/*      $NetBSD: btmagic.c,v 1.21 2021/08/07 16:19:09 thorpej Exp $     */

/*-
 * Copyright (c) 2010 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Iain Hibbert.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Lennart Augustsson (lennart@augustsson.net) at
 * Carlstedt Research & Technology.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */
/*-
 * Copyright (c) 2006 Itronix Inc.
 * All rights reserved.
 *
 * Written by Iain Hibbert for Itronix Inc.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of Itronix Inc. may not be used to endorse
 *    or promote products derived from this software without specific
 *    prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */


/*****************************************************************************
 *
 *              Apple Bluetooth Magic Mouse driver
 *
 * The Apple Magic Mouse is a HID device but it doesn't provide a proper HID
 * descriptor, and requires extra initializations to enable the proprietary
 * touch reports. We match against the vendor-id and product-id and provide
 * our own Bluetooth connection handling as the bthidev driver does not cater
 * for such complications.
 *
 * This driver interprets the touch reports only as far as emulating a
 * middle mouse button and providing horizontal and vertical scroll action.
 * Full gesture support would be more complicated and is left as an exercise
 * for the reader.
 *
 * Credit for decoding the proprietary touch reports goes to Michael Poole
 * who wrote the Linux hid-magicmouse input driver.
 *
 *****************************************************************************/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: btmagic.c,v 1.21 2021/08/07 16:19:09 thorpej Exp $");

#include <sys/param.h>
#include <sys/conf.h>
#include <sys/device.h>
#include <sys/fcntl.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/proc.h>
#include <sys/socketvar.h>
#include <sys/systm.h>
#include <sys/sysctl.h>

#include <prop/proplib.h>

#include <netbt/bluetooth.h>
#include <netbt/l2cap.h>

#include <dev/bluetooth/btdev.h>
#include <dev/bluetooth/bthid.h>
#include <dev/bluetooth/bthidev.h>

#include <dev/hid/hid.h>
#include <dev/usb/usb.h>
#include <dev/usb/usbdevs.h>

#include <dev/wscons/wsconsio.h>
#include <dev/wscons/wsmousevar.h>

#undef  DPRINTF
#ifdef  BTMAGIC_DEBUG
#define DPRINTF(sc, ...) do {                           \
        printf("%s: ", device_xname((sc)->sc_dev));     \
        printf(__VA_ARGS__);                            \
        printf("\n");                                   \
} while (/*CONSTCOND*/0)
#else
#define DPRINTF(...)    (void)0
#endif

struct btmagic_softc {
        bdaddr_t                sc_laddr;       /* local address */
        bdaddr_t                sc_raddr;       /* remote address */
        struct sockopt          sc_mode;        /* link mode */

        device_t                sc_dev;
        uint16_t                sc_state;
        uint16_t                sc_flags;

        callout_t               sc_timeout;

        /* control */
        struct l2cap_channel    *sc_ctl;
        struct l2cap_channel    *sc_ctl_l;

        /* interrupt */
        struct l2cap_channel    *sc_int;
        struct l2cap_channel    *sc_int_l;

        /* wsmouse child */
        device_t                sc_wsmouse;
        int                     sc_enabled;

        /* config */
        int                     sc_resolution;  /* for soft scaling */
        int                     sc_firm;        /* firm touch threshold */
        int                     sc_dist;        /* scroll distance threshold */
        int                     sc_scale;       /* scroll descaling */
        struct sysctllog        *sc_log;        /* sysctl teardown log */

        /* remainders */
        int                     sc_rx;
        int                     sc_ry;
        int                     sc_rz;
        int                     sc_rw;

        /* previous touches */
        uint32_t                sc_smask;       /* active IDs */
        int                     sc_nfingers;    /* number of active IDs */
        int                     sc_ax[16];
        int                     sc_ay[16];

        /* previous mouse buttons */
        int                     sc_mb_id; /* which ID selects the button */
        uint32_t                sc_mb;
        /* button emulation with tap */
        int                     sc_tapmb_id; /* which ID selects the button */
        struct timeval          sc_taptime;
        int                     sc_taptimeout;
        callout_t               sc_tapcallout;
};

/* sc_flags */
#define BTMAGIC_CONNECTING      __BIT(0) /* we are connecting */
#define BTMAGIC_ENABLED         __BIT(1) /* touch reports enabled */

/* sc_state */
#define BTMAGIC_CLOSED          0
#define BTMAGIC_WAIT_CTL        1
#define BTMAGIC_WAIT_INT        2
#define BTMAGIC_OPEN            3

/* autoconf(9) glue */
static int  btmagic_match(device_t, cfdata_t, void *);
static void btmagic_attach(device_t, device_t, void *);
static int  btmagic_detach(device_t, int);
static int  btmagic_listen(struct btmagic_softc *);
static int  btmagic_connect(struct btmagic_softc *);
static int  btmagic_sysctl_resolution(SYSCTLFN_PROTO);
static int  btmagic_sysctl_scale(SYSCTLFN_PROTO);
static int  btmagic_tap(struct btmagic_softc *, int);
static int  btmagic_sysctl_taptimeout(SYSCTLFN_PROTO);

CFATTACH_DECL_NEW(btmagic, sizeof(struct btmagic_softc),
    btmagic_match, btmagic_attach, btmagic_detach, NULL);

/* wsmouse(4) accessops */
static int  btmagic_wsmouse_enable(void *);
static int  btmagic_wsmouse_ioctl(void *, unsigned long, void *, int, struct lwp *);
static void btmagic_wsmouse_disable(void *);

static const struct wsmouse_accessops btmagic_wsmouse_accessops = {
        btmagic_wsmouse_enable,
        btmagic_wsmouse_ioctl,
        btmagic_wsmouse_disable,
};

/* bluetooth(9) protocol methods for L2CAP */
static void  btmagic_connecting(void *);
static void  btmagic_ctl_connected(void *);
static void  btmagic_int_connected(void *);
static void  btmagic_ctl_disconnected(void *, int);
static void  btmagic_int_disconnected(void *, int);
static void *btmagic_ctl_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
static void *btmagic_int_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
static void  btmagic_complete(void *, int);
static void  btmagic_linkmode(void *, int);
static void  btmagic_input(void *, struct mbuf *);
static void  btmagic_input_basic(struct btmagic_softc *, uint8_t *, size_t);
static void  btmagic_input_magicm(struct btmagic_softc *, uint8_t *, size_t);
static void  btmagic_input_magict(struct btmagic_softc *, uint8_t *, size_t);
static void  btmagic_tapcallout(void *);

