sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c

   1 /*
   2  * ng_ubt.c
   3  */
   4
   5 /*-
   6  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   7  *
   8  * Copyright (c) 2001-2009 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  *
  32  * $Id: ng_ubt.c,v 1.16 2003/10/10 19:15:06 max Exp $
  33  * $FreeBSD$
  34  */
  35
  36 /*
  37  * NOTE: ng_ubt2 driver has a split personality. On one side it is
  38  * a USB device driver and on the other it is a Netgraph node. This
  39  * driver will *NOT* create traditional /dev/ enties, only Netgraph
  40  * node.
  41  *
  42  * NOTE ON LOCKS USED: ng_ubt2 drives uses 2 locks (mutexes)
  43  *
  44  * 1) sc_if_mtx - lock for device's interface #0 and #1. This lock is used
  45  *    by USB for any USB request going over device's interface #0 and #1,
  46  *    i.e. interrupt, control, bulk and isoc. transfers.
  47  *
  48  * 2) sc_ng_mtx - this lock is used to protect shared (between USB, Netgraph
  49  *    and Taskqueue) data, such as outgoing mbuf queues, task flags and hook
  50  *    pointer. This lock *SHOULD NOT* be grabbed for a long time. In fact,
  51  *    think of it as a spin lock.
  52  *
  53  * NOTE ON LOCKING STRATEGY: ng_ubt2 driver operates in 3 different contexts.
  54  *
  55  * 1) USB context. This is where all the USB related stuff happens. All
  56  *    callbacks run in this context. All callbacks are called (by USB) with
  57  *    appropriate interface lock held. It is (generally) allowed to grab
  58  *    any additional locks.
  59  *
  60  * 2) Netgraph context. This is where all the Netgraph related stuff happens.
  61  *    Since we mark node as WRITER, the Netgraph node will be "locked" (from
  62  *    Netgraph point of view). Any variable that is only modified from the
  63  *    Netgraph context does not require any additional locking. It is generally
  64  *    *NOT* allowed to grab *ANY* additional locks. Whatever you do, *DO NOT*
  65  *    grab any lock in the Netgraph context that could cause de-scheduling of
  66  *    the Netgraph thread for significant amount of time. In fact, the only
  67  *    lock that is allowed in the Netgraph context is the sc_ng_mtx lock.
  68  *    Also make sure that any code that is called from the Netgraph context
  69  *    follows the rule above.
  70  *
  71  * 3) Taskqueue context. This is where ubt_task runs. Since we are generally
  72  *    NOT allowed to grab any lock that could cause de-scheduling in the
  73  *    Netgraph context, and, USB requires us to grab interface lock before
  74  *    doing things with transfers, it is safer to transition from the Netgraph
  75  *    context to the Taskqueue context before we can call into USB subsystem.
  76  *
  77  * So, to put everything together, the rules are as follows.
  78  *      It is OK to call from the USB context or the Taskqueue context into
  79  * the Netgraph context (i.e. call NG_SEND_xxx functions). In other words
  80  * it is allowed to call into the Netgraph context with locks held.
  81  *      Is it *NOT* OK to call from the Netgraph context into the USB context,
  82  * because USB requires us to grab interface locks, and, it is safer to
  83  * avoid it. So, to make things safer we set task flags to indicate which
  84  * actions we want to perform and schedule ubt_task which would run in the
  85  * Taskqueue context.
  86  *      Is is OK to call from the Taskqueue context into the USB context,
  87  * and, ubt_task does just that (i.e. grabs appropriate interface locks
  88  * before calling into USB).
  89  *      Access to the outgoing queues, task flags and hook pointer is
  90  * controlled by the sc_ng_mtx lock. It is an unavoidable evil. Again,
  91  * sc_ng_mtx should really be a spin lock (and it is very likely to an
  92  * equivalent of spin lock due to adaptive nature of FreeBSD mutexes).
  93  *      All USB callbacks accept softc pointer as a private data. USB ensures
  94  * that this pointer is valid.
  95  */
  96
  97 #include <sys/stdint.h>
  98 #include <sys/stddef.h>
  99 #include <sys/param.h>
 100 #include <sys/queue.h>
 101 #include <sys/types.h>
 102 #include <sys/systm.h>
 103 #include <sys/kernel.h>
 104 #include <sys/bus.h>
 105 #include <sys/module.h>
 106 #include <sys/lock.h>
 107 #include <sys/mutex.h>
 108 #include <sys/condvar.h>
 109 #include <sys/sysctl.h>
 110 #include <sys/sx.h>
 111 #include <sys/unistd.h>
 112 #include <sys/callout.h>
 113 #include <sys/malloc.h>
 114 #include <sys/priv.h>
 115
 116 #include "usbdevs.h"
 117 #include <dev/usb/usb.h>
 118 #include <dev/usb/usbdi.h>
 119 #include <dev/usb/usbdi_util.h>
 120
 121 #define USB_DEBUG_VAR usb_debug
 122 #include <dev/usb/usb_debug.h>
 123 #include <dev/usb/usb_busdma.h>
 124
 125 #include <sys/mbuf.h>
 126 #include <sys/taskqueue.h>
 127
 128 #include <netgraph/ng_message.h>
 129 #include <netgraph/netgraph.h>
 130 #include <netgraph/ng_parse.h>
 131 #include <netgraph/bluetooth/include/ng_bluetooth.h>
 132 #include <netgraph/bluetooth/include/ng_hci.h>
 133 #include <netgraph/bluetooth/include/ng_ubt.h>
 134 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h>
 135
 136 static int              ubt_modevent(module_t, int, void *);
 137 static device_probe_t   ubt_probe;
 138 static device_attach_t  ubt_attach;
 139 static device_detach_t  ubt_detach;
 140
 141 static void             ubt_task_schedule(ubt_softc_p, int);
 142 static task_fn_t        ubt_task;
 143
 144 #define ubt_xfer_start(sc, i)   usbd_transfer_start((sc)->sc_xfer[(i)])
 145
 146 /* Netgraph methods */
 147 static ng_constructor_t ng_ubt_constructor;
 148 static ng_shutdown_t    ng_ubt_shutdown;
 149 static ng_newhook_t     ng_ubt_newhook;
 150 static ng_connect_t     ng_ubt_connect;
 151 static ng_disconnect_t  ng_ubt_disconnect;
 152 static ng_rcvmsg_t      ng_ubt_rcvmsg;
 153 static ng_rcvdata_t     ng_ubt_rcvdata;
 154
 155 /* Queue length */
 156 static const struct ng_parse_struct_field       ng_ubt_node_qlen_type_fields[] =
 157 {
 158         { "queue", &ng_parse_int32_type, },
 159         { "qlen",  &ng_parse_int32_type, },
 160         { NULL, }
 161 };
 162 static const struct ng_parse_type               ng_ubt_node_qlen_type =
 163 {
 164         &ng_parse_struct_type,
 165         &ng_ubt_node_qlen_type_fields
 166 };
 167
 168 /* Stat info */
 169 static const struct ng_parse_struct_field       ng_ubt_node_stat_type_fields[] =
 170 {
 171         { "pckts_recv", &ng_parse_uint32_type, },
 172         { "bytes_recv", &ng_parse_uint32_type, },
 173         { "pckts_sent", &ng_parse_uint32_type, },
 174         { "bytes_sent", &ng_parse_uint32_type, },
 175         { "oerrors",    &ng_parse_uint32_type, },
 176         { "ierrors",    &ng_parse_uint32_type, },
 177         { NULL, }
 178 };
 179 static const struct ng_parse_type               ng_ubt_node_stat_type =
 180 {
 181         &ng_parse_struct_type,
 182         &ng_ubt_node_stat_type_fields
 183 };
 184
 185 /* Netgraph node command list */
 186 static const struct ng_cmdlist                  ng_ubt_cmdlist[] =
 187 {
 188         {
 189                 NGM_UBT_COOKIE,
 190                 NGM_UBT_NODE_SET_DEBUG,
 191                 "set_debug",
 192                 &ng_parse_uint16_type,
 193                 NULL
 194         },
 195         {
 196                 NGM_UBT_COOKIE,
 197                 NGM_UBT_NODE_GET_DEBUG,
 198                 "get_debug",
 199                 NULL,
 200                 &ng_parse_uint16_type
 201         },
 202         {
 203                 NGM_UBT_COOKIE,
 204                 NGM_UBT_NODE_SET_QLEN,
 205                 "set_qlen",
 206                 &ng_ubt_node_qlen_type,
 207                 NULL
 208         },
 209         {
 210                 NGM_UBT_COOKIE,
 211                 NGM_UBT_NODE_GET_QLEN,
 212                 "get_qlen",
 213                 &ng_ubt_node_qlen_type,
 214                 &ng_ubt_node_qlen_type
 215         },
 216         {
 217                 NGM_UBT_COOKIE,
 218                 NGM_UBT_NODE_GET_STAT,
 219                 "get_stat",
 220                 NULL,
 221                 &ng_ubt_node_stat_type
 222         },
 223         {
 224                 NGM_UBT_COOKIE,
 225                 NGM_UBT_NODE_RESET_STAT,
 226                 "reset_stat",
 227                 NULL,
 228                 NULL
 229         },
 230         { 0, }
 231 };
 232
 233 /* Netgraph node type */
 234 static struct ng_type   typestruct =
 235 {
 236         .version =      NG_ABI_VERSION,
 237         .name =         NG_UBT_NODE_TYPE,
 238         .constructor =  ng_ubt_constructor,
 239         .rcvmsg =       ng_ubt_rcvmsg,
 240         .shutdown =     ng_ubt_shutdown,
 241         .newhook =      ng_ubt_newhook,
 242         .connect =      ng_ubt_connect,
 243         .rcvdata =      ng_ubt_rcvdata,
 244         .disconnect =   ng_ubt_disconnect,
 245         .cmdlist =      ng_ubt_cmdlist
 246 };
 247
 248 /****************************************************************************
 249  ****************************************************************************
 250  **                              USB specific
 251  ****************************************************************************
 252  ****************************************************************************/
 253
 254 /* USB methods */
 255 static usb_callback_t   ubt_probe_intr_callback;
 256 static usb_callback_t   ubt_ctrl_write_callback;
 257 static usb_callback_t   ubt_intr_read_callback;
 258 static usb_callback_t   ubt_bulk_read_callback;
 259 static usb_callback_t   ubt_bulk_write_callback;
 260 static usb_callback_t   ubt_isoc_read_callback;
 261 static usb_callback_t   ubt_isoc_write_callback;
 262
 263 static int              ubt_fwd_mbuf_up(ubt_softc_p, struct mbuf **);
 264 static int              ubt_isoc_read_one_frame(struct usb_xfer *, int);
 265
 266 /*
 267  * USB config
 268  *
 269  * The following desribes usb transfers that could be submitted on USB device.
