1 /*
2  * ng_ubt.c
3  */
4 
5 /*-
6  * SPDX-License-Identifier: BSD-2-Clause
7  *
8  * Copyright (c) 2001-2009 Maksim Yevmenkin <m_evmenkin@yahoo.com>
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  * $Id: ng_ubt.c,v 1.16 2003/10/10 19:15:06 max Exp $
33  * $FreeBSD$
34  */
35 
36 /*
37  * NOTE: ng_ubt2 driver has a split personality. On one side it is
38  * a USB device driver and on the other it is a Netgraph node. This
39  * driver will *NOT* create traditional /dev/ enties, only Netgraph
40  * node.
41  *
42  * NOTE ON LOCKS USED: ng_ubt2 drives uses 2 locks (mutexes)
43  *
44  * 1) sc_if_mtx - lock for device's interface #0 and #1. This lock is used
45  *    by USB for any USB request going over device's interface #0 and #1,
46  *    i.e. interrupt, control, bulk and isoc. transfers.
47  *
48  * 2) sc_ng_mtx - this lock is used to protect shared (between USB, Netgraph
49  *    and Taskqueue) data, such as outgoing mbuf queues, task flags and hook
50  *    pointer. This lock *SHOULD NOT* be grabbed for a long time. In fact,
51  *    think of it as a spin lock.
52  *
53  * NOTE ON LOCKING STRATEGY: ng_ubt2 driver operates in 3 different contexts.
54  *
55  * 1) USB context. This is where all the USB related stuff happens. All
56  *    callbacks run in this context. All callbacks are called (by USB) with
57  *    appropriate interface lock held. It is (generally) allowed to grab
58  *    any additional locks.
59  *
60  * 2) Netgraph context. This is where all the Netgraph related stuff happens.
61  *    Since we mark node as WRITER, the Netgraph node will be "locked" (from
62  *    Netgraph point of view). Any variable that is only modified from the
63  *    Netgraph context does not require any additional locking. It is generally
64  *    *NOT* allowed to grab *ANY* additional locks. Whatever you do, *DO NOT*
65  *    grab any lock in the Netgraph context that could cause de-scheduling of
66  *    the Netgraph thread for significant amount of time. In fact, the only
67  *    lock that is allowed in the Netgraph context is the sc_ng_mtx lock.
68  *    Also make sure that any code that is called from the Netgraph context
69  *    follows the rule above.
70  *
71  * 3) Taskqueue context. This is where ubt_task runs. Since we are generally
72  *    NOT allowed to grab any lock that could cause de-scheduling in the
73  *    Netgraph context, and, USB requires us to grab interface lock before
74  *    doing things with transfers, it is safer to transition from the Netgraph
75  *    context to the Taskqueue context before we can call into USB subsystem.
76  *
77  * So, to put everything together, the rules are as follows.
78  *	It is OK to call from the USB context or the Taskqueue context into
79  * the Netgraph context (i.e. call NG_SEND_xxx functions). In other words
80  * it is allowed to call into the Netgraph context with locks held.
81  *	Is it *NOT* OK to call from the Netgraph context into the USB context,
82  * because USB requires us to grab interface locks, and, it is safer to
83  * avoid it. So, to make things safer we set task flags to indicate which
84  * actions we want to perform and schedule ubt_task which would run in the
85  * Taskqueue context.
86  *	Is is OK to call from the Taskqueue context into the USB context,
87  * and, ubt_task does just that (i.e. grabs appropriate interface locks
88  * before calling into USB).
89  *	Access to the outgoing queues, task flags and hook pointer is
90  * controlled by the sc_ng_mtx lock. It is an unavoidable evil. Again,
91  * sc_ng_mtx should really be a spin lock (and it is very likely to an
92  * equivalent of spin lock due to adaptive nature of FreeBSD mutexes).
93  *	All USB callbacks accept softc pointer as a private data. USB ensures
94  * that this pointer is valid.
95  */
96 
97 #include <sys/stdint.h>
98 #include <sys/stddef.h>
99 #include <sys/param.h>
100 #include <sys/queue.h>
101 #include <sys/types.h>
102 #include <sys/systm.h>
103 #include <sys/kernel.h>
104 #include <sys/bus.h>
105 #include <sys/module.h>
106 #include <sys/lock.h>
107 #include <sys/mutex.h>
108 #include <sys/condvar.h>
109 #include <sys/sysctl.h>
110 #include <sys/sx.h>
111 #include <sys/unistd.h>
112 #include <sys/callout.h>
113 #include <sys/malloc.h>
114 #include <sys/priv.h>
115 
116 #include "usbdevs.h"
117 #include <dev/usb/usb.h>
118 #include <dev/usb/usbdi.h>
119 #include <dev/usb/usbdi_util.h>
120 
121 #define	USB_DEBUG_VAR usb_debug
122 #include <dev/usb/usb_debug.h>
123 #include <dev/usb/usb_busdma.h>
124 
125 #include <sys/mbuf.h>
126 #include <sys/taskqueue.h>
127 
128 #include <netgraph/ng_message.h>
129 #include <netgraph/netgraph.h>
130 #include <netgraph/ng_parse.h>
131 #include <netgraph/bluetooth/include/ng_bluetooth.h>
132 #include <netgraph/bluetooth/include/ng_hci.h>
133 #include <netgraph/bluetooth/include/ng_ubt.h>
134 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h>
135 
136 static int		ubt_modevent(module_t, int, void *);
137 static device_probe_t	ubt_probe;
138 static device_attach_t	ubt_attach;
139 static device_detach_t	ubt_detach;
140 
141 static void		ubt_task_schedule(ubt_softc_p, int);
142 static task_fn_t	ubt_task;
143 
144 #define	ubt_xfer_start(sc, i)	usbd_transfer_start((sc)->sc_xfer[(i)])
145 
146 /* Netgraph methods */
147 static ng_constructor_t	ng_ubt_constructor;
148 static ng_shutdown_t	ng_ubt_shutdown;
149 static ng_newhook_t	ng_ubt_newhook;
150 static ng_connect_t	ng_ubt_connect;
151 static ng_disconnect_t	ng_ubt_disconnect;
152 static ng_rcvmsg_t	ng_ubt_rcvmsg;
153 static ng_rcvdata_t	ng_ubt_rcvdata;
154 
155 static int ng_usb_isoc_enable = 1;
156 
157 SYSCTL_INT(_net_bluetooth, OID_AUTO, usb_isoc_enable, CTLFLAG_RWTUN | CTLFLAG_MPSAFE,
158     &ng_usb_isoc_enable, 0, "enable isochronous transfers");
159 
160 /* Queue length */
161 static const struct ng_parse_struct_field	ng_ubt_node_qlen_type_fields[] =
162 {
163 	{ "queue", &ng_parse_int32_type, },
164 	{ "qlen",  &ng_parse_int32_type, },
165 	{ NULL, }
166 };
167 static const struct ng_parse_type		ng_ubt_node_qlen_type =
168 {
169 	&ng_parse_struct_type,
170 	&ng_ubt_node_qlen_type_fields
171 };
172 
173 /* Stat info */
174 static const struct ng_parse_struct_field	ng_ubt_node_stat_type_fields[] =
175 {
176 	{ "pckts_recv", &ng_parse_uint32_type, },
177 	{ "bytes_recv", &ng_parse_uint32_type, },
178 	{ "pckts_sent", &ng_parse_uint32_type, },
179 	{ "bytes_sent", &ng_parse_uint32_type, },
180 	{ "oerrors",    &ng_parse_uint32_type, },
181 	{ "ierrors",    &ng_parse_uint32_type, },
182 	{ NULL, }
183 };
184 static const struct ng_parse_type		ng_ubt_node_stat_type =
185 {
186 	&ng_parse_struct_type,
187 	&ng_ubt_node_stat_type_fields
188 };
189 
190 /* Netgraph node command list */
191 static const struct ng_cmdlist			ng_ubt_cmdlist[] =
192 {
193 	{
194 		NGM_UBT_COOKIE,
195 		NGM_UBT_NODE_SET_DEBUG,
196 		"set_debug",
197 		&ng_parse_uint16_type,
198 		NULL
199 	},
200 	{
201 		NGM_UBT_COOKIE,
202 		NGM_UBT_NODE_GET_DEBUG,
203 		"get_debug",
204 		NULL,
205 		&ng_parse_uint16_type
206 	},
207 	{
208 		NGM_UBT_COOKIE,
209 		NGM_UBT_NODE_SET_QLEN,
210 		"set_qlen",
211 		&ng_ubt_node_qlen_type,
212 		NULL
213 	},
214 	{
215 		NGM_UBT_COOKIE,
216 		NGM_UBT_NODE_GET_QLEN,
217 		"get_qlen",
218 		&ng_ubt_node_qlen_type,
219 		&ng_ubt_node_qlen_type
220 	},
221 	{
222 		NGM_UBT_COOKIE,
223 		NGM_UBT_NODE_GET_STAT,
224 		"get_stat",
225 		NULL,
226 		&ng_ubt_node_stat_type
227 	},
228 	{
229 		NGM_UBT_COOKIE,
230 		NGM_UBT_NODE_RESET_STAT,
231 		"reset_stat",
232 		NULL,
233 		NULL
234 	},
235 	{ 0, }
236 };
237 
238 /* Netgraph node type */
239 static struct ng_type	typestruct =
240 {
241 	.version = 	NG_ABI_VERSION,
242 	.name =		NG_UBT_NODE_TYPE,
243 	.constructor =	ng_ubt_constructor,
244 	.rcvmsg =	ng_ubt_rcvmsg,
245 	.shutdown =	ng_ubt_shutdown,
246 	.newhook =	ng_ubt_newhook,
247 	.connect =	ng_ubt_connect,
248 	.rcvdata =	ng_ubt_rcvdata,
249 	.disconnect =	ng_ubt_disconnect,
250 	.cmdlist =	ng_ubt_cmdlist
251 };
252 
253 /****************************************************************************
254  ****************************************************************************
255  **                              USB specific
256  ****************************************************************************
257  ****************************************************************************/
258 
259 /* USB methods */
260 static usb_callback_t	ubt_probe_intr_callback;
261 static usb_callback_t	ubt_ctrl_write_callback;
262 static usb_callback_t	ubt_intr_read_callback;
263 static usb_callback_t	ubt_bulk_read_callback;
264 static usb_callback_t	ubt_bulk_write_callback;
265 static usb_callback_t	ubt_isoc_read_callback;
266 static usb_callback_t	ubt_isoc_write_callback;
267 
268 static int		ubt_fwd_mbuf_up(ubt_softc_p, struct mbuf **);
269 static int		ubt_isoc_read_one_frame(struct usb_xfer *, int);
270 
271 /*
272  * USB config
273  *
274  * The following desribes usb transfers that could be submitted on USB device.