/* report types (data[1]) */
#define BASIC_REPORT_ID         0x10
#define TRACKPAD_REPORT_ID      0x28
#define MOUSE_REPORT_ID         0x29
#define BATT_STAT_REPORT_ID     0x30
#define BATT_STRENGTH_REPORT_ID 0x47
#define SURFACE_REPORT_ID       0x61

static const struct btproto btmagic_ctl_proto = {
        btmagic_connecting,
        btmagic_ctl_connected,
        btmagic_ctl_disconnected,
        btmagic_ctl_newconn,
        btmagic_complete,
        btmagic_linkmode,
        btmagic_input,
};

static const struct btproto btmagic_int_proto = {
        btmagic_connecting,
        btmagic_int_connected,
        btmagic_int_disconnected,
        btmagic_int_newconn,
        btmagic_complete,
        btmagic_linkmode,
        btmagic_input,
};

/* btmagic internals */
static void btmagic_timeout(void *);
static int  btmagic_ctl_send(struct btmagic_softc *, const uint8_t *, size_t);
static void btmagic_enable(struct btmagic_softc *);
static void btmagic_check_battery(struct btmagic_softc *);
static int  btmagic_scale(int, int *, int);


/*****************************************************************************
 *
 *      Magic Mouse autoconf(9) routines
 */

static int
btmagic_match(device_t self, cfdata_t cfdata, void *aux)
{
        uint16_t v, p;

        if (prop_dictionary_get_uint16(aux, BTDEVvendor, &v)
            && prop_dictionary_get_uint16(aux, BTDEVproduct, &p)
            && v == USB_VENDOR_APPLE
            && (p == USB_PRODUCT_APPLE_MAGICMOUSE ||
                p == USB_PRODUCT_APPLE_MAGICTRACKPAD))
                return 2;       /* trump bthidev(4) */

        return 0;
}

static void
btmagic_attach(device_t parent, device_t self, void *aux)
{
        struct btmagic_softc *sc = device_private(self);
        struct wsmousedev_attach_args wsma;
        const struct sysctlnode *node;
        prop_object_t obj;
        int err;

        /*
         * Init softc
         */
        sc->sc_dev = self;
        sc->sc_state = BTMAGIC_CLOSED;
        sc->sc_mb_id = -1;
        sc->sc_tapmb_id = -1;
        callout_init(&sc->sc_timeout, 0);
        callout_setfunc(&sc->sc_timeout, btmagic_timeout, sc);
        callout_init(&sc->sc_tapcallout, 0);
        callout_setfunc(&sc->sc_tapcallout, btmagic_tapcallout, sc);
        sockopt_init(&sc->sc_mode, BTPROTO_L2CAP, SO_L2CAP_LM, 0);

        /*
         * extract config from proplist
         */
        obj = prop_dictionary_get(aux, BTDEVladdr);
        bdaddr_copy(&sc->sc_laddr, prop_data_value(obj));

        obj = prop_dictionary_get(aux, BTDEVraddr);
        bdaddr_copy(&sc->sc_raddr, prop_data_value(obj));

        obj = prop_dictionary_get(aux, BTDEVmode);
        if (prop_object_type(obj) == PROP_TYPE_STRING) {
                if (prop_string_equals_string(obj, BTDEVauth))
                        sockopt_setint(&sc->sc_mode, L2CAP_LM_AUTH);
                else if (prop_string_equals_string(obj, BTDEVencrypt))
                        sockopt_setint(&sc->sc_mode, L2CAP_LM_ENCRYPT);
                else if (prop_string_equals_string(obj, BTDEVsecure))
                        sockopt_setint(&sc->sc_mode, L2CAP_LM_SECURE);
                else  {
                        aprint_error(" unknown %s\n", BTDEVmode);
                        return;
                }

                aprint_verbose(" %s %s", BTDEVmode,
                    prop_string_value(obj));
        } else
                sockopt_setint(&sc->sc_mode, 0);

        aprint_normal(": 3 buttons, W and Z dirs\n");
        aprint_naive("\n");

        /*
         * set defaults
         */
        sc->sc_resolution = 650;
        sc->sc_firm = 6;
        sc->sc_dist = 130;
        sc->sc_scale = 20;
        sc->sc_taptimeout = 100;

        sysctl_createv(&sc->sc_log, 0, NULL, &node,
                0,
                CTLTYPE_NODE, device_xname(self),
                NULL,
                NULL, 0,
                NULL, 0,
                CTL_HW,
                CTL_CREATE, CTL_EOL);

        if (node != NULL) {
                sysctl_createv(&sc->sc_log, 0, NULL, NULL,
                        CTLFLAG_READWRITE,
                        CTLTYPE_INT, "soft_resolution",
                        NULL,
                        btmagic_sysctl_resolution, 0,
                        (void *)sc, 0,
                        CTL_HW, node->sysctl_num,
                        CTL_CREATE, CTL_EOL);

                sysctl_createv(&sc->sc_log, 0, NULL, NULL,
                        CTLFLAG_READWRITE,
                        CTLTYPE_INT, "firm_touch_threshold",
                        NULL,
                        NULL, 0,
                        &sc->sc_firm, sizeof(sc->sc_firm),
                        CTL_HW, node->sysctl_num,
                        CTL_CREATE, CTL_EOL);

                sysctl_createv(&sc->sc_log, 0, NULL, NULL,
                        CTLFLAG_READWRITE,
                        CTLTYPE_INT, "scroll_distance_threshold",
                        NULL,
                        NULL, 0,
                        &sc->sc_dist, sizeof(sc->sc_dist),
                        CTL_HW, node->sysctl_num,
                        CTL_CREATE, CTL_EOL);

                sysctl_createv(&sc->sc_log, 0, NULL, NULL,
                        CTLFLAG_READWRITE,
                        CTLTYPE_INT, "scroll_downscale_factor",
                        NULL,
                        btmagic_sysctl_scale, 0,
                        (void *)sc, 0,
                        CTL_HW, node->sysctl_num,
                        CTL_CREATE, CTL_EOL);
                sysctl_createv(&sc->sc_log, 0, NULL, NULL,
                        CTLFLAG_READWRITE,
                        CTLTYPE_INT, "taptimeout",
                        "timeout for tap detection in milliseconds",
                        btmagic_sysctl_taptimeout, 0,
                        (void *)sc, 0,
                        CTL_HW, node->sysctl_num,
                        CTL_CREATE, CTL_EOL);
        }

        /*
         * attach the wsmouse
         */
        wsma.accessops = &btmagic_wsmouse_accessops;
        wsma.accesscookie = self;
        sc->sc_wsmouse = config_found(self, &wsma, wsmousedevprint, CFARGS_NONE);
        if (sc->sc_wsmouse == NULL) {
                aprint_error_dev(self, "failed to attach wsmouse\n");
                return;
        }

        pmf_device_register(self, NULL, NULL);