 270  *
 271  * Interface 0 on the USB device must present the following endpoints
 272  *      1) Interrupt endpoint to receive HCI events
 273  *      2) Bulk IN endpoint to receive ACL data
 274  *      3) Bulk OUT endpoint to send ACL data
 275  *
 276  * Interface 1 on the USB device must present the following endpoints
 277  *      1) Isochronous IN endpoint to receive SCO data
 278  *      2) Isochronous OUT endpoint to send SCO data
 279  */
 280
 281 static const struct usb_config          ubt_config[UBT_N_TRANSFER] =
 282 {
 283         /*
 284          * Interface #0
 285          */
 286
 287         /* Outgoing bulk transfer - ACL packets */
 288         [UBT_IF_0_BULK_DT_WR] = {
 289                 .type =         UE_BULK,
 290                 .endpoint =     UE_ADDR_ANY,
 291                 .direction =    UE_DIR_OUT,
 292                 .if_index =     0,
 293                 .bufsize =      UBT_BULK_WRITE_BUFFER_SIZE,
 294                 .flags =        { .pipe_bof = 1, .force_short_xfer = 1, },
 295                 .callback =     &ubt_bulk_write_callback,
 296         },
 297         /* Incoming bulk transfer - ACL packets */
 298         [UBT_IF_0_BULK_DT_RD] = {
 299                 .type =         UE_BULK,
 300                 .endpoint =     UE_ADDR_ANY,
 301                 .direction =    UE_DIR_IN,
 302                 .if_index =     0,
 303                 .bufsize =      UBT_BULK_READ_BUFFER_SIZE,
 304                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
 305                 .callback =     &ubt_bulk_read_callback,
 306         },
 307         /* Incoming interrupt transfer - HCI events */
 308         [UBT_IF_0_INTR_DT_RD] = {
 309                 .type =         UE_INTERRUPT,
 310                 .endpoint =     UE_ADDR_ANY,
 311                 .direction =    UE_DIR_IN,
 312                 .if_index =     0,
 313                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
 314                 .bufsize =      UBT_INTR_BUFFER_SIZE,
 315                 .callback =     &ubt_intr_read_callback,
 316         },
 317         /* Outgoing control transfer - HCI commands */
 318         [UBT_IF_0_CTRL_DT_WR] = {
 319                 .type =         UE_CONTROL,
 320                 .endpoint =     0x00,   /* control pipe */
 321                 .direction =    UE_DIR_ANY,
 322                 .if_index =     0,
 323                 .bufsize =      UBT_CTRL_BUFFER_SIZE,
 324                 .callback =     &ubt_ctrl_write_callback,
 325                 .timeout =      5000,   /* 5 seconds */
 326         },
 327
 328         /*
 329          * Interface #1
 330          */
 331
 332         /* Incoming isochronous transfer #1 - SCO packets */
 333         [UBT_IF_1_ISOC_DT_RD1] = {
 334                 .type =         UE_ISOCHRONOUS,
 335                 .endpoint =     UE_ADDR_ANY,
 336                 .direction =    UE_DIR_IN,
 337                 .if_index =     1,
 338                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 339                 .frames =       UBT_ISOC_NFRAMES,
 340                 .flags =        { .short_xfer_ok = 1, },
 341                 .callback =     &ubt_isoc_read_callback,
 342         },
 343         /* Incoming isochronous transfer #2 - SCO packets */
 344         [UBT_IF_1_ISOC_DT_RD2] = {
 345                 .type =         UE_ISOCHRONOUS,
 346                 .endpoint =     UE_ADDR_ANY,
 347                 .direction =    UE_DIR_IN,
 348                 .if_index =     1,
 349                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 350                 .frames =       UBT_ISOC_NFRAMES,
 351                 .flags =        { .short_xfer_ok = 1, },
 352                 .callback =     &ubt_isoc_read_callback,
 353         },
 354         /* Outgoing isochronous transfer #1 - SCO packets */
 355         [UBT_IF_1_ISOC_DT_WR1] = {
 356                 .type =         UE_ISOCHRONOUS,
 357                 .endpoint =     UE_ADDR_ANY,
 358                 .direction =    UE_DIR_OUT,
 359                 .if_index =     1,
 360                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 361                 .frames =       UBT_ISOC_NFRAMES,
 362                 .flags =        { .short_xfer_ok = 1, },
 363                 .callback =     &ubt_isoc_write_callback,
 364         },
 365         /* Outgoing isochronous transfer #2 - SCO packets */
 366         [UBT_IF_1_ISOC_DT_WR2] = {
 367                 .type =         UE_ISOCHRONOUS,
 368                 .endpoint =     UE_ADDR_ANY,
 369                 .direction =    UE_DIR_OUT,
 370                 .if_index =     1,
 371                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 372                 .frames =       UBT_ISOC_NFRAMES,
 373                 .flags =        { .short_xfer_ok = 1, },
 374                 .callback =     &ubt_isoc_write_callback,
 375         },
 376 };
 377
 378 /*
 379  * If for some reason device should not be attached then put
 380  * VendorID/ProductID pair into the list below. The format is
 381  * as follows:
 382  *
 383  *      { USB_VPI(VENDOR_ID, PRODUCT_ID, 0) },
 384  *
 385  * where VENDOR_ID and PRODUCT_ID are hex numbers.
 386  */
 387
 388 static const STRUCT_USB_HOST_ID ubt_ignore_devs[] =
 389 {
 390         /* AVM USB Bluetooth-Adapter BlueFritz! v1.0 */
 391         { USB_VPI(USB_VENDOR_AVM, 0x2200, 0) },
 392
 393         /* Atheros 3011 with sflash firmware */
 394         { USB_VPI(0x0cf3, 0x3002, 0) },
 395         { USB_VPI(0x0cf3, 0xe019, 0) },
 396         { USB_VPI(0x13d3, 0x3304, 0) },
 397         { USB_VPI(0x0930, 0x0215, 0) },
 398         { USB_VPI(0x0489, 0xe03d, 0) },
 399         { USB_VPI(0x0489, 0xe027, 0) },
 400
 401         /* Atheros AR9285 Malbec with sflash firmware */
 402         { USB_VPI(0x03f0, 0x311d, 0) },
 403
 404         /* Atheros 3012 with sflash firmware */
 405         { USB_VPI(0x0cf3, 0x3004, 0), USB_DEV_BCD_LTEQ(1) },
 406         { USB_VPI(0x0cf3, 0x311d, 0), USB_DEV_BCD_LTEQ(1) },
 407         { USB_VPI(0x13d3, 0x3375, 0), USB_DEV_BCD_LTEQ(1) },
 408         { USB_VPI(0x04ca, 0x3005, 0), USB_DEV_BCD_LTEQ(1) },
 409         { USB_VPI(0x04ca, 0x3006, 0), USB_DEV_BCD_LTEQ(1) },
 410         { USB_VPI(0x04ca, 0x3008, 0), USB_DEV_BCD_LTEQ(1) },
 411         { USB_VPI(0x13d3, 0x3362, 0), USB_DEV_BCD_LTEQ(1) },
 412         { USB_VPI(0x0cf3, 0xe004, 0), USB_DEV_BCD_LTEQ(1) },
 413         { USB_VPI(0x0930, 0x0219, 0), USB_DEV_BCD_LTEQ(1) },
 414         { USB_VPI(0x0489, 0xe057, 0), USB_DEV_BCD_LTEQ(1) },
 415         { USB_VPI(0x13d3, 0x3393, 0), USB_DEV_BCD_LTEQ(1) },
 416         { USB_VPI(0x0489, 0xe04e, 0), USB_DEV_BCD_LTEQ(1) },
 417         { USB_VPI(0x0489, 0xe056, 0), USB_DEV_BCD_LTEQ(1) },
 418
 419         /* Atheros AR5BBU12 with sflash firmware */
 420         { USB_VPI(0x0489, 0xe02c, 0), USB_DEV_BCD_LTEQ(1) },
 421
 422         /* Atheros AR5BBU12 with sflash firmware */
 423         { USB_VPI(0x0489, 0xe03c, 0), USB_DEV_BCD_LTEQ(1) },
 424         { USB_VPI(0x0489, 0xe036, 0), USB_DEV_BCD_LTEQ(1) },
 425
 426         /* Intel Wireless 8260 and successors are handled in ng_ubt_intel.c */
