Home | History | Annotate | Line # | Download | only in bluetooth
bthidev.c revision 1.32.4.1
      1 /*	$NetBSD: bthidev.c,v 1.32.4.1 2021/03/22 02:00:59 thorpej Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2006 Itronix Inc.
      5  * All rights reserved.
      6  *
      7  * Written by Iain Hibbert for Itronix Inc.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. The name of Itronix Inc. may not be used to endorse
     18  *    or promote products derived from this software without specific
     19  *    prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
     25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     26  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
     28  * ON ANY THEORY OF LIABILITY, WHETHER IN
     29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     31  * POSSIBILITY OF SUCH DAMAGE.
     32  */
     33 
     34 #include <sys/cdefs.h>
     35 __KERNEL_RCSID(0, "$NetBSD: bthidev.c,v 1.32.4.1 2021/03/22 02:00:59 thorpej Exp $");
     36 
     37 #include <sys/param.h>
     38 #include <sys/condvar.h>
     39 #include <sys/conf.h>
     40 #include <sys/device.h>
     41 #include <sys/fcntl.h>
     42 #include <sys/kernel.h>
     43 #include <sys/kthread.h>
     44 #include <sys/queue.h>
     45 #include <sys/malloc.h>
     46 #include <sys/mbuf.h>
     47 #include <sys/mutex.h>
     48 #include <sys/proc.h>
     49 #include <sys/socketvar.h>
     50 #include <sys/systm.h>
     51 
     52 #include <prop/proplib.h>
     53 
     54 #include <netbt/bluetooth.h>
     55 #include <netbt/l2cap.h>
     56 
     57 #include <dev/hid/hid.h>
     58 #include <dev/bluetooth/btdev.h>
     59 #include <dev/bluetooth/bthid.h>
     60 #include <dev/bluetooth/bthidev.h>
     61 
     62 #include "locators.h"
     63 
     64 /*****************************************************************************
     65  *
     66  *	Bluetooth HID device
     67  */
     68 
     69 #define MAX_DESCRIPTOR_LEN	1024		/* sanity check */
     70 
     71 /* bthidev softc */
     72 struct bthidev_softc {
     73 	uint16_t		sc_state;
     74 	uint16_t		sc_flags;
     75 	device_t		sc_dev;
     76 
     77 	bdaddr_t		sc_laddr;	/* local address */
     78 	bdaddr_t		sc_raddr;	/* remote address */
     79 	struct sockopt		sc_mode;	/* link mode sockopt */
     80 
     81 	uint16_t		sc_ctlpsm;	/* control PSM */
     82 	struct l2cap_channel	*sc_ctl;	/* control channel */
     83 	struct l2cap_channel	*sc_ctl_l;	/* control listen */
     84 
     85 	uint16_t		sc_intpsm;	/* interrupt PSM */
     86 	struct l2cap_channel	*sc_int;	/* interrupt channel */
     87 	struct l2cap_channel	*sc_int_l;	/* interrupt listen */
     88 
     89 	MBUFQ_HEAD()		sc_inq;		/* input queue */
     90 	kmutex_t		sc_lock;	/* input queue lock */
     91 	kcondvar_t		sc_cv;		/* input queue trigger */
     92 	lwp_t			*sc_lwp;	/* input queue processor */
     93 	int			sc_detach;
     94 
     95 	LIST_HEAD(,bthidev)	sc_list;	/* child list */
     96 
     97 	callout_t		sc_reconnect;
     98 	int			sc_attempts;	/* connection attempts */
     99 };
    100 
    101 /* sc_flags */
    102 #define BTHID_RECONNECT		(1 << 0)	/* reconnect on link loss */
    103 #define BTHID_CONNECTING	(1 << 1)	/* we are connecting */
    104 
    105 /* device state */
    106 #define BTHID_CLOSED		0
    107 #define BTHID_WAIT_CTL		1
    108 #define BTHID_WAIT_INT		2
    109 #define BTHID_OPEN		3
    110 
    111 #define	BTHID_RETRY_INTERVAL	5	/* seconds between connection attempts */
    112 
    113 /* bthidev internals */
    114 static void bthidev_timeout(void *);
    115 static int  bthidev_listen(struct bthidev_softc *);
    116 static int  bthidev_connect(struct bthidev_softc *);
    117 static int  bthidev_output(struct bthidev *, uint8_t *, int);
