sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c

   1 /*
   2  * ng_ubt.c
   3  */
   4
   5 /*-
   6  * Copyright (c) 2001-2009 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  * $Id: ng_ubt.c,v 1.16 2003/10/10 19:15:06 max Exp $
  31  * $FreeBSD$
  32  */
  33
  34 /*
  35  * NOTE: ng_ubt2 driver has a split personality. On one side it is
  36  * a USB device driver and on the other it is a Netgraph node. This
  37  * driver will *NOT* create traditional /dev/ enties, only Netgraph
  38  * node.
  39  *
  40  * NOTE ON LOCKS USED: ng_ubt2 drives uses 2 locks (mutexes)
  41  *
  42  * 1) sc_if_mtx - lock for device's interface #0 and #1. This lock is used
  43  *    by USB for any USB request going over device's interface #0 and #1,
  44  *    i.e. interrupt, control, bulk and isoc. transfers.
  45  *
  46  * 2) sc_ng_mtx - this lock is used to protect shared (between USB, Netgraph
  47  *    and Taskqueue) data, such as outgoing mbuf queues, task flags and hook
  48  *    pointer. This lock *SHOULD NOT* be grabbed for a long time. In fact,
  49  *    think of it as a spin lock.
  50  *
  51  * NOTE ON LOCKING STRATEGY: ng_ubt2 driver operates in 3 different contexts.
  52  *
  53  * 1) USB context. This is where all the USB related stuff happens. All
  54  *    callbacks run in this context. All callbacks are called (by USB) with
  55  *    appropriate interface lock held. It is (generally) allowed to grab
  56  *    any additional locks.
  57  *
  58  * 2) Netgraph context. This is where all the Netgraph related stuff happens.
  59  *    Since we mark node as WRITER, the Netgraph node will be "locked" (from
  60  *    Netgraph point of view). Any variable that is only modified from the
  61  *    Netgraph context does not require any additonal locking. It is generally
  62  *    *NOT* allowed to grab *ANY* additional locks. Whatever you do, *DO NOT*
  63  *    grab any lock in the Netgraph context that could cause de-scheduling of
  64  *    the Netgraph thread for significant amount of time. In fact, the only
  65  *    lock that is allowed in the Netgraph context is the sc_ng_mtx lock.
  66  *    Also make sure that any code that is called from the Netgraph context
  67  *    follows the rule above.
  68  *
  69  * 3) Taskqueue context. This is where ubt_task runs. Since we are generally
  70  *    NOT allowed to grab any lock that could cause de-scheduling in the
  71  *    Netgraph context, and, USB requires us to grab interface lock before
  72  *    doing things with transfers, it is safer to transition from the Netgraph
  73  *    context to the Taskqueue context before we can call into USB subsystem.
  74  *
  75  * So, to put everything together, the rules are as follows.
  76  *      It is OK to call from the USB context or the Taskqueue context into
  77  * the Netgraph context (i.e. call NG_SEND_xxx functions). In other words
  78  * it is allowed to call into the Netgraph context with locks held.
  79  *      Is it *NOT* OK to call from the Netgraph context into the USB context,
  80  * because USB requires us to grab interface locks, and, it is safer to
  81  * avoid it. So, to make things safer we set task flags to indicate which
  82  * actions we want to perform and schedule ubt_task which would run in the
  83  * Taskqueue context.
  84  *      Is is OK to call from the Taskqueue context into the USB context,
  85  * and, ubt_task does just that (i.e. grabs appropriate interface locks
  86  * before calling into USB).
  87  *      Access to the outgoing queues, task flags and hook pointer is
  88  * controlled by the sc_ng_mtx lock. It is an unavoidable evil. Again,
  89  * sc_ng_mtx should really be a spin lock (and it is very likely to an
  90  * equivalent of spin lock due to adaptive nature of FreeBSD mutexes).
  91  *      All USB callbacks accept softc pointer as a private data. USB ensures
  92  * that this pointer is valid.
  93  */
  94
  95 #include <sys/stdint.h>
  96 #include <sys/stddef.h>
  97 #include <sys/param.h>
  98 #include <sys/queue.h>
  99 #include <sys/types.h>
 100 #include <sys/systm.h>
 101 #include <sys/kernel.h>
 102 #include <sys/bus.h>
 103 #include <sys/module.h>
 104 #include <sys/lock.h>
 105 #include <sys/mutex.h>
 106 #include <sys/condvar.h>
 107 #include <sys/sysctl.h>
 108 #include <sys/sx.h>
 109 #include <sys/unistd.h>
 110 #include <sys/callout.h>
 111 #include <sys/malloc.h>
 112 #include <sys/jail.h>
 113 #include <sys/priv.h>
 114 #include <sys/proc.h>
 115
 116 #include "usbdevs.h"
 117 #include <dev/usb/usb.h>
 118 #include <dev/usb/usbdi.h>
 119 #include <dev/usb/usbdi_util.h>
 120
 121 #define USB_DEBUG_VAR usb_debug
 122 #include <dev/usb/usb_debug.h>
 123 #include <dev/usb/usb_busdma.h>
 124
 125 #include <sys/mbuf.h>
 126 #include <sys/taskqueue.h>
 127
 128 #include <net/vnet.h>
 129 #include <netgraph/ng_message.h>
 130 #include <netgraph/netgraph.h>
 131 #include <netgraph/ng_parse.h>
 132 #include <netgraph/bluetooth/include/ng_bluetooth.h>
 133 #include <netgraph/bluetooth/include/ng_hci.h>
 134 #include <netgraph/bluetooth/include/ng_ubt.h>
 135 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h>
 136
 137 static int              ubt_modevent(module_t, int, void *);
 138 static device_probe_t   ubt_probe;
 139 static device_attach_t  ubt_attach;
 140 static device_detach_t  ubt_detach;
 141
 142 static void             ubt_task_schedule(ubt_softc_p, int);
 143 static task_fn_t        ubt_task;
 144
 145 #define ubt_xfer_start(sc, i)   usbd_transfer_start((sc)->sc_xfer[(i)])
 146
 147 /* Netgraph methods */
 148 static ng_constructor_t ng_ubt_constructor;
 149 static ng_shutdown_t    ng_ubt_shutdown;
 150 static ng_newhook_t     ng_ubt_newhook;
 151 static ng_connect_t     ng_ubt_connect;
 152 static ng_disconnect_t  ng_ubt_disconnect;
 153 static ng_rcvmsg_t      ng_ubt_rcvmsg;
 154 static ng_rcvdata_t     ng_ubt_rcvdata;
 155
 156 /* Queue length */
 157 static const struct ng_parse_struct_field       ng_ubt_node_qlen_type_fields[] =
 158 {
 159         { "queue", &ng_parse_int32_type, },
 160         { "qlen",  &ng_parse_int32_type, },
 161         { NULL, }
 162 };
 163 static const struct ng_parse_type               ng_ubt_node_qlen_type =
 164 {
 165         &ng_parse_struct_type,
 166         &ng_ubt_node_qlen_type_fields
 167 };
 168
 169 /* Stat info */
 170 static const struct ng_parse_struct_field       ng_ubt_node_stat_type_fields[] =
 171 {
 172         { "pckts_recv", &ng_parse_uint32_type, },
 173         { "bytes_recv", &ng_parse_uint32_type, },
 174         { "pckts_sent", &ng_parse_uint32_type, },
 175         { "bytes_sent", &ng_parse_uint32_type, },
 176         { "oerrors",    &ng_parse_uint32_type, },
 177         { "ierrors",    &ng_parse_uint32_type, },
 178         { NULL, }
 179 };
 180 static const struct ng_parse_type               ng_ubt_node_stat_type =
 181 {
 182         &ng_parse_struct_type,
 183         &ng_ubt_node_stat_type_fields
 184 };
 185
 186 /* Netgraph node command list */
 187 static const struct ng_cmdlist                  ng_ubt_cmdlist[] =
 188 {
 189         {
 190                 NGM_UBT_COOKIE,
 191                 NGM_UBT_NODE_SET_DEBUG,
 192                 "set_debug",
 193                 &ng_parse_uint16_type,
 194                 NULL
 195         },
 196         {
 197                 NGM_UBT_COOKIE,
 198                 NGM_UBT_NODE_GET_DEBUG,
 199                 "get_debug",
 200                 NULL,
 201                 &ng_parse_uint16_type
 202         },
 203         {
 204                 NGM_UBT_COOKIE,
 205                 NGM_UBT_NODE_SET_QLEN,
 206                 "set_qlen",
 207                 &ng_ubt_node_qlen_type,
 208                 NULL
 209         },
 210         {
 211                 NGM_UBT_COOKIE,
 212                 NGM_UBT_NODE_GET_QLEN,
 213                 "get_qlen",
 214                 &ng_ubt_node_qlen_type,
 215                 &ng_ubt_node_qlen_type
 216         },
 217         {
 218                 NGM_UBT_COOKIE,
 219                 NGM_UBT_NODE_GET_STAT,
 220                 "get_stat",
 221                 NULL,
 222                 &ng_ubt_node_stat_type
 223         },
 224         {
 225                 NGM_UBT_COOKIE,
 226                 NGM_UBT_NODE_RESET_STAT,
 227                 "reset_stat",
 228                 NULL,
 229                 NULL
 230         },
 231         { 0, }
 232 };
 233
 234 /* Netgraph node type */
 235 static struct ng_type   typestruct =
 236 {
 237         .version =      NG_ABI_VERSION,
 238         .name =         NG_UBT_NODE_TYPE,
 239         .constructor =  ng_ubt_constructor,
 240         .rcvmsg =       ng_ubt_rcvmsg,
 241         .shutdown =     ng_ubt_shutdown,
 242         .newhook =      ng_ubt_newhook,
 243         .connect =      ng_ubt_connect,
 244         .rcvdata =      ng_ubt_rcvdata,
 245         .disconnect =   ng_ubt_disconnect,
 246         .cmdlist =      ng_ubt_cmdlist
 247 };
 248
 249 /****************************************************************************
 250  ****************************************************************************
 251  **                              USB specific
 252  ****************************************************************************
 253  ****************************************************************************/
 254
 255 /* USB methods */
 256 static usb_callback_t   ubt_ctrl_write_callback;
 257 static usb_callback_t   ubt_intr_read_callback;
 258 static usb_callback_t   ubt_bulk_read_callback;
 259 static usb_callback_t   ubt_bulk_write_callback;
 260 static usb_callback_t   ubt_isoc_read_callback;
 261 static usb_callback_t   ubt_isoc_write_callback;
 262
 263 static int              ubt_fwd_mbuf_up(ubt_softc_p, struct mbuf **);
 264 static int              ubt_isoc_read_one_frame(struct usb_xfer *, int);
 265
 266 /*
 267  * USB config
 268  *
 269  * The following desribes usb transfers that could be submitted on USB device.