 427         { USB_VPI(USB_VENDOR_INTEL2, 0x0a2b, 0) },
 428         { USB_VPI(USB_VENDOR_INTEL2, 0x0aaa, 0) },
 429         { USB_VPI(USB_VENDOR_INTEL2, 0x0025, 0) },
 430         { USB_VPI(USB_VENDOR_INTEL2, 0x0026, 0) },
 431         { USB_VPI(USB_VENDOR_INTEL2, 0x0029, 0) },
 432 };
 433
 434 /* List of supported bluetooth devices */
 435 static const STRUCT_USB_HOST_ID ubt_devs[] =
 436 {
 437         /* Generic Bluetooth class devices */
 438         { USB_IFACE_CLASS(UDCLASS_WIRELESS),
 439           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 440           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 441
 442         /* AVM USB Bluetooth-Adapter BlueFritz! v2.0 */
 443         { USB_VPI(USB_VENDOR_AVM, 0x3800, 0) },
 444
 445         /* Broadcom USB dongles, mostly BCM20702 and BCM20702A0 */
 446         { USB_VENDOR(USB_VENDOR_BROADCOM),
 447           USB_IFACE_CLASS(UICLASS_VENDOR),
 448           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 449           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 450
 451         /* Apple-specific (Broadcom) devices */
 452         { USB_VENDOR(USB_VENDOR_APPLE),
 453           USB_IFACE_CLASS(UICLASS_VENDOR),
 454           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 455           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 456
 457         /* Foxconn - Hon Hai */
 458         { USB_VENDOR(USB_VENDOR_FOXCONN),
 459           USB_IFACE_CLASS(UICLASS_VENDOR),
 460           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 461           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 462
 463         /* MediaTek MT76x0E */
 464         { USB_VPI(USB_VENDOR_MEDIATEK, 0x763f, 0) },
 465
 466         /* Broadcom SoftSailing reporting vendor specific */
 467         { USB_VPI(USB_VENDOR_BROADCOM, 0x21e1, 0) },
 468
 469         /* Apple MacBookPro 7,1 */
 470         { USB_VPI(USB_VENDOR_APPLE, 0x8213, 0) },
 471
 472         /* Apple iMac11,1 */
 473         { USB_VPI(USB_VENDOR_APPLE, 0x8215, 0) },
 474
 475         /* Apple MacBookPro6,2 */
 476         { USB_VPI(USB_VENDOR_APPLE, 0x8218, 0) },
 477
 478         /* Apple MacBookAir3,1, MacBookAir3,2 */
 479         { USB_VPI(USB_VENDOR_APPLE, 0x821b, 0) },
 480
 481         /* Apple MacBookAir4,1 */
 482         { USB_VPI(USB_VENDOR_APPLE, 0x821f, 0) },
 483
 484         /* MacBookAir6,1 */
 485         { USB_VPI(USB_VENDOR_APPLE, 0x828f, 0) },
 486
 487         /* Apple MacBookPro8,2 */
 488         { USB_VPI(USB_VENDOR_APPLE, 0x821a, 0) },
 489
 490         /* Apple MacMini5,1 */
 491         { USB_VPI(USB_VENDOR_APPLE, 0x8281, 0) },
 492
 493         /* Bluetooth Ultraport Module from IBM */
 494         { USB_VPI(USB_VENDOR_TDK, 0x030a, 0) },
 495
 496         /* ALPS Modules with non-standard ID */
 497         { USB_VPI(USB_VENDOR_ALPS, 0x3001, 0) },
 498         { USB_VPI(USB_VENDOR_ALPS, 0x3002, 0) },
 499
 500         { USB_VPI(USB_VENDOR_ERICSSON2, 0x1002, 0) },
 501
 502         /* Canyon CN-BTU1 with HID interfaces */
 503         { USB_VPI(USB_VENDOR_CANYON, 0x0000, 0) },
 504
 505         /* Broadcom BCM20702A0 */
 506         { USB_VPI(USB_VENDOR_ASUS, 0x17b5, 0) },
 507         { USB_VPI(USB_VENDOR_ASUS, 0x17cb, 0) },
 508         { USB_VPI(USB_VENDOR_LITEON, 0x2003, 0) },
 509         { USB_VPI(USB_VENDOR_FOXCONN, 0xe042, 0) },
 510         { USB_VPI(USB_VENDOR_DELL, 0x8197, 0) },
 511 };
 512
 513 /*
 514  * Does a synchronous (waits for completion event) execution of HCI command.
 515  * Size of both command and response buffers are passed in length field of
 516  * corresponding structures in "Parameter Total Length" format i.e.
 517  * not including HCI packet headers.
 518  *
 519  * Must not be used after USB transfers have been configured in attach routine.
 520  */
 521
 522 usb_error_t
 523 ubt_do_hci_request(struct usb_device *udev, struct ubt_hci_cmd *cmd,
 524     void *evt, usb_timeout_t timeout)
 525 {
 526         static const struct usb_config ubt_probe_config = {
 527                 .type = UE_INTERRUPT,
 528                 .endpoint = UE_ADDR_ANY,
 529                 .direction = UE_DIR_IN,
 530                 .flags = { .pipe_bof = 1, .short_xfer_ok = 1 },
 531                 .bufsize = UBT_INTR_BUFFER_SIZE,
 532                 .callback = &ubt_probe_intr_callback,
 533         };
 534         struct usb_device_request req;
 535         struct usb_xfer *xfer[1];
 536         struct mtx mtx;
 537         usb_error_t error = USB_ERR_NORMAL_COMPLETION;
 538         uint8_t iface_index = 0;
 539
 540         /* Initialize a USB control request and then do it */
 541         bzero(&req, sizeof(req));
 542         req.bmRequestType = UBT_HCI_REQUEST;
 543         req.wIndex[0] = iface_index;
 544         USETW(req.wLength, UBT_HCI_CMD_SIZE(cmd));
 545
 546         error = usbd_do_request(udev, NULL, &req, cmd);
 547         if (error != USB_ERR_NORMAL_COMPLETION) {
 548                 printf("ng_ubt: usbd_do_request error=%s\n",
 549                         usbd_errstr(error));
 550                 return (error);
 551         }
 552
 553         if (evt == NULL)
 554                 return (USB_ERR_NORMAL_COMPLETION);
 555
 556         /* Initialize INTR endpoint xfer and wait for response */
 557         mtx_init(&mtx, "ubt pb", NULL, MTX_DEF);
 558
 559         error = usbd_transfer_setup(udev, &iface_index, xfer,
 560             &ubt_probe_config, 1, evt, &mtx);
 561         if (error == USB_ERR_NORMAL_COMPLETION) {
 562
 563                 mtx_lock(&mtx);
 564                 usbd_transfer_start(*xfer);
 565
 566                 if (msleep_sbt(evt, &mtx, 0, "ubt pb", SBT_1MS * timeout,
 567                                 0, C_HARDCLOCK) == EWOULDBLOCK) {
 568                         printf("ng_ubt: HCI command 0x%04x timed out\n",
 569                                 le16toh(cmd->opcode));
 570                         error = USB_ERR_TIMEOUT;
 571                 }
 572
 573                 usbd_transfer_stop(*xfer);
 574                 mtx_unlock(&mtx);
 575
 576                 usbd_transfer_unsetup(xfer, 1);
 577         } else
 578                 printf("ng_ubt: usbd_transfer_setup error=%s\n",
 579                         usbd_errstr(error));
 580
 581         mtx_destroy(&mtx);
 582
 583         return (error);
 584 }
 585
 586 /*
 587  * Probe for a USB Bluetooth device.
 588  * USB context.
 589  */
 590
 591 static int
 592 ubt_probe(device_t dev)
 593 {
 594         struct usb_attach_arg   *uaa = device_get_ivars(dev);
 595         int error;
 596
 597         if (uaa->usb_mode != USB_MODE_HOST)
 598                 return (ENXIO);
 599
 600         if (uaa->info.bIfaceIndex != 0)
 601                 return (ENXIO);
 602
 603         if (usbd_lookup_id_by_uaa(ubt_ignore_devs,
 604                         sizeof(ubt_ignore_devs), uaa) == 0)
 605                 return (ENXIO);
 606
 607         error = usbd_lookup_id_by_uaa(ubt_devs, sizeof(ubt_devs), uaa);
 608         if (error == 0)
 609                 return (BUS_PROBE_GENERIC);
 610         return (error);
 611 } /* ubt_probe */
 612
 613 /*
 614  * Attach the device.
 615  * USB context.