    118 static void bthidev_null(struct bthidev *, uint8_t *, int);
    119 static void bthidev_process(void *);
    120 static void bthidev_process_one(struct bthidev_softc *, struct mbuf *);
    121 
    122 /* autoconf(9) glue */
    123 static int  bthidev_match(device_t, cfdata_t, void *);
    124 static void bthidev_attach(device_t, device_t, void *);
    125 static int  bthidev_detach(device_t, int);
    126 static int  bthidev_print(void *, const char *);
    127 
    128 CFATTACH_DECL_NEW(bthidev, sizeof(struct bthidev_softc),
    129     bthidev_match, bthidev_attach, bthidev_detach, NULL);
    130 
    131 /* bluetooth(9) protocol methods for L2CAP */
    132 static void  bthidev_connecting(void *);
    133 static void  bthidev_ctl_connected(void *);
    134 static void  bthidev_int_connected(void *);
    135 static void  bthidev_ctl_disconnected(void *, int);
    136 static void  bthidev_int_disconnected(void *, int);
    137 static void *bthidev_ctl_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
    138 static void *bthidev_int_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
    139 static void  bthidev_complete(void *, int);
    140 static void  bthidev_linkmode(void *, int);
    141 static void  bthidev_input(void *, struct mbuf *);
    142 
    143 static const struct btproto bthidev_ctl_proto = {
    144 	bthidev_connecting,
    145 	bthidev_ctl_connected,
    146 	bthidev_ctl_disconnected,
    147 	bthidev_ctl_newconn,
    148 	bthidev_complete,
    149 	bthidev_linkmode,
    150 	bthidev_input,
    151 };
    152 
    153 static const struct btproto bthidev_int_proto = {
    154 	bthidev_connecting,
    155 	bthidev_int_connected,
    156 	bthidev_int_disconnected,
    157 	bthidev_int_newconn,
    158 	bthidev_complete,
    159 	bthidev_linkmode,
    160 	bthidev_input,
    161 };
    162 
    163 /*****************************************************************************
    164  *
    165  *	bthidev autoconf(9) routines
    166  */
    167 
    168 static int
    169 bthidev_match(device_t self, cfdata_t cfdata, void *aux)
    170 {
    171 	prop_dictionary_t dict = aux;
    172 	prop_object_t obj;
    173 
    174 	obj = prop_dictionary_get(dict, BTDEVservice);
    175 	if (prop_string_equals_string(obj, "HID"))
    176 		return 1;
    177 
    178 	return 0;
    179 }
    180 
    181 static void
    182 bthidev_attach(device_t parent, device_t self, void *aux)
    183 {
    184 	struct bthidev_softc *sc = device_private(self);
    185 	prop_dictionary_t dict = aux;
    186 	prop_object_t obj;
    187 	device_t dev;
    188 	struct bthidev_attach_args bha;
    189 	struct bthidev *hidev;
    190 	struct hid_data *d;
    191 	struct hid_item h;
    192 	const void *desc;
    193 	int locs[BTHIDBUSCF_NLOCS];
    194 	int maxid, rep, dlen;
    195 	int vendor, product;
    196 	int err;
    197 
    198 	/*
    199 	 * Init softc
    200 	 */
    201 	sc->sc_dev = self;
    202 	LIST_INIT(&sc->sc_list);
    203 	MBUFQ_INIT(&sc->sc_inq);
    204 	callout_init(&sc->sc_reconnect, 0);
    205 	callout_setfunc(&sc->sc_reconnect, bthidev_timeout, sc);
    206 	sc->sc_state = BTHID_CLOSED;
    207 	sc->sc_flags = BTHID_CONNECTING;
    208 	sc->sc_ctlpsm = L2CAP_PSM_HID_CNTL;
    209 	sc->sc_intpsm = L2CAP_PSM_HID_INTR;
    210 
    211 	sockopt_init(&sc->sc_mode, BTPROTO_L2CAP, SO_L2CAP_LM, 0);
    212 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NONE);
    213 	cv_init(&sc->sc_cv, device_xname(self));
    214 
    215 	/*
    216 	 * extract config from proplist
    217 	 */
    218 	obj = prop_dictionary_get(dict, BTDEVladdr);
    219 	bdaddr_copy(&sc->sc_laddr, prop_data_value(obj));
    220 
    221 	obj = prop_dictionary_get(dict, BTDEVraddr);
