xref: /netbsd-src/sys/dev/usb/ubt.c (revision 6a493d6bc668897c91594964a732d38505b70cbb)
1 /*	$NetBSD: ubt.c,v 1.49 2012/10/06 14:37:41 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006 Itronix Inc.
5  * All rights reserved.
6  *
7  * Written by Iain Hibbert for Itronix Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of Itronix Inc. may not be used to endorse
18  *    or promote products derived from this software without specific
19  *    prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28  * ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 /*
34  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
35  * All rights reserved.
36  *
37  * This code is derived from software contributed to The NetBSD Foundation
38  * by Lennart Augustsson (lennart@augustsson.net) and
39  * David Sainty (David.Sainty@dtsp.co.nz).
40  *
41  * Redistribution and use in source and binary forms, with or without
42  * modification, are permitted provided that the following conditions
43  * are met:
44  * 1. Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  * 2. Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in the
48  *    documentation and/or other materials provided with the distribution.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
51  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
52  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
53  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
54  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
55  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
56  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
57  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
58  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
59  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
60  * POSSIBILITY OF SUCH DAMAGE.
61  */
62 /*
63  * This driver originally written by Lennart Augustsson and David Sainty,
64  * but was mostly rewritten for the NetBSD Bluetooth protocol stack by
65  * Iain Hibbert for Itronix, Inc using the FreeBSD ng_ubt.c driver as a
66  * reference.
67  */
68 
69 #include <sys/cdefs.h>
70 __KERNEL_RCSID(0, "$NetBSD: ubt.c,v 1.49 2012/10/06 14:37:41 christos Exp $");
71 
72 #include <sys/param.h>
73 #include <sys/device.h>
74 #include <sys/ioctl.h>
75 #include <sys/kernel.h>
76 #include <sys/malloc.h>
77 #include <sys/mbuf.h>
78 #include <sys/proc.h>
79 #include <sys/sysctl.h>
80 #include <sys/systm.h>
81 
82 #include <dev/usb/usb.h>
83 #include <dev/usb/usbdi.h>
84 #include <dev/usb/usbdi_util.h>
85 #include <dev/usb/usbdevs.h>
86 
87 #include <netbt/bluetooth.h>
88 #include <netbt/hci.h>
89 
90 /*******************************************************************************
91  *
92  *	debugging stuff
93  */
94 #undef DPRINTF
95 #undef DPRINTFN
96 
97 #ifdef UBT_DEBUG
98 int	ubt_debug = 0;
99 
100 #define DPRINTF(...)		do {		\
101 	if (ubt_debug) {			\
102 		printf("%s: ", __func__);	\
103 		printf(__VA_ARGS__);		\
104 	}					\
105 } while (/* CONSTCOND */0)
106 
107 #define DPRINTFN(n, ...)	do {		\
108 	if (ubt_debug > (n)) {			\
109 		printf("%s: ", __func__);	\
110 		printf(__VA_ARGS__);		\
111 	}					\
112 } while (/* CONSTCOND */0)
113 
114 SYSCTL_SETUP(sysctl_hw_ubt_debug_setup, "sysctl hw.ubt_debug setup")
115 {
116 
117 	sysctl_createv(NULL, 0, NULL, NULL,
118 		CTLFLAG_PERMANENT,
119 		CTLTYPE_NODE, "hw",
120 		NULL,
121 		NULL, 0,
122 		NULL, 0,
123 		CTL_HW, CTL_EOL);
124 
125 	sysctl_createv(NULL, 0, NULL, NULL,
126 		CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
127 		CTLTYPE_INT, "ubt_debug",
128 		SYSCTL_DESCR("ubt debug level"),
129 		NULL, 0,
130 		&ubt_debug, sizeof(ubt_debug),
131 		CTL_HW, CTL_CREATE, CTL_EOL);
132 }
133 #else
134 #define DPRINTF(...)
135 #define DPRINTFN(...)
136 #endif
137 
138 /*******************************************************************************
139  *
140  *	ubt softc structure
141  *
142  */
143 
144 /* buffer sizes */
145 /*
146  * NB: although ACL packets can extend to 65535 bytes, most devices
147  * have max_acl_size at much less (largest I have seen is 384)
148  */
149 #define UBT_BUFSIZ_CMD		(HCI_CMD_PKT_SIZE - 1)
150 #define UBT_BUFSIZ_ACL		(2048 - 1)
151 #define UBT_BUFSIZ_EVENT	(HCI_EVENT_PKT_SIZE - 1)
152 
153 /* Transmit timeouts */
154 #define UBT_CMD_TIMEOUT		USBD_DEFAULT_TIMEOUT
155 #define UBT_ACL_TIMEOUT		USBD_DEFAULT_TIMEOUT
156 
157 /*
158  * ISOC transfers
159  *
160  * xfer buffer size depends on the frame size, and the number
161  * of frames per transfer is fixed, as each frame should be
162  * 1ms worth of data. This keeps the rate that xfers complete
163  * fairly constant. We use multiple xfers to keep the hardware
164  * busy
165  */
166 #define UBT_NXFERS		3	/* max xfers to queue */
167 #define UBT_NFRAMES		10	/* frames per xfer */
168 
169 struct ubt_isoc_xfer {
170 	struct ubt_softc	*softc;
171 	usbd_xfer_handle	 xfer;
172 	uint8_t			*buf;
173 	uint16_t		 size[UBT_NFRAMES];
174 	int			 busy;
175 };
176 
177 struct ubt_softc {
178 	device_t		 sc_dev;
179 	usbd_device_handle	 sc_udev;
180 	int			 sc_refcnt;
181 	int			 sc_dying;
182 	int			 sc_enabled;
183 
184 	/* Control Interface */
185 	usbd_interface_handle	 sc_iface0;
186 
187 	/* Commands (control) */
188 	usbd_xfer_handle	 sc_cmd_xfer;
189 	uint8_t			*sc_cmd_buf;
190 	int			 sc_cmd_busy;	/* write active */
191 	MBUFQ_HEAD()		 sc_cmd_queue;	/* output queue */
192 
193 	/* Events (interrupt) */
194 	int			 sc_evt_addr;	/* endpoint address */
195 	usbd_pipe_handle	 sc_evt_pipe;
196 	uint8_t			*sc_evt_buf;
197 
198 	/* ACL data (in) */
199 	int			 sc_aclrd_addr;	/* endpoint address */
200 	usbd_pipe_handle	 sc_aclrd_pipe;	/* read pipe */
201 	usbd_xfer_handle	 sc_aclrd_xfer;	/* read xfer */
202 	uint8_t			*sc_aclrd_buf;	/* read buffer */
203 	int			 sc_aclrd_busy;	/* reading */
204 
205 	/* ACL data (out) */
206 	int			 sc_aclwr_addr;	/* endpoint address */
207 	usbd_pipe_handle	 sc_aclwr_pipe;	/* write pipe */
208 	usbd_xfer_handle	 sc_aclwr_xfer;	/* write xfer */
209 	uint8_t			*sc_aclwr_buf;	/* write buffer */
210 	int			 sc_aclwr_busy;	/* write active */
211 	MBUFQ_HEAD()		 sc_aclwr_queue;/* output queue */
212 
213 	/* ISOC interface */
214 	usbd_interface_handle	 sc_iface1;	/* ISOC interface */
215 	struct sysctllog	*sc_log;	/* sysctl log */
216 	int			 sc_config;	/* current config no */
217 	int			 sc_alt_config;	/* no of alternates */
218 
219 	/* SCO data (in) */
220 	int			 sc_scord_addr;	/* endpoint address */
221 	usbd_pipe_handle	 sc_scord_pipe;	/* read pipe */
222 	int			 sc_scord_size;	/* frame length */
223 	struct ubt_isoc_xfer	 sc_scord[UBT_NXFERS];
224 	struct mbuf		*sc_scord_mbuf;	/* current packet */
225 
226 	/* SCO data (out) */
227 	int			 sc_scowr_addr;	/* endpoint address */
228 	usbd_pipe_handle	 sc_scowr_pipe;	/* write pipe */
229 	int			 sc_scowr_size;	/* frame length */
230 	struct ubt_isoc_xfer	 sc_scowr[UBT_NXFERS];