        /*
         * start bluetooth connections
         */
        mutex_enter(bt_lock);
        if ((err = btmagic_listen(sc)) != 0)
                aprint_error_dev(self, "failed to listen (%d)\n", err);
        btmagic_connect(sc);
        mutex_exit(bt_lock);
}

static int
btmagic_detach(device_t self, int flags)
{
        struct btmagic_softc *sc = device_private(self);
        int err = 0;

        mutex_enter(bt_lock);

        /* release interrupt listen */
        if (sc->sc_int_l != NULL) {
                l2cap_detach_pcb(&sc->sc_int_l);
                sc->sc_int_l = NULL;
        }

        /* release control listen */
        if (sc->sc_ctl_l != NULL) {
                l2cap_detach_pcb(&sc->sc_ctl_l);
                sc->sc_ctl_l = NULL;
        }

        /* close interrupt channel */
        if (sc->sc_int != NULL) {
                l2cap_disconnect_pcb(sc->sc_int, 0);
                l2cap_detach_pcb(&sc->sc_int);
                sc->sc_int = NULL;
        }

        /* close control channel */
        if (sc->sc_ctl != NULL) {
                l2cap_disconnect_pcb(sc->sc_ctl, 0);
                l2cap_detach_pcb(&sc->sc_ctl);
                sc->sc_ctl = NULL;
        }

        callout_halt(&sc->sc_tapcallout, bt_lock);
        callout_destroy(&sc->sc_tapcallout);
        callout_halt(&sc->sc_timeout, bt_lock);
        callout_destroy(&sc->sc_timeout);

        mutex_exit(bt_lock);

        pmf_device_deregister(self);

        sockopt_destroy(&sc->sc_mode);

        sysctl_teardown(&sc->sc_log);

        if (sc->sc_wsmouse != NULL) {
                err = config_detach(sc->sc_wsmouse, flags);
                sc->sc_wsmouse = NULL;
        }

        return err;
}

/*
 * listen for our device
 *
 * bt_lock is held
 */
static int
btmagic_listen(struct btmagic_softc *sc)
{
        struct sockaddr_bt sa;
        int err;

        memset(&sa, 0, sizeof(sa));
        sa.bt_len = sizeof(sa);
        sa.bt_family = AF_BLUETOOTH;
        bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);

        /*
         * Listen on control PSM
         */
        err = l2cap_attach_pcb(&sc->sc_ctl_l, &btmagic_ctl_proto, sc);
        if (err)
                return err;

        err = l2cap_setopt(sc->sc_ctl_l, &sc->sc_mode);
        if (err)
                return err;

        sa.bt_psm = L2CAP_PSM_HID_CNTL;
        err = l2cap_bind_pcb(sc->sc_ctl_l, &sa);
        if (err)
                return err;

        err = l2cap_listen_pcb(sc->sc_ctl_l);
        if (err)
                return err;

        /*
         * Listen on interrupt PSM
         */
        err = l2cap_attach_pcb(&sc->sc_int_l, &btmagic_int_proto, sc);
        if (err)
                return err;

        err = l2cap_setopt(sc->sc_int_l, &sc->sc_mode);
        if (err)
                return err;

        sa.bt_psm = L2CAP_PSM_HID_INTR;
        err = l2cap_bind_pcb(sc->sc_int_l, &sa);
        if (err)
                return err;

        err = l2cap_listen_pcb(sc->sc_int_l);
        if (err)
                return err;

        sc->sc_state = BTMAGIC_WAIT_CTL;
        return 0;
}

/*
 * start connecting to our device
 *
 * bt_lock is held
 */
static int
btmagic_connect(struct btmagic_softc *sc)
{
        struct sockaddr_bt sa;
        int err;

        memset(&sa, 0, sizeof(sa));
        sa.bt_len = sizeof(sa);
        sa.bt_family = AF_BLUETOOTH;

        err = l2cap_attach_pcb(&sc->sc_ctl, &btmagic_ctl_proto, sc);
        if (err) {
                printf("%s: l2cap_attach failed (%d)\n",
                    device_xname(sc->sc_dev), err);
                return err;
        }

        err = l2cap_setopt(sc->sc_ctl, &sc->sc_mode);
        if (err) {
                printf("%s: l2cap_setopt failed (%d)\n",
                    device_xname(sc->sc_dev), err);
                return err;
        }

        bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);
        err = l2cap_bind_pcb(sc->sc_ctl, &sa);
        if (err) {
                printf("%s: l2cap_bind_pcb failed (%d)\n",
                    device_xname(sc->sc_dev), err);
                return err;
        }

        sa.bt_psm = L2CAP_PSM_HID_CNTL;
        bdaddr_copy(&sa.bt_bdaddr, &sc->sc_raddr);
        err = l2cap_connect_pcb(sc->sc_ctl, &sa);
        if (err) {
                printf("%s: l2cap_connect_pcb failed (%d)\n",
                    device_xname(sc->sc_dev), err);
                return err;
        }

        SET(sc->sc_flags, BTMAGIC_CONNECTING);
        sc->sc_state = BTMAGIC_WAIT_CTL;
        return 0;
}

/* validate soft_resolution */
static int
btmagic_sysctl_resolution(SYSCTLFN_ARGS)
{
        struct sysctlnode node;
        struct btmagic_softc *sc;
        int t, error;

        node = *rnode;
        sc = node.sysctl_data;

        t = sc->sc_resolution;
        node.sysctl_data = &t;
        error = sysctl_lookup(SYSCTLFN_CALL(&node));
        if (error || newp == NULL)
                return error;

        if (t < 100 || t > 4000 || (t / sc->sc_scale) == 0)
                return EINVAL;

        sc->sc_resolution = t;
        DPRINTF(sc, "sc_resolution = %u", t);
        return 0;
}

/* validate scroll_downscale_factor */
static int
btmagic_sysctl_scale(SYSCTLFN_ARGS)
{
        struct sysctlnode node;
        struct btmagic_softc *sc;
        int t, error;

        node = *rnode;
        sc = node.sysctl_data;

        t = sc->sc_scale;
        node.sysctl_data = &t;
        error = sysctl_lookup(SYSCTLFN_CALL(&node));
        if (error || newp == NULL)
                return error;

        if (t < 1 || t > 40 || (sc->sc_resolution / t) == 0)
                return EINVAL;

        sc->sc_scale = t;
        DPRINTF(sc, "sc_scale = %u", t);
        return 0;
}

/* validate tap timeout */
static int
btmagic_sysctl_taptimeout(SYSCTLFN_ARGS)
{
        struct sysctlnode node;
        struct btmagic_softc *sc;
        int t, error;

        node = *rnode;
        sc = node.sysctl_data;

        t = sc->sc_taptimeout;
        node.sysctl_data = &t;
        error = sysctl_lookup(SYSCTLFN_CALL(&node));
        if (error || newp == NULL)
                return error;

        if (t < uimax(1000 / hz, 1) || t > 999)
                return EINVAL;

        sc->sc_taptimeout = t;
        DPRINTF(sc, "taptimeout = %u", t);
        return 0;
}

