xref: /netbsd-src/sys/dev/usb/ubt.c (revision fad4c9f71477ae11cea2ee75ec82151ac770a534)
1 /*	$NetBSD: ubt.c,v 1.14 2006/06/19 15:44:45 gdamore Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006 Itronix Inc.
5  * All rights reserved.
6  *
7  * Written by Iain Hibbert for Itronix Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. The name of Itronix Inc. may not be used to endorse
18  *    or promote products derived from this software without specific
19  *    prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
28  * ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 /*
34  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
35  * All rights reserved.
36  *
37  * This code is derived from software contributed to The NetBSD Foundation
38  * by Lennart Augustsson (lennart@augustsson.net) and
39  * David Sainty (David.Sainty@dtsp.co.nz).
40  *
41  * Redistribution and use in source and binary forms, with or without
42  * modification, are permitted provided that the following conditions
43  * are met:
44  * 1. Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  * 2. Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in the
48  *    documentation and/or other materials provided with the distribution.
49  * 3. All advertising materials mentioning features or use of this software
50  *    must display the following acknowledgement:
51  *        This product includes software developed by the NetBSD
52  *        Foundation, Inc. and its contributors.
53  * 4. Neither the name of The NetBSD Foundation nor the names of its
54  *    contributors may be used to endorse or promote products derived
55  *    from this software without specific prior written permission.
56  *
57  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
58  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
59  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
60  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
61  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
62  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
63  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
64  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
65  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
66  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
67  * POSSIBILITY OF SUCH DAMAGE.
68  */
69 /*
70  * This driver originally written by Lennart Augustsson and David Sainty,
71  * but was mostly rewritten for the NetBSD Bluetooth protocol stack by
72  * Iain Hibbert for Itronix, Inc using the FreeBSD ng_ubt.c driver as a
73  * reference.
74  */
75 
76 #include <sys/cdefs.h>
77 __KERNEL_RCSID(0, "$NetBSD: ubt.c,v 1.14 2006/06/19 15:44:45 gdamore Exp $");
78 
79 #include <sys/param.h>
80 #include <sys/device.h>
81 #include <sys/ioctl.h>
82 #include <sys/kernel.h>
83 #include <sys/malloc.h>
84 #include <sys/mbuf.h>
85 #include <sys/proc.h>
86 #include <sys/sysctl.h>
87 #include <sys/systm.h>
88 
89 #include <dev/usb/usb.h>
90 #include <dev/usb/usbdi.h>
91 #include <dev/usb/usbdi_util.h>
92 #include <dev/usb/usbdevs.h>
93 
94 #include <netbt/bluetooth.h>
95 #include <netbt/hci.h>
96 
97 /*******************************************************************************
98  *
99  *	debugging stuff
100  */
101 #undef DPRINTF
102 #undef DPRINTFN
103 
104 #ifdef UBT_DEBUG
105 int	ubt_debug = UBT_DEBUG;
106 
107 #define DPRINTF(fmt, args...)		do {		\
108 	if (ubt_debug)					\
109 		printf("%s: "fmt, __func__ , ##args);	\
110 } while (/* CONSTCOND */0)
111 
112 #define DPRINTFN(n, fmt, args...)	do {		\
113 	if (ubt_debug > (n))				\
114 		printf("%s: "fmt, __func__ , ##args);	\
115 } while (/* CONSTCOND */0)
116 
117 SYSCTL_SETUP(sysctl_hw_ubt_debug_setup, "sysctl hw.ubt_debug setup")
118 {
119 
120 	sysctl_createv(NULL, 0, NULL, NULL,
121 		CTLFLAG_PERMANENT,
122 		CTLTYPE_NODE, "hw",
123 		NULL,
124 		NULL, 0,
125 		NULL, 0,
126 		CTL_HW, CTL_EOL);
127 
128 	sysctl_createv(NULL, 0, NULL, NULL,
129 		CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
130 		CTLTYPE_INT, "ubt_debug",
131 		SYSCTL_DESCR("ubt debug level"),
132 		NULL, 0,
133 		&ubt_debug, sizeof(ubt_debug),
134 		CTL_HW, CTL_CREATE, CTL_EOL);
135 }
136 #else
137 #define DPRINTF(...)
138 #define DPRINTFN(...)
139 #endif
140 
141 /*******************************************************************************
142  *
143  *	ubt softc structure
144  *
145  */
146 
147 /* buffer sizes */
148 /*
149  * NB: although ACL packets can extend to 65535 bytes, most devices
150  * have max_acl_size at much less (largest I have seen is 384)
151  */
152 #define UBT_BUFSIZ_CMD		(HCI_CMD_PKT_SIZE - 1)
153 #define UBT_BUFSIZ_ACL		(2048 - 1)
154 #define UBT_BUFSIZ_EVENT	(HCI_EVENT_PKT_SIZE - 1)
155 
156 /* Interrupt Interval from (Bluetooth spec) */
157 #define UBT_EVENT_INTERVAL	1	/* 1ms */
158 
159 /* Transmit timeouts */
160 #define UBT_CMD_TIMEOUT		USBD_DEFAULT_TIMEOUT
161 #define UBT_ACL_TIMEOUT		USBD_DEFAULT_TIMEOUT
162 
163 /*
164  * ISOC transfers
165  *
166  * xfer buffer size depends on the frame size, and the number
167  * of frames per transfer is fixed, as each frame should be
168  * 1ms worth of data. This keeps the rate that xfers complete
169  * fairly constant. We use multiple xfers to keep the hardware
170  * busy
171  */
172 #define UBT_NXFERS		3	/* max xfers to queue */
173 #define UBT_NFRAMES		10	/* frames per xfer */
174 
175 struct ubt_isoc_xfer {
176 	struct ubt_softc	*softc;
177 	usbd_xfer_handle	 xfer;
178 	uint8_t			*buf;
179 	uint16_t		 size[UBT_NFRAMES];
180 	int			 busy;
181 };
182 
183 struct ubt_softc {
184 	USBBASEDEVICE		 sc_dev;
185 	usbd_device_handle	 sc_udev;
186 	int			 sc_refcnt;
187 	int			 sc_dying;
188 
189 	/* Control Interface */
190 	usbd_interface_handle	 sc_iface0;
191 
192 	/* Commands (control) */
193 	usbd_xfer_handle	 sc_cmd_xfer;
194 	uint8_t			*sc_cmd_buf;
195 
196 	/* Events (interrupt) */
197 	int			 sc_evt_addr;	/* endpoint address */
198 	usbd_pipe_handle	 sc_evt_pipe;
199 	uint8_t			*sc_evt_buf;
200 
201 	/* ACL data (in) */
202 	int			 sc_aclrd_addr;	/* endpoint address */
203 	usbd_pipe_handle	 sc_aclrd_pipe;	/* read pipe */
204 	usbd_xfer_handle	 sc_aclrd_xfer;	/* read xfer */
205 	uint8_t			*sc_aclrd_buf;	/* read buffer */
206 	int			 sc_aclrd_busy;	/* reading */
207 
208 	/* ACL data (out) */