275  *
276  * Interface 0 on the USB device must present the following endpoints
277  *	1) Interrupt endpoint to receive HCI events
278  *	2) Bulk IN endpoint to receive ACL data
279  *	3) Bulk OUT endpoint to send ACL data
280  *
281  * Interface 1 on the USB device must present the following endpoints
282  *	1) Isochronous IN endpoint to receive SCO data
283  *	2) Isochronous OUT endpoint to send SCO data
284  */
285 
286 static const struct usb_config		ubt_config[UBT_N_TRANSFER] =
287 {
288 	/*
289 	 * Interface #0
290  	 */
291 
292 	/* Outgoing bulk transfer - ACL packets */
293 	[UBT_IF_0_BULK_DT_WR] = {
294 		.type =		UE_BULK,
295 		.endpoint =	UE_ADDR_ANY,
296 		.direction =	UE_DIR_OUT,
297 		.if_index = 	0,
298 		.bufsize =	UBT_BULK_WRITE_BUFFER_SIZE,
299 		.flags =	{ .pipe_bof = 1, .force_short_xfer = 1, },
300 		.callback =	&ubt_bulk_write_callback,
301 	},
302 	/* Incoming bulk transfer - ACL packets */
303 	[UBT_IF_0_BULK_DT_RD] = {
304 		.type =		UE_BULK,
305 		.endpoint =	UE_ADDR_ANY,
306 		.direction =	UE_DIR_IN,
307 		.if_index = 	0,
308 		.bufsize =	UBT_BULK_READ_BUFFER_SIZE,
309 		.flags =	{ .pipe_bof = 1, .short_xfer_ok = 1, },
310 		.callback =	&ubt_bulk_read_callback,
311 	},
312 	/* Incoming interrupt transfer - HCI events */
313 	[UBT_IF_0_INTR_DT_RD] = {
314 		.type =		UE_INTERRUPT,
315 		.endpoint =	UE_ADDR_ANY,
316 		.direction =	UE_DIR_IN,
317 		.if_index = 	0,
318 		.flags =	{ .pipe_bof = 1, .short_xfer_ok = 1, },
319 		.bufsize =	UBT_INTR_BUFFER_SIZE,
320 		.callback =	&ubt_intr_read_callback,
321 	},
322 	/* Outgoing control transfer - HCI commands */
323 	[UBT_IF_0_CTRL_DT_WR] = {
324 		.type =		UE_CONTROL,
325 		.endpoint =	0x00,	/* control pipe */
326 		.direction =	UE_DIR_ANY,
327 		.if_index = 	0,
328 		.bufsize =	UBT_CTRL_BUFFER_SIZE,
329 		.callback =	&ubt_ctrl_write_callback,
330 		.timeout =	5000,	/* 5 seconds */
331 	},
332 
333 	/*
334 	 * Interface #1
335  	 */
336 
337 	/* Incoming isochronous transfer #1 - SCO packets */
338 	[UBT_IF_1_ISOC_DT_RD1] = {
339 		.type =		UE_ISOCHRONOUS,
340 		.endpoint =	UE_ADDR_ANY,
341 		.direction =	UE_DIR_IN,
342 		.if_index = 	1,
343 		.bufsize =	0,	/* use "wMaxPacketSize * frames" */
344 		.frames =	UBT_ISOC_NFRAMES,
345 		.flags =	{ .short_xfer_ok = 1, },
346 		.callback =	&ubt_isoc_read_callback,
347 	},
348 	/* Incoming isochronous transfer #2 - SCO packets */
349 	[UBT_IF_1_ISOC_DT_RD2] = {
350 		.type =		UE_ISOCHRONOUS,
351 		.endpoint =	UE_ADDR_ANY,
352 		.direction =	UE_DIR_IN,
353 		.if_index = 	1,
354 		.bufsize =	0,	/* use "wMaxPacketSize * frames" */
355 		.frames =	UBT_ISOC_NFRAMES,
356 		.flags =	{ .short_xfer_ok = 1, },
357 		.callback =	&ubt_isoc_read_callback,
358 	},
359 	/* Outgoing isochronous transfer #1 - SCO packets */
360 	[UBT_IF_1_ISOC_DT_WR1] = {
361 		.type =		UE_ISOCHRONOUS,
362 		.endpoint =	UE_ADDR_ANY,
363 		.direction =	UE_DIR_OUT,
364 		.if_index = 	1,
365 		.bufsize =	0,	/* use "wMaxPacketSize * frames" */
366 		.frames =	UBT_ISOC_NFRAMES,
367 		.flags =	{ .short_xfer_ok = 1, },
368 		.callback =	&ubt_isoc_write_callback,
369 	},
370 	/* Outgoing isochronous transfer #2 - SCO packets */
371 	[UBT_IF_1_ISOC_DT_WR2] = {
372 		.type =		UE_ISOCHRONOUS,
373 		.endpoint =	UE_ADDR_ANY,
374 		.direction =	UE_DIR_OUT,
375 		.if_index = 	1,
376 		.bufsize =	0,	/* use "wMaxPacketSize * frames" */
377 		.frames =	UBT_ISOC_NFRAMES,
378 		.flags =	{ .short_xfer_ok = 1, },
379 		.callback =	&ubt_isoc_write_callback,
380 	},
381 };
382 
383 /*
384  * If for some reason device should not be attached then put
385  * VendorID/ProductID pair into the list below. The format is
386  * as follows:
387  *
388  *	{ USB_VPI(VENDOR_ID, PRODUCT_ID, 0) },
389  *
390  * where VENDOR_ID and PRODUCT_ID are hex numbers.