    222 	bdaddr_copy(&sc->sc_raddr, prop_data_value(obj));
    223 
    224 	obj = prop_dictionary_get(dict, BTDEVvendor);
    225 	vendor = (int)prop_number_signed_value(obj);
    226 
    227 	obj = prop_dictionary_get(dict, BTDEVproduct);
    228 	product = (int)prop_number_signed_value(obj);
    229 
    230 	obj = prop_dictionary_get(dict, BTDEVmode);
    231 	if (prop_object_type(obj) == PROP_TYPE_STRING) {
    232 		if (prop_string_equals_string(obj, BTDEVauth))
    233 			sockopt_setint(&sc->sc_mode, L2CAP_LM_AUTH);
    234 		else if (prop_string_equals_string(obj, BTDEVencrypt))
    235 			sockopt_setint(&sc->sc_mode, L2CAP_LM_ENCRYPT);
    236 		else if (prop_string_equals_string(obj, BTDEVsecure))
    237 			sockopt_setint(&sc->sc_mode, L2CAP_LM_SECURE);
    238 		else  {
    239 			aprint_error(" unknown %s\n", BTDEVmode);
    240 			return;
    241 		}
    242 
    243 		aprint_verbose(" %s %s", BTDEVmode,
    244 					 prop_string_value(obj));
    245 	} else
    246 		sockopt_setint(&sc->sc_mode, 0);
    247 
    248 	obj = prop_dictionary_get(dict, BTHIDEVcontrolpsm);
    249 	if (prop_object_type(obj) == PROP_TYPE_NUMBER) {
    250 		sc->sc_ctlpsm = prop_number_signed_value(obj);
    251 		if (L2CAP_PSM_INVALID(sc->sc_ctlpsm)) {
    252 			aprint_error(" invalid %s\n", BTHIDEVcontrolpsm);
    253 			return;
    254 		}
    255 	}
    256 
    257 	obj = prop_dictionary_get(dict, BTHIDEVinterruptpsm);
    258 	if (prop_object_type(obj) == PROP_TYPE_NUMBER) {
    259 		sc->sc_intpsm = prop_number_signed_value(obj);
    260 		if (L2CAP_PSM_INVALID(sc->sc_intpsm)) {
    261 			aprint_error(" invalid %s\n", BTHIDEVinterruptpsm);
    262 			return;
    263 		}
    264 	}
    265 
    266 	obj = prop_dictionary_get(dict, BTHIDEVdescriptor);
    267 	if (prop_object_type(obj) == PROP_TYPE_DATA) {
    268 		dlen = prop_data_size(obj);
    269 		desc = prop_data_value(obj);
    270 	} else {
    271 		aprint_error(" no %s\n", BTHIDEVdescriptor);
    272 		return;
    273 	}
    274 
    275 	obj = prop_dictionary_get(dict, BTHIDEVreconnect);
    276 	if (prop_object_type(obj) == PROP_TYPE_BOOL
    277 	    && !prop_bool_true(obj))
    278 		sc->sc_flags |= BTHID_RECONNECT;
    279 
    280 	/*
    281 	 * Parse the descriptor and attach child devices, one per report.
    282 	 */
    283 	maxid = -1;
    284 	h.report_ID = 0;
    285 	d = hid_start_parse(desc, dlen, hid_none);
    286 	while (hid_get_item(d, &h)) {
    287 		if ((int)h.report_ID > maxid)
    288 			maxid = h.report_ID;
    289 	}
    290 	hid_end_parse(d);
    291 
    292 	if (maxid < 0) {
    293 		aprint_error(" no reports found\n");
    294 		return;
    295 	}
    296 
    297 	aprint_normal("\n");
    298 
    299 	if (kthread_create(PRI_NONE, KTHREAD_MUSTJOIN, NULL, bthidev_process,
    300 	    sc, &sc->sc_lwp, "%s", device_xname(self)) != 0) {
    301 		aprint_error_dev(self, "failed to create input thread\n");
    302 		return;
    303 	}
    304 
    305 	for (rep = 0 ; rep <= maxid ; rep++) {
    306 		if (hid_report_size(desc, dlen, hid_feature, rep) == 0
    307 		    && hid_report_size(desc, dlen, hid_input, rep) == 0
    308 		    && hid_report_size(desc, dlen, hid_output, rep) == 0)
    309 			continue;
    310 
    311 		bha.ba_vendor = vendor;
    312 		bha.ba_product = product;
    313 		bha.ba_desc = desc;
    314 		bha.ba_dlen = dlen;
    315 		bha.ba_input = bthidev_null;
    316 		bha.ba_feature = bthidev_null;
    317 		bha.ba_output = bthidev_output;
    318 		bha.ba_id = rep;
    319 
    320 		locs[BTHIDBUSCF_REPORTID] = rep;
    321 
    322 		dev = config_found(self, &bha, bthidev_print,
    323 		    CFARG_SUBMATCH, config_stdsubmatch,
    324 		    CFARG_IATTR, "bthidbus",
    325 		    CFARG_LOCATORS, locs,