 270  *
 271  * Interface 0 on the USB device must present the following endpoints
 272  *      1) Interrupt endpoint to receive HCI events
 273  *      2) Bulk IN endpoint to receive ACL data
 274  *      3) Bulk OUT endpoint to send ACL data
 275  *
 276  * Interface 1 on the USB device must present the following endpoints
 277  *      1) Isochronous IN endpoint to receive SCO data
 278  *      2) Isochronous OUT endpoint to send SCO data
 279  */
 280
 281 static const struct usb_config          ubt_config[UBT_N_TRANSFER] =
 282 {
 283         /*
 284          * Interface #0
 285          */
 286
 287         /* Outgoing bulk transfer - ACL packets */
 288         [UBT_IF_0_BULK_DT_WR] = {
 289                 .type =         UE_BULK,
 290                 .endpoint =     UE_ADDR_ANY,
 291                 .direction =    UE_DIR_OUT,
 292                 .if_index =     0,
 293                 .bufsize =      UBT_BULK_WRITE_BUFFER_SIZE,
 294                 .flags =        { .pipe_bof = 1, .force_short_xfer = 1, },
 295                 .callback =     &ubt_bulk_write_callback,
 296         },
 297         /* Incoming bulk transfer - ACL packets */
 298         [UBT_IF_0_BULK_DT_RD] = {
 299                 .type =         UE_BULK,
 300                 .endpoint =     UE_ADDR_ANY,
 301                 .direction =    UE_DIR_IN,
 302                 .if_index =     0,
 303                 .bufsize =      UBT_BULK_READ_BUFFER_SIZE,
 304                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
 305                 .callback =     &ubt_bulk_read_callback,
 306         },
 307         /* Incoming interrupt transfer - HCI events */
 308         [UBT_IF_0_INTR_DT_RD] = {
 309                 .type =         UE_INTERRUPT,
 310                 .endpoint =     UE_ADDR_ANY,
 311                 .direction =    UE_DIR_IN,
 312                 .if_index =     0,
 313                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
 314                 .bufsize =      UBT_INTR_BUFFER_SIZE,
 315                 .callback =     &ubt_intr_read_callback,
 316         },
 317         /* Outgoing control transfer - HCI commands */
 318         [UBT_IF_0_CTRL_DT_WR] = {
 319                 .type =         UE_CONTROL,
 320                 .endpoint =     0x00,   /* control pipe */
 321                 .direction =    UE_DIR_ANY,
 322                 .if_index =     0,
 323                 .bufsize =      UBT_CTRL_BUFFER_SIZE,
 324                 .callback =     &ubt_ctrl_write_callback,
 325                 .timeout =      5000,   /* 5 seconds */
 326         },
 327
 328         /*
 329          * Interface #1
 330          */
 331
 332         /* Incoming isochronous transfer #1 - SCO packets */
 333         [UBT_IF_1_ISOC_DT_RD1] = {
 334                 .type =         UE_ISOCHRONOUS,
 335                 .endpoint =     UE_ADDR_ANY,
 336                 .direction =    UE_DIR_IN,
 337                 .if_index =     1,
 338                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 339                 .frames =       UBT_ISOC_NFRAMES,
 340                 .flags =        { .short_xfer_ok = 1, },
 341                 .callback =     &ubt_isoc_read_callback,
 342         },
 343         /* Incoming isochronous transfer #2 - SCO packets */
 344         [UBT_IF_1_ISOC_DT_RD2] = {
 345                 .type =         UE_ISOCHRONOUS,
 346                 .endpoint =     UE_ADDR_ANY,
 347                 .direction =    UE_DIR_IN,
 348                 .if_index =     1,
 349                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 350                 .frames =       UBT_ISOC_NFRAMES,
 351                 .flags =        { .short_xfer_ok = 1, },
 352                 .callback =     &ubt_isoc_read_callback,
 353         },
 354         /* Outgoing isochronous transfer #1 - SCO packets */
 355         [UBT_IF_1_ISOC_DT_WR1] = {
 356                 .type =         UE_ISOCHRONOUS,
 357                 .endpoint =     UE_ADDR_ANY,
 358                 .direction =    UE_DIR_OUT,
 359                 .if_index =     1,
 360                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 361                 .frames =       UBT_ISOC_NFRAMES,
 362                 .flags =        { .short_xfer_ok = 1, },
 363                 .callback =     &ubt_isoc_write_callback,
 364         },
 365         /* Outgoing isochronous transfer #2 - SCO packets */
 366         [UBT_IF_1_ISOC_DT_WR2] = {
 367                 .type =         UE_ISOCHRONOUS,
 368                 .endpoint =     UE_ADDR_ANY,
 369                 .direction =    UE_DIR_OUT,
 370                 .if_index =     1,
 371                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 372                 .frames =       UBT_ISOC_NFRAMES,
 373                 .flags =        { .short_xfer_ok = 1, },
 374                 .callback =     &ubt_isoc_write_callback,
 375         },
 376 };
 377
 378 /*
 379  * If for some reason device should not be attached then put
 380  * VendorID/ProductID pair into the list below. The format is
 381  * as follows:
 382  *
 383  *      { USB_VPI(VENDOR_ID, PRODUCT_ID, 0) },
 384  *
 385  * where VENDOR_ID and PRODUCT_ID are hex numbers.