391  */
392 
393 static const STRUCT_USB_HOST_ID ubt_ignore_devs[] =
394 {
395 	/* AVM USB Bluetooth-Adapter BlueFritz! v1.0 */
396 	{ USB_VPI(USB_VENDOR_AVM, 0x2200, 0) },
397 
398 	/* Atheros 3011 with sflash firmware */
399 	{ USB_VPI(0x0cf3, 0x3002, 0) },
400 	{ USB_VPI(0x0cf3, 0xe019, 0) },
401 	{ USB_VPI(0x13d3, 0x3304, 0) },
402 	{ USB_VPI(0x0930, 0x0215, 0) },
403 	{ USB_VPI(0x0489, 0xe03d, 0) },
404 	{ USB_VPI(0x0489, 0xe027, 0) },
405 
406 	/* Atheros AR9285 Malbec with sflash firmware */
407 	{ USB_VPI(0x03f0, 0x311d, 0) },
408 
409 	/* Atheros 3012 with sflash firmware */
410 	{ USB_VPI(0x0cf3, 0x3004, 0), USB_DEV_BCD_LTEQ(1) },
411 	{ USB_VPI(0x0cf3, 0x311d, 0), USB_DEV_BCD_LTEQ(1) },
412 	{ USB_VPI(0x13d3, 0x3375, 0), USB_DEV_BCD_LTEQ(1) },
413 	{ USB_VPI(0x04ca, 0x3005, 0), USB_DEV_BCD_LTEQ(1) },
414 	{ USB_VPI(0x04ca, 0x3006, 0), USB_DEV_BCD_LTEQ(1) },
415 	{ USB_VPI(0x04ca, 0x3008, 0), USB_DEV_BCD_LTEQ(1) },
416 	{ USB_VPI(0x13d3, 0x3362, 0), USB_DEV_BCD_LTEQ(1) },
417 	{ USB_VPI(0x0cf3, 0xe004, 0), USB_DEV_BCD_LTEQ(1) },
418 	{ USB_VPI(0x0930, 0x0219, 0), USB_DEV_BCD_LTEQ(1) },
419 	{ USB_VPI(0x0489, 0xe057, 0), USB_DEV_BCD_LTEQ(1) },
420 	{ USB_VPI(0x13d3, 0x3393, 0), USB_DEV_BCD_LTEQ(1) },
421 	{ USB_VPI(0x0489, 0xe04e, 0), USB_DEV_BCD_LTEQ(1) },
422 	{ USB_VPI(0x0489, 0xe056, 0), USB_DEV_BCD_LTEQ(1) },
423 
424 	/* Atheros AR5BBU12 with sflash firmware */
425 	{ USB_VPI(0x0489, 0xe02c, 0), USB_DEV_BCD_LTEQ(1) },
426 
427 	/* Atheros AR5BBU12 with sflash firmware */
428 	{ USB_VPI(0x0489, 0xe03c, 0), USB_DEV_BCD_LTEQ(1) },
429 	{ USB_VPI(0x0489, 0xe036, 0), USB_DEV_BCD_LTEQ(1) },
430 
431 	/* Intel Wireless controllers are handled in ng_ubt_intel.c */
432 	{ USB_VPI(USB_VENDOR_INTEL2, 0x07dc, 0) },
433 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0a2a, 0) },
434 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0aa7, 0) },
435 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0a2b, 0) },
436 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0aaa, 0) },
437 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0025, 0) },
438 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0026, 0) },
439 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0029, 0) },
440 
441 	/*
442 	 * Some Intel controllers are not yet supported by ng_ubt_intel and
443 	 * should be ignored.
444 	 */
445 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0032, 0) },
446 	{ USB_VPI(USB_VENDOR_INTEL2, 0x0033, 0) },
447 };
448 
449 /* List of supported bluetooth devices */
450 static const STRUCT_USB_HOST_ID ubt_devs[] =
451 {
452 	/* Generic Bluetooth class devices */
453 	{ USB_IFACE_CLASS(UDCLASS_WIRELESS),
454 	  USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
455 	  USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
456 
457 	/* AVM USB Bluetooth-Adapter BlueFritz! v2.0 */
458 	{ USB_VPI(USB_VENDOR_AVM, 0x3800, 0) },
459 
460 	/* Broadcom USB dongles, mostly BCM20702 and BCM20702A0 */
461 	{ USB_VENDOR(USB_VENDOR_BROADCOM),
462 	  USB_IFACE_CLASS(UICLASS_VENDOR),
463 	  USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
464 	  USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
465 
466 	/* Apple-specific (Broadcom) devices */
467 	{ USB_VENDOR(USB_VENDOR_APPLE),
468 	  USB_IFACE_CLASS(UICLASS_VENDOR),
469 	  USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
470 	  USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
471 
472 	/* Foxconn - Hon Hai */
473 	{ USB_VENDOR(USB_VENDOR_FOXCONN),
474 	  USB_IFACE_CLASS(UICLASS_VENDOR),
475 	  USB_IFACE_SUBCLASS(UDSUBCLASS_RF),
476 	  USB_IFACE_PROTOCOL(UDPROTO_BLUETOOTH) },
477 
478 	/* MediaTek MT76x0E */
479 	{ USB_VPI(USB_VENDOR_MEDIATEK, 0x763f, 0) },
480 
481 	/* Broadcom SoftSailing reporting vendor specific */
482 	{ USB_VPI(USB_VENDOR_BROADCOM, 0x21e1, 0) },
483 
484 	/* Apple MacBookPro 7,1 */
485 	{ USB_VPI(USB_VENDOR_APPLE, 0x8213, 0) },
486 
487 	/* Apple iMac11,1 */
488 	{ USB_VPI(USB_VENDOR_APPLE, 0x8215, 0) },
489 
490 	/* Apple MacBookPro6,2 */
491 	{ USB_VPI(USB_VENDOR_APPLE, 0x8218, 0) },
492 
493 	/* Apple MacBookAir3,1, MacBookAir3,2 */
494 	{ USB_VPI(USB_VENDOR_APPLE, 0x821b, 0) },
495 
496 	/* Apple MacBookAir4,1 */
497 	{ USB_VPI(USB_VENDOR_APPLE, 0x821f, 0) },
498 
499 	/* MacBookAir6,1 */
500 	{ USB_VPI(USB_VENDOR_APPLE, 0x828f, 0) },
501 
502 	/* Apple MacBookPro8,2 */
503 	{ USB_VPI(USB_VENDOR_APPLE, 0x821a, 0) },
504 
505 	/* Apple MacMini5,1 */
506 	{ USB_VPI(USB_VENDOR_APPLE, 0x8281, 0) },
507 
508 	/* Bluetooth Ultraport Module from IBM */
509 	{ USB_VPI(USB_VENDOR_TDK, 0x030a, 0) },
510 
511 	/* ALPS Modules with non-standard ID */
512 	{ USB_VPI(USB_VENDOR_ALPS, 0x3001, 0) },
513 	{ USB_VPI(USB_VENDOR_ALPS, 0x3002, 0) },
514 
515 	{ USB_VPI(USB_VENDOR_ERICSSON2, 0x1002, 0) },
516 
517 	/* Canyon CN-BTU1 with HID interfaces */
518 	{ USB_VPI(USB_VENDOR_CANYON, 0x0000, 0) },
519 
520 	/* Broadcom BCM20702A0 */
521 	{ USB_VPI(USB_VENDOR_ASUS, 0x17b5, 0) },
522 	{ USB_VPI(USB_VENDOR_ASUS, 0x17cb, 0) },
523 	{ USB_VPI(USB_VENDOR_LITEON, 0x2003, 0) },
524 	{ USB_VPI(USB_VENDOR_FOXCONN, 0xe042, 0) },
525 	{ USB_VPI(USB_VENDOR_DELL, 0x8197, 0) },
526 	{ USB_VPI(USB_VENDOR_BELKIN, 0x065a, 0) },
527 };
528 
529 /*
530  * Does a synchronous (waits for completion event) execution of HCI command.
531  * Size of both command and response buffers are passed in length field of
532  * corresponding structures in "Parameter Total Length" format i.e.
533  * not including HCI packet headers.
534  *
535  * Must not be used after USB transfers have been configured in attach routine.