    326 		    CFARG_EOL);
    327 		if (dev != NULL) {
    328 			hidev = device_private(dev);
    329 			hidev->sc_dev = dev;
    330 			hidev->sc_parent = self;
    331 			hidev->sc_id = rep;
    332 			hidev->sc_input = bha.ba_input;
    333 			hidev->sc_feature = bha.ba_feature;
    334 			LIST_INSERT_HEAD(&sc->sc_list, hidev, sc_next);
    335 		}
    336 	}
    337 
    338 	pmf_device_register(self, NULL, NULL);
    339 
    340 	/*
    341 	 * start bluetooth connections
    342 	 */
    343 	mutex_enter(bt_lock);
    344 	if ((sc->sc_flags & BTHID_RECONNECT) == 0
    345 	    && (err = bthidev_listen(sc)) != 0)
    346 		aprint_error_dev(self, "failed to listen (%d)\n", err);
    347 
    348 	if (sc->sc_flags & BTHID_CONNECTING)
    349 		bthidev_connect(sc);
    350 	mutex_exit(bt_lock);
    351 }
    352 
    353 static int
    354 bthidev_detach(device_t self, int flags)
    355 {
    356 	struct bthidev_softc *sc = device_private(self);
    357 	struct bthidev *hidev;
    358 
    359 	mutex_enter(bt_lock);
    360 	sc->sc_flags = 0;	/* disable reconnecting */
    361 
    362 	/* release interrupt listen */
    363 	if (sc->sc_int_l != NULL) {
    364 		l2cap_detach_pcb(&sc->sc_int_l);
    365 		sc->sc_int_l = NULL;
    366 	}
    367 
    368 	/* release control listen */
    369 	if (sc->sc_ctl_l != NULL) {
    370 		l2cap_detach_pcb(&sc->sc_ctl_l);
    371 		sc->sc_ctl_l = NULL;
    372 	}
    373 
    374 	/* close interrupt channel */
    375 	if (sc->sc_int != NULL) {
    376 		l2cap_disconnect_pcb(sc->sc_int, 0);
    377 		l2cap_detach_pcb(&sc->sc_int);
    378 		sc->sc_int = NULL;
    379 	}
    380 
    381 	/* close control channel */
    382 	if (sc->sc_ctl != NULL) {
    383 		l2cap_disconnect_pcb(sc->sc_ctl, 0);
    384 		l2cap_detach_pcb(&sc->sc_ctl);
    385 		sc->sc_ctl = NULL;
    386 	}
    387 
    388 	callout_halt(&sc->sc_reconnect, bt_lock);
    389 	callout_destroy(&sc->sc_reconnect);
    390 
    391 	mutex_exit(bt_lock);
    392 
    393 	pmf_device_deregister(self);
    394 
    395 	/* kill off the input processor */
    396 	if (sc->sc_lwp != NULL) {
    397 		mutex_enter(&sc->sc_lock);
    398 		sc->sc_detach = 1;
    399 		cv_signal(&sc->sc_cv);
    400 		mutex_exit(&sc->sc_lock);
    401 		kthread_join(sc->sc_lwp);
    402 		sc->sc_lwp = NULL;
    403 	}
    404 
    405 	/* detach children */
    406 	while ((hidev = LIST_FIRST(&sc->sc_list)) != NULL) {
    407 		LIST_REMOVE(hidev, sc_next);
    408 		config_detach(hidev->sc_dev, flags);
    409 	}
    410 
    411 	MBUFQ_DRAIN(&sc->sc_inq);
    412 	cv_destroy(&sc->sc_cv);
    413 	mutex_destroy(&sc->sc_lock);
    414 	sockopt_destroy(&sc->sc_mode);
    415 
    416 	return 0;
    417 }
    418 
    419 /*
    420  * bthidev config print
    421  */
    422 static int
    423 bthidev_print(void *aux, const char *pnp)
    424 {
    425 	struct bthidev_attach_args *ba = aux;
    426 
    427 	if (pnp != NULL)
    428 		aprint_normal("%s:", pnp);
    429 
    430 	if (ba->ba_id > 0)
    431 		aprint_normal(" reportid %d", ba->ba_id);
    432 
    433 	return UNCONF;
    434 }
    435 
    436 /*****************************************************************************
    437  *
    438  *	bluetooth(4) HID attach/detach routines
    439  */
    440 
    441 /*
    442  * callouts are scheduled after connections have been lost, in order
    443  * to clean up and reconnect.
    444  */
    445 static void
    446 bthidev_timeout(void *arg)
    447 {
    448 	struct bthidev_softc *sc = arg;
    449 
    450 	mutex_enter(bt_lock);
    451 	callout_ack(&sc->sc_reconnect);
    452 
    453 	switch (sc->sc_state) {
    454 	case BTHID_CLOSED:
    455 		if (sc->sc_int != NULL) {
    456 			l2cap_disconnect_pcb(sc->sc_int, 0);
