	return 0;
583 }
584 
585 /*
586  * The LWP which processes input reports, forwarding to child devices.
587  * We are always either processing input reports, holding the lock, or
588  * waiting for a signal on condvar.
589  */
590 static void
591 bthidev_process(void *arg)
592 {
593 	struct bthidev_softc *sc = arg;
594 	struct mbuf *m;
595 
596 	mutex_enter(&sc->sc_lock);
597 	while (sc->sc_detach == 0) {
598 		MBUFQ_DEQUEUE(&sc->sc_inq, m);
599 		if (m == NULL) {
600 			cv_wait(&sc->sc_cv, &sc->sc_lock);
601 			continue;
602 		}
603 
604 		mutex_exit(&sc->sc_lock);
605 		bthidev_process_one(sc, m);
606 		m_freem(m);
607 		mutex_enter(&sc->sc_lock);
608 	}
609 	mutex_exit(&sc->sc_lock);
610 	kthread_exit(0);
611 }
612 
613 static void
614 bthidev_process_one(struct bthidev_softc *sc, struct mbuf *m)
615 {
616 	struct bthidev *hidev;
617 	uint8_t *data;
618 	int len;
619 
620 	if (sc->sc_state != BTHID_OPEN)
621 		return;
622 
623 	if (m->m_pkthdr.len > m->m_len)
624 		aprint_error_dev(sc->sc_dev, "truncating HID report\n");
625 
626 	len = m->m_len;
627 	data = mtod(m, uint8_t *);
628 
629 	switch (BTHID_TYPE(data[0])) {
630 	case BTHID_DATA:
631 		/*
632 		 * data[0] == type / parameter
633 		 * data[1] == id
634 		 * data[2..len] == report
635 		 */
636 		if (len < 3)
637 			break;
638 
639 		LIST_FOREACH(hidev, &sc->sc_list, sc_next)
640 			if (data[1] == hidev->sc_id)
641 				break;
642 
643 		if (hidev == NULL) {
644 			aprint_error_dev(sc->sc_dev,
645 			    "report id %d, len = %d ignored\n", data[1], len - 2);
646 
647 			break;
648 		}
649 
650 		switch (BTHID_DATA_PARAM(data[0])) {
651 		case BTHID_DATA_INPUT:
652 			(*hidev->sc_input)(hidev, data + 2, len - 2);
653 			break;
654 
655 		case BTHID_DATA_FEATURE:
656 			(*hidev->sc_feature)(hidev, data + 2, len - 2);
657 			break;
658 
659 		default:
660 			break;
661 		}
662 
663 		break;
664 
665 	case BTHID_CONTROL:
666 		if (len < 1)
667 			break;
668 
669 		switch (BTHID_DATA_PARAM(data[0])) {
670 		case BTHID_CONTROL_UNPLUG:
671 			aprint_normal_dev(sc->sc_dev, "unplugged\n");
672 
673 			mutex_enter(bt_lock);
674 			/* close interrupt channel */
675 			if (sc->sc_int != NULL) {
676 				l2cap_disconnect(sc->sc_int, 0);
677 				l2cap_detach(&sc->sc_int);
678 				sc->sc_int = NULL;
679 			}
680 
681 			/* close control channel */
682 			if (sc->sc_ctl != NULL) {
683 				l2cap_disconnect(sc->sc_ctl, 0);
684 				l2cap_detach(&sc->sc_ctl);
685 				sc->sc_ctl = NULL;
686 			}
687 			mutex_exit(bt_lock);
688 
689 			break;
690 
691 		default:
692 			break;
693 		}
694 
695 		break;
696 
697 	default:
698 		break;
699 	}
700 }
701 
702 /*****************************************************************************
703  *
704  *	bluetooth(9) callback methods for L2CAP
705  *
706  *	All these are called from Bluetooth Protocol code, in a soft
707  *	interrupt context at IPL_SOFTNET.