536  */
537 
538 usb_error_t
539 ubt_do_hci_request(struct usb_device *udev, struct ubt_hci_cmd *cmd,
540     void *evt, usb_timeout_t timeout)
541 {
542 	static const struct usb_config ubt_probe_config = {
543 		.type = UE_INTERRUPT,
544 		.endpoint = UE_ADDR_ANY,
545 		.direction = UE_DIR_IN,
546 		.flags = { .pipe_bof = 1, .short_xfer_ok = 1 },
547 		.bufsize = UBT_INTR_BUFFER_SIZE,
548 		.callback = &ubt_probe_intr_callback,
549 	};
550 	struct usb_device_request req;
551 	struct usb_xfer *xfer[1];
552 	struct mtx mtx;
553 	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
554 	uint8_t iface_index = 0;
555 
556 	/* Initialize a USB control request and then do it */
557 	bzero(&req, sizeof(req));
558 	req.bmRequestType = UBT_HCI_REQUEST;
559 	req.wIndex[0] = iface_index;
560 	USETW(req.wLength, UBT_HCI_CMD_SIZE(cmd));
561 
562 	error = usbd_do_request(udev, NULL, &req, cmd);
563 	if (error != USB_ERR_NORMAL_COMPLETION) {
564 		printf("ng_ubt: usbd_do_request error=%s\n",
565 			usbd_errstr(error));
566 		return (error);
567 	}
568 
569 	if (evt == NULL)
570 		return (USB_ERR_NORMAL_COMPLETION);
571 
572 	/* Initialize INTR endpoint xfer and wait for response */
573 	mtx_init(&mtx, "ubt pb", NULL, MTX_DEF | MTX_NEW);
574 
575 	error = usbd_transfer_setup(udev, &iface_index, xfer,
576 	    &ubt_probe_config, 1, evt, &mtx);
577 	if (error == USB_ERR_NORMAL_COMPLETION) {
578 		mtx_lock(&mtx);
579 		usbd_transfer_start(*xfer);
580 
581 		if (msleep_sbt(evt, &mtx, 0, "ubt pb", SBT_1MS * timeout,
582 				0, C_HARDCLOCK) == EWOULDBLOCK) {
583 			printf("ng_ubt: HCI command 0x%04x timed out\n",
584 				le16toh(cmd->opcode));
585 			error = USB_ERR_TIMEOUT;
586 		}
587 
588 		usbd_transfer_stop(*xfer);
589 		mtx_unlock(&mtx);
590 
591 		usbd_transfer_unsetup(xfer, 1);
592 	} else
593 		printf("ng_ubt: usbd_transfer_setup error=%s\n",
594 			usbd_errstr(error));
595 
596 	mtx_destroy(&mtx);
597 
598 	return (error);
599 }
600 
601 /*
602  * Probe for a USB Bluetooth device.
603  * USB context.
604  */
605 
606 static int
607 ubt_probe(device_t dev)
608 {
609 	struct usb_attach_arg	*uaa = device_get_ivars(dev);
610 	const struct usb_device_id *id;
611 
612 	if (uaa->usb_mode != USB_MODE_HOST)
613 		return (ENXIO);
614 
615 	if (usbd_lookup_id_by_uaa(ubt_ignore_devs,
616 			sizeof(ubt_ignore_devs), uaa) == 0)
617 		return (ENXIO);
618 
619 	id = usbd_lookup_id_by_info(ubt_devs,
620 	    sizeof(ubt_devs), &uaa->info);
621 	if (id == NULL)
622 		return (ENXIO);
623 
624 	if (uaa->info.bIfaceIndex != 0) {
625 		/* make sure we are matching the interface */
626 		if (id->match_flag_int_class &&
627 		    id->match_flag_int_subclass &&
628 		    id->match_flag_int_protocol)
629 			return (BUS_PROBE_GENERIC);
630 		else
631 			return (ENXIO);
632 	} else {
633 		return (BUS_PROBE_GENERIC);
634 	}
635 } /* ubt_probe */
636 
637 /*
638  * Attach the device.
639  * USB context.
640  */
641 
642 static int
643 ubt_attach(device_t dev)
644 {
645 	struct usb_attach_arg		*uaa = device_get_ivars(dev);
646 	struct ubt_softc		*sc = device_get_softc(dev);
647 	struct usb_endpoint_descriptor	*ed;
648 	struct usb_interface_descriptor *id;
649 	struct usb_interface		*iface[2];
650 	uint32_t			wMaxPacketSize;
651 	uint8_t				alt_index, i, j;
652 	uint8_t				iface_index[2];
653 
654 	device_set_usb_desc(dev);
655 
656 	iface_index[0] = uaa->info.bIfaceIndex;
657 	iface_index[1] = uaa->info.bIfaceIndex + 1;
658 
659 	iface[0] = usbd_get_iface(uaa->device, iface_index[0]);
660 	iface[1] = usbd_get_iface(uaa->device, iface_index[1]);
661 
662 	sc->sc_dev = dev;
663 	sc->sc_debug = NG_UBT_WARN_LEVEL;
664 
665 	/*
666 	 * Sanity checks.
667 	 */
668 
669 	if (iface[0] == NULL || iface[1] == NULL ||
670 	    iface[0]->idesc == NULL || iface[1]->idesc == NULL) {
671 		UBT_ALERT(sc, "could not get two interfaces\n");
672 		return (ENXIO);
673 	}
674 
675 	/*
676 	 * Create Netgraph node
677 	 */
678 
679 	if (ng_make_node_common(&typestruct, &sc->sc_node) != 0) {
680 		UBT_ALERT(sc, "could not create Netgraph node\n");
681 		return (ENXIO);
682 	}
683 
684 	/* Name Netgraph node */
685 	if (ng_name_node(sc->sc_node, device_get_nameunit(dev)) != 0) {
686 		UBT_ALERT(sc, "could not name Netgraph node\n");
687 		NG_NODE_UNREF(sc->sc_node);
688 		return (ENXIO);
689 	}
690 	NG_NODE_SET_PRIVATE(sc->sc_node, sc);
691 	NG_NODE_FORCE_WRITER(sc->sc_node);
692 
693 	/*
694 	 * Initialize device softc structure
695 	 */
696 
697 	/* initialize locks */
698 	mtx_init(&sc->sc_ng_mtx, "ubt ng", NULL, MTX_DEF);
699 	mtx_init(&sc->sc_if_mtx, "ubt if", NULL, MTX_DEF | MTX_RECURSE);
700 
701 	/* initialize packet queues */
702 	NG_BT_MBUFQ_INIT(&sc->sc_cmdq, UBT_DEFAULT_QLEN);
703 	NG_BT_MBUFQ_INIT(&sc->sc_aclq, UBT_DEFAULT_QLEN);
704 	NG_BT_MBUFQ_INIT(&sc->sc_scoq, UBT_DEFAULT_QLEN);
705 
706 	/* initialize glue task */
707 	TASK_INIT(&sc->sc_task, 0, ubt_task, sc);
708 
709 	/*
710 	 * Configure Bluetooth USB device. Discover all required USB
711 	 * interfaces and endpoints.
712 	 *
713 	 * USB device must present two interfaces:
714 	 * 1) Interface 0 that has 3 endpoints
715 	 *	1) Interrupt endpoint to receive HCI events
716 	 *	2) Bulk IN endpoint to receive ACL data
717 	 *	3) Bulk OUT endpoint to send ACL data
718 	 *
719 	 * 2) Interface 1 then has 2 endpoints
720 	 *	1) Isochronous IN endpoint to receive SCO data
721  	 *	2) Isochronous OUT endpoint to send SCO data
722 	 *
723 	 * Interface 1 (with isochronous endpoints) has several alternate
724 	 * configurations with different packet size.
725 	 */
726 
727 	/*
728 	 * For interface #1 search alternate settings, and find
729 	 * the descriptor with the largest wMaxPacketSize
730 	 */
731 
732 	wMaxPacketSize = 0;
733 	alt_index = 0;
734 	i = 0;
735 	j = 0;
736 	ed = NULL;
737 
738 	/*
739 	 * Search through all the descriptors looking for the largest
740 	 * packet size:
741 	 */
742 	while ((ed = (struct usb_endpoint_descriptor *)usb_desc_foreach(
743 	    usbd_get_config_descriptor(uaa->device),
744 	    (struct usb_descriptor *)ed))) {
745 		if ((ed->bDescriptorType == UDESC_INTERFACE) &&
746 		    (ed->bLength >= sizeof(*id))) {
747 			id = (struct usb_interface_descriptor *)ed;
748 			i = (id->bInterfaceNumber == iface[1]->idesc->bInterfaceNumber);
749 			j = id->bAlternateSetting;
750 		}
751 
752 		if ((ed->bDescriptorType == UDESC_ENDPOINT) &&
753 		    (ed->bLength >= sizeof(*ed)) &&
754 		    (i != 0)) {
755 			uint32_t temp;
756 
757 			temp = usbd_get_max_frame_length(
758 			    ed, NULL, usbd_get_speed(uaa->device));
759 			if (temp > wMaxPacketSize) {
760 				wMaxPacketSize = temp;
761 				alt_index = j;
762 			}
763 		}
764 	}
765 
766 	/* Set alt configuration on interface #1 only if we found it */
767 	if (wMaxPacketSize > 0 &&
768 	    usbd_set_alt_interface_index(uaa->device, iface_index[1], alt_index)) {
769 		UBT_ALERT(sc, "could not set alternate setting %d " \
770 			"for interface 1!\n", alt_index);
771 		goto detach;
772 	}
773 
774 	/* Setup transfers for both interfaces */
775 	if (usbd_transfer_setup(uaa->device, iface_index, sc->sc_xfer, ubt_config,
776 			ng_usb_isoc_enable ? UBT_N_TRANSFER : UBT_IF_1_ISOC_DT_RD1,
777 			sc, &sc->sc_if_mtx)) {
778 		UBT_ALERT(sc, "could not allocate transfers\n");
779 		goto detach;
780 	}
781 
782 	/* Claim second interface belonging to the Bluetooth part */
783 	usbd_set_parent_iface(uaa->device, iface_index[1], uaa->info.bIfaceIndex);
784 
785 	return (0); /* success */
786 
787 detach:
788 	ubt_detach(dev);
789 
790 	return (ENXIO);
791 } /* ubt_attach */
792 
793 /*
794  * Detach the device.