    457 			break;
    458 		}
    459 
    460 		if (sc->sc_ctl != NULL) {
    461 			l2cap_disconnect_pcb(sc->sc_ctl, 0);
    462 			break;
    463 		}
    464 
    465 		if (sc->sc_flags & BTHID_RECONNECT) {
    466 			sc->sc_flags |= BTHID_CONNECTING;
    467 			bthidev_connect(sc);
    468 			break;
    469 		}
    470 
    471 		break;
    472 
    473 	case BTHID_WAIT_CTL:
    474 		break;
    475 
    476 	case BTHID_WAIT_INT:
    477 		break;
    478 
    479 	case BTHID_OPEN:
    480 		break;
    481 
    482 	default:
    483 		break;
    484 	}
    485 	mutex_exit(bt_lock);
    486 }
    487 
    488 /*
    489  * listen for our device
    490  */
    491 static int
    492 bthidev_listen(struct bthidev_softc *sc)
    493 {
    494 	struct sockaddr_bt sa;
    495 	int err;
    496 
    497 	memset(&sa, 0, sizeof(sa));
    498 	sa.bt_len = sizeof(sa);
    499 	sa.bt_family = AF_BLUETOOTH;
    500 	bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
    501 
    502 	/*
    503 	 * Listen on control PSM
    504 	 */
    505 	err = l2cap_attach_pcb(&sc->sc_ctl_l, &bthidev_ctl_proto, sc);
    506 	if (err)
    507 		return err;
    508 
    509 	err = l2cap_setopt(sc->sc_ctl_l, &sc->sc_mode);
    510 	if (err)
    511 		return err;
    512 
    513 	sa.bt_psm = sc->sc_ctlpsm;
    514 	err = l2cap_bind_pcb(sc->sc_ctl_l, &sa);
    515 	if (err)
    516 		return err;
    517 
    518 	err = l2cap_listen_pcb(sc->sc_ctl_l);
    519 	if (err)
    520 		return err;
    521 
    522 	/*
    523 	 * Listen on interrupt PSM
    524 	 */
    525 	err = l2cap_attach_pcb(&sc->sc_int_l, &bthidev_int_proto, sc);
    526 	if (err)
    527 		return err;
    528 
    529 	err = l2cap_setopt(sc->sc_int_l, &sc->sc_mode);
    530 	if (err)
    531 		return err;
    532 
    533 	sa.bt_psm = sc->sc_intpsm;
    534 	err = l2cap_bind_pcb(sc->sc_int_l, &sa);
    535 	if (err)
    536 		return err;
    537 
    538 	err = l2cap_listen_pcb(sc->sc_int_l);
    539 	if (err)
    540 		return err;
    541 
    542 	sc->sc_state = BTHID_WAIT_CTL;
    543 	return 0;
    544 }
    545 
    546 /*
    547  * start connecting to our device
    548  */
    549 static int
    550 bthidev_connect(struct bthidev_softc *sc)
    551 {
    552 	struct sockaddr_bt sa;
    553 	int err;
    554 
    555 	if (sc->sc_attempts++ > 0)
    556 		aprint_verbose_dev(sc->sc_dev, "connect (#%d)\n", sc->sc_attempts);
    557 
    558 	memset(&sa, 0, sizeof(sa));
    559 	sa.bt_len = sizeof(sa);
    560 	sa.bt_family = AF_BLUETOOTH;
    561 
    562 	err = l2cap_attach_pcb(&sc->sc_ctl, &bthidev_ctl_proto, sc);
    563 	if (err) {
    564 		aprint_error_dev(sc->sc_dev, "l2cap_attach failed (%d)\n", err);
    565 		return err;
    566 	}
    567 
    568 	err = l2cap_setopt(sc->sc_ctl, &sc->sc_mode);
    569 	if (err) {
    570 		aprint_error_dev(sc->sc_dev, "l2cap_setopt failed (%d)\n", err);
    571 		return err;
    572 	}
    573 
    574 	bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
    575 	err = l2cap_bind_pcb(sc->sc_ctl, &sa);
    576 	if (err) {
    577 		aprint_error_dev(sc->sc_dev, "l2cap_bind_pcb failed (%d)\n", err);
    578 		return err;
    579 	}
    580 
    581 	sa.bt_psm = sc->sc_ctlpsm;
    582 	bdaddr_copy(&sa.bt_bdaddr, &sc->sc_raddr);
    583 	err = l2cap_connect_pcb(sc->sc_ctl, &sa);
    584 	if (err) {
    585 		aprint_error_dev(sc->sc_dev, "l2cap_connect_pcb failed (%d)\n", err);
    586 		return err;
    587 	}
    588 
    589 	sc->sc_state = BTHID_WAIT_CTL;
    590 	return 0;
    591 }
    592 
    593 /*
    594  * The LWP which processes input reports, forwarding to child devices.
    595  * We are always either processing input reports, holding the lock, or
    596  * waiting for a signal on condvar.