 616  */
 617
 618 static int
 619 ubt_attach(device_t dev)
 620 {
 621         struct usb_attach_arg           *uaa = device_get_ivars(dev);
 622         struct ubt_softc                *sc = device_get_softc(dev);
 623         struct usb_endpoint_descriptor  *ed;
 624         struct usb_interface_descriptor *id;
 625         struct usb_interface            *iface;
 626         uint16_t                        wMaxPacketSize;
 627         uint8_t                         alt_index, i, j;
 628         uint8_t                         iface_index[2] = { 0, 1 };
 629
 630         device_set_usb_desc(dev);
 631
 632         sc->sc_dev = dev;
 633         sc->sc_debug = NG_UBT_WARN_LEVEL;
 634
 635         /*
 636          * Create Netgraph node
 637          */
 638
 639         if (ng_make_node_common(&typestruct, &sc->sc_node) != 0) {
 640                 UBT_ALERT(sc, "could not create Netgraph node\n");
 641                 return (ENXIO);
 642         }
 643
 644         /* Name Netgraph node */
 645         if (ng_name_node(sc->sc_node, device_get_nameunit(dev)) != 0) {
 646                 UBT_ALERT(sc, "could not name Netgraph node\n");
 647                 NG_NODE_UNREF(sc->sc_node);
 648                 return (ENXIO);
 649         }
 650         NG_NODE_SET_PRIVATE(sc->sc_node, sc);
 651         NG_NODE_FORCE_WRITER(sc->sc_node);
 652
 653         /*
 654          * Initialize device softc structure
 655          */
 656
 657         /* initialize locks */
 658         mtx_init(&sc->sc_ng_mtx, "ubt ng", NULL, MTX_DEF);
 659         mtx_init(&sc->sc_if_mtx, "ubt if", NULL, MTX_DEF | MTX_RECURSE);
 660
 661         /* initialize packet queues */
 662         NG_BT_MBUFQ_INIT(&sc->sc_cmdq, UBT_DEFAULT_QLEN);
 663         NG_BT_MBUFQ_INIT(&sc->sc_aclq, UBT_DEFAULT_QLEN);
 664         NG_BT_MBUFQ_INIT(&sc->sc_scoq, UBT_DEFAULT_QLEN);
 665
 666         /* initialize glue task */
 667         TASK_INIT(&sc->sc_task, 0, ubt_task, sc);
 668
 669         /*
 670          * Configure Bluetooth USB device. Discover all required USB
 671          * interfaces and endpoints.
 672          *
 673          * USB device must present two interfaces:
 674          * 1) Interface 0 that has 3 endpoints
 675          *      1) Interrupt endpoint to receive HCI events
 676          *      2) Bulk IN endpoint to receive ACL data
 677          *      3) Bulk OUT endpoint to send ACL data
 678          *
 679          * 2) Interface 1 then has 2 endpoints
 680          *      1) Isochronous IN endpoint to receive SCO data
 681          *      2) Isochronous OUT endpoint to send SCO data
 682          *
 683          * Interface 1 (with isochronous endpoints) has several alternate
 684          * configurations with different packet size.
 685          */
 686
 687         /*
 688          * For interface #1 search alternate settings, and find
 689          * the descriptor with the largest wMaxPacketSize
 690          */
 691
 692         wMaxPacketSize = 0;
 693         alt_index = 0;
 694         i = 0;
 695         j = 0;
 696         ed = NULL;
 697
 698         /*
 699          * Search through all the descriptors looking for the largest
 700          * packet size:
 701          */
 702         while ((ed = (struct usb_endpoint_descriptor *)usb_desc_foreach(
 703             usbd_get_config_descriptor(uaa->device),
 704             (struct usb_descriptor *)ed))) {
 705
 706                 if ((ed->bDescriptorType == UDESC_INTERFACE) &&
 707                     (ed->bLength >= sizeof(*id))) {
 708                         id = (struct usb_interface_descriptor *)ed;
 709                         i = id->bInterfaceNumber;
 710                         j = id->bAlternateSetting;
 711                 }
 712
 713                 if ((ed->bDescriptorType == UDESC_ENDPOINT) &&
 714                     (ed->bLength >= sizeof(*ed)) &&
 715                     (i == 1)) {
 716                         uint16_t temp;
 717
 718                         temp = UGETW(ed->wMaxPacketSize);
 719                         if (temp > wMaxPacketSize) {
 720                                 wMaxPacketSize = temp;
 721                                 alt_index = j;
 722                         }
 723                 }
 724         }
 725
 726         /* Set alt configuration on interface #1 only if we found it */
 727         if (wMaxPacketSize > 0 &&
 728             usbd_set_alt_interface_index(uaa->device, 1, alt_index)) {
 729                 UBT_ALERT(sc, "could not set alternate setting %d " \
 730                         "for interface 1!\n", alt_index);
 731                 goto detach;
 732         }
 733
 734         /* Setup transfers for both interfaces */
 735         if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer,
 736                         ubt_config, UBT_N_TRANSFER, sc, &sc->sc_if_mtx)) {
 737                 UBT_ALERT(sc, "could not allocate transfers\n");
 738                 goto detach;
 739         }
 740
 741         /* Claim all interfaces belonging to the Bluetooth part */
 742         for (i = 1;; i++) {
 743                 iface = usbd_get_iface(uaa->device, i);
 744                 if (iface == NULL)
 745                         break;
 746                 id = usbd_get_interface_descriptor(iface);
 747
 748                 if ((id != NULL) &&
 749                     (id->bInterfaceClass == UICLASS_WIRELESS) &&
 750                     (id->bInterfaceSubClass == UISUBCLASS_RF) &&
 751                     (id->bInterfaceProtocol == UIPROTO_BLUETOOTH)) {
 752                         usbd_set_parent_iface(uaa->device, i,
 753                             uaa->info.bIfaceIndex);
 754                 }
 755         }
 756         return (0); /* success */
 757
 758 detach:
 759         ubt_detach(dev);
 760
 761         return (ENXIO);
 762 } /* ubt_attach */
 763
 764 /*
 765  * Detach the device.
 766  * USB context.
 767  */
 768
 769 int
 770 ubt_detach(device_t dev)
 771 {
 772         struct ubt_softc        *sc = device_get_softc(dev);
 773         node_p                  node = sc->sc_node;
 774
 775         /* Destroy Netgraph node */
 776         if (node != NULL) {
 777                 sc->sc_node = NULL;
 778                 NG_NODE_REALLY_DIE(node);
 779                 ng_rmnode_self(node);
 780         }
 781
 782         /* Make sure ubt_task in gone */
 783         taskqueue_drain(taskqueue_swi, &sc->sc_task);
 784
 785         /* Free USB transfers, if any */
 786         usbd_transfer_unsetup(sc->sc_xfer, UBT_N_TRANSFER);
 787
 788         /* Destroy queues */
 789         UBT_NG_LOCK(sc);
 790         NG_BT_MBUFQ_DESTROY(&sc->sc_cmdq);
 791         NG_BT_MBUFQ_DESTROY(&sc->sc_aclq);
 792         NG_BT_MBUFQ_DESTROY(&sc->sc_scoq);
 793         UBT_NG_UNLOCK(sc);
 794
 795         mtx_destroy(&sc->sc_if_mtx);
 796         mtx_destroy(&sc->sc_ng_mtx);
 797
 798         return (0);
 799 } /* ubt_detach */
 800
 801 /*
 802  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
 803  * HCI event was received from the device during device probe stage.
 804  * USB context.
 805  */
 806
 807 static void
 808 ubt_probe_intr_callback(struct usb_xfer *xfer, usb_error_t error)
 809 {
 810         struct ubt_hci_event    *evt = usbd_xfer_softc(xfer);
 811         struct usb_page_cache   *pc;
 812         int                     actlen;
 813
 814         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 815
 816         switch (USB_GET_STATE(xfer)) {
 817         case USB_ST_TRANSFERRED:
 818                 if (actlen > UBT_HCI_EVENT_SIZE(evt))
 819                         actlen = UBT_HCI_EVENT_SIZE(evt);
 820                 pc = usbd_xfer_get_frame(xfer, 0);
 821                 usbd_copy_out(pc, 0, evt, actlen);
 822                 /* OneShot mode */
 823                 wakeup(evt);
 824                 break;
 825
 826         case USB_ST_SETUP:
 827 submit_next:
 828                 /* Try clear stall first */
 829                 usbd_xfer_set_stall(xfer);
 830                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
 831                 usbd_transfer_submit(xfer);
 832                 break;
 833
 834         default:
 835                 if (error != USB_ERR_CANCELLED) {
 836                         printf("ng_ubt: interrupt transfer failed: %s\n",
 837                                 usbd_errstr(error));
 838                         goto submit_next;
 839                 }
 840                 break;
 841         }
 842 } /* ubt_probe_intr_callback */
 843
 844 /*
 845  * Called when outgoing control request (HCI command) has completed, i.e.
 846  * HCI command was sent to the device.
 847  * USB context.
 848  */
 849
 850 static void
 851 ubt_ctrl_write_callback(struct usb_xfer *xfer, usb_error_t error)
 852 {
 853         struct ubt_softc                *sc = usbd_xfer_softc(xfer);
 854         struct usb_device_request       req;
 855         struct mbuf                     *m;
 856         struct usb_page_cache           *pc;
 857         int                             actlen;
 858
 859         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 860
 861         switch (USB_GET_STATE(xfer)) {
 862         case USB_ST_TRANSFERRED:
 863                 UBT_INFO(sc, "sent %d bytes to control pipe\n", actlen);
 864                 UBT_STAT_BYTES_SENT(sc, actlen);
 865                 UBT_STAT_PCKTS_SENT(sc);
 866                 /* FALLTHROUGH */
 867
 868         case USB_ST_SETUP:
 869 send_next:
 870                 /* Get next command mbuf, if any */
 871                 UBT_NG_LOCK(sc);
 872                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_cmdq, m);
 873                 UBT_NG_UNLOCK(sc);
 874
 875                 if (m == NULL) {
 876                         UBT_INFO(sc, "HCI command queue is empty\n");
 877                         break;  /* transfer complete */
 878                 }
 879
 880                 /* Initialize a USB control request and then schedule it */
 881                 bzero(&req, sizeof(req));
 882                 req.bmRequestType = UBT_HCI_REQUEST;
 883                 USETW(req.wLength, m->m_pkthdr.len);
 884
 885                 UBT_INFO(sc, "Sending control request, " \
 886                         "bmRequestType=0x%02x, wLength=%d\n",
 887                         req.bmRequestType, UGETW(req.wLength));
 888
 889                 pc = usbd_xfer_get_frame(xfer, 0);
 890                 usbd_copy_in(pc, 0, &req, sizeof(req));
 891                 pc = usbd_xfer_get_frame(xfer, 1);
 892                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
 893
 894                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
 895                 usbd_xfer_set_frame_len(xfer, 1, m->m_pkthdr.len);
 896                 usbd_xfer_set_frames(xfer, 2);
 897
 898                 NG_FREE_M(m);
 899
 900                 usbd_transfer_submit(xfer);
 901                 break;
 902
 903         default: /* Error */
 904                 if (error != USB_ERR_CANCELLED) {
 905                         UBT_WARN(sc, "control transfer failed: %s\n",
 906                                 usbd_errstr(error));
 907
 908                         UBT_STAT_OERROR(sc);
 909                         goto send_next;
 910                 }
 911
 912                 /* transfer cancelled */
 913                 break;
 914         }
 915 } /* ubt_ctrl_write_callback */
 916
 917 /*
 918  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
 919  * HCI event was received from the device.
