xref: /netbsd-src/sys/dev/usb/ubt.c (revision a24efa7dea9f1f56c3bdb15a927d3516792ace1c)
1 /*	$NetBSD: ubt.c,v 1.54 2016/04/23 10:15:32 skrll Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006 Itronix Inc.
5  * All rights reserved.
6  *
7  * Written by Iain Hibbert for Itronix Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of Itronix Inc. may not be used to endorse
18  *    or promote products derived from this software without specific
19  *    prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28  * ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 /*
34  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
35  * All rights reserved.
36  *
37  * This code is derived from software contributed to The NetBSD Foundation
38  * by Lennart Augustsson (lennart@augustsson.net) and
39  * David Sainty (David.Sainty@dtsp.co.nz).
40  *
41  * Redistribution and use in source and binary forms, with or without
42  * modification, are permitted provided that the following conditions
43  * are met:
44  * 1. Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  * 2. Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in the
48  *    documentation and/or other materials provided with the distribution.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
51  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
52  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
53  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
54  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
55  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
56  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
57  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
58  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
59  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
60  * POSSIBILITY OF SUCH DAMAGE.
61  */
62 /*
63  * This driver originally written by Lennart Augustsson and David Sainty,
64  * but was mostly rewritten for the NetBSD Bluetooth protocol stack by
65  * Iain Hibbert for Itronix, Inc using the FreeBSD ng_ubt.c driver as a
66  * reference.
67  */
68 
69 #include <sys/cdefs.h>
70 __KERNEL_RCSID(0, "$NetBSD: ubt.c,v 1.54 2016/04/23 10:15:32 skrll Exp $");
71 
72 #include <sys/param.h>
73 #include <sys/device.h>
74 #include <sys/ioctl.h>
75 #include <sys/kernel.h>
76 #include <sys/kmem.h>
77 #include <sys/mbuf.h>
78 #include <sys/proc.h>
79 #include <sys/sysctl.h>
80 #include <sys/systm.h>
81 
82 #include <dev/usb/usb.h>
83 #include <dev/usb/usbdi.h>
84 #include <dev/usb/usbdi_util.h>
85 #include <dev/usb/usbdevs.h>
86 
87 #include <netbt/bluetooth.h>
88 #include <netbt/hci.h>
89 
90 /*******************************************************************************
91  *
92  *	debugging stuff
93  */
94 #undef DPRINTF
95 #undef DPRINTFN
96 
97 #ifdef UBT_DEBUG
98 int	ubt_debug = 0;
99 
100 #define DPRINTF(...)		do {		\
101 	if (ubt_debug) {			\
102 		printf("%s: ", __func__);	\
103 		printf(__VA_ARGS__);		\
104 	}					\
105 } while (/* CONSTCOND */0)
106 
107 #define DPRINTFN(n, ...)	do {		\
108 	if (ubt_debug > (n)) {			\
109 		printf("%s: ", __func__);	\
110 		printf(__VA_ARGS__);		\
111 	}					\
112 } while (/* CONSTCOND */0)
113 
114 SYSCTL_SETUP(sysctl_hw_ubt_debug_setup, "sysctl hw.ubt_debug setup")
115 {
116 
117 	sysctl_createv(NULL, 0, NULL, NULL,
118 		CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
119 		CTLTYPE_INT, "ubt_debug",
120 		SYSCTL_DESCR("ubt debug level"),
121 		NULL, 0,
122 		&ubt_debug, sizeof(ubt_debug),
123 		CTL_HW, CTL_CREATE, CTL_EOL);
124 }
125 #else
126 #define DPRINTF(...)
127 #define DPRINTFN(...)
128 #endif
129 
130 /*******************************************************************************
131  *
132  *	ubt softc structure
133  *
134  */
135 
136 /* buffer sizes */
137 /*
138  * NB: although ACL packets can extend to 65535 bytes, most devices
139  * have max_acl_size at much less (largest I have seen is 384)
140  */
141 #define UBT_BUFSIZ_CMD		(HCI_CMD_PKT_SIZE - 1)
142 #define UBT_BUFSIZ_ACL		(2048 - 1)
143 #define UBT_BUFSIZ_EVENT	(HCI_EVENT_PKT_SIZE - 1)
144 
145 /* Transmit timeouts */
146 #define UBT_CMD_TIMEOUT		USBD_DEFAULT_TIMEOUT
147 #define UBT_ACL_TIMEOUT		USBD_DEFAULT_TIMEOUT
148 
149 /*
150  * ISOC transfers
151  *
152  * xfer buffer size depends on the frame size, and the number
153  * of frames per transfer is fixed, as each frame should be
154  * 1ms worth of data. This keeps the rate that xfers complete
155  * fairly constant. We use multiple xfers to keep the hardware
156  * busy
157  */
158 #define UBT_NXFERS		3	/* max xfers to queue */
159 #define UBT_NFRAMES		10	/* frames per xfer */
160 
161 struct ubt_isoc_xfer {
162 	struct ubt_softc	*softc;
163 	struct usbd_xfer	*xfer;
164 	uint8_t			*buf;
165 	uint16_t		 size[UBT_NFRAMES];
166 	int			 busy;
167 };
168 
169 struct ubt_softc {
170 	device_t		 sc_dev;
171 	struct usbd_device	*sc_udev;
172 	int			 sc_refcnt;
173 	int			 sc_dying;
174 	int			 sc_enabled;
175 
176 	/* Control Interface */
177 	struct usbd_interface *	 sc_iface0;
178 
179 	/* Commands (control) */
180 	struct usbd_xfer	*sc_cmd_xfer;
181 	uint8_t			*sc_cmd_buf;
182 	int			 sc_cmd_busy;	/* write active */
183 	MBUFQ_HEAD()		 sc_cmd_queue;	/* output queue */
184 
185 	/* Events (interrupt) */
186 	int			 sc_evt_addr;	/* endpoint address */
187 	struct usbd_pipe	*sc_evt_pipe;
188 	uint8_t			*sc_evt_buf;
189 
190 	/* ACL data (in) */
191 	int			 sc_aclrd_addr;	/* endpoint address */
192 	struct usbd_pipe	*sc_aclrd_pipe;	/* read pipe */
193 	struct usbd_xfer	*sc_aclrd_xfer;	/* read xfer */
194 	uint8_t			*sc_aclrd_buf;	/* read buffer */
195 	int			 sc_aclrd_busy;	/* reading */
196 
197 	/* ACL data (out) */
198 	int			 sc_aclwr_addr;	/* endpoint address */
199 	struct usbd_pipe	*sc_aclwr_pipe;	/* write pipe */
200 	struct usbd_xfer	*sc_aclwr_xfer;	/* write xfer */
201 	uint8_t			*sc_aclwr_buf;	/* write buffer */
202 	int			 sc_aclwr_busy;	/* write active */
203 	MBUFQ_HEAD()		 sc_aclwr_queue;/* output queue */
204 
205 	/* ISOC interface */
206 	struct usbd_interface	*sc_iface1;	/* ISOC interface */
207 	struct sysctllog	*sc_log;	/* sysctl log */
208 	int			 sc_config;	/* current config no */
209 	int			 sc_alt_config;	/* no of alternates */
210 
211 	/* SCO data (in) */
212 	int			 sc_scord_addr;	/* endpoint address */
213 	struct usbd_pipe	*sc_scord_pipe;	/* read pipe */
214 	int			 sc_scord_size;	/* frame length */
215 	struct ubt_isoc_xfer	 sc_scord[UBT_NXFERS];
216 	struct mbuf		*sc_scord_mbuf;	/* current packet */
217 
218 	/* SCO data (out) */
219 	int			 sc_scowr_addr;	/* endpoint address */
220 	struct usbd_pipe	*sc_scowr_pipe;	/* write pipe */
221 	int			 sc_scowr_size;	/* frame length */