209 	int			 sc_aclwr_addr;	/* endpoint address */
210 	usbd_pipe_handle	 sc_aclwr_pipe;	/* write pipe */
211 	usbd_xfer_handle	 sc_aclwr_xfer;	/* write xfer */
212 	uint8_t			*sc_aclwr_buf;	/* write buffer */
213 
214 	/* ISOC interface */
215 	usbd_interface_handle	 sc_iface1;	/* ISOC interface */
216 	struct sysctllog	*sc_log;	/* sysctl log */
217 	int			 sc_config;	/* current config no */
218 	int			 sc_alt_config;	/* no of alternates */
219 
220 	/* SCO data (in) */
221 	int			 sc_scord_addr;	/* endpoint address */
222 	usbd_pipe_handle	 sc_scord_pipe;	/* read pipe */
223 	int			 sc_scord_size;	/* frame length */
224 	struct ubt_isoc_xfer	 sc_scord[UBT_NXFERS];
225 	struct mbuf		*sc_scord_mbuf;	/* current packet */
226 
227 	/* SCO data (out) */
228 	int			 sc_scowr_addr;	/* endpoint address */
229 	usbd_pipe_handle	 sc_scowr_pipe;	/* write pipe */
230 	int			 sc_scowr_size;	/* frame length */
231 	struct ubt_isoc_xfer	 sc_scowr[UBT_NXFERS];
232 	struct mbuf		*sc_scowr_mbuf;	/* current packet */
233 
234 	/* Protocol structure */
235 	struct hci_unit		 sc_unit;
236 };
237 
238 /*******************************************************************************
239  *
240  * Bluetooth unit/USB callback routines
241  *
242  */
243 static int ubt_enable(struct hci_unit *);
244 static void ubt_disable(struct hci_unit *);
245 
246 static void ubt_xmit_cmd_start(struct hci_unit *);
247 static void ubt_xmit_cmd_complete(usbd_xfer_handle,
248 				usbd_private_handle, usbd_status);
249 
250 static void ubt_xmit_acl_start(struct hci_unit *);
251 static void ubt_xmit_acl_complete(usbd_xfer_handle,
252 				usbd_private_handle, usbd_status);
253 
254 static void ubt_xmit_sco_start(struct hci_unit *);
255 static void ubt_xmit_sco_start1(struct ubt_softc *, struct ubt_isoc_xfer *);
256 static void ubt_xmit_sco_complete(usbd_xfer_handle,
257 				usbd_private_handle, usbd_status);
258 
259 static void ubt_recv_event(usbd_xfer_handle,
260 				usbd_private_handle, usbd_status);
261 
262 static void ubt_recv_acl_start(struct ubt_softc *);
263 static void ubt_recv_acl_complete(usbd_xfer_handle,
264 				usbd_private_handle, usbd_status);
265 
266 static void ubt_recv_sco_start1(struct ubt_softc *, struct ubt_isoc_xfer *);
267 static void ubt_recv_sco_complete(usbd_xfer_handle,
268 				usbd_private_handle, usbd_status);
269 
270 
271 /*******************************************************************************
272  *
273  * USB Autoconfig stuff
274  *
275  */
276 
277 USB_DECLARE_DRIVER(ubt);
278 
279 static int ubt_set_isoc_config(struct ubt_softc *);
280 static int ubt_sysctl_config(SYSCTLFN_PROTO);
281 static void ubt_abortdealloc(struct ubt_softc *);
282 
283 USB_MATCH(ubt)
284 {
285 	USB_MATCH_START(ubt, uaa);
286 	usb_interface_descriptor_t *id;
287 
288 	DPRINTFN(50, "ubt_match\n");
289 
290 	if (uaa->iface == NULL)
291 		return UMATCH_NONE;
292 
293 	id = usbd_get_interface_descriptor(uaa->iface);
294 	if (id != NULL
295 	    && id->bInterfaceClass == UICLASS_WIRELESS
296 	    && id->bInterfaceSubClass == UISUBCLASS_RF
297 	    && id->bInterfaceProtocol == UIPROTO_BLUETOOTH)
298 		return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO;
299 
300 	return UMATCH_NONE;
301 }
302 
303 USB_ATTACH(ubt)
304 {
305 	USB_ATTACH_START(ubt, sc, uaa);
306 	usbd_interface_handle iface;
307 	usb_config_descriptor_t *cd;
308 	usb_endpoint_descriptor_t *ed;
309 	const struct sysctlnode *node;
310 	char *devinfop;
311 	int err;
312 	uint8_t count, i;
313 
314 	DPRINTFN(50, "ubt_attach: sc=%p\n", sc);
315 
316 	sc->sc_udev = uaa->device;
317 
318 	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
319 	USB_ATTACH_SETUP;
320 	aprint_normal("%s: %s\n", USBDEVNAME(sc->sc_dev), devinfop);
321 	usbd_devinfo_free(devinfop);
322 
323 	/*
324 	 * We must have at least 2 interfaces.
325 	 */
326 	if (uaa->nifaces < 2) {
327 		aprint_error("%s: need 2 interfaces (got %d)\n",
328 			USBDEVNAME(sc->sc_dev), uaa->nifaces);
329 
330 		USB_ATTACH_ERROR_RETURN;
331 	}
332 
333 	/*
334 	 * Interface 0 must have 3 endpoints
335 	 *	1) Interrupt endpoint to receive HCI events
336 	 *	2) Bulk IN endpoint to receive ACL data
337 	 *	3) Bulk OUT endpoint to send ACL data
338 	 */
339 	err = usbd_device2interface_handle(sc->sc_udev, 0, &iface);
340 	if (err) {
341 		aprint_error("%s: Could not get interface 0 handle %s (%d)\n",
342 				USBDEVNAME(sc->sc_dev), usbd_errstr(err), err);
343 
344 		USB_ATTACH_ERROR_RETURN;
345 	}
346 
347 	sc->sc_evt_addr = -1;
348 	sc->sc_aclrd_addr = -1;
349 	sc->sc_aclwr_addr = -1;
350 
351 	count = 0;
352 	(void)usbd_endpoint_count(iface, &count);
353 
354 	for (i = 0 ; i < count ; i++) {
355 		int dir, type;
356 
357 		ed = usbd_interface2endpoint_descriptor(iface, i);
358 		if (ed == NULL) {
359 			aprint_error("%s: could not read endpoint descriptor %d\n",
360 			    USBDEVNAME(sc->sc_dev), i);
361 
362 			USB_ATTACH_ERROR_RETURN;
363 		}
364 
365 		dir = UE_GET_DIR(ed->bEndpointAddress);
366 		type = UE_GET_XFERTYPE(ed->bmAttributes);
367 
368 		if (dir == UE_DIR_IN && type == UE_INTERRUPT)
369 			sc->sc_evt_addr = ed->bEndpointAddress;
370 		else if (dir == UE_DIR_IN && type == UE_BULK)
371 			sc->sc_aclrd_addr = ed->bEndpointAddress;
372 		else if (dir == UE_DIR_OUT && type == UE_BULK)
373 			sc->sc_aclwr_addr = ed->bEndpointAddress;
374 	}
375 
376 	if (sc->sc_evt_addr == -1) {
377 		aprint_error("%s: missing INTERRUPT endpoint on interface 0\n",
378 				USBDEVNAME(sc->sc_dev));
379 
380 		USB_ATTACH_ERROR_RETURN;
381 	}
382 	if (sc->sc_aclrd_addr == -1) {
383 		aprint_error("%s: missing BULK IN endpoint on interface 0\n",
384 				USBDEVNAME(sc->sc_dev));
385 
386 		USB_ATTACH_ERROR_RETURN;
387 	}
388 	if (sc->sc_aclwr_addr == -1) {
389 		aprint_error("%s: missing BULK OUT endpoint on interface 0\n",
390 				USBDEVNAME(sc->sc_dev));
391 
392 		USB_ATTACH_ERROR_RETURN;
393 	}
394 
395 	/* Interface 0 Ok */
396 	sc->sc_iface0 = iface;
397 	uaa->ifaces[0] = NULL;
398 
399 	/*
400 	 * Interface 1 must have 2 endpoints
401 	 *	1) Isochronous IN endpoint to receive SCO data
402 	 *	2) Isochronous OUT endpoint to send SCO data
403 	 *
404 	 * and will have several configurations, which can be selected
405 	 * via a sysctl variable. We select config 0 to start, which
406 	 * means that no SCO data will be available.
