sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c

   1 /*
   2  * ng_ubt.c
   3  */
   4
   5 /*-
   6  * Copyright (c) 2001-2009 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  * $Id: ng_ubt.c,v 1.16 2003/10/10 19:15:06 max Exp $
  31  * $FreeBSD$
  32  */
  33
  34 /*
  35  * NOTE: ng_ubt2 driver has a split personality. On one side it is
  36  * a USB device driver and on the other it is a Netgraph node. This
  37  * driver will *NOT* create traditional /dev/ enties, only Netgraph
  38  * node.
  39  *
  40  * NOTE ON LOCKS USED: ng_ubt2 drives uses 2 locks (mutexes)
  41  *
  42  * 1) sc_if_mtx - lock for device's interface #0 and #1. This lock is used
  43  *    by USB for any USB request going over device's interface #0 and #1,
  44  *    i.e. interrupt, control, bulk and isoc. transfers.
  45  *
  46  * 2) sc_ng_mtx - this lock is used to protect shared (between USB, Netgraph
  47  *    and Taskqueue) data, such as outgoing mbuf queues, task flags and hook
  48  *    pointer. This lock *SHOULD NOT* be grabbed for a long time. In fact,
  49  *    think of it as a spin lock.
  50  *
  51  * NOTE ON LOCKING STRATEGY: ng_ubt2 driver operates in 3 different contexts.
  52  *
  53  * 1) USB context. This is where all the USB related stuff happens. All
  54  *    callbacks run in this context. All callbacks are called (by USB) with
  55  *    appropriate interface lock held. It is (generally) allowed to grab
  56  *    any additional locks.
  57  *
  58  * 2) Netgraph context. This is where all the Netgraph related stuff happens.
  59  *    Since we mark node as WRITER, the Netgraph node will be "locked" (from
  60  *    Netgraph point of view). Any variable that is only modified from the
  61  *    Netgraph context does not require any additonal locking. It is generally
  62  *    *NOT* allowed to grab *ANY* additional locks. Whatever you do, *DO NOT*
  63  *    grab any lock in the Netgraph context that could cause de-scheduling of
  64  *    the Netgraph thread for significant amount of time. In fact, the only
  65  *    lock that is allowed in the Netgraph context is the sc_ng_mtx lock.
  66  *    Also make sure that any code that is called from the Netgraph context
  67  *    follows the rule above.
  68  *
  69  * 3) Taskqueue context. This is where ubt_task runs. Since we are generally
  70  *    NOT allowed to grab any lock that could cause de-scheduling in the
  71  *    Netgraph context, and, USB requires us to grab interface lock before
  72  *    doing things with transfers, it is safer to transition from the Netgraph
  73  *    context to the Taskqueue context before we can call into USB subsystem.
  74  *
  75  * So, to put everything together, the rules are as follows.
  76  *      It is OK to call from the USB context or the Taskqueue context into
  77  * the Netgraph context (i.e. call NG_SEND_xxx functions). In other words
  78  * it is allowed to call into the Netgraph context with locks held.
  79  *      Is it *NOT* OK to call from the Netgraph context into the USB context,
  80  * because USB requires us to grab interface locks, and, it is safer to
  81  * avoid it. So, to make things safer we set task flags to indicate which
  82  * actions we want to perform and schedule ubt_task which would run in the
  83  * Taskqueue context.
  84  *      Is is OK to call from the Taskqueue context into the USB context,
  85  * and, ubt_task does just that (i.e. grabs appropriate interface locks
  86  * before calling into USB).
  87  *      Access to the outgoing queues, task flags and hook pointer is
  88  * controlled by the sc_ng_mtx lock. It is an unavoidable evil. Again,
  89  * sc_ng_mtx should really be a spin lock (and it is very likely to an
  90  * equivalent of spin lock due to adaptive nature of FreeBSD mutexes).
  91  *      All USB callbacks accept softc pointer as a private data. USB ensures
  92  * that this pointer is valid.
  93  */
  94
  95 #include <sys/stdint.h>
  96 #include <sys/stddef.h>
  97 #include <sys/param.h>
  98 #include <sys/queue.h>
  99 #include <sys/types.h>
 100 #include <sys/systm.h>
 101 #include <sys/kernel.h>
 102 #include <sys/bus.h>
 103 #include <sys/module.h>
 104 #include <sys/lock.h>
 105 #include <sys/mutex.h>
 106 #include <sys/condvar.h>
 107 #include <sys/sysctl.h>
 108 #include <sys/sx.h>
 109 #include <sys/unistd.h>
 110 #include <sys/callout.h>
 111 #include <sys/malloc.h>
 112 #include <sys/priv.h>
 113
 114 #include "usbdevs.h"
 115 #include <dev/usb/usb.h>
 116 #include <dev/usb/usbdi.h>
 117 #include <dev/usb/usbdi_util.h>
 118
 119 #define USB_DEBUG_VAR usb_debug
 120 #include <dev/usb/usb_debug.h>
 121 #include <dev/usb/usb_busdma.h>
 122
 123 #include <sys/mbuf.h>
 124 #include <sys/taskqueue.h>
 125
 126 #include <netgraph/ng_message.h>
 127 #include <netgraph/netgraph.h>
 128 #include <netgraph/ng_parse.h>
 129 #include <netgraph/bluetooth/include/ng_bluetooth.h>
 130 #include <netgraph/bluetooth/include/ng_hci.h>
 131 #include <netgraph/bluetooth/include/ng_ubt.h>
 132 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h>
 133
 134 static int              ubt_modevent(module_t, int, void *);
 135 static device_probe_t   ubt_probe;
 136 static device_attach_t  ubt_attach;
 137 static device_detach_t  ubt_detach;
 138
 139 static void             ubt_task_schedule(ubt_softc_p, int);
 140 static task_fn_t        ubt_task;
 141
 142 #define ubt_xfer_start(sc, i)   usbd_transfer_start((sc)->sc_xfer[(i)])
 143
 144 /* Netgraph methods */
 145 static ng_constructor_t ng_ubt_constructor;
 146 static ng_shutdown_t    ng_ubt_shutdown;
 147 static ng_newhook_t     ng_ubt_newhook;
 148 static ng_connect_t     ng_ubt_connect;
 149 static ng_disconnect_t  ng_ubt_disconnect;
 150 static ng_rcvmsg_t      ng_ubt_rcvmsg;
 151 static ng_rcvdata_t     ng_ubt_rcvdata;
 152
 153 /* Queue length */
 154 static const struct ng_parse_struct_field       ng_ubt_node_qlen_type_fields[] =
 155 {
 156         { "queue", &ng_parse_int32_type, },
 157         { "qlen",  &ng_parse_int32_type, },
 158         { NULL, }
 159 };
 160 static const struct ng_parse_type               ng_ubt_node_qlen_type =
 161 {
 162         &ng_parse_struct_type,
 163         &ng_ubt_node_qlen_type_fields
 164 };
 165
 166 /* Stat info */
 167 static const struct ng_parse_struct_field       ng_ubt_node_stat_type_fields[] =
 168 {
 169         { "pckts_recv", &ng_parse_uint32_type, },
 170         { "bytes_recv", &ng_parse_uint32_type, },
 171         { "pckts_sent", &ng_parse_uint32_type, },
 172         { "bytes_sent", &ng_parse_uint32_type, },
 173         { "oerrors",    &ng_parse_uint32_type, },
 174         { "ierrors",    &ng_parse_uint32_type, },
 175         { NULL, }
 176 };
 177 static const struct ng_parse_type               ng_ubt_node_stat_type =
 178 {
 179         &ng_parse_struct_type,
 180         &ng_ubt_node_stat_type_fields
 181 };
 182
 183 /* Netgraph node command list */
 184 static const struct ng_cmdlist                  ng_ubt_cmdlist[] =
 185 {
 186         {
 187                 NGM_UBT_COOKIE,
 188                 NGM_UBT_NODE_SET_DEBUG,
 189                 "set_debug",
 190                 &ng_parse_uint16_type,
 191                 NULL
 192         },
 193         {
 194                 NGM_UBT_COOKIE,
 195                 NGM_UBT_NODE_GET_DEBUG,
 196                 "get_debug",
 197                 NULL,
 198                 &ng_parse_uint16_type
 199         },
 200         {
 201                 NGM_UBT_COOKIE,
 202                 NGM_UBT_NODE_SET_QLEN,
 203                 "set_qlen",
 204                 &ng_ubt_node_qlen_type,
 205                 NULL
 206         },
 207         {
 208                 NGM_UBT_COOKIE,
 209                 NGM_UBT_NODE_GET_QLEN,
 210                 "get_qlen",
 211                 &ng_ubt_node_qlen_type,
 212                 &ng_ubt_node_qlen_type
 213         },
 214         {
 215                 NGM_UBT_COOKIE,
 216                 NGM_UBT_NODE_GET_STAT,
 217                 "get_stat",
 218                 NULL,
 219                 &ng_ubt_node_stat_type
 220         },
 221         {
 222                 NGM_UBT_COOKIE,
 223                 NGM_UBT_NODE_RESET_STAT,
 224                 "reset_stat",
 225                 NULL,
 226                 NULL
 227         },
 228         { 0, }
 229 };
 230
 231 /* Netgraph node type */
 232 static struct ng_type   typestruct =
 233 {
 234         .version =      NG_ABI_VERSION,
 235         .name =         NG_UBT_NODE_TYPE,
 236         .constructor =  ng_ubt_constructor,
 237         .rcvmsg =       ng_ubt_rcvmsg,
 238         .shutdown =     ng_ubt_shutdown,
 239         .newhook =      ng_ubt_newhook,
 240         .connect =      ng_ubt_connect,
 241         .rcvdata =      ng_ubt_rcvdata,
 242         .disconnect =   ng_ubt_disconnect,
 243         .cmdlist =      ng_ubt_cmdlist
 244 };
 245
 246 /****************************************************************************
 247  ****************************************************************************
 248  **                              USB specific
 249  ****************************************************************************
 250  ****************************************************************************/
 251
 252 /* USB methods */
 253 static usb_callback_t   ubt_ctrl_write_callback;
 254 static usb_callback_t   ubt_intr_read_callback;
 255 static usb_callback_t   ubt_bulk_read_callback;
 256 static usb_callback_t   ubt_bulk_write_callback;
 257 static usb_callback_t   ubt_isoc_read_callback;
 258 static usb_callback_t   ubt_isoc_write_callback;
 259
 260 static int              ubt_fwd_mbuf_up(ubt_softc_p, struct mbuf **);
 261 static int              ubt_isoc_read_one_frame(struct usb_xfer *, int);
 262
 263 /*
 264  * USB config
 265  *
 266  * The following desribes usb transfers that could be submitted on USB device.