222 	struct ubt_isoc_xfer	 sc_scowr[UBT_NXFERS];
223 	struct mbuf		*sc_scowr_mbuf;	/* current packet */
224 	int			 sc_scowr_busy;	/* write active */
225 	MBUFQ_HEAD()		 sc_scowr_queue;/* output queue */
226 
227 	/* Protocol structure */
228 	struct hci_unit		*sc_unit;
229 	struct bt_stats		 sc_stats;
230 
231 	/* Successfully attached */
232 	int			 sc_ok;
233 };
234 
235 /*******************************************************************************
236  *
237  * Bluetooth unit/USB callback routines
238  *
239  */
240 static int ubt_enable(device_t);
241 static void ubt_disable(device_t);
242 
243 static void ubt_xmit_cmd(device_t, struct mbuf *);
244 static void ubt_xmit_cmd_start(struct ubt_softc *);
245 static void ubt_xmit_cmd_complete(struct usbd_xfer *,
246 				void *, usbd_status);
247 
248 static void ubt_xmit_acl(device_t, struct mbuf *);
249 static void ubt_xmit_acl_start(struct ubt_softc *);
250 static void ubt_xmit_acl_complete(struct usbd_xfer *,
251 				void *, usbd_status);
252 
253 static void ubt_xmit_sco(device_t, struct mbuf *);
254 static void ubt_xmit_sco_start(struct ubt_softc *);
255 static void ubt_xmit_sco_start1(struct ubt_softc *, struct ubt_isoc_xfer *);
256 static void ubt_xmit_sco_complete(struct usbd_xfer *,
257 				void *, usbd_status);
258 
259 static void ubt_recv_event(struct usbd_xfer *,
260 				void *, usbd_status);
261 
262 static void ubt_recv_acl_start(struct ubt_softc *);
263 static void ubt_recv_acl_complete(struct usbd_xfer *,
264 				void *, usbd_status);
265 
266 static void ubt_recv_sco_start1(struct ubt_softc *, struct ubt_isoc_xfer *);
267 static void ubt_recv_sco_complete(struct usbd_xfer *,
268 				void *, usbd_status);
269 
270 static void ubt_stats(device_t, struct bt_stats *, int);
271 
272 static const struct hci_if ubt_hci = {
273 	.enable = ubt_enable,
274 	.disable = ubt_disable,
275 	.output_cmd = ubt_xmit_cmd,
276 	.output_acl = ubt_xmit_acl,
277 	.output_sco = ubt_xmit_sco,
278 	.get_stats = ubt_stats,
279 	.ipl = IPL_SOFTUSB,
280 };
281 
282 /*******************************************************************************
283  *
284  * USB Autoconfig stuff
285  *
286  */
287 
288 int             ubt_match(device_t, cfdata_t, void *);
289 void            ubt_attach(device_t, device_t, void *);
290 int             ubt_detach(device_t, int);
291 int             ubt_activate(device_t, enum devact);
292 extern struct cfdriver ubt_cd;
293 CFATTACH_DECL_NEW(ubt, sizeof(struct ubt_softc), ubt_match, ubt_attach, ubt_detach, ubt_activate);
294 
295 static int ubt_set_isoc_config(struct ubt_softc *);
296 static int ubt_sysctl_config(SYSCTLFN_PROTO);
297 static void ubt_abortdealloc(struct ubt_softc *);
298 
299 /*
300  * To match or ignore, add details to the ubt_dev list.
301  * Use value of -1 to indicate a wildcard
302  * To override another entry, add details earlier
303  */
304 const struct ubt_devno {
305 	int			vendor;
306 	int			product;
307 	int			class;
308 	int			subclass;
309 	int			proto;
310 	int			match;
311 } ubt_dev[] = {
312 	{   /* ignore Broadcom 2033 without firmware */
313 	    USB_VENDOR_BROADCOM,
314 	    USB_PRODUCT_BROADCOM_BCM2033NF,
315 	    -1,
316 	    -1,
317 	    -1,
318 	    UMATCH_NONE
319 	},
320 	{   /* Apple Bluetooth Host Controller MacbookPro 7,1 */
321 	    USB_VENDOR_APPLE,
322 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_1,
323 	    -1,
324 	    -1,
325 	    -1,
326 	    UMATCH_VENDOR_PRODUCT
327 	},
328 	{   /* Apple Bluetooth Host Controller iMac 11,1 */
329 	    USB_VENDOR_APPLE,
330 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_2,
331 	    -1,
332 	    -1,
333 	    -1,
334 	    UMATCH_VENDOR_PRODUCT
335 	},
336 	{   /* Apple Bluetooth Host Controller MacBookPro 8,2 */
337 	    USB_VENDOR_APPLE,
338 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_3,
339 	    -1,
340 	    -1,
341 	    -1,
342 	    UMATCH_VENDOR_PRODUCT
343 	},
344 	{   /* Apple Bluetooth Host Controller MacBookAir 3,1 3,2*/
345 	    USB_VENDOR_APPLE,
346 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_4,
347 	    -1,
348 	    -1,
349 	    -1,
350 	    UMATCH_VENDOR_PRODUCT
351 	},
352 	{   /* Apple Bluetooth Host Controller MacBookAir 4,1 */
353 	    USB_VENDOR_APPLE,
354 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_5,
355 	    -1,
356 	    -1,
357 	    -1,
358 	    UMATCH_VENDOR_PRODUCT
359 	},
360 	{   /* Apple Bluetooth Host Controller MacMini 5,1 */
361 	    USB_VENDOR_APPLE,
362 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_6,
363 	    -1,
364 	    -1,
365 	    -1,
366 	    UMATCH_VENDOR_PRODUCT
367 	},
368 	{   /* Apple Bluetooth Host Controller MacBookAir 6,1 */
369 	    USB_VENDOR_APPLE,
370 	    USB_PRODUCT_APPLE_BLUETOOTH_HOST_7,
371 	    -1,
372 	    -1,
373 	    -1,
374 	    UMATCH_VENDOR_PRODUCT
375 	},
376 	{   /* Broadcom chips with PatchRAM support */
377 	    USB_VENDOR_BROADCOM,
378 	    -1,
379 	    UDCLASS_VENDOR,
380 	    UDSUBCLASS_RF,
381 	    UDPROTO_BLUETOOTH,
382 	    UMATCH_VENDOR_DEVCLASS_DEVPROTO
383 	},
384 	{   /* Broadcom based device with PatchRAM support */
385 	    USB_VENDOR_FOXCONN,
386 	    -1,
387 	    UDCLASS_VENDOR,
388 	    UDSUBCLASS_RF,
389 	    UDPROTO_BLUETOOTH,
390 	    UMATCH_VENDOR_DEVCLASS_DEVPROTO
391 	},
392 	{   /* Broadcom based device with PatchRAM support */
393 	    USB_VENDOR_LITEON,
394 	    -1,
395 	    UDCLASS_VENDOR,
396 	    UDSUBCLASS_RF,
397 	    UDPROTO_BLUETOOTH,
398 	    UMATCH_VENDOR_DEVCLASS_DEVPROTO
399 	},
400 	{   /* Broadcom based device with PatchRAM support */
401 	    USB_VENDOR_BELKIN,
402 	    -1,
403 	    UDCLASS_VENDOR,
404 	    UDSUBCLASS_RF,
405 	    UDPROTO_BLUETOOTH,
406 	    UMATCH_VENDOR_DEVCLASS_DEVPROTO
407 	},
408 	{   /* Broadcom based device with PatchRAM support */
409 	    USB_VENDOR_TOSHIBA,
410 	    -1,
411 	    UDCLASS_VENDOR,
412 	    UDSUBCLASS_RF,
413 	    UDPROTO_BLUETOOTH,
414 	    UMATCH_VENDOR_DEVCLASS_DEVPROTO
415 	},
416 	{   /* Broadcom based device with PatchRAM support */
417 	    USB_VENDOR_ASUSTEK,
418 	    -1,
419 	    UDCLASS_VENDOR,
420 	    UDSUBCLASS_RF,
421 	    UDPROTO_BLUETOOTH,
422 	    UMATCH_VENDOR_DEVCLASS_DEVPROTO
423 	},
424 	{   /* Generic Bluetooth SIG compliant devices */
425 	    -1,
426 	    -1,
427 	    UDCLASS_WIRELESS,
428 	    UDSUBCLASS_RF,
429 	    UDPROTO_BLUETOOTH,
430 	    UMATCH_DEVCLASS_DEVSUBCLASS_DEVPROTO
431 	},
432 };
433 
434 int
435 ubt_match(device_t parent, cfdata_t match, void *aux)
436 {
437 	struct usb_attach_arg *uaa = aux;
438 	size_t i;
439 
440 	DPRINTFN(50, "ubt_match\n");
441 
442 	for (i = 0; i < __arraycount(ubt_dev); i++) {
443 		if (ubt_dev[i].vendor != -1
444 		    && ubt_dev[i].vendor != (int)uaa->uaa_vendor)