407 	 */
408 	err = usbd_device2interface_handle(sc->sc_udev, 1, &iface);
409 	if (err) {
410 		aprint_error("%s: Could not get interface 1 handle %s (%d)\n",
411 				USBDEVNAME(sc->sc_dev), usbd_errstr(err), err);
412 
413 		USB_ATTACH_ERROR_RETURN;
414 	}
415 
416 	cd = usbd_get_config_descriptor(sc->sc_udev);
417 	if (cd == NULL) {
418 		aprint_error("%s: could not get config descriptor\n",
419 			USBDEVNAME(sc->sc_dev));
420 
421 		USB_ATTACH_ERROR_RETURN;
422 	}
423 
424 	sc->sc_alt_config = usbd_get_no_alts(cd, 1);
425 
426 	/* Interface 1 Ok */
427 	sc->sc_iface1 = iface;
428 	uaa->ifaces[1] = NULL;
429 
430 	/* set initial config */
431 	err = ubt_set_isoc_config(sc);
432 	if (err) {
433 		aprint_error("%s: ISOC config failed\n",
434 			USBDEVNAME(sc->sc_dev));
435 
436 		USB_ATTACH_ERROR_RETURN;
437 	}
438 
439 	/* Attach HCI */
440 	sc->sc_unit.hci_softc = sc;
441 	sc->sc_unit.hci_devname = USBDEVNAME(sc->sc_dev);
442 	sc->sc_unit.hci_enable = ubt_enable;
443 	sc->sc_unit.hci_disable = ubt_disable;
444 	sc->sc_unit.hci_start_cmd = ubt_xmit_cmd_start;
445 	sc->sc_unit.hci_start_acl = ubt_xmit_acl_start;
446 	sc->sc_unit.hci_start_sco = ubt_xmit_sco_start;
447 	sc->sc_unit.hci_ipl = IPL_USB;	/* XXX: IPL_SOFTUSB ?? */
448 	hci_attach(&sc->sc_unit);
449 
450 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
451 			   USBDEV(sc->sc_dev));
452 
453 	/* sysctl set-up for alternate configs */
454 	sysctl_createv(&sc->sc_log, 0, NULL, NULL,
455 		CTLFLAG_PERMANENT,
456 		CTLTYPE_NODE, "hw",
457 		NULL,
458 		NULL, 0,
459 		NULL, 0,
460 		CTL_HW, CTL_EOL);
461 
462 	sysctl_createv(&sc->sc_log, 0, NULL, &node,
463 		0,
464 		CTLTYPE_NODE, USBDEVNAME(sc->sc_dev),
465 		SYSCTL_DESCR("ubt driver information"),
466 		NULL, 0,
467 		NULL, 0,
468 		CTL_HW,
469 		CTL_CREATE, CTL_EOL);
470 
471 	if (node != NULL) {
472 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
473 			CTLFLAG_READWRITE,
474 			CTLTYPE_INT, "config",
475 			SYSCTL_DESCR("configuration number"),
476 			ubt_sysctl_config, 0,
477 			sc, 0,
478 			CTL_HW, node->sysctl_num,
479 			CTL_CREATE, CTL_EOL);
480 
481 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
482 			CTLFLAG_READONLY,
483 			CTLTYPE_INT, "alt_config",
484 			SYSCTL_DESCR("number of alternate configurations"),
485 			NULL, 0,
486 			&sc->sc_alt_config, sizeof(sc->sc_alt_config),
487 			CTL_HW, node->sysctl_num,
488 			CTL_CREATE, CTL_EOL);
489 
490 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
491 			CTLFLAG_READONLY,
492 			CTLTYPE_INT, "sco_rxsize",
493 			SYSCTL_DESCR("max SCO receive size"),
494 			NULL, 0,
495 			&sc->sc_scord_size, sizeof(sc->sc_scord_size),
496 			CTL_HW, node->sysctl_num,
497 			CTL_CREATE, CTL_EOL);
498 
499 		sysctl_createv(&sc->sc_log, 0, NULL, NULL,
500 			CTLFLAG_READONLY,
501 			CTLTYPE_INT, "sco_txsize",
502 			SYSCTL_DESCR("max SCO transmit size"),
503 			NULL, 0,
504 			&sc->sc_scowr_size, sizeof(sc->sc_scowr_size),
505 			CTL_HW, node->sysctl_num,
506 			CTL_CREATE, CTL_EOL);
507 	}
508 
509 	USB_ATTACH_SUCCESS_RETURN;
510 }
511 
512 USB_DETACH(ubt)
513 {
514 	USB_DETACH_START(ubt, sc);
515 	int s;
516 
517 	DPRINTF("sc=%p flags=%d\n", sc, flags);
518 
519 	sc->sc_dying = 1;
520 
521 	/* delete sysctl nodes */
522 	sysctl_teardown(&sc->sc_log);
523 
524 	/* Detach HCI interface */
525 	hci_detach(&sc->sc_unit);
526 
527 	/*
528 	 * Abort all pipes. Causes processes waiting for transfer to wake.
529 	 *
530 	 * Actually, hci_detach() above will call ubt_disable() which may
531 	 * call ubt_abortdealloc(), but lets be sure since doing it twice
532 	 * wont cause an error.
533 	 */
534 	ubt_abortdealloc(sc);
535 
536 	/* wait for all processes to finish */
537 	s = splusb();
538 	if (sc->sc_refcnt-- > 0)
539 		usb_detach_wait(USBDEV(sc->sc_dev));
540 
541 	splx(s);
542 
543 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
544 			   USBDEV(sc->sc_dev));
545 
546 	DPRINTFN(1, "driver detached\n");
547 
548 	return 0;
549 }
550 
551 int
552 ubt_activate(device_ptr_t self, enum devact act)
553 {
554 	struct ubt_softc *sc = (struct ubt_softc *)self;
555 	int error = 0;
556 
557 	DPRINTFN(1, "ubt_activate: sc=%p, act=%d\n", sc, act);
558 
559 	switch (act) {
560 	case DVACT_ACTIVATE:
561 		return EOPNOTSUPP;
562 		break;
563 
564 	case DVACT_DEACTIVATE:
565 		sc->sc_dying = 1;
566 		break;
567 	}
568 	return error;
569 }
570 
571 /* set ISOC configuration */
572 static int
573 ubt_set_isoc_config(struct ubt_softc *sc)
574 {
575 	usb_endpoint_descriptor_t *ed;
576 	int rd_addr, wr_addr, rd_size, wr_size;
577 	uint8_t count, i;
578 	int err;
579 
580 	err = usbd_set_interface(sc->sc_iface1, sc->sc_config);
581 	if (err) {
582 		aprint_error(
583 		    "%s: Could not set config %d on ISOC interface. %s (%d)\n",
584 		    USBDEVNAME(sc->sc_dev), sc->sc_config, usbd_errstr(err), err);
585 
586 		return err;
587 	}
588 
589 	/*
590 	 * We wont get past the above if there are any pipes open, so no
591 	 * need to worry about buf/xfer/pipe deallocation. If we get an
592 	 * error after this, the frame quantities will be 0 and no SCO
593 	 * data will be possible.