 386  */
 387
 388 static const STRUCT_USB_HOST_ID ubt_ignore_devs[] =
 389 {
 390         /* AVM USB Bluetooth-Adapter BlueFritz! v1.0 */
 391         { USB_VPI(USB_VENDOR_AVM, 0x2200, 0) },
 392
 393         /* Atheros 3011 with sflash firmware */
 394         { USB_VPI(0x0cf3, 0x3002, 0) },
 395         { USB_VPI(0x0cf3, 0xe019, 0) },
 396         { USB_VPI(0x13d3, 0x3304, 0) },
 397         { USB_VPI(0x0930, 0x0215, 0) },
 398         { USB_VPI(0x0489, 0xe03d, 0) },
 399         { USB_VPI(0x0489, 0xe027, 0) },
 400
 401         /* Atheros AR9285 Malbec with sflash firmware */
 402         { USB_VPI(0x03f0, 0x311d, 0) },
 403
 404         /* Atheros 3012 with sflash firmware */
 405         { USB_VPI(0x0cf3, 0x3004, 0) },
 406         { USB_VPI(0x0cf3, 0x311d, 0) },
 407         { USB_VPI(0x13d3, 0x3375, 0) },
 408         { USB_VPI(0x04ca, 0x3005, 0) },
 409         { USB_VPI(0x04ca, 0x3006, 0) },
 410         { USB_VPI(0x04ca, 0x3008, 0) },
 411         { USB_VPI(0x13d3, 0x3362, 0) },
 412         { USB_VPI(0x0cf3, 0xe004, 0) },
 413         { USB_VPI(0x0930, 0x0219, 0) },
 414         { USB_VPI(0x0489, 0xe057, 0) },
 415         { USB_VPI(0x13d3, 0x3393, 0) },
 416         { USB_VPI(0x0489, 0xe04e, 0) },
 417         { USB_VPI(0x0489, 0xe056, 0) },
 418
 419         /* Atheros AR5BBU12 with sflash firmware */
 420         { USB_VPI(0x0489, 0xe02c, 0) },
 421
 422         /* Atheros AR5BBU12 with sflash firmware */
 423         { USB_VPI(0x0489, 0xe03c, 0) },
 424         { USB_VPI(0x0489, 0xe036, 0) },
 425 };
 426
 427 /* List of supported bluetooth devices */
 428 static const STRUCT_USB_HOST_ID ubt_devs[] =
 429 {
 430         /* Generic Bluetooth class devices */
 431         { USB_IFACE_CLASS(UDCLASS_WIRELESS),
 432           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 433           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 434
 435         /* AVM USB Bluetooth-Adapter BlueFritz! v2.0 */
 436         { USB_VPI(USB_VENDOR_AVM, 0x3800, 0) },
 437
 438         /* Broadcom USB dongles, mostly BCM20702 and BCM20702A0 */
 439         { USB_VENDOR(USB_VENDOR_BROADCOM),
 440           USB_IFACE_CLASS(UICLASS_VENDOR),
 441           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 442           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 443 };
 444
 445 /*
 446  * Probe for a USB Bluetooth device.
 447  * USB context.
 448  */
 449
 450 static int
 451 ubt_probe(device_t dev)
 452 {
 453         struct usb_attach_arg   *uaa = device_get_ivars(dev);
 454         int error;
 455
 456         if (uaa->usb_mode != USB_MODE_HOST)
 457                 return (ENXIO);
 458
 459         if (uaa->info.bIfaceIndex != 0)
 460                 return (ENXIO);
 461
 462         if (usbd_lookup_id_by_uaa(ubt_ignore_devs,
 463                         sizeof(ubt_ignore_devs), uaa) == 0)
 464                 return (ENXIO);
 465
 466         error = usbd_lookup_id_by_uaa(ubt_devs, sizeof(ubt_devs), uaa);
 467         if (error == 0)
 468                 return (BUS_PROBE_GENERIC);
 469         return (error);
 470 } /* ubt_probe */
 471
 472 /*
 473  * Attach the device.
 474  * USB context.
 475  */
 476
 477 static int
 478 ubt_attach(device_t dev)
 479 {
 480         struct usb_attach_arg           *uaa = device_get_ivars(dev);
 481         struct ubt_softc                *sc = device_get_softc(dev);
 482         struct usb_endpoint_descriptor  *ed;
 483         struct usb_interface_descriptor *id;
 484         struct usb_interface            *iface;
 485         uint16_t                        wMaxPacketSize;
 486         uint8_t                         alt_index, i, j;
 487         uint8_t                         iface_index[2] = { 0, 1 };
 488
 489         device_set_usb_desc(dev);
 490
 491         sc->sc_dev = dev;
 492         sc->sc_debug = NG_UBT_WARN_LEVEL;
 493         CURVNET_SET(TD_TO_VNET(curthread));
 494         /*
 495          * Create Netgraph node
 496          */
 497
 498         if (ng_make_node_common(&typestruct, &sc->sc_node) != 0) {
 499                 UBT_ALERT(sc, "could not create Netgraph node\n");
 500                 CURVNET_RESTORE();
 501                 return (ENXIO);
 502         }
 503
 504         /* Name Netgraph node */
 505         if (ng_name_node(sc->sc_node, device_get_nameunit(dev)) != 0) {
 506                 UBT_ALERT(sc, "could not name Netgraph node\n");
 507                 NG_NODE_UNREF(sc->sc_node);
 508                 CURVNET_RESTORE();
 509                 return (ENXIO);
 510         }
 511         NG_NODE_SET_PRIVATE(sc->sc_node, sc);
 512         NG_NODE_FORCE_WRITER(sc->sc_node);
 513         CURVNET_RESTORE();
 514
 515         /*
 516          * Initialize device softc structure
 517          */
 518
 519         /* initialize locks */
 520         mtx_init(&sc->sc_ng_mtx, "ubt ng", NULL, MTX_DEF);
 521         mtx_init(&sc->sc_if_mtx, "ubt if", NULL, MTX_DEF | MTX_RECURSE);
 522
 523         /* initialize packet queues */
 524         NG_BT_MBUFQ_INIT(&sc->sc_cmdq, UBT_DEFAULT_QLEN);
 525         NG_BT_MBUFQ_INIT(&sc->sc_aclq, UBT_DEFAULT_QLEN);
 526         NG_BT_MBUFQ_INIT(&sc->sc_scoq, UBT_DEFAULT_QLEN);
 527
 528         /* initialize glue task */
 529         TASK_INIT(&sc->sc_task, 0, ubt_task, sc);
 530
 531         /*
 532          * Configure Bluetooth USB device. Discover all required USB
 533          * interfaces and endpoints.
 534          *
 535          * USB device must present two interfaces:
 536          * 1) Interface 0 that has 3 endpoints
 537          *      1) Interrupt endpoint to receive HCI events
 538          *      2) Bulk IN endpoint to receive ACL data
 539          *      3) Bulk OUT endpoint to send ACL data
 540          *
 541          * 2) Interface 1 then has 2 endpoints
 542          *      1) Isochronous IN endpoint to receive SCO data
 543          *      2) Isochronous OUT endpoint to send SCO data
 544          *
 545          * Interface 1 (with isochronous endpoints) has several alternate
 546          * configurations with different packet size.
 547          */
 548
 549         /*
 550          * For interface #1 search alternate settings, and find
 551          * the descriptor with the largest wMaxPacketSize
 552          */
 553
 554         wMaxPacketSize = 0;
 555         alt_index = 0;
 556         i = 0;
 557         j = 0;
 558         ed = NULL;
 559
 560         /*
 561          * Search through all the descriptors looking for the largest
 562          * packet size:
 563          */
 564         while ((ed = (struct usb_endpoint_descriptor *)usb_desc_foreach(
 565             usbd_get_config_descriptor(uaa->device),
 566             (struct usb_descriptor *)ed))) {
 567
 568                 if ((ed->bDescriptorType == UDESC_INTERFACE) &&
 569                     (ed->bLength >= sizeof(*id))) {
 570                         id = (struct usb_interface_descriptor *)ed;
 571                         i = id->bInterfaceNumber;
 572                         j = id->bAlternateSetting;
 573                 }
 574
 575                 if ((ed->bDescriptorType == UDESC_ENDPOINT) &&
 576                     (ed->bLength >= sizeof(*ed)) &&
 577                     (i == 1)) {
 578                         uint16_t temp;
 579
 580                         temp = UGETW(ed->wMaxPacketSize);
 581                         if (temp > wMaxPacketSize) {
 582                                 wMaxPacketSize = temp;
 583                                 alt_index = j;
 584                         }
 585                 }
 586         }
 587
 588         /* Set alt configuration on interface #1 only if we found it */
 589         if (wMaxPacketSize > 0 &&
 590             usbd_set_alt_interface_index(uaa->device, 1, alt_index)) {
 591                 UBT_ALERT(sc, "could not set alternate setting %d " \
 592                         "for interface 1!\n", alt_index);
 593                 goto detach;
 594         }
 595
 596         /* Setup transfers for both interfaces */
 597         if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer,
 598                         ubt_config, UBT_N_TRANSFER, sc, &sc->sc_if_mtx)) {
 599                 UBT_ALERT(sc, "could not allocate transfers\n");
 600                 goto detach;
 601         }
 602
 603         /* Claim all interfaces belonging to the Bluetooth part */
 604         for (i = 1;; i++) {
 605                 iface = usbd_get_iface(uaa->device, i);
 606                 if (iface == NULL)
 607                         break;
 608                 id = usbd_get_interface_descriptor(iface);
 609
 610                 if ((id != NULL) &&
 611                     (id->bInterfaceClass == UICLASS_WIRELESS) &&
 612                     (id->bInterfaceSubClass == UISUBCLASS_RF) &&
 613                     (id->bInterfaceProtocol == UIPROTO_BLUETOOTH)) {
 614                         usbd_set_parent_iface(uaa->device, i,
 615                             uaa->info.bIfaceIndex);
 616                 }
 617         }
 618         return (0); /* success */
 619
 620 detach:
 621         ubt_detach(dev);
 622
 623         return (ENXIO);
 624 } /* ubt_attach */
 625
 626 /*
 627  * Detach the device.