 920  * USB context.
 921  */
 922
 923 static void
 924 ubt_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
 925 {
 926         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 927         struct mbuf             *m;
 928         ng_hci_event_pkt_t      *hdr;
 929         struct usb_page_cache   *pc;
 930         int                     actlen;
 931
 932         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 933
 934         m = NULL;
 935
 936         switch (USB_GET_STATE(xfer)) {
 937         case USB_ST_TRANSFERRED:
 938                 /* Allocate a new mbuf */
 939                 MGETHDR(m, M_NOWAIT, MT_DATA);
 940                 if (m == NULL) {
 941                         UBT_STAT_IERROR(sc);
 942                         goto submit_next;
 943                 }
 944
 945                 if (!(MCLGET(m, M_NOWAIT))) {
 946                         UBT_STAT_IERROR(sc);
 947                         goto submit_next;
 948                 }
 949
 950                 /* Add HCI packet type */
 951                 *mtod(m, uint8_t *)= NG_HCI_EVENT_PKT;
 952                 m->m_pkthdr.len = m->m_len = 1;
 953
 954                 if (actlen > MCLBYTES - 1)
 955                         actlen = MCLBYTES - 1;
 956
 957                 pc = usbd_xfer_get_frame(xfer, 0);
 958                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
 959                 m->m_pkthdr.len += actlen;
 960                 m->m_len += actlen;
 961
 962                 UBT_INFO(sc, "got %d bytes from interrupt pipe\n",
 963                         actlen);
 964
 965                 /* Validate packet and send it up the stack */
 966                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
 967                         UBT_INFO(sc, "HCI event packet is too short\n");
 968
 969                         UBT_STAT_IERROR(sc);
 970                         goto submit_next;
 971                 }
 972
 973                 hdr = mtod(m, ng_hci_event_pkt_t *);
 974                 if (hdr->length != (m->m_pkthdr.len - sizeof(*hdr))) {
 975                         UBT_ERR(sc, "Invalid HCI event packet size, " \
 976                                 "length=%d, pktlen=%d\n",
 977                                 hdr->length, m->m_pkthdr.len);
 978
 979                         UBT_STAT_IERROR(sc);
 980                         goto submit_next;
 981                 }
 982
 983                 UBT_INFO(sc, "got complete HCI event frame, pktlen=%d, " \
 984                         "length=%d\n", m->m_pkthdr.len, hdr->length);
 985
 986                 UBT_STAT_PCKTS_RECV(sc);
 987                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
 988
 989                 ubt_fwd_mbuf_up(sc, &m);
 990                 /* m == NULL at this point */
 991                 /* FALLTHROUGH */
 992
 993         case USB_ST_SETUP:
 994 submit_next:
 995                 NG_FREE_M(m); /* checks for m != NULL */
 996
 997                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
 998                 usbd_transfer_submit(xfer);
 999                 break;
1000
1001         default: /* Error */
1002                 if (error != USB_ERR_CANCELLED) {
1003                         UBT_WARN(sc, "interrupt transfer failed: %s\n",
1004                                 usbd_errstr(error));
1005
1006                         /* Try to clear stall first */
1007                         usbd_xfer_set_stall(xfer);
1008                         goto submit_next;
1009                 }
1010                         /* transfer cancelled */
1011                 break;
1012         }
1013 } /* ubt_intr_read_callback */
1014
1015 /*
1016  * Called when incoming bulk transfer (ACL packet) has completed, i.e.
1017  * ACL packet was received from the device.
1018  * USB context.
1019  */
1020
1021 static void
1022 ubt_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1023 {
1024         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1025         struct mbuf             *m;
1026         ng_hci_acldata_pkt_t    *hdr;
1027         struct usb_page_cache   *pc;
1028         int len;
1029         int actlen;
1030
1031         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1032
1033         m = NULL;
1034
1035         switch (USB_GET_STATE(xfer)) {
1036         case USB_ST_TRANSFERRED:
1037                 /* Allocate new mbuf */
1038                 MGETHDR(m, M_NOWAIT, MT_DATA);
1039                 if (m == NULL) {
1040                         UBT_STAT_IERROR(sc);
1041                         goto submit_next;
1042                 }
1043
1044                 if (!(MCLGET(m, M_NOWAIT))) {
1045                         UBT_STAT_IERROR(sc);
1046                         goto submit_next;
1047                 }
1048
1049                 /* Add HCI packet type */
1050                 *mtod(m, uint8_t *)= NG_HCI_ACL_DATA_PKT;
1051                 m->m_pkthdr.len = m->m_len = 1;
1052
1053                 if (actlen > MCLBYTES - 1)
1054                         actlen = MCLBYTES - 1;
1055
1056                 pc = usbd_xfer_get_frame(xfer, 0);
1057                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
1058                 m->m_pkthdr.len += actlen;
1059                 m->m_len += actlen;
1060
1061                 UBT_INFO(sc, "got %d bytes from bulk-in pipe\n",
1062                         actlen);
1063
1064                 /* Validate packet and send it up the stack */
1065                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
1066                         UBT_INFO(sc, "HCI ACL packet is too short\n");
1067
1068                         UBT_STAT_IERROR(sc);
1069                         goto submit_next;
1070                 }
1071
1072                 hdr = mtod(m, ng_hci_acldata_pkt_t *);
1073                 len = le16toh(hdr->length);
1074                 if (len != (int)(m->m_pkthdr.len - sizeof(*hdr))) {
1075                         UBT_ERR(sc, "Invalid ACL packet size, length=%d, " \
1076                                 "pktlen=%d\n", len, m->m_pkthdr.len);
1077
1078                         UBT_STAT_IERROR(sc);
1079                         goto submit_next;
1080                 }
1081
1082                 UBT_INFO(sc, "got complete ACL data packet, pktlen=%d, " \
1083                         "length=%d\n", m->m_pkthdr.len, len);
1084
1085                 UBT_STAT_PCKTS_RECV(sc);
1086                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1087
1088                 ubt_fwd_mbuf_up(sc, &m);
1089                 /* m == NULL at this point */
1090                 /* FALLTHOUGH */
1091
1092         case USB_ST_SETUP:
1093 submit_next:
1094                 NG_FREE_M(m); /* checks for m != NULL */
1095
1096                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1097                 usbd_transfer_submit(xfer);
1098                 break;
1099
1100         default: /* Error */
1101                 if (error != USB_ERR_CANCELLED) {
1102                         UBT_WARN(sc, "bulk-in transfer failed: %s\n",
1103                                 usbd_errstr(error));
1104
1105                         /* Try to clear stall first */
1106                         usbd_xfer_set_stall(xfer);
1107                         goto submit_next;
1108                 }
1109                         /* transfer cancelled */
1110                 break;
1111         }
1112 } /* ubt_bulk_read_callback */
1113
1114 /*
1115  * Called when outgoing bulk transfer (ACL packet) has completed, i.e.
1116  * ACL packet was sent to the device.
1117  * USB context.
1118  */
1119
1120 static void
1121 ubt_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
1122 {
1123         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1124         struct mbuf             *m;
1125         struct usb_page_cache   *pc;
1126         int                     actlen;
1127
1128         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1129
1130         switch (USB_GET_STATE(xfer)) {
1131         case USB_ST_TRANSFERRED:
1132                 UBT_INFO(sc, "sent %d bytes to bulk-out pipe\n", actlen);
1133                 UBT_STAT_BYTES_SENT(sc, actlen);
1134                 UBT_STAT_PCKTS_SENT(sc);
1135                 /* FALLTHROUGH */
1136
1137         case USB_ST_SETUP:
1138 send_next:
1139                 /* Get next mbuf, if any */
1140                 UBT_NG_LOCK(sc);
1141                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_aclq, m);
1142                 UBT_NG_UNLOCK(sc);
1143
1144                 if (m == NULL) {
1145                         UBT_INFO(sc, "ACL data queue is empty\n");
1146                         break; /* transfer completed */
1147                 }
1148
1149                 /*
1150                  * Copy ACL data frame back to a linear USB transfer buffer
1151                  * and schedule transfer
1152                  */
1153
1154                 pc = usbd_xfer_get_frame(xfer, 0);
1155                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
1156                 usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
1157
1158                 UBT_INFO(sc, "bulk-out transfer has been started, len=%d\n",
1159                         m->m_pkthdr.len);
1160
1161                 NG_FREE_M(m);
1162
1163                 usbd_transfer_submit(xfer);
1164                 break;
1165
1166         default: /* Error */
1167                 if (error != USB_ERR_CANCELLED) {
1168                         UBT_WARN(sc, "bulk-out transfer failed: %s\n",
1169                                 usbd_errstr(error));
1170
1171                         UBT_STAT_OERROR(sc);
1172
1173                         /* try to clear stall first */
1174                         usbd_xfer_set_stall(xfer);
1175                         goto send_next;
1176                 }
1177                         /* transfer cancelled */
1178                 break;
1179         }
1180 } /* ubt_bulk_write_callback */
1181
1182 /*
1183  * Called when incoming isoc transfer (SCO packet) has completed, i.e.