445 			continue;
446 		if (ubt_dev[i].product != -1
447 		    && ubt_dev[i].product != (int)uaa->uaa_product)
448 			continue;
449 		if (ubt_dev[i].class != -1
450 		    && ubt_dev[i].class != uaa->uaa_class)
451 			continue;
452 		if (ubt_dev[i].subclass != -1
453 		    && ubt_dev[i].subclass != uaa->uaa_subclass)
454 			continue;
455 		if (ubt_dev[i].proto != -1
456 		    && ubt_dev[i].proto != uaa->uaa_proto)
457 			continue;
458 
459 		return ubt_dev[i].match;
460 	}
461 
462 	return UMATCH_NONE;
463 }
464 
465 void
466 ubt_attach(device_t parent, device_t self, void *aux)
467 {
468 	struct ubt_softc *sc = device_private(self);
469 	struct usb_attach_arg *uaa = aux;
470 	usb_config_descriptor_t *cd;
471 	usb_endpoint_descriptor_t *ed;
472 	const struct sysctlnode *node;
473 	char *devinfop;
474 	int err;
475 	uint8_t count, i;
476 
477 	DPRINTFN(50, "ubt_attach: sc=%p\n", sc);
478 
479 	sc->sc_dev = self;
480 	sc->sc_udev = uaa->uaa_device;
481 
482 	MBUFQ_INIT(&sc->sc_cmd_queue);
483 	MBUFQ_INIT(&sc->sc_aclwr_queue);
484 	MBUFQ_INIT(&sc->sc_scowr_queue);
485 
486 	aprint_naive("\n");
487 	aprint_normal("\n");
488 
489 	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
490 	aprint_normal_dev(self, "%s\n", devinfop);
491 	usbd_devinfo_free(devinfop);
492 
493 	/*
494 	 * Move the device into the configured state
495 	 */
496 	err = usbd_set_config_index(sc->sc_udev, 0, 1);
497 	if (err) {
498 		aprint_error_dev(self, "failed to set configuration idx 0: %s\n",
499 		    usbd_errstr(err));
500 
501 		return;
502 	}
503 
504 	/*
505 	 * Interface 0 must have 3 endpoints
506 	 *	1) Interrupt endpoint to receive HCI events
507 	 *	2) Bulk IN endpoint to receive ACL data
508 	 *	3) Bulk OUT endpoint to send ACL data
509 	 */
510 	err = usbd_device2interface_handle(sc->sc_udev, 0, &sc->sc_iface0);
511 	if (err) {
512 		aprint_error_dev(self, "Could not get interface 0 handle %s (%d)\n",
513 				usbd_errstr(err), err);
514 
515 		return;
516 	}
517 
518 	sc->sc_evt_addr = -1;
519 	sc->sc_aclrd_addr = -1;
520 	sc->sc_aclwr_addr = -1;
521 
522 	count = 0;
523 	(void)usbd_endpoint_count(sc->sc_iface0, &count);
524 
525 	for (i = 0 ; i < count ; i++) {
526 		int dir, type;
527 
528 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface0, i);
529 		if (ed == NULL) {
530 			aprint_error_dev(self,
531 			    "could not read endpoint descriptor %d\n", i);
532 
533 			return;
534 		}
535 
536 		dir = UE_GET_DIR(ed->bEndpointAddress);
537 		type = UE_GET_XFERTYPE(ed->bmAttributes);
538 
539 		if (dir == UE_DIR_IN && type == UE_INTERRUPT)
540 			sc->sc_evt_addr = ed->bEndpointAddress;
541 		else if (dir == UE_DIR_IN && type == UE_BULK)
542 			sc->sc_aclrd_addr = ed->bEndpointAddress;
543 		else if (dir == UE_DIR_OUT && type == UE_BULK)
544 			sc->sc_aclwr_addr = ed->bEndpointAddress;
545 	}
546 
547 	if (sc->sc_evt_addr == -1) {
548 		aprint_error_dev(self,
549 		    "missing INTERRUPT endpoint on interface 0\n");
550 
551 		return;
552 	}
553 	if (sc->sc_aclrd_addr == -1) {
554 		aprint_error_dev(self,
555 		    "missing BULK IN endpoint on interface 0\n");
556 
557 		return;
558 	}
559 	if (sc->sc_aclwr_addr == -1) {
560 		aprint_error_dev(self,
561 		    "missing BULK OUT endpoint on interface 0\n");
562 
563 		return;
564 	}
565 
566 	/*
567 	 * Interface 1 must have 2 endpoints
568 	 *	1) Isochronous IN endpoint to receive SCO data
569 	 *	2) Isochronous OUT endpoint to send SCO data
570 	 *
571 	 * and will have several configurations, which can be selected
572 	 * via a sysctl variable. We select config 0 to start, which
573 	 * means that no SCO data will be available.
574 	 */
575 	err = usbd_device2interface_handle(sc->sc_udev, 1, &sc->sc_iface1);
576 	if (err) {
577 		aprint_error_dev(self,
578 		    "Could not get interface 1 handle %s (%d)\n",
579 		    usbd_errstr(err), err);
580 
581 		return;
582 	}
583 
584 	cd = usbd_get_config_descriptor(sc->sc_udev);
585 	if (cd == NULL) {
586 		aprint_error_dev(self, "could not get config descriptor\n");
587 
588 		return;
589 	}
590 
591 	sc->sc_alt_config = usbd_get_no_alts(cd, 1);
592 
593 	/* set initial config */
594 	err = ubt_set_isoc_config(sc);
595 	if (err) {
596 		aprint_error_dev(self, "ISOC config failed\n");
597 
598 		return;
599 	}
600 
601 	/* Attach HCI */
602 	sc->sc_unit = hci_attach_pcb(&ubt_hci, sc->sc_dev, 0);
603 
604 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
605 			   sc->sc_dev);
606 
607 	/* sysctl set-up for alternate configs */
608 	sysctl_createv(&sc->sc_log, 0, NULL, &node,
609 		0,
610 		CTLTYPE_NODE, device_xname(sc->sc_dev),
611 		SYSCTL_DESCR("ubt driver information"),
612 		NULL, 0,
613 		NULL, 0,
614 		CTL_HW,
615 		CTL_CREATE, CTL_EOL);
616 
617 	if (node != NULL) {
618 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
619 			CTLFLAG_READWRITE,
620 			CTLTYPE_INT, "config",
621 			SYSCTL_DESCR("configuration number"),
622 			ubt_sysctl_config, 0,
623 			(void *)sc, 0,
624 			CTL_HW, node->sysctl_num,
625 			CTL_CREATE, CTL_EOL);
626 
627 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
628 			CTLFLAG_READONLY,
629 			CTLTYPE_INT, "alt_config",
630 			SYSCTL_DESCR("number of alternate configurations"),
631 			NULL, 0,
632 			&sc->sc_alt_config, sizeof(sc->sc_alt_config),
633 			CTL_HW, node->sysctl_num,
634 			CTL_CREATE, CTL_EOL);
635 
636 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
637 			CTLFLAG_READONLY,
638 			CTLTYPE_INT, "sco_rxsize",
639 			SYSCTL_DESCR("max SCO receive size"),
640 			NULL, 0,
641 			&sc->sc_scord_size, sizeof(sc->sc_scord_size),
642 			CTL_HW, node->sysctl_num,
643 			CTL_CREATE, CTL_EOL);
644 
645 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
646 			CTLFLAG_READONLY,
647 			CTLTYPE_INT, "sco_txsize",
648 			SYSCTL_DESCR("max SCO transmit size"),
649 			NULL, 0,
650 			&sc->sc_scowr_size, sizeof(sc->sc_scowr_size),
651 			CTL_HW, node->sysctl_num,
652 			CTL_CREATE, CTL_EOL);
653 	}
654 
655 	sc->sc_ok = 1;
656 
657 	if (!pmf_device_register(self, NULL, NULL))
658 		aprint_error_dev(self, "couldn't establish power handler\n");
659 
660 	return;
661 }
662 
663 int
664 ubt_detach(device_t self, int flags)
665 {
666 	struct ubt_softc *sc = device_private(self);
667 	int s;
668 
669 	DPRINTF("sc=%p flags=%d\n", sc, flags);
670 
671 	pmf_device_deregister(self);
672 
673 	sc->sc_dying = 1;
674 
675 	if (!sc->sc_ok)
676 		return 0;
677 
678 	/* delete sysctl nodes */
679 	sysctl_teardown(&sc->sc_log);
680 
681 	/* Detach HCI interface */
682 	if (sc->sc_unit) {
683 		hci_detach_pcb(sc->sc_unit);
684 		sc->sc_unit = NULL;
685 	}
686 
687 	/*
688 	 * Abort all pipes. Causes processes waiting for transfer to wake.