 267  *
 268  * Interface 0 on the USB device must present the following endpoints
 269  *      1) Interrupt endpoint to receive HCI events
 270  *      2) Bulk IN endpoint to receive ACL data
 271  *      3) Bulk OUT endpoint to send ACL data
 272  *
 273  * Interface 1 on the USB device must present the following endpoints
 274  *      1) Isochronous IN endpoint to receive SCO data
 275  *      2) Isochronous OUT endpoint to send SCO data
 276  */
 277
 278 static const struct usb_config          ubt_config[UBT_N_TRANSFER] =
 279 {
 280         /*
 281          * Interface #0
 282          */
 283
 284         /* Outgoing bulk transfer - ACL packets */
 285         [UBT_IF_0_BULK_DT_WR] = {
 286                 .type =         UE_BULK,
 287                 .endpoint =     UE_ADDR_ANY,
 288                 .direction =    UE_DIR_OUT,
 289                 .if_index =     0,
 290                 .bufsize =      UBT_BULK_WRITE_BUFFER_SIZE,
 291                 .flags =        { .pipe_bof = 1, .force_short_xfer = 1, },
 292                 .callback =     &ubt_bulk_write_callback,
 293         },
 294         /* Incoming bulk transfer - ACL packets */
 295         [UBT_IF_0_BULK_DT_RD] = {
 296                 .type =         UE_BULK,
 297                 .endpoint =     UE_ADDR_ANY,
 298                 .direction =    UE_DIR_IN,
 299                 .if_index =     0,
 300                 .bufsize =      UBT_BULK_READ_BUFFER_SIZE,
 301                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
 302                 .callback =     &ubt_bulk_read_callback,
 303         },
 304         /* Incoming interrupt transfer - HCI events */
 305         [UBT_IF_0_INTR_DT_RD] = {
 306                 .type =         UE_INTERRUPT,
 307                 .endpoint =     UE_ADDR_ANY,
 308                 .direction =    UE_DIR_IN,
 309                 .if_index =     0,
 310                 .flags =        { .pipe_bof = 1, .short_xfer_ok = 1, },
 311                 .bufsize =      UBT_INTR_BUFFER_SIZE,
 312                 .callback =     &ubt_intr_read_callback,
 313         },
 314         /* Outgoing control transfer - HCI commands */
 315         [UBT_IF_0_CTRL_DT_WR] = {
 316                 .type =         UE_CONTROL,
 317                 .endpoint =     0x00,   /* control pipe */
 318                 .direction =    UE_DIR_ANY,
 319                 .if_index =     0,
 320                 .bufsize =      UBT_CTRL_BUFFER_SIZE,
 321                 .callback =     &ubt_ctrl_write_callback,
 322                 .timeout =      5000,   /* 5 seconds */
 323         },
 324
 325         /*
 326          * Interface #1
 327          */
 328
 329         /* Incoming isochronous transfer #1 - SCO packets */
 330         [UBT_IF_1_ISOC_DT_RD1] = {
 331                 .type =         UE_ISOCHRONOUS,
 332                 .endpoint =     UE_ADDR_ANY,
 333                 .direction =    UE_DIR_IN,
 334                 .if_index =     1,
 335                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 336                 .frames =       UBT_ISOC_NFRAMES,
 337                 .flags =        { .short_xfer_ok = 1, },
 338                 .callback =     &ubt_isoc_read_callback,
 339         },
 340         /* Incoming isochronous transfer #2 - SCO packets */
 341         [UBT_IF_1_ISOC_DT_RD2] = {
 342                 .type =         UE_ISOCHRONOUS,
 343                 .endpoint =     UE_ADDR_ANY,
 344                 .direction =    UE_DIR_IN,
 345                 .if_index =     1,
 346                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 347                 .frames =       UBT_ISOC_NFRAMES,
 348                 .flags =        { .short_xfer_ok = 1, },
 349                 .callback =     &ubt_isoc_read_callback,
 350         },
 351         /* Outgoing isochronous transfer #1 - SCO packets */
 352         [UBT_IF_1_ISOC_DT_WR1] = {
 353                 .type =         UE_ISOCHRONOUS,
 354                 .endpoint =     UE_ADDR_ANY,
 355                 .direction =    UE_DIR_OUT,
 356                 .if_index =     1,
 357                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 358                 .frames =       UBT_ISOC_NFRAMES,
 359                 .flags =        { .short_xfer_ok = 1, },
 360                 .callback =     &ubt_isoc_write_callback,
 361         },
 362         /* Outgoing isochronous transfer #2 - SCO packets */
 363         [UBT_IF_1_ISOC_DT_WR2] = {
 364                 .type =         UE_ISOCHRONOUS,
 365                 .endpoint =     UE_ADDR_ANY,
 366                 .direction =    UE_DIR_OUT,
 367                 .if_index =     1,
 368                 .bufsize =      0,      /* use "wMaxPacketSize * frames" */
 369                 .frames =       UBT_ISOC_NFRAMES,
 370                 .flags =        { .short_xfer_ok = 1, },
 371                 .callback =     &ubt_isoc_write_callback,
 372         },
 373 };
 374
 375 /*
 376  * If for some reason device should not be attached then put
 377  * VendorID/ProductID pair into the list below. The format is
 378  * as follows:
 379  *
 380  *      { USB_VPI(VENDOR_ID, PRODUCT_ID, 0) },
 381  *
 382  * where VENDOR_ID and PRODUCT_ID are hex numbers.
