]> CyberLeo.Net >> Repos - FreeBSD/releng/10.0.git/blob - sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
- Copy stable/10 (r259064) to releng/10.0 as part of the
[FreeBSD/releng/10.0.git] / sys / netgraph / bluetooth / drivers / ubt / ng_ubt.c
1 /*
2  * ng_ubt.c
3  */
4
5 /*-
6  * Copyright (c) 2001-2009 Maksim Yevmenkin <m_evmenkin@yahoo.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $Id: ng_ubt.c,v 1.16 2003/10/10 19:15:06 max Exp $
31  * $FreeBSD$
32  */
33
34 /*
35  * NOTE: ng_ubt2 driver has a split personality. On one side it is
36  * a USB device driver and on the other it is a Netgraph node. This
37  * driver will *NOT* create traditional /dev/ enties, only Netgraph 
38  * node.
39  *
40  * NOTE ON LOCKS USED: ng_ubt2 drives uses 2 locks (mutexes)
41  *
42  * 1) sc_if_mtx - lock for device's interface #0 and #1. This lock is used
43  *    by USB for any USB request going over device's interface #0 and #1,
44  *    i.e. interrupt, control, bulk and isoc. transfers.
45  * 
46  * 2) sc_ng_mtx - this lock is used to protect shared (between USB, Netgraph
47  *    and Taskqueue) data, such as outgoing mbuf queues, task flags and hook
48  *    pointer. This lock *SHOULD NOT* be grabbed for a long time. In fact,
49  *    think of it as a spin lock.
50  *
51  * NOTE ON LOCKING STRATEGY: ng_ubt2 driver operates in 3 different contexts.
52  *
53  * 1) USB context. This is where all the USB related stuff happens. All
54  *    callbacks run in this context. All callbacks are called (by USB) with
55  *    appropriate interface lock held. It is (generally) allowed to grab
56  *    any additional locks.
57  *
58  * 2) Netgraph context. This is where all the Netgraph related stuff happens.
59  *    Since we mark node as WRITER, the Netgraph node will be "locked" (from
60  *    Netgraph point of view). Any variable that is only modified from the
61  *    Netgraph context does not require any additonal locking. It is generally
62  *    *NOT* allowed to grab *ANY* additional locks. Whatever you do, *DO NOT*
63  *    grab any lock in the Netgraph context that could cause de-scheduling of
64  *    the Netgraph thread for significant amount of time. In fact, the only
65  *    lock that is allowed in the Netgraph context is the sc_ng_mtx lock.
66  *    Also make sure that any code that is called from the Netgraph context
67  *    follows the rule above.
68  *
69  * 3) Taskqueue context. This is where ubt_task runs. Since we are generally
70  *    NOT allowed to grab any lock that could cause de-scheduling in the
71  *    Netgraph context, and, USB requires us to grab interface lock before
72  *    doing things with transfers, it is safer to transition from the Netgraph
73  *    context to the Taskqueue context before we can call into USB subsystem.
74  *
75  * So, to put everything together, the rules are as follows.
76  *      It is OK to call from the USB context or the Taskqueue context into
77  * the Netgraph context (i.e. call NG_SEND_xxx functions). In other words
78  * it is allowed to call into the Netgraph context with locks held.
79  *      Is it *NOT* OK to call from the Netgraph context into the USB context,
80  * because USB requires us to grab interface locks, and, it is safer to
81  * avoid it. So, to make things safer we set task flags to indicate which
82  * actions we want to perform and schedule ubt_task which would run in the
83  * Taskqueue context.
84  *      Is is OK to call from the Taskqueue context into the USB context,
85  * and, ubt_task does just that (i.e. grabs appropriate interface locks
86  * before calling into USB).
87  *      Access to the outgoing queues, task flags and hook pointer is
88  * controlled by the sc_ng_mtx lock. It is an unavoidable evil. Again,
89  * sc_ng_mtx should really be a spin lock (and it is very likely to an
90  * equivalent of spin lock due to adaptive nature of FreeBSD mutexes).
91  *      All USB callbacks accept softc pointer as a private data. USB ensures
92  * that this pointer is valid.
93  */
94
95 #include <sys/stdint.h>
96 #include <sys/stddef.h>
97 #include <sys/param.h>
98 #include <sys/queue.h>
99 #include <sys/types.h>
100 #include <sys/systm.h>
101 #include <sys/kernel.h>
102 #include <sys/bus.h>
103 #include <sys/module.h>
104 #include <sys/lock.h>
105 #include <sys/mutex.h>
106 #include <sys/condvar.h>
107 #include <sys/sysctl.h>
108 #include <sys/sx.h>
109 #include <sys/unistd.h>
110 #include <sys/callout.h>
111 #include <sys/malloc.h>
112 #include <sys/priv.h>
113
114 #include "usbdevs.h"
115 #include <dev/usb/usb.h>
116 #include <dev/usb/usbdi.h>
117 #include <dev/usb/usbdi_util.h>
118
119 #define USB_DEBUG_VAR usb_debug
120 #include <dev/usb/usb_debug.h>
121 #include <dev/usb/usb_busdma.h>
122
123 #include <sys/mbuf.h>
124 #include <sys/taskqueue.h>
125
126 #include <netgraph/ng_message.h>
127 #include <netgraph/netgraph.h>
128 #include <netgraph/ng_parse.h>
129 #include <netgraph/bluetooth/include/ng_bluetooth.h>
130 #include <netgraph/bluetooth/include/ng_hci.h>
131 #include <netgraph/bluetooth/include/ng_ubt.h>
132 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h>
133
134 static int              ubt_modevent(module_t, int, void *);
135 static device_probe_t   ubt_probe;
136 static device_attach_t  ubt_attach;
137 static device_detach_t  ubt_detach;
138
139 static void             ubt_task_schedule(ubt_softc_p, int);
140 static task_fn_t        ubt_task;
141
142 #define ubt_xfer_start(sc, i)   usbd_transfer_start((sc)->sc_xfer[(i)])
143
144 /* Netgraph methods */
145 static ng_constructor_t ng_ubt_constructor;
146 static ng_shutdown_t    ng_ubt_shutdown;
147 static ng_newhook_t     ng_ubt_newhook;
148 static ng_connect_t     ng_ubt_connect;
149 static ng_disconnect_t  ng_ubt_disconnect;
150 static ng_rcvmsg_t      ng_ubt_rcvmsg;
151 static ng_rcvdata_t     ng_ubt_rcvdata;
152
153 /* Queue length */
154 static const struct ng_parse_struct_field       ng_ubt_node_qlen_type_fields[] =
155 {
156         { "queue", &ng_parse_int32_type, },
157         { "qlen",  &ng_parse_int32_type, },
158         { NULL, }
159 };
160 static const struct ng_parse_type               ng_ubt_node_qlen_type =
161 {
162         &ng_parse_struct_type,
163         &ng_ubt_node_qlen_type_fields
164 };
165
166 /* Stat info */
167 static const struct ng_parse_struct_field       ng_ubt_node_stat_type_fields[] =
168 {
169         { "pckts_recv", &ng_parse_uint32_type, },
170         { "bytes_recv", &ng_parse_uint32_type, },
171         { "pckts_sent", &ng_parse_uint32_type, },
172         { "bytes_sent", &ng_parse_uint32_type, },
173         { "oerrors",    &ng_parse_uint32_type, },
174         { "ierrors",    &ng_parse_uint32_type, },
175         { NULL, }
176 };
177 static const struct ng_parse_type               ng_ubt_node_stat_type =
178 {
179         &ng_parse_struct_type,
180         &ng_ubt_node_stat_type_fields
181 };
182
183 /* Netgraph node command list */
184 static const struct ng_cmdlist                  ng_ubt_cmdlist[] =
185 {
186         {
187                 NGM_UBT_COOKIE,
188                 NGM_UBT_NODE_SET_DEBUG,
189                 "set_debug",
190                 &ng_parse_uint16_type,
191                 NULL
192         },
193         {
194                 NGM_UBT_COOKIE,
195                 NGM_UBT_NODE_GET_DEBUG,
196                 "get_debug",
197                 NULL,
198                 &ng_parse_uint16_type
199         },
200         {
201                 NGM_UBT_COOKIE,
202                 NGM_UBT_NODE_SET_QLEN,
203                 "set_qlen",
204                 &ng_ubt_node_qlen_type,
205                 NULL
206         },
207         {
208                 NGM_UBT_COOKIE,
209                 NGM_UBT_NODE_GET_QLEN,
210                 "get_qlen",
211                 &ng_ubt_node_qlen_type,
212                 &ng_ubt_node_qlen_type
213         },
214         {
215                 NGM_UBT_COOKIE,
216                 NGM_UBT_NODE_GET_STAT,
217                 "get_stat",
218                 NULL,
219                 &ng_ubt_node_stat_type
220         },
221         {
222                 NGM_UBT_COOKIE,
223                 NGM_UBT_NODE_RESET_STAT,
224                 "reset_stat",
225                 NULL,
226                 NULL
227         },
228         { 0, }
229 };
230
231 /* Netgraph node type */
232 static struct ng_type   typestruct =
233 {
234         .version =      NG_ABI_VERSION,
235         .name =         NG_UBT_NODE_TYPE,
236         .constructor =  ng_ubt_constructor,
237         .rcvmsg =       ng_ubt_rcvmsg,
238         .shutdown =     ng_ubt_shutdown,
239         .newhook =      ng_ubt_newhook,
240         .connect =      ng_ubt_connect,
241         .rcvdata =      ng_ubt_rcvdata,
242         .disconnect =   ng_ubt_disconnect,
243         .cmdlist =      ng_ubt_cmdlist
244 };
245
246 /****************************************************************************
247  ****************************************************************************
248  **                              USB specific
249  ****************************************************************************
250  ****************************************************************************/
251
252 /* USB methods */
253 static usb_callback_t   ubt_ctrl_write_callback;
254 static usb_callback_t   ubt_intr_read_callback;
255 static usb_callback_t   ubt_bulk_read_callback;
256 static usb_callback_t   ubt_bulk_write_callback;
257 static usb_callback_t   ubt_isoc_read_callback;
258 static usb_callback_t   ubt_isoc_write_callback;
259
260 static int              ubt_fwd_mbuf_up(ubt_softc_p, struct mbuf **);
261 static int              ubt_isoc_read_one_frame(struct usb_xfer *, int);
262
263 /*
264  * USB config
265  * 
266  * The following desribes usb transfers that could be submitted on USB device.