/*****************************************************************************
 *
 *      wsmouse(4) accessops
 */

static int
btmagic_wsmouse_enable(void *self)
{
        struct btmagic_softc *sc = device_private(self);

        if (sc->sc_enabled)
                return EBUSY;

        sc->sc_enabled = 1;
        DPRINTF(sc, "enable");
        return 0;
}

static int
btmagic_wsmouse_ioctl(void *self, unsigned long cmd, void *data,
    int flag, struct lwp *l)
{
        /* struct btmagic_softc *sc = device_private(self); */
        int err;

        switch (cmd) {
        case WSMOUSEIO_GTYPE:
                *(uint *)data = WSMOUSE_TYPE_BLUETOOTH;
                err = 0;
                break;

        default:
                err = EPASSTHROUGH;
                break;
        }

        return err;
}

static void
btmagic_wsmouse_disable(void *self)
{
        struct btmagic_softc *sc = device_private(self);

        DPRINTF(sc, "disable");
        sc->sc_enabled = 0;
}


/*****************************************************************************
 *
 *      setup routines
 */

static void
btmagic_timeout(void *arg)
{
        struct btmagic_softc *sc = arg;

        mutex_enter(bt_lock);
        callout_ack(&sc->sc_timeout);

        switch (sc->sc_state) {
        case BTMAGIC_CLOSED:
                if (sc->sc_int != NULL) {
                        l2cap_disconnect_pcb(sc->sc_int, 0);
                        break;
                }

                if (sc->sc_ctl != NULL) {
                        l2cap_disconnect_pcb(sc->sc_ctl, 0);
                        break;
                }
                break;

        case BTMAGIC_OPEN:
                if (!ISSET(sc->sc_flags, BTMAGIC_ENABLED)) {
                        btmagic_enable(sc);
                        break;
                }

                btmagic_check_battery(sc);
                break;

        case BTMAGIC_WAIT_CTL:
        case BTMAGIC_WAIT_INT:
        default:
                break;
        }
        mutex_exit(bt_lock);
}

/*
 * Send report on control channel
 *
 * bt_lock is held
 */
static int
btmagic_ctl_send(struct btmagic_softc *sc, const uint8_t *data, size_t len)
{
        struct mbuf *m;

        if (len > MLEN)
                return EINVAL;

        m = m_gethdr(M_DONTWAIT, MT_DATA);
        if (m == NULL)
                return ENOMEM;

#ifdef BTMAGIC_DEBUG
        printf("%s: send", device_xname(sc->sc_dev));
        for (size_t i = 0; i < len; i++)
                printf(" 0x%02x", data[i]);
        printf("\n");
#endif

        memcpy(mtod(m, uint8_t *), data, len);
        m->m_pkthdr.len = m->m_len = len;
        return l2cap_send_pcb(sc->sc_ctl, m);
}

/*
 * Enable touch reports by sending the following report
 *
 *       SET_REPORT(FEATURE, 0xd7) = 0x01
 *
 * bt_lock is held
 */
static void
btmagic_enable(struct btmagic_softc *sc)
{
        static const uint8_t rep[] = { 0x53, 0xd7, 0x01 };

        if (btmagic_ctl_send(sc, rep, sizeof(rep)) != 0) {
                printf("%s: cannot enable touch reports\n",
                    device_xname(sc->sc_dev));

                return;
        }

        SET(sc->sc_flags, BTMAGIC_ENABLED);
}

/*
 * Request the battery level by sending the following report
 *
 *      GET_REPORT(FEATURE, 0x47)
 *
 * bt_lock is held
 */
static void
btmagic_check_battery(struct btmagic_softc *sc)
{
        static const uint8_t rep[] = { 0x43, 0x47 };

        if (btmagic_ctl_send(sc, rep, sizeof(rep)) != 0)
                printf("%s: cannot request battery level\n",
                    device_xname(sc->sc_dev));
}

/*
 * the Magic Mouse has a base resolution of 1300dpi which is rather flighty. We
 * scale the output to the requested resolution, taking care to account for the
 * remainders to prevent loss of small deltas.
 */
static int
btmagic_scale(int delta, int *remainder, int resolution)
{
        int new;

        delta += *remainder;
        new = delta * resolution / 1300;
        *remainder = delta - new * 1300 / resolution;
        return new;
}


/*****************************************************************************
 *
 *      bluetooth(9) callback methods for L2CAP
 *
 *      All these are called from Bluetooth Protocol code, holding bt_lock.
 */

static void
btmagic_connecting(void *arg)
{

        /* dont care */
}

static void
btmagic_ctl_connected(void *arg)
{
        struct sockaddr_bt sa;
        struct btmagic_softc *sc = arg;
        int err;

        if (sc->sc_state != BTMAGIC_WAIT_CTL)
                return;

        KASSERT(sc->sc_ctl != NULL);
        KASSERT(sc->sc_int == NULL);

        if (ISSET(sc->sc_flags, BTMAGIC_CONNECTING)) {
                /* initiate connect on interrupt PSM */
                err = l2cap_attach_pcb(&sc->sc_int, &btmagic_int_proto, sc);
                if (err)
                        goto fail;

                err = l2cap_setopt(sc->sc_int, &sc->sc_mode);
                if (err)
                        goto fail;

                memset(&sa, 0, sizeof(sa));
                sa.bt_len = sizeof(sa);
                sa.bt_family = AF_BLUETOOTH;
                bdaddr_copy(&sa.bt_bdaddr, &sc->sc_laddr);

                err = l2cap_bind_pcb(sc->sc_int, &sa);
                if (err)
                        goto fail;

                sa.bt_psm = L2CAP_PSM_HID_INTR;
                bdaddr_copy(&sa.bt_bdaddr, &sc->sc_raddr);
                err = l2cap_connect_pcb(sc->sc_int, &sa);
                if (err)
                        goto fail;
        }

        sc->sc_state = BTMAGIC_WAIT_INT;
        return;

fail:
        l2cap_detach_pcb(&sc->sc_ctl);
        sc->sc_ctl = NULL;

        printf("%s: connect failed (%d)\n", device_xname(sc->sc_dev), err);
}

static void
btmagic_int_connected(void *arg)
{
        struct btmagic_softc *sc = arg;

        if (sc->sc_state != BTMAGIC_WAIT_INT)
                return;