594 	 */
595 
596 	sc->sc_scord_size = rd_size = 0;
597 	sc->sc_scord_addr = rd_addr = -1;
598 
599 	sc->sc_scowr_size = wr_size = 0;
600 	sc->sc_scowr_addr = wr_addr = -1;
601 
602 	count = 0;
603 	(void)usbd_endpoint_count(sc->sc_iface1, &count);
604 
605 	for (i = 0 ; i < count ; i++) {
606 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface1, i);
607 		if (ed == NULL) {
608 			printf("%s: could not read endpoint descriptor %d\n",
609 			    USBDEVNAME(sc->sc_dev), i);
610 
611 			return EIO;
612 		}
613 
614 		DPRINTFN(5, "%s: endpoint type %02x (%02x) addr %02x (%s)\n",
615 			USBDEVNAME(sc->sc_dev),
616 			UE_GET_XFERTYPE(ed->bmAttributes),
617 			UE_GET_ISO_TYPE(ed->bmAttributes),
618 			ed->bEndpointAddress,
619 			UE_GET_DIR(ed->bEndpointAddress) ? "in" : "out");
620 
621 		if (UE_GET_XFERTYPE(ed->bmAttributes) != UE_ISOCHRONOUS)
622 			continue;
623 
624 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) {
625 			rd_addr = ed->bEndpointAddress;
626 			rd_size = UGETW(ed->wMaxPacketSize);
627 		} else {
628 			wr_addr = ed->bEndpointAddress;
629 			wr_size = UGETW(ed->wMaxPacketSize);
630 		}
631 	}
632 
633 	if (rd_addr == -1) {
634 		aprint_error(
635 		    "%s: missing ISOC IN endpoint on interface config %d\n",
636 		    USBDEVNAME(sc->sc_dev), sc->sc_config);
637 
638 		return ENOENT;
639 	}
640 	if (wr_addr == -1) {
641 		aprint_error(
642 		    "%s: missing ISOC OUT endpoint on interface config %d\n",
643 		    USBDEVNAME(sc->sc_dev), sc->sc_config);
644 
645 		return ENOENT;
646 	}
647 
648 #ifdef DIAGNOSTIC
649 	if (rd_size > MLEN) {
650 		printf("%s: rd_size=%d exceeds MLEN\n",
651 		    USBDEVNAME(sc->sc_dev), rd_size);
652 
653 		return EOVERFLOW;
654 	}
655 
656 	if (wr_size > MLEN) {
657 		printf("%s: wr_size=%d exceeds MLEN\n",
658 		    USBDEVNAME(sc->sc_dev), wr_size);
659 
660 		return EOVERFLOW;
661 	}
662 #endif
663 
664 	sc->sc_scord_size = rd_size;
665 	sc->sc_scord_addr = rd_addr;
666 
667 	sc->sc_scowr_size = wr_size;
668 	sc->sc_scowr_addr = wr_addr;
669 
670 	return 0;
671 }
672 
673 /* sysctl helper to set alternate configurations */
674 static int
675 ubt_sysctl_config(SYSCTLFN_ARGS)
676 {
677 	struct sysctlnode node;
678 	struct ubt_softc *sc;
679 	int t, error;
680 
681 	node = *rnode;
682 	sc = node.sysctl_data;
683 
684 	t = sc->sc_config;
685 	node.sysctl_data = &t;
686 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
687 	if (error || newp == NULL)
688 		return error;
689 
690 	if (t < 0 || t >= sc->sc_alt_config)
691 		return EINVAL;
692 
693 	sc->sc_config = t;
694 	return ubt_set_isoc_config(sc);
695 }
696 
697 static void
698 ubt_abortdealloc(struct ubt_softc *sc)
699 {
700 	int i;
701 
702 	DPRINTFN(1, "sc=%p\n", sc);
703 
704 	/* Abort all pipes */
705 	if (sc->sc_evt_pipe != NULL) {
706 		usbd_abort_pipe(sc->sc_evt_pipe);
707 		usbd_close_pipe(sc->sc_evt_pipe);
708 		sc->sc_evt_pipe = NULL;
709 	}
710 
711 	if (sc->sc_aclrd_pipe != NULL) {
712 		usbd_abort_pipe(sc->sc_aclrd_pipe);
713 		usbd_close_pipe(sc->sc_aclrd_pipe);
714 		sc->sc_aclrd_pipe = NULL;
715 	}
716 
717 	if (sc->sc_aclwr_pipe != NULL) {
718 		usbd_abort_pipe(sc->sc_aclwr_pipe);
719 		usbd_close_pipe(sc->sc_aclwr_pipe);
720 		sc->sc_aclwr_pipe = NULL;
721 	}
722 
723 	if (sc->sc_scord_pipe != NULL) {
724 		usbd_abort_pipe(sc->sc_scord_pipe);
725 		usbd_close_pipe(sc->sc_scord_pipe);
726 		sc->sc_scord_pipe = NULL;
727 	}
728 
729 	if (sc->sc_scowr_pipe != NULL) {
730 		usbd_abort_pipe(sc->sc_scowr_pipe);
731 		usbd_close_pipe(sc->sc_scowr_pipe);
732 		sc->sc_scowr_pipe = NULL;
733 	}
734 
735 	/* Free event buffer */
736 	if (sc->sc_evt_buf != NULL) {
737 		free(sc->sc_evt_buf, M_USBDEV);
738 		sc->sc_evt_buf = NULL;
739 	}
740 
741 	/* Free all xfers and xfer buffers (implicit) */
742 	if (sc->sc_cmd_xfer != NULL) {
743 		usbd_free_xfer(sc->sc_cmd_xfer);
744 		sc->sc_cmd_xfer = NULL;
745 		sc->sc_cmd_buf = NULL;
746 	}
747 
748 	if (sc->sc_aclrd_xfer != NULL) {
749 		usbd_free_xfer(sc->sc_aclrd_xfer);
750 		sc->sc_aclrd_xfer = NULL;
751 		sc->sc_aclrd_buf = NULL;
752 	}
753 
754 	if (sc->sc_aclwr_xfer != NULL) {
755 		usbd_free_xfer(sc->sc_aclwr_xfer);
756 		sc->sc_aclwr_xfer = NULL;
757 		sc->sc_aclwr_buf = NULL;
758 	}
759 
760 	for (i = 0 ; i < UBT_NXFERS ; i++) {
761 		if (sc->sc_scord[i].xfer != NULL) {
762 			usbd_free_xfer(sc->sc_scord[i].xfer);
763 			sc->sc_scord[i].xfer = NULL;
764 			sc->sc_scord[i].buf = NULL;
765 		}
766 
767 		if (sc->sc_scowr[i].xfer != NULL) {
768 			usbd_free_xfer(sc->sc_scowr[i].xfer);
769 			sc->sc_scowr[i].xfer = NULL;
770 			sc->sc_scowr[i].buf = NULL;
771 		}
772 	}
773 
774 	/* Free partial SCO packets */
775 	if (sc->sc_scord_mbuf != NULL) {
776 		m_freem(sc->sc_scord_mbuf);
777 		sc->sc_scord_mbuf = NULL;
778 	}
779 
780 	if (sc->sc_scowr_mbuf != NULL) {
781 		m_freem(sc->sc_scowr_mbuf);
782 		sc->sc_scowr_mbuf = NULL;
783 	}
784 }
785 
786 /*******************************************************************************