708  */
709 
710 static void
711 bthidev_connecting(void *arg)
712 {
713 
714 	/* dont care */
715 }
716 
717 static void
718 bthidev_ctl_connected(void *arg)
719 {
720 	struct sockaddr_bt sa;
721 	struct bthidev_softc *sc = arg;
722 	int err;
723 
724 	if (sc->sc_state != BTHID_WAIT_CTL)
725 		return;
726 
727 	KASSERT(sc->sc_ctl != NULL);
728 	KASSERT(sc->sc_int == NULL);
729 
730 	if (sc->sc_flags & BTHID_CONNECTING) {
731 		/* initiate connect on interrupt PSM */
732 		err = l2cap_attach(&sc->sc_int, &bthidev_int_proto, sc);
733 		if (err)
734 			goto fail;
735 
736 		err = l2cap_setopt(sc->sc_int, &sc->sc_mode);
737 		if (err)
738 			goto fail;
739 
740 		memset(&sa, 0, sizeof(sa));
741 		sa.bt_len = sizeof(sa);
742 		sa.bt_family = AF_BLUETOOTH;
743 		bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
744 
745 		err = l2cap_bind(sc->sc_int, &sa);
746 		if (err)
747 			goto fail;
748 
749 		sa.bt_psm = sc->sc_intpsm;
750 		bdaddr_copy(&sa.bt_bdaddr, &sc->sc_raddr);
751 		err = l2cap_connect(sc->sc_int, &sa);
752 		if (err)
753 			goto fail;
754 	}
755 
756 	sc->sc_state = BTHID_WAIT_INT;
757 	return;
758 
759 fail:
760 	l2cap_detach(&sc->sc_ctl);
761 	sc->sc_ctl = NULL;
762 
763 	aprint_error_dev(sc->sc_dev, "connect failed (%d)\n", err);
764 }
765 
766 static void
767 bthidev_int_connected(void *arg)
768 {
769 	struct bthidev_softc *sc = arg;
770 
771 	if (sc->sc_state != BTHID_WAIT_INT)
772 		return;
773 
774 	KASSERT(sc->sc_ctl != NULL);
775 	KASSERT(sc->sc_int != NULL);
776 
777 	sc->sc_attempts = 0;
778 	sc->sc_flags &= ~BTHID_CONNECTING;
779 	sc->sc_state = BTHID_OPEN;
780 
781 	aprint_normal_dev(sc->sc_dev, "connected\n");
782 }
783 
784 /*
785  * Disconnected
786  *
787  * Depending on our state, this could mean several things, but essentially
788  * we are lost. If both channels are closed, and we are marked to reconnect,
789  * schedule another try otherwise just give up. They will contact us.
790  */
791 static void
792 bthidev_ctl_disconnected(void *arg, int err)
793 {
794 	struct bthidev_softc *sc = arg;
795 
796 	if (sc->sc_ctl != NULL) {
797 		l2cap_detach(&sc->sc_ctl);
798 		sc->sc_ctl = NULL;
799 	}
800 
801 	sc->sc_state = BTHID_CLOSED;
802 
803 	if (sc->sc_int == NULL) {
804 		aprint_normal_dev(sc->sc_dev, "disconnected\n");
805 		sc->sc_flags &= ~BTHID_CONNECTING;
806 
807 		if (sc->sc_flags & BTHID_RECONNECT)
808 			callout_schedule(&sc->sc_reconnect,
809 					BTHID_RETRY_INTERVAL * hz);
810 		else
811 			sc->sc_state = BTHID_WAIT_CTL;
812 	} else {
813 		/*
814 		 * The interrupt channel should have been closed first,
815 		 * but its potentially unsafe to detach that from here.
816 		 * Give them a second to do the right thing or let the
817 		 * callout handle it.