 628  * USB context.
 629  */
 630
 631 int
 632 ubt_detach(device_t dev)
 633 {
 634         struct ubt_softc        *sc = device_get_softc(dev);
 635         node_p                  node = sc->sc_node;
 636
 637         /* Destroy Netgraph node */
 638         if (node != NULL) {
 639                 sc->sc_node = NULL;
 640                 CURVNET_SET(node->nd_vnet);
 641                 NG_NODE_REALLY_DIE(node);
 642                 ng_rmnode_self(node);
 643                 CURVNET_RESTORE();
 644         }
 645
 646         /* Make sure ubt_task in gone */
 647         taskqueue_drain(taskqueue_swi, &sc->sc_task);
 648
 649         /* Free USB transfers, if any */
 650         usbd_transfer_unsetup(sc->sc_xfer, UBT_N_TRANSFER);
 651
 652         /* Destroy queues */
 653         UBT_NG_LOCK(sc);
 654         NG_BT_MBUFQ_DESTROY(&sc->sc_cmdq);
 655         NG_BT_MBUFQ_DESTROY(&sc->sc_aclq);
 656         NG_BT_MBUFQ_DESTROY(&sc->sc_scoq);
 657         UBT_NG_UNLOCK(sc);
 658
 659         mtx_destroy(&sc->sc_if_mtx);
 660         mtx_destroy(&sc->sc_ng_mtx);
 661
 662         return (0);
 663 } /* ubt_detach */
 664
 665 /*
 666  * Called when outgoing control request (HCI command) has completed, i.e.
 667  * HCI command was sent to the device.
 668  * USB context.
 669  */
 670
 671 static void
 672 ubt_ctrl_write_callback(struct usb_xfer *xfer, usb_error_t error)
 673 {
 674         struct ubt_softc                *sc = usbd_xfer_softc(xfer);
 675         struct usb_device_request       req;
 676         struct mbuf                     *m;
 677         struct usb_page_cache           *pc;
 678         int                             actlen;
 679
 680         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 681
 682         switch (USB_GET_STATE(xfer)) {
 683         case USB_ST_TRANSFERRED:
 684                 UBT_INFO(sc, "sent %d bytes to control pipe\n", actlen);
 685                 UBT_STAT_BYTES_SENT(sc, actlen);
 686                 UBT_STAT_PCKTS_SENT(sc);
 687                 /* FALLTHROUGH */
 688
 689         case USB_ST_SETUP:
 690 send_next:
 691                 /* Get next command mbuf, if any */
 692                 UBT_NG_LOCK(sc);
 693                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_cmdq, m);
 694                 UBT_NG_UNLOCK(sc);
 695
 696                 if (m == NULL) {
 697                         UBT_INFO(sc, "HCI command queue is empty\n");
 698                         break;  /* transfer complete */
 699                 }
 700
 701                 /* Initialize a USB control request and then schedule it */
 702                 bzero(&req, sizeof(req));
 703                 req.bmRequestType = UBT_HCI_REQUEST;
 704                 USETW(req.wLength, m->m_pkthdr.len);
 705
 706                 UBT_INFO(sc, "Sending control request, " \
 707                         "bmRequestType=0x%02x, wLength=%d\n",
 708                         req.bmRequestType, UGETW(req.wLength));
 709
 710                 pc = usbd_xfer_get_frame(xfer, 0);
 711                 usbd_copy_in(pc, 0, &req, sizeof(req));
 712                 pc = usbd_xfer_get_frame(xfer, 1);
 713                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
 714
 715                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
 716                 usbd_xfer_set_frame_len(xfer, 1, m->m_pkthdr.len);
 717                 usbd_xfer_set_frames(xfer, 2);
 718
 719                 NG_FREE_M(m);
 720
 721                 usbd_transfer_submit(xfer);
 722                 break;
 723
 724         default: /* Error */
 725                 if (error != USB_ERR_CANCELLED) {
 726                         UBT_WARN(sc, "control transfer failed: %s\n",
 727                                 usbd_errstr(error));
 728
 729                         UBT_STAT_OERROR(sc);
 730                         goto send_next;
 731                 }
 732
 733                 /* transfer cancelled */
 734                 break;
 735         }
 736 } /* ubt_ctrl_write_callback */
 737
 738 /*
 739  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
 740  * HCI event was received from the device.
 741  * USB context.
 742  */
 743
 744 static void
 745 ubt_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
 746 {
 747         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 748         struct mbuf             *m;
 749         ng_hci_event_pkt_t      *hdr;
 750         struct usb_page_cache   *pc;
 751         int                     actlen;
 752
 753         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 754
 755         m = NULL;
 756
 757         switch (USB_GET_STATE(xfer)) {
 758         case USB_ST_TRANSFERRED:
 759                 /* Allocate a new mbuf */
 760                 MGETHDR(m, M_NOWAIT, MT_DATA);
 761                 if (m == NULL) {
 762                         UBT_STAT_IERROR(sc);
 763                         goto submit_next;
 764                 }
 765
 766                 MCLGET(m, M_NOWAIT);
 767                 if (!(m->m_flags & M_EXT)) {
 768                         UBT_STAT_IERROR(sc);
 769                         goto submit_next;
 770                 }
 771
 772                 /* Add HCI packet type */
 773                 *mtod(m, uint8_t *)= NG_HCI_EVENT_PKT;
 774                 m->m_pkthdr.len = m->m_len = 1;
 775
 776                 if (actlen > MCLBYTES - 1)
 777                         actlen = MCLBYTES - 1;
 778
 779                 pc = usbd_xfer_get_frame(xfer, 0);
 780                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
 781                 m->m_pkthdr.len += actlen;
 782                 m->m_len += actlen;
 783
 784                 UBT_INFO(sc, "got %d bytes from interrupt pipe\n",
 785                         actlen);
 786
 787                 /* Validate packet and send it up the stack */
 788                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
 789                         UBT_INFO(sc, "HCI event packet is too short\n");
 790
 791                         UBT_STAT_IERROR(sc);
 792                         goto submit_next;
 793                 }
 794
 795                 hdr = mtod(m, ng_hci_event_pkt_t *);
 796                 if (hdr->length != (m->m_pkthdr.len - sizeof(*hdr))) {
 797                         UBT_ERR(sc, "Invalid HCI event packet size, " \
 798                                 "length=%d, pktlen=%d\n",
 799                                 hdr->length, m->m_pkthdr.len);
 800
 801                         UBT_STAT_IERROR(sc);
 802                         goto submit_next;
 803                 }
 804
 805                 UBT_INFO(sc, "got complete HCI event frame, pktlen=%d, " \
 806                         "length=%d\n", m->m_pkthdr.len, hdr->length);
 807
 808                 UBT_STAT_PCKTS_RECV(sc);
 809                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
 810
 811                 ubt_fwd_mbuf_up(sc, &m);
 812                 /* m == NULL at this point */
 813                 /* FALLTHROUGH */
 814
 815         case USB_ST_SETUP:
 816 submit_next:
 817                 NG_FREE_M(m); /* checks for m != NULL */
 818
 819                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
 820                 usbd_transfer_submit(xfer);
 821                 break;
 822
 823         default: /* Error */
 824                 if (error != USB_ERR_CANCELLED) {
 825                         UBT_WARN(sc, "interrupt transfer failed: %s\n",
 826                                 usbd_errstr(error));
 827
 828                         /* Try to clear stall first */
 829                         usbd_xfer_set_stall(xfer);
 830                         goto submit_next;
 831                 }
 832                         /* transfer cancelled */
 833                 break;
 834         }
 835 } /* ubt_intr_read_callback */
 836
 837 /*
 838  * Called when incoming bulk transfer (ACL packet) has completed, i.e.