 383  */
 384
 385 static const STRUCT_USB_HOST_ID ubt_ignore_devs[] =
 386 {
 387         /* AVM USB Bluetooth-Adapter BlueFritz! v1.0 */
 388         { USB_VPI(USB_VENDOR_AVM, 0x2200, 0) },
 389 };
 390
 391 /* List of supported bluetooth devices */
 392 static const STRUCT_USB_HOST_ID ubt_devs[] =
 393 {
 394         /* Generic Bluetooth class devices */
 395         { USB_IFACE_CLASS(UDCLASS_WIRELESS),
 396           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 397           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 398
 399         /* AVM USB Bluetooth-Adapter BlueFritz! v2.0 */
 400         { USB_VPI(USB_VENDOR_AVM, 0x3800, 0) },
 401
 402         /* Broadcom USB dongles, mostly BCM20702 and BCM20702A0 */
 403         { USB_VENDOR(USB_VENDOR_BROADCOM),
 404           USB_IFACE_CLASS(UICLASS_VENDOR),
 405           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 406           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 407
 408         /* Apple-specific (Broadcom) devices */
 409         { USB_VENDOR(USB_VENDOR_APPLE),
 410           USB_IFACE_CLASS(UICLASS_VENDOR),
 411           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 412           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 413
 414         /* Foxconn - Hon Hai */
 415         { USB_VENDOR(USB_VENDOR_FOXCONN),
 416           USB_IFACE_CLASS(UICLASS_VENDOR),
 417           USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
 418           USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
 419
 420         /* MediaTek MT76x0E */
 421         { USB_VPI(USB_VENDOR_MEDIATEK, 0x763f, 0) },
 422
 423         /* Broadcom SoftSailing reporting vendor specific */
 424         { USB_VPI(USB_VENDOR_BROADCOM, 0x21e1, 0) },
 425
 426         /* Apple MacBookPro 7,1 */
 427         { USB_VPI(USB_VENDOR_APPLE, 0x8213, 0) },
 428
 429         /* Apple iMac11,1 */
 430         { USB_VPI(USB_VENDOR_APPLE, 0x8215, 0) },
 431
 432         /* Apple MacBookPro6,2 */
 433         { USB_VPI(USB_VENDOR_APPLE, 0x8218, 0) },
 434
 435         /* Apple MacBookAir3,1, MacBookAir3,2 */
 436         { USB_VPI(USB_VENDOR_APPLE, 0x821b, 0) },
 437
 438         /* Apple MacBookAir4,1 */
 439         { USB_VPI(USB_VENDOR_APPLE, 0x821f, 0) },
 440
 441         /* MacBookAir6,1 */
 442         { USB_VPI(USB_VENDOR_APPLE, 0x828f, 0) },
 443
 444         /* Apple MacBookPro8,2 */
 445         { USB_VPI(USB_VENDOR_APPLE, 0x821a, 0) },
 446
 447         /* Apple MacMini5,1 */
 448         { USB_VPI(USB_VENDOR_APPLE, 0x8281, 0) },
 449
 450         /* Bluetooth Ultraport Module from IBM */
 451         { USB_VPI(USB_VENDOR_TDK, 0x030a, 0) },
 452
 453         /* ALPS Modules with non-standard ID */
 454         { USB_VPI(USB_VENDOR_ALPS, 0x3001, 0) },
 455         { USB_VPI(USB_VENDOR_ALPS, 0x3002, 0) },
 456
 457         { USB_VPI(USB_VENDOR_ERICSSON2, 0x1002, 0) },
 458
 459         /* Canyon CN-BTU1 with HID interfaces */
 460         { USB_VPI(USB_VENDOR_CANYON, 0x0000, 0) },
 461
 462         /* Broadcom BCM20702A0 */
 463         { USB_VPI(USB_VENDOR_ASUS, 0x17b5, 0) },
 464         { USB_VPI(USB_VENDOR_ASUS, 0x17cb, 0) },
 465         { USB_VPI(USB_VENDOR_LITEON, 0x2003, 0) },
 466         { USB_VPI(USB_VENDOR_FOXCONN, 0xe042, 0) },
 467         { USB_VPI(USB_VENDOR_DELL, 0x8197, 0) },
 468 };
 469
 470 /*
 471  * Probe for a USB Bluetooth device.
 472  * USB context.
 473  */
 474
 475 static int
 476 ubt_probe(device_t dev)
 477 {
 478         struct usb_attach_arg   *uaa = device_get_ivars(dev);
 479         int error;
 480
 481         if (uaa->usb_mode != USB_MODE_HOST)
 482                 return (ENXIO);
 483
 484         if (uaa->info.bIfaceIndex != 0)
 485                 return (ENXIO);
 486
 487         if (usbd_lookup_id_by_uaa(ubt_ignore_devs,
 488                         sizeof(ubt_ignore_devs), uaa) == 0)
 489                 return (ENXIO);
 490
 491         error = usbd_lookup_id_by_uaa(ubt_devs, sizeof(ubt_devs), uaa);
 492         if (error == 0)
 493                 return (BUS_PROBE_GENERIC);
 494         return (error);
 495 } /* ubt_probe */
 496
 497 /*
 498  * Attach the device.
 499  * USB context.
 500  */
 501
 502 static int
 503 ubt_attach(device_t dev)
 504 {
 505         struct usb_attach_arg           *uaa = device_get_ivars(dev);
 506         struct ubt_softc                *sc = device_get_softc(dev);
 507         struct usb_endpoint_descriptor  *ed;
 508         struct usb_interface_descriptor *id;
 509         uint32_t                        wMaxPacketSize;
 510         uint8_t                         alt_index, i, j;
 511         uint8_t                         iface_index[2] = { 0, 1 };
 512
 513         device_set_usb_desc(dev);
 514
 515         sc->sc_dev = dev;
 516         sc->sc_debug = NG_UBT_WARN_LEVEL;
 517
 518         /*
 519          * Create Netgraph node
 520          */
 521
 522         if (ng_make_node_common(&typestruct, &sc->sc_node) != 0) {
 523                 UBT_ALERT(sc, "could not create Netgraph node\n");
 524                 return (ENXIO);
 525         }
 526
 527         /* Name Netgraph node */
 528         if (ng_name_node(sc->sc_node, device_get_nameunit(dev)) != 0) {
 529                 UBT_ALERT(sc, "could not name Netgraph node\n");
 530                 NG_NODE_UNREF(sc->sc_node);
 531                 return (ENXIO);
 532         }
 533         NG_NODE_SET_PRIVATE(sc->sc_node, sc);
 534         NG_NODE_FORCE_WRITER(sc->sc_node);
 535
 536         /*
 537          * Initialize device softc structure
 538          */
 539
 540         /* initialize locks */
 541         mtx_init(&sc->sc_ng_mtx, "ubt ng", NULL, MTX_DEF);
 542         mtx_init(&sc->sc_if_mtx, "ubt if", NULL, MTX_DEF | MTX_RECURSE);
 543
 544         /* initialize packet queues */
 545         NG_BT_MBUFQ_INIT(&sc->sc_cmdq, UBT_DEFAULT_QLEN);
 546         NG_BT_MBUFQ_INIT(&sc->sc_aclq, UBT_DEFAULT_QLEN);
 547         NG_BT_MBUFQ_INIT(&sc->sc_scoq, UBT_DEFAULT_QLEN);
 548
 549         /* initialize glue task */
 550         TASK_INIT(&sc->sc_task, 0, ubt_task, sc);
 551
 552         /*
 553          * Configure Bluetooth USB device. Discover all required USB
 554          * interfaces and endpoints.
 555          *
 556          * USB device must present two interfaces:
 557          * 1) Interface 0 that has 3 endpoints
 558          *      1) Interrupt endpoint to receive HCI events
 559          *      2) Bulk IN endpoint to receive ACL data
 560          *      3) Bulk OUT endpoint to send ACL data
 561          *
 562          * 2) Interface 1 then has 2 endpoints
 563          *      1) Isochronous IN endpoint to receive SCO data
 564          *      2) Isochronous OUT endpoint to send SCO data
 565          *
 566          * Interface 1 (with isochronous endpoints) has several alternate
 567          * configurations with different packet size.
 568          */
 569
 570         /*
 571          * For interface #1 search alternate settings, and find
 572          * the descriptor with the largest wMaxPacketSize
 573          */
 574
 575         wMaxPacketSize = 0;
 576         alt_index = 0;
 577         i = 0;
 578         j = 0;
 579         ed = NULL;
 580
 581         /*
 582          * Search through all the descriptors looking for the largest
 583          * packet size:
 584          */
 585         while ((ed = (struct usb_endpoint_descriptor *)usb_desc_foreach(
 586             usbd_get_config_descriptor(uaa->device),
 587             (struct usb_descriptor *)ed))) {
 588
 589                 if ((ed->bDescriptorType == UDESC_INTERFACE) &&
 590                     (ed->bLength >= sizeof(*id))) {
 591                         id = (struct usb_interface_descriptor *)ed;
 592                         i = id->bInterfaceNumber;
 593                         j = id->bAlternateSetting;
 594                 }
 595
 596                 if ((ed->bDescriptorType == UDESC_ENDPOINT) &&
 597                     (ed->bLength >= sizeof(*ed)) &&
 598                     (i == 1)) {
 599                         uint32_t temp;
 600
 601                         temp = usbd_get_max_frame_length(
 602                             ed, NULL, usbd_get_speed(uaa->device));
 603                         if (temp > wMaxPacketSize) {
 604                                 wMaxPacketSize = temp;
 605                                 alt_index = j;
 606                         }
 607                 }
 608         }
 609
 610         /* Set alt configuration on interface #1 only if we found it */
 611         if (wMaxPacketSize > 0 &&
 612             usbd_set_alt_interface_index(uaa->device, 1, alt_index)) {
 613                 UBT_ALERT(sc, "could not set alternate setting %d " \
 614                         "for interface 1!\n", alt_index);
 615                 goto detach;
 616         }
 617
 618         /* Setup transfers for both interfaces */
 619         if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer,
 620                         ubt_config, UBT_N_TRANSFER, sc, &sc->sc_if_mtx)) {
 621                 UBT_ALERT(sc, "could not allocate transfers\n");
 622                 goto detach;
 623         }
 624
 625         /* Claim all interfaces on the device */
 626         for (i = 1; usbd_get_iface(uaa->device, i) != NULL; i ++)
 627                 usbd_set_parent_iface(uaa->device, i, uaa->info.bIfaceIndex);
 628
 629         return (0); /* success */
 630
 631 detach:
 632         ubt_detach(dev);
 633
 634         return (ENXIO);
 635 } /* ubt_attach */
 636
 637 /*
 638  * Detach the device.