231 	struct mbuf		*sc_scowr_mbuf;	/* current packet */
232 	int			 sc_scowr_busy;	/* write active */
233 	MBUFQ_HEAD()		 sc_scowr_queue;/* output queue */
234 
235 	/* Protocol structure */
236 	struct hci_unit		*sc_unit;
237 	struct bt_stats		 sc_stats;
238 
239 	/* Successfully attached */
240 	int			 sc_ok;
241 };
242 
243 /*******************************************************************************
244  *
245  * Bluetooth unit/USB callback routines
246  *
247  */
248 static int ubt_enable(device_t);
249 static void ubt_disable(device_t);
250 
251 static void ubt_xmit_cmd(device_t, struct mbuf *);
252 static void ubt_xmit_cmd_start(struct ubt_softc *);
253 static void ubt_xmit_cmd_complete(usbd_xfer_handle,
254 				usbd_private_handle, usbd_status);
255 
256 static void ubt_xmit_acl(device_t, struct mbuf *);
257 static void ubt_xmit_acl_start(struct ubt_softc *);
258 static void ubt_xmit_acl_complete(usbd_xfer_handle,
259 				usbd_private_handle, usbd_status);
260 
261 static void ubt_xmit_sco(device_t, struct mbuf *);
262 static void ubt_xmit_sco_start(struct ubt_softc *);
263 static void ubt_xmit_sco_start1(struct ubt_softc *, struct ubt_isoc_xfer *);
264 static void ubt_xmit_sco_complete(usbd_xfer_handle,
265 				usbd_private_handle, usbd_status);
266 
267 static void ubt_recv_event(usbd_xfer_handle,
268 				usbd_private_handle, usbd_status);
269 
270 static void ubt_recv_acl_start(struct ubt_softc *);
271 static void ubt_recv_acl_complete(usbd_xfer_handle,
272 				usbd_private_handle, usbd_status);
273 
274 static void ubt_recv_sco_start1(struct ubt_softc *, struct ubt_isoc_xfer *);
275 static void ubt_recv_sco_complete(usbd_xfer_handle,
276 				usbd_private_handle, usbd_status);
277 
278 static void ubt_stats(device_t, struct bt_stats *, int);
279 
280 static const struct hci_if ubt_hci = {
281 	.enable = ubt_enable,
282 	.disable = ubt_disable,
283 	.output_cmd = ubt_xmit_cmd,
284 	.output_acl = ubt_xmit_acl,
285 	.output_sco = ubt_xmit_sco,
286 	.get_stats = ubt_stats,
287 	.ipl = IPL_USB,		/* IPL_SOFTUSB ??? */
288 };
289 
290 /*******************************************************************************
291  *
292  * USB Autoconfig stuff
293  *
294  */
295 
296 int             ubt_match(device_t, cfdata_t, void *);
297 void            ubt_attach(device_t, device_t, void *);
298 int             ubt_detach(device_t, int);
299 int             ubt_activate(device_t, enum devact);
300 extern struct cfdriver ubt_cd;
301 CFATTACH_DECL_NEW(ubt, sizeof(struct ubt_softc), ubt_match, ubt_attach, ubt_detach, ubt_activate);
302 
303 static int ubt_set_isoc_config(struct ubt_softc *);
304 static int ubt_sysctl_config(SYSCTLFN_PROTO);
305 static void ubt_abortdealloc(struct ubt_softc *);
306 
307 /*
308  * To match or ignore forcibly, add
309  *
310  *	{ { VendorID, ProductID } , UMATCH_VENDOR_PRODUCT|UMATCH_NONE }
311  *
312  * to the ubt_dev list.
313  */
314 const struct ubt_devno {
315 	struct usb_devno	devno;
316 	int			match;
317 } ubt_dev[] = {
318 	{ { USB_VENDOR_BROADCOM, USB_PRODUCT_BROADCOM_BCM2033NF },
319 	  UMATCH_NONE },
320 	{ { USB_VENDOR_APPLE, USB_PRODUCT_APPLE_BLUETOOTH_HOST_C },
321 	  UMATCH_VENDOR_PRODUCT },
322 };
323 #define ubt_lookup(vendor, product) \
324 	((const struct ubt_devno *)usb_lookup(ubt_dev, vendor, product))
325 
326 int
327 ubt_match(device_t parent, cfdata_t match, void *aux)
328 {
329 	struct usb_attach_arg *uaa = aux;
330 	const struct ubt_devno *dev;
331 
332 	DPRINTFN(50, "ubt_match\n");
333 
334 	if ((dev = ubt_lookup(uaa->vendor, uaa->product)) != NULL)
335 		return dev->match;
336 
337 	if (uaa->class == UDCLASS_WIRELESS
338 	    && uaa->subclass == UDSUBCLASS_RF
339 	    && uaa->proto == UDPROTO_BLUETOOTH)
340 		return UMATCH_DEVCLASS_DEVSUBCLASS_DEVPROTO;
341 
342 	return UMATCH_NONE;
343 }
344 
345 void
346 ubt_attach(device_t parent, device_t self, void *aux)
347 {
348 	struct ubt_softc *sc = device_private(self);
349 	struct usb_attach_arg *uaa = aux;
350 	usb_config_descriptor_t *cd;
351 	usb_endpoint_descriptor_t *ed;
352 	const struct sysctlnode *node;
353 	char *devinfop;
354 	int err;
355 	uint8_t count, i;
356 
357 	DPRINTFN(50, "ubt_attach: sc=%p\n", sc);
358 
359 	sc->sc_dev = self;
360 	sc->sc_udev = uaa->device;
361 
362 	MBUFQ_INIT(&sc->sc_cmd_queue);
363 	MBUFQ_INIT(&sc->sc_aclwr_queue);
364 	MBUFQ_INIT(&sc->sc_scowr_queue);
365 
366 	aprint_naive("\n");
367 	aprint_normal("\n");
368 
369 	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
370 	aprint_normal_dev(self, "%s\n", devinfop);
371 	usbd_devinfo_free(devinfop);
372 
373 	/*
374 	 * Move the device into the configured state
375 	 */
376 	err = usbd_set_config_index(sc->sc_udev, 0, 1);
377 	if (err) {
378 		aprint_error_dev(self, "failed to set configuration idx 0: %s\n",
379 		    usbd_errstr(err));
380 
381 		return;
382 	}
383 
384 	/*
385 	 * Interface 0 must have 3 endpoints
386 	 *	1) Interrupt endpoint to receive HCI events
387 	 *	2) Bulk IN endpoint to receive ACL data
388 	 *	3) Bulk OUT endpoint to send ACL data
389 	 */
390 	err = usbd_device2interface_handle(sc->sc_udev, 0, &sc->sc_iface0);
391 	if (err) {
392 		aprint_error_dev(self, "Could not get interface 0 handle %s (%d)\n",
393 				usbd_errstr(err), err);
394 
395 		return;
396 	}
397 
398 	sc->sc_evt_addr = -1;
399 	sc->sc_aclrd_addr = -1;
400 	sc->sc_aclwr_addr = -1;
401 
402 	count = 0;
403 	(void)usbd_endpoint_count(sc->sc_iface0, &count);
404 
405 	for (i = 0 ; i < count ; i++) {
406 		int dir, type;
407 
408 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface0, i);
409 		if (ed == NULL) {
410 			aprint_error_dev(self,
411 			    "could not read endpoint descriptor %d\n", i);
412 
413 			return;
414 		}
415 
416 		dir = UE_GET_DIR(ed->bEndpointAddress);
417 		type = UE_GET_XFERTYPE(ed->bmAttributes);
418 
419 		if (dir == UE_DIR_IN && type == UE_INTERRUPT)
420 			sc->sc_evt_addr = ed->bEndpointAddress;
421 		else if (dir == UE_DIR_IN && type == UE_BULK)
422 			sc->sc_aclrd_addr = ed->bEndpointAddress;
423 		else if (dir == UE_DIR_OUT && type == UE_BULK)
424 			sc->sc_aclwr_addr = ed->bEndpointAddress;
425 	}
426 
427 	if (sc->sc_evt_addr == -1) {
428 		aprint_error_dev(self,
429 		    "missing INTERRUPT endpoint on interface 0\n");
430 
431 		return;
432 	}
433 	if (sc->sc_aclrd_addr == -1) {
434 		aprint_error_dev(self,
435 		    "missing BULK IN endpoint on interface 0\n");
436 
437 		return;
438 	}
439 	if (sc->sc_aclwr_addr == -1) {
440 		aprint_error_dev(self,
441 		    "missing BULK OUT endpoint on interface 0\n");
442 
443 		return;
444 	}
445 
446 	/*
447 	 * Interface 1 must have 2 endpoints
448 	 *	1) Isochronous IN endpoint to receive SCO data
449 	 *	2) Isochronous OUT endpoint to send SCO data
450 	 *
451 	 * and will have several configurations, which can be selected
452 	 * via a sysctl variable. We select config 0 to start, which
453 	 * means that no SCO data will be available.