 839  * ACL packet was received from the device.
 840  * USB context.
 841  */
 842
 843 static void
 844 ubt_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 845 {
 846         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 847         struct mbuf             *m;
 848         ng_hci_acldata_pkt_t    *hdr;
 849         struct usb_page_cache   *pc;
 850         int len;
 851         int actlen;
 852
 853         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 854
 855         m = NULL;
 856
 857         switch (USB_GET_STATE(xfer)) {
 858         case USB_ST_TRANSFERRED:
 859                 /* Allocate new mbuf */
 860                 MGETHDR(m, M_NOWAIT, MT_DATA);
 861                 if (m == NULL) {
 862                         UBT_STAT_IERROR(sc);
 863                         goto submit_next;
 864                 }
 865
 866                 MCLGET(m, M_NOWAIT);
 867                 if (!(m->m_flags & M_EXT)) {
 868                         UBT_STAT_IERROR(sc);
 869                         goto submit_next;
 870                 }
 871
 872                 /* Add HCI packet type */
 873                 *mtod(m, uint8_t *)= NG_HCI_ACL_DATA_PKT;
 874                 m->m_pkthdr.len = m->m_len = 1;
 875
 876                 if (actlen > MCLBYTES - 1)
 877                         actlen = MCLBYTES - 1;
 878
 879                 pc = usbd_xfer_get_frame(xfer, 0);
 880                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
 881                 m->m_pkthdr.len += actlen;
 882                 m->m_len += actlen;
 883
 884                 UBT_INFO(sc, "got %d bytes from bulk-in pipe\n",
 885                         actlen);
 886
 887                 /* Validate packet and send it up the stack */
 888                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
 889                         UBT_INFO(sc, "HCI ACL packet is too short\n");
 890
 891                         UBT_STAT_IERROR(sc);
 892                         goto submit_next;
 893                 }
 894
 895                 hdr = mtod(m, ng_hci_acldata_pkt_t *);
 896                 len = le16toh(hdr->length);
 897                 if (len != (int)(m->m_pkthdr.len - sizeof(*hdr))) {
 898                         UBT_ERR(sc, "Invalid ACL packet size, length=%d, " \
 899                                 "pktlen=%d\n", len, m->m_pkthdr.len);
 900
 901                         UBT_STAT_IERROR(sc);
 902                         goto submit_next;
 903                 }
 904
 905                 UBT_INFO(sc, "got complete ACL data packet, pktlen=%d, " \
 906                         "length=%d\n", m->m_pkthdr.len, len);
 907
 908                 UBT_STAT_PCKTS_RECV(sc);
 909                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
 910
 911                 ubt_fwd_mbuf_up(sc, &m);
 912                 /* m == NULL at this point */
 913                 /* FALLTHOUGH */
 914
 915         case USB_ST_SETUP:
 916 submit_next:
 917                 NG_FREE_M(m); /* checks for m != NULL */
 918
 919                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
 920                 usbd_transfer_submit(xfer);
 921                 break;
 922
 923         default: /* Error */
 924                 if (error != USB_ERR_CANCELLED) {
 925                         UBT_WARN(sc, "bulk-in transfer failed: %s\n",
 926                                 usbd_errstr(error));
 927
 928                         /* Try to clear stall first */
 929                         usbd_xfer_set_stall(xfer);
 930                         goto submit_next;
 931                 }
 932                         /* transfer cancelled */
 933                 break;
 934         }
 935 } /* ubt_bulk_read_callback */
 936
 937 /*
 938  * Called when outgoing bulk transfer (ACL packet) has completed, i.e.
 939  * ACL packet was sent to the device.
 940  * USB context.
 941  */
 942
 943 static void
 944 ubt_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
 945 {
 946         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 947         struct mbuf             *m;
 948         struct usb_page_cache   *pc;
 949         int                     actlen;
 950
 951         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 952
 953         switch (USB_GET_STATE(xfer)) {
 954         case USB_ST_TRANSFERRED:
 955                 UBT_INFO(sc, "sent %d bytes to bulk-out pipe\n", actlen);
 956                 UBT_STAT_BYTES_SENT(sc, actlen);
 957                 UBT_STAT_PCKTS_SENT(sc);
 958                 /* FALLTHROUGH */
 959
 960         case USB_ST_SETUP:
 961 send_next:
 962                 /* Get next mbuf, if any */
 963                 UBT_NG_LOCK(sc);
 964                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_aclq, m);
 965                 UBT_NG_UNLOCK(sc);
 966
 967                 if (m == NULL) {
 968                         UBT_INFO(sc, "ACL data queue is empty\n");
 969                         break; /* transfer completed */
 970                 }
 971
 972                 /*
 973                  * Copy ACL data frame back to a linear USB transfer buffer
 974                  * and schedule transfer
 975                  */
 976
 977                 pc = usbd_xfer_get_frame(xfer, 0);
 978                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
 979                 usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
 980
 981                 UBT_INFO(sc, "bulk-out transfer has been started, len=%d\n",
 982                         m->m_pkthdr.len);
 983
 984                 NG_FREE_M(m);
 985
 986                 usbd_transfer_submit(xfer);
 987                 break;
 988
 989         default: /* Error */
 990                 if (error != USB_ERR_CANCELLED) {
 991                         UBT_WARN(sc, "bulk-out transfer failed: %s\n",
 992                                 usbd_errstr(error));
 993
 994                         UBT_STAT_OERROR(sc);
 995
 996                         /* try to clear stall first */
 997                         usbd_xfer_set_stall(xfer);
 998                         goto send_next;
 999                 }
1000                         /* transfer cancelled */
1001                 break;
1002         }
1003 } /* ubt_bulk_write_callback */
1004
1005 /*
1006  * Called when incoming isoc transfer (SCO packet) has completed, i.e.
1007  * SCO packet was received from the device.
1008  * USB context.
1009  */
1010
1011 static void
1012 ubt_isoc_read_callback(struct usb_xfer *xfer, usb_error_t error)
1013 {
1014         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1015         int                     n;
1016         int actlen, nframes;
1017
1018         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1019
1020         switch (USB_GET_STATE(xfer)) {
1021         case USB_ST_TRANSFERRED:
1022                 for (n = 0; n < nframes; n ++)
1023                         if (ubt_isoc_read_one_frame(xfer, n) < 0)
1024                                 break;
1025                 /* FALLTHROUGH */
1026
1027         case USB_ST_SETUP:
1028 read_next:
1029                 for (n = 0; n < nframes; n ++)
1030                         usbd_xfer_set_frame_len(xfer, n,
1031                             usbd_xfer_max_framelen(xfer));
1032
1033                 usbd_transfer_submit(xfer);
1034                 break;
1035
1036         default: /* Error */
1037                 if (error != USB_ERR_CANCELLED) {
1038                         UBT_STAT_IERROR(sc);
1039                         goto read_next;
1040                 }
1041
1042                 /* transfer cancelled */
1043                 break;
1044         }
1045 } /* ubt_isoc_read_callback */
1046
1047 /*
1048  * Helper function. Called from ubt_isoc_read_callback() to read
1049  * SCO data from one frame.
1050  * USB context.