267  *
268  * Interface 0 on the USB device must present the following endpoints
269  *      1) Interrupt endpoint to receive HCI events
270  *      2) Bulk IN endpoint to receive ACL data
271  *      3) Bulk OUT endpoint to send ACL data
272  *
273  * Interface 1 on the USB device must present the following endpoints
274  *      1) Isochronous IN endpoint to receive SCO data
275  *      2) Isochronous OUT endpoint to send SCO data
276  */
277
278 static const struct usb_config          ubt_config[UBT_N_TRANSFER] =
279 {
280         /*
281          * Interface #0
282          */
283
284         /* Outgoing bulk transfer - ACL packets */
285         [UBT_IF_0_BULK_DT_WR] = {
286                 .type =         UE_BULK,
287                 .endpoint =     UE_ADDR_ANY,
288                 .direction =    UE_DIR_OUT,
289                 .if_index =     0,
290                 .bufsize =      UBT_BULK_WRITE_BUFFER_SIZE,
291                 .flags =        { .pipe_bof = 1, .force_short_xfer = 1, },
292                 .callback =     &ubt_bulk_write_callback,
293         },
294         /* Incoming bulk transfer - ACL packets */
295         [UBT_IF_0_BULK_DT_RD] = {
296                 .type =         UE_BULK,
297                 .endpoint =     UE_ADDR_ANY,
298                 .direction =    UE_DIR_IN,
299                 .if_index =     0,
300                 .bufsize =      UBT_BULK_READ_BUFFER_SIZE,
301                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
302                 .callback =     &ubt_bulk_read_callback,
303         },
304         /* Incoming interrupt transfer - HCI events */
305         [UBT_IF_0_INTR_DT_RD] = {
306                 .type =         UE_INTERRUPT,
307                 .endpoint =     UE_ADDR_ANY,
308                 .direction =    UE_DIR_IN,
309                 .if_index =     0,
310                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
311                 .bufsize =      UBT_INTR_BUFFER_SIZE,
312                 .callback =     &ubt_intr_read_callback,
313         },
314         /* Outgoing control transfer - HCI commands */
315         [UBT_IF_0_CTRL_DT_WR] = {
316                 .type =         UE_CONTROL,
317                 .endpoint =     0x00,   /* control pipe */
318                 .direction =    UE_DIR_ANY,
319                 .if_index =     0,
320                 .bufsize =      UBT_CTRL_BUFFER_SIZE,
321                 .callback =     &ubt_ctrl_write_callback,
322                 .timeout =      5000,   /* 5 seconds */
323         },
324
325         /*
326          * Interface #1
327          */
328
329         /* Incoming isochronous transfer #1 - SCO packets */
330         [UBT_IF_1_ISOC_DT_RD1] = {
331                 .type =         UE_ISOCHRONOUS,
332                 .endpoint =     UE_ADDR_ANY,
333                 .direction =    UE_DIR_IN,
334                 .if_index =     1,
335                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
336                 .frames =       UBT_ISOC_NFRAMES,
337                 .flags =        { .short_xfer_ok = 1, },
338                 .callback =     &ubt_isoc_read_callback,
339         },
340         /* Incoming isochronous transfer #2 - SCO packets */
341         [UBT_IF_1_ISOC_DT_RD2] = {
342                 .type =         UE_ISOCHRONOUS,
343                 .endpoint =     UE_ADDR_ANY,
344                 .direction =    UE_DIR_IN,
345                 .if_index =     1,
346                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
347                 .frames =       UBT_ISOC_NFRAMES,
348                 .flags =        { .short_xfer_ok = 1, },
349                 .callback =     &ubt_isoc_read_callback,
350         },
351         /* Outgoing isochronous transfer #1 - SCO packets */
352         [UBT_IF_1_ISOC_DT_WR1] = {
353                 .type =         UE_ISOCHRONOUS,
354                 .endpoint =     UE_ADDR_ANY,
355                 .direction =    UE_DIR_OUT,
356                 .if_index =     1,
357                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
358                 .frames =       UBT_ISOC_NFRAMES,
359                 .flags =        { .short_xfer_ok = 1, },
360                 .callback =     &ubt_isoc_write_callback,
361         },
362         /* Outgoing isochronous transfer #2 - SCO packets */
363         [UBT_IF_1_ISOC_DT_WR2] = {
364                 .type =         UE_ISOCHRONOUS,
365                 .endpoint =     UE_ADDR_ANY,
366                 .direction =    UE_DIR_OUT,
367                 .if_index =     1,
368                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
369                 .frames =       UBT_ISOC_NFRAMES,
370                 .flags =        { .short_xfer_ok = 1, },
371                 .callback =     &ubt_isoc_write_callback,
372         },
373 };
374
375 /*
376  * If for some reason device should not be attached then put
377  * VendorID/ProductID pair into the list below. The format is
378  * as follows:
379  *
380  *      { USB_VPI(VENDOR_ID, PRODUCT_ID, 0) },
381  *
382  * where VENDOR_ID and PRODUCT_ID are hex numbers.