454 	 */
455 	err = usbd_device2interface_handle(sc->sc_udev, 1, &sc->sc_iface1);
456 	if (err) {
457 		aprint_error_dev(self,
458 		    "Could not get interface 1 handle %s (%d)\n",
459 		    usbd_errstr(err), err);
460 
461 		return;
462 	}
463 
464 	cd = usbd_get_config_descriptor(sc->sc_udev);
465 	if (cd == NULL) {
466 		aprint_error_dev(self, "could not get config descriptor\n");
467 
468 		return;
469 	}
470 
471 	sc->sc_alt_config = usbd_get_no_alts(cd, 1);
472 
473 	/* set initial config */
474 	err = ubt_set_isoc_config(sc);
475 	if (err) {
476 		aprint_error_dev(self, "ISOC config failed\n");
477 
478 		return;
479 	}
480 
481 	/* Attach HCI */
482 	sc->sc_unit = hci_attach(&ubt_hci, sc->sc_dev, 0);
483 
484 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
485 			   sc->sc_dev);
486 
487 	/* sysctl set-up for alternate configs */
488 	sysctl_createv(&sc->sc_log, 0, NULL, NULL,
489 		CTLFLAG_PERMANENT,
490 		CTLTYPE_NODE, "hw",
491 		NULL,
492 		NULL, 0,
493 		NULL, 0,
494 		CTL_HW, CTL_EOL);
495 
496 	sysctl_createv(&sc->sc_log, 0, NULL, &node,
497 		0,
498 		CTLTYPE_NODE, device_xname(sc->sc_dev),
499 		SYSCTL_DESCR("ubt driver information"),
500 		NULL, 0,
501 		NULL, 0,
502 		CTL_HW,
503 		CTL_CREATE, CTL_EOL);
504 
505 	if (node != NULL) {
506 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
507 			CTLFLAG_READWRITE,
508 			CTLTYPE_INT, "config",
509 			SYSCTL_DESCR("configuration number"),
510 			ubt_sysctl_config, 0,
511 			(void *)sc, 0,
512 			CTL_HW, node->sysctl_num,
513 			CTL_CREATE, CTL_EOL);
514 
515 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
516 			CTLFLAG_READONLY,
517 			CTLTYPE_INT, "alt_config",
518 			SYSCTL_DESCR("number of alternate configurations"),
519 			NULL, 0,
520 			&sc->sc_alt_config, sizeof(sc->sc_alt_config),
521 			CTL_HW, node->sysctl_num,
522 			CTL_CREATE, CTL_EOL);
523 
524 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
525 			CTLFLAG_READONLY,
526 			CTLTYPE_INT, "sco_rxsize",
527 			SYSCTL_DESCR("max SCO receive size"),
528 			NULL, 0,
529 			&sc->sc_scord_size, sizeof(sc->sc_scord_size),
530 			CTL_HW, node->sysctl_num,
531 			CTL_CREATE, CTL_EOL);
532 
533 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
534 			CTLFLAG_READONLY,
535 			CTLTYPE_INT, "sco_txsize",
536 			SYSCTL_DESCR("max SCO transmit size"),
537 			NULL, 0,
538 			&sc->sc_scowr_size, sizeof(sc->sc_scowr_size),
539 			CTL_HW, node->sysctl_num,
540 			CTL_CREATE, CTL_EOL);
541 	}
542 
543 	sc->sc_ok = 1;
544 
545 	if (!pmf_device_register(self, NULL, NULL))
546 		aprint_error_dev(self, "couldn't establish power handler\n");
547 
548 	return;
549 }
550 
551 int
552 ubt_detach(device_t self, int flags)
553 {
554 	struct ubt_softc *sc = device_private(self);
555 	int s;
556 
557 	DPRINTF("sc=%p flags=%d\n", sc, flags);
558 
559 	pmf_device_deregister(self);
560 
561 	sc->sc_dying = 1;
562 
563 	if (!sc->sc_ok)
564 		return 0;
565 
566 	/* delete sysctl nodes */
567 	sysctl_teardown(&sc->sc_log);
568 
569 	/* Detach HCI interface */
570 	if (sc->sc_unit) {
571 		hci_detach(sc->sc_unit);
572 		sc->sc_unit = NULL;
573 	}
574 
575 	/*
576 	 * Abort all pipes. Causes processes waiting for transfer to wake.
577 	 *
578 	 * Actually, hci_detach() above will call ubt_disable() which may
579 	 * call ubt_abortdealloc(), but lets be sure since doing it twice
580 	 * wont cause an error.
581 	 */
582 	ubt_abortdealloc(sc);
583 
584 	/* wait for all processes to finish */
585 	s = splusb();
586 	if (sc->sc_refcnt-- > 0)
587 		usb_detach_waitold(sc->sc_dev);
588 
589 	splx(s);
590 
591 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
592 			   sc->sc_dev);
593 
594 	DPRINTFN(1, "driver detached\n");
595 
596 	return 0;
597 }
598 
599 int
600 ubt_activate(device_t self, enum devact act)
601 {
602 	struct ubt_softc *sc = device_private(self);
603 
604 	DPRINTFN(1, "sc=%p, act=%d\n", sc, act);
605 
606 	switch (act) {
607 	case DVACT_DEACTIVATE:
608 		sc->sc_dying = 1;
609 		return 0;
610 	default:
611 		return EOPNOTSUPP;
612 	}
613 }
614 
615 /* set ISOC configuration */
616 static int
617 ubt_set_isoc_config(struct ubt_softc *sc)
618 {
619 	usb_endpoint_descriptor_t *ed;
620 	int rd_addr, wr_addr, rd_size, wr_size;
621 	uint8_t count, i;
622 	int err;
623 
624 	err = usbd_set_interface(sc->sc_iface1, sc->sc_config);
625 	if (err != USBD_NORMAL_COMPLETION) {
626 		aprint_error_dev(sc->sc_dev,
627 		    "Could not set config %d on ISOC interface. %s (%d)\n",
628 		    sc->sc_config, usbd_errstr(err), err);
629 
630 		return err == USBD_IN_USE ? EBUSY : EIO;
631 	}
632 
633 	/*
634 	 * We wont get past the above if there are any pipes open, so no
635 	 * need to worry about buf/xfer/pipe deallocation. If we get an
636 	 * error after this, the frame quantities will be 0 and no SCO
637 	 * data will be possible.