    597  */
    598 static void
    599 bthidev_process(void *arg)
    600 {
    601 	struct bthidev_softc *sc = arg;
    602 	struct mbuf *m;
    603 
    604 	mutex_enter(&sc->sc_lock);
    605 	while (sc->sc_detach == 0) {
    606 		MBUFQ_DEQUEUE(&sc->sc_inq, m);
    607 		if (m == NULL) {
    608 			cv_wait(&sc->sc_cv, &sc->sc_lock);
    609 			continue;
    610 		}
    611 
    612 		mutex_exit(&sc->sc_lock);
    613 		bthidev_process_one(sc, m);
    614 		m_freem(m);
    615 		mutex_enter(&sc->sc_lock);
    616 	}
    617 	mutex_exit(&sc->sc_lock);
    618 	kthread_exit(0);
    619 }
    620 
    621 static void
    622 bthidev_process_one(struct bthidev_softc *sc, struct mbuf *m)
    623 {
    624 	struct bthidev *hidev;
    625 	uint8_t *data;
    626 	int len;
    627 
    628 	if (sc->sc_state != BTHID_OPEN)
    629 		return;
    630 
    631 	if (m->m_pkthdr.len > m->m_len)
    632 		aprint_error_dev(sc->sc_dev, "truncating HID report\n");
    633 
    634 	len = m->m_len;
    635 	data = mtod(m, uint8_t *);
    636 
    637 	switch (BTHID_TYPE(data[0])) {
    638 	case BTHID_DATA:
    639 		/*
    640 		 * data[0] == type / parameter
    641 		 * data[1] == id
    642 		 * data[2..len] == report
    643 		 */
    644 		if (len < 3)
    645 			break;
    646 
    647 		LIST_FOREACH(hidev, &sc->sc_list, sc_next)
    648 			if (data[1] == hidev->sc_id)
    649 				break;
    650 
    651 		if (hidev == NULL) {
    652 			aprint_error_dev(sc->sc_dev,
    653 			    "report id %d, len = %d ignored\n", data[1], len - 2);
    654 
    655 			break;
    656 		}
    657 
    658 		switch (BTHID_DATA_PARAM(data[0])) {
    659 		case BTHID_DATA_INPUT:
    660 			(*hidev->sc_input)(hidev, data + 2, len - 2);
    661 			break;
    662 
    663 		case BTHID_DATA_FEATURE:
    664 			(*hidev->sc_feature)(hidev, data + 2, len - 2);
    665 			break;
    666 
    667 		default:
    668 			break;
    669 		}
    670 
    671 		break;
    672 
    673 	case BTHID_CONTROL:
    674 		if (len < 1)
    675 			break;
    676 
    677 		switch (BTHID_DATA_PARAM(data[0])) {
    678 		case BTHID_CONTROL_UNPLUG:
    679 			aprint_normal_dev(sc->sc_dev, "unplugged\n");
    680 
    681 			mutex_enter(bt_lock);
    682 			/* close interrupt channel */
    683 			if (sc->sc_int != NULL) {
    684 				l2cap_disconnect_pcb(sc->sc_int, 0);
    685 				l2cap_detach_pcb(&sc->sc_int);
    686 				sc->sc_int = NULL;
    687 			}
    688 
    689 			/* close control channel */
    690 			if (sc->sc_ctl != NULL) {
    691 				l2cap_disconnect_pcb(sc->sc_ctl, 0);
    692 				l2cap_detach_pcb(&sc->sc_ctl);
    693 				sc->sc_ctl = NULL;
    694 			}
    695 			mutex_exit(bt_lock);
    696 
    697 			break;
    698 
    699 		default:
    700 			break;
    701 		}
    702 
    703 		break;
    704 
    705 	default:
    706 		break;
    707 	}
    708 }
    709 
    710 /*****************************************************************************
    711  *
    712  *	bluetooth(9) callback methods for L2CAP
    713  *
    714  *	All these are called from Bluetooth Protocol code, in a soft
    715  *	interrupt context at IPL_SOFTNET.
    716  */
    717 
    718 static void
    719 bthidev_connecting(void *arg)
    720 {
    721 
    722 	/* dont care */
    723 }
    724 
    725 static void
    726 bthidev_ctl_connected(void *arg)
    727 {
    728 	struct sockaddr_bt sa;
    729 	struct bthidev_softc *sc = arg;
    730 	int err;
    731 
    732 	if (sc->sc_state != BTHID_WAIT_CTL)
    733 		return;
    734 
    735 	KASSERT(sc->sc_ctl != NULL);
    736 	KASSERT(sc->sc_int == NULL);
    737 
    738 	if (sc->sc_flags & BTHID_CONNECTING) {
    739 		/* initiate connect on interrupt PSM */
    740 		err = l2cap_attach_pcb(&sc->sc_int, &bthidev_int_proto, sc);
    741 		if (err)
    742 			goto fail;
    743 
    744 		err = l2cap_setopt(sc->sc_int, &sc->sc_mode);
    745 		if (err)
    746 			goto fail;
    747 
    748 		memset(&sa, 0, sizeof(sa));
    749 		sa.bt_len = sizeof(sa);
    750 		sa.bt_family = AF_BLUETOOTH;
    751 		bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
    752 
    753 		err = l2cap_bind_pcb(sc->sc_int, &sa);
    754 		if (err)
    755 			goto fail;
    756 
    757 		sa.bt_psm = sc->sc_intpsm;
    758 		bdaddr_copy(&sa.bt_bdaddr, &sc->sc_raddr);
    759 		err = l2cap_connect_pcb(sc->sc_int, &sa);
    760 		if (err)
    761 			goto fail;
    762 	}
    763 
    764 	sc->sc_state = BTHID_WAIT_INT;
    765 	return;
    766 
    767 fail:
    768 	l2cap_detach_pcb(&sc->sc_ctl);
    769 	sc->sc_ctl = NULL;
    770 
    771 	aprint_error_dev(sc->sc_dev, "connect failed (%d)\n", err);
    772 }
    773 
    774 static void
    775 bthidev_int_connected(void *arg)
    776 {
    777 	struct bthidev_softc *sc = arg;
    778 
    779 	if (sc->sc_state != BTHID_WAIT_INT)
    780 		return;
    781 
    782 	KASSERT(sc->sc_ctl != NULL);
    783 	KASSERT(sc->sc_int != NULL);
    784 
    785 	sc->sc_attempts = 0;
    786 	sc->sc_flags &= ~BTHID_CONNECTING;
    787 	sc->sc_state = BTHID_OPEN;
    788 
    789 	aprint_normal_dev(sc->sc_dev, "connected\n");
    790 }
    791 
    792 /*
    793  * Disconnected
    794  *
    795  * Depending on our state, this could mean several things, but essentially
    796  * we are lost. If both channels are closed, and we are marked to reconnect,
    797  * schedule another try otherwise just give up. They will contact us.