1184  * SCO packet was received from the device.
1185  * USB context.
1186  */
1187
1188 static void
1189 ubt_isoc_read_callback(struct usb_xfer *xfer, usb_error_t error)
1190 {
1191         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1192         int                     n;
1193         int actlen, nframes;
1194
1195         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1196
1197         switch (USB_GET_STATE(xfer)) {
1198         case USB_ST_TRANSFERRED:
1199                 for (n = 0; n < nframes; n ++)
1200                         if (ubt_isoc_read_one_frame(xfer, n) < 0)
1201                                 break;
1202                 /* FALLTHROUGH */
1203
1204         case USB_ST_SETUP:
1205 read_next:
1206                 for (n = 0; n < nframes; n ++)
1207                         usbd_xfer_set_frame_len(xfer, n,
1208                             usbd_xfer_max_framelen(xfer));
1209
1210                 usbd_transfer_submit(xfer);
1211                 break;
1212
1213         default: /* Error */
1214                 if (error != USB_ERR_CANCELLED) {
1215                         UBT_STAT_IERROR(sc);
1216                         goto read_next;
1217                 }
1218
1219                 /* transfer cancelled */
1220                 break;
1221         }
1222 } /* ubt_isoc_read_callback */
1223
1224 /*
1225  * Helper function. Called from ubt_isoc_read_callback() to read
1226  * SCO data from one frame.
1227  * USB context.
1228  */
1229
1230 static int
1231 ubt_isoc_read_one_frame(struct usb_xfer *xfer, int frame_no)
1232 {
1233         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1234         struct usb_page_cache   *pc;
1235         struct mbuf             *m;
1236         int                     len, want, got, total;
1237
1238         /* Get existing SCO reassembly buffer */
1239         pc = usbd_xfer_get_frame(xfer, 0);
1240         m = sc->sc_isoc_in_buffer;
1241         total = usbd_xfer_frame_len(xfer, frame_no);
1242
1243         /* While we have data in the frame */
1244         while (total > 0) {
1245                 if (m == NULL) {
1246                         /* Start new reassembly buffer */
1247                         MGETHDR(m, M_NOWAIT, MT_DATA);
1248                         if (m == NULL) {
1249                                 UBT_STAT_IERROR(sc);
1250                                 return (-1);    /* XXX out of sync! */
1251                         }
1252
1253                         if (!(MCLGET(m, M_NOWAIT))) {
1254                                 UBT_STAT_IERROR(sc);
1255                                 NG_FREE_M(m);
1256                                 return (-1);    /* XXX out of sync! */
1257                         }
1258
1259                         /* Expect SCO header */
1260                         *mtod(m, uint8_t *) = NG_HCI_SCO_DATA_PKT;
1261                         m->m_pkthdr.len = m->m_len = got = 1;
1262                         want = sizeof(ng_hci_scodata_pkt_t);
1263                 } else {
1264                         /*
1265                          * Check if we have SCO header and if so
1266                          * adjust amount of data we want
1267                          */
1268                         got = m->m_pkthdr.len;
1269                         want = sizeof(ng_hci_scodata_pkt_t);
1270
1271                         if (got >= want)
1272                                 want += mtod(m, ng_hci_scodata_pkt_t *)->length;
1273                 }
1274
1275                 /* Append frame data to the SCO reassembly buffer */
1276                 len = total;
1277                 if (got + len > want)
1278                         len = want - got;
1279
1280                 usbd_copy_out(pc, frame_no * usbd_xfer_max_framelen(xfer),
1281                         mtod(m, uint8_t *) + m->m_pkthdr.len, len);
1282
1283                 m->m_pkthdr.len += len;
1284                 m->m_len += len;
1285                 total -= len;
1286
1287                 /* Check if we got everything we wanted, if not - continue */
1288                 if (got != want)
1289                         continue;
1290
1291                 /* If we got here then we got complete SCO frame */
1292                 UBT_INFO(sc, "got complete SCO data frame, pktlen=%d, " \
1293                         "length=%d\n", m->m_pkthdr.len,
1294                         mtod(m, ng_hci_scodata_pkt_t *)->length);
1295
1296                 UBT_STAT_PCKTS_RECV(sc);
1297                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1298
1299                 ubt_fwd_mbuf_up(sc, &m);
1300                 /* m == NULL at this point */
1301         }
1302
1303         /* Put SCO reassembly buffer back */
1304         sc->sc_isoc_in_buffer = m;
1305
1306         return (0);
1307 } /* ubt_isoc_read_one_frame */
1308
1309 /*
1310  * Called when outgoing isoc transfer (SCO packet) has completed, i.e.
1311  * SCO packet was sent to the device.
1312  * USB context.
1313  */
1314
1315 static void
1316 ubt_isoc_write_callback(struct usb_xfer *xfer, usb_error_t error)
1317 {
1318         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1319         struct usb_page_cache   *pc;
1320         struct mbuf             *m;
1321         int                     n, space, offset;
1322         int                     actlen, nframes;
1323
1324         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1325         pc = usbd_xfer_get_frame(xfer, 0);
1326
1327         switch (USB_GET_STATE(xfer)) {
1328         case USB_ST_TRANSFERRED:
1329                 UBT_INFO(sc, "sent %d bytes to isoc-out pipe\n", actlen);
1330                 UBT_STAT_BYTES_SENT(sc, actlen);
1331                 UBT_STAT_PCKTS_SENT(sc);
1332                 /* FALLTHROUGH */
1333
1334         case USB_ST_SETUP:
1335 send_next:
1336                 offset = 0;
1337                 space = usbd_xfer_max_framelen(xfer) * nframes;
1338                 m = NULL;
1339
1340                 while (space > 0) {
1341                         if (m == NULL) {
1342                                 UBT_NG_LOCK(sc);
1343                                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_scoq, m);
1344                                 UBT_NG_UNLOCK(sc);
1345
1346                                 if (m == NULL)
1347                                         break;
1348                         }
1349
1350                         n = min(space, m->m_pkthdr.len);
1351                         if (n > 0) {
1352                                 usbd_m_copy_in(pc, offset, m,0, n);
1353                                 m_adj(m, n);
1354
1355                                 offset += n;
1356                                 space -= n;
1357                         }
1358
1359                         if (m->m_pkthdr.len == 0)
1360                                 NG_FREE_M(m); /* sets m = NULL */
1361                 }
1362
1363                 /* Put whatever is left from mbuf back on queue */
1364                 if (m != NULL) {
1365                         UBT_NG_LOCK(sc);
1366                         NG_BT_MBUFQ_PREPEND(&sc->sc_scoq, m);
1367                         UBT_NG_UNLOCK(sc);
1368                 }
1369
1370                 /*
1371                  * Calculate sizes for isoc frames.
1372                  * Note that offset could be 0 at this point (i.e. we have
1373                  * nothing to send). That is fine, as we have isoc. transfers
1374                  * going in both directions all the time. In this case it
1375                  * would be just empty isoc. transfer.
1376                  */
1377
1378                 for (n = 0; n < nframes; n ++) {
1379                         usbd_xfer_set_frame_len(xfer, n,
1380                             min(offset, usbd_xfer_max_framelen(xfer)));
1381                         offset -= usbd_xfer_frame_len(xfer, n);
1382                 }
1383
1384                 usbd_transfer_submit(xfer);
1385                 break;
1386
1387         default: /* Error */
1388                 if (error != USB_ERR_CANCELLED) {
1389                         UBT_STAT_OERROR(sc);
1390                         goto send_next;
1391                 }
1392
1393                 /* transfer cancelled */
1394                 break;
1395         }
1396 }
1397
1398 /*
1399  * Utility function to forward provided mbuf upstream (i.e. up the stack).
1400  * Modifies value of the mbuf pointer (sets it to NULL).
1401  * Save to call from any context.
1402  */
1403
1404 static int
1405 ubt_fwd_mbuf_up(ubt_softc_p sc, struct mbuf **m)
1406 {
1407         hook_p  hook;
1408         int     error;
1409
1410         /*
1411          * Close the race with Netgraph hook newhook/disconnect methods.
1412          * Save the hook pointer atomically. Two cases are possible:
1413          *
1414          * 1) The hook pointer is NULL. It means disconnect method got
1415          *    there first. In this case we are done.
1416          *
1417          * 2) The hook pointer is not NULL. It means that hook pointer
1418          *    could be either in valid or invalid (i.e. in the process
1419          *    of disconnect) state. In any case grab an extra reference
1420          *    to protect the hook pointer.
1421          *
1422          * It is ok to pass hook in invalid state to NG_SEND_DATA_ONLY() as
1423          * it checks for it. Drop extra reference after NG_SEND_DATA_ONLY().