795  * USB context.
796  */
797 
798 int
799 ubt_detach(device_t dev)
800 {
801 	struct ubt_softc	*sc = device_get_softc(dev);
802 	node_p			node = sc->sc_node;
803 
804 	/* Destroy Netgraph node */
805 	if (node != NULL) {
806 		sc->sc_node = NULL;
807 		NG_NODE_REALLY_DIE(node);
808 		ng_rmnode_self(node);
809 	}
810 
811 	/* Make sure ubt_task in gone */
812 	taskqueue_drain(taskqueue_swi, &sc->sc_task);
813 
814 	/* Free USB transfers, if any */
815 	usbd_transfer_unsetup(sc->sc_xfer, UBT_N_TRANSFER);
816 
817 	/* Destroy queues */
818 	UBT_NG_LOCK(sc);
819 	NG_BT_MBUFQ_DESTROY(&sc->sc_cmdq);
820 	NG_BT_MBUFQ_DESTROY(&sc->sc_aclq);
821 	NG_BT_MBUFQ_DESTROY(&sc->sc_scoq);
822 	UBT_NG_UNLOCK(sc);
823 
824 	mtx_destroy(&sc->sc_if_mtx);
825 	mtx_destroy(&sc->sc_ng_mtx);
826 
827 	return (0);
828 } /* ubt_detach */
829 
830 /*
831  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
832  * HCI event was received from the device during device probe stage.
833  * USB context.
834  */
835 
836 static void
837 ubt_probe_intr_callback(struct usb_xfer *xfer, usb_error_t error)
838 {
839 	struct ubt_hci_event	*evt = usbd_xfer_softc(xfer);
840 	struct usb_page_cache	*pc;
841 	int			actlen;
842 
843 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
844 
845 	switch (USB_GET_STATE(xfer)) {
846 	case USB_ST_TRANSFERRED:
847 		if (actlen > UBT_HCI_EVENT_SIZE(evt))
848 			actlen = UBT_HCI_EVENT_SIZE(evt);
849 		pc = usbd_xfer_get_frame(xfer, 0);
850 		usbd_copy_out(pc, 0, evt, actlen);
851 		/* OneShot mode */
852 		wakeup(evt);
853 		break;
854 
855         case USB_ST_SETUP:
856 submit_next:
857 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
858 		usbd_transfer_submit(xfer);
859 		break;
860 
861 	default:
862 		if (error != USB_ERR_CANCELLED) {
863 			printf("ng_ubt: interrupt transfer failed: %s\n",
864 				usbd_errstr(error));
865 			/* Try clear stall first */
866 			usbd_xfer_set_stall(xfer);
867 			goto submit_next;
868 		}
869 		break;
870 	}
871 } /* ubt_probe_intr_callback */
872 
873 /*
874  * Called when outgoing control request (HCI command) has completed, i.e.
875  * HCI command was sent to the device.
876  * USB context.
877  */
878 
879 static void
880 ubt_ctrl_write_callback(struct usb_xfer *xfer, usb_error_t error)
881 {
882 	struct ubt_softc		*sc = usbd_xfer_softc(xfer);
883 	struct usb_device_request	req;
884 	struct mbuf			*m;
885 	struct usb_page_cache		*pc;
886 	int				actlen;
887 
888 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
889 
890 	switch (USB_GET_STATE(xfer)) {
891 	case USB_ST_TRANSFERRED:
892 		UBT_INFO(sc, "sent %d bytes to control pipe\n", actlen);
893 		UBT_STAT_BYTES_SENT(sc, actlen);
894 		UBT_STAT_PCKTS_SENT(sc);
895 		/* FALLTHROUGH */
896 
897 	case USB_ST_SETUP:
898 send_next:
899 		/* Get next command mbuf, if any */
900 		UBT_NG_LOCK(sc);
901 		NG_BT_MBUFQ_DEQUEUE(&sc->sc_cmdq, m);
902 		UBT_NG_UNLOCK(sc);
903 
904 		if (m == NULL) {
905 			UBT_INFO(sc, "HCI command queue is empty\n");
906 			break;	/* transfer complete */
907 		}
908 
909 		/* Initialize a USB control request and then schedule it */
910 		bzero(&req, sizeof(req));
911 		req.bmRequestType = UBT_HCI_REQUEST;
912 		USETW(req.wLength, m->m_pkthdr.len);
913 
914 		UBT_INFO(sc, "Sending control request, " \
915 			"bmRequestType=0x%02x, wLength=%d\n",
916 			req.bmRequestType, UGETW(req.wLength));
917 
918 		pc = usbd_xfer_get_frame(xfer, 0);
919 		usbd_copy_in(pc, 0, &req, sizeof(req));
920 		pc = usbd_xfer_get_frame(xfer, 1);
921 		usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
922 
923 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
924 		usbd_xfer_set_frame_len(xfer, 1, m->m_pkthdr.len);
925 		usbd_xfer_set_frames(xfer, 2);
926 
927 		NG_FREE_M(m);
928 
929 		usbd_transfer_submit(xfer);
930 		break;
931 
932 	default: /* Error */
933 		if (error != USB_ERR_CANCELLED) {
934 			UBT_WARN(sc, "control transfer failed: %s\n",
935 				usbd_errstr(error));
936 
937 			UBT_STAT_OERROR(sc);
938 			goto send_next;
939 		}
940 
941 		/* transfer cancelled */
942 		break;
943 	}
944 } /* ubt_ctrl_write_callback */
945 
946 /*
947  * Called when incoming interrupt transfer (HCI event) has completed, i.e.
948  * HCI event was received from the device.
949  * USB context.
950  */
951 
952 static void
953 ubt_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
954 {
955 	struct ubt_softc	*sc = usbd_xfer_softc(xfer);
956 	struct mbuf		*m;
957 	ng_hci_event_pkt_t	*hdr;
958 	struct usb_page_cache	*pc;
959 	int			actlen;
960 
961 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
962 
963 	m = NULL;
964 
965 	switch (USB_GET_STATE(xfer)) {
966 	case USB_ST_TRANSFERRED:
967 		/* Allocate a new mbuf */
968 		MGETHDR(m, M_NOWAIT, MT_DATA);
969 		if (m == NULL) {
970 			UBT_STAT_IERROR(sc);
971 			goto submit_next;
972 		}
973 
974 		if (!(MCLGET(m, M_NOWAIT))) {
975 			UBT_STAT_IERROR(sc);
976 			goto submit_next;
977 		}
978 
979 		/* Add HCI packet type */
980 		*mtod(m, uint8_t *)= NG_HCI_EVENT_PKT;
981 		m->m_pkthdr.len = m->m_len = 1;
982 
983 		if (actlen > MCLBYTES - 1)
984 			actlen = MCLBYTES - 1;
985 
986 		pc = usbd_xfer_get_frame(xfer, 0);
987 		usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
988 		m->m_pkthdr.len += actlen;
989 		m->m_len += actlen;
990 
991 		UBT_INFO(sc, "got %d bytes from interrupt pipe\n",
992 			actlen);
993 
994 		/* Validate packet and send it up the stack */
995 		if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
996 			UBT_INFO(sc, "HCI event packet is too short\n");
997 
998 			UBT_STAT_IERROR(sc);
999 			goto submit_next;
1000 		}
1001 
1002 		hdr = mtod(m, ng_hci_event_pkt_t *);
1003 		if (hdr->length != (m->m_pkthdr.len - sizeof(*hdr))) {
1004 			UBT_ERR(sc, "Invalid HCI event packet size, " \
1005 				"length=%d, pktlen=%d\n",
1006 				hdr->length, m->m_pkthdr.len);
1007 
1008 			UBT_STAT_IERROR(sc);
1009 			goto submit_next;
1010 		}
1011 
1012 		UBT_INFO(sc, "got complete HCI event frame, pktlen=%d, " \
1013 			"length=%d\n", m->m_pkthdr.len, hdr->length);
1014 
1015 		UBT_STAT_PCKTS_RECV(sc);
1016 		UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1017 
1018 		ubt_fwd_mbuf_up(sc, &m);
1019 		/* m == NULL at this point */
1020 		/* FALLTHROUGH */
1021 
1022 	case USB_ST_SETUP:
1023 submit_next:
1024 		NG_FREE_M(m); /* checks for m != NULL */
1025 
1026 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1027 		usbd_transfer_submit(xfer);
1028 		break;
1029 
1030 	default: /* Error */
1031 		if (error != USB_ERR_CANCELLED) {
1032 			UBT_WARN(sc, "interrupt transfer failed: %s\n",
1033 				usbd_errstr(error));
1034 
1035 			/* Try to clear stall first */
1036 			usbd_xfer_set_stall(xfer);
1037 			goto submit_next;
1038 		}
1039 			/* transfer cancelled */
1040 		break;
1041 	}
1042 } /* ubt_intr_read_callback */
1043 
1044 /*
1045  * Called when incoming bulk transfer (ACL packet) has completed, i.e.