        KASSERT(sc->sc_ctl != NULL);
        KASSERT(sc->sc_int != NULL);

        printf("%s: connected\n", device_xname(sc->sc_dev));
        CLR(sc->sc_flags, BTMAGIC_CONNECTING);
        sc->sc_state = BTMAGIC_OPEN;

        /* trigger the setup */
        CLR(sc->sc_flags, BTMAGIC_ENABLED);
        callout_schedule(&sc->sc_timeout, hz);
}

/*
 * Disconnected
 *
 * Depending on our state, this could mean several things, but essentially
 * we are lost. If both channels are closed, schedule another connection.
 */
static void
btmagic_ctl_disconnected(void *arg, int err)
{
        struct btmagic_softc *sc = arg;

        if (sc->sc_ctl != NULL) {
                l2cap_detach_pcb(&sc->sc_ctl);
                sc->sc_ctl = NULL;
        }

        if (sc->sc_int == NULL) {
                printf("%s: disconnected (%d)\n", device_xname(sc->sc_dev), err);
                CLR(sc->sc_flags, BTMAGIC_CONNECTING);
                sc->sc_state = BTMAGIC_WAIT_CTL;
        } else {
                /*
                 * The interrupt channel should have been closed first,
                 * but its potentially unsafe to detach that from here.
                 * Give them a second to do the right thing or let the
                 * callout handle it.
                 */
                sc->sc_state = BTMAGIC_CLOSED;
                callout_schedule(&sc->sc_timeout, hz);
        }
}

static void
btmagic_int_disconnected(void *arg, int err)
{
        struct btmagic_softc *sc = arg;

        if (sc->sc_int != NULL) {
                l2cap_detach_pcb(&sc->sc_int);
                sc->sc_int = NULL;
        }

        if (sc->sc_ctl == NULL) {
                printf("%s: disconnected (%d)\n", device_xname(sc->sc_dev), err);
                CLR(sc->sc_flags, BTMAGIC_CONNECTING);
                sc->sc_state = BTMAGIC_WAIT_CTL;
        } else {
                /*
                 * The control channel should be closing also, allow
                 * them a chance to do that before we force it.
                 */
                sc->sc_state = BTMAGIC_CLOSED;
                callout_schedule(&sc->sc_timeout, hz);
        }
}

/*
 * New Connections
 *
 * We give a new L2CAP handle back if this matches the BDADDR we are
 * listening for and we are in the right state. btmagic_connected will
 * be called when the connection is open, so nothing else to do here
 */
static void *
btmagic_ctl_newconn(void *arg, struct sockaddr_bt *laddr,
    struct sockaddr_bt *raddr)
{
        struct btmagic_softc *sc = arg;

        if (bdaddr_same(&raddr->bt_bdaddr, &sc->sc_raddr) == 0)
                return NULL;

        if (sc->sc_state != BTMAGIC_WAIT_CTL
            || ISSET(sc->sc_flags, BTMAGIC_CONNECTING)
            || sc->sc_ctl != NULL
            || sc->sc_int != NULL) {
                DPRINTF(sc, "reject ctl newconn %s%s%s%s",
                    (sc->sc_state == BTMAGIC_WAIT_CTL) ? " (WAITING)": "",
                    ISSET(sc->sc_flags, BTMAGIC_CONNECTING) ? " (CONNECTING)" : "",
                    (sc->sc_ctl != NULL) ? " (GOT CONTROL)" : "",
                    (sc->sc_int != NULL) ? " (GOT INTERRUPT)" : "");

                return NULL;
        }

        l2cap_attach_pcb(&sc->sc_ctl, &btmagic_ctl_proto, sc);
        return sc->sc_ctl;
}

static void *
btmagic_int_newconn(void *arg, struct sockaddr_bt *laddr,
    struct sockaddr_bt *raddr)
{
        struct btmagic_softc *sc = arg;

        if (bdaddr_same(&raddr->bt_bdaddr, &sc->sc_raddr) == 0)
                return NULL;

        if (sc->sc_state != BTMAGIC_WAIT_INT
            || ISSET(sc->sc_flags, BTMAGIC_CONNECTING)
            || sc->sc_ctl == NULL
            || sc->sc_int != NULL) {
                DPRINTF(sc, "reject int newconn %s%s%s%s",
                    (sc->sc_state == BTMAGIC_WAIT_INT) ? " (WAITING)": "",
                    ISSET(sc->sc_flags, BTMAGIC_CONNECTING) ? " (CONNECTING)" : "",
                    (sc->sc_ctl == NULL) ? " (NO CONTROL)" : "",
                    (sc->sc_int != NULL) ? " (GOT INTERRUPT)" : "");

                return NULL;
        }

        l2cap_attach_pcb(&sc->sc_int, &btmagic_int_proto, sc);
        return sc->sc_int;
}

static void
btmagic_complete(void *arg, int count)
{

        /* dont care */
}

static void
btmagic_linkmode(void *arg, int new)
{
        struct btmagic_softc *sc = arg;
        int mode;

        (void)sockopt_getint(&sc->sc_mode, &mode);

        if (ISSET(mode, L2CAP_LM_AUTH) && !ISSET(new, L2CAP_LM_AUTH))
                printf("%s: auth failed\n", device_xname(sc->sc_dev));
        else if (ISSET(mode, L2CAP_LM_ENCRYPT) && !ISSET(new, L2CAP_LM_ENCRYPT))
                printf("%s: encrypt off\n", device_xname(sc->sc_dev));
        else if (ISSET(mode, L2CAP_LM_SECURE) && !ISSET(new, L2CAP_LM_SECURE))
                printf("%s: insecure\n", device_xname(sc->sc_dev));
        else
                return;

        if (sc->sc_int != NULL)
                l2cap_disconnect_pcb(sc->sc_int, 0);

        if (sc->sc_ctl != NULL)
                l2cap_disconnect_pcb(sc->sc_ctl, 0);
}

/*
 * Receive transaction from the mouse. We don't differentiate between
 * interrupt and control channel here, there is no need.
 */
static void
btmagic_input(void *arg, struct mbuf *m)
{
        struct btmagic_softc *sc = arg;
        uint8_t *data;
        size_t len;

        if (sc->sc_state != BTMAGIC_OPEN
            || sc->sc_wsmouse == NULL
            || sc->sc_enabled == 0)
                goto release;