818 		 */
819 		callout_schedule(&sc->sc_reconnect, hz);
820 	}
821 }
822 
823 static void
824 bthidev_int_disconnected(void *arg, int err)
825 {
826 	struct bthidev_softc *sc = arg;
827 
828 	if (sc->sc_int != NULL) {
829 		l2cap_detach(&sc->sc_int);
830 		sc->sc_int = NULL;
831 	}
832 
833 	sc->sc_state = BTHID_CLOSED;
834 
835 	if (sc->sc_ctl == NULL) {
836 		aprint_normal_dev(sc->sc_dev, "disconnected\n");
837 		sc->sc_flags &= ~BTHID_CONNECTING;
838 
839 		if (sc->sc_flags & BTHID_RECONNECT)
840 			callout_schedule(&sc->sc_reconnect,
841 					BTHID_RETRY_INTERVAL * hz);
842 		else
843 			sc->sc_state = BTHID_WAIT_CTL;
844 	} else {
845 		/*
846 		 * The control channel should be closing also, allow
847 		 * them a chance to do that before we force it.
848 		 */
849 		callout_schedule(&sc->sc_reconnect, hz);
850 	}
851 }
852 
853 /*
854  * New Connections
855  *
856  * We give a new L2CAP handle back if this matches the BDADDR we are
857  * listening for and we are in the right state. bthidev_connected will
858  * be called when the connection is open, so nothing else to do here
859  */
860 static void *
861 bthidev_ctl_newconn(void *arg, struct sockaddr_bt *laddr,
862     struct sockaddr_bt *raddr)
863 {
864 	struct bthidev_softc *sc = arg;
865 
866 	if (bdaddr_same(&raddr->bt_bdaddr, &sc->sc_raddr) == 0)
867 		return NULL;
868 
869 	if ((sc->sc_flags & BTHID_CONNECTING)
870 	    || sc->sc_state != BTHID_WAIT_CTL
871 	    || sc->sc_ctl != NULL
872 	    || sc->sc_int != NULL) {
873 		aprint_verbose_dev(sc->sc_dev, "reject ctl newconn %s%s%s%s\n",
874 		    (sc->sc_flags & BTHID_CONNECTING) ? " (CONNECTING)" : "",
875 		    (sc->sc_state == BTHID_WAIT_CTL) ? " (WAITING)": "",
876 		    (sc->sc_ctl != NULL) ? " (GOT CONTROL)" : "",
877 		    (sc->sc_int != NULL) ? " (GOT INTERRUPT)" : "");
878 
879 		return NULL;
880 	}
881 
882 	l2cap_attach(&sc->sc_ctl, &bthidev_ctl_proto, sc);
883 	return sc->sc_ctl;
884 }
885 
886 static void *
887 bthidev_int_newconn(void *arg, struct sockaddr_bt *laddr,
888     struct sockaddr_bt *raddr)
889 {
890 	struct bthidev_softc *sc = arg;
891 
892 	if (bdaddr_same(&raddr->bt_bdaddr, &sc->sc_raddr) == 0)
893 		return NULL;
894 
895 	if ((sc->sc_flags & BTHID_CONNECTING)
896 	    || sc->sc_state != BTHID_WAIT_INT
897 	    || sc->sc_ctl == NULL
898 	    || sc->sc_int != NULL) {
899 		aprint_verbose_dev(sc->sc_dev, "reject int newconn %s%s%s%s\n",
900 		    (sc->sc_flags & BTHID_CONNECTING) ? " (CONNECTING)" : "",
901 		    (sc->sc_state == BTHID_WAIT_INT) ? " (WAITING)": "",
902 		    (sc->sc_ctl == NULL) ? " (NO CONTROL)" : "",
903 		    (sc->sc_int != NULL) ? " (GOT INTERRUPT)" : "");
904 
905 		return NULL;
906 	}
907 
908 	l2cap_attach(&sc->sc_int, &bthidev_int_proto, sc);
909 	return sc->sc_int;