1046  * ACL packet was received from the device.
1047  * USB context.
1048  */
1049 
1050 static void
1051 ubt_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1052 {
1053 	struct ubt_softc	*sc = usbd_xfer_softc(xfer);
1054 	struct mbuf		*m;
1055 	ng_hci_acldata_pkt_t	*hdr;
1056 	struct usb_page_cache	*pc;
1057 	int len;
1058 	int actlen;
1059 
1060 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1061 
1062 	m = NULL;
1063 
1064 	switch (USB_GET_STATE(xfer)) {
1065 	case USB_ST_TRANSFERRED:
1066 		/* Allocate new mbuf */
1067 		MGETHDR(m, M_NOWAIT, MT_DATA);
1068 		if (m == NULL) {
1069 			UBT_STAT_IERROR(sc);
1070 			goto submit_next;
1071 		}
1072 
1073 		if (!(MCLGET(m, M_NOWAIT))) {
1074 			UBT_STAT_IERROR(sc);
1075 			goto submit_next;
1076 		}
1077 
1078 		/* Add HCI packet type */
1079 		*mtod(m, uint8_t *)= NG_HCI_ACL_DATA_PKT;
1080 		m->m_pkthdr.len = m->m_len = 1;
1081 
1082 		if (actlen > MCLBYTES - 1)
1083 			actlen = MCLBYTES - 1;
1084 
1085 		pc = usbd_xfer_get_frame(xfer, 0);
1086 		usbd_copy_out(pc, 0, mtod(m, uint8_t *) + 1, actlen);
1087 		m->m_pkthdr.len += actlen;
1088 		m->m_len += actlen;
1089 
1090 		UBT_INFO(sc, "got %d bytes from bulk-in pipe\n",
1091 			actlen);
1092 
1093 		/* Validate packet and send it up the stack */
1094 		if (m->m_pkthdr.len < (int)sizeof(*hdr)) {
1095 			UBT_INFO(sc, "HCI ACL packet is too short\n");
1096 
1097 			UBT_STAT_IERROR(sc);
1098 			goto submit_next;
1099 		}
1100 
1101 		hdr = mtod(m, ng_hci_acldata_pkt_t *);
1102 		len = le16toh(hdr->length);
1103 		if (len != (int)(m->m_pkthdr.len - sizeof(*hdr))) {
1104 			UBT_ERR(sc, "Invalid ACL packet size, length=%d, " \
1105 				"pktlen=%d\n", len, m->m_pkthdr.len);
1106 
1107 			UBT_STAT_IERROR(sc);
1108 			goto submit_next;
1109 		}
1110 
1111 		UBT_INFO(sc, "got complete ACL data packet, pktlen=%d, " \
1112 			"length=%d\n", m->m_pkthdr.len, len);
1113 
1114 		UBT_STAT_PCKTS_RECV(sc);
1115 		UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1116 
1117 		ubt_fwd_mbuf_up(sc, &m);
1118 		/* m == NULL at this point */
1119 		/* FALLTHOUGH */
1120 
1121 	case USB_ST_SETUP:
1122 submit_next:
1123 		NG_FREE_M(m); /* checks for m != NULL */
1124 
1125 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1126 		usbd_transfer_submit(xfer);
1127 		break;
1128 
1129 	default: /* Error */
1130 		if (error != USB_ERR_CANCELLED) {
1131 			UBT_WARN(sc, "bulk-in transfer failed: %s\n",
1132 				usbd_errstr(error));
1133 
1134 			/* Try to clear stall first */
1135 			usbd_xfer_set_stall(xfer);
1136 			goto submit_next;
1137 		}
1138 			/* transfer cancelled */
1139 		break;
1140 	}
1141 } /* ubt_bulk_read_callback */
1142 
1143 /*
1144  * Called when outgoing bulk transfer (ACL packet) has completed, i.e.
1145  * ACL packet was sent to the device.
1146  * USB context.
1147  */
1148 
1149 static void
1150 ubt_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
1151 {
1152 	struct ubt_softc	*sc = usbd_xfer_softc(xfer);
1153 	struct mbuf		*m;
1154 	struct usb_page_cache	*pc;
1155 	int			actlen;
1156 
1157 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1158 
1159 	switch (USB_GET_STATE(xfer)) {
1160 	case USB_ST_TRANSFERRED:
1161 		UBT_INFO(sc, "sent %d bytes to bulk-out pipe\n", actlen);
1162 		UBT_STAT_BYTES_SENT(sc, actlen);
1163 		UBT_STAT_PCKTS_SENT(sc);
1164 		/* FALLTHROUGH */
1165 
1166 	case USB_ST_SETUP:
1167 send_next:
1168 		/* Get next mbuf, if any */
1169 		UBT_NG_LOCK(sc);
1170 		NG_BT_MBUFQ_DEQUEUE(&sc->sc_aclq, m);
1171 		UBT_NG_UNLOCK(sc);
1172 
1173 		if (m == NULL) {
1174 			UBT_INFO(sc, "ACL data queue is empty\n");
1175 			break; /* transfer completed */
1176 		}
1177 
1178 		/*
1179 		 * Copy ACL data frame back to a linear USB transfer buffer
1180 		 * and schedule transfer
1181 		 */
1182 
1183 		pc = usbd_xfer_get_frame(xfer, 0);
1184 		usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
1185 		usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
1186 
1187 		UBT_INFO(sc, "bulk-out transfer has been started, len=%d\n",
1188 			m->m_pkthdr.len);
1189 
1190 		NG_FREE_M(m);
1191 
1192 		usbd_transfer_submit(xfer);
1193 		break;
1194 
1195 	default: /* Error */
1196 		if (error != USB_ERR_CANCELLED) {
1197 			UBT_WARN(sc, "bulk-out transfer failed: %s\n",
1198 				usbd_errstr(error));
1199 
1200 			UBT_STAT_OERROR(sc);
1201 
1202 			/* try to clear stall first */
1203 			usbd_xfer_set_stall(xfer);
1204 			goto send_next;
1205 		}
1206 			/* transfer cancelled */
1207 		break;
1208 	}
1209 } /* ubt_bulk_write_callback */
1210 
1211 /*
1212  * Called when incoming isoc transfer (SCO packet) has completed, i.e.
1213  * SCO packet was received from the device.
1214  * USB context.