689 	 *
690 	 * Actually, hci_detach_pcb() above will call ubt_disable() which
691 	 * may call ubt_abortdealloc(), but lets be sure since doing it
692 	 * twice wont cause an error.
693 	 */
694 	ubt_abortdealloc(sc);
695 
696 	/* wait for all processes to finish */
697 	s = splusb();
698 	if (sc->sc_refcnt-- > 0)
699 		usb_detach_waitold(sc->sc_dev);
700 
701 	splx(s);
702 
703 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
704 			   sc->sc_dev);
705 
706 	DPRINTFN(1, "driver detached\n");
707 
708 	return 0;
709 }
710 
711 int
712 ubt_activate(device_t self, enum devact act)
713 {
714 	struct ubt_softc *sc = device_private(self);
715 
716 	DPRINTFN(1, "sc=%p, act=%d\n", sc, act);
717 
718 	switch (act) {
719 	case DVACT_DEACTIVATE:
720 		sc->sc_dying = 1;
721 		return 0;
722 	default:
723 		return EOPNOTSUPP;
724 	}
725 }
726 
727 /* set ISOC configuration */
728 static int
729 ubt_set_isoc_config(struct ubt_softc *sc)
730 {
731 	usb_endpoint_descriptor_t *ed;
732 	int rd_addr, wr_addr, rd_size, wr_size;
733 	uint8_t count, i;
734 	int err;
735 
736 	err = usbd_set_interface(sc->sc_iface1, sc->sc_config);
737 	if (err != USBD_NORMAL_COMPLETION) {
738 		aprint_error_dev(sc->sc_dev,
739 		    "Could not set config %d on ISOC interface. %s (%d)\n",
740 		    sc->sc_config, usbd_errstr(err), err);
741 
742 		return err == USBD_IN_USE ? EBUSY : EIO;
743 	}
744 
745 	/*
746 	 * We wont get past the above if there are any pipes open, so no
747 	 * need to worry about buf/xfer/pipe deallocation. If we get an
748 	 * error after this, the frame quantities will be 0 and no SCO
749 	 * data will be possible.
750 	 */
751 
752 	sc->sc_scord_size = rd_size = 0;
753 	sc->sc_scord_addr = rd_addr = -1;
754 
755 	sc->sc_scowr_size = wr_size = 0;
756 	sc->sc_scowr_addr = wr_addr = -1;
757 
758 	count = 0;
759 	(void)usbd_endpoint_count(sc->sc_iface1, &count);
760 
761 	for (i = 0 ; i < count ; i++) {
762 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface1, i);
763 		if (ed == NULL) {
764 			aprint_error_dev(sc->sc_dev,
765 			    "could not read endpoint descriptor %d\n", i);
766 
767 			return EIO;
768 		}
769 
770 		DPRINTFN(5, "%s: endpoint type %02x (%02x) addr %02x (%s)\n",
771 			device_xname(sc->sc_dev),
772 			UE_GET_XFERTYPE(ed->bmAttributes),
773 			UE_GET_ISO_TYPE(ed->bmAttributes),
774 			ed->bEndpointAddress,
775 			UE_GET_DIR(ed->bEndpointAddress) ? "in" : "out");
776 
777 		if (UE_GET_XFERTYPE(ed->bmAttributes) != UE_ISOCHRONOUS)
778 			continue;
779 
780 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) {
781 			rd_addr = ed->bEndpointAddress;
782 			rd_size = UGETW(ed->wMaxPacketSize);
783 		} else {
784 			wr_addr = ed->bEndpointAddress;
785 			wr_size = UGETW(ed->wMaxPacketSize);
786 		}
787 	}
788 
789 	if (rd_addr == -1) {
790 		aprint_error_dev(sc->sc_dev,
791 		    "missing ISOC IN endpoint on interface config %d\n",
792 		    sc->sc_config);
793 
794 		return ENOENT;
795 	}
796 	if (wr_addr == -1) {
797 		aprint_error_dev(sc->sc_dev,
798 		    "missing ISOC OUT endpoint on interface config %d\n",
799 		    sc->sc_config);
800 
801 		return ENOENT;
802 	}
803 
804 	if (rd_size > MLEN) {
805 		aprint_error_dev(sc->sc_dev, "rd_size=%d exceeds MLEN\n",
806 		    rd_size);
807 
808 		return EOVERFLOW;
809 	}
810 
811 	if (wr_size > MLEN) {
812 		aprint_error_dev(sc->sc_dev, "wr_size=%d exceeds MLEN\n",
813 		    wr_size);
814 
815 		return EOVERFLOW;
816 	}
817 
818 	sc->sc_scord_size = rd_size;
819 	sc->sc_scord_addr = rd_addr;
820 
821 	sc->sc_scowr_size = wr_size;
822 	sc->sc_scowr_addr = wr_addr;
823 
824 	return 0;
825 }
826 
827 /* sysctl helper to set alternate configurations */
828 static int
829 ubt_sysctl_config(SYSCTLFN_ARGS)
830 {
831 	struct sysctlnode node;
832 	struct ubt_softc *sc;
833 	int t, error;
834 
835 	node = *rnode;
836 	sc = node.sysctl_data;
837 
838 	t = sc->sc_config;
839 	node.sysctl_data = &t;
840 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
841 	if (error || newp == NULL)
842 		return error;
843 
844 	if (t < 0 || t >= sc->sc_alt_config)
845 		return EINVAL;
846 
847 	/* This may not change when the unit is enabled */
848 	if (sc->sc_enabled)
849 		return EBUSY;
850 
851 	KERNEL_LOCK(1, curlwp);
852 	sc->sc_config = t;
853 	error = ubt_set_isoc_config(sc);
854 	KERNEL_UNLOCK_ONE(curlwp);
855 	return error;
856 }
857 
858 static void
859 ubt_abortdealloc(struct ubt_softc *sc)
860 {
861 	int i;
862 
863 	DPRINTFN(1, "sc=%p\n", sc);
864 
865 	/* Abort all pipes */
866 	usbd_abort_default_pipe(sc->sc_udev);
867 
868 	if (sc->sc_evt_pipe != NULL) {
869 		usbd_abort_pipe(sc->sc_evt_pipe);
870 	}
871 
872 	if (sc->sc_aclrd_pipe != NULL) {
873 		usbd_abort_pipe(sc->sc_aclrd_pipe);
874 	}
875 
876 	if (sc->sc_aclwr_pipe != NULL) {
877 		usbd_abort_pipe(sc->sc_aclwr_pipe);
878 	}
879 
880 	if (sc->sc_scord_pipe != NULL) {
881 		usbd_abort_pipe(sc->sc_scord_pipe);
882 	}
883 
884 	if (sc->sc_scowr_pipe != NULL) {
885 		usbd_abort_pipe(sc->sc_scowr_pipe);
886 	}
887 
888 	/* Free event buffer */
889 	if (sc->sc_evt_buf != NULL) {
890 		kmem_free(sc->sc_evt_buf, UBT_BUFSIZ_EVENT);
891 		sc->sc_evt_buf = NULL;
892 	}
893 
894 	/* Free all xfers and xfer buffers (implicit) */
895 	if (sc->sc_cmd_xfer != NULL) {
896 		usbd_destroy_xfer(sc->sc_cmd_xfer);
897 		sc->sc_cmd_xfer = NULL;
898 		sc->sc_cmd_buf = NULL;
899 	}
900 
901 	if (sc->sc_aclrd_xfer != NULL) {
902 		usbd_destroy_xfer(sc->sc_aclrd_xfer);
903 		sc->sc_aclrd_xfer = NULL;
904 		sc->sc_aclrd_buf = NULL;
905 	}
906 
907 	if (sc->sc_aclwr_xfer != NULL) {
908 		usbd_destroy_xfer(sc->sc_aclwr_xfer);
909 		sc->sc_aclwr_xfer = NULL;
910 		sc->sc_aclwr_buf = NULL;
911 	}
912 
913 	for (i = 0 ; i < UBT_NXFERS ; i++) {
914 		if (sc->sc_scord[i].xfer != NULL) {
915 			usbd_destroy_xfer(sc->sc_scord[i].xfer);