 639  * USB context.
 640  */
 641
 642 int
 643 ubt_detach(device_t dev)
 644 {
 645         struct ubt_softc        *sc = device_get_softc(dev);
 646         node_p                  node = sc->sc_node;
 647
 648         /* Destroy Netgraph node */
 649         if (node != NULL) {
 650                 sc->sc_node = NULL;
 651                 NG_NODE_REALLY_DIE(node);
 652                 ng_rmnode_self(node);
 653         }
 654
 655         /* Make sure ubt_task in gone */
 656         taskqueue_drain(taskqueue_swi, &sc->sc_task);
 657
 658         /* Free USB transfers, if any */
 659         usbd_transfer_unsetup(sc->sc_xfer, UBT_N_TRANSFER);
 660
 661         /* Destroy queues */
 662         UBT_NG_LOCK(sc);
 663         NG_BT_MBUFQ_DESTROY(&sc->sc_cmdq);
 664         NG_BT_MBUFQ_DESTROY(&sc->sc_aclq);
 665         NG_BT_MBUFQ_DESTROY(&sc->sc_scoq);
 666         UBT_NG_UNLOCK(sc);
 667
 668         mtx_destroy(&sc->sc_if_mtx);
 669         mtx_destroy(&sc->sc_ng_mtx);
 670
 671         return (0);
 672 } /* ubt_detach */
 673
 674 /*
 675  * Called when outgoing control request (HCI command) has completed, i.e.
 676  * HCI command was sent to the device.
 677  * USB context.
 678  */
 679
 680 static void
 681 ubt_ctrl_write_callback(struct usb_xfer *xfer, usb_error_t error)
 682 {
 683         struct ubt_softc                *sc = usbd_xfer_softc(xfer);
 684         struct usb_device_request       req;
 685         struct mbuf                     *m;
 686         struct usb_page_cache           *pc;
 687         int                             actlen;
 688
 689         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 690
 691         switch (USB_GET_STATE(xfer)) {
 692         case USB_ST_TRANSFERRED:
 693                 UBT_INFO(sc, "sent %d bytes to control pipe\n", actlen);
 694                 UBT_STAT_BYTES_SENT(sc, actlen);
 695                 UBT_STAT_PCKTS_SENT(sc);
 696                 /* FALLTHROUGH */
 697
 698         case USB_ST_SETUP:
 699 send_next:
 700                 /* Get next command mbuf, if any */
 701                 UBT_NG_LOCK(sc);
 702                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_cmdq, m);
 703                 UBT_NG_UNLOCK(sc);
 704
 705                 if (m == NULL) {
 706                         UBT_INFO(sc, "HCI command queue is empty\n");
 707                         break;  /* transfer complete */
 708                 }
 709
 710                 /* Initialize a USB control request and then schedule it */
 711                 bzero(&req, sizeof(req));
 712                 req.bmRequestType = UBT_HCI_REQUEST;
 713                 USETW(req.wLength, m->m_pkthdr.len);
 714
 715                 UBT_INFO(sc, "Sending control request, " \
 716                         "bmRequestType=0x%02x, wLength=%d\n",
 717                         req.bmRequestType, UGETW(req.wLength));
 718
 719                 pc = usbd_xfer_get_frame(xfer, 0);
 720                 usbd_copy_in(pc, 0, &req, sizeof(req));
 721                 pc = usbd_xfer_get_frame(xfer, 1);
 722                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
 723
 724                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
 725                 usbd_xfer_set_frame_len(xfer, 1, m->m_pkthdr.len);
 726                 usbd_xfer_set_frames(xfer, 2);
 727
 728                 NG_FREE_M(m);
 729
 730                 usbd_transfer_submit(xfer);
 731                 break;
 732
 733         default: /* Error */
 734                 if (error != USB_ERR_CANCELLED) {
 735                         UBT_WARN(sc, "control transfer failed: %s\n",
 736                                 usbd_errstr(error));
 737
 738                         UBT_STAT_OERROR(sc);
 739                         goto send_next;
 740                 }
 741
 742                 /* transfer cancelled */
 743                 break;
 744         }
 745 } /* ubt_ctrl_write_callback */
 746
 747 /*
 748  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
 749  * HCI event was received from the device.
 750  * USB context.
 751  */
 752
 753 static void
 754 ubt_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
 755 {
 756         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 757         struct mbuf             *m;
 758         ng_hci_event_pkt_t      *hdr;
 759         struct usb_page_cache   *pc;
 760         int                     actlen;
 761
 762         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 763
 764         m = NULL;
 765
 766         switch (USB_GET_STATE(xfer)) {
 767         case USB_ST_TRANSFERRED:
 768                 /* Allocate a new mbuf */
 769                 MGETHDR(m, M_DONTWAIT, MT_DATA);
 770                 if (m == NULL) {
 771                         UBT_STAT_IERROR(sc);
 772                         goto submit_next;
 773                 }
 774
 775                 MCLGET(m, M_DONTWAIT);
 776                 if (!(m->m_flags & M_EXT)) {
 777                         UBT_STAT_IERROR(sc);
 778                         goto submit_next;
 779                 }
 780
 781                 /* Add HCI packet type */
 782                 *mtod(m, uint8_t *)= NG_HCI_EVENT_PKT;
 783                 m->m_pkthdr.len = m->m_len = 1;
 784
 785                 if (actlen > MCLBYTES - 1)
 786                         actlen = MCLBYTES - 1;
 787
 788                 pc = usbd_xfer_get_frame(xfer, 0);
 789                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
 790                 m->m_pkthdr.len += actlen;
 791                 m->m_len += actlen;
 792
 793                 UBT_INFO(sc, "got %d bytes from interrupt pipe\n",
 794                         actlen);
 795
 796                 /* Validate packet and send it up the stack */
 797                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
 798                         UBT_INFO(sc, "HCI event packet is too short\n");
 799
 800                         UBT_STAT_IERROR(sc);
 801                         goto submit_next;
 802                 }
 803
 804                 hdr = mtod(m, ng_hci_event_pkt_t *);
 805                 if (hdr->length != (m->m_pkthdr.len - sizeof(*hdr))) {
 806                         UBT_ERR(sc, "Invalid HCI event packet size, " \
 807                                 "length=%d, pktlen=%d\n",
 808                                 hdr->length, m->m_pkthdr.len);
 809
 810                         UBT_STAT_IERROR(sc);
 811                         goto submit_next;
 812                 }
 813
 814                 UBT_INFO(sc, "got complete HCI event frame, pktlen=%d, " \
 815                         "length=%d\n", m->m_pkthdr.len, hdr->length);
 816
 817                 UBT_STAT_PCKTS_RECV(sc);
 818                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
 819
 820                 ubt_fwd_mbuf_up(sc, &m);
 821                 /* m == NULL at this point */
 822                 /* FALLTHROUGH */
 823
 824         case USB_ST_SETUP:
 825 submit_next:
 826                 NG_FREE_M(m); /* checks for m != NULL */
 827
 828                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
 829                 usbd_transfer_submit(xfer);
 830                 break;
 831
 832         default: /* Error */
 833                 if (error != USB_ERR_CANCELLED) {
 834                         UBT_WARN(sc, "interrupt transfer failed: %s\n",
 835                                 usbd_errstr(error));
 836
 837                         /* Try to clear stall first */
 838                         usbd_xfer_set_stall(xfer);
 839                         goto submit_next;
 840                 }
 841                         /* transfer cancelled */
 842                 break;
 843         }
 844 } /* ubt_intr_read_callback */
 845
 846 /*
 847  * Called when incoming bulk transfer (ACL packet) has completed, i.e.