1051  */
1052
1053 static int
1054 ubt_isoc_read_one_frame(struct usb_xfer *xfer, int frame_no)
1055 {
1056         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1057         struct usb_page_cache   *pc;
1058         struct mbuf             *m;
1059         int                     len, want, got, total;
1060
1061         /* Get existing SCO reassembly buffer */
1062         pc = usbd_xfer_get_frame(xfer, 0);
1063         m = sc->sc_isoc_in_buffer;
1064         total = usbd_xfer_frame_len(xfer, frame_no);
1065
1066         /* While we have data in the frame */
1067         while (total > 0) {
1068                 if (m == NULL) {
1069                         /* Start new reassembly buffer */
1070                         MGETHDR(m, M_NOWAIT, MT_DATA);
1071                         if (m == NULL) {
1072                                 UBT_STAT_IERROR(sc);
1073                                 return (-1);    /* XXX out of sync! */
1074                         }
1075
1076                         MCLGET(m, M_NOWAIT);
1077                         if (!(m->m_flags & M_EXT)) {
1078                                 UBT_STAT_IERROR(sc);
1079                                 NG_FREE_M(m);
1080                                 return (-1);    /* XXX out of sync! */
1081                         }
1082
1083                         /* Expect SCO header */
1084                         *mtod(m, uint8_t *) = NG_HCI_SCO_DATA_PKT;
1085                         m->m_pkthdr.len = m->m_len = got = 1;
1086                         want = sizeof(ng_hci_scodata_pkt_t);
1087                 } else {
1088                         /*
1089                          * Check if we have SCO header and if so
1090                          * adjust amount of data we want
1091                          */
1092                         got = m->m_pkthdr.len;
1093                         want = sizeof(ng_hci_scodata_pkt_t);
1094
1095                         if (got >= want)
1096                                 want += mtod(m, ng_hci_scodata_pkt_t *)->length;
1097                 }
1098
1099                 /* Append frame data to the SCO reassembly buffer */
1100                 len = total;
1101                 if (got + len > want)
1102                         len = want - got;
1103
1104                 usbd_copy_out(pc, frame_no * usbd_xfer_max_framelen(xfer),
1105                         mtod(m, uint8_t *) + m->m_pkthdr.len, len);
1106
1107                 m->m_pkthdr.len += len;
1108                 m->m_len += len;
1109                 total -= len;
1110
1111                 /* Check if we got everything we wanted, if not - continue */
1112                 if (got != want)
1113                         continue;
1114
1115                 /* If we got here then we got complete SCO frame */
1116                 UBT_INFO(sc, "got complete SCO data frame, pktlen=%d, " \
1117                         "length=%d\n", m->m_pkthdr.len,
1118                         mtod(m, ng_hci_scodata_pkt_t *)->length);
1119
1120                 UBT_STAT_PCKTS_RECV(sc);
1121                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1122
1123                 ubt_fwd_mbuf_up(sc, &m);
1124                 /* m == NULL at this point */
1125         }
1126
1127         /* Put SCO reassembly buffer back */
1128         sc->sc_isoc_in_buffer = m;
1129
1130         return (0);
1131 } /* ubt_isoc_read_one_frame */
1132
1133 /*
1134  * Called when outgoing isoc transfer (SCO packet) has completed, i.e.
1135  * SCO packet was sent to the device.
1136  * USB context.
1137  */
1138
1139 static void
1140 ubt_isoc_write_callback(struct usb_xfer *xfer, usb_error_t error)
1141 {
1142         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1143         struct usb_page_cache   *pc;
1144         struct mbuf             *m;
1145         int                     n, space, offset;
1146         int                     actlen, nframes;
1147
1148         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1149         pc = usbd_xfer_get_frame(xfer, 0);
1150
1151         switch (USB_GET_STATE(xfer)) {
1152         case USB_ST_TRANSFERRED:
1153                 UBT_INFO(sc, "sent %d bytes to isoc-out pipe\n", actlen);
1154                 UBT_STAT_BYTES_SENT(sc, actlen);
1155                 UBT_STAT_PCKTS_SENT(sc);
1156                 /* FALLTHROUGH */
1157
1158         case USB_ST_SETUP:
1159 send_next:
1160                 offset = 0;
1161                 space = usbd_xfer_max_framelen(xfer) * nframes;
1162                 m = NULL;
1163
1164                 while (space > 0) {
1165                         if (m == NULL) {
1166                                 UBT_NG_LOCK(sc);
1167                                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_scoq, m);
1168                                 UBT_NG_UNLOCK(sc);
1169
1170                                 if (m == NULL)
1171                                         break;
1172                         }
1173
1174                         n = min(space, m->m_pkthdr.len);
1175                         if (n > 0) {
1176                                 usbd_m_copy_in(pc, offset, m,0, n);
1177                                 m_adj(m, n);
1178
1179                                 offset += n;
1180                                 space -= n;
1181                         }
1182
1183                         if (m->m_pkthdr.len == 0)
1184                                 NG_FREE_M(m); /* sets m = NULL */
1185                 }
1186
1187                 /* Put whatever is left from mbuf back on queue */
1188                 if (m != NULL) {
1189                         UBT_NG_LOCK(sc);
1190                         NG_BT_MBUFQ_PREPEND(&sc->sc_scoq, m);
1191                         UBT_NG_UNLOCK(sc);
1192                 }
1193
1194                 /*
1195                  * Calculate sizes for isoc frames.
1196                  * Note that offset could be 0 at this point (i.e. we have
1197                  * nothing to send). That is fine, as we have isoc. transfers
1198                  * going in both directions all the time. In this case it
1199                  * would be just empty isoc. transfer.
1200                  */
1201
1202                 for (n = 0; n < nframes; n ++) {
1203                         usbd_xfer_set_frame_len(xfer, n,
1204                             min(offset, usbd_xfer_max_framelen(xfer)));
1205                         offset -= usbd_xfer_frame_len(xfer, n);
1206                 }
1207
1208                 usbd_transfer_submit(xfer);
1209                 break;
1210
1211         default: /* Error */
1212                 if (error != USB_ERR_CANCELLED) {
1213                         UBT_STAT_OERROR(sc);
1214                         goto send_next;
1215                 }
1216
1217                 /* transfer cancelled */
1218                 break;
1219         }
1220 }
1221
1222 /*
1223  * Utility function to forward provided mbuf upstream (i.e. up the stack).
1224  * Modifies value of the mbuf pointer (sets it to NULL).
1225  * Save to call from any context.
1226  */
1227
1228 static int
1229 ubt_fwd_mbuf_up(ubt_softc_p sc, struct mbuf **m)
1230 {
1231         hook_p  hook;
1232         int     error;
1233
1234         /*
1235          * Close the race with Netgraph hook newhook/disconnect methods.
1236          * Save the hook pointer atomically. Two cases are possible:
1237          *
1238          * 1) The hook pointer is NULL. It means disconnect method got
1239          *    there first. In this case we are done.
1240          *
1241          * 2) The hook pointer is not NULL. It means that hook pointer
1242          *    could be either in valid or invalid (i.e. in the process
1243          *    of disconnect) state. In any case grab an extra reference
1244          *    to protect the hook pointer.
1245          *
1246          * It is ok to pass hook in invalid state to NG_SEND_DATA_ONLY() as
1247          * it checks for it. Drop extra reference after NG_SEND_DATA_ONLY().
1248          */
1249
1250         UBT_NG_LOCK(sc);
1251         if ((hook = sc->sc_hook) != NULL)
1252                 NG_HOOK_REF(hook);
1253         UBT_NG_UNLOCK(sc);
1254
1255         if (hook == NULL) {
1256                 NG_FREE_M(*m);
1257                 return (ENETDOWN);
1258         }
1259
1260         NG_SEND_DATA_ONLY(error, hook, *m);
1261         NG_HOOK_UNREF(hook);
1262
1263         if (error != 0)
1264                 UBT_STAT_IERROR(sc);
1265
1266         return (error);
1267 } /* ubt_fwd_mbuf_up */
1268
1269 /****************************************************************************
1270  ****************************************************************************
1271  **                                 Glue
1272  ****************************************************************************
1273  ****************************************************************************/
1274
1275 /*
1276  * Schedule glue task. Should be called with sc_ng_mtx held.
1277  * Netgraph context.
1278  */
1279
1280 static void
1281 ubt_task_schedule(ubt_softc_p sc, int action)
1282 {
1283         mtx_assert(&sc->sc_ng_mtx, MA_OWNED);
1284
1285         /*
1286          * Try to handle corner case when "start all" and "stop all"
1287          * actions can both be set before task is executed.
1288          *
1289          * The rules are
1290          *
1291          * sc_task_flags        action          new sc_task_flags
1292          * ------------------------------------------------------
1293          * 0                    start           start
1294          * 0                    stop            stop
1295          * start                start           start
1296          * start                stop            stop
1297          * stop                 start           stop|start
1298          * stop                 stop            stop
1299          * stop|start           start           stop|start
1300          * stop|start           stop            stop
1301          */
1302
1303         if (action != 0) {
1304                 if ((action & UBT_FLAG_T_STOP_ALL) != 0)
1305                         sc->sc_task_flags &= ~UBT_FLAG_T_START_ALL;
1306
1307                 sc->sc_task_flags |= action;
1308         }
1309
1310         if (sc->sc_task_flags & UBT_FLAG_T_PENDING)
1311                 return;
1312
1313         if (taskqueue_enqueue(taskqueue_swi, &sc->sc_task) == 0) {
1314                 sc->sc_task_flags |= UBT_FLAG_T_PENDING;
1315                 return;
1316         }
1317
1318         /* XXX: i think this should never happen */
1319 } /* ubt_task_schedule */
1320
1321 /*
1322  * Glue task. Examines sc_task_flags and does things depending on it.