916 			sc->sc_scord[i].xfer = NULL;
917 			sc->sc_scord[i].buf = NULL;
918 		}
919 
920 		if (sc->sc_scowr[i].xfer != NULL) {
921 			usbd_destroy_xfer(sc->sc_scowr[i].xfer);
922 			sc->sc_scowr[i].xfer = NULL;
923 			sc->sc_scowr[i].buf = NULL;
924 		}
925 	}
926 
927 	if (sc->sc_evt_pipe != NULL) {
928 		usbd_close_pipe(sc->sc_evt_pipe);
929 		sc->sc_evt_pipe = NULL;
930 	}
931 
932 	if (sc->sc_aclrd_pipe != NULL) {
933 		usbd_close_pipe(sc->sc_aclrd_pipe);
934 		sc->sc_aclrd_pipe = NULL;
935 	}
936 
937 	if (sc->sc_aclwr_pipe != NULL) {
938 		usbd_close_pipe(sc->sc_aclwr_pipe);
939 		sc->sc_aclwr_pipe = NULL;
940 	}
941 
942 	if (sc->sc_scord_pipe != NULL) {
943 		usbd_close_pipe(sc->sc_scord_pipe);
944 		sc->sc_scord_pipe = NULL;
945 	}
946 
947 	if (sc->sc_scowr_pipe != NULL) {
948 		usbd_close_pipe(sc->sc_scowr_pipe);
949 		sc->sc_scowr_pipe = NULL;
950 	}
951 
952 	/* Free partial SCO packets */
953 	if (sc->sc_scord_mbuf != NULL) {
954 		m_freem(sc->sc_scord_mbuf);
955 		sc->sc_scord_mbuf = NULL;
956 	}
957 
958 	if (sc->sc_scowr_mbuf != NULL) {
959 		m_freem(sc->sc_scowr_mbuf);
960 		sc->sc_scowr_mbuf = NULL;
961 	}
962 
963 	/* Empty mbuf queues */
964 	MBUFQ_DRAIN(&sc->sc_cmd_queue);
965 	MBUFQ_DRAIN(&sc->sc_aclwr_queue);
966 	MBUFQ_DRAIN(&sc->sc_scowr_queue);
967 }
968 
969 /*******************************************************************************
970  *
971  * Bluetooth Unit/USB callbacks
972  *
973  */
974 static int
975 ubt_enable(device_t self)
976 {
977 	struct ubt_softc *sc = device_private(self);
978 	usbd_status err;
979 	int s, i, error;
980 
981 	DPRINTFN(1, "sc=%p\n", sc);
982 
983 	if (sc->sc_enabled)
984 		return 0;
985 
986 	s = splusb();
987 
988 	/* Events */
989 	sc->sc_evt_buf = kmem_alloc(UBT_BUFSIZ_EVENT, KM_SLEEP);
990 	if (sc->sc_evt_buf == NULL) {
991 		error = ENOMEM;
992 		goto bad;
993 	}
994 	err = usbd_open_pipe_intr(sc->sc_iface0,
995 				  sc->sc_evt_addr,
996 				  USBD_SHORT_XFER_OK,
997 				  &sc->sc_evt_pipe,
998 				  sc,
999 				  sc->sc_evt_buf,
1000 				  UBT_BUFSIZ_EVENT,
1001 				  ubt_recv_event,
1002 				  USBD_DEFAULT_INTERVAL);
1003 	if (err != USBD_NORMAL_COMPLETION) {
1004 		error = EIO;
1005 		goto bad;
1006 	}
1007 
1008 	/* Commands */
1009 	struct usbd_pipe *pipe0 = usbd_get_pipe0(sc->sc_udev);
1010 	error = usbd_create_xfer(pipe0, UBT_BUFSIZ_CMD, 0, 0,
1011 	    &sc->sc_cmd_xfer);
1012 	if (error)
1013 		goto bad;
1014 	sc->sc_cmd_buf = usbd_get_buffer(sc->sc_cmd_xfer);
1015 	sc->sc_cmd_busy = 0;
1016 
1017 	/* ACL read */
1018 	err = usbd_open_pipe(sc->sc_iface0, sc->sc_aclrd_addr,
1019 				USBD_EXCLUSIVE_USE, &sc->sc_aclrd_pipe);
1020 	if (err != USBD_NORMAL_COMPLETION) {
1021 		error = EIO;
1022 		goto bad;
1023 	}
1024 	error = usbd_create_xfer(sc->sc_aclrd_pipe, UBT_BUFSIZ_ACL,
1025 	    USBD_SHORT_XFER_OK, 0, &sc->sc_aclrd_xfer);
1026 	if (error)
1027 		goto bad;
1028 	sc->sc_aclrd_buf = usbd_get_buffer(sc->sc_aclrd_xfer);
1029 	sc->sc_aclrd_busy = 0;
1030 	ubt_recv_acl_start(sc);
1031 
1032 	/* ACL write */
1033 	err = usbd_open_pipe(sc->sc_iface0, sc->sc_aclwr_addr,
1034 				USBD_EXCLUSIVE_USE, &sc->sc_aclwr_pipe);
1035 	if (err != USBD_NORMAL_COMPLETION) {
1036 		error = EIO;
1037 		goto bad;
1038 	}
1039 	error = usbd_create_xfer(sc->sc_aclwr_pipe, UBT_BUFSIZ_ACL,
1040 	    USBD_FORCE_SHORT_XFER, 0, &sc->sc_aclwr_xfer);
1041 	if (error)
1042 		goto bad;
1043 	sc->sc_aclwr_buf = usbd_get_buffer(sc->sc_aclwr_xfer);
1044 	sc->sc_aclwr_busy = 0;
1045 
1046 	/* SCO read */
1047 	if (sc->sc_scord_size > 0) {
1048 		err = usbd_open_pipe(sc->sc_iface1, sc->sc_scord_addr,
1049 					USBD_EXCLUSIVE_USE, &sc->sc_scord_pipe);
1050 		if (err != USBD_NORMAL_COMPLETION) {
1051 			error = EIO;
1052 			goto bad;
1053 		}
1054 
1055 		for (i = 0 ; i < UBT_NXFERS ; i++) {
1056 		        error = usbd_create_xfer(sc->sc_scord_pipe,
1057 			    sc->sc_scord_size * UBT_NFRAMES,
1058 			    USBD_SHORT_XFER_OK, UBT_NFRAMES,
1059 			    &sc->sc_scord[i].xfer);
1060 			if (error)
1061 				goto bad;
1062 
1063 			sc->sc_scord[i].buf =
1064 			    usbd_get_buffer(sc->sc_scord[i].xfer);
1065 			sc->sc_scord[i].softc = sc;
1066 			sc->sc_scord[i].busy = 0;
1067 			ubt_recv_sco_start1(sc, &sc->sc_scord[i]);
1068 		}
1069 	}
1070 
1071 	/* SCO write */
1072 	if (sc->sc_scowr_size > 0) {
1073 		err = usbd_open_pipe(sc->sc_iface1, sc->sc_scowr_addr,
1074 					USBD_EXCLUSIVE_USE, &sc->sc_scowr_pipe);
1075 		if (err != USBD_NORMAL_COMPLETION) {
1076 			error = EIO;
1077 			goto bad;
1078 		}
1079 
1080 		for (i = 0 ; i < UBT_NXFERS ; i++) {
1081 			error = usbd_create_xfer(sc->sc_scowr_pipe,
1082 			    sc->sc_scowr_size * UBT_NFRAMES,
1083 			    USBD_FORCE_SHORT_XFER, UBT_NFRAMES,
1084 			    &sc->sc_scowr[i].xfer);
1085 			if (error)
1086 				goto bad;
1087 			sc->sc_scowr[i].buf =
1088 			    usbd_get_buffer(sc->sc_scowr[i].xfer);
1089 			sc->sc_scowr[i].softc = sc;
1090 			sc->sc_scowr[i].busy = 0;
1091 		}
1092 
1093 		sc->sc_scowr_busy = 0;
1094 	}
1095 
1096 	sc->sc_enabled = 1;
1097 	splx(s);
1098 	return 0;
1099 
1100 bad:
1101 	ubt_abortdealloc(sc);
1102 	splx(s);
1103 	return error;
1104 }
1105 
1106 static void
1107 ubt_disable(device_t self)
1108 {
1109 	struct ubt_softc *sc = device_private(self);
1110 	int s;
1111 
1112 	DPRINTFN(1, "sc=%p\n", sc);
1113 
1114 	if (sc->sc_enabled == 0)
1115 		return;
1116 
1117 	s = splusb();
1118 	ubt_abortdealloc(sc);
1119 
1120 	sc->sc_enabled = 0;
1121 	splx(s);
1122 }
1123 
1124 static void
1125 ubt_xmit_cmd(device_t self, struct mbuf *m)
1126 {
1127 	struct ubt_softc *sc = device_private(self);
1128 	int s;
1129 
1130 	KASSERT(sc->sc_enabled);
1131 
1132 	s = splusb();
1133 	MBUFQ_ENQUEUE(&sc->sc_cmd_queue, m);
1134 
1135 	if (sc->sc_cmd_busy == 0)
1136 		ubt_xmit_cmd_start(sc);
1137 
1138 	splx(s);
1139 }
1140 
1141 static void