383  */
384
385 static const STRUCT_USB_HOST_ID ubt_ignore_devs[] = 
386 {
387         /* AVM USB Bluetooth-Adapter BlueFritz! v1.0 */
388         { USB_VPI(USB_VENDOR_AVM, 0x2200, 0) },
389
390         /* Atheros 3011 with sflash firmware */
391         { USB_VPI(0x0cf3, 0x3002, 0) },
392         { USB_VPI(0x0cf3, 0xe019, 0) },
393         { USB_VPI(0x13d3, 0x3304, 0) },
394         { USB_VPI(0x0930, 0x0215, 0) },
395         { USB_VPI(0x0489, 0xe03d, 0) },
396         { USB_VPI(0x0489, 0xe027, 0) },
397
398         /* Atheros AR9285 Malbec with sflash firmware */
399         { USB_VPI(0x03f0, 0x311d, 0) },
400
401         /* Atheros 3012 with sflash firmware */
402         { USB_VPI(0x0cf3, 0x3004, 0) },
403         { USB_VPI(0x0cf3, 0x311d, 0) },
404         { USB_VPI(0x13d3, 0x3375, 0) },
405         { USB_VPI(0x04ca, 0x3005, 0) },
406         { USB_VPI(0x04ca, 0x3006, 0) },
407         { USB_VPI(0x04ca, 0x3008, 0) },
408         { USB_VPI(0x13d3, 0x3362, 0) },
409         { USB_VPI(0x0cf3, 0xe004, 0) },
410         { USB_VPI(0x0930, 0x0219, 0) },
411         { USB_VPI(0x0489, 0xe057, 0) },
412         { USB_VPI(0x13d3, 0x3393, 0) },
413         { USB_VPI(0x0489, 0xe04e, 0) },
414         { USB_VPI(0x0489, 0xe056, 0) },
415
416         /* Atheros AR5BBU12 with sflash firmware */
417         { USB_VPI(0x0489, 0xe02c, 0) },
418
419         /* Atheros AR5BBU12 with sflash firmware */
420         { USB_VPI(0x0489, 0xe03c, 0) },
421         { USB_VPI(0x0489, 0xe036, 0) },
422 };
423
424 /* List of supported bluetooth devices */
425 static const STRUCT_USB_HOST_ID ubt_devs[] =
426 {
427         /* Generic Bluetooth class devices */
428         { USB_IFACE_CLASS(UDCLASS_WIRELESS),
429           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
430           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
431
432         /* AVM USB Bluetooth-Adapter BlueFritz! v2.0 */
433         { USB_VPI(USB_VENDOR_AVM, 0x3800, 0) },
434
435         /* Broadcom USB dongles, mostly BCM20702 and BCM20702A0 */
436         { USB_VENDOR(USB_VENDOR_BROADCOM),
437           USB_IFACE_CLASS(UICLASS_VENDOR),
438           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
439           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
440
441         /* Apple-specific (Broadcom) devices */
442         { USB_VENDOR(USB_VENDOR_APPLE),
443           USB_IFACE_CLASS(UICLASS_VENDOR),
444           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
445           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
446
447         /* Foxconn - Hon Hai */
448         { USB_VENDOR(USB_VENDOR_FOXCONN),
449           USB_IFACE_CLASS(UICLASS_VENDOR),
450           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
451           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
452
453         /* MediaTek MT76x0E */
454         { USB_VPI(USB_VENDOR_MEDIATEK, 0x763f, 0) },
455
456         /* Broadcom SoftSailing reporting vendor specific */
457         { USB_VPI(USB_VENDOR_BROADCOM, 0x21e1, 0) },
458
459         /* Apple MacBookPro 7,1 */
460         { USB_VPI(USB_VENDOR_APPLE, 0x8213, 0) },
461
462         /* Apple iMac11,1 */
463         { USB_VPI(USB_VENDOR_APPLE, 0x8215, 0) },
464
465         /* Apple MacBookPro6,2 */
466         { USB_VPI(USB_VENDOR_APPLE, 0x8218, 0) },
467
468         /* Apple MacBookAir3,1, MacBookAir3,2 */
469         { USB_VPI(USB_VENDOR_APPLE, 0x821b, 0) },
470
471         /* Apple MacBookAir4,1 */
472         { USB_VPI(USB_VENDOR_APPLE, 0x821f, 0) },
473
474         /* MacBookAir6,1 */
475         { USB_VPI(USB_VENDOR_APPLE, 0x828f, 0) },
476
477         /* Apple MacBookPro8,2 */
478         { USB_VPI(USB_VENDOR_APPLE, 0x821a, 0) },
479
480         /* Apple MacMini5,1 */
481         { USB_VPI(USB_VENDOR_APPLE, 0x8281, 0) },
482
483         /* Bluetooth Ultraport Module from IBM */
484         { USB_VPI(USB_VENDOR_TDK, 0x030a, 0) },
485
486         /* ALPS Modules with non-standard ID */
487         { USB_VPI(USB_VENDOR_ALPS, 0x3001, 0) },
488         { USB_VPI(USB_VENDOR_ALPS, 0x3002, 0) },
489
490         { USB_VPI(USB_VENDOR_ERICSSON2, 0x1002, 0) },
491
492         /* Canyon CN-BTU1 with HID interfaces */
493         { USB_VPI(USB_VENDOR_CANYON, 0x0000, 0) },
494
495         /* Broadcom BCM20702A0 */
496         { USB_VPI(USB_VENDOR_ASUS, 0x17b5, 0) },
497         { USB_VPI(USB_VENDOR_ASUS, 0x17cb, 0) },
498         { USB_VPI(USB_VENDOR_LITEON, 0x2003, 0) },
499         { USB_VPI(USB_VENDOR_FOXCONN, 0xe042, 0) },
500         { USB_VPI(USB_VENDOR_DELL, 0x8197, 0) },
501 };
502
503 /*
504  * Probe for a USB Bluetooth device.
505  * USB context.
506  */
507
508 static int
509 ubt_probe(device_t dev)
510 {
511         struct usb_attach_arg   *uaa = device_get_ivars(dev);
512         int error;
513
514         if (uaa->usb_mode != USB_MODE_HOST)
515                 return (ENXIO);
516
517         if (uaa->info.bIfaceIndex != 0)
518                 return (ENXIO);
519
520         if (usbd_lookup_id_by_uaa(ubt_ignore_devs,
521                         sizeof(ubt_ignore_devs), uaa) == 0)
522                 return (ENXIO);
523
524         error = usbd_lookup_id_by_uaa(ubt_devs, sizeof(ubt_devs), uaa);
525         if (error == 0)
526                 return (BUS_PROBE_GENERIC);
527         return (error);
528 } /* ubt_probe */
529
530 /*
531  * Attach the device.
532  * USB context.
533  */
534
535 static int
536 ubt_attach(device_t dev)
537 {
538         struct usb_attach_arg           *uaa = device_get_ivars(dev);
539         struct ubt_softc                *sc = device_get_softc(dev);
540         struct usb_endpoint_descriptor  *ed;
541         struct usb_interface_descriptor *id;
542         struct usb_interface            *iface;
543         uint16_t                        wMaxPacketSize;
544         uint8_t                         alt_index, i, j;
545         uint8_t                         iface_index[2] = { 0, 1 };
546
547         device_set_usb_desc(dev);
548
549         sc->sc_dev = dev;
550         sc->sc_debug = NG_UBT_WARN_LEVEL;
551
552         /* 
553          * Create Netgraph node
554          */
555
556         if (ng_make_node_common(&typestruct, &sc->sc_node) != 0) {
557                 UBT_ALERT(sc, "could not create Netgraph node\n");
558                 return (ENXIO);
559         }
560
561         /* Name Netgraph node */
562         if (ng_name_node(sc->sc_node, device_get_nameunit(dev)) != 0) {
563                 UBT_ALERT(sc, "could not name Netgraph node\n");
564                 NG_NODE_UNREF(sc->sc_node);
565                 return (ENXIO);
566         }
567         NG_NODE_SET_PRIVATE(sc->sc_node, sc);
568         NG_NODE_FORCE_WRITER(sc->sc_node);
569
570         /*
571          * Initialize device softc structure
572          */
573
574         /* initialize locks */
575         mtx_init(&sc->sc_ng_mtx, "ubt ng", NULL, MTX_DEF);
576         mtx_init(&sc->sc_if_mtx, "ubt if", NULL, MTX_DEF | MTX_RECURSE);
577
578         /* initialize packet queues */
579         NG_BT_MBUFQ_INIT(&sc->sc_cmdq, UBT_DEFAULT_QLEN);
580         NG_BT_MBUFQ_INIT(&sc->sc_aclq, UBT_DEFAULT_QLEN);
581         NG_BT_MBUFQ_INIT(&sc->sc_scoq, UBT_DEFAULT_QLEN);
582
583         /* initialize glue task */
584         TASK_INIT(&sc->sc_task, 0, ubt_task, sc);
585
586         /*
587          * Configure Bluetooth USB device. Discover all required USB
588          * interfaces and endpoints.
589          *
590          * USB device must present two interfaces:
591          * 1) Interface 0 that has 3 endpoints
592          *      1) Interrupt endpoint to receive HCI events
593          *      2) Bulk IN endpoint to receive ACL data
594          *      3) Bulk OUT endpoint to send ACL data
595          *
596          * 2) Interface 1 then has 2 endpoints
597          *      1) Isochronous IN endpoint to receive SCO data
598          *      2) Isochronous OUT endpoint to send SCO data
599          *
600          * Interface 1 (with isochronous endpoints) has several alternate
601          * configurations with different packet size.