        if (m->m_pkthdr.len > m->m_len)
                printf("%s: truncating input\n", device_xname(sc->sc_dev));

        data = mtod(m, uint8_t *);
        len = m->m_len;

        if (len < 1)
                goto release;

        switch (BTHID_TYPE(data[0])) {
        case BTHID_HANDSHAKE:
                DPRINTF(sc, "Handshake: 0x%x", BTHID_HANDSHAKE_PARAM(data[0]));
                callout_schedule(&sc->sc_timeout, hz);
                break;

        case BTHID_DATA:
                if (len < 2)
                        break;

                switch (data[1]) {
                case BASIC_REPORT_ID: /* Basic mouse (input) */
                        btmagic_input_basic(sc, data + 2, len - 2);
                        break;

                case TRACKPAD_REPORT_ID: /* Magic trackpad (input) */
                        btmagic_input_magict(sc, data + 2, len - 2);
                        break;

                case MOUSE_REPORT_ID: /* Magic touch (input) */
                        btmagic_input_magicm(sc, data + 2, len - 2);
                        break;

                case BATT_STAT_REPORT_ID: /* Battery status (input) */
                        if (len != 3)
                                break;

                        printf("%s: Battery ", device_xname(sc->sc_dev));
                        switch (data[2]) {
                        case 0: printf("Ok\n");                 break;
                        case 1: printf("Warning\n");            break;
                        case 2: printf("Critical\n");           break;
                        default: printf("0x%02x\n", data[2]);   break;
                        }
                        break;

                case BATT_STRENGTH_REPORT_ID: /* Battery strength (feature) */
                        if (len != 3)
                                break;

                        printf("%s: Battery %d%%\n", device_xname(sc->sc_dev),
                            data[2]);
                        break;

                case SURFACE_REPORT_ID: /* Surface detection (input) */
                        if (len != 3)
                                break;

                        DPRINTF(sc, "Mouse %s",
                            (data[2] == 0 ? "lowered" : "raised"));
                        break;

                case 0x60: /* unknown (input) */
                case 0xf0: /* unknown (feature) */
                case 0xf1: /* unknown (feature) */
                default:
#if BTMAGIC_DEBUG
                        printf("%s: recv", device_xname(sc->sc_dev));
                        for (size_t i = 0; i < len; i++)
                                printf(" 0x%02x", data[i]);
                        printf("\n");
#endif
                        break;
                }
                break;

        default:
                DPRINTF(sc, "transaction (type 0x%x)", BTHID_TYPE(data[0]));
                break;
        }

release:
        m_freem(m);
}

/*
 * parse the Basic report (0x10), which according to the provided
 * HID descriptor is in the following format
 *
 *      button 1        1-bit
 *      button 2        1-bit
 *      padding         6-bits
 *      dX              16-bits (signed)
 *      dY              16-bits (signed)
 *
 * Even when the magic touch reports are enabled, the basic report is
 * sent for mouse move events where no touches are detected.
 */
static const struct {
        struct hid_location button1;
        struct hid_location button2;
        struct hid_location dX;
        struct hid_location dY;
} basic = {
        .button1 = { .pos =  0, .size = 1 },
        .button2 = { .pos =  1, .size = 1 },
        .dX = { .pos =  8, .size = 16 },
        .dY = { .pos = 24, .size = 16 },
};

static void
btmagic_input_basic(struct btmagic_softc *sc, uint8_t *data, size_t len)
{
        int dx, dy;
        uint32_t mb;
        int s;

        if (len != 5)
                return;

        dx = hid_get_data(data, &basic.dX);
        dx = btmagic_scale(dx, &sc->sc_rx, sc->sc_resolution);

        dy = hid_get_data(data, &basic.dY);
        dy = btmagic_scale(dy, &sc->sc_ry, sc->sc_resolution);

        mb = 0;
        if (hid_get_udata(data, &basic.button1))
                mb |= __BIT(0);
        if (hid_get_udata(data, &basic.button2))
                mb |= __BIT(2);

        if (dx != 0 || dy != 0 || mb != sc->sc_mb) {
                sc->sc_mb = mb;

                s = spltty();
                wsmouse_input(sc->sc_wsmouse, mb,
                    dx, -dy, 0, 0, WSMOUSE_INPUT_DELTA);
                splx(s);
        }
}

/*
 * the Magic touch report (0x29), according to the Linux driver
 * written by Michael Poole, is variable length starting with the
 * fixed 40-bit header
 *
 *      dX lsb          8-bits (signed)
 *      dY lsb          8-bits (signed)
 *      button 1        1-bit
 *      button 2        1-bit
 *      dX msb          2-bits (signed)
 *      dY msb          2-bits (signed)
 *      timestamp       18-bits
 *
 * followed by (up to 5?) touch reports of 64-bits each
 *
 *      abs W           12-bits (signed)
 *      abs Z           12-bits (signed)
 *      axis major      8-bits
 *      axis minor      8-bits
 *      pressure        6-bits
 *      id              4-bits
 *      angle           6-bits  (from E(0)->N(32)->W(64))
 *      unknown         4-bits
 *      phase           4-bits
 */

static const struct {
        struct hid_location dXl;
        struct hid_location dYl;
        struct hid_location button1;
        struct hid_location button2;
        struct hid_location dXm;
        struct hid_location dYm;
        struct hid_location timestamp;
} magic = {
        .dXl = { .pos = 0, .size = 8 },
        .dYl = { .pos = 8, .size = 8 },
        .button1 = { .pos = 16, .size = 1 },
        .button2 = { .pos = 17, .size = 1 },
        .dXm = { .pos = 18, .size = 2 },
        .dYm = { .pos = 20, .size = 2 },
        .timestamp = { .pos = 22, .size = 18 },
};

static const struct {
        struct hid_location aW;
        struct hid_location aZ;
        struct hid_location major;
        struct hid_location minor;
        struct hid_location pressure;
        struct hid_location id;
        struct hid_location angle;
        struct hid_location unknown;
        struct hid_location phase;
} touch = {
        .aW = { .pos = 0, .size = 12 },
        .aZ = { .pos = 12, .size = 12 },
        .major = { .pos = 24, .size = 8 },
        .minor = { .pos = 32, .size = 8 },
        .pressure = { .pos = 40, .size = 6 },
        .id = { .pos = 46, .size = 4 },
        .angle = { .pos = 50, .size = 6 },
        .unknown = { .pos = 56, .size = 4 },
        .phase = { .pos = 60, .size = 4 },
};