1142 ubt_xmit_cmd_start(struct ubt_softc *sc)
1143 {
1144 	usb_device_request_t req;
1145 	usbd_status status;
1146 	struct mbuf *m;
1147 	int len;
1148 
1149 	if (sc->sc_dying)
1150 		return;
1151 
1152 	if (MBUFQ_FIRST(&sc->sc_cmd_queue) == NULL)
1153 		return;
1154 
1155 	MBUFQ_DEQUEUE(&sc->sc_cmd_queue, m);
1156 	KASSERT(m != NULL);
1157 
1158 	DPRINTFN(15, "%s: xmit CMD packet (%d bytes)\n",
1159 			device_xname(sc->sc_dev), m->m_pkthdr.len);
1160 
1161 	sc->sc_refcnt++;
1162 	sc->sc_cmd_busy = 1;
1163 
1164 	len = m->m_pkthdr.len - 1;
1165 	m_copydata(m, 1, len, sc->sc_cmd_buf);
1166 	m_freem(m);
1167 
1168 	memset(&req, 0, sizeof(req));
1169 	req.bmRequestType = UT_WRITE_CLASS_DEVICE;
1170 	USETW(req.wLength, len);
1171 
1172 	usbd_setup_default_xfer(sc->sc_cmd_xfer,
1173 				sc->sc_udev,
1174 				sc,
1175 				UBT_CMD_TIMEOUT,
1176 				&req,
1177 				sc->sc_cmd_buf,
1178 				len,
1179 				USBD_FORCE_SHORT_XFER,
1180 				ubt_xmit_cmd_complete);
1181 
1182 	status = usbd_transfer(sc->sc_cmd_xfer);
1183 
1184 	KASSERT(status != USBD_NORMAL_COMPLETION);
1185 
1186 	if (status != USBD_IN_PROGRESS) {
1187 		DPRINTF("usbd_transfer status=%s (%d)\n",
1188 			usbd_errstr(status), status);
1189 
1190 		sc->sc_refcnt--;
1191 		sc->sc_cmd_busy = 0;
1192 	}
1193 }
1194 
1195 static void
1196 ubt_xmit_cmd_complete(struct usbd_xfer *xfer,
1197 			void * h, usbd_status status)
1198 {
1199 	struct ubt_softc *sc = h;
1200 	uint32_t count;
1201 
1202 	DPRINTFN(15, "%s: CMD complete status=%s (%d)\n",
1203 			device_xname(sc->sc_dev), usbd_errstr(status), status);
1204 
1205 	sc->sc_cmd_busy = 0;
1206 
1207 	if (--sc->sc_refcnt < 0) {
1208 		DPRINTF("sc_refcnt=%d\n", sc->sc_refcnt);
1209 		usb_detach_wakeupold(sc->sc_dev);
1210 		return;
1211 	}
1212 
1213 	if (sc->sc_dying) {
1214 		DPRINTF("sc_dying\n");
1215 		return;
1216 	}
1217 
1218 	if (status != USBD_NORMAL_COMPLETION) {
1219 		DPRINTF("status=%s (%d)\n",
1220 			usbd_errstr(status), status);
1221 
1222 		sc->sc_stats.err_tx++;
1223 		return;
1224 	}
1225 
1226 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1227 	sc->sc_stats.cmd_tx++;
1228 	sc->sc_stats.byte_tx += count;
1229 
1230 	ubt_xmit_cmd_start(sc);
1231 }
1232 
1233 static void
1234 ubt_xmit_acl(device_t self, struct mbuf *m)
1235 {
1236 	struct ubt_softc *sc = device_private(self);
1237 	int s;
1238 
1239 	KASSERT(sc->sc_enabled);
1240 
1241 	s = splusb();
1242 	MBUFQ_ENQUEUE(&sc->sc_aclwr_queue, m);
1243 
1244 	if (sc->sc_aclwr_busy == 0)
1245 		ubt_xmit_acl_start(sc);
1246 
1247 	splx(s);
1248 }
1249 
1250 static void
1251 ubt_xmit_acl_start(struct ubt_softc *sc)
1252 {
1253 	struct mbuf *m;
1254 	usbd_status status;
1255 	int len;
1256 
1257 	if (sc->sc_dying)
1258 		return;
1259 
1260 	if (MBUFQ_FIRST(&sc->sc_aclwr_queue) == NULL)
1261 		return;
1262 
1263 	sc->sc_refcnt++;
1264 	sc->sc_aclwr_busy = 1;
1265 
1266 	MBUFQ_DEQUEUE(&sc->sc_aclwr_queue, m);
1267 	KASSERT(m != NULL);
1268 
1269 	DPRINTFN(15, "%s: xmit ACL packet (%d bytes)\n",
1270 			device_xname(sc->sc_dev), m->m_pkthdr.len);
1271 
1272 	len = m->m_pkthdr.len - 1;
1273 	if (len > UBT_BUFSIZ_ACL) {
1274 		DPRINTF("%s: truncating ACL packet (%d => %d)!\n",
1275 			device_xname(sc->sc_dev), len, UBT_BUFSIZ_ACL);
1276 
1277 		len = UBT_BUFSIZ_ACL;
1278 	}
1279 
1280 	m_copydata(m, 1, len, sc->sc_aclwr_buf);
1281 	m_freem(m);
1282 
1283 	sc->sc_stats.acl_tx++;
1284 	sc->sc_stats.byte_tx += len;
1285 
1286 	usbd_setup_xfer(sc->sc_aclwr_xfer,
1287 			sc,
1288 			sc->sc_aclwr_buf,
1289 			len,
1290 			USBD_FORCE_SHORT_XFER,
1291 			UBT_ACL_TIMEOUT,
1292 			ubt_xmit_acl_complete);
1293 
1294 	status = usbd_transfer(sc->sc_aclwr_xfer);
1295 
1296 	KASSERT(status != USBD_NORMAL_COMPLETION);
1297 
1298 	if (status != USBD_IN_PROGRESS) {
1299 		DPRINTF("usbd_transfer status=%s (%d)\n",
1300 			usbd_errstr(status), status);
1301 
1302 		sc->sc_refcnt--;
1303 		sc->sc_aclwr_busy = 0;
1304 	}
1305 }
1306 
1307 static void
1308 ubt_xmit_acl_complete(struct usbd_xfer *xfer,
1309 		void * h, usbd_status status)
1310 {
1311 	struct ubt_softc *sc = h;
1312 
1313 	DPRINTFN(15, "%s: ACL complete status=%s (%d)\n",
1314 		device_xname(sc->sc_dev), usbd_errstr(status), status);
1315 
1316 	sc->sc_aclwr_busy = 0;
1317 
1318 	if (--sc->sc_refcnt < 0) {
1319 		usb_detach_wakeupold(sc->sc_dev);
1320 		return;
1321 	}
1322 
1323 	if (sc->sc_dying)
1324 		return;
1325 
1326 	if (status != USBD_NORMAL_COMPLETION) {
1327 		DPRINTF("status=%s (%d)\n",
1328 			usbd_errstr(status), status);
1329 
1330 		sc->sc_stats.err_tx++;
1331 
1332 		if (status == USBD_STALLED)
1333 			usbd_clear_endpoint_stall_async(sc->sc_aclwr_pipe);
1334 		else
1335 			return;
1336 	}
1337 
1338 	ubt_xmit_acl_start(sc);
1339 }
1340 
1341 static void
1342 ubt_xmit_sco(device_t self, struct mbuf *m)
1343 {
1344 	struct ubt_softc *sc = device_private(self);
1345 	int s;
1346 
1347 	KASSERT(sc->sc_enabled);
1348 
1349 	s = splusb();
1350 	MBUFQ_ENQUEUE(&sc->sc_scowr_queue, m);
1351 
1352 	if (sc->sc_scowr_busy == 0)
1353 		ubt_xmit_sco_start(sc);
1354 
1355 	splx(s);
1356 }
1357 
1358 static void
1359 ubt_xmit_sco_start(struct ubt_softc *sc)
1360 {
1361 	int i;
1362 
1363 	if (sc->sc_dying || sc->sc_scowr_size == 0)
1364 		return;
1365 
1366 	for (i = 0 ; i < UBT_NXFERS ; i++) {
1367 		if (sc->sc_scowr[i].busy)
1368 			continue;
1369 
1370 		ubt_xmit_sco_start1(sc, &sc->sc_scowr[i]);
1371 	}
1372 }
1373 
1374 static void
1375 ubt_xmit_sco_start1(struct ubt_softc *sc, struct ubt_isoc_xfer *isoc)
1376 {
1377 	struct mbuf *m;
1378 	uint8_t *buf;
1379 	int num, len, size, space;
1380 
1381 	space = sc->sc_scowr_size * UBT_NFRAMES;
1382 	buf = isoc->buf;
1383 	len = 0;
1384 
1385 	/*
1386 	 * Fill the request buffer with data from the queue,
1387 	 * keeping any leftover packet on our private hook.