1424          */
1425
1426         UBT_NG_LOCK(sc);
1427         if ((hook = sc->sc_hook) != NULL)
1428                 NG_HOOK_REF(hook);
1429         UBT_NG_UNLOCK(sc);
1430
1431         if (hook == NULL) {
1432                 NG_FREE_M(*m);
1433                 return (ENETDOWN);
1434         }
1435
1436         NG_SEND_DATA_ONLY(error, hook, *m);
1437         NG_HOOK_UNREF(hook);
1438
1439         if (error != 0)
1440                 UBT_STAT_IERROR(sc);
1441
1442         return (error);
1443 } /* ubt_fwd_mbuf_up */
1444
1445 /****************************************************************************
1446  ****************************************************************************
1447  **                                 Glue
1448  ****************************************************************************
1449  ****************************************************************************/
1450
1451 /*
1452  * Schedule glue task. Should be called with sc_ng_mtx held.
1453  * Netgraph context.
1454  */
1455
1456 static void
1457 ubt_task_schedule(ubt_softc_p sc, int action)
1458 {
1459         mtx_assert(&sc->sc_ng_mtx, MA_OWNED);
1460
1461         /*
1462          * Try to handle corner case when "start all" and "stop all"
1463          * actions can both be set before task is executed.
1464          *
1465          * The rules are
1466          *
1467          * sc_task_flags        action          new sc_task_flags
1468          * ------------------------------------------------------
1469          * 0                    start           start
1470          * 0                    stop            stop
1471          * start                start           start
1472          * start                stop            stop
1473          * stop                 start           stop|start
1474          * stop                 stop            stop
1475          * stop|start           start           stop|start
1476          * stop|start           stop            stop
1477          */
1478
1479         if (action != 0) {
1480                 if ((action & UBT_FLAG_T_STOP_ALL) != 0)
1481                         sc->sc_task_flags &= ~UBT_FLAG_T_START_ALL;
1482
1483                 sc->sc_task_flags |= action;
1484         }
1485
1486         if (sc->sc_task_flags & UBT_FLAG_T_PENDING)
1487                 return;
1488
1489         if (taskqueue_enqueue(taskqueue_swi, &sc->sc_task) == 0) {
1490                 sc->sc_task_flags |= UBT_FLAG_T_PENDING;
1491                 return;
1492         }
1493
1494         /* XXX: i think this should never happen */
1495 } /* ubt_task_schedule */
1496
1497 /*
1498  * Glue task. Examines sc_task_flags and does things depending on it.
1499  * Taskqueue context.
1500  */
1501
1502 static void
1503 ubt_task(void *context, int pending)
1504 {
1505         ubt_softc_p     sc = context;
1506         int             task_flags, i;
1507
1508         UBT_NG_LOCK(sc);
1509         task_flags = sc->sc_task_flags;
1510         sc->sc_task_flags = 0;
1511         UBT_NG_UNLOCK(sc);
1512
1513         /*
1514          * Stop all USB transfers synchronously.
1515          * Stop interface #0 and #1 transfers at the same time and in the
1516          * same loop. usbd_transfer_drain() will do appropriate locking.
1517          */
1518
1519         if (task_flags & UBT_FLAG_T_STOP_ALL)
1520                 for (i = 0; i < UBT_N_TRANSFER; i ++)
1521                         usbd_transfer_drain(sc->sc_xfer[i]);
1522
1523         /* Start incoming interrupt and bulk, and all isoc. USB transfers */
1524         if (task_flags & UBT_FLAG_T_START_ALL) {
1525                 /*
1526                  * Interface #0
1527                  */
1528
1529                 mtx_lock(&sc->sc_if_mtx);
1530
1531                 ubt_xfer_start(sc, UBT_IF_0_INTR_DT_RD);
1532                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_RD);
1533
1534                 /*
1535                  * Interface #1
1536                  * Start both read and write isoc. transfers by default.
1537                  * Get them going all the time even if we have nothing
1538                  * to send to avoid any delays.
1539                  */
1540
1541                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD1);
1542                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD2);
1543                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR1);
1544                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR2);
1545
1546                 mtx_unlock(&sc->sc_if_mtx);
1547         }
1548
1549         /* Start outgoing control transfer */
1550         if (task_flags & UBT_FLAG_T_START_CTRL) {
1551                 mtx_lock(&sc->sc_if_mtx);
1552                 ubt_xfer_start(sc, UBT_IF_0_CTRL_DT_WR);
1553                 mtx_unlock(&sc->sc_if_mtx);
1554         }
1555
1556         /* Start outgoing bulk transfer */
1557         if (task_flags & UBT_FLAG_T_START_BULK) {
1558                 mtx_lock(&sc->sc_if_mtx);
1559                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_WR);
1560                 mtx_unlock(&sc->sc_if_mtx);
1561         }
1562 } /* ubt_task */
1563
1564 /****************************************************************************
1565  ****************************************************************************
1566  **                        Netgraph specific
1567  ****************************************************************************
1568  ****************************************************************************/
1569
1570 /*
1571  * Netgraph node constructor. Do not allow to create node of this type.
1572  * Netgraph context.
1573  */
1574
1575 static int
1576 ng_ubt_constructor(node_p node)
1577 {
1578         return (EINVAL);
1579 } /* ng_ubt_constructor */
1580
1581 /*
1582  * Netgraph node destructor. Destroy node only when device has been detached.
1583  * Netgraph context.
1584  */
1585
1586 static int
1587 ng_ubt_shutdown(node_p node)
1588 {
1589         if (node->nd_flags & NGF_REALLY_DIE) {
1590                 /*
1591                  * We came here because the USB device is being
1592                  * detached, so stop being persistent.
1593                  */
1594                 NG_NODE_SET_PRIVATE(node, NULL);
1595                 NG_NODE_UNREF(node);
1596         } else
1597                 NG_NODE_REVIVE(node); /* tell ng_rmnode we are persisant */
1598
1599         return (0);
1600 } /* ng_ubt_shutdown */
1601
1602 /*
1603  * Create new hook. There can only be one.
1604  * Netgraph context.
1605  */
1606
1607 static int
1608 ng_ubt_newhook(node_p node, hook_p hook, char const *name)
1609 {
1610         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1611
1612         if (strcmp(name, NG_UBT_HOOK) != 0)
1613                 return (EINVAL);
1614
1615         UBT_NG_LOCK(sc);
1616         if (sc->sc_hook != NULL) {
1617                 UBT_NG_UNLOCK(sc);
1618
1619                 return (EISCONN);
1620         }
1621
1622         sc->sc_hook = hook;
1623         UBT_NG_UNLOCK(sc);
1624
1625         return (0);
1626 } /* ng_ubt_newhook */
1627
1628 /*
1629  * Connect hook. Start incoming USB transfers.
1630  * Netgraph context.
1631  */
1632
1633 static int
1634 ng_ubt_connect(hook_p hook)
1635 {
1636         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1637
1638         NG_HOOK_FORCE_QUEUE(NG_HOOK_PEER(hook));
1639
1640         UBT_NG_LOCK(sc);
1641         ubt_task_schedule(sc, UBT_FLAG_T_START_ALL);
1642         UBT_NG_UNLOCK(sc);
1643
1644         return (0);
1645 } /* ng_ubt_connect */
1646
1647 /*
1648  * Disconnect hook.
1649  * Netgraph context.
1650  */
1651
1652 static int
1653 ng_ubt_disconnect(hook_p hook)
1654 {
1655         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1656
1657         UBT_NG_LOCK(sc);
1658
1659         if (hook != sc->sc_hook) {
1660                 UBT_NG_UNLOCK(sc);
1661
1662                 return (EINVAL);
1663         }
1664
1665         sc->sc_hook = NULL;
1666
1667         /* Kick off task to stop all USB xfers */
1668         ubt_task_schedule(sc, UBT_FLAG_T_STOP_ALL);
1669
1670         /* Drain queues */
1671         NG_BT_MBUFQ_DRAIN(&sc->sc_cmdq);
1672         NG_BT_MBUFQ_DRAIN(&sc->sc_aclq);
1673         NG_BT_MBUFQ_DRAIN(&sc->sc_scoq);
1674
1675         UBT_NG_UNLOCK(sc);
1676
1677         return (0);
1678 } /* ng_ubt_disconnect */
1679
1680 /*
1681  * Process control message.
1682  * Netgraph context.