602          */
603
604         /*
605          * For interface #1 search alternate settings, and find
606          * the descriptor with the largest wMaxPacketSize
607          */
608
609         wMaxPacketSize = 0;
610         alt_index = 0;
611         i = 0;
612         j = 0;
613         ed = NULL;
614
615         /* 
616          * Search through all the descriptors looking for the largest
617          * packet size:
618          */
619         while ((ed = (struct usb_endpoint_descriptor *)usb_desc_foreach(
620             usbd_get_config_descriptor(uaa->device), 
621             (struct usb_descriptor *)ed))) {
622
623                 if ((ed->bDescriptorType == UDESC_INTERFACE) &&
624                     (ed->bLength >= sizeof(*id))) {
625                         id = (struct usb_interface_descriptor *)ed;
626                         i = id->bInterfaceNumber;
627                         j = id->bAlternateSetting;
628                 }
629
630                 if ((ed->bDescriptorType == UDESC_ENDPOINT) &&
631                     (ed->bLength >= sizeof(*ed)) &&
632                     (i == 1)) {
633                         uint16_t temp;
634
635                         temp = UGETW(ed->wMaxPacketSize);
636                         if (temp > wMaxPacketSize) {
637                                 wMaxPacketSize = temp;
638                                 alt_index = j;
639                         }
640                 }
641         }
642
643         /* Set alt configuration on interface #1 only if we found it */
644         if (wMaxPacketSize > 0 &&
645             usbd_set_alt_interface_index(uaa->device, 1, alt_index)) {
646                 UBT_ALERT(sc, "could not set alternate setting %d " \
647                         "for interface 1!\n", alt_index);
648                 goto detach;
649         }
650
651         /* Setup transfers for both interfaces */
652         if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer,
653                         ubt_config, UBT_N_TRANSFER, sc, &sc->sc_if_mtx)) {
654                 UBT_ALERT(sc, "could not allocate transfers\n");
655                 goto detach;
656         }
657
658         /* Claim all interfaces belonging to the Bluetooth part */
659         for (i = 1;; i++) {
660                 iface = usbd_get_iface(uaa->device, i);
661                 if (iface == NULL)
662                         break;
663                 id = usbd_get_interface_descriptor(iface);
664
665                 if ((id != NULL) &&
666                     (id->bInterfaceClass == UICLASS_WIRELESS) &&
667                     (id->bInterfaceSubClass == UISUBCLASS_RF) &&
668                     (id->bInterfaceProtocol == UIPROTO_BLUETOOTH)) {
669                         usbd_set_parent_iface(uaa->device, i,
670                             uaa->info.bIfaceIndex);
671                 }
672         }
673         return (0); /* success */
674
675 detach:
676         ubt_detach(dev);
677
678         return (ENXIO);
679 } /* ubt_attach */
680
681 /*
682  * Detach the device.
683  * USB context.
684  */
685
686 int
687 ubt_detach(device_t dev)
688 {
689         struct ubt_softc        *sc = device_get_softc(dev);
690         node_p                  node = sc->sc_node;
691
692         /* Destroy Netgraph node */
693         if (node != NULL) {
694                 sc->sc_node = NULL;
695                 NG_NODE_REALLY_DIE(node);
696                 ng_rmnode_self(node);
697         }
698
699         /* Make sure ubt_task in gone */
700         taskqueue_drain(taskqueue_swi, &sc->sc_task);
701
702         /* Free USB transfers, if any */
703         usbd_transfer_unsetup(sc->sc_xfer, UBT_N_TRANSFER);
704
705         /* Destroy queues */
706         UBT_NG_LOCK(sc);
707         NG_BT_MBUFQ_DESTROY(&sc->sc_cmdq);
708         NG_BT_MBUFQ_DESTROY(&sc->sc_aclq);
709         NG_BT_MBUFQ_DESTROY(&sc->sc_scoq);
710         UBT_NG_UNLOCK(sc);
711
712         mtx_destroy(&sc->sc_if_mtx);
713         mtx_destroy(&sc->sc_ng_mtx);
714
715         return (0);
716 } /* ubt_detach */
717
718 /* 
719  * Called when outgoing control request (HCI command) has completed, i.e.
720  * HCI command was sent to the device.
721  * USB context.
722  */
723
724 static void
725 ubt_ctrl_write_callback(struct usb_xfer *xfer, usb_error_t error)
726 {
727         struct ubt_softc                *sc = usbd_xfer_softc(xfer);
728         struct usb_device_request       req;
729         struct mbuf                     *m;
730         struct usb_page_cache           *pc;
731         int                             actlen;
732
733         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
734
735         switch (USB_GET_STATE(xfer)) {
736         case USB_ST_TRANSFERRED:
737                 UBT_INFO(sc, "sent %d bytes to control pipe\n", actlen);
738                 UBT_STAT_BYTES_SENT(sc, actlen);
739                 UBT_STAT_PCKTS_SENT(sc);
740                 /* FALLTHROUGH */
741
742         case USB_ST_SETUP:
743 send_next:
744                 /* Get next command mbuf, if any */
745                 UBT_NG_LOCK(sc);
746                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_cmdq, m);
747                 UBT_NG_UNLOCK(sc);
748
749                 if (m == NULL) {
750                         UBT_INFO(sc, "HCI command queue is empty\n");
751                         break;  /* transfer complete */
752                 }
753
754                 /* Initialize a USB control request and then schedule it */
755                 bzero(&req, sizeof(req));
756                 req.bmRequestType = UBT_HCI_REQUEST;
757                 USETW(req.wLength, m->m_pkthdr.len);
758
759                 UBT_INFO(sc, "Sending control request, " \
760                         "bmRequestType=0x%02x, wLength=%d\n",
761                         req.bmRequestType, UGETW(req.wLength));
762
763                 pc = usbd_xfer_get_frame(xfer, 0);
764                 usbd_copy_in(pc, 0, &req, sizeof(req));
765                 pc = usbd_xfer_get_frame(xfer, 1);
766                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
767
768                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
769                 usbd_xfer_set_frame_len(xfer, 1, m->m_pkthdr.len);
770                 usbd_xfer_set_frames(xfer, 2);
771
772                 NG_FREE_M(m);
773
774                 usbd_transfer_submit(xfer);
775                 break;
776
777         default: /* Error */
778                 if (error != USB_ERR_CANCELLED) {
779                         UBT_WARN(sc, "control transfer failed: %s\n",
780                                 usbd_errstr(error));
781
782                         UBT_STAT_OERROR(sc);
783                         goto send_next;
784                 }
785
786                 /* transfer cancelled */
787                 break;
788         }
789 } /* ubt_ctrl_write_callback */
790
791 /* 
792  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
793  * HCI event was received from the device.
794  * USB context.
795  */
796
797 static void
798 ubt_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
799 {
800         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
801         struct mbuf             *m;
802         ng_hci_event_pkt_t      *hdr;
803         struct usb_page_cache   *pc;
804         int                     actlen;
805
806         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
807
808         m = NULL;
809
810         switch (USB_GET_STATE(xfer)) {
811         case USB_ST_TRANSFERRED:
812                 /* Allocate a new mbuf */
813                 MGETHDR(m, M_NOWAIT, MT_DATA);
814                 if (m == NULL) {
815                         UBT_STAT_IERROR(sc);
816                         goto submit_next;
817                 }
818
819                 MCLGET(m, M_NOWAIT);
820                 if (!(m->m_flags & M_EXT)) {
821                         UBT_STAT_IERROR(sc);
822                         goto submit_next;
823                 }
824
825                 /* Add HCI packet type */
826                 *mtod(m, uint8_t *)= NG_HCI_EVENT_PKT;
827                 m->m_pkthdr.len = m->m_len = 1;
828
829                 if (actlen > MCLBYTES - 1)
830                         actlen = MCLBYTES - 1;
831
832                 pc = usbd_xfer_get_frame(xfer, 0);
833                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
834                 m->m_pkthdr.len += actlen;
835                 m->m_len += actlen;
836
837                 UBT_INFO(sc, "got %d bytes from interrupt pipe\n",
838                         actlen);
839
840                 /* Validate packet and send it up the stack */
841                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
842                         UBT_INFO(sc, "HCI event packet is too short\n");
843
844                         UBT_STAT_IERROR(sc);
845                         goto submit_next;
846                 }
847
848                 hdr = mtod(m, ng_hci_event_pkt_t *);
849                 if (hdr->length != (m->m_pkthdr.len - sizeof(*hdr))) {
850                         UBT_ERR(sc, "Invalid HCI event packet size, " \
851                                 "length=%d, pktlen=%d\n",
852                                 hdr->length, m->m_pkthdr.len);
853
854                         UBT_STAT_IERROR(sc);
855                         goto submit_next;
856                 }
857
858                 UBT_INFO(sc, "got complete HCI event frame, pktlen=%d, " \
859                         "length=%d\n", m->m_pkthdr.len, hdr->length);
860
861                 UBT_STAT_PCKTS_RECV(sc);
862                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
863
864                 ubt_fwd_mbuf_up(sc, &m);
865                 /* m == NULL at this point */
866                 /* FALLTHROUGH */
867
868         case USB_ST_SETUP:
869 submit_next:
870                 NG_FREE_M(m); /* checks for m != NULL */
871
872                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
873                 usbd_transfer_submit(xfer);
874                 break;
875
876         default: /* Error */
877                 if (error != USB_ERR_CANCELLED) {
878                         UBT_WARN(sc, "interrupt transfer failed: %s\n",
879                                 usbd_errstr(error));
880
881                         /* Try to clear stall first */
882                         usbd_xfer_set_stall(xfer);
883                         goto submit_next;
884                 }
885                         /* transfer cancelled */
886                 break;
887         }
888 } /* ubt_intr_read_callback */
889
890 /*
891  * Called when incoming bulk transfer (ACL packet) has completed, i.e.