1388 	 *
1389 	 * Complete packets are passed back up to the stack
1390 	 * for disposal, since we can't rely on the controller
1391 	 * to tell us when it has finished with them.
1392 	 */
1393 
1394 	m = sc->sc_scowr_mbuf;
1395 	while (space > 0) {
1396 		if (m == NULL) {
1397 			MBUFQ_DEQUEUE(&sc->sc_scowr_queue, m);
1398 			if (m == NULL)
1399 				break;
1400 
1401 			m_adj(m, 1);	/* packet type */
1402 		}
1403 
1404 		if (m->m_pkthdr.len > 0) {
1405 			size = MIN(m->m_pkthdr.len, space);
1406 
1407 			m_copydata(m, 0, size, buf);
1408 			m_adj(m, size);
1409 
1410 			buf += size;
1411 			len += size;
1412 			space -= size;
1413 		}
1414 
1415 		if (m->m_pkthdr.len == 0) {
1416 			sc->sc_stats.sco_tx++;
1417 			if (!hci_complete_sco(sc->sc_unit, m))
1418 				sc->sc_stats.err_tx++;
1419 
1420 			m = NULL;
1421 		}
1422 	}
1423 	sc->sc_scowr_mbuf = m;
1424 
1425 	DPRINTFN(15, "isoc=%p, len=%d, space=%d\n", isoc, len, space);
1426 
1427 	if (len == 0)	/* nothing to send */
1428 		return;
1429 
1430 	sc->sc_refcnt++;
1431 	sc->sc_scowr_busy = 1;
1432 	sc->sc_stats.byte_tx += len;
1433 	isoc->busy = 1;
1434 
1435 	/*
1436 	 * calculate number of isoc frames and sizes
1437 	 */
1438 
1439 	for (num = 0 ; len > 0 ; num++) {
1440 		size = MIN(sc->sc_scowr_size, len);
1441 
1442 		isoc->size[num] = size;
1443 		len -= size;
1444 	}
1445 
1446 	usbd_setup_isoc_xfer(isoc->xfer,
1447 			     isoc,
1448 			     isoc->size,
1449 			     num,
1450 			     USBD_FORCE_SHORT_XFER,
1451 			     ubt_xmit_sco_complete);
1452 
1453 	usbd_transfer(isoc->xfer);
1454 }
1455 
1456 static void
1457 ubt_xmit_sco_complete(struct usbd_xfer *xfer,
1458 		void * h, usbd_status status)
1459 {
1460 	struct ubt_isoc_xfer *isoc = h;
1461 	struct ubt_softc *sc;
1462 	int i;
1463 
1464 	KASSERT(xfer == isoc->xfer);
1465 	sc = isoc->softc;
1466 
1467 	DPRINTFN(15, "isoc=%p, status=%s (%d)\n",
1468 		isoc, usbd_errstr(status), status);
1469 
1470 	isoc->busy = 0;
1471 
1472 	for (i = 0 ; ; i++) {
1473 		if (i == UBT_NXFERS) {
1474 			sc->sc_scowr_busy = 0;
1475 			break;
1476 		}
1477 
1478 		if (sc->sc_scowr[i].busy)
1479 			break;
1480 	}
1481 
1482 	if (--sc->sc_refcnt < 0) {
1483 		usb_detach_wakeupold(sc->sc_dev);
1484 		return;
1485 	}
1486 
1487 	if (sc->sc_dying)
1488 		return;
1489 
1490 	if (status != USBD_NORMAL_COMPLETION) {
1491 		DPRINTF("status=%s (%d)\n",
1492 			usbd_errstr(status), status);
1493 
1494 		sc->sc_stats.err_tx++;
1495 
1496 		if (status == USBD_STALLED)
1497 			usbd_clear_endpoint_stall_async(sc->sc_scowr_pipe);
1498 		else
1499 			return;
1500 	}
1501 
1502 	ubt_xmit_sco_start(sc);
1503 }
1504 
1505 /*
1506  * load incoming data into an mbuf with
1507  * leading type byte
1508  */
1509 static struct mbuf *
1510 ubt_mbufload(uint8_t *buf, int count, uint8_t type)
1511 {
1512 	struct mbuf *m;
1513 
1514 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1515 	if (m == NULL)
1516 		return NULL;
1517 
1518 	*mtod(m, uint8_t *) = type;
1519 	m->m_pkthdr.len = m->m_len = MHLEN;
1520 	m_copyback(m, 1, count, buf);	// (extends if necessary)
1521 	if (m->m_pkthdr.len != MAX(MHLEN, count + 1)) {
1522 		m_free(m);
1523 		return NULL;
1524 	}
1525 
1526 	m->m_pkthdr.len = count + 1;
1527 	m->m_len = MIN(MHLEN, m->m_pkthdr.len);
1528 
1529 	return m;
1530 }
1531 
1532 static void
1533 ubt_recv_event(struct usbd_xfer *xfer, void * h, usbd_status status)
1534 {
1535 	struct ubt_softc *sc = h;
1536 	struct mbuf *m;
1537 	uint32_t count;
1538 	void *buf;
1539 
1540 	DPRINTFN(15, "sc=%p status=%s (%d)\n",
1541 		    sc, usbd_errstr(status), status);
1542 
1543 	if (status != USBD_NORMAL_COMPLETION || sc->sc_dying)
1544 		return;
1545 
1546 	usbd_get_xfer_status(xfer, NULL, &buf, &count, NULL);
1547 
1548 	if (count < sizeof(hci_event_hdr_t) - 1) {
1549 		DPRINTF("dumped undersized event (count = %d)\n", count);
1550 		sc->sc_stats.err_rx++;
1551 		return;
1552 	}
1553 
1554 	sc->sc_stats.evt_rx++;
1555 	sc->sc_stats.byte_rx += count;
1556 
1557 	m = ubt_mbufload(buf, count, HCI_EVENT_PKT);
1558 	if (m == NULL || !hci_input_event(sc->sc_unit, m))
1559 		sc->sc_stats.err_rx++;
1560 }
1561 
1562 static void
1563 ubt_recv_acl_start(struct ubt_softc *sc)
1564 {
1565 	usbd_status status;
1566 
1567 	DPRINTFN(15, "sc=%p\n", sc);
1568 
1569 	if (sc->sc_aclrd_busy || sc->sc_dying) {
1570 		DPRINTF("sc_aclrd_busy=%d, sc_dying=%d\n",
1571 			sc->sc_aclrd_busy,
1572 			sc->sc_dying);
1573 
1574 		return;
1575 	}
1576 
1577 	sc->sc_refcnt++;
1578 	sc->sc_aclrd_busy = 1;
1579 
1580 	usbd_setup_xfer(sc->sc_aclrd_xfer,
1581 			sc,
1582 			sc->sc_aclrd_buf,
1583 			UBT_BUFSIZ_ACL,
1584 			USBD_SHORT_XFER_OK,
1585 			USBD_NO_TIMEOUT,
1586 			ubt_recv_acl_complete);
1587 
1588 	status = usbd_transfer(sc->sc_aclrd_xfer);
1589 
1590 	KASSERT(status != USBD_NORMAL_COMPLETION);
1591 
1592 	if (status != USBD_IN_PROGRESS) {
1593 		DPRINTF("usbd_transfer status=%s (%d)\n",
1594 			usbd_errstr(status), status);
1595 
1596 		sc->sc_refcnt--;
1597 		sc->sc_aclrd_busy = 0;
1598 	}
1599 }
1600 
1601 static void
1602 ubt_recv_acl_complete(struct usbd_xfer *xfer,
1603 		void * h, usbd_status status)
1604 {
1605 	struct ubt_softc *sc = h;
1606 	struct mbuf *m;
1607 	uint32_t count;
1608 	void *buf;
1609 
1610 	DPRINTFN(15, "sc=%p status=%s (%d)\n",
1611 			sc, usbd_errstr(status), status);
1612 
1613 	sc->sc_aclrd_busy = 0;
1614 
1615 	if (--sc->sc_refcnt < 0) {
1616 		DPRINTF("refcnt = %d\n", sc->sc_refcnt);
1617 		usb_detach_wakeupold(sc->sc_dev);
1618 		return;
1619 	}
1620 
1621 	if (sc->sc_dying) {
1622 		DPRINTF("sc_dying\n");
1623 		return;
1624 	}
1625 
1626 	if (status != USBD_NORMAL_COMPLETION) {
1627 		DPRINTF("status=%s (%d)\n",