787  *
788  * Bluetooth Unit/USB callbacks
789  *
790  * All of this will be called at the IPL_ we specified above
791  */
792 static int
793 ubt_enable(struct hci_unit *unit)
794 {
795 	struct ubt_softc *sc = unit->hci_softc;
796 	usbd_status err;
797 	int i, error;
798 
799 	DPRINTFN(1, "sc=%p\n", sc);
800 
801 	if (unit->hci_flags & BTF_RUNNING)
802 		return 0;
803 
804 	/* Events */
805 	sc->sc_evt_buf = malloc(UBT_BUFSIZ_EVENT, M_USBDEV, M_NOWAIT);
806 	if (sc->sc_evt_buf == NULL) {
807 		error = ENOMEM;
808 		goto bad;
809 	}
810 	err = usbd_open_pipe_intr(sc->sc_iface0,
811 				  sc->sc_evt_addr,
812 				  USBD_SHORT_XFER_OK,
813 				  &sc->sc_evt_pipe,
814 				  sc,
815 				  sc->sc_evt_buf,
816 				  UBT_BUFSIZ_EVENT,
817 				  ubt_recv_event,
818 				  UBT_EVENT_INTERVAL);
819 	if (err != USBD_NORMAL_COMPLETION) {
820 		error = EIO;
821 		goto bad;
822 	}
823 
824 	/* Commands */
825 	sc->sc_cmd_xfer = usbd_alloc_xfer(sc->sc_udev);
826 	if (sc->sc_cmd_xfer == NULL) {
827 		error = ENOMEM;
828 		goto bad;
829 	}
830 	sc->sc_cmd_buf = usbd_alloc_buffer(sc->sc_cmd_xfer, UBT_BUFSIZ_CMD);
831 	if (sc->sc_cmd_buf == NULL) {
832 		error = ENOMEM;
833 		goto bad;
834 	}
835 
836 	/* ACL read */
837 	err = usbd_open_pipe(sc->sc_iface0, sc->sc_aclrd_addr,
838 				USBD_EXCLUSIVE_USE, &sc->sc_aclrd_pipe);
839 	if (err != USBD_NORMAL_COMPLETION) {
840 		error = EIO;
841 		goto bad;
842 	}
843 	sc->sc_aclrd_xfer = usbd_alloc_xfer(sc->sc_udev);
844 	if (sc->sc_aclrd_xfer == NULL) {
845 		error = ENOMEM;
846 		goto bad;
847 	}
848 	sc->sc_aclrd_buf = usbd_alloc_buffer(sc->sc_aclrd_xfer, UBT_BUFSIZ_ACL);
849 	if (sc->sc_aclrd_buf == NULL) {
850 		error = ENOMEM;
851 		goto bad;
852 	}
853 	sc->sc_aclrd_busy = 0;
854 	ubt_recv_acl_start(sc);
855 
856 	/* ACL write */
857 	err = usbd_open_pipe(sc->sc_iface0, sc->sc_aclwr_addr,
858 				USBD_EXCLUSIVE_USE, &sc->sc_aclwr_pipe);
859 	if (err != USBD_NORMAL_COMPLETION) {
860 		error = EIO;
861 		goto bad;
862 	}
863 	sc->sc_aclwr_xfer = usbd_alloc_xfer(sc->sc_udev);
864 	if (sc->sc_aclwr_xfer == NULL) {
865 		error = ENOMEM;
866 		goto bad;
867 	}
868 	sc->sc_aclwr_buf = usbd_alloc_buffer(sc->sc_aclwr_xfer, UBT_BUFSIZ_ACL);
869 	if (sc->sc_aclwr_buf == NULL) {
870 		error = ENOMEM;
871 		goto bad;
872 	}
873 
874 	/* SCO read */
875 	if (sc->sc_scord_size > 0) {
876 		err = usbd_open_pipe(sc->sc_iface1, sc->sc_scord_addr,
877 					USBD_EXCLUSIVE_USE, &sc->sc_scord_pipe);
878 		if (err != USBD_NORMAL_COMPLETION) {
879 			error = EIO;
880 			goto bad;
881 		}
882 
883 		for (i = 0 ; i < UBT_NXFERS ; i++) {
884 			sc->sc_scord[i].xfer = usbd_alloc_xfer(sc->sc_udev);
885 			if (sc->sc_scord[i].xfer == NULL) {
886 				error = ENOMEM;
887 				goto bad;
888 			}
889 			sc->sc_scord[i].buf = usbd_alloc_buffer(sc->sc_scord[i].xfer,
890 						sc->sc_scord_size * UBT_NFRAMES);
891 			if (sc->sc_scord[i].buf == NULL) {
892 				error = ENOMEM;
893 				goto bad;
894 			}
895 			sc->sc_scord[i].softc = sc;
896 			sc->sc_scord[i].busy = 0;
897 			ubt_recv_sco_start1(sc, &sc->sc_scord[i]);
898 		}
899 	}
900 
901 	/* SCO write */
902 	if (sc->sc_scowr_size > 0) {
903 		err = usbd_open_pipe(sc->sc_iface1, sc->sc_scowr_addr,
904 					USBD_EXCLUSIVE_USE, &sc->sc_scowr_pipe);
905 		if (err != USBD_NORMAL_COMPLETION) {
906 			error = EIO;
907 			goto bad;
908 		}
909 
910 		for (i = 0 ; i < UBT_NXFERS ; i++) {
911 			sc->sc_scowr[i].xfer = usbd_alloc_xfer(sc->sc_udev);
912 			if (sc->sc_scowr[i].xfer == NULL) {
913 				error = ENOMEM;
914 				goto bad;
915 			}
916 			sc->sc_scowr[i].buf = usbd_alloc_buffer(sc->sc_scowr[i].xfer,
917 						sc->sc_scowr_size * UBT_NFRAMES);
918 			if (sc->sc_scowr[i].buf == NULL) {
919 				error = ENOMEM;
920 				goto bad;
921 			}
922 			sc->sc_scowr[i].softc = sc;
923 			sc->sc_scowr[i].busy = 0;
924 		}
925 	}
926 
927 	unit->hci_flags &= ~BTF_XMIT;
928 	unit->hci_flags |= BTF_RUNNING;
929 	return 0;
930 
931 bad:
932 	ubt_abortdealloc(sc);
933 	return error;
934 }
935 
936 static void
937 ubt_disable(struct hci_unit *unit)
938 {
939 	struct ubt_softc *sc = unit->hci_softc;
940 
941 	DPRINTFN(1, "sc=%p\n", sc);
942 
943 	if ((unit->hci_flags & BTF_RUNNING) == 0)
944 		return;
945 
946 	ubt_abortdealloc(sc);
947 
948 	unit->hci_flags &= ~BTF_RUNNING;
949 }
950 
951 static void
952 ubt_xmit_cmd_start(struct hci_unit *unit)
953 {
954 	struct ubt_softc *sc = unit->hci_softc;
955 	usb_device_request_t req;
956 	usbd_status status;
957 	struct mbuf *m;
958 	int len;
959 
960 	if (sc->sc_dying)
961 		return;
962 
963 	if (MBUFQ_FIRST(&unit->hci_cmdq) == NULL)
964 		return;
965 
966 	MBUFQ_DEQUEUE(&unit->hci_cmdq, m);
967 	KASSERT(m != NULL);
968 
969 	DPRINTFN(15, "%s: xmit CMD packet (%d bytes)\n",
970 			unit->hci_devname, m->m_pkthdr.len);
971 
972 	sc->sc_refcnt++;
973 	unit->hci_flags |= BTF_XMIT_CMD;
974 
975 	len = m->m_pkthdr.len - 1;
976 	m_copydata(m, 1, len, sc->sc_cmd_buf);
977 	m_freem(m);
978 
979 	memset(&req, 0, sizeof(req));