892  * ACL packet was received from the device.
893  * USB context.
894  */
895
896 static void
897 ubt_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
898 {
899         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
900         struct mbuf             *m;
901         ng_hci_acldata_pkt_t    *hdr;
902         struct usb_page_cache   *pc;
903         int len;
904         int actlen;
905
906         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
907
908         m = NULL;
909
910         switch (USB_GET_STATE(xfer)) {
911         case USB_ST_TRANSFERRED:
912                 /* Allocate new mbuf */
913                 MGETHDR(m, M_NOWAIT, MT_DATA);
914                 if (m == NULL) {
915                         UBT_STAT_IERROR(sc);
916                         goto submit_next;
917                 }
918
919                 MCLGET(m, M_NOWAIT);
920                 if (!(m->m_flags & M_EXT)) {
921                         UBT_STAT_IERROR(sc);
922                         goto submit_next;
923                 }
924
925                 /* Add HCI packet type */
926                 *mtod(m, uint8_t *)= NG_HCI_ACL_DATA_PKT;
927                 m->m_pkthdr.len = m->m_len = 1;
928
929                 if (actlen > MCLBYTES - 1)
930                         actlen = MCLBYTES - 1;
931
932                 pc = usbd_xfer_get_frame(xfer, 0);
933                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
934                 m->m_pkthdr.len += actlen;
935                 m->m_len += actlen;
936
937                 UBT_INFO(sc, "got %d bytes from bulk-in pipe\n",
938                         actlen);
939
940                 /* Validate packet and send it up the stack */
941                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
942                         UBT_INFO(sc, "HCI ACL packet is too short\n");
943
944                         UBT_STAT_IERROR(sc);
945                         goto submit_next;
946                 }
947
948                 hdr = mtod(m, ng_hci_acldata_pkt_t *);
949                 len = le16toh(hdr->length);
950                 if (len != (int)(m->m_pkthdr.len - sizeof(*hdr))) {
951                         UBT_ERR(sc, "Invalid ACL packet size, length=%d, " \
952                                 "pktlen=%d\n", len, m->m_pkthdr.len);
953
954                         UBT_STAT_IERROR(sc);
955                         goto submit_next;
956                 }
957
958                 UBT_INFO(sc, "got complete ACL data packet, pktlen=%d, " \
959                         "length=%d\n", m->m_pkthdr.len, len);
960
961                 UBT_STAT_PCKTS_RECV(sc);
962                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
963
964                 ubt_fwd_mbuf_up(sc, &m);
965                 /* m == NULL at this point */
966                 /* FALLTHOUGH */
967
968         case USB_ST_SETUP:
969 submit_next:
970                 NG_FREE_M(m); /* checks for m != NULL */
971
972                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
973                 usbd_transfer_submit(xfer);
974                 break;
975
976         default: /* Error */
977                 if (error != USB_ERR_CANCELLED) {
978                         UBT_WARN(sc, "bulk-in transfer failed: %s\n",
979                                 usbd_errstr(error));
980
981                         /* Try to clear stall first */
982                         usbd_xfer_set_stall(xfer);
983                         goto submit_next;
984                 }
985                         /* transfer cancelled */
986                 break;
987         }
988 } /* ubt_bulk_read_callback */
989
990 /*
991  * Called when outgoing bulk transfer (ACL packet) has completed, i.e.
992  * ACL packet was sent to the device.
993  * USB context.
994  */
995
996 static void
997 ubt_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
998 {
999         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1000         struct mbuf             *m;
1001         struct usb_page_cache   *pc;
1002         int                     actlen;
1003
1004         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1005
1006         switch (USB_GET_STATE(xfer)) {
1007         case USB_ST_TRANSFERRED:
1008                 UBT_INFO(sc, "sent %d bytes to bulk-out pipe\n", actlen);
1009                 UBT_STAT_BYTES_SENT(sc, actlen);
1010                 UBT_STAT_PCKTS_SENT(sc);
1011                 /* FALLTHROUGH */
1012
1013         case USB_ST_SETUP:
1014 send_next:
1015                 /* Get next mbuf, if any */
1016                 UBT_NG_LOCK(sc);
1017                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_aclq, m);
1018                 UBT_NG_UNLOCK(sc);
1019
1020                 if (m == NULL) {
1021                         UBT_INFO(sc, "ACL data queue is empty\n");
1022                         break; /* transfer completed */
1023                 }
1024
1025                 /*
1026                  * Copy ACL data frame back to a linear USB transfer buffer
1027                  * and schedule transfer
1028                  */
1029
1030                 pc = usbd_xfer_get_frame(xfer, 0);
1031                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
1032                 usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
1033
1034                 UBT_INFO(sc, "bulk-out transfer has been started, len=%d\n",
1035                         m->m_pkthdr.len);
1036
1037                 NG_FREE_M(m);
1038
1039                 usbd_transfer_submit(xfer);
1040                 break;
1041
1042         default: /* Error */
1043                 if (error != USB_ERR_CANCELLED) {
1044                         UBT_WARN(sc, "bulk-out transfer failed: %s\n",
1045                                 usbd_errstr(error));
1046
1047                         UBT_STAT_OERROR(sc);
1048
1049                         /* try to clear stall first */
1050                         usbd_xfer_set_stall(xfer);
1051                         goto send_next;
1052                 }
1053                         /* transfer cancelled */
1054                 break;
1055         }
1056 } /* ubt_bulk_write_callback */
1057
1058 /*
1059  * Called when incoming isoc transfer (SCO packet) has completed, i.e.
1060  * SCO packet was received from the device.
1061  * USB context.
1062  */
1063
1064 static void
1065 ubt_isoc_read_callback(struct usb_xfer *xfer, usb_error_t error)
1066 {
1067         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1068         int                     n;
1069         int actlen, nframes;
1070
1071         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1072
1073         switch (USB_GET_STATE(xfer)) {
1074         case USB_ST_TRANSFERRED:
1075                 for (n = 0; n < nframes; n ++)
1076                         if (ubt_isoc_read_one_frame(xfer, n) < 0)
1077                                 break;
1078                 /* FALLTHROUGH */
1079
1080         case USB_ST_SETUP:
1081 read_next:
1082                 for (n = 0; n < nframes; n ++)
1083                         usbd_xfer_set_frame_len(xfer, n,
1084                             usbd_xfer_max_framelen(xfer));
1085
1086                 usbd_transfer_submit(xfer);
1087                 break;
1088
1089         default: /* Error */
1090                 if (error != USB_ERR_CANCELLED) {
1091                         UBT_STAT_IERROR(sc);
1092                         goto read_next;
1093                 }
1094
1095                 /* transfer cancelled */
1096                 break;
1097         }
1098 } /* ubt_isoc_read_callback */
1099
1100 /*
1101  * Helper function. Called from ubt_isoc_read_callback() to read
1102  * SCO data from one frame.
1103  * USB context.