638 	 */
639 
640 	sc->sc_scord_size = rd_size = 0;
641 	sc->sc_scord_addr = rd_addr = -1;
642 
643 	sc->sc_scowr_size = wr_size = 0;
644 	sc->sc_scowr_addr = wr_addr = -1;
645 
646 	count = 0;
647 	(void)usbd_endpoint_count(sc->sc_iface1, &count);
648 
649 	for (i = 0 ; i < count ; i++) {
650 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface1, i);
651 		if (ed == NULL) {
652 			aprint_error_dev(sc->sc_dev,
653 			    "could not read endpoint descriptor %d\n", i);
654 
655 			return EIO;
656 		}
657 
658 		DPRINTFN(5, "%s: endpoint type %02x (%02x) addr %02x (%s)\n",
659 			device_xname(sc->sc_dev),
660 			UE_GET_XFERTYPE(ed->bmAttributes),
661 			UE_GET_ISO_TYPE(ed->bmAttributes),
662 			ed->bEndpointAddress,
663 			UE_GET_DIR(ed->bEndpointAddress) ? "in" : "out");
664 
665 		if (UE_GET_XFERTYPE(ed->bmAttributes) != UE_ISOCHRONOUS)
666 			continue;
667 
668 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) {
669 			rd_addr = ed->bEndpointAddress;
670 			rd_size = UGETW(ed->wMaxPacketSize);
671 		} else {
672 			wr_addr = ed->bEndpointAddress;
673 			wr_size = UGETW(ed->wMaxPacketSize);
674 		}
675 	}
676 
677 	if (rd_addr == -1) {
678 		aprint_error_dev(sc->sc_dev,
679 		    "missing ISOC IN endpoint on interface config %d\n",
680 		    sc->sc_config);
681 
682 		return ENOENT;
683 	}
684 	if (wr_addr == -1) {
685 		aprint_error_dev(sc->sc_dev,
686 		    "missing ISOC OUT endpoint on interface config %d\n",
687 		    sc->sc_config);
688 
689 		return ENOENT;
690 	}
691 
692 	if (rd_size > MLEN) {
693 		aprint_error_dev(sc->sc_dev, "rd_size=%d exceeds MLEN\n",
694 		    rd_size);
695 
696 		return EOVERFLOW;
697 	}
698 
699 	if (wr_size > MLEN) {
700 		aprint_error_dev(sc->sc_dev, "wr_size=%d exceeds MLEN\n",
701 		    wr_size);
702 
703 		return EOVERFLOW;
704 	}
705 
706 	sc->sc_scord_size = rd_size;
707 	sc->sc_scord_addr = rd_addr;
708 
709 	sc->sc_scowr_size = wr_size;
710 	sc->sc_scowr_addr = wr_addr;
711 
712 	return 0;
713 }
714 
715 /* sysctl helper to set alternate configurations */
716 static int
717 ubt_sysctl_config(SYSCTLFN_ARGS)
718 {
719 	struct sysctlnode node;
720 	struct ubt_softc *sc;
721 	int t, error;
722 
723 	node = *rnode;
724 	sc = node.sysctl_data;
725 
726 	t = sc->sc_config;
727 	node.sysctl_data = &t;
728 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
729 	if (error || newp == NULL)
730 		return error;
731 
732 	if (t < 0 || t >= sc->sc_alt_config)
733 		return EINVAL;
734 
735 	/* This may not change when the unit is enabled */
736 	if (sc->sc_enabled)
737 		return EBUSY;
738 
739 	KERNEL_LOCK(1, curlwp);
740 	sc->sc_config = t;
741 	error = ubt_set_isoc_config(sc);
742 	KERNEL_UNLOCK_ONE(curlwp);
743 	return error;
744 }
745 
746 static void
747 ubt_abortdealloc(struct ubt_softc *sc)
748 {
749 	int i;
750 
751 	DPRINTFN(1, "sc=%p\n", sc);
752 
753 	/* Abort all pipes */
754 	usbd_abort_default_pipe(sc->sc_udev);
755 
756 	if (sc->sc_evt_pipe != NULL) {
757 		usbd_abort_pipe(sc->sc_evt_pipe);
758 		usbd_close_pipe(sc->sc_evt_pipe);
759 		sc->sc_evt_pipe = NULL;
760 	}
761 
762 	if (sc->sc_aclrd_pipe != NULL) {
763 		usbd_abort_pipe(sc->sc_aclrd_pipe);
764 		usbd_close_pipe(sc->sc_aclrd_pipe);
765 		sc->sc_aclrd_pipe = NULL;
766 	}
767 
768 	if (sc->sc_aclwr_pipe != NULL) {
769 		usbd_abort_pipe(sc->sc_aclwr_pipe);
770 		usbd_close_pipe(sc->sc_aclwr_pipe);
771 		sc->sc_aclwr_pipe = NULL;
772 	}
773 
774 	if (sc->sc_scord_pipe != NULL) {
775 		usbd_abort_pipe(sc->sc_scord_pipe);
776 		usbd_close_pipe(sc->sc_scord_pipe);
777 		sc->sc_scord_pipe = NULL;
778 	}
779 
780 	if (sc->sc_scowr_pipe != NULL) {
781 		usbd_abort_pipe(sc->sc_scowr_pipe);
782 		usbd_close_pipe(sc->sc_scowr_pipe);
783 		sc->sc_scowr_pipe = NULL;
784 	}
785 
786 	/* Free event buffer */
787 	if (sc->sc_evt_buf != NULL) {
788 		free(sc->sc_evt_buf, M_USBDEV);
789 		sc->sc_evt_buf = NULL;
790 	}
791 
792 	/* Free all xfers and xfer buffers (implicit) */
793 	if (sc->sc_cmd_xfer != NULL) {
794 		usbd_free_xfer(sc->sc_cmd_xfer);
795 		sc->sc_cmd_xfer = NULL;
796 		sc->sc_cmd_buf = NULL;
797 	}
798 
799 	if (sc->sc_aclrd_xfer != NULL) {
800 		usbd_free_xfer(sc->sc_aclrd_xfer);
801 		sc->sc_aclrd_xfer = NULL;
802 		sc->sc_aclrd_buf = NULL;
803 	}
804 
805 	if (sc->sc_aclwr_xfer != NULL) {
806 		usbd_free_xfer(sc->sc_aclwr_xfer);
807 		sc->sc_aclwr_xfer = NULL;
808 		sc->sc_aclwr_buf = NULL;
809 	}
810 
811 	for (i = 0 ; i < UBT_NXFERS ; i++) {
812 		if (sc->sc_scord[i].xfer != NULL) {
813 			usbd_free_xfer(sc->sc_scord[i].xfer);
814 			sc->sc_scord[i].xfer = NULL;
815 			sc->sc_scord[i].buf = NULL;
816 		}
817 
818 		if (sc->sc_scowr[i].xfer != NULL) {
819 			usbd_free_xfer(sc->sc_scowr[i].xfer);
820 			sc->sc_scowr[i].xfer = NULL;
821 			sc->sc_scowr[i].buf = NULL;
822 		}
823 	}
824 
825 	/* Free partial SCO packets */
826 	if (sc->sc_scord_mbuf != NULL) {
827 		m_freem(sc->sc_scord_mbuf);
828 		sc->sc_scord_mbuf = NULL;
829 	}
830 
831 	if (sc->sc_scowr_mbuf != NULL) {
832 		m_freem(sc->sc_scowr_mbuf);
833 		sc->sc_scowr_mbuf = NULL;
834 	}
835 
836 	/* Empty mbuf queues */
837 	MBUFQ_DRAIN(&sc->sc_cmd_queue);
838 	MBUFQ_DRAIN(&sc->sc_aclwr_queue);
839 	MBUFQ_DRAIN(&sc->sc_scowr_queue);
840 }
841 
842 /*******************************************************************************
843  *
844  * Bluetooth Unit/USB callbacks
845  *
846  */