1215  */
1216 
1217 static void
1218 ubt_isoc_read_callback(struct usb_xfer *xfer, usb_error_t error)
1219 {
1220 	struct ubt_softc	*sc = usbd_xfer_softc(xfer);
1221 	int			n;
1222 	int actlen, nframes;
1223 
1224 	usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1225 
1226 	switch (USB_GET_STATE(xfer)) {
1227 	case USB_ST_TRANSFERRED:
1228 		for (n = 0; n < nframes; n ++)
1229 			if (ubt_isoc_read_one_frame(xfer, n) < 0)
1230 				break;
1231 		/* FALLTHROUGH */
1232 
1233 	case USB_ST_SETUP:
1234 read_next:
1235 		for (n = 0; n < nframes; n ++)
1236 			usbd_xfer_set_frame_len(xfer, n,
1237 			    usbd_xfer_max_framelen(xfer));
1238 
1239 		usbd_transfer_submit(xfer);
1240 		break;
1241 
1242 	default: /* Error */
1243                 if (error != USB_ERR_CANCELLED) {
1244                         UBT_STAT_IERROR(sc);
1245                         goto read_next;
1246                 }
1247 
1248 		/* transfer cancelled */
1249 		break;
1250 	}
1251 } /* ubt_isoc_read_callback */
1252 
1253 /*
1254  * Helper function. Called from ubt_isoc_read_callback() to read
1255  * SCO data from one frame.
1256  * USB context.
1257  */
1258 
1259 static int
1260 ubt_isoc_read_one_frame(struct usb_xfer *xfer, int frame_no)
1261 {
1262 	struct ubt_softc	*sc = usbd_xfer_softc(xfer);
1263 	struct usb_page_cache	*pc;
1264 	struct mbuf		*m;
1265 	int			len, want, got, total;
1266 
1267 	/* Get existing SCO reassembly buffer */
1268 	pc = usbd_xfer_get_frame(xfer, 0);
1269 	m = sc->sc_isoc_in_buffer;
1270 	total = usbd_xfer_frame_len(xfer, frame_no);
1271 
1272 	/* While we have data in the frame */
1273 	while (total > 0) {
1274 		if (m == NULL) {
1275 			/* Start new reassembly buffer */
1276 			MGETHDR(m, M_NOWAIT, MT_DATA);
1277 			if (m == NULL) {
1278 				UBT_STAT_IERROR(sc);
1279 				return (-1);	/* XXX out of sync! */
1280 			}
1281 
1282 			if (!(MCLGET(m, M_NOWAIT))) {
1283 				UBT_STAT_IERROR(sc);
1284 				NG_FREE_M(m);
1285 				return (-1);	/* XXX out of sync! */
1286 			}
1287 
1288 			/* Expect SCO header */
1289 			*mtod(m, uint8_t *) = NG_HCI_SCO_DATA_PKT;
1290 			m->m_pkthdr.len = m->m_len = got = 1;
1291 			want = sizeof(ng_hci_scodata_pkt_t);
1292 		} else {
1293 			/*
1294 			 * Check if we have SCO header and if so
1295 			 * adjust amount of data we want
1296 			 */
1297 			got = m->m_pkthdr.len;
1298 			want = sizeof(ng_hci_scodata_pkt_t);
1299 
1300 			if (got >= want)
1301 				want += mtod(m, ng_hci_scodata_pkt_t *)->length;
1302 		}
1303 
1304 		/* Append frame data to the SCO reassembly buffer */
1305 		len = total;
1306 		if (got + len > want)
1307 			len = want - got;
1308 
1309 		usbd_copy_out(pc, frame_no * usbd_xfer_max_framelen(xfer),
1310 			mtod(m, uint8_t *) + m->m_pkthdr.len, len);
1311 
1312 		m->m_pkthdr.len += len;
1313 		m->m_len += len;
1314 		total -= len;
1315 
1316 		/* Check if we got everything we wanted, if not - continue */
1317 		if (got != want)
1318 			continue;
1319 
1320 		/* If we got here then we got complete SCO frame */
1321 		UBT_INFO(sc, "got complete SCO data frame, pktlen=%d, " \
1322 			"length=%d\n", m->m_pkthdr.len,
1323 			mtod(m, ng_hci_scodata_pkt_t *)->length);
1324 
1325 		UBT_STAT_PCKTS_RECV(sc);
1326 		UBT_STAT_BYTES_RECV(sc, m->m_pkthdr.len);
1327 
1328 		ubt_fwd_mbuf_up(sc, &m);
1329 		/* m == NULL at this point */
1330 	}
1331 
1332 	/* Put SCO reassembly buffer back */
1333 	sc->sc_isoc_in_buffer = m;
1334 
1335 	return (0);
1336 } /* ubt_isoc_read_one_frame */
1337 
1338 /*
1339  * Called when outgoing isoc transfer (SCO packet) has completed, i.e.
1340  * SCO packet was sent to the device.
1341  * USB context.
1342  */
1343 
1344 static void
1345 ubt_isoc_write_callback(struct usb_xfer *xfer, usb_error_t error)
1346 {
1347 	struct ubt_softc	*sc = usbd_xfer_softc(xfer);
1348 	struct usb_page_cache	*pc;
1349 	struct mbuf		*m;
1350 	int			n, space, offset;
1351 	int			actlen, nframes;
1352 
1353 	usbd_xfer_status(xfer, &actlen, NULL, NULL, &nframes);
1354 	pc = usbd_xfer_get_frame(xfer, 0);
1355 
1356 	switch (USB_GET_STATE(xfer)) {
1357 	case USB_ST_TRANSFERRED:
1358 		UBT_INFO(sc, "sent %d bytes to isoc-out pipe\n", actlen);
1359 		UBT_STAT_BYTES_SENT(sc, actlen);
1360 		UBT_STAT_PCKTS_SENT(sc);
1361 		/* FALLTHROUGH */
1362 
1363 	case USB_ST_SETUP:
1364 send_next:
1365 		offset = 0;
1366 		space = usbd_xfer_max_framelen(xfer) * nframes;
1367 		m = NULL;
1368 
1369 		while (space > 0) {
1370 			if (m == NULL) {
1371 				UBT_NG_LOCK(sc);
1372 				NG_BT_MBUFQ_DEQUEUE(&sc->sc_scoq, m);
1373 				UBT_NG_UNLOCK(sc);
1374 
1375 				if (m == NULL)
1376 					break;
1377 			}
1378 
1379 			n = min(space, m->m_pkthdr.len);
1380 			if (n > 0) {
1381 				usbd_m_copy_in(pc, offset, m,0, n);
1382 				m_adj(m, n);
1383 
1384 				offset += n;
1385 				space -= n;
1386 			}
1387 
1388 			if (m->m_pkthdr.len == 0)
1389 				NG_FREE_M(m); /* sets m = NULL */
1390 		}
1391 
1392 		/* Put whatever is left from mbuf back on queue */
1393 		if (m != NULL) {
1394 			UBT_NG_LOCK(sc);
1395 			NG_BT_MBUFQ_PREPEND(&sc->sc_scoq, m);
1396 			UBT_NG_UNLOCK(sc);
1397 		}
1398 
1399 		/*
1400 		 * Calculate sizes for isoc frames.
1401 		 * Note that offset could be 0 at this point (i.e. we have
1402 		 * nothing to send). That is fine, as we have isoc. transfers
1403 		 * going in both directions all the time. In this case it
1404 		 * would be just empty isoc. transfer.
1405 		 */
1406 
1407 		for (n = 0; n < nframes; n ++) {
1408 			usbd_xfer_set_frame_len(xfer, n,
1409 			    min(offset, usbd_xfer_max_framelen(xfer)));
1410 			offset -= usbd_xfer_frame_len(xfer, n);
1411 		}
1412 
1413 		usbd_transfer_submit(xfer);
1414 		break;
1415 
1416 	default: /* Error */
1417 		if (error != USB_ERR_CANCELLED) {
1418 			UBT_STAT_OERROR(sc);
1419 			goto send_next;
1420 		}
1421 
1422 		/* transfer cancelled */
1423 		break;
1424 	}
1425 }
1426 
1427 /*
1428  * Utility function to forward provided mbuf upstream (i.e. up the stack).
1429  * Modifies value of the mbuf pointer (sets it to NULL).
1430  * Save to call from any context.
1431  */
1432 
1433 static int
1434 ubt_fwd_mbuf_up(ubt_softc_p sc, struct mbuf **m)
1435 {
1436 	hook_p	hook;
1437 	int	error;
1438 
1439 	/*
1440 	 * Close the race with Netgraph hook newhook/disconnect methods.
1441 	 * Save the hook pointer atomically. Two cases are possible:
1442 	 *
1443 	 * 1) The hook pointer is NULL. It means disconnect method got
1444 	 *    there first. In this case we are done.
1445 	 *
1446 	 * 2) The hook pointer is not NULL. It means that hook pointer
1447 	 *    could be either in valid or invalid (i.e. in the process
1448 	 *    of disconnect) state. In any case grab an extra reference
1449 	 *    to protect the hook pointer.