1104  */
1105
1106 static int
1107 ubt_isoc_read_one_frame(struct usb_xfer *xfer, int frame_no)
1108 {
1109         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1110         struct usb_page_cache   *pc;
1111         struct mbuf             *m;
1112         int                     len, want, got, total;
1113
1114         /* Get existing SCO reassembly buffer */
1115         pc = usbd_xfer_get_frame(xfer, 0);
1116         m = sc->sc_isoc_in_buffer;
1117         total = usbd_xfer_frame_len(xfer, frame_no);
1118
1119         /* While we have data in the frame */
1120         while (total > 0) {
1121                 if (m == NULL) {
1122                         /* Start new reassembly buffer */
1123                         MGETHDR(m, M_NOWAIT, MT_DATA);
1124                         if (m == NULL) {
1125                                 UBT_STAT_IERROR(sc);
1126                                 return (-1);    /* XXX out of sync! */
1127                         }
1128
1129                         MCLGET(m, M_NOWAIT);
1130                         if (!(m->m_flags & M_EXT)) {
1131                                 UBT_STAT_IERROR(sc);
1132                                 NG_FREE_M(m);
1133                                 return (-1);    /* XXX out of sync! */
1134                         }
1135
1136                         /* Expect SCO header */
1137                         *mtod(m, uint8_t *) = NG_HCI_SCO_DATA_PKT;
1138                         m->m_pkthdr.len = m->m_len = got = 1;
1139                         want = sizeof(ng_hci_scodata_pkt_t);
1140                 } else {
1141                         /*
1142                          * Check if we have SCO header and if so 
1143                          * adjust amount of data we want
1144                          */
1145                         got = m->m_pkthdr.len;
1146                         want = sizeof(ng_hci_scodata_pkt_t);
1147
1148                         if (got >= want)
1149                                 want += mtod(m, ng_hci_scodata_pkt_t *)->length;
1150                 }
1151
1152                 /* Append frame data to the SCO reassembly buffer */
1153                 len = total;
1154                 if (got + len > want)
1155                         len = want - got;
1156
1157                 usbd_copy_out(pc, frame_no * usbd_xfer_max_framelen(xfer),
1158                         mtod(m, uint8_t *) + m->m_pkthdr.len, len);
1159
1160                 m->m_pkthdr.len += len;
1161                 m->m_len += len;
1162                 total -= len;
1163
1164                 /* Check if we got everything we wanted, if not - continue */
1165                 if (got != want)
1166                         continue;
1167
1168                 /* If we got here then we got complete SCO frame */
1169                 UBT_INFO(sc, "got complete SCO data frame, pktlen=%d, " \
1170                         "length=%d\n", m->m_pkthdr.len,
1171                         mtod(m, ng_hci_scodata_pkt_t *)->length);
1172
1173                 UBT_STAT_PCKTS_RECV(sc);
1174                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1175
1176                 ubt_fwd_mbuf_up(sc, &m);
1177                 /* m == NULL at this point */
1178         }
1179
1180         /* Put SCO reassembly buffer back */
1181         sc->sc_isoc_in_buffer = m;
1182
1183         return (0);
1184 } /* ubt_isoc_read_one_frame */
1185
1186 /*
1187  * Called when outgoing isoc transfer (SCO packet) has completed, i.e.
1188  * SCO packet was sent to the device.
1189  * USB context.
1190  */
1191
1192 static void
1193 ubt_isoc_write_callback(struct usb_xfer *xfer, usb_error_t error)
1194 {
1195         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1196         struct usb_page_cache   *pc;
1197         struct mbuf             *m;
1198         int                     n, space, offset;
1199         int                     actlen, nframes;
1200
1201         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1202         pc = usbd_xfer_get_frame(xfer, 0);
1203
1204         switch (USB_GET_STATE(xfer)) {
1205         case USB_ST_TRANSFERRED:
1206                 UBT_INFO(sc, "sent %d bytes to isoc-out pipe\n", actlen);
1207                 UBT_STAT_BYTES_SENT(sc, actlen);
1208                 UBT_STAT_PCKTS_SENT(sc);
1209                 /* FALLTHROUGH */
1210
1211         case USB_ST_SETUP:
1212 send_next:
1213                 offset = 0;
1214                 space = usbd_xfer_max_framelen(xfer) * nframes;
1215                 m = NULL;
1216
1217                 while (space > 0) {
1218                         if (m == NULL) {
1219                                 UBT_NG_LOCK(sc);
1220                                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_scoq, m);
1221                                 UBT_NG_UNLOCK(sc);
1222
1223                                 if (m == NULL)
1224                                         break;
1225                         }
1226
1227                         n = min(space, m->m_pkthdr.len);
1228                         if (n > 0) {
1229                                 usbd_m_copy_in(pc, offset, m,0, n);
1230                                 m_adj(m, n);
1231
1232                                 offset += n;
1233                                 space -= n;
1234                         }
1235
1236                         if (m->m_pkthdr.len == 0)
1237                                 NG_FREE_M(m); /* sets m = NULL */
1238                 }
1239
1240                 /* Put whatever is left from mbuf back on queue */
1241                 if (m != NULL) {
1242                         UBT_NG_LOCK(sc);
1243                         NG_BT_MBUFQ_PREPEND(&sc->sc_scoq, m);
1244                         UBT_NG_UNLOCK(sc);
1245                 }
1246
1247                 /*
1248                  * Calculate sizes for isoc frames.
1249                  * Note that offset could be 0 at this point (i.e. we have
1250                  * nothing to send). That is fine, as we have isoc. transfers
1251                  * going in both directions all the time. In this case it
1252                  * would be just empty isoc. transfer.
1253                  */
1254
1255                 for (n = 0; n < nframes; n ++) {
1256                         usbd_xfer_set_frame_len(xfer, n,
1257                             min(offset, usbd_xfer_max_framelen(xfer)));
1258                         offset -= usbd_xfer_frame_len(xfer, n);
1259                 }
1260
1261                 usbd_transfer_submit(xfer);
1262                 break;
1263
1264         default: /* Error */
1265                 if (error != USB_ERR_CANCELLED) {
1266                         UBT_STAT_OERROR(sc);
1267                         goto send_next;
1268                 }
1269
1270                 /* transfer cancelled */
1271                 break;
1272         }
1273 }
1274
1275 /*
1276  * Utility function to forward provided mbuf upstream (i.e. up the stack).
1277  * Modifies value of the mbuf pointer (sets it to NULL).
1278  * Save to call from any context.
1279  */
1280
1281 static int
1282 ubt_fwd_mbuf_up(ubt_softc_p sc, struct mbuf **m)
1283 {
1284         hook_p  hook;
1285         int     error;
1286
1287         /*
1288          * Close the race with Netgraph hook newhook/disconnect methods.
1289          * Save the hook pointer atomically. Two cases are possible:
1290          *
1291          * 1) The hook pointer is NULL. It means disconnect method got
1292          *    there first. In this case we are done.
1293          *
1294          * 2) The hook pointer is not NULL. It means that hook pointer
1295          *    could be either in valid or invalid (i.e. in the process
1296          *    of disconnect) state. In any case grab an extra reference
1297          *    to protect the hook pointer.
1298          *
1299          * It is ok to pass hook in invalid state to NG_SEND_DATA_ONLY() as
1300          * it checks for it. Drop extra reference after NG_SEND_DATA_ONLY().
1301          */
1302
1303         UBT_NG_LOCK(sc);
1304         if ((hook = sc->sc_hook) != NULL)
1305                 NG_HOOK_REF(hook);
1306         UBT_NG_UNLOCK(sc);
1307
1308         if (hook == NULL) {
1309                 NG_FREE_M(*m);
1310                 return (ENETDOWN);
1311         }
1312
1313         NG_SEND_DATA_ONLY(error, hook, *m);
1314         NG_HOOK_UNREF(hook);
1315
1316         if (error != 0)
1317                 UBT_STAT_IERROR(sc);
1318
1319         return (error);
1320 } /* ubt_fwd_mbuf_up */
1321
1322 /****************************************************************************
1323  ****************************************************************************
1324  **                                 Glue 
1325  ****************************************************************************
1326  ****************************************************************************/
1327
1328 /*
1329  * Schedule glue task. Should be called with sc_ng_mtx held. 
1330  * Netgraph context.
1331  */
1332
1333 static void
1334 ubt_task_schedule(ubt_softc_p sc, int action)
1335 {
1336         mtx_assert(&sc->sc_ng_mtx, MA_OWNED);
1337
1338         /*
1339          * Try to handle corner case when "start all" and "stop all"
1340          * actions can both be set before task is executed.
1341          *
1342          * The rules are
1343          *
1344          * sc_task_flags        action          new sc_task_flags
1345          * ------------------------------------------------------
1346          * 0                    start           start
1347          * 0                    stop            stop
1348          * start                start           start
1349          * start                stop            stop
1350          * stop                 start           stop|start
1351          * stop                 stop            stop
1352          * stop|start           start           stop|start
1353          * stop|start           stop            stop
1354          */
1355
1356         if (action != 0) {
1357                 if ((action & UBT_FLAG_T_STOP_ALL) != 0)
1358                         sc->sc_task_flags &= ~UBT_FLAG_T_START_ALL;
1359
1360                 sc->sc_task_flags |= action;
1361         }
1362
1363         if (sc->sc_task_flags & UBT_FLAG_T_PENDING)
1364                 return;
1365
1366         if (taskqueue_enqueue(taskqueue_swi, &sc->sc_task) == 0) {
1367                 sc->sc_task_flags |= UBT_FLAG_T_PENDING;
1368                 return;
1369         }
1370
1371         /* XXX: i think this should never happen */
1372 } /* ubt_task_schedule */
1373
1374 /*
1375  * Glue task. Examines sc_task_flags and does things depending on it.