847 static int
848 ubt_enable(device_t self)
849 {
850 	struct ubt_softc *sc = device_private(self);
851 	usbd_status err;
852 	int s, i, error;
853 
854 	DPRINTFN(1, "sc=%p\n", sc);
855 
856 	if (sc->sc_enabled)
857 		return 0;
858 
859 	s = splusb();
860 
861 	/* Events */
862 	sc->sc_evt_buf = malloc(UBT_BUFSIZ_EVENT, M_USBDEV, M_NOWAIT);
863 	if (sc->sc_evt_buf == NULL) {
864 		error = ENOMEM;
865 		goto bad;
866 	}
867 	err = usbd_open_pipe_intr(sc->sc_iface0,
868 				  sc->sc_evt_addr,
869 				  USBD_SHORT_XFER_OK,
870 				  &sc->sc_evt_pipe,
871 				  sc,
872 				  sc->sc_evt_buf,
873 				  UBT_BUFSIZ_EVENT,
874 				  ubt_recv_event,
875 				  USBD_DEFAULT_INTERVAL);
876 	if (err != USBD_NORMAL_COMPLETION) {
877 		error = EIO;
878 		goto bad;
879 	}
880 
881 	/* Commands */
882 	sc->sc_cmd_xfer = usbd_alloc_xfer(sc->sc_udev);
883 	if (sc->sc_cmd_xfer == NULL) {
884 		error = ENOMEM;
885 		goto bad;
886 	}
887 	sc->sc_cmd_buf = usbd_alloc_buffer(sc->sc_cmd_xfer, UBT_BUFSIZ_CMD);
888 	if (sc->sc_cmd_buf == NULL) {
889 		error = ENOMEM;
890 		goto bad;
891 	}
892 	sc->sc_cmd_busy = 0;
893 
894 	/* ACL read */
895 	err = usbd_open_pipe(sc->sc_iface0, sc->sc_aclrd_addr,
896 				USBD_EXCLUSIVE_USE, &sc->sc_aclrd_pipe);
897 	if (err != USBD_NORMAL_COMPLETION) {
898 		error = EIO;
899 		goto bad;
900 	}
901 	sc->sc_aclrd_xfer = usbd_alloc_xfer(sc->sc_udev);
902 	if (sc->sc_aclrd_xfer == NULL) {
903 		error = ENOMEM;
904 		goto bad;
905 	}
906 	sc->sc_aclrd_buf = usbd_alloc_buffer(sc->sc_aclrd_xfer, UBT_BUFSIZ_ACL);
907 	if (sc->sc_aclrd_buf == NULL) {
908 		error = ENOMEM;
909 		goto bad;
910 	}
911 	sc->sc_aclrd_busy = 0;
912 	ubt_recv_acl_start(sc);
913 
914 	/* ACL write */
915 	err = usbd_open_pipe(sc->sc_iface0, sc->sc_aclwr_addr,
916 				USBD_EXCLUSIVE_USE, &sc->sc_aclwr_pipe);
917 	if (err != USBD_NORMAL_COMPLETION) {
918 		error = EIO;
919 		goto bad;
920 	}
921 	sc->sc_aclwr_xfer = usbd_alloc_xfer(sc->sc_udev);
922 	if (sc->sc_aclwr_xfer == NULL) {
923 		error = ENOMEM;
924 		goto bad;
925 	}
926 	sc->sc_aclwr_buf = usbd_alloc_buffer(sc->sc_aclwr_xfer, UBT_BUFSIZ_ACL);
927 	if (sc->sc_aclwr_buf == NULL) {
928 		error = ENOMEM;
929 		goto bad;
930 	}
931 	sc->sc_aclwr_busy = 0;
932 
933 	/* SCO read */
934 	if (sc->sc_scord_size > 0) {
935 		err = usbd_open_pipe(sc->sc_iface1, sc->sc_scord_addr,
936 					USBD_EXCLUSIVE_USE, &sc->sc_scord_pipe);
937 		if (err != USBD_NORMAL_COMPLETION) {
938 			error = EIO;
939 			goto bad;
940 		}
941 
942 		for (i = 0 ; i < UBT_NXFERS ; i++) {
943 			sc->sc_scord[i].xfer = usbd_alloc_xfer(sc->sc_udev);
944 			if (sc->sc_scord[i].xfer == NULL) {
945 				error = ENOMEM;
946 				goto bad;
947 			}
948 			sc->sc_scord[i].buf = usbd_alloc_buffer(sc->sc_scord[i].xfer,
949 						sc->sc_scord_size * UBT_NFRAMES);
950 			if (sc->sc_scord[i].buf == NULL) {
951 				error = ENOMEM;
952 				goto bad;
953 			}
954 			sc->sc_scord[i].softc = sc;
955 			sc->sc_scord[i].busy = 0;
956 			ubt_recv_sco_start1(sc, &sc->sc_scord[i]);
957 		}
958 	}
959 
960 	/* SCO write */
961 	if (sc->sc_scowr_size > 0) {
962 		err = usbd_open_pipe(sc->sc_iface1, sc->sc_scowr_addr,
963 					USBD_EXCLUSIVE_USE, &sc->sc_scowr_pipe);
964 		if (err != USBD_NORMAL_COMPLETION) {
965 			error = EIO;
966 			goto bad;
967 		}
968 
969 		for (i = 0 ; i < UBT_NXFERS ; i++) {
970 			sc->sc_scowr[i].xfer = usbd_alloc_xfer(sc->sc_udev);
971 			if (sc->sc_scowr[i].xfer == NULL) {
972 				error = ENOMEM;
973 				goto bad;
974 			}
975 			sc->sc_scowr[i].buf = usbd_alloc_buffer(sc->sc_scowr[i].xfer,
976 						sc->sc_scowr_size * UBT_NFRAMES);
977 			if (sc->sc_scowr[i].buf == NULL) {
978 				error = ENOMEM;
979 				goto bad;
980 			}
981 			sc->sc_scowr[i].softc = sc;
982 			sc->sc_scowr[i].busy = 0;
983 		}
984 
985 		sc->sc_scowr_busy = 0;
986 	}
987 
988 	sc->sc_enabled = 1;
989 	splx(s);
990 	return 0;
991 
992 bad:
993 	ubt_abortdealloc(sc);
994 	splx(s);
995 	return error;
996 }
997 
998 static void
999 ubt_disable(device_t self)
1000 {
1001 	struct ubt_softc *sc = device_private(self);
1002 	int s;
1003 
1004 	DPRINTFN(1, "sc=%p\n", sc);
1005 
1006 	if (sc->sc_enabled == 0)
1007 		return;
1008 
1009 	s = splusb();
1010 	ubt_abortdealloc(sc);
1011 
1012 	sc->sc_enabled = 0;
1013 	splx(s);
1014 }
1015 
1016 static void
1017 ubt_xmit_cmd(device_t self, struct mbuf *m)
1018 {
1019 	struct ubt_softc *sc = device_private(self);
1020 	int s;
1021 
1022 	KASSERT(sc->sc_enabled);
1023 
1024 	s = splusb();
1025 	MBUFQ_ENQUEUE(&sc->sc_cmd_queue, m);
1026 
1027 	if (sc->sc_cmd_busy == 0)
1028 		ubt_xmit_cmd_start(sc);
1029 
1030 	splx(s);
1031 }
1032 
1033 static void
1034 ubt_xmit_cmd_start(struct ubt_softc *sc)
1035 {
1036 	usb_device_request_t req;
1037 	usbd_status status;
1038 	struct mbuf *m;
1039 	int len;
1040 
1041 	if (sc->sc_dying)
1042 		return;
1043 
1044 	if (MBUFQ_FIRST(&sc->sc_cmd_queue) == NULL)
1045 		return;
1046 
1047 	MBUFQ_DEQUEUE(&sc->sc_cmd_queue, m);
1048 	KASSERT(m != NULL);
1049 
1050 	DPRINTFN(15, "%s: xmit CMD packet (%d bytes)\n",
1051 			device_xname(sc->sc_dev), m->m_pkthdr.len);
1052 
1053 	sc->sc_refcnt++;
1054 	sc->sc_cmd_busy = 1;
1055 
1056 	len = m->m_pkthdr.len - 1;
1057 	m_copydata(m, 1, len, sc->sc_cmd_buf);
1058 	m_freem(m);
1059 
1060 	memset(&req, 0, sizeof(req));
1061 	req.bmRequestType = UT_WRITE_CLASS_DEVICE;
1062 	USETW(req.wLength, len);