    798  */
    799 static void
    800 bthidev_ctl_disconnected(void *arg, int err)
    801 {
    802 	struct bthidev_softc *sc = arg;
    803 
    804 	if (sc->sc_ctl != NULL) {
    805 		l2cap_detach_pcb(&sc->sc_ctl);
    806 		sc->sc_ctl = NULL;
    807 	}
    808 
    809 	sc->sc_state = BTHID_CLOSED;
    810 
    811 	if (sc->sc_int == NULL) {
    812 		aprint_normal_dev(sc->sc_dev, "disconnected (%d)\n", err);
    813 		sc->sc_flags &= ~BTHID_CONNECTING;
    814 
    815 		if (sc->sc_flags & BTHID_RECONNECT)
    816 			callout_schedule(&sc->sc_reconnect,
    817 					BTHID_RETRY_INTERVAL * hz);
    818 		else
    819 			sc->sc_state = BTHID_WAIT_CTL;
    820 	} else {
    821 		/*
    822 		 * The interrupt channel should have been closed first,
    823 		 * but its potentially unsafe to detach that from here.
    824 		 * Give them a second to do the right thing or let the
    825 		 * callout handle it.
    826 		 */
    827 		callout_schedule(&sc->sc_reconnect, hz);
    828 	}
    829 }
    830 
    831 static void
    832 bthidev_int_disconnected(void *arg, int err)
    833 {
    834 	struct bthidev_softc *sc = arg;
    835 
    836 	if (sc->sc_int != NULL) {
    837 		l2cap_detach_pcb(&sc->sc_int);
    838 		sc->sc_int = NULL;
    839 	}
    840 
    841 	sc->sc_state = BTHID_CLOSED;
    842 
    843 	if (sc->sc_ctl == NULL) {
    844 		aprint_normal_dev(sc->sc_dev, "disconnected (%d)\n", err);
    845 		sc->sc_flags &= ~BTHID_CONNECTING;
    846 
    847 		if (sc->sc_flags & BTHID_RECONNECT)
    848 			callout_schedule(&sc->sc_reconnect,
    849 					BTHID_RETRY_INTERVAL * hz);
    850 		else
    851 			sc->sc_state = BTHID_WAIT_CTL;
    852 	} else {
    853 		/*
    854 		 * The control channel should be closing also, allow
    855 		 * them a chance to do that before we force it.
    856 		 */
    857 		callout_schedule(&sc->sc_reconnect, hz);
    858 	}
    859 }
    860 
    861 /*
    862  * New Connections
    863  *
    864  * We give a new L2CAP handle back if this matches the BDADDR we are
    865  * listening for and we are in the right state. bthidev_connected will
    866  * be called when the connection is open, so nothing else to do here
    867  */
    868 static void *
    869 bthidev_ctl_newconn(void *arg, struct sockaddr_bt *laddr,
    870     struct sockaddr_bt *raddr)
    871 {
    872 	struct bthidev_softc *sc = arg;
    873 
    874 	if (bdaddr_same(&raddr->bt_bdaddr, &sc->sc_raddr) == 0)
    875 		return NULL;
    876 
    877 	if ((sc->sc_flags & BTHID_CONNECTING)
    878 	    || sc->sc_state != BTHID_WAIT_CTL
    879 	    || sc->sc_ctl != NULL
    880 	    || sc->sc_int != NULL) {
    881 		aprint_verbose_dev(sc->sc_dev, "reject ctl newconn %s%s%s%s\n",
    882 		    (sc->sc_flags & BTHID_CONNECTING) ? " (CONNECTING)" : "",
    883 		    (sc->sc_state == BTHID_WAIT_CTL) ? " (WAITING)": "",
    884 		    (sc->sc_ctl != NULL) ? " (GOT CONTROL)" : "",
    885 		    (sc->sc_int != NULL) ? " (GOT INTERRUPT)" : "");
    886 
    887 		return NULL;
    888 	}
    889 
    890 	l2cap_attach_pcb(&sc->sc_ctl, &bthidev_ctl_proto, sc);
    891 	return sc->sc_ctl;
    892 }
    893 
    894 static void *
    895 bthidev_int_newconn(void *arg, struct sockaddr_bt *laddr,
    896     struct sockaddr_bt *raddr)
    897 {
    898 	struct bthidev_softc *sc = arg;
    899 
    900 	if (bdaddr_same(&raddr->bt_bdaddr, &sc->sc_raddr) == 0)
    901 		return NULL;
    902 
    903 	if ((sc->sc_flags & BTHID_CONNECTING)
    904 	    || sc->sc_state != BTHID_WAIT_INT
    905 	    || sc->sc_ctl == NULL
    906 	    || sc->sc_int != NULL) {