/*
 * the phase of the touch starts at 0x01 as the finger is first detected
 * approaching the mouse, increasing to 0x04 while the finger is touching,
 * then increases towards 0x07 as the finger is lifted, and we get 0x00
 * when the touch is cancelled. The values below seem to be produced for
 * every touch, the others less consistently depending on how fast the
 * approach or departure is.
 *
 * In fact we ignore touches unless they are in the steady 0x04 phase.
 */
#define BTMAGIC_PHASE_START     0x3
#define BTMAGIC_PHASE_CONT      0x4
#define BTMAGIC_PHASE_END       0x7
#define BTMAGIC_PHASE_CANCEL    0x0

static void
btmagic_input_magicm(struct btmagic_softc *sc, uint8_t *data, size_t len)
{
        uint32_t mb;
        int dx, dy, dz, dw;
        int id, nf, az, aw, tz, tw;
        int s;

        if (((len - 5) % 8) != 0)
                return;

        dx = (hid_get_data(data, &magic.dXm) << 8)
            | (hid_get_data(data, &magic.dXl) & 0xff);
        dx = btmagic_scale(dx, &sc->sc_rx, sc->sc_resolution);

        dy = (hid_get_data(data, &magic.dYm) << 8)
            | (hid_get_data(data, &magic.dYl) & 0xff);
        dy = btmagic_scale(dy, &sc->sc_ry, sc->sc_resolution);

        mb = 0;
        if (hid_get_udata(data, &magic.button1))
                mb |= __BIT(0);
        if (hid_get_udata(data, &magic.button2))
                mb |= __BIT(2);

        nf = 0;
        dz = 0;
        dw = 0;
        len = (len - 5) / 8;
        for (data += 5; len-- > 0; data += 8) {
                id = hid_get_udata(data, &touch.id);
                az = hid_get_data(data, &touch.aZ);
                aw = hid_get_data(data, &touch.aW);

                /*
                 * scrolling is triggered by an established touch moving
                 * beyond a minimum distance from its start point and is
                 * cancelled as the touch starts to fade.
                 *
                 * Multiple touches may be scrolling simultaneously, the
                 * effect is cumulative.
                 */

                switch (hid_get_udata(data, &touch.phase)) {
                case BTMAGIC_PHASE_CONT:
#define sc_az sc_ay
#define sc_aw sc_ax
                        tz = az - sc->sc_az[id];
                        tw = aw - sc->sc_aw[id];

                        if (ISSET(sc->sc_smask, __BIT(id))) {
                                /* scrolling finger */
                                dz += btmagic_scale(tz, &sc->sc_rz,
                                    sc->sc_resolution / sc->sc_scale);
                                dw += btmagic_scale(tw, &sc->sc_rw,
                                    sc->sc_resolution / sc->sc_scale);
                        } else if (abs(tz) > sc->sc_dist
                            || abs(tw) > sc->sc_dist) {
                                /* new scrolling finger */
                                if (sc->sc_smask == 0) {
                                        sc->sc_rz = 0;
                                        sc->sc_rw = 0;
                                }

                                SET(sc->sc_smask, __BIT(id));
                        } else {
                                /* not scrolling finger */
                                az = sc->sc_az[id];
                                aw = sc->sc_aw[id];
                        }

                        /* count firm touches for middle-click */
                        if (hid_get_udata(data, &touch.pressure) > sc->sc_firm)
                                nf++;

                        break;

                default:
                        CLR(sc->sc_smask, __BIT(id));
                        break;
                }

                sc->sc_az[id] = az;
                sc->sc_aw[id] = aw;
#undef sc_az
#undef sc_aw
        }

        /*
         * The mouse only has one click detector, and says left or right but
         * never both. We convert multiple firm touches while clicking into
         * a middle button press, and cancel any scroll effects while click
         * is active.
         */
        if (mb != 0) {
                if (sc->sc_mb != 0)
                        mb = sc->sc_mb;
                else if (nf > 1)
                        mb = __BIT(1);

                sc->sc_smask = 0;
                dz = 0;
                dw = 0;
        }

        if (dx != 0 || dy != 0 || dz != 0 || dw != 0 || mb != sc->sc_mb) {
                sc->sc_mb = mb;

                s = spltty();
                wsmouse_input(sc->sc_wsmouse, mb,
                    dx, -dy, -dz, dw, WSMOUSE_INPUT_DELTA);
                splx(s);
        }
}

/*
 * the Magic touch trackpad report (0x28), according to the Linux driver
 * written by Michael Poole and Chase Douglas, is variable length starting
 * with the fixed 24-bit header
 *
 *      button 1        1-bit
 *      unknown         5-bits
 *      timestamp       18-bits
 *
 * followed by (up to 5?) touch reports of 72-bits each
 *
 *      abs X           13-bits (signed)
 *      abs Y           13-bits (signed)
 *      unknown         6-bits
 *      axis major      8-bits
 *      axis minor      8-bits
 *      pressure        6-bits
 *      id              4-bits
 *      angle           6-bits  (from E(0)->N(32)->W(64))
 *      unknown         4-bits
 *      phase           4-bits
 */

static const struct {
        struct hid_location button;
        struct hid_location timestamp;
} magict = {
        .button = { .pos =  0, .size = 1 },
        .timestamp = { .pos = 6, .size = 18 },
};

static const struct {
        struct hid_location aX;
        struct hid_location aY;
        struct hid_location major;
        struct hid_location minor;
        struct hid_location pressure;
        struct hid_location id;
        struct hid_location angle;
        struct hid_location unknown;
        struct hid_location phase;
} toucht = {
        .aX = { .pos = 0, .size = 13 },
        .aY = { .pos = 13, .size = 13 },
        .major = { .pos = 32, .size = 8 },
        .minor = { .pos = 40, .size = 8 },
        .pressure = { .pos = 48, .size = 6 },
        .id = { .pos = 54, .size = 4 },
        .angle = { .pos = 58, .size = 6 },
        .unknown = { .pos = 64, .size = 4 },
        .phase = { .pos = 68, .size = 4 },
};

/*
 * as for btmagic_input_magicm, 
 * the phase of the touch starts at 0x01 as the finger is first detected
 * approaching the mouse, increasing to 0x04 while the finger is touching,
 * then increases towards 0x07 as the finger is lifted, and we get 0x00
 * when the touch is cancelled. The values below seem to be produced for
 * every touch, the others less consistently depending on how fast the
 * approach or departure is.
 *
 * In fact we ignore touches unless they are in the steady 0x04 phase.
 */

/* min and max values reported */
#define MAGICT_X_MIN    (-2910)
#define MAGICT_X_MAX    (3170)
#define MAGICT_Y_MIN    (-2565)
#define MAGICT_Y_MAX    (2455)