1063 
1064 	usbd_setup_default_xfer(sc->sc_cmd_xfer,
1065 				sc->sc_udev,
1066 				sc,
1067 				UBT_CMD_TIMEOUT,
1068 				&req,
1069 				sc->sc_cmd_buf,
1070 				len,
1071 				USBD_NO_COPY | USBD_FORCE_SHORT_XFER,
1072 				ubt_xmit_cmd_complete);
1073 
1074 	status = usbd_transfer(sc->sc_cmd_xfer);
1075 
1076 	KASSERT(status != USBD_NORMAL_COMPLETION);
1077 
1078 	if (status != USBD_IN_PROGRESS) {
1079 		DPRINTF("usbd_transfer status=%s (%d)\n",
1080 			usbd_errstr(status), status);
1081 
1082 		sc->sc_refcnt--;
1083 		sc->sc_cmd_busy = 0;
1084 	}
1085 }
1086 
1087 static void
1088 ubt_xmit_cmd_complete(usbd_xfer_handle xfer,
1089 			usbd_private_handle h, usbd_status status)
1090 {
1091 	struct ubt_softc *sc = h;
1092 	uint32_t count;
1093 
1094 	DPRINTFN(15, "%s: CMD complete status=%s (%d)\n",
1095 			device_xname(sc->sc_dev), usbd_errstr(status), status);
1096 
1097 	sc->sc_cmd_busy = 0;
1098 
1099 	if (--sc->sc_refcnt < 0) {
1100 		DPRINTF("sc_refcnt=%d\n", sc->sc_refcnt);
1101 		usb_detach_wakeupold(sc->sc_dev);
1102 		return;
1103 	}
1104 
1105 	if (sc->sc_dying) {
1106 		DPRINTF("sc_dying\n");
1107 		return;
1108 	}
1109 
1110 	if (status != USBD_NORMAL_COMPLETION) {
1111 		DPRINTF("status=%s (%d)\n",
1112 			usbd_errstr(status), status);
1113 
1114 		sc->sc_stats.err_tx++;
1115 		return;
1116 	}
1117 
1118 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1119 	sc->sc_stats.cmd_tx++;
1120 	sc->sc_stats.byte_tx += count;
1121 
1122 	ubt_xmit_cmd_start(sc);
1123 }
1124 
1125 static void
1126 ubt_xmit_acl(device_t self, struct mbuf *m)
1127 {
1128 	struct ubt_softc *sc = device_private(self);
1129 	int s;
1130 
1131 	KASSERT(sc->sc_enabled);
1132 
1133 	s = splusb();
1134 	MBUFQ_ENQUEUE(&sc->sc_aclwr_queue, m);
1135 
1136 	if (sc->sc_aclwr_busy == 0)
1137 		ubt_xmit_acl_start(sc);
1138 
1139 	splx(s);
1140 }
1141 
1142 static void
1143 ubt_xmit_acl_start(struct ubt_softc *sc)
1144 {
1145 	struct mbuf *m;
1146 	usbd_status status;
1147 	int len;
1148 
1149 	if (sc->sc_dying)
1150 		return;
1151 
1152 	if (MBUFQ_FIRST(&sc->sc_aclwr_queue) == NULL)
1153 		return;
1154 
1155 	sc->sc_refcnt++;
1156 	sc->sc_aclwr_busy = 1;
1157 
1158 	MBUFQ_DEQUEUE(&sc->sc_aclwr_queue, m);
1159 	KASSERT(m != NULL);
1160 
1161 	DPRINTFN(15, "%s: xmit ACL packet (%d bytes)\n",
1162 			device_xname(sc->sc_dev), m->m_pkthdr.len);
1163 
1164 	len = m->m_pkthdr.len - 1;
1165 	if (len > UBT_BUFSIZ_ACL) {
1166 		DPRINTF("%s: truncating ACL packet (%d => %d)!\n",
1167 			device_xname(sc->sc_dev), len, UBT_BUFSIZ_ACL);
1168 
1169 		len = UBT_BUFSIZ_ACL;
1170 	}
1171 
1172 	m_copydata(m, 1, len, sc->sc_aclwr_buf);
1173 	m_freem(m);
1174 
1175 	sc->sc_stats.acl_tx++;
1176 	sc->sc_stats.byte_tx += len;
1177 
1178 	usbd_setup_xfer(sc->sc_aclwr_xfer,
1179 			sc->sc_aclwr_pipe,
1180 			sc,
1181 			sc->sc_aclwr_buf,
1182 			len,
1183 			USBD_NO_COPY | USBD_FORCE_SHORT_XFER,
1184 			UBT_ACL_TIMEOUT,
1185 			ubt_xmit_acl_complete);
1186 
1187 	status = usbd_transfer(sc->sc_aclwr_xfer);
1188 
1189 	KASSERT(status != USBD_NORMAL_COMPLETION);
1190 
1191 	if (status != USBD_IN_PROGRESS) {
1192 		DPRINTF("usbd_transfer status=%s (%d)\n",
1193 			usbd_errstr(status), status);
1194 
1195 		sc->sc_refcnt--;
1196 		sc->sc_aclwr_busy = 0;
1197 	}
1198 }
1199 
1200 static void
1201 ubt_xmit_acl_complete(usbd_xfer_handle xfer,
1202 		usbd_private_handle h, usbd_status status)
1203 {
1204 	struct ubt_softc *sc = h;
1205 
1206 	DPRINTFN(15, "%s: ACL complete status=%s (%d)\n",
1207 		device_xname(sc->sc_dev), usbd_errstr(status), status);
1208 
1209 	sc->sc_aclwr_busy = 0;
1210 
1211 	if (--sc->sc_refcnt < 0) {
1212 		usb_detach_wakeupold(sc->sc_dev);
1213 		return;
1214 	}
1215 
1216 	if (sc->sc_dying)
1217 		return;
1218 
1219 	if (status != USBD_NORMAL_COMPLETION) {
1220 		DPRINTF("status=%s (%d)\n",
1221 			usbd_errstr(status), status);
1222 
1223 		sc->sc_stats.err_tx++;
1224 
1225 		if (status == USBD_STALLED)
1226 			usbd_clear_endpoint_stall_async(sc->sc_aclwr_pipe);
1227 		else
1228 			return;
1229 	}
1230 
1231 	ubt_xmit_acl_start(sc);
1232 }
1233 
1234 static void
1235 ubt_xmit_sco(device_t self, struct mbuf *m)
1236 {
1237 	struct ubt_softc *sc = device_private(self);
1238 	int s;
1239 
1240 	KASSERT(sc->sc_enabled);
1241 
1242 	s = splusb();
1243 	MBUFQ_ENQUEUE(&sc->sc_scowr_queue, m);
1244 
1245 	if (sc->sc_scowr_busy == 0)
1246 		ubt_xmit_sco_start(sc);
1247 
1248 	splx(s);
1249 }
1250 
1251 static void
1252 ubt_xmit_sco_start(struct ubt_softc *sc)
1253 {
1254 	int i;
1255 
1256 	if (sc->sc_dying || sc->sc_scowr_size == 0)
1257 		return;
1258 
1259 	for (i = 0 ; i < UBT_NXFERS ; i++) {
1260 		if (sc->sc_scowr[i].busy)
1261 			continue;
1262 
1263 		ubt_xmit_sco_start1(sc, &sc->sc_scowr[i]);
1264 	}
1265 }
1266 
1267 static void
1268 ubt_xmit_sco_start1(struct ubt_softc *sc, struct ubt_isoc_xfer *isoc)
1269 {
1270 	struct mbuf *m;
1271 	uint8_t *buf;
1272 	int num, len, size, space;
1273 
1274 	space = sc->sc_scowr_size * UBT_NFRAMES;
1275 	buf = isoc->buf;
1276 	len = 0;
1277 
1278 	/*
1279 	 * Fill the request buffer with data from the queue,
1280 	 * keeping any leftover packet on our private hook.
1281 	 *
1282 	 * Complete packets are passed back up to the stack
1283 	 * for disposal, since we can't rely on the controller
1284 	 * to tell us when it has finished with them.