1323  * Taskqueue context.
1324  */
1325
1326 static void
1327 ubt_task(void *context, int pending)
1328 {
1329         ubt_softc_p     sc = context;
1330         int             task_flags, i;
1331
1332         UBT_NG_LOCK(sc);
1333         task_flags = sc->sc_task_flags;
1334         sc->sc_task_flags = 0;
1335         UBT_NG_UNLOCK(sc);
1336
1337         /*
1338          * Stop all USB transfers synchronously.
1339          * Stop interface #0 and #1 transfers at the same time and in the
1340          * same loop. usbd_transfer_drain() will do appropriate locking.
1341          */
1342
1343         if (task_flags & UBT_FLAG_T_STOP_ALL)
1344                 for (i = 0; i < UBT_N_TRANSFER; i ++)
1345                         usbd_transfer_drain(sc->sc_xfer[i]);
1346
1347         /* Start incoming interrupt and bulk, and all isoc. USB transfers */
1348         if (task_flags & UBT_FLAG_T_START_ALL) {
1349                 /*
1350                  * Interface #0
1351                  */
1352
1353                 mtx_lock(&sc->sc_if_mtx);
1354
1355                 ubt_xfer_start(sc, UBT_IF_0_INTR_DT_RD);
1356                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_RD);
1357
1358                 /*
1359                  * Interface #1
1360                  * Start both read and write isoc. transfers by default.
1361                  * Get them going all the time even if we have nothing
1362                  * to send to avoid any delays.
1363                  */
1364
1365                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD1);
1366                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD2);
1367                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR1);
1368                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR2);
1369
1370                 mtx_unlock(&sc->sc_if_mtx);
1371         }
1372
1373         /* Start outgoing control transfer */
1374         if (task_flags & UBT_FLAG_T_START_CTRL) {
1375                 mtx_lock(&sc->sc_if_mtx);
1376                 ubt_xfer_start(sc, UBT_IF_0_CTRL_DT_WR);
1377                 mtx_unlock(&sc->sc_if_mtx);
1378         }
1379
1380         /* Start outgoing bulk transfer */
1381         if (task_flags & UBT_FLAG_T_START_BULK) {
1382                 mtx_lock(&sc->sc_if_mtx);
1383                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_WR);
1384                 mtx_unlock(&sc->sc_if_mtx);
1385         }
1386 } /* ubt_task */
1387
1388 /****************************************************************************
1389  ****************************************************************************
1390  **                        Netgraph specific
1391  ****************************************************************************
1392  ****************************************************************************/
1393
1394 /*
1395  * Netgraph node constructor. Do not allow to create node of this type.
1396  * Netgraph context.
1397  */
1398
1399 static int
1400 ng_ubt_constructor(node_p node)
1401 {
1402         return (EINVAL);
1403 } /* ng_ubt_constructor */
1404
1405 /*
1406  * Netgraph node destructor. Destroy node only when device has been detached.
1407  * Netgraph context.
1408  */
1409
1410 static int
1411 ng_ubt_shutdown(node_p node)
1412 {
1413         if (node->nd_flags & NGF_REALLY_DIE) {
1414                 /*
1415                  * We came here because the USB device is being
1416                  * detached, so stop being persistant.
1417                  */
1418                 NG_NODE_SET_PRIVATE(node, NULL);
1419                 NG_NODE_UNREF(node);
1420         } else
1421                 NG_NODE_REVIVE(node); /* tell ng_rmnode we are persisant */
1422
1423         return (0);
1424 } /* ng_ubt_shutdown */
1425
1426 /*
1427  * Create new hook. There can only be one.
1428  * Netgraph context.
1429  */
1430
1431 static int
1432 ng_ubt_newhook(node_p node, hook_p hook, char const *name)
1433 {
1434         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1435
1436         if (strcmp(name, NG_UBT_HOOK) != 0)
1437                 return (EINVAL);
1438
1439         UBT_NG_LOCK(sc);
1440         if (sc->sc_hook != NULL) {
1441                 UBT_NG_UNLOCK(sc);
1442
1443                 return (EISCONN);
1444         }
1445
1446         sc->sc_hook = hook;
1447         UBT_NG_UNLOCK(sc);
1448
1449         return (0);
1450 } /* ng_ubt_newhook */
1451
1452 /*
1453  * Connect hook. Start incoming USB transfers.
1454  * Netgraph context.
1455  */
1456
1457 static int
1458 ng_ubt_connect(hook_p hook)
1459 {
1460         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1461
1462         NG_HOOK_FORCE_QUEUE(NG_HOOK_PEER(hook));
1463
1464         UBT_NG_LOCK(sc);
1465         ubt_task_schedule(sc, UBT_FLAG_T_START_ALL);
1466         UBT_NG_UNLOCK(sc);
1467
1468         return (0);
1469 } /* ng_ubt_connect */
1470
1471 /*
1472  * Disconnect hook.
1473  * Netgraph context.
1474  */
1475
1476 static int
1477 ng_ubt_disconnect(hook_p hook)
1478 {
1479         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1480
1481         UBT_NG_LOCK(sc);
1482
1483         if (hook != sc->sc_hook) {
1484                 UBT_NG_UNLOCK(sc);
1485
1486                 return (EINVAL);
1487         }
1488
1489         sc->sc_hook = NULL;
1490
1491         /* Kick off task to stop all USB xfers */
1492         ubt_task_schedule(sc, UBT_FLAG_T_STOP_ALL);
1493
1494         /* Drain queues */
1495         NG_BT_MBUFQ_DRAIN(&sc->sc_cmdq);
1496         NG_BT_MBUFQ_DRAIN(&sc->sc_aclq);
1497         NG_BT_MBUFQ_DRAIN(&sc->sc_scoq);
1498
1499         UBT_NG_UNLOCK(sc);
1500
1501         return (0);
1502 } /* ng_ubt_disconnect */
1503
1504 /*
1505  * Process control message.
1506  * Netgraph context.