/*
 * area for detecting the buttons: divide in 3 areas on X, 
 * below -1900 on y
 */
#define MAGICT_B_YMAX   (-1900)
#define MAGICT_B_XSIZE  ((MAGICT_X_MAX - MAGICT_X_MIN) / 3)
#define MAGICT_B_X1MAX  (MAGICT_X_MIN + MAGICT_B_XSIZE)
#define MAGICT_B_X2MAX  (MAGICT_X_MIN + MAGICT_B_XSIZE * 2)

static void
btmagic_input_magict(struct btmagic_softc *sc, uint8_t *data, size_t len)
{
        bool bpress;
        uint32_t mb;
        int id, ax, ay, tx, ty;
        int dx, dy, dz, dw;
        int s;

        if (((len - 3) % 9) != 0)
                return;

        bpress = 0;
        if (hid_get_udata(data, &magict.button))
                bpress = 1;

        dx = dy = dz = dw = 0;
        mb = 0;

        len = (len - 3) / 9;
        for (data += 3; len-- > 0; data += 9) {
                id = hid_get_udata(data, &toucht.id);
                ax = hid_get_data(data, &toucht.aX);
                ay = hid_get_data(data, &toucht.aY);

                DPRINTF(sc,
                    "btmagic_input_magict: id %d ax %d ay %d phase %ld %s\n",
                    id, ax, ay, hid_get_udata(data, &toucht.phase),
                    bpress ? "button pressed" : "");

                /*
                 * a single touch is interpreted as a mouse move.
                 * If a button is pressed, the touch in the button area
                 * defined above defines the button; a second touch is
                 * interpreted as a mouse move.
                 */

                switch (hid_get_udata(data, &toucht.phase)) {
                case BTMAGIC_PHASE_CONT:
                        if (bpress) {
                                if (sc->sc_mb == 0 && ay < MAGICT_B_YMAX) {
                                        /*
                                         * we have a new button press,
                                         * and this id tells which one
                                         */
                                        if (ax < MAGICT_B_X1MAX)
                                                mb = __BIT(0);
                                        else if (ax > MAGICT_B_X2MAX)
                                                mb = __BIT(2);
                                        else
                                                mb = __BIT(1);
                                        sc->sc_mb_id = id;
                                } else {
                                        /* keep previous state */
                                        mb = sc->sc_mb;
                                }
                        } else {
                                /* no button pressed */
                                mb = 0;
                                sc->sc_mb_id = -1;
                        }
                        if (id == sc->sc_mb_id) {
                                /*
                                 * this id selects the button
                                 * ignore for move/scroll
                                 */
                                 continue;
                        }
                        if (id >= __arraycount(sc->sc_ax))
                                continue;
                                        
                        tx = ax - sc->sc_ax[id];
                        ty = ay - sc->sc_ay[id];

                        if (ISSET(sc->sc_smask, __BIT(id))) {
                                struct timeval now_tv;
                                getmicrotime(&now_tv);
                                if (sc->sc_nfingers == 1 && mb == 0 &&
                                    timercmp(&sc->sc_taptime, &now_tv, >)) {
                                        /* still detecting a tap */
                                        continue;
                                }

                                if (sc->sc_nfingers == 1 || mb != 0) {
                                        /* single finger moving */
                                        dx += btmagic_scale(tx, &sc->sc_rx,
                                            sc->sc_resolution);
                                        dy += btmagic_scale(ty, &sc->sc_ry,
                                            sc->sc_resolution);
                                } else {
                                        /* scrolling fingers */
                                        dz += btmagic_scale(ty, &sc->sc_rz,
                                            sc->sc_resolution / sc->sc_scale);
                                        dw += btmagic_scale(tx, &sc->sc_rw,
                                            sc->sc_resolution / sc->sc_scale);
                                }
                        } else if (ay > MAGICT_B_YMAX) { /* new finger */
                                sc->sc_rx = 0;
                                sc->sc_ry = 0;
                                sc->sc_rz = 0;
                                sc->sc_rw = 0;
                                KASSERT(!ISSET(sc->sc_smask, __BIT(id)));
                                SET(sc->sc_smask, __BIT(id));
                                sc->sc_nfingers++;
                                if (sc->sc_tapmb_id == -1 &&
                                    mb == 0 && sc->sc_mb == 0) {
                                        sc->sc_tapmb_id = id;
                                        getmicrotime(&sc->sc_taptime);
                                        sc->sc_taptime.tv_usec +=
                                            sc->sc_taptimeout * 1000;
                                        if (sc->sc_taptime.tv_usec > 1000000) {
                                                sc->sc_taptime.tv_usec -=
                                                    1000000;
                                                sc->sc_taptime.tv_sec++;
                                        }
                                }
                                        
                        }

                        break;
                default:
                        if (ISSET(sc->sc_smask, __BIT(id))) {
                                CLR(sc->sc_smask, __BIT(id));
                                sc->sc_nfingers--;
                                KASSERT(sc->sc_nfingers >= 0);
                                if (id == sc->sc_tapmb_id) {
                                        mb = btmagic_tap(sc, id);
                                }
                        }
                        break;
                }

                if (id >= __arraycount(sc->sc_ax))
                        continue;

                sc->sc_ax[id] = ax;
                sc->sc_ay[id] = ay;
        }

        if (dx != 0 || dy != 0 || dz != 0 || dw != 0 || mb != sc->sc_mb) {
                sc->sc_mb = mb;

                s = spltty();
                wsmouse_input(sc->sc_wsmouse, mb,
                    dx, dy, -dz, dw, WSMOUSE_INPUT_DELTA);
                splx(s);
        }
}

static int
btmagic_tap(struct btmagic_softc *sc, int id)
{
        struct timeval now_tv;

        sc->sc_tapmb_id = -1;
        getmicrotime(&now_tv);
        if (timercmp(&sc->sc_taptime, &now_tv, >)) {
                /* got a tap */
                callout_schedule(
                    &sc->sc_tapcallout,
                    mstohz(sc->sc_taptimeout));
                return __BIT(0);
        }
        return 0;
}

static void
btmagic_tapcallout(void *arg)
{
        struct btmagic_softc *sc = arg;
        int s;

        mutex_enter(bt_lock);
        callout_ack(&sc->sc_tapcallout);
        if ((sc->sc_mb & __BIT(0)) != 0) {
                sc->sc_mb &= ~__BIT(0);
                s = spltty();
                wsmouse_input(sc->sc_wsmouse, sc->sc_mb,
                    0, 0, 0, 0, WSMOUSE_INPUT_DELTA);
                splx(s);
        }
        mutex_exit(bt_lock);
}