 848  * ACL packet was received from the device.
 849  * USB context.
 850  */
 851
 852 static void
 853 ubt_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 854 {
 855         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 856         struct mbuf             *m;
 857         ng_hci_acldata_pkt_t    *hdr;
 858         struct usb_page_cache   *pc;
 859         int len;
 860         int actlen;
 861
 862         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 863
 864         m = NULL;
 865
 866         switch (USB_GET_STATE(xfer)) {
 867         case USB_ST_TRANSFERRED:
 868                 /* Allocate new mbuf */
 869                 MGETHDR(m, M_DONTWAIT, MT_DATA);
 870                 if (m == NULL) {
 871                         UBT_STAT_IERROR(sc);
 872                         goto submit_next;
 873                 }
 874
 875                 MCLGET(m, M_DONTWAIT);
 876                 if (!(m->m_flags & M_EXT)) {
 877                         UBT_STAT_IERROR(sc);
 878                         goto submit_next;
 879                 }
 880
 881                 /* Add HCI packet type */
 882                 *mtod(m, uint8_t *)= NG_HCI_ACL_DATA_PKT;
 883                 m->m_pkthdr.len = m->m_len = 1;
 884
 885                 if (actlen > MCLBYTES - 1)
 886                         actlen = MCLBYTES - 1;
 887
 888                 pc = usbd_xfer_get_frame(xfer, 0);
 889                 usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
 890                 m->m_pkthdr.len += actlen;
 891                 m->m_len += actlen;
 892
 893                 UBT_INFO(sc, "got %d bytes from bulk-in pipe\n",
 894                         actlen);
 895
 896                 /* Validate packet and send it up the stack */
 897                 if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
 898                         UBT_INFO(sc, "HCI ACL packet is too short\n");
 899
 900                         UBT_STAT_IERROR(sc);
 901                         goto submit_next;
 902                 }
 903
 904                 hdr = mtod(m, ng_hci_acldata_pkt_t *);
 905                 len = le16toh(hdr->length);
 906                 if (len != (int)(m->m_pkthdr.len - sizeof(*hdr))) {
 907                         UBT_ERR(sc, "Invalid ACL packet size, length=%d, " \
 908                                 "pktlen=%d\n", len, m->m_pkthdr.len);
 909
 910                         UBT_STAT_IERROR(sc);
 911                         goto submit_next;
 912                 }
 913
 914                 UBT_INFO(sc, "got complete ACL data packet, pktlen=%d, " \
 915                         "length=%d\n", m->m_pkthdr.len, len);
 916
 917                 UBT_STAT_PCKTS_RECV(sc);
 918                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
 919
 920                 ubt_fwd_mbuf_up(sc, &m);
 921                 /* m == NULL at this point */
 922                 /* FALLTHOUGH */
 923
 924         case USB_ST_SETUP:
 925 submit_next:
 926                 NG_FREE_M(m); /* checks for m != NULL */
 927
 928                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
 929                 usbd_transfer_submit(xfer);
 930                 break;
 931
 932         default: /* Error */
 933                 if (error != USB_ERR_CANCELLED) {
 934                         UBT_WARN(sc, "bulk-in transfer failed: %s\n",
 935                                 usbd_errstr(error));
 936
 937                         /* Try to clear stall first */
 938                         usbd_xfer_set_stall(xfer);
 939                         goto submit_next;
 940                 }
 941                         /* transfer cancelled */
 942                 break;
 943         }
 944 } /* ubt_bulk_read_callback */
 945
 946 /*
 947  * Called when outgoing bulk transfer (ACL packet) has completed, i.e.
 948  * ACL packet was sent to the device.
 949  * USB context.
 950  */
 951
 952 static void
 953 ubt_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
 954 {
 955         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
 956         struct mbuf             *m;
 957         struct usb_page_cache   *pc;
 958         int                     actlen;
 959
 960         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 961
 962         switch (USB_GET_STATE(xfer)) {
 963         case USB_ST_TRANSFERRED:
 964                 UBT_INFO(sc, "sent %d bytes to bulk-out pipe\n", actlen);
 965                 UBT_STAT_BYTES_SENT(sc, actlen);
 966                 UBT_STAT_PCKTS_SENT(sc);
 967                 /* FALLTHROUGH */
 968
 969         case USB_ST_SETUP:
 970 send_next:
 971                 /* Get next mbuf, if any */
 972                 UBT_NG_LOCK(sc);
 973                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_aclq, m);
 974                 UBT_NG_UNLOCK(sc);
 975
 976                 if (m == NULL) {
 977                         UBT_INFO(sc, "ACL data queue is empty\n");
 978                         break; /* transfer completed */
 979                 }
 980
 981                 /*
 982                  * Copy ACL data frame back to a linear USB transfer buffer
 983                  * and schedule transfer
 984                  */
 985
 986                 pc = usbd_xfer_get_frame(xfer, 0);
 987                 usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
 988                 usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
 989
 990                 UBT_INFO(sc, "bulk-out transfer has been started, len=%d\n",
 991                         m->m_pkthdr.len);
 992
 993                 NG_FREE_M(m);
 994
 995                 usbd_transfer_submit(xfer);
 996                 break;
 997
 998         default: /* Error */
 999                 if (error != USB_ERR_CANCELLED) {
1000                         UBT_WARN(sc, "bulk-out transfer failed: %s\n",
1001                                 usbd_errstr(error));
1002
1003                         UBT_STAT_OERROR(sc);
1004
1005                         /* try to clear stall first */
1006                         usbd_xfer_set_stall(xfer);
1007                         goto send_next;
1008                 }
1009                         /* transfer cancelled */
1010                 break;
1011         }
1012 } /* ubt_bulk_write_callback */
1013
1014 /*
1015  * Called when incoming isoc transfer (SCO packet) has completed, i.e.
1016  * SCO packet was received from the device.
1017  * USB context.
1018  */
1019
1020 static void
1021 ubt_isoc_read_callback(struct usb_xfer *xfer, usb_error_t error)
1022 {
1023         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1024         int                     n;
1025         int actlen, nframes;
1026
1027         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1028
1029         switch (USB_GET_STATE(xfer)) {
1030         case USB_ST_TRANSFERRED:
1031                 for (n = 0; n < nframes; n ++)
1032                         if (ubt_isoc_read_one_frame(xfer, n) < 0)
1033                                 break;
1034                 /* FALLTHROUGH */
1035
1036         case USB_ST_SETUP:
1037 read_next:
1038                 for (n = 0; n < nframes; n ++)
1039                         usbd_xfer_set_frame_len(xfer, n,
1040                             usbd_xfer_max_framelen(xfer));
1041
1042                 usbd_transfer_submit(xfer);
1043                 break;
1044
1045         default: /* Error */
1046                 if (error != USB_ERR_CANCELLED) {
1047                         UBT_STAT_IERROR(sc);
1048                         goto read_next;
1049                 }
1050
1051                 /* transfer cancelled */
1052                 break;
1053         }
1054 } /* ubt_isoc_read_callback */
1055
1056 /*
1057  * Helper function. Called from ubt_isoc_read_callback() to read
1058  * SCO data from one frame.
1059  * USB context.