1376  * Taskqueue context.
1377  */
1378
1379 static void
1380 ubt_task(void *context, int pending)
1381 {
1382         ubt_softc_p     sc = context;
1383         int             task_flags, i;
1384
1385         UBT_NG_LOCK(sc);
1386         task_flags = sc->sc_task_flags;
1387         sc->sc_task_flags = 0;
1388         UBT_NG_UNLOCK(sc);
1389
1390         /*
1391          * Stop all USB transfers synchronously.
1392          * Stop interface #0 and #1 transfers at the same time and in the
1393          * same loop. usbd_transfer_drain() will do appropriate locking.
1394          */
1395
1396         if (task_flags & UBT_FLAG_T_STOP_ALL)
1397                 for (i = 0; i < UBT_N_TRANSFER; i ++)
1398                         usbd_transfer_drain(sc->sc_xfer[i]);
1399
1400         /* Start incoming interrupt and bulk, and all isoc. USB transfers */
1401         if (task_flags & UBT_FLAG_T_START_ALL) {
1402                 /*
1403                  * Interface #0
1404                  */
1405
1406                 mtx_lock(&sc->sc_if_mtx);
1407
1408                 ubt_xfer_start(sc, UBT_IF_0_INTR_DT_RD);
1409                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_RD);
1410
1411                 /*
1412                  * Interface #1
1413                  * Start both read and write isoc. transfers by default.
1414                  * Get them going all the time even if we have nothing
1415                  * to send to avoid any delays.
1416                  */
1417
1418                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD1);
1419                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD2);
1420                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR1);
1421                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR2);
1422
1423                 mtx_unlock(&sc->sc_if_mtx);
1424         }
1425
1426         /* Start outgoing control transfer */
1427         if (task_flags & UBT_FLAG_T_START_CTRL) {
1428                 mtx_lock(&sc->sc_if_mtx);
1429                 ubt_xfer_start(sc, UBT_IF_0_CTRL_DT_WR);
1430                 mtx_unlock(&sc->sc_if_mtx);
1431         }
1432
1433         /* Start outgoing bulk transfer */
1434         if (task_flags & UBT_FLAG_T_START_BULK) {
1435                 mtx_lock(&sc->sc_if_mtx);
1436                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_WR);
1437                 mtx_unlock(&sc->sc_if_mtx);
1438         }
1439 } /* ubt_task */
1440
1441 /****************************************************************************
1442  ****************************************************************************
1443  **                        Netgraph specific
1444  ****************************************************************************
1445  ****************************************************************************/
1446
1447 /*
1448  * Netgraph node constructor. Do not allow to create node of this type.
1449  * Netgraph context.
1450  */
1451
1452 static int
1453 ng_ubt_constructor(node_p node)
1454 {
1455         return (EINVAL);
1456 } /* ng_ubt_constructor */
1457
1458 /*
1459  * Netgraph node destructor. Destroy node only when device has been detached.
1460  * Netgraph context.
1461  */
1462
1463 static int
1464 ng_ubt_shutdown(node_p node)
1465 {
1466         if (node->nd_flags & NGF_REALLY_DIE) {
1467                 /*
1468                  * We came here because the USB device is being
1469                  * detached, so stop being persistant.
1470                  */
1471                 NG_NODE_SET_PRIVATE(node, NULL);
1472                 NG_NODE_UNREF(node);
1473         } else
1474                 NG_NODE_REVIVE(node); /* tell ng_rmnode we are persisant */
1475
1476         return (0);
1477 } /* ng_ubt_shutdown */
1478
1479 /*
1480  * Create new hook. There can only be one.
1481  * Netgraph context.
1482  */
1483
1484 static int
1485 ng_ubt_newhook(node_p node, hook_p hook, char const *name)
1486 {
1487         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1488
1489         if (strcmp(name, NG_UBT_HOOK) != 0)
1490                 return (EINVAL);
1491
1492         UBT_NG_LOCK(sc);
1493         if (sc->sc_hook != NULL) {
1494                 UBT_NG_UNLOCK(sc);
1495
1496                 return (EISCONN);
1497         }
1498
1499         sc->sc_hook = hook;
1500         UBT_NG_UNLOCK(sc);
1501
1502         return (0);
1503 } /* ng_ubt_newhook */
1504
1505 /*
1506  * Connect hook. Start incoming USB transfers.
1507  * Netgraph context.
1508  */
1509
1510 static int
1511 ng_ubt_connect(hook_p hook)
1512 {
1513         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1514
1515         NG_HOOK_FORCE_QUEUE(NG_HOOK_PEER(hook));
1516
1517         UBT_NG_LOCK(sc);
1518         ubt_task_schedule(sc, UBT_FLAG_T_START_ALL);
1519         UBT_NG_UNLOCK(sc);
1520
1521         return (0);
1522 } /* ng_ubt_connect */
1523
1524 /*
1525  * Disconnect hook.
1526  * Netgraph context.
1527  */
1528
1529 static int
1530 ng_ubt_disconnect(hook_p hook)
1531 {
1532         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1533
1534         UBT_NG_LOCK(sc);
1535
1536         if (hook != sc->sc_hook) {
1537                 UBT_NG_UNLOCK(sc);
1538
1539                 return (EINVAL);
1540         }
1541
1542         sc->sc_hook = NULL;
1543
1544         /* Kick off task to stop all USB xfers */
1545         ubt_task_schedule(sc, UBT_FLAG_T_STOP_ALL);
1546
1547         /* Drain queues */
1548         NG_BT_MBUFQ_DRAIN(&sc->sc_cmdq);
1549         NG_BT_MBUFQ_DRAIN(&sc->sc_aclq);
1550         NG_BT_MBUFQ_DRAIN(&sc->sc_scoq);
1551
1552         UBT_NG_UNLOCK(sc);
1553
1554         return (0);
1555 } /* ng_ubt_disconnect */
1556         
1557 /*
1558  * Process control message.
1559  * Netgraph context.