910 }
911 
912 static void
913 bthidev_complete(void *arg, int count)
914 {
915 
916 	/* dont care */
917 }
918 
919 static void
920 bthidev_linkmode(void *arg, int new)
921 {
922 	struct bthidev_softc *sc = arg;
923 	int mode;
924 
925 	(void)sockopt_getint(&sc->sc_mode, &mode);
926 
927 	if ((mode & L2CAP_LM_AUTH) && !(new & L2CAP_LM_AUTH))
928 		aprint_error_dev(sc->sc_dev, "auth failed\n");
929 	else if ((mode & L2CAP_LM_ENCRYPT) && !(new & L2CAP_LM_ENCRYPT))
930 		aprint_error_dev(sc->sc_dev, "encrypt off\n");
931 	else if ((mode & L2CAP_LM_SECURE) && !(new & L2CAP_LM_SECURE))
932 		aprint_error_dev(sc->sc_dev, "insecure\n");
933 	else
934 		return;
935 
936 	if (sc->sc_int != NULL)
937 		l2cap_disconnect(sc->sc_int, 0);
938 
939 	if (sc->sc_ctl != NULL)
940 		l2cap_disconnect(sc->sc_ctl, 0);
941 }
942 
943 /*
944  * Receive reports from the protocol stack. Because this will be called
945  * with bt_lock held, we queue the mbuf and process it with a kernel thread
946  */
947 static void
948 bthidev_input(void *arg, struct mbuf *m)
949 {
950 	struct bthidev_softc *sc = arg;
951 
952 	if (sc->sc_state != BTHID_OPEN) {
953 		m_freem(m);
954 		return;
955 	}
956 
957 	mutex_enter(&sc->sc_lock);
958 	MBUFQ_ENQUEUE(&sc->sc_inq, m);
959 	cv_signal(&sc->sc_cv);
960 	mutex_exit(&sc->sc_lock);
961 }
962 
963 /*****************************************************************************
964  *
965  *	IO routines
966  */
967 
968 static void
969 bthidev_null(struct bthidev *hidev, uint8_t *report, int len)
970 {
971 
972 	/*
973 	 * empty routine just in case the device
974 	 * provided no method to handle this report
975 	 */
976 }
977 
978 static int
979 bthidev_output(struct bthidev *hidev, uint8_t *report, int rlen)
980 {
981 	struct bthidev_softc *sc = device_private(hidev->sc_parent);
982 	struct mbuf *m;
983 	int err;
984 
985 	if (sc == NULL || sc->sc_state != BTHID_OPEN)
986 		return ENOTCONN;
987 
988 	KASSERT(sc->sc_ctl != NULL);
989 	KASSERT(sc->sc_int != NULL);
990 
991 	if (rlen == 0 || report == NULL)
992 		return 0;
993 
994 	if (rlen > MHLEN - 2) {
995 		aprint_error_dev(sc->sc_dev,
996 		    "output report too long (%d)!\n", rlen);
997 		return EMSGSIZE;
998 	}
999 
1000 	m = m_gethdr(M_DONTWAIT, MT_DATA);
1001 	if (m == NULL)
1002 		return ENOMEM;
1003 
1004 	/*
1005 	 * data[0] = type / parameter
1006 	 * data[1] = id
1007 	 * data[2..N] = report
1008 	 */
1009 	mtod(m, uint8_t *)[0] = (uint8_t)((BTHID_DATA << 4) | BTHID_DATA_OUTPUT);
1010 	mtod(m, uint8_t *)[1] = hidev->sc_id;
1011 	memcpy(mtod(m, uint8_t *) + 2, report, rlen);
1012 	m->m_pkthdr.len = m->m_len = rlen + 2;
1013 
1014 	mutex_enter(bt_lock);
1015 	err = l2cap_send(sc->sc_int, m);
1016 	mutex_exit(bt_lock);
1017 
1018 	return err;
1019 }
1020