1285 	 */
1286 
1287 	m = sc->sc_scowr_mbuf;
1288 	while (space > 0) {
1289 		if (m == NULL) {
1290 			MBUFQ_DEQUEUE(&sc->sc_scowr_queue, m);
1291 			if (m == NULL)
1292 				break;
1293 
1294 			m_adj(m, 1);	/* packet type */
1295 		}
1296 
1297 		if (m->m_pkthdr.len > 0) {
1298 			size = MIN(m->m_pkthdr.len, space);
1299 
1300 			m_copydata(m, 0, size, buf);
1301 			m_adj(m, size);
1302 
1303 			buf += size;
1304 			len += size;
1305 			space -= size;
1306 		}
1307 
1308 		if (m->m_pkthdr.len == 0) {
1309 			sc->sc_stats.sco_tx++;
1310 			if (!hci_complete_sco(sc->sc_unit, m))
1311 				sc->sc_stats.err_tx++;
1312 
1313 			m = NULL;
1314 		}
1315 	}
1316 	sc->sc_scowr_mbuf = m;
1317 
1318 	DPRINTFN(15, "isoc=%p, len=%d, space=%d\n", isoc, len, space);
1319 
1320 	if (len == 0)	/* nothing to send */
1321 		return;
1322 
1323 	sc->sc_refcnt++;
1324 	sc->sc_scowr_busy = 1;
1325 	sc->sc_stats.byte_tx += len;
1326 	isoc->busy = 1;
1327 
1328 	/*
1329 	 * calculate number of isoc frames and sizes
1330 	 */
1331 
1332 	for (num = 0 ; len > 0 ; num++) {
1333 		size = MIN(sc->sc_scowr_size, len);
1334 
1335 		isoc->size[num] = size;
1336 		len -= size;
1337 	}
1338 
1339 	usbd_setup_isoc_xfer(isoc->xfer,
1340 			     sc->sc_scowr_pipe,
1341 			     isoc,
1342 			     isoc->size,
1343 			     num,
1344 			     USBD_NO_COPY | USBD_FORCE_SHORT_XFER,
1345 			     ubt_xmit_sco_complete);
1346 
1347 	usbd_transfer(isoc->xfer);
1348 }
1349 
1350 static void
1351 ubt_xmit_sco_complete(usbd_xfer_handle xfer,
1352 		usbd_private_handle h, usbd_status status)
1353 {
1354 	struct ubt_isoc_xfer *isoc = h;
1355 	struct ubt_softc *sc;
1356 	int i;
1357 
1358 	KASSERT(xfer == isoc->xfer);
1359 	sc = isoc->softc;
1360 
1361 	DPRINTFN(15, "isoc=%p, status=%s (%d)\n",
1362 		isoc, usbd_errstr(status), status);
1363 
1364 	isoc->busy = 0;
1365 
1366 	for (i = 0 ; ; i++) {
1367 		if (i == UBT_NXFERS) {
1368 			sc->sc_scowr_busy = 0;
1369 			break;
1370 		}
1371 
1372 		if (sc->sc_scowr[i].busy)
1373 			break;
1374 	}
1375 
1376 	if (--sc->sc_refcnt < 0) {
1377 		usb_detach_wakeupold(sc->sc_dev);
1378 		return;
1379 	}
1380 
1381 	if (sc->sc_dying)
1382 		return;
1383 
1384 	if (status != USBD_NORMAL_COMPLETION) {
1385 		DPRINTF("status=%s (%d)\n",
1386 			usbd_errstr(status), status);
1387 
1388 		sc->sc_stats.err_tx++;
1389 
1390 		if (status == USBD_STALLED)
1391 			usbd_clear_endpoint_stall_async(sc->sc_scowr_pipe);
1392 		else
1393 			return;
1394 	}
1395 
1396 	ubt_xmit_sco_start(sc);
1397 }
1398 
1399 /*
1400  * load incoming data into an mbuf with
1401  * leading type byte
1402  */
1403 static struct mbuf *
1404 ubt_mbufload(uint8_t *buf, int count, uint8_t type)
1405 {
1406 	struct mbuf *m;
1407 
1408 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1409 	if (m == NULL)
1410 		return NULL;
1411 
1412 	*mtod(m, uint8_t *) = type;
1413 	m->m_pkthdr.len = m->m_len = MHLEN;
1414 	m_copyback(m, 1, count, buf);	// (extends if necessary)
1415 	if (m->m_pkthdr.len != MAX(MHLEN, count + 1)) {
1416 		m_free(m);
1417 		return NULL;
1418 	}
1419 
1420 	m->m_pkthdr.len = count + 1;
1421 	m->m_len = MIN(MHLEN, m->m_pkthdr.len);
1422 
1423 	return m;
1424 }
1425 
1426 static void
1427 ubt_recv_event(usbd_xfer_handle xfer, usbd_private_handle h, usbd_status status)
1428 {
1429 	struct ubt_softc *sc = h;
1430 	struct mbuf *m;
1431 	uint32_t count;
1432 	void *buf;
1433 
1434 	DPRINTFN(15, "sc=%p status=%s (%d)\n",
1435 		    sc, usbd_errstr(status), status);
1436 
1437 	if (status != USBD_NORMAL_COMPLETION || sc->sc_dying)
1438 		return;
1439 
1440 	usbd_get_xfer_status(xfer, NULL, &buf, &count, NULL);
1441 
1442 	if (count < sizeof(hci_event_hdr_t) - 1) {
1443 		DPRINTF("dumped undersized event (count = %d)\n", count);
1444 		sc->sc_stats.err_rx++;
1445 		return;
1446 	}
1447 
1448 	sc->sc_stats.evt_rx++;
1449 	sc->sc_stats.byte_rx += count;
1450 
1451 	m = ubt_mbufload(buf, count, HCI_EVENT_PKT);
1452 	if (m == NULL || !hci_input_event(sc->sc_unit, m))
1453 		sc->sc_stats.err_rx++;
1454 }
1455 
1456 static void
1457 ubt_recv_acl_start(struct ubt_softc *sc)
1458 {
1459 	usbd_status status;
1460 
1461 	DPRINTFN(15, "sc=%p\n", sc);
1462 
1463 	if (sc->sc_aclrd_busy || sc->sc_dying) {
1464 		DPRINTF("sc_aclrd_busy=%d, sc_dying=%d\n",
1465 			sc->sc_aclrd_busy,
1466 			sc->sc_dying);
1467 
1468 		return;
1469 	}
1470 
1471 	sc->sc_refcnt++;
1472 	sc->sc_aclrd_busy = 1;
1473 
1474 	usbd_setup_xfer(sc->sc_aclrd_xfer,
1475 			sc->sc_aclrd_pipe,
1476 			sc,
1477 			sc->sc_aclrd_buf,
1478 			UBT_BUFSIZ_ACL,
1479 			USBD_NO_COPY | USBD_SHORT_XFER_OK,
1480 			USBD_NO_TIMEOUT,
1481 			ubt_recv_acl_complete);
1482 
1483 	status = usbd_transfer(sc->sc_aclrd_xfer);
1484 
1485 	KASSERT(status != USBD_NORMAL_COMPLETION);
1486 
1487 	if (status != USBD_IN_PROGRESS) {
1488 		DPRINTF("usbd_transfer status=%s (%d)\n",
1489 			usbd_errstr(status), status);
1490 
1491 		sc->sc_refcnt--;
1492 		sc->sc_aclrd_busy = 0;
1493 	}
1494 }
1495 
1496 static void
1497 ubt_recv_acl_complete(usbd_xfer_handle xfer,
1498 		usbd_private_handle h, usbd_status status)
1499 {
1500 	struct ubt_softc *sc = h;
1501 	struct mbuf *m;
1502 	uint32_t count;
1503 	void *buf;
1504 
1505 	DPRINTFN(15, "sc=%p status=%s (%d)\n",
1506 			sc, usbd_errstr(status), status);
1507 
1508 	sc->sc_aclrd_busy = 0;
1509 
1510 	if (--sc->sc_refcnt < 0) {
1511 		DPRINTF("refcnt = %d\n", sc->sc_refcnt);
1512 		usb_detach_wakeupold(sc->sc_dev);
1513 		return;
1514 	}
1515 
1516 	if (sc->sc_dying) {
1517 		DPRINTF("sc_dying\n");
1518 		return;
1519 	}
1520 
1521 	if (status != USBD_NORMAL_COMPLETION) {
1522 		DPRINTF("status=%s (%d)\n",
1523 			usbd_errstr(status), status);
1524 
1525 		sc->sc_stats.err_rx++;