980 	req.bmRequestType = UT_WRITE_CLASS_DEVICE;
981 	USETW(req.wLength, len);
982 
983 	usbd_setup_default_xfer(sc->sc_cmd_xfer,
984 				sc->sc_udev,
985 				unit,
986 				UBT_CMD_TIMEOUT,
987 				&req,
988 				sc->sc_cmd_buf,
989 				len,
990 				USBD_NO_COPY | USBD_FORCE_SHORT_XFER,
991 				ubt_xmit_cmd_complete);
992 
993 	status = usbd_transfer(sc->sc_cmd_xfer);
994 
995 	KASSERT(status != USBD_NORMAL_COMPLETION);
996 
997 	if (status != USBD_IN_PROGRESS) {
998 		DPRINTF("usbd_transfer status=%s (%d)\n",
999 			usbd_errstr(status), status);
1000 
1001 		sc->sc_refcnt--;
1002 		unit->hci_flags &= ~BTF_XMIT_CMD;
1003 	}
1004 }
1005 
1006 static void
1007 ubt_xmit_cmd_complete(usbd_xfer_handle xfer,
1008 			usbd_private_handle h, usbd_status status)
1009 {
1010 	struct hci_unit *unit = h;
1011 	struct ubt_softc *sc = unit->hci_softc;
1012 	uint32_t count;
1013 
1014 	DPRINTFN(15, "%s: CMD complete status=%s (%d)\n",
1015 			unit->hci_devname, usbd_errstr(status), status);
1016 
1017 	unit->hci_flags &= ~BTF_XMIT_CMD;
1018 
1019 	if (--sc->sc_refcnt < 0) {
1020 		DPRINTF("sc_refcnt=%d\n", sc->sc_refcnt);
1021 		usb_detach_wakeup(USBDEV(sc->sc_dev));
1022 		return;
1023 	}
1024 
1025 	if (sc->sc_dying) {
1026 		DPRINTF("sc_dying\n");
1027 		return;
1028 	}
1029 
1030 	if (status != USBD_NORMAL_COMPLETION) {
1031 		DPRINTF("status=%s (%d)\n",
1032 			usbd_errstr(status), status);
1033 
1034 		unit->hci_stats.err_tx++;
1035 		return;
1036 	}
1037 
1038 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1039 	unit->hci_stats.cmd_tx++;
1040 	unit->hci_stats.byte_tx += count;
1041 
1042 	ubt_xmit_cmd_start(unit);
1043 }
1044 
1045 static void
1046 ubt_xmit_acl_start(struct hci_unit *unit)
1047 {
1048 	struct ubt_softc *sc = unit->hci_softc;
1049 	struct mbuf *m;
1050 	usbd_status status;
1051 	int len;
1052 
1053 	if (sc->sc_dying)
1054 		return;
1055 
1056 	if (MBUFQ_FIRST(&unit->hci_acltxq) == NULL)
1057 		return;
1058 
1059 	sc->sc_refcnt++;
1060 	unit->hci_flags |= BTF_XMIT_ACL;
1061 
1062 	MBUFQ_DEQUEUE(&unit->hci_acltxq, m);
1063 	KASSERT(m != NULL);
1064 
1065 	DPRINTFN(15, "%s: xmit ACL packet (%d bytes)\n",
1066 			unit->hci_devname, m->m_pkthdr.len);
1067 
1068 	len = m->m_pkthdr.len - 1;
1069 	if (len > UBT_BUFSIZ_ACL) {
1070 		DPRINTF("%s: truncating ACL packet (%d => %d)!\n",
1071 			unit->hci_devname, len, UBT_BUFSIZ_ACL);
1072 
1073 		len = UBT_BUFSIZ_ACL;
1074 	}
1075 
1076 	m_copydata(m, 1, len, sc->sc_aclwr_buf);
1077 	m_freem(m);
1078 
1079 	unit->hci_stats.acl_tx++;
1080 	unit->hci_stats.byte_tx += len;
1081 
1082 	usbd_setup_xfer(sc->sc_aclwr_xfer,
1083 			sc->sc_aclwr_pipe,
1084 			unit,
1085 			sc->sc_aclwr_buf,
1086 			len,
1087 			USBD_NO_COPY | USBD_FORCE_SHORT_XFER,
1088 			UBT_ACL_TIMEOUT,
1089 			ubt_xmit_acl_complete);
1090 
1091 	status = usbd_transfer(sc->sc_aclwr_xfer);
1092 
1093 	KASSERT(status != USBD_NORMAL_COMPLETION);
1094 
1095 	if (status != USBD_IN_PROGRESS) {
1096 		DPRINTF("usbd_transfer status=%s (%d)\n",
1097 			usbd_errstr(status), status);
1098 
1099 		sc->sc_refcnt--;
1100 		unit->hci_flags &= ~BTF_XMIT_ACL;
1101 	}
1102 }
1103 
1104 static void
1105 ubt_xmit_acl_complete(usbd_xfer_handle xfer,
1106 		usbd_private_handle h, usbd_status status)
1107 {
1108 	struct hci_unit *unit = h;
1109 	struct ubt_softc *sc = unit->hci_softc;
1110 
1111 	DPRINTFN(15, "%s: ACL complete status=%s (%d)\n",
1112 		unit->hci_devname, usbd_errstr(status), status);
1113 
1114 	unit->hci_flags &= ~BTF_XMIT_ACL;
1115 
1116 	if (--sc->sc_refcnt < 0) {
1117 		usb_detach_wakeup(USBDEV(sc->sc_dev));
1118 		return;
1119 	}
1120 
1121 	if (sc->sc_dying)
1122 		return;
1123 
1124 	if (status != USBD_NORMAL_COMPLETION) {
1125 		DPRINTF("status=%s (%d)\n",
1126 			usbd_errstr(status), status);
1127 
1128 		unit->hci_stats.err_tx++;
1129 
1130 		if (status == USBD_STALLED)
1131 			usbd_clear_endpoint_stall_async(sc->sc_aclwr_pipe);
1132 		else
1133 			return;
1134 	}
1135 
1136 	ubt_xmit_acl_start(unit);
1137 }
1138 
1139 static void
1140 ubt_xmit_sco_start(struct hci_unit *unit)
1141 {
1142 	struct ubt_softc *sc = unit->hci_softc;
1143 	int i;
1144 
1145 	if (sc->sc_dying || sc->sc_scowr_size == 0)
1146 		return;
1147 
1148 	for (i = 0 ; i < UBT_NXFERS ; i++) {
1149 		if (sc->sc_scowr[i].busy)
1150 			continue;
1151 
1152 		ubt_xmit_sco_start1(sc, &sc->sc_scowr[i]);
1153 	}
1154 }
1155 
1156 static void
1157 ubt_xmit_sco_start1(struct ubt_softc *sc, struct ubt_isoc_xfer *isoc)
1158 {
1159 	struct mbuf *m;
1160 	uint8_t *buf;
1161 	int num, len, size, space;
1162 
1163 	space = sc->sc_scowr_size * UBT_NFRAMES;
1164 	buf = isoc->buf;
1165 	len = 0;
1166 
1167 	/*
1168 	 * Fill the request buffer with data from the queue,
1169 	 * keeping any leftover packet on our private hook.
1170 	 *
1171 	 * Complete packets are passed back up to the stack
1172 	 * for disposal, since we can't rely on the controller
1173 	 * to tell us when it has finished with them.