1060  */
1061
1062 static int
1063 ubt_isoc_read_one_frame(struct usb_xfer *xfer, int frame_no)
1064 {
1065         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1066         struct usb_page_cache   *pc;
1067         struct mbuf             *m;
1068         int                     len, want, got, total;
1069
1070         /* Get existing SCO reassembly buffer */
1071         pc = usbd_xfer_get_frame(xfer, 0);
1072         m = sc->sc_isoc_in_buffer;
1073         total = usbd_xfer_frame_len(xfer, frame_no);
1074
1075         /* While we have data in the frame */
1076         while (total > 0) {
1077                 if (m == NULL) {
1078                         /* Start new reassembly buffer */
1079                         MGETHDR(m, M_DONTWAIT, MT_DATA);
1080                         if (m == NULL) {
1081                                 UBT_STAT_IERROR(sc);
1082                                 return (-1);    /* XXX out of sync! */
1083                         }
1084
1085                         MCLGET(m, M_DONTWAIT);
1086                         if (!(m->m_flags & M_EXT)) {
1087                                 UBT_STAT_IERROR(sc);
1088                                 NG_FREE_M(m);
1089                                 return (-1);    /* XXX out of sync! */
1090                         }
1091
1092                         /* Expect SCO header */
1093                         *mtod(m, uint8_t *) = NG_HCI_SCO_DATA_PKT;
1094                         m->m_pkthdr.len = m->m_len = got = 1;
1095                         want = sizeof(ng_hci_scodata_pkt_t);
1096                 } else {
1097                         /*
1098                          * Check if we have SCO header and if so
1099                          * adjust amount of data we want
1100                          */
1101                         got = m->m_pkthdr.len;
1102                         want = sizeof(ng_hci_scodata_pkt_t);
1103
1104                         if (got >= want)
1105                                 want += mtod(m, ng_hci_scodata_pkt_t *)->length;
1106                 }
1107
1108                 /* Append frame data to the SCO reassembly buffer */
1109                 len = total;
1110                 if (got + len > want)
1111                         len = want - got;
1112
1113                 usbd_copy_out(pc, frame_no * usbd_xfer_max_framelen(xfer),
1114                         mtod(m, uint8_t *) + m->m_pkthdr.len, len);
1115
1116                 m->m_pkthdr.len += len;
1117                 m->m_len += len;
1118                 total -= len;
1119
1120                 /* Check if we got everything we wanted, if not - continue */
1121                 if (got != want)
1122                         continue;
1123
1124                 /* If we got here then we got complete SCO frame */
1125                 UBT_INFO(sc, "got complete SCO data frame, pktlen=%d, " \
1126                         "length=%d\n", m->m_pkthdr.len,
1127                         mtod(m, ng_hci_scodata_pkt_t *)->length);
1128
1129                 UBT_STAT_PCKTS_RECV(sc);
1130                 UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1131
1132                 ubt_fwd_mbuf_up(sc, &m);
1133                 /* m == NULL at this point */
1134         }
1135
1136         /* Put SCO reassembly buffer back */
1137         sc->sc_isoc_in_buffer = m;
1138
1139         return (0);
1140 } /* ubt_isoc_read_one_frame */
1141
1142 /*
1143  * Called when outgoing isoc transfer (SCO packet) has completed, i.e.
1144  * SCO packet was sent to the device.
1145  * USB context.
1146  */
1147
1148 static void
1149 ubt_isoc_write_callback(struct usb_xfer *xfer, usb_error_t error)
1150 {
1151         struct ubt_softc        *sc = usbd_xfer_softc(xfer);
1152         struct usb_page_cache   *pc;
1153         struct mbuf             *m;
1154         int                     n, space, offset;
1155         int                     actlen, nframes;
1156
1157         usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1158         pc = usbd_xfer_get_frame(xfer, 0);
1159
1160         switch (USB_GET_STATE(xfer)) {
1161         case USB_ST_TRANSFERRED:
1162                 UBT_INFO(sc, "sent %d bytes to isoc-out pipe\n", actlen);
1163                 UBT_STAT_BYTES_SENT(sc, actlen);
1164                 UBT_STAT_PCKTS_SENT(sc);
1165                 /* FALLTHROUGH */
1166
1167         case USB_ST_SETUP:
1168 send_next:
1169                 offset = 0;
1170                 space = usbd_xfer_max_framelen(xfer) * nframes;
1171                 m = NULL;
1172
1173                 while (space > 0) {
1174                         if (m == NULL) {
1175                                 UBT_NG_LOCK(sc);
1176                                 NG_BT_MBUFQ_DEQUEUE(&sc->sc_scoq, m);
1177                                 UBT_NG_UNLOCK(sc);
1178
1179                                 if (m == NULL)
1180                                         break;
1181                         }
1182
1183                         n = min(space, m->m_pkthdr.len);
1184                         if (n > 0) {
1185                                 usbd_m_copy_in(pc, offset, m,0, n);
1186                                 m_adj(m, n);
1187
1188                                 offset += n;
1189                                 space -= n;
1190                         }
1191
1192                         if (m->m_pkthdr.len == 0)
1193                                 NG_FREE_M(m); /* sets m = NULL */
1194                 }
1195
1196                 /* Put whatever is left from mbuf back on queue */
1197                 if (m != NULL) {
1198                         UBT_NG_LOCK(sc);
1199                         NG_BT_MBUFQ_PREPEND(&sc->sc_scoq, m);
1200                         UBT_NG_UNLOCK(sc);
1201                 }
1202
1203                 /*
1204                  * Calculate sizes for isoc frames.
1205                  * Note that offset could be 0 at this point (i.e. we have
1206                  * nothing to send). That is fine, as we have isoc. transfers
1207                  * going in both directions all the time. In this case it
1208                  * would be just empty isoc. transfer.
1209                  */
1210
1211                 for (n = 0; n < nframes; n ++) {
1212                         usbd_xfer_set_frame_len(xfer, n,
1213                             min(offset, usbd_xfer_max_framelen(xfer)));
1214                         offset -= usbd_xfer_frame_len(xfer, n);
1215                 }
1216
1217                 usbd_transfer_submit(xfer);
1218                 break;
1219
1220         default: /* Error */
1221                 if (error != USB_ERR_CANCELLED) {
1222                         UBT_STAT_OERROR(sc);
1223                         goto send_next;
1224                 }
1225
1226                 /* transfer cancelled */
1227                 break;
1228         }
1229 }
1230
1231 /*
1232  * Utility function to forward provided mbuf upstream (i.e. up the stack).
1233  * Modifies value of the mbuf pointer (sets it to NULL).
1234  * Save to call from any context.
1235  */
1236
1237 static int
1238 ubt_fwd_mbuf_up(ubt_softc_p sc, struct mbuf **m)
1239 {
1240         hook_p  hook;
1241         int     error;
1242
1243         /*
1244          * Close the race with Netgraph hook newhook/disconnect methods.
1245          * Save the hook pointer atomically. Two cases are possible:
1246          *
1247          * 1) The hook pointer is NULL. It means disconnect method got
1248          *    there first. In this case we are done.
1249          *
1250          * 2) The hook pointer is not NULL. It means that hook pointer
1251          *    could be either in valid or invalid (i.e. in the process
1252          *    of disconnect) state. In any case grab an extra reference
1253          *    to protect the hook pointer.
1254          *
1255          * It is ok to pass hook in invalid state to NG_SEND_DATA_ONLY() as
1256          * it checks for it. Drop extra reference after NG_SEND_DATA_ONLY().
1257          */
1258
1259         UBT_NG_LOCK(sc);
1260         if ((hook = sc->sc_hook) != NULL)
1261                 NG_HOOK_REF(hook);
1262         UBT_NG_UNLOCK(sc);
1263
1264         if (hook == NULL) {
1265                 NG_FREE_M(*m);
1266                 return (ENETDOWN);
1267         }
1268
1269         NG_SEND_DATA_ONLY(error, hook, *m);
1270         NG_HOOK_UNREF(hook);
1271
1272         if (error != 0)
1273                 UBT_STAT_IERROR(sc);
1274
1275         return (error);
1276 } /* ubt_fwd_mbuf_up */
1277
1278 /****************************************************************************
1279  ****************************************************************************
1280  **                                 Glue
1281  ****************************************************************************
1282  ****************************************************************************/
1283
1284 /*
1285  * Schedule glue task. Should be called with sc_ng_mtx held.
1286  * Netgraph context.
1287  */
1288
1289 static void
1290 ubt_task_schedule(ubt_softc_p sc, int action)
1291 {
1292         mtx_assert(&sc->sc_ng_mtx, MA_OWNED);
1293
1294         /*
1295          * Try to handle corner case when "start all" and "stop all"
1296          * actions can both be set before task is executed.
1297          *
1298          * The rules are
1299          *
1300          * sc_task_flags        action          new sc_task_flags
1301          * ------------------------------------------------------
1302          * 0                    start           start
1303          * 0                    stop            stop
1304          * start                start           start
1305          * start                stop            stop
1306          * stop                 start           stop|start
1307          * stop                 stop            stop
1308          * stop|start           start           stop|start
1309          * stop|start           stop            stop
1310          */
1311
1312         if (action != 0) {
1313                 if ((action & UBT_FLAG_T_STOP_ALL) != 0)
1314                         sc->sc_task_flags &= ~UBT_FLAG_T_START_ALL;
1315
1316                 sc->sc_task_flags |= action;
1317         }
1318
1319         if (sc->sc_task_flags & UBT_FLAG_T_PENDING)
1320                 return;
1321
1322         if (taskqueue_enqueue(taskqueue_swi, &sc->sc_task) == 0) {
1323                 sc->sc_task_flags |= UBT_FLAG_T_PENDING;
1324                 return;
1325         }
1326
1327         /* XXX: i think this should never happen */
1328 } /* ubt_task_schedule */
1329
1330 /*
1331  * Glue task. Examines sc_task_flags and does things depending on it.