    907 		aprint_verbose_dev(sc->sc_dev, "reject int newconn %s%s%s%s\n",
    908 		    (sc->sc_flags & BTHID_CONNECTING) ? " (CONNECTING)" : "",
    909 		    (sc->sc_state == BTHID_WAIT_INT) ? " (WAITING)": "",
    910 		    (sc->sc_ctl == NULL) ? " (NO CONTROL)" : "",
    911 		    (sc->sc_int != NULL) ? " (GOT INTERRUPT)" : "");
    912 
    913 		return NULL;
    914 	}
    915 
    916 	l2cap_attach_pcb(&sc->sc_int, &bthidev_int_proto, sc);
    917 	return sc->sc_int;
    918 }
    919 
    920 static void
    921 bthidev_complete(void *arg, int count)
    922 {
    923 
    924 	/* dont care */
    925 }
    926 
    927 static void
    928 bthidev_linkmode(void *arg, int new)
    929 {
    930 	struct bthidev_softc *sc = arg;
    931 	int mode;
    932 
    933 	(void)sockopt_getint(&sc->sc_mode, &mode);
    934 
    935 	if ((mode & L2CAP_LM_AUTH) && !(new & L2CAP_LM_AUTH))
    936 		aprint_error_dev(sc->sc_dev, "auth failed\n");
    937 	else if ((mode & L2CAP_LM_ENCRYPT) && !(new & L2CAP_LM_ENCRYPT))
    938 		aprint_error_dev(sc->sc_dev, "encrypt off\n");
    939 	else if ((mode & L2CAP_LM_SECURE) && !(new & L2CAP_LM_SECURE))
    940 		aprint_error_dev(sc->sc_dev, "insecure\n");
    941 	else
    942 		return;
    943 
    944 	if (sc->sc_int != NULL)
    945 		l2cap_disconnect_pcb(sc->sc_int, 0);
    946 
    947 	if (sc->sc_ctl != NULL)
    948 		l2cap_disconnect_pcb(sc->sc_ctl, 0);
    949 }
    950 
    951 /*
    952  * Receive reports from the protocol stack. Because this will be called
    953  * with bt_lock held, we queue the mbuf and process it with a kernel thread
    954  */
    955 static void
    956 bthidev_input(void *arg, struct mbuf *m)
    957 {
    958 	struct bthidev_softc *sc = arg;
    959 
    960 	if (sc->sc_state != BTHID_OPEN) {
    961 		m_freem(m);
    962 		return;
    963 	}
    964 
    965 	mutex_enter(&sc->sc_lock);
    966 	MBUFQ_ENQUEUE(&sc->sc_inq, m);
    967 	cv_signal(&sc->sc_cv);
    968 	mutex_exit(&sc->sc_lock);
    969 }
    970 
    971 /*****************************************************************************
    972  *
    973  *	IO routines
    974  */
    975 
    976 static void
    977 bthidev_null(struct bthidev *hidev, uint8_t *report, int len)
    978 {
    979 
    980 	/*
    981 	 * empty routine just in case the device
    982 	 * provided no method to handle this report
    983 	 */
    984 }
    985 
    986 static int
    987 bthidev_output(struct bthidev *hidev, uint8_t *report, int rlen)
    988 {
    989 	struct bthidev_softc *sc = device_private(hidev->sc_parent);
    990 	struct mbuf *m;
    991 	int err;
    992 
    993 	if (sc == NULL || sc->sc_state != BTHID_OPEN)
    994 		return ENOTCONN;
    995 
    996 	KASSERT(sc->sc_ctl != NULL);
    997 	KASSERT(sc->sc_int != NULL);
    998 
    999 	if (rlen == 0 || report == NULL)
   1000 		return 0;
   1001 
   1002 	if (rlen > MHLEN - 2) {
   1003 		aprint_error_dev(sc->sc_dev,
   1004 		    "output report too long (%d)!\n", rlen);
   1005 		return EMSGSIZE;
   1006 	}
   1007 
   1008 	m = m_gethdr(M_DONTWAIT, MT_DATA);
   1009 	if (m == NULL)
   1010 		return ENOMEM;
   1011 
   1012 	/*
   1013 	 * data[0] = type / parameter
   1014 	 * data[1] = id
   1015 	 * data[2..N] = report
   1016 	 */
   1017 	mtod(m, uint8_t *)[0] = (uint8_t)((BTHID_DATA << 4) | BTHID_DATA_OUTPUT);
   1018 	mtod(m, uint8_t *)[1] = hidev->sc_id;
   1019 	memcpy(mtod(m, uint8_t *) + 2, report, rlen);
   1020 	m->m_pkthdr.len = m->m_len = rlen + 2;
   1021 
   1022 	mutex_enter(bt_lock);
   1023 	err = l2cap_send_pcb(sc->sc_int, m);
   1024 	mutex_exit(bt_lock);
   1025 
   1026 	return err;
   1027 }
   1028