1174 	 */
1175 
1176 	m = sc->sc_scowr_mbuf;
1177 	while (space > 0) {
1178 		if (m == NULL) {
1179 			MBUFQ_DEQUEUE(&sc->sc_unit.hci_scotxq, m);
1180 			if (m == NULL)
1181 				break;
1182 
1183 			m_adj(m, 1);	/* packet type */
1184 		}
1185 
1186 		if (m->m_pkthdr.len > 0) {
1187 			size = MIN(m->m_pkthdr.len, space);
1188 
1189 			m_copydata(m, 0, size, buf);
1190 			m_adj(m, size);
1191 
1192 			buf += size;
1193 			len += size;
1194 			space -= size;
1195 		}
1196 
1197 		if (m->m_pkthdr.len == 0) {
1198 			sc->sc_unit.hci_stats.sco_tx++;
1199 			hci_complete_sco(&sc->sc_unit, m);
1200 			m = NULL;
1201 		}
1202 	}
1203 	sc->sc_scowr_mbuf = m;
1204 
1205 	DPRINTFN(15, "isoc=%p, len=%d, space=%d\n", isoc, len, space);
1206 
1207 	if (len == 0)	/* nothing to send */
1208 		return;
1209 
1210 	sc->sc_refcnt++;
1211 	sc->sc_unit.hci_flags |= BTF_XMIT_SCO;
1212 	sc->sc_unit.hci_stats.byte_tx += len;
1213 	isoc->busy = 1;
1214 
1215 	/*
1216 	 * calculate number of isoc frames and sizes
1217 	 */
1218 
1219 	for (num = 0 ; len > 0 ; num++) {
1220 		size = MIN(sc->sc_scowr_size, len);
1221 
1222 		isoc->size[num] = size;
1223 		len -= size;
1224 	}
1225 
1226 	usbd_setup_isoc_xfer(isoc->xfer,
1227 			     sc->sc_scowr_pipe,
1228 			     isoc,
1229 			     isoc->size,
1230 			     num,
1231 			     USBD_NO_COPY | USBD_FORCE_SHORT_XFER,
1232 			     ubt_xmit_sco_complete);
1233 
1234 	usbd_transfer(isoc->xfer);
1235 }
1236 
1237 static void
1238 ubt_xmit_sco_complete(usbd_xfer_handle xfer,
1239 		usbd_private_handle h, usbd_status status)
1240 {
1241 	struct ubt_isoc_xfer *isoc = h;
1242 	struct ubt_softc *sc;
1243 	int i;
1244 
1245 	KASSERT(xfer == isoc->xfer);
1246 	sc = isoc->softc;
1247 
1248 	DPRINTFN(15, "isoc=%p, status=%s (%d)\n",
1249 		isoc, usbd_errstr(status), status);
1250 
1251 	isoc->busy = 0;
1252 
1253 	for (i = 0 ; ; i++) {
1254 		if (i == UBT_NXFERS) {
1255 			sc->sc_unit.hci_flags &= ~BTF_XMIT_SCO;
1256 			break;
1257 		}
1258 
1259 		if (sc->sc_scowr[i].busy)
1260 			break;
1261 	}
1262 
1263 	if (--sc->sc_refcnt < 0) {
1264 		usb_detach_wakeup(USBDEV(sc->sc_dev));
1265 		return;
1266 	}
1267 
1268 	if (sc->sc_dying)
1269 		return;
1270 
1271 	if (status != USBD_NORMAL_COMPLETION) {
1272 		DPRINTF("status=%s (%d)\n",
1273 			usbd_errstr(status), status);
1274 
1275 		sc->sc_unit.hci_stats.err_tx++;
1276 
1277 		if (status == USBD_STALLED)
1278 			usbd_clear_endpoint_stall_async(sc->sc_scowr_pipe);
1279 		else
1280 			return;
1281 	}
1282 
1283 	ubt_xmit_sco_start(&sc->sc_unit);
1284 }
1285 
1286 /*
1287  * load incoming data into an mbuf with
1288  * leading type byte
1289  */
1290 static struct mbuf *
1291 ubt_mbufload(uint8_t *buf, int count, uint8_t type)
1292 {
1293 	struct mbuf *m;
1294 
1295 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1296 	if (m == NULL)
1297 		return NULL;
1298 
1299 	*mtod(m, uint8_t *) = type;
1300 	m->m_pkthdr.len = m->m_len = MHLEN;
1301 	m_copyback(m, 1, count, buf);	// (extends if necessary)
1302 	if (m->m_pkthdr.len != MAX(MHLEN, count + 1)) {
1303 		m_free(m);
1304 		return NULL;
1305 	}
1306 
1307 	m->m_pkthdr.len = count + 1;
1308 	m->m_len = MIN(MHLEN, m->m_pkthdr.len);
1309 
1310 	return m;
1311 }
1312 
1313 static void
1314 ubt_recv_event(usbd_xfer_handle xfer, usbd_private_handle h, usbd_status status)
1315 {
1316 	struct ubt_softc *sc = h;
1317 	struct mbuf *m;
1318 	uint32_t count;
1319 	void *buf;
1320 
1321 	DPRINTFN(15, "sc=%p status=%s (%d)\n",
1322 		    sc, usbd_errstr(status), status);
1323 
1324 	if (status != USBD_NORMAL_COMPLETION || sc->sc_dying)
1325 		return;
1326 
1327 	usbd_get_xfer_status(xfer, NULL, &buf, &count, NULL);
1328 
1329 	sc->sc_unit.hci_stats.evt_rx++;
1330 	sc->sc_unit.hci_stats.byte_rx += count;
1331 
1332 	m = ubt_mbufload(buf, count, HCI_EVENT_PKT);
1333 	if (m != NULL)
1334 		hci_input_event(&sc->sc_unit, m);
1335 	else
1336 		sc->sc_unit.hci_stats.err_rx++;
1337 }
1338 
1339 static void
1340 ubt_recv_acl_start(struct ubt_softc *sc)
1341 {
1342 	usbd_status status;
1343 
1344 	DPRINTFN(15, "sc=%p\n", sc);
1345 
1346 	if (sc->sc_aclrd_busy || sc->sc_dying) {
1347 		DPRINTF("sc_aclrd_busy=%d, sc_dying=%d\n",
1348 			sc->sc_aclrd_busy,
1349 			sc->sc_dying);
1350 
1351 		return;
1352 	}
1353 
1354 	sc->sc_refcnt++;
1355 	sc->sc_aclrd_busy = 1;
1356 
1357 	usbd_setup_xfer(sc->sc_aclrd_xfer,
1358 			sc->sc_aclrd_pipe,
1359 			sc,
1360 			sc->sc_aclrd_buf,
1361 			UBT_BUFSIZ_ACL,
1362 			USBD_NO_COPY | USBD_SHORT_XFER_OK,
1363 			USBD_NO_TIMEOUT,
1364 			ubt_recv_acl_complete);
1365 
1366 	status = usbd_transfer(sc->sc_aclrd_xfer);
1367 
1368 	KASSERT(status != USBD_NORMAL_COMPLETION);
1369 
1370 	if (status != USBD_IN_PROGRESS) {
1371 		DPRINTF("usbd_transfer status=%s (%d)\n",
1372 			usbd_errstr(status), status);
1373 
1374 		sc->sc_refcnt--;
1375 		sc->sc_aclrd_busy = 0;
1376 	}
1377 }
1378 
1379 static void
1380 ubt_recv_acl_complete(usbd_xfer_handle xfer,
1381 		usbd_private_handle h, usbd_status status)
1382 {
1383 	struct ubt_softc *sc = h;
1384 	struct mbuf *m;
1385 	uint32_t count;
1386 	void *buf;
1387 
1388 	DPRINTFN(15, "sc=%p status=%s (%d)\n",
1389 			sc, usbd_errstr(status), status);
1390 
1391 	sc->sc_aclrd_busy = 0;
1392 
1393 	if (--sc->sc_refcnt < 0) {
1394 		DPRINTF("refcnt = %d\n", sc->sc_refcnt);