1332  * Taskqueue context.
1333  */
1334
1335 static void
1336 ubt_task(void *context, int pending)
1337 {
1338         ubt_softc_p     sc = context;
1339         int             task_flags, i;
1340
1341         UBT_NG_LOCK(sc);
1342         task_flags = sc->sc_task_flags;
1343         sc->sc_task_flags = 0;
1344         UBT_NG_UNLOCK(sc);
1345
1346         /*
1347          * Stop all USB transfers synchronously.
1348          * Stop interface #0 and #1 transfers at the same time and in the
1349          * same loop. usbd_transfer_drain() will do appropriate locking.
1350          */
1351
1352         if (task_flags & UBT_FLAG_T_STOP_ALL)
1353                 for (i = 0; i < UBT_N_TRANSFER; i ++)
1354                         usbd_transfer_drain(sc->sc_xfer[i]);
1355
1356         /* Start incoming interrupt and bulk, and all isoc. USB transfers */
1357         if (task_flags & UBT_FLAG_T_START_ALL) {
1358                 /*
1359                  * Interface #0
1360                  */
1361
1362                 mtx_lock(&sc->sc_if_mtx);
1363
1364                 ubt_xfer_start(sc, UBT_IF_0_INTR_DT_RD);
1365                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_RD);
1366
1367                 /*
1368                  * Interface #1
1369                  * Start both read and write isoc. transfers by default.
1370                  * Get them going all the time even if we have nothing
1371                  * to send to avoid any delays.
1372                  */
1373
1374                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD1);
1375                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD2);
1376                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR1);
1377                 ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR2);
1378
1379                 mtx_unlock(&sc->sc_if_mtx);
1380         }
1381
1382         /* Start outgoing control transfer */
1383         if (task_flags & UBT_FLAG_T_START_CTRL) {
1384                 mtx_lock(&sc->sc_if_mtx);
1385                 ubt_xfer_start(sc, UBT_IF_0_CTRL_DT_WR);
1386                 mtx_unlock(&sc->sc_if_mtx);
1387         }
1388
1389         /* Start outgoing bulk transfer */
1390         if (task_flags & UBT_FLAG_T_START_BULK) {
1391                 mtx_lock(&sc->sc_if_mtx);
1392                 ubt_xfer_start(sc, UBT_IF_0_BULK_DT_WR);
1393                 mtx_unlock(&sc->sc_if_mtx);
1394         }
1395 } /* ubt_task */
1396
1397 /****************************************************************************
1398  ****************************************************************************
1399  **                        Netgraph specific
1400  ****************************************************************************
1401  ****************************************************************************/
1402
1403 /*
1404  * Netgraph node constructor. Do not allow to create node of this type.
1405  * Netgraph context.
1406  */
1407
1408 static int
1409 ng_ubt_constructor(node_p node)
1410 {
1411         return (EINVAL);
1412 } /* ng_ubt_constructor */
1413
1414 /*
1415  * Netgraph node destructor. Destroy node only when device has been detached.
1416  * Netgraph context.
1417  */
1418
1419 static int
1420 ng_ubt_shutdown(node_p node)
1421 {
1422         if (node->nd_flags & NGF_REALLY_DIE) {
1423                 /*
1424                  * We came here because the USB device is being
1425                  * detached, so stop being persistant.
1426                  */
1427                 NG_NODE_SET_PRIVATE(node, NULL);
1428                 NG_NODE_UNREF(node);
1429         } else
1430                 NG_NODE_REVIVE(node); /* tell ng_rmnode we are persisant */
1431
1432         return (0);
1433 } /* ng_ubt_shutdown */
1434
1435 /*
1436  * Create new hook. There can only be one.
1437  * Netgraph context.
1438  */
1439
1440 static int
1441 ng_ubt_newhook(node_p node, hook_p hook, char const *name)
1442 {
1443         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1444
1445         if (strcmp(name, NG_UBT_HOOK) != 0)
1446                 return (EINVAL);
1447
1448         UBT_NG_LOCK(sc);
1449         if (sc->sc_hook != NULL) {
1450                 UBT_NG_UNLOCK(sc);
1451
1452                 return (EISCONN);
1453         }
1454
1455         sc->sc_hook = hook;
1456         UBT_NG_UNLOCK(sc);
1457
1458         return (0);
1459 } /* ng_ubt_newhook */
1460
1461 /*
1462  * Connect hook. Start incoming USB transfers.
1463  * Netgraph context.
1464  */
1465
1466 static int
1467 ng_ubt_connect(hook_p hook)
1468 {
1469         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1470
1471         NG_HOOK_FORCE_QUEUE(NG_HOOK_PEER(hook));
1472
1473         UBT_NG_LOCK(sc);
1474         ubt_task_schedule(sc, UBT_FLAG_T_START_ALL);
1475         UBT_NG_UNLOCK(sc);
1476
1477         return (0);
1478 } /* ng_ubt_connect */
1479
1480 /*
1481  * Disconnect hook.
1482  * Netgraph context.
1483  */
1484
1485 static int
1486 ng_ubt_disconnect(hook_p hook)
1487 {
1488         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1489
1490         UBT_NG_LOCK(sc);
1491
1492         if (hook != sc->sc_hook) {
1493                 UBT_NG_UNLOCK(sc);
1494
1495                 return (EINVAL);
1496         }
1497
1498         sc->sc_hook = NULL;
1499
1500         /* Kick off task to stop all USB xfers */
1501         ubt_task_schedule(sc, UBT_FLAG_T_STOP_ALL);
1502
1503         /* Drain queues */
1504         NG_BT_MBUFQ_DRAIN(&sc->sc_cmdq);
1505         NG_BT_MBUFQ_DRAIN(&sc->sc_aclq);
1506         NG_BT_MBUFQ_DRAIN(&sc->sc_scoq);
1507
1508         UBT_NG_UNLOCK(sc);
1509
1510         return (0);
1511 } /* ng_ubt_disconnect */
1512
1513 /*
1514  * Process control message.
1515  * Netgraph context.