1683  */
1684
1685 static int
1686 ng_ubt_rcvmsg(node_p node, item_p item, hook_p lasthook)
1687 {
1688         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1689         struct ng_mesg          *msg, *rsp = NULL;
1690         struct ng_bt_mbufq      *q;
1691         int                     error = 0, queue, qlen;
1692
1693         NGI_GET_MSG(item, msg);
1694
1695         switch (msg->header.typecookie) {
1696         case NGM_GENERIC_COOKIE:
1697                 switch (msg->header.cmd) {
1698                 case NGM_TEXT_STATUS:
1699                         NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
1700                         if (rsp == NULL) {
1701                                 error = ENOMEM;
1702                                 break;
1703                         }
1704
1705                         snprintf(rsp->data, NG_TEXTRESPONSE,
1706                                 "Hook: %s\n" \
1707                                 "Task flags: %#x\n" \
1708                                 "Debug: %d\n" \
1709                                 "CMD queue: [have:%d,max:%d]\n" \
1710                                 "ACL queue: [have:%d,max:%d]\n" \
1711                                 "SCO queue: [have:%d,max:%d]",
1712                                 (sc->sc_hook != NULL) ? NG_UBT_HOOK : "",
1713                                 sc->sc_task_flags,
1714                                 sc->sc_debug,
1715                                 sc->sc_cmdq.len,
1716                                 sc->sc_cmdq.maxlen,
1717                                 sc->sc_aclq.len,
1718                                 sc->sc_aclq.maxlen,
1719                                 sc->sc_scoq.len,
1720                                 sc->sc_scoq.maxlen);
1721                         break;
1722
1723                 default:
1724                         error = EINVAL;
1725                         break;
1726                 }
1727                 break;
1728
1729         case NGM_UBT_COOKIE:
1730                 switch (msg->header.cmd) {
1731                 case NGM_UBT_NODE_SET_DEBUG:
1732                         if (msg->header.arglen != sizeof(ng_ubt_node_debug_ep)){
1733                                 error = EMSGSIZE;
1734                                 break;
1735                         }
1736
1737                         sc->sc_debug = *((ng_ubt_node_debug_ep *) (msg->data));
1738                         break;
1739
1740                 case NGM_UBT_NODE_GET_DEBUG:
1741                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_debug_ep),
1742                             M_NOWAIT);
1743                         if (rsp == NULL) {
1744                                 error = ENOMEM;
1745                                 break;
1746                         }
1747
1748                         *((ng_ubt_node_debug_ep *) (rsp->data)) = sc->sc_debug;
1749                         break;
1750
1751                 case NGM_UBT_NODE_SET_QLEN:
1752                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1753                                 error = EMSGSIZE;
1754                                 break;
1755                         }
1756
1757                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1758                         qlen = ((ng_ubt_node_qlen_ep *) (msg->data))->qlen;
1759
1760                         switch (queue) {
1761                         case NGM_UBT_NODE_QUEUE_CMD:
1762                                 q = &sc->sc_cmdq;
1763                                 break;
1764
1765                         case NGM_UBT_NODE_QUEUE_ACL:
1766                                 q = &sc->sc_aclq;
1767                                 break;
1768
1769                         case NGM_UBT_NODE_QUEUE_SCO:
1770                                 q = &sc->sc_scoq;
1771                                 break;
1772
1773                         default:
1774                                 error = EINVAL;
1775                                 goto done;
1776                                 /* NOT REACHED */
1777                         }
1778
1779                         q->maxlen = qlen;
1780                         break;
1781
1782                 case NGM_UBT_NODE_GET_QLEN:
1783                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1784                                 error = EMSGSIZE;
1785                                 break;
1786                         }
1787
1788                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1789
1790                         switch (queue) {
1791                         case NGM_UBT_NODE_QUEUE_CMD:
1792                                 q = &sc->sc_cmdq;
1793                                 break;
1794
1795                         case NGM_UBT_NODE_QUEUE_ACL:
1796                                 q = &sc->sc_aclq;
1797                                 break;
1798
1799                         case NGM_UBT_NODE_QUEUE_SCO:
1800                                 q = &sc->sc_scoq;
1801                                 break;
1802
1803                         default:
1804                                 error = EINVAL;
1805                                 goto done;
1806                                 /* NOT REACHED */
1807                         }
1808
1809                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_qlen_ep),
1810                                 M_NOWAIT);
1811                         if (rsp == NULL) {
1812                                 error = ENOMEM;
1813                                 break;
1814                         }
1815
1816                         ((ng_ubt_node_qlen_ep *) (rsp->data))->queue = queue;
1817                         ((ng_ubt_node_qlen_ep *) (rsp->data))->qlen = q->maxlen;
1818                         break;
1819
1820                 case NGM_UBT_NODE_GET_STAT:
1821                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_stat_ep),
1822                             M_NOWAIT);
1823                         if (rsp == NULL) {
1824                                 error = ENOMEM;
1825                                 break;
1826                         }
1827
1828                         bcopy(&sc->sc_stat, rsp->data,
1829                                 sizeof(ng_ubt_node_stat_ep));
1830                         break;
1831
1832                 case NGM_UBT_NODE_RESET_STAT:
1833                         UBT_STAT_RESET(sc);
1834                         break;
1835
1836                 default:
1837                         error = EINVAL;
1838                         break;
1839                 }
1840                 break;
1841
1842         default:
1843                 error = EINVAL;
1844                 break;
1845         }
1846 done:
1847         NG_RESPOND_MSG(error, node, item, rsp);
1848         NG_FREE_MSG(msg);
1849
1850         return (error);
1851 } /* ng_ubt_rcvmsg */
1852
1853 /*
1854  * Process data.
1855  * Netgraph context.
1856  */
1857
1858 static int
1859 ng_ubt_rcvdata(hook_p hook, item_p item)
1860 {
1861         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1862         struct mbuf             *m;
1863         struct ng_bt_mbufq      *q;
1864         int                     action, error = 0;
1865
1866         if (hook != sc->sc_hook) {
1867                 error = EINVAL;
1868                 goto done;
1869         }
1870
1871         /* Deatch mbuf and get HCI frame type */
1872         NGI_GET_M(item, m);
1873
1874         /*
1875          * Minimal size of the HCI frame is 4 bytes: 1 byte frame type,
1876          * 2 bytes connection handle and at least 1 byte of length.
1877          * Panic on data frame that has size smaller than 4 bytes (it
1878          * should not happen)
1879          */
1880
1881         if (m->m_pkthdr.len < 4)
1882                 panic("HCI frame size is too small! pktlen=%d\n",
1883                         m->m_pkthdr.len);
1884
1885         /* Process HCI frame */
1886         switch (*mtod(m, uint8_t *)) {  /* XXX call m_pullup ? */
1887         case NG_HCI_CMD_PKT:
1888                 if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE)
1889                         panic("HCI command frame size is too big! " \
1890                                 "buffer size=%zd, packet len=%d\n",
1891                                 UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len);
1892
1893                 q = &sc->sc_cmdq;
1894                 action = UBT_FLAG_T_START_CTRL;
1895                 break;
1896
1897         case NG_HCI_ACL_DATA_PKT:
1898                 if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE)
1899                         panic("ACL data frame size is too big! " \
1900                                 "buffer size=%d, packet len=%d\n",
1901                                 UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len);
1902
1903                 q = &sc->sc_aclq;
1904                 action = UBT_FLAG_T_START_BULK;
1905                 break;
1906
1907         case NG_HCI_SCO_DATA_PKT:
1908                 q = &sc->sc_scoq;
1909                 action = 0;
1910                 break;
1911
1912         default:
1913                 UBT_ERR(sc, "Dropping unsupported HCI frame, type=0x%02x, " \
1914                         "pktlen=%d\n", *mtod(m, uint8_t *), m->m_pkthdr.len);
1915
1916                 NG_FREE_M(m);
1917                 error = EINVAL;
1918                 goto done;
1919                 /* NOT REACHED */
1920         }
1921
1922         UBT_NG_LOCK(sc);
1923         if (NG_BT_MBUFQ_FULL(q)) {
1924                 NG_BT_MBUFQ_DROP(q);
1925                 UBT_NG_UNLOCK(sc);
1926
1927                 UBT_ERR(sc, "Dropping HCI frame 0x%02x, len=%d. Queue full\n",
1928                         *mtod(m, uint8_t *), m->m_pkthdr.len);
1929
1930                 NG_FREE_M(m);
1931         } else {
1932                 /* Loose HCI packet type, enqueue mbuf and kick off task */
1933                 m_adj(m, sizeof(uint8_t));
1934                 NG_BT_MBUFQ_ENQUEUE(q, m);
1935                 ubt_task_schedule(sc, action);
1936                 UBT_NG_UNLOCK(sc);
1937         }
1938 done:
1939         NG_FREE_ITEM(item);
1940
1941         return (error);
1942 } /* ng_ubt_rcvdata */
1943
1944 /****************************************************************************
1945  ****************************************************************************
1946  **                              Module
1947  ****************************************************************************
1948  ****************************************************************************/
1949
1950 /*
1951  * Load/Unload the driver module
1952  */
1953
1954 static int
1955 ubt_modevent(module_t mod, int event, void *data)
1956 {
1957         int     error;
1958
1959         switch (event) {
1960         case MOD_LOAD:
1961                 error = ng_newtype(&typestruct);
1962                 if (error != 0)
1963                         printf("%s: Could not register Netgraph node type, " \
1964                                 "error=%d\n", NG_UBT_NODE_TYPE, error);
1965                 break;
1966
1967         case MOD_UNLOAD:
1968                 error = ng_rmtype(&typestruct);
1969                 break;
1970
1971         default:
1972                 error = EOPNOTSUPP;
1973                 break;
1974         }
1975
1976         return (error);
1977 } /* ubt_modevent */
1978
1979 devclass_t      ubt_devclass;
1980
1981 static device_method_t  ubt_methods[] =
1982 {
1983         DEVMETHOD(device_probe, ubt_probe),
1984         DEVMETHOD(device_attach, ubt_attach),
1985         DEVMETHOD(device_detach, ubt_detach),
1986         DEVMETHOD_END
1987 };
1988
1989 driver_t                ubt_driver =
1990 {
1991         .name =    "ubt",
1992         .methods = ubt_methods,
1993         .size =    sizeof(struct ubt_softc),
1994 };
1995
1996 DRIVER_MODULE(ng_ubt, uhub, ubt_driver, ubt_devclass, ubt_modevent, 0);
1997 MODULE_VERSION(ng_ubt, NG_BLUETOOTH_VERSION);
1998 MODULE_DEPEND(ng_ubt, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
1999 MODULE_DEPEND(ng_ubt, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
2000 MODULE_DEPEND(ng_ubt, usb, 1, 1, 1);
2001 USB_PNP_HOST_INFO(ubt_devs);