1628 			usbd_errstr(status), status);
1629 
1630 		sc->sc_stats.err_rx++;
1631 
1632 		if (status == USBD_STALLED)
1633 			usbd_clear_endpoint_stall_async(sc->sc_aclrd_pipe);
1634 		else
1635 			return;
1636 	} else {
1637 		usbd_get_xfer_status(xfer, NULL, &buf, &count, NULL);
1638 
1639 		if (count < sizeof(hci_acldata_hdr_t) - 1) {
1640 			DPRINTF("dumped undersized packet (%d)\n", count);
1641 			sc->sc_stats.err_rx++;
1642 		} else {
1643 			sc->sc_stats.acl_rx++;
1644 			sc->sc_stats.byte_rx += count;
1645 
1646 			m = ubt_mbufload(buf, count, HCI_ACL_DATA_PKT);
1647 			if (m == NULL || !hci_input_acl(sc->sc_unit, m))
1648 				sc->sc_stats.err_rx++;
1649 		}
1650 	}
1651 
1652 	/* and restart */
1653 	ubt_recv_acl_start(sc);
1654 }
1655 
1656 static void
1657 ubt_recv_sco_start1(struct ubt_softc *sc, struct ubt_isoc_xfer *isoc)
1658 {
1659 	int i;
1660 
1661 	DPRINTFN(15, "sc=%p, isoc=%p\n", sc, isoc);
1662 
1663 	if (isoc->busy || sc->sc_dying || sc->sc_scord_size == 0) {
1664 		DPRINTF("%s%s%s\n",
1665 			isoc->busy ? " busy" : "",
1666 			sc->sc_dying ? " dying" : "",
1667 			sc->sc_scord_size == 0 ? " size=0" : "");
1668 
1669 		return;
1670 	}
1671 
1672 	sc->sc_refcnt++;
1673 	isoc->busy = 1;
1674 
1675 	for (i = 0 ; i < UBT_NFRAMES ; i++)
1676 		isoc->size[i] = sc->sc_scord_size;
1677 
1678 	usbd_setup_isoc_xfer(isoc->xfer,
1679 			     isoc,
1680 			     isoc->size,
1681 			     UBT_NFRAMES,
1682 			     USBD_SHORT_XFER_OK,
1683 			     ubt_recv_sco_complete);
1684 
1685 	usbd_transfer(isoc->xfer);
1686 }
1687 
1688 static void
1689 ubt_recv_sco_complete(struct usbd_xfer *xfer,
1690 		void * h, usbd_status status)
1691 {
1692 	struct ubt_isoc_xfer *isoc = h;
1693 	struct ubt_softc *sc;
1694 	struct mbuf *m;
1695 	uint32_t count;
1696 	uint8_t *ptr, *frame;
1697 	int i, size, got, want;
1698 
1699 	KASSERT(isoc != NULL);
1700 	KASSERT(isoc->xfer == xfer);
1701 
1702 	sc = isoc->softc;
1703 	isoc->busy = 0;
1704 
1705 	if (--sc->sc_refcnt < 0) {
1706 		DPRINTF("refcnt=%d\n", sc->sc_refcnt);
1707 		usb_detach_wakeupold(sc->sc_dev);
1708 		return;
1709 	}
1710 
1711 	if (sc->sc_dying) {
1712 		DPRINTF("sc_dying\n");
1713 		return;
1714 	}
1715 
1716 	if (status != USBD_NORMAL_COMPLETION) {
1717 		DPRINTF("status=%s (%d)\n",
1718 			usbd_errstr(status), status);
1719 
1720 		sc->sc_stats.err_rx++;
1721 
1722 		if (status == USBD_STALLED) {
1723 			usbd_clear_endpoint_stall_async(sc->sc_scord_pipe);
1724 			goto restart;
1725 		}
1726 
1727 		return;
1728 	}
1729 
1730 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1731 	if (count == 0)
1732 		goto restart;
1733 
1734 	DPRINTFN(15, "sc=%p, isoc=%p, count=%u\n",
1735 			sc, isoc, count);
1736 
1737 	sc->sc_stats.byte_rx += count;
1738 
1739 	/*
1740 	 * Extract SCO packets from ISOC frames. The way we have it,
1741 	 * no SCO packet can be bigger than MHLEN. This is unlikely
1742 	 * to actually happen, but if we ran out of mbufs and lost
1743 	 * sync then we may get spurious data that makes it seem that
1744 	 * way, so we discard data that wont fit. This doesnt really
1745 	 * help with the lost sync situation alas.
1746 	 */
1747 
1748 	m = sc->sc_scord_mbuf;
1749 	if (m != NULL) {
1750 		sc->sc_scord_mbuf = NULL;
1751 		ptr = mtod(m, uint8_t *) + m->m_pkthdr.len;
1752 		got = m->m_pkthdr.len;
1753 		want = sizeof(hci_scodata_hdr_t);
1754 		if (got >= want)
1755 			want += mtod(m, hci_scodata_hdr_t *)->length ;
1756 	} else {
1757 		ptr = NULL;
1758 		got = 0;
1759 		want = 0;
1760 	}
1761 
1762 	for (i = 0 ; i < UBT_NFRAMES ; i++) {
1763 		frame = isoc->buf + (i * sc->sc_scord_size);
1764 
1765 		while (isoc->size[i] > 0) {
1766 			size = isoc->size[i];
1767 
1768 			if (m == NULL) {
1769 				MGETHDR(m, M_DONTWAIT, MT_DATA);
1770 				if (m == NULL) {
1771 					aprint_error_dev(sc->sc_dev,
1772 					    "out of memory (xfer halted)\n");
1773 
1774 					sc->sc_stats.err_rx++;
1775 					return;		/* lost sync */
1776 				}
1777 
1778 				ptr = mtod(m, uint8_t *);
1779 				*ptr++ = HCI_SCO_DATA_PKT;
1780 				got = 1;
1781 				want = sizeof(hci_scodata_hdr_t);
1782 			}
1783 
1784 			if (got + size > want)
1785 				size = want - got;
1786 
1787 			memcpy(ptr, frame, size);
1788 
1789 			ptr += size;
1790 			got += size;
1791 			frame += size;
1792 
1793 			if (got == want) {
1794 				/*
1795 				 * If we only got a header, add the packet
1796 				 * length to our want count. Send complete
1797 				 * packets up to protocol stack.
1798 				 */
1799 				if (want == sizeof(hci_scodata_hdr_t)) {
1800 					uint32_t len =
1801 					    mtod(m, hci_scodata_hdr_t *)->length;
1802 					want += len;
1803 					if (len == 0 || want > MHLEN) {
1804 						aprint_error_dev(sc->sc_dev,
1805 						    "packet too large %u "
1806 						    "(lost sync)\n", len);
1807 						sc->sc_stats.err_rx++;
1808 						return;
1809 					}
1810 				}
1811 
1812 				if (got == want) {
1813 					m->m_pkthdr.len = m->m_len = got;
1814 					sc->sc_stats.sco_rx++;
1815 					if (!hci_input_sco(sc->sc_unit, m))
1816 						sc->sc_stats.err_rx++;
1817 
1818 					m = NULL;
1819 				}
1820 			}
1821 
1822 			isoc->size[i] -= size;
1823 		}
1824 	}
1825 
1826 	if (m != NULL) {
1827 		m->m_pkthdr.len = m->m_len = got;
1828 		sc->sc_scord_mbuf = m;
1829 	}
1830 
1831 restart: /* and restart */
1832 	ubt_recv_sco_start1(sc, isoc);
1833 }
1834 
1835 void
1836 ubt_stats(device_t self, struct bt_stats *dest, int flush)
1837 {
1838 	struct ubt_softc *sc = device_private(self);
1839 	int s;
1840 
1841 	s = splusb();
1842 	memcpy(dest, &sc->sc_stats, sizeof(struct bt_stats));
1843 
1844 	if (flush)
1845 		memset(&sc->sc_stats, 0, sizeof(struct bt_stats));
1846 
1847 	splx(s);
1848 }
1849