1395 		usb_detach_wakeup(USBDEV(sc->sc_dev));
1396 		return;
1397 	}
1398 
1399 	if (sc->sc_dying) {
1400 		DPRINTF("sc_dying\n");
1401 		return;
1402 	}
1403 
1404 	if (status != USBD_NORMAL_COMPLETION) {
1405 		DPRINTF("status=%s (%d)\n",
1406 			usbd_errstr(status), status);
1407 
1408 		sc->sc_unit.hci_stats.err_rx++;
1409 
1410 		if (status == USBD_STALLED)
1411 			usbd_clear_endpoint_stall_async(sc->sc_aclrd_pipe);
1412 		else
1413 			return;
1414 	} else {
1415 		usbd_get_xfer_status(xfer, NULL, &buf, &count, NULL);
1416 
1417 		sc->sc_unit.hci_stats.acl_rx++;
1418 		sc->sc_unit.hci_stats.byte_rx += count;
1419 
1420 		m = ubt_mbufload(buf, count, HCI_ACL_DATA_PKT);
1421 		if (m != NULL)
1422 			hci_input_acl(&sc->sc_unit, m);
1423 		else
1424 			sc->sc_unit.hci_stats.err_rx++;
1425 	}
1426 
1427 	/* and restart */
1428 	ubt_recv_acl_start(sc);
1429 }
1430 
1431 static void
1432 ubt_recv_sco_start1(struct ubt_softc *sc, struct ubt_isoc_xfer *isoc)
1433 {
1434 	int i;
1435 
1436 	DPRINTFN(15, "sc=%p, isoc=%p\n", sc, isoc);
1437 
1438 	if (isoc->busy || sc->sc_dying || sc->sc_scord_size == 0) {
1439 		DPRINTF("%s%s%s\n",
1440 			isoc->busy ? " busy" : "",
1441 			sc->sc_dying ? " dying" : "",
1442 			sc->sc_scord_size == 0 ? " size=0" : "");
1443 
1444 		return;
1445 	}
1446 
1447 	sc->sc_refcnt++;
1448 	isoc->busy = 1;
1449 
1450 	for (i = 0 ; i < UBT_NFRAMES ; i++)
1451 		isoc->size[i] = sc->sc_scord_size;
1452 
1453 	usbd_setup_isoc_xfer(isoc->xfer,
1454 			     sc->sc_scord_pipe,
1455 			     isoc,
1456 			     isoc->size,
1457 			     UBT_NFRAMES,
1458 			     USBD_NO_COPY | USBD_SHORT_XFER_OK,
1459 			     ubt_recv_sco_complete);
1460 
1461 	usbd_transfer(isoc->xfer);
1462 }
1463 
1464 static void
1465 ubt_recv_sco_complete(usbd_xfer_handle xfer,
1466 		usbd_private_handle h, usbd_status status)
1467 {
1468 	struct ubt_isoc_xfer *isoc = h;
1469 	struct ubt_softc *sc;
1470 	struct mbuf *m;
1471 	uint32_t count;
1472 	uint8_t *ptr, *frame;
1473 	int i, size, got, want;
1474 
1475 	KASSERT(isoc != NULL);
1476 	KASSERT(isoc->xfer == xfer);
1477 
1478 	sc = isoc->softc;
1479 	isoc->busy = 0;
1480 
1481 	if (--sc->sc_refcnt < 0) {
1482 		DPRINTF("refcnt=%d\n", sc->sc_refcnt);
1483 		usb_detach_wakeup(USBDEV(sc->sc_dev));
1484 		return;
1485 	}
1486 
1487 	if (sc->sc_dying) {
1488 		DPRINTF("sc_dying\n");
1489 		return;
1490 	}
1491 
1492 	if (status != USBD_NORMAL_COMPLETION) {
1493 		DPRINTF("status=%s (%d)\n",
1494 			usbd_errstr(status), status);
1495 
1496 		sc->sc_unit.hci_stats.err_rx++;
1497 
1498 		if (status == USBD_STALLED) {
1499 			usbd_clear_endpoint_stall_async(sc->sc_scord_pipe);
1500 			goto restart;
1501 		}
1502 
1503 		return;
1504 	}
1505 
1506 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1507 	if (count == 0)
1508 		goto restart;
1509 
1510 	DPRINTFN(15, "sc=%p, isoc=%p, count=%u\n",
1511 			sc, isoc, count);
1512 
1513 	sc->sc_unit.hci_stats.byte_rx += count;
1514 
1515 	/*
1516 	 * Extract SCO packets from ISOC frames. The way we have it,
1517 	 * no SCO packet can be bigger than MHLEN. This is unlikely
1518 	 * to actually happen, but if we ran out of mbufs and lost
1519 	 * sync then we may get spurious data that makes it seem that
1520 	 * way, so we discard data that wont fit. This doesnt really
1521 	 * help with the lost sync situation alas.
1522 	 */
1523 
1524 	m = sc->sc_scord_mbuf;
1525 	if (m != NULL) {
1526 		sc->sc_scord_mbuf = NULL;
1527 		ptr = mtod(m, uint8_t *) + m->m_pkthdr.len;
1528 		got = m->m_pkthdr.len;
1529 		want = sizeof(hci_scodata_hdr_t);
1530 		if (got >= want)
1531 			want += mtod(m, hci_scodata_hdr_t *)->length ;
1532 	} else {
1533 		ptr = NULL;
1534 		got = 0;
1535 		want = 0;
1536 	}
1537 
1538 	for (i = 0 ; i < UBT_NFRAMES ; i++) {
1539 		frame = isoc->buf + (i * sc->sc_scord_size);
1540 
1541 		while (isoc->size[i] > 0) {
1542 			size = isoc->size[i];
1543 
1544 			if (m == NULL) {
1545 				MGETHDR(m, M_DONTWAIT, MT_DATA);
1546 				if (m == NULL) {
1547 					printf("%s: out of memory (xfer halted)\n",
1548 						USBDEVNAME(sc->sc_dev));
1549 
1550 					sc->sc_unit.hci_stats.err_rx++;
1551 					return;		/* lost sync */
1552 				}
1553 
1554 				ptr = mtod(m, uint8_t *);
1555 				*ptr++ = HCI_SCO_DATA_PKT;
1556 				got = 1;
1557 				want = sizeof(hci_scodata_hdr_t);
1558 			}
1559 
1560 			if (got + size > want)
1561 				size = want - got;
1562 
1563 			if (got + size > MHLEN)
1564 				memcpy(ptr, frame, MHLEN - got);
1565 			else
1566 				memcpy(ptr, frame, size);
1567 
1568 			ptr += size;
1569 			got += size;
1570 			frame += size;
1571 
1572 			if (got == want) {
1573 				/*
1574 				 * If we only got a header, add the packet
1575 				 * length to our want count. Send complete
1576 				 * packets up to protocol stack.
1577 				 */
1578 				if (want == sizeof(hci_scodata_hdr_t))
1579 					want += mtod(m, hci_scodata_hdr_t *)->length;
1580 
1581 				if (got == want) {
1582 					m->m_pkthdr.len = m->m_len = got;
1583 					sc->sc_unit.hci_stats.sco_rx++;
1584 					hci_input_sco(&sc->sc_unit, m);
1585 					m = NULL;
1586 				}
1587 			}
1588 
1589 			isoc->size[i] -= size;
1590 		}
1591 	}
1592 
1593 	if (m != NULL) {
1594 		m->m_pkthdr.len = m->m_len = got;
1595 		sc->sc_scord_mbuf = m;
1596 	}
1597 
1598 restart: /* and restart */
1599 	ubt_recv_sco_start1(sc, isoc);
1600 }
1601