1526 
1527 		if (status == USBD_STALLED)
1528 			usbd_clear_endpoint_stall_async(sc->sc_aclrd_pipe);
1529 		else
1530 			return;
1531 	} else {
1532 		usbd_get_xfer_status(xfer, NULL, &buf, &count, NULL);
1533 
1534 		if (count < sizeof(hci_acldata_hdr_t) - 1) {
1535 			DPRINTF("dumped undersized packet (%d)\n", count);
1536 			sc->sc_stats.err_rx++;
1537 		} else {
1538 			sc->sc_stats.acl_rx++;
1539 			sc->sc_stats.byte_rx += count;
1540 
1541 			m = ubt_mbufload(buf, count, HCI_ACL_DATA_PKT);
1542 			if (m == NULL || !hci_input_acl(sc->sc_unit, m))
1543 				sc->sc_stats.err_rx++;
1544 		}
1545 	}
1546 
1547 	/* and restart */
1548 	ubt_recv_acl_start(sc);
1549 }
1550 
1551 static void
1552 ubt_recv_sco_start1(struct ubt_softc *sc, struct ubt_isoc_xfer *isoc)
1553 {
1554 	int i;
1555 
1556 	DPRINTFN(15, "sc=%p, isoc=%p\n", sc, isoc);
1557 
1558 	if (isoc->busy || sc->sc_dying || sc->sc_scord_size == 0) {
1559 		DPRINTF("%s%s%s\n",
1560 			isoc->busy ? " busy" : "",
1561 			sc->sc_dying ? " dying" : "",
1562 			sc->sc_scord_size == 0 ? " size=0" : "");
1563 
1564 		return;
1565 	}
1566 
1567 	sc->sc_refcnt++;
1568 	isoc->busy = 1;
1569 
1570 	for (i = 0 ; i < UBT_NFRAMES ; i++)
1571 		isoc->size[i] = sc->sc_scord_size;
1572 
1573 	usbd_setup_isoc_xfer(isoc->xfer,
1574 			     sc->sc_scord_pipe,
1575 			     isoc,
1576 			     isoc->size,
1577 			     UBT_NFRAMES,
1578 			     USBD_NO_COPY | USBD_SHORT_XFER_OK,
1579 			     ubt_recv_sco_complete);
1580 
1581 	usbd_transfer(isoc->xfer);
1582 }
1583 
1584 static void
1585 ubt_recv_sco_complete(usbd_xfer_handle xfer,
1586 		usbd_private_handle h, usbd_status status)
1587 {
1588 	struct ubt_isoc_xfer *isoc = h;
1589 	struct ubt_softc *sc;
1590 	struct mbuf *m;
1591 	uint32_t count;
1592 	uint8_t *ptr, *frame;
1593 	int i, size, got, want;
1594 
1595 	KASSERT(isoc != NULL);
1596 	KASSERT(isoc->xfer == xfer);
1597 
1598 	sc = isoc->softc;
1599 	isoc->busy = 0;
1600 
1601 	if (--sc->sc_refcnt < 0) {
1602 		DPRINTF("refcnt=%d\n", sc->sc_refcnt);
1603 		usb_detach_wakeupold(sc->sc_dev);
1604 		return;
1605 	}
1606 
1607 	if (sc->sc_dying) {
1608 		DPRINTF("sc_dying\n");
1609 		return;
1610 	}
1611 
1612 	if (status != USBD_NORMAL_COMPLETION) {
1613 		DPRINTF("status=%s (%d)\n",
1614 			usbd_errstr(status), status);
1615 
1616 		sc->sc_stats.err_rx++;
1617 
1618 		if (status == USBD_STALLED) {
1619 			usbd_clear_endpoint_stall_async(sc->sc_scord_pipe);
1620 			goto restart;
1621 		}
1622 
1623 		return;
1624 	}
1625 
1626 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1627 	if (count == 0)
1628 		goto restart;
1629 
1630 	DPRINTFN(15, "sc=%p, isoc=%p, count=%u\n",
1631 			sc, isoc, count);
1632 
1633 	sc->sc_stats.byte_rx += count;
1634 
1635 	/*
1636 	 * Extract SCO packets from ISOC frames. The way we have it,
1637 	 * no SCO packet can be bigger than MHLEN. This is unlikely
1638 	 * to actually happen, but if we ran out of mbufs and lost
1639 	 * sync then we may get spurious data that makes it seem that
1640 	 * way, so we discard data that wont fit. This doesnt really
1641 	 * help with the lost sync situation alas.
1642 	 */
1643 
1644 	m = sc->sc_scord_mbuf;
1645 	if (m != NULL) {
1646 		sc->sc_scord_mbuf = NULL;
1647 		ptr = mtod(m, uint8_t *) + m->m_pkthdr.len;
1648 		got = m->m_pkthdr.len;
1649 		want = sizeof(hci_scodata_hdr_t);
1650 		if (got >= want)
1651 			want += mtod(m, hci_scodata_hdr_t *)->length ;
1652 	} else {
1653 		ptr = NULL;
1654 		got = 0;
1655 		want = 0;
1656 	}
1657 
1658 	for (i = 0 ; i < UBT_NFRAMES ; i++) {
1659 		frame = isoc->buf + (i * sc->sc_scord_size);
1660 
1661 		while (isoc->size[i] > 0) {
1662 			size = isoc->size[i];
1663 
1664 			if (m == NULL) {
1665 				MGETHDR(m, M_DONTWAIT, MT_DATA);
1666 				if (m == NULL) {
1667 					aprint_error_dev(sc->sc_dev,
1668 					    "out of memory (xfer halted)\n");
1669 
1670 					sc->sc_stats.err_rx++;
1671 					return;		/* lost sync */
1672 				}
1673 
1674 				ptr = mtod(m, uint8_t *);
1675 				*ptr++ = HCI_SCO_DATA_PKT;
1676 				got = 1;
1677 				want = sizeof(hci_scodata_hdr_t);
1678 			}
1679 
1680 			if (got + size > want)
1681 				size = want - got;
1682 
1683 			memcpy(ptr, frame, size);
1684 
1685 			ptr += size;
1686 			got += size;
1687 			frame += size;
1688 
1689 			if (got == want) {
1690 				/*
1691 				 * If we only got a header, add the packet
1692 				 * length to our want count. Send complete
1693 				 * packets up to protocol stack.
1694 				 */
1695 				if (want == sizeof(hci_scodata_hdr_t)) {
1696 					uint32_t len =
1697 					    mtod(m, hci_scodata_hdr_t *)->length;
1698 					want += len;
1699 					if (len == 0 || want > MHLEN) {
1700 						aprint_error_dev(sc->sc_dev,
1701 						    "packet too large %u "
1702 						    "(lost sync)\n", len);
1703 						sc->sc_stats.err_rx++;
1704 						return;
1705 					}
1706 				}
1707 
1708 				if (got == want) {
1709 					m->m_pkthdr.len = m->m_len = got;
1710 					sc->sc_stats.sco_rx++;
1711 					if (!hci_input_sco(sc->sc_unit, m))
1712 						sc->sc_stats.err_rx++;
1713 
1714 					m = NULL;
1715 				}
1716 			}
1717 
1718 			isoc->size[i] -= size;
1719 		}
1720 	}
1721 
1722 	if (m != NULL) {
1723 		m->m_pkthdr.len = m->m_len = got;
1724 		sc->sc_scord_mbuf = m;
1725 	}
1726 
1727 restart: /* and restart */
1728 	ubt_recv_sco_start1(sc, isoc);
1729 }
1730 
1731 void
1732 ubt_stats(device_t self, struct bt_stats *dest, int flush)
1733 {
1734 	struct ubt_softc *sc = device_private(self);
1735 	int s;
1736 
1737 	s = splusb();
1738 	memcpy(dest, &sc->sc_stats, sizeof(struct bt_stats));
1739 
1740 	if (flush)
1741 		memset(&sc->sc_stats, 0, sizeof(struct bt_stats));
1742 
1743 	splx(s);
1744 }
1745