1516  */
1517
1518 static int
1519 ng_ubt_rcvmsg(node_p node, item_p item, hook_p lasthook)
1520 {
1521         struct ubt_softc        *sc = NG_NODE_PRIVATE(node);
1522         struct ng_mesg          *msg, *rsp = NULL;
1523         struct ng_bt_mbufq      *q;
1524         int                     error = 0, queue, qlen;
1525
1526         NGI_GET_MSG(item, msg);
1527
1528         switch (msg->header.typecookie) {
1529         case NGM_GENERIC_COOKIE:
1530                 switch (msg->header.cmd) {
1531                 case NGM_TEXT_STATUS:
1532                         NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
1533                         if (rsp == NULL) {
1534                                 error = ENOMEM;
1535                                 break;
1536                         }
1537
1538                         snprintf(rsp->data, NG_TEXTRESPONSE,
1539                                 "Hook: %s\n" \
1540                                 "Task flags: %#x\n" \
1541                                 "Debug: %d\n" \
1542                                 "CMD queue: [have:%d,max:%d]\n" \
1543                                 "ACL queue: [have:%d,max:%d]\n" \
1544                                 "SCO queue: [have:%d,max:%d]",
1545                                 (sc->sc_hook != NULL) ? NG_UBT_HOOK : "",
1546                                 sc->sc_task_flags,
1547                                 sc->sc_debug,
1548                                 sc->sc_cmdq.len,
1549                                 sc->sc_cmdq.maxlen,
1550                                 sc->sc_aclq.len,
1551                                 sc->sc_aclq.maxlen,
1552                                 sc->sc_scoq.len,
1553                                 sc->sc_scoq.maxlen);
1554                         break;
1555
1556                 default:
1557                         error = EINVAL;
1558                         break;
1559                 }
1560                 break;
1561
1562         case NGM_UBT_COOKIE:
1563                 switch (msg->header.cmd) {
1564                 case NGM_UBT_NODE_SET_DEBUG:
1565                         if (msg->header.arglen != sizeof(ng_ubt_node_debug_ep)){
1566                                 error = EMSGSIZE;
1567                                 break;
1568                         }
1569
1570                         sc->sc_debug = *((ng_ubt_node_debug_ep *) (msg->data));
1571                         break;
1572
1573                 case NGM_UBT_NODE_GET_DEBUG:
1574                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_debug_ep),
1575                             M_NOWAIT);
1576                         if (rsp == NULL) {
1577                                 error = ENOMEM;
1578                                 break;
1579                         }
1580
1581                         *((ng_ubt_node_debug_ep *) (rsp->data)) = sc->sc_debug;
1582                         break;
1583
1584                 case NGM_UBT_NODE_SET_QLEN:
1585                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1586                                 error = EMSGSIZE;
1587                                 break;
1588                         }
1589
1590                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1591                         qlen = ((ng_ubt_node_qlen_ep *) (msg->data))->qlen;
1592
1593                         switch (queue) {
1594                         case NGM_UBT_NODE_QUEUE_CMD:
1595                                 q = &sc->sc_cmdq;
1596                                 break;
1597
1598                         case NGM_UBT_NODE_QUEUE_ACL:
1599                                 q = &sc->sc_aclq;
1600                                 break;
1601
1602                         case NGM_UBT_NODE_QUEUE_SCO:
1603                                 q = &sc->sc_scoq;
1604                                 break;
1605
1606                         default:
1607                                 error = EINVAL;
1608                                 goto done;
1609                                 /* NOT REACHED */
1610                         }
1611
1612                         q->maxlen = qlen;
1613                         break;
1614
1615                 case NGM_UBT_NODE_GET_QLEN:
1616                         if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1617                                 error = EMSGSIZE;
1618                                 break;
1619                         }
1620
1621                         queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1622
1623                         switch (queue) {
1624                         case NGM_UBT_NODE_QUEUE_CMD:
1625                                 q = &sc->sc_cmdq;
1626                                 break;
1627
1628                         case NGM_UBT_NODE_QUEUE_ACL:
1629                                 q = &sc->sc_aclq;
1630                                 break;
1631
1632                         case NGM_UBT_NODE_QUEUE_SCO:
1633                                 q = &sc->sc_scoq;
1634                                 break;
1635
1636                         default:
1637                                 error = EINVAL;
1638                                 goto done;
1639                                 /* NOT REACHED */
1640                         }
1641
1642                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_qlen_ep),
1643                                 M_NOWAIT);
1644                         if (rsp == NULL) {
1645                                 error = ENOMEM;
1646                                 break;
1647                         }
1648
1649                         ((ng_ubt_node_qlen_ep *) (rsp->data))->queue = queue;
1650                         ((ng_ubt_node_qlen_ep *) (rsp->data))->qlen = q->maxlen;
1651                         break;
1652
1653                 case NGM_UBT_NODE_GET_STAT:
1654                         NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_stat_ep),
1655                             M_NOWAIT);
1656                         if (rsp == NULL) {
1657                                 error = ENOMEM;
1658                                 break;
1659                         }
1660
1661                         bcopy(&sc->sc_stat, rsp->data,
1662                                 sizeof(ng_ubt_node_stat_ep));
1663                         break;
1664
1665                 case NGM_UBT_NODE_RESET_STAT:
1666                         UBT_STAT_RESET(sc);
1667                         break;
1668
1669                 default:
1670                         error = EINVAL;
1671                         break;
1672                 }
1673                 break;
1674
1675         default:
1676                 error = EINVAL;
1677                 break;
1678         }
1679 done:
1680         NG_RESPOND_MSG(error, node, item, rsp);
1681         NG_FREE_MSG(msg);
1682
1683         return (error);
1684 } /* ng_ubt_rcvmsg */
1685
1686 /*
1687  * Process data.
1688  * Netgraph context.
1689  */
1690
1691 static int
1692 ng_ubt_rcvdata(hook_p hook, item_p item)
1693 {
1694         struct ubt_softc        *sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1695         struct mbuf             *m;
1696         struct ng_bt_mbufq      *q;
1697         int                     action, error = 0;
1698
1699         if (hook != sc->sc_hook) {
1700                 error = EINVAL;
1701                 goto done;
1702         }
1703
1704         /* Deatch mbuf and get HCI frame type */
1705         NGI_GET_M(item, m);
1706
1707         /*
1708          * Minimal size of the HCI frame is 4 bytes: 1 byte frame type,
1709          * 2 bytes connection handle and at least 1 byte of length.
1710          * Panic on data frame that has size smaller than 4 bytes (it
1711          * should not happen)
1712          */
1713
1714         if (m->m_pkthdr.len < 4)
1715                 panic("HCI frame size is too small! pktlen=%d\n",
1716                         m->m_pkthdr.len);
1717
1718         /* Process HCI frame */
1719         switch (*mtod(m, uint8_t *)) {  /* XXX call m_pullup ? */
1720         case NG_HCI_CMD_PKT:
1721                 if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE)
1722                         panic("HCI command frame size is too big! " \
1723                                 "buffer size=%zd, packet len=%d\n",
1724                                 UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len);
1725
1726                 q = &sc->sc_cmdq;
1727                 action = UBT_FLAG_T_START_CTRL;
1728                 break;
1729
1730         case NG_HCI_ACL_DATA_PKT:
1731                 if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE)
1732                         panic("ACL data frame size is too big! " \
1733                                 "buffer size=%d, packet len=%d\n",
1734                                 UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len);
1735
1736                 q = &sc->sc_aclq;
1737                 action = UBT_FLAG_T_START_BULK;
1738                 break;
1739
1740         case NG_HCI_SCO_DATA_PKT:
1741                 q = &sc->sc_scoq;
1742                 action = 0;
1743                 break;
1744
1745         default:
1746                 UBT_ERR(sc, "Dropping unsupported HCI frame, type=0x%02x, " \
1747                         "pktlen=%d\n", *mtod(m, uint8_t *), m->m_pkthdr.len);
1748
1749                 NG_FREE_M(m);
1750                 error = EINVAL;
1751                 goto done;
1752                 /* NOT REACHED */
1753         }
1754
1755         UBT_NG_LOCK(sc);
1756         if (NG_BT_MBUFQ_FULL(q)) {
1757                 NG_BT_MBUFQ_DROP(q);
1758                 UBT_NG_UNLOCK(sc);
1759
1760                 UBT_ERR(sc, "Dropping HCI frame 0x%02x, len=%d. Queue full\n",
1761                         *mtod(m, uint8_t *), m->m_pkthdr.len);
1762
1763                 NG_FREE_M(m);
1764         } else {
1765                 /* Loose HCI packet type, enqueue mbuf and kick off task */
1766                 m_adj(m, sizeof(uint8_t));
1767                 NG_BT_MBUFQ_ENQUEUE(q, m);
1768                 ubt_task_schedule(sc, action);
1769                 UBT_NG_UNLOCK(sc);
1770         }
1771 done:
1772         NG_FREE_ITEM(item);
1773
1774         return (error);
1775 } /* ng_ubt_rcvdata */
1776
1777 /****************************************************************************
1778  ****************************************************************************
1779  **                              Module
1780  ****************************************************************************
1781  ****************************************************************************/
1782
1783 /*
1784  * Load/Unload the driver module
1785  */
1786
1787 static int
1788 ubt_modevent(module_t mod, int event, void *data)
1789 {
1790         int     error;
1791
1792         switch (event) {
1793         case MOD_LOAD:
1794                 error = ng_newtype(&typestruct);
1795                 if (error != 0)
1796                         printf("%s: Could not register Netgraph node type, " \
1797                                 "error=%d\n", NG_UBT_NODE_TYPE, error);
1798                 break;
1799
1800         case MOD_UNLOAD:
1801                 error = ng_rmtype(&typestruct);
1802                 break;
1803
1804         default:
1805                 error = EOPNOTSUPP;
1806                 break;
1807         }
1808
1809         return (error);
1810 } /* ubt_modevent */
1811
1812 static devclass_t       ubt_devclass;
1813
1814 static device_method_t  ubt_methods[] =
1815 {
1816         DEVMETHOD(device_probe, ubt_probe),
1817         DEVMETHOD(device_attach, ubt_attach),
1818         DEVMETHOD(device_detach, ubt_detach),
1819         DEVMETHOD_END
1820 };
1821
1822 static driver_t         ubt_driver =
1823 {
1824         .name =    "ubt",
1825         .methods = ubt_methods,
1826         .size =    sizeof(struct ubt_softc),
1827 };
1828
1829 DRIVER_MODULE(ng_ubt, uhub, ubt_driver, ubt_devclass, ubt_modevent, 0);
1830 MODULE_VERSION(ng_ubt, NG_BLUETOOTH_VERSION);
1831 MODULE_DEPEND(ng_ubt, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
1832 MODULE_DEPEND(ng_ubt, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
1833 MODULE_DEPEND(ng_ubt, usb, 1, 1, 1);
1834