1560  */
1561
1562 static int
1563 ng_ubt_rcvmsg(node_p node, item_p item, hook_p lasthook)
1564 {
1565         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1566         struct ng_mesg          *msg, *rsp = NULL;
1567         struct ng_bt_mbufq      *q;
1568         int                     error = 0, queue, qlen;
1569
1570         NGI_GET_MSG(item, msg);
1571
1572         switch (msg->header.typecookie) {
1573         case NGM_GENERIC_COOKIE:
1574                 switch (msg->header.cmd) {
1575                 case NGM_TEXT_STATUS:
1576                         NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
1577                         if (rsp == NULL) {
1578                                 error = ENOMEM;
1579                                 break;
1580                         }
1581
1582                         snprintf(rsp->data, NG_TEXTRESPONSE,
1583                                 "Hook: %s\n" \
1584                                 "Task flags: %#x\n" \
1585                                 "Debug: %d\n" \
1586                                 "CMD queue: [have:%d,max:%d]\n" \
1587                                 "ACL queue: [have:%d,max:%d]\n" \
1588                                 "SCO queue: [have:%d,max:%d]",
1589                                 (sc->sc_hook != NULL) ? NG_UBT_HOOK : "",
1590                                 sc->sc_task_flags,
1591                                 sc->sc_debug,
1592                                 sc->sc_cmdq.len,
1593                                 sc->sc_cmdq.maxlen,
1594                                 sc->sc_aclq.len,
1595                                 sc->sc_aclq.maxlen,
1596                                 sc->sc_scoq.len,
1597                                 sc->sc_scoq.maxlen);
1598                         break;
1599
1600                 default:
1601                         error = EINVAL;
1602                         break;
1603                 }
1604                 break;
1605
1606         case NGM_UBT_COOKIE:
1607                 switch (msg->header.cmd) {
1608                 case NGM_UBT_NODE_SET_DEBUG:
1609                         if (msg->header.arglen != sizeof(ng_ubt_node_debug_ep)){
1610                                 error = EMSGSIZE;
1611                                 break;
1612                         }
1613
1614                         sc->sc_debug = *((ng_ubt_node_debug_ep *) (msg->data));
1615                         break;
1616
1617                 case NGM_UBT_NODE_GET_DEBUG:
1618                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_debug_ep),
1619                             M_NOWAIT);
1620                         if (rsp == NULL) {
1621                                 error = ENOMEM;
1622                                 break;
1623                         }
1624
1625                         *((ng_ubt_node_debug_ep *) (rsp->data)) = sc->sc_debug;
1626                         break;
1627
1628                 case NGM_UBT_NODE_SET_QLEN:
1629                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1630                                 error = EMSGSIZE;
1631                                 break;
1632                         }
1633
1634                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1635                         qlen = ((ng_ubt_node_qlen_ep *) (msg->data))->qlen;
1636
1637                         switch (queue) {
1638                         case NGM_UBT_NODE_QUEUE_CMD:
1639                                 q = &sc->sc_cmdq;
1640                                 break;
1641
1642                         case NGM_UBT_NODE_QUEUE_ACL:
1643                                 q = &sc->sc_aclq;
1644                                 break;
1645
1646                         case NGM_UBT_NODE_QUEUE_SCO:
1647                                 q = &sc->sc_scoq;
1648                                 break;
1649
1650                         default:
1651                                 error = EINVAL;
1652                                 goto done;
1653                                 /* NOT REACHED */
1654                         }
1655
1656                         q->maxlen = qlen;
1657                         break;
1658
1659                 case NGM_UBT_NODE_GET_QLEN:
1660                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1661                                 error = EMSGSIZE;
1662                                 break;
1663                         }
1664
1665                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1666
1667                         switch (queue) {
1668                         case NGM_UBT_NODE_QUEUE_CMD:
1669                                 q = &sc->sc_cmdq;
1670                                 break;
1671
1672                         case NGM_UBT_NODE_QUEUE_ACL:
1673                                 q = &sc->sc_aclq;
1674                                 break;
1675
1676                         case NGM_UBT_NODE_QUEUE_SCO:
1677                                 q = &sc->sc_scoq;
1678                                 break;
1679
1680                         default:
1681                                 error = EINVAL;
1682                                 goto done;
1683                                 /* NOT REACHED */
1684                         }
1685
1686                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_qlen_ep),
1687                                 M_NOWAIT);
1688                         if (rsp == NULL) {
1689                                 error = ENOMEM;
1690                                 break;
1691                         }
1692
1693                         ((ng_ubt_node_qlen_ep *) (rsp->data))->queue = queue;
1694                         ((ng_ubt_node_qlen_ep *) (rsp->data))->qlen = q->maxlen;
1695                         break;
1696
1697                 case NGM_UBT_NODE_GET_STAT:
1698                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_stat_ep),
1699                             M_NOWAIT);
1700                         if (rsp == NULL) {
1701                                 error = ENOMEM;
1702                                 break;
1703                         }
1704
1705                         bcopy(&sc->sc_stat, rsp->data,
1706                                 sizeof(ng_ubt_node_stat_ep));
1707                         break;
1708
1709                 case NGM_UBT_NODE_RESET_STAT:
1710                         UBT_STAT_RESET(sc);
1711                         break;
1712
1713                 default:
1714                         error = EINVAL;
1715                         break;
1716                 }
1717                 break;
1718
1719         default:
1720                 error = EINVAL;
1721                 break;
1722         }
1723 done:
1724         NG_RESPOND_MSG(error, node, item, rsp);
1725         NG_FREE_MSG(msg);
1726
1727         return (error);
1728 } /* ng_ubt_rcvmsg */
1729
1730 /*
1731  * Process data.
1732  * Netgraph context.
1733  */
1734
1735 static int
1736 ng_ubt_rcvdata(hook_p hook, item_p item)
1737 {
1738         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1739         struct mbuf             *m;
1740         struct ng_bt_mbufq      *q;
1741         int                     action, error = 0;
1742
1743         if (hook != sc->sc_hook) {
1744                 error = EINVAL;
1745                 goto done;
1746         }
1747
1748         /* Deatch mbuf and get HCI frame type */
1749         NGI_GET_M(item, m);
1750
1751         /*
1752          * Minimal size of the HCI frame is 4 bytes: 1 byte frame type,
1753          * 2 bytes connection handle and at least 1 byte of length.
1754          * Panic on data frame that has size smaller than 4 bytes (it
1755          * should not happen)
1756          */
1757
1758         if (m->m_pkthdr.len < 4)
1759                 panic("HCI frame size is too small! pktlen=%d\n",
1760                         m->m_pkthdr.len);
1761
1762         /* Process HCI frame */
1763         switch (*mtod(m, uint8_t *)) {  /* XXX call m_pullup ? */
1764         case NG_HCI_CMD_PKT:
1765                 if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE)
1766                         panic("HCI command frame size is too big! " \
1767                                 "buffer size=%zd, packet len=%d\n",
1768                                 UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len);
1769
1770                 q = &sc->sc_cmdq;
1771                 action = UBT_FLAG_T_START_CTRL;
1772                 break;
1773
1774         case NG_HCI_ACL_DATA_PKT:
1775                 if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE)
1776                         panic("ACL data frame size is too big! " \
1777                                 "buffer size=%d, packet len=%d\n",
1778                                 UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len);
1779
1780                 q = &sc->sc_aclq;
1781                 action = UBT_FLAG_T_START_BULK;
1782                 break;
1783
1784         case NG_HCI_SCO_DATA_PKT:
1785                 q = &sc->sc_scoq;
1786                 action = 0;
1787                 break;
1788
1789         default:
1790                 UBT_ERR(sc, "Dropping unsupported HCI frame, type=0x%02x, " \
1791                         "pktlen=%d\n", *mtod(m, uint8_t *), m->m_pkthdr.len);
1792
1793                 NG_FREE_M(m);
1794                 error = EINVAL;
1795                 goto done;
1796                 /* NOT REACHED */
1797         }
1798
1799         UBT_NG_LOCK(sc);
1800         if (NG_BT_MBUFQ_FULL(q)) {
1801                 NG_BT_MBUFQ_DROP(q);
1802                 UBT_NG_UNLOCK(sc);
1803                 
1804                 UBT_ERR(sc, "Dropping HCI frame 0x%02x, len=%d. Queue full\n",
1805                         *mtod(m, uint8_t *), m->m_pkthdr.len);
1806
1807                 NG_FREE_M(m);
1808         } else {
1809                 /* Loose HCI packet type, enqueue mbuf and kick off task */
1810                 m_adj(m, sizeof(uint8_t));
1811                 NG_BT_MBUFQ_ENQUEUE(q, m);
1812                 ubt_task_schedule(sc, action);
1813                 UBT_NG_UNLOCK(sc);
1814         }
1815 done:
1816         NG_FREE_ITEM(item);
1817
1818         return (error);
1819 } /* ng_ubt_rcvdata */
1820
1821 /****************************************************************************
1822  ****************************************************************************
1823  **                              Module
1824  ****************************************************************************
1825  ****************************************************************************/
1826
1827 /*
1828  * Load/Unload the driver module
1829  */
1830
1831 static int
1832 ubt_modevent(module_t mod, int event, void *data)
1833 {
1834         int     error;
1835
1836         switch (event) {
1837         case MOD_LOAD:
1838                 error = ng_newtype(&typestruct);
1839                 if (error != 0)
1840                         printf("%s: Could not register Netgraph node type, " \
1841                                 "error=%d\n", NG_UBT_NODE_TYPE, error);
1842                 break;
1843
1844         case MOD_UNLOAD:
1845                 error = ng_rmtype(&typestruct);
1846                 break;
1847
1848         default:
1849                 error = EOPNOTSUPP;
1850                 break;
1851         }
1852
1853         return (error);
1854 } /* ubt_modevent */
1855
1856 static devclass_t       ubt_devclass;
1857
1858 static device_method_t  ubt_methods[] =
1859 {
1860         DEVMETHOD(device_probe, ubt_probe),
1861         DEVMETHOD(device_attach, ubt_attach),
1862         DEVMETHOD(device_detach, ubt_detach),
1863         DEVMETHOD_END
1864 };
1865
1866 static driver_t         ubt_driver =
1867 {
1868         .name =    "ubt",
1869         .methods = ubt_methods,
1870         .size =    sizeof(struct ubt_softc),
1871 };
1872
1873 DRIVER_MODULE(ng_ubt, uhub, ubt_driver, ubt_devclass, ubt_modevent, 0);
1874 MODULE_VERSION(ng_ubt, NG_BLUETOOTH_VERSION);
1875 MODULE_DEPEND(ng_ubt, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
1876 MODULE_DEPEND(ng_ubt, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
1877 MODULE_DEPEND(ng_ubt, usb, 1, 1, 1);
1878