1507  */
1508
1509 static int
1510 ng_ubt_rcvmsg(node_p node, item_p item, hook_p lasthook)
1511 {
1512         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1513         struct ng_mesg          *msg, *rsp = NULL;
1514         struct ng_bt_mbufq      *q;
1515         int                     error = 0, queue, qlen;
1516
1517         NGI_GET_MSG(item, msg);
1518
1519         switch (msg->header.typecookie) {
1520         case NGM_GENERIC_COOKIE:
1521                 switch (msg->header.cmd) {
1522                 case NGM_TEXT_STATUS:
1523                         NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
1524                         if (rsp == NULL) {
1525                                 error = ENOMEM;
1526                                 break;
1527                         }
1528
1529                         snprintf(rsp->data, NG_TEXTRESPONSE,
1530                                 "Hook: %s\n" \
1531                                 "Task flags: %#x\n" \
1532                                 "Debug: %d\n" \
1533                                 "CMD queue: [have:%d,max:%d]\n" \
1534                                 "ACL queue: [have:%d,max:%d]\n" \
1535                                 "SCO queue: [have:%d,max:%d]",
1536                                 (sc->sc_hook != NULL) ? NG_UBT_HOOK : "",
1537                                 sc->sc_task_flags,
1538                                 sc->sc_debug,
1539                                 sc->sc_cmdq.len,
1540                                 sc->sc_cmdq.maxlen,
1541                                 sc->sc_aclq.len,
1542                                 sc->sc_aclq.maxlen,
1543                                 sc->sc_scoq.len,
1544                                 sc->sc_scoq.maxlen);
1545                         break;
1546
1547                 default:
1548                         error = EINVAL;
1549                         break;
1550                 }
1551                 break;
1552
1553         case NGM_UBT_COOKIE:
1554                 switch (msg->header.cmd) {
1555                 case NGM_UBT_NODE_SET_DEBUG:
1556                         if (msg->header.arglen != sizeof(ng_ubt_node_debug_ep)){
1557                                 error = EMSGSIZE;
1558                                 break;
1559                         }
1560
1561                         sc->sc_debug = *((ng_ubt_node_debug_ep *) (msg->data));
1562                         break;
1563
1564                 case NGM_UBT_NODE_GET_DEBUG:
1565                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_debug_ep),
1566                             M_NOWAIT);
1567                         if (rsp == NULL) {
1568                                 error = ENOMEM;
1569                                 break;
1570                         }
1571
1572                         *((ng_ubt_node_debug_ep *) (rsp->data)) = sc->sc_debug;
1573                         break;
1574
1575                 case NGM_UBT_NODE_SET_QLEN:
1576                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1577                                 error = EMSGSIZE;
1578                                 break;
1579                         }
1580
1581                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1582                         qlen = ((ng_ubt_node_qlen_ep *) (msg->data))->qlen;
1583
1584                         switch (queue) {
1585                         case NGM_UBT_NODE_QUEUE_CMD:
1586                                 q = &sc->sc_cmdq;
1587                                 break;
1588
1589                         case NGM_UBT_NODE_QUEUE_ACL:
1590                                 q = &sc->sc_aclq;
1591                                 break;
1592
1593                         case NGM_UBT_NODE_QUEUE_SCO:
1594                                 q = &sc->sc_scoq;
1595                                 break;
1596
1597                         default:
1598                                 error = EINVAL;
1599                                 goto done;
1600                                 /* NOT REACHED */
1601                         }
1602
1603                         q->maxlen = qlen;
1604                         break;
1605
1606                 case NGM_UBT_NODE_GET_QLEN:
1607                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1608                                 error = EMSGSIZE;
1609                                 break;
1610                         }
1611
1612                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1613
1614                         switch (queue) {
1615                         case NGM_UBT_NODE_QUEUE_CMD:
1616                                 q = &sc->sc_cmdq;
1617                                 break;
1618
1619                         case NGM_UBT_NODE_QUEUE_ACL:
1620                                 q = &sc->sc_aclq;
1621                                 break;
1622
1623                         case NGM_UBT_NODE_QUEUE_SCO:
1624                                 q = &sc->sc_scoq;
1625                                 break;
1626
1627                         default:
1628                                 error = EINVAL;
1629                                 goto done;
1630                                 /* NOT REACHED */
1631                         }
1632
1633                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_qlen_ep),
1634                                 M_NOWAIT);
1635                         if (rsp == NULL) {
1636                                 error = ENOMEM;
1637                                 break;
1638                         }
1639
1640                         ((ng_ubt_node_qlen_ep *) (rsp->data))->queue = queue;
1641                         ((ng_ubt_node_qlen_ep *) (rsp->data))->qlen = q->maxlen;
1642                         break;
1643
1644                 case NGM_UBT_NODE_GET_STAT:
1645                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_stat_ep),
1646                             M_NOWAIT);
1647                         if (rsp == NULL) {
1648                                 error = ENOMEM;
1649                                 break;
1650                         }
1651
1652                         bcopy(&sc->sc_stat, rsp->data,
1653                                 sizeof(ng_ubt_node_stat_ep));
1654                         break;
1655
1656                 case NGM_UBT_NODE_RESET_STAT:
1657                         UBT_STAT_RESET(sc);
1658                         break;
1659
1660                 default:
1661                         error = EINVAL;
1662                         break;
1663                 }
1664                 break;
1665
1666         default:
1667                 error = EINVAL;
1668                 break;
1669         }
1670 done:
1671         NG_RESPOND_MSG(error, node, item, rsp);
1672         NG_FREE_MSG(msg);
1673
1674         return (error);
1675 } /* ng_ubt_rcvmsg */
1676
1677 /*
1678  * Process data.
1679  * Netgraph context.
1680  */
1681
1682 static int
1683 ng_ubt_rcvdata(hook_p hook, item_p item)
1684 {
1685         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1686         struct mbuf             *m;
1687         struct ng_bt_mbufq      *q;
1688         int                     action, error = 0;
1689
1690         if (hook != sc->sc_hook) {
1691                 error = EINVAL;
1692                 goto done;
1693         }
1694
1695         /* Deatch mbuf and get HCI frame type */
1696         NGI_GET_M(item, m);
1697
1698         /*
1699          * Minimal size of the HCI frame is 4 bytes: 1 byte frame type,
1700          * 2 bytes connection handle and at least 1 byte of length.
1701          * Panic on data frame that has size smaller than 4 bytes (it
1702          * should not happen)
1703          */
1704
1705         if (m->m_pkthdr.len < 4)
1706                 panic("HCI frame size is too small! pktlen=%d\n",
1707                         m->m_pkthdr.len);
1708
1709         /* Process HCI frame */
1710         switch (*mtod(m, uint8_t *)) {  /* XXX call m_pullup ? */
1711         case NG_HCI_CMD_PKT:
1712                 if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE)
1713                         panic("HCI command frame size is too big! " \
1714                                 "buffer size=%zd, packet len=%d\n",
1715                                 UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len);
1716
1717                 q = &sc->sc_cmdq;
1718                 action = UBT_FLAG_T_START_CTRL;
1719                 break;
1720
1721         case NG_HCI_ACL_DATA_PKT:
1722                 if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE)
1723                         panic("ACL data frame size is too big! " \
1724                                 "buffer size=%d, packet len=%d\n",
1725                                 UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len);
1726
1727                 q = &sc->sc_aclq;
1728                 action = UBT_FLAG_T_START_BULK;
1729                 break;
1730
1731         case NG_HCI_SCO_DATA_PKT:
1732                 q = &sc->sc_scoq;
1733                 action = 0;
1734                 break;
1735
1736         default:
1737                 UBT_ERR(sc, "Dropping unsupported HCI frame, type=0x%02x, " \
1738                         "pktlen=%d\n", *mtod(m, uint8_t *), m->m_pkthdr.len);
1739
1740                 NG_FREE_M(m);
1741                 error = EINVAL;
1742                 goto done;
1743                 /* NOT REACHED */
1744         }
1745
1746         UBT_NG_LOCK(sc);
1747         if (NG_BT_MBUFQ_FULL(q)) {
1748                 NG_BT_MBUFQ_DROP(q);
1749                 UBT_NG_UNLOCK(sc);
1750
1751                 UBT_ERR(sc, "Dropping HCI frame 0x%02x, len=%d. Queue full\n",
1752                         *mtod(m, uint8_t *), m->m_pkthdr.len);
1753
1754                 NG_FREE_M(m);
1755         } else {
1756                 /* Loose HCI packet type, enqueue mbuf and kick off task */
1757                 m_adj(m, sizeof(uint8_t));
1758                 NG_BT_MBUFQ_ENQUEUE(q, m);
1759                 ubt_task_schedule(sc, action);
1760                 UBT_NG_UNLOCK(sc);
1761         }
1762 done:
1763         NG_FREE_ITEM(item);
1764
1765         return (error);
1766 } /* ng_ubt_rcvdata */
1767
1768 /****************************************************************************
1769  ****************************************************************************
1770  **                              Module
1771  ****************************************************************************
1772  ****************************************************************************/
1773
1774 /*
1775  * Load/Unload the driver module
1776  */
1777
1778 static int
1779 ubt_modevent(module_t mod, int event, void *data)
1780 {
1781         int     error;
1782
1783         switch (event) {
1784         case MOD_LOAD:
1785                 error = ng_newtype(&typestruct);
1786                 if (error != 0)
1787                         printf("%s: Could not register Netgraph node type, " \
1788                                 "error=%d\n", NG_UBT_NODE_TYPE, error);
1789                 break;
1790
1791         case MOD_UNLOAD:
1792                 error = ng_rmtype(&typestruct);
1793                 break;
1794
1795         default:
1796                 error = EOPNOTSUPP;
1797                 break;
1798         }
1799
1800         return (error);
1801 } /* ubt_modevent */
1802
1803 static devclass_t       ubt_devclass;
1804
1805 static device_method_t  ubt_methods[] =
1806 {
1807         DEVMETHOD(device_probe, ubt_probe),
1808         DEVMETHOD(device_attach, ubt_attach),
1809         DEVMETHOD(device_detach, ubt_detach),
1810         DEVMETHOD_END
1811 };
1812
1813 static driver_t         ubt_driver =
1814 {
1815         .name =    "ubt",
1816         .methods = ubt_methods,
1817         .size =    sizeof(struct ubt_softc),
1818 };
1819
1820 DRIVER_MODULE(ng_ubt, uhub, ubt_driver, ubt_devclass, ubt_modevent, 0);
1821 MODULE_VERSION(ng_ubt, NG_BLUETOOTH_VERSION);
1822 MODULE_DEPEND(ng_ubt, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
1823 MODULE_DEPEND(ng_ubt, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
1824 MODULE_DEPEND(ng_ubt, usb, 1, 1, 1);
1825