1450 	 *
1451 	 * It is ok to pass hook in invalid state to NG_SEND_DATA_ONLY() as
1452 	 * it checks for it. Drop extra reference after NG_SEND_DATA_ONLY().
1453 	 */
1454 
1455 	UBT_NG_LOCK(sc);
1456 	if ((hook = sc->sc_hook) != NULL)
1457 		NG_HOOK_REF(hook);
1458 	UBT_NG_UNLOCK(sc);
1459 
1460 	if (hook == NULL) {
1461 		NG_FREE_M(*m);
1462 		return (ENETDOWN);
1463 	}
1464 
1465 	NG_SEND_DATA_ONLY(error, hook, *m);
1466 	NG_HOOK_UNREF(hook);
1467 
1468 	if (error != 0)
1469 		UBT_STAT_IERROR(sc);
1470 
1471 	return (error);
1472 } /* ubt_fwd_mbuf_up */
1473 
1474 /****************************************************************************
1475  ****************************************************************************
1476  **                                 Glue
1477  ****************************************************************************
1478  ****************************************************************************/
1479 
1480 /*
1481  * Schedule glue task. Should be called with sc_ng_mtx held.
1482  * Netgraph context.
1483  */
1484 
1485 static void
1486 ubt_task_schedule(ubt_softc_p sc, int action)
1487 {
1488 	mtx_assert(&sc->sc_ng_mtx, MA_OWNED);
1489 
1490 	/*
1491 	 * Try to handle corner case when "start all" and "stop all"
1492 	 * actions can both be set before task is executed.
1493 	 *
1494 	 * The rules are
1495 	 *
1496 	 * sc_task_flags	action		new sc_task_flags
1497 	 * ------------------------------------------------------
1498 	 * 0			start		start
1499 	 * 0			stop		stop
1500 	 * start		start		start
1501 	 * start		stop		stop
1502 	 * stop			start		stop|start
1503 	 * stop			stop		stop
1504 	 * stop|start		start		stop|start
1505 	 * stop|start		stop		stop
1506 	 */
1507 
1508 	if (action != 0) {
1509 		if ((action & UBT_FLAG_T_STOP_ALL) != 0)
1510 			sc->sc_task_flags &= ~UBT_FLAG_T_START_ALL;
1511 
1512 		sc->sc_task_flags |= action;
1513 	}
1514 
1515 	if (sc->sc_task_flags & UBT_FLAG_T_PENDING)
1516 		return;
1517 
1518 	if (taskqueue_enqueue(taskqueue_swi, &sc->sc_task) == 0) {
1519 		sc->sc_task_flags |= UBT_FLAG_T_PENDING;
1520 		return;
1521 	}
1522 
1523 	/* XXX: i think this should never happen */
1524 } /* ubt_task_schedule */
1525 
1526 /*
1527  * Glue task. Examines sc_task_flags and does things depending on it.
1528  * Taskqueue context.
1529  */
1530 
1531 static void
1532 ubt_task(void *context, int pending)
1533 {
1534 	ubt_softc_p	sc = context;
1535 	int		task_flags, i;
1536 
1537 	UBT_NG_LOCK(sc);
1538 	task_flags = sc->sc_task_flags;
1539 	sc->sc_task_flags = 0;
1540 	UBT_NG_UNLOCK(sc);
1541 
1542 	/*
1543 	 * Stop all USB transfers synchronously.
1544 	 * Stop interface #0 and #1 transfers at the same time and in the
1545 	 * same loop. usbd_transfer_drain() will do appropriate locking.
1546 	 */
1547 
1548 	if (task_flags & UBT_FLAG_T_STOP_ALL)
1549 		for (i = 0; i < UBT_N_TRANSFER; i ++)
1550 			usbd_transfer_drain(sc->sc_xfer[i]);
1551 
1552 	/* Start incoming interrupt and bulk, and all isoc. USB transfers */
1553 	if (task_flags & UBT_FLAG_T_START_ALL) {
1554 		/*
1555 		 * Interface #0
1556 		 */
1557 
1558 		mtx_lock(&sc->sc_if_mtx);
1559 
1560 		ubt_xfer_start(sc, UBT_IF_0_INTR_DT_RD);
1561 		ubt_xfer_start(sc, UBT_IF_0_BULK_DT_RD);
1562 
1563 		/*
1564 		 * Interface #1
1565 		 * Start both read and write isoc. transfers by default.
1566 		 * Get them going all the time even if we have nothing
1567 		 * to send to avoid any delays.
1568 		 */
1569 
1570 		ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD1);
1571 		ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_RD2);
1572 		ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR1);
1573 		ubt_xfer_start(sc, UBT_IF_1_ISOC_DT_WR2);
1574 
1575 		mtx_unlock(&sc->sc_if_mtx);
1576 	}
1577 
1578  	/* Start outgoing control transfer */
1579 	if (task_flags & UBT_FLAG_T_START_CTRL) {
1580 		mtx_lock(&sc->sc_if_mtx);
1581 		ubt_xfer_start(sc, UBT_IF_0_CTRL_DT_WR);
1582 		mtx_unlock(&sc->sc_if_mtx);
1583 	}
1584 
1585 	/* Start outgoing bulk transfer */
1586 	if (task_flags & UBT_FLAG_T_START_BULK) {
1587 		mtx_lock(&sc->sc_if_mtx);
1588 		ubt_xfer_start(sc, UBT_IF_0_BULK_DT_WR);
1589 		mtx_unlock(&sc->sc_if_mtx);
1590 	}
1591 } /* ubt_task */
1592 
1593 /****************************************************************************
1594  ****************************************************************************
1595  **                        Netgraph specific
1596  ****************************************************************************
1597  ****************************************************************************/
1598 
1599 /*
1600  * Netgraph node constructor. Do not allow to create node of this type.
1601  * Netgraph context.
1602  */
1603 
1604 static int
1605 ng_ubt_constructor(node_p node)
1606 {
1607 	return (EINVAL);
1608 } /* ng_ubt_constructor */
1609 
1610 /*
1611  * Netgraph node destructor. Destroy node only when device has been detached.
1612  * Netgraph context.
1613  */
1614 
1615 static int
1616 ng_ubt_shutdown(node_p node)
1617 {
1618 	if (node->nd_flags & NGF_REALLY_DIE) {
1619 		/*
1620                  * We came here because the USB device is being
1621 		 * detached, so stop being persistent.
1622                  */
1623 		NG_NODE_SET_PRIVATE(node, NULL);
1624 		NG_NODE_UNREF(node);
1625 	} else
1626 		NG_NODE_REVIVE(node); /* tell ng_rmnode we are persisant */
1627 
1628 	return (0);
1629 } /* ng_ubt_shutdown */
1630 
1631 /*
1632  * Create new hook. There can only be one.
1633  * Netgraph context.
1634  */
1635 
1636 static int
1637 ng_ubt_newhook(node_p node, hook_p hook, char const *name)
1638 {
1639 	struct ubt_softc	*sc = NG_NODE_PRIVATE(node);
1640 
1641 	if (strcmp(name, NG_UBT_HOOK) != 0)
1642 		return (EINVAL);
1643 
1644 	UBT_NG_LOCK(sc);
1645 	if (sc->sc_hook != NULL) {
1646 		UBT_NG_UNLOCK(sc);
1647 
1648 		return (EISCONN);
1649 	}
1650 
1651 	sc->sc_hook = hook;
1652 	UBT_NG_UNLOCK(sc);
1653 
1654 	return (0);
1655 } /* ng_ubt_newhook */
1656 
1657 /*
1658  * Connect hook. Start incoming USB transfers.
1659  * Netgraph context.
1660  */
1661 
1662 static int
1663 ng_ubt_connect(hook_p hook)
1664 {
1665 	struct ubt_softc	*sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1666 
1667 	NG_HOOK_FORCE_QUEUE(NG_HOOK_PEER(hook));
1668 
1669 	UBT_NG_LOCK(sc);
1670 	ubt_task_schedule(sc, UBT_FLAG_T_START_ALL);
1671 	UBT_NG_UNLOCK(sc);
1672 
1673 	return (0);
1674 } /* ng_ubt_connect */
1675 
1676 /*
1677  * Disconnect hook.
1678  * Netgraph context.
1679  */
1680 
1681 static int
1682 ng_ubt_disconnect(hook_p hook)
1683 {
1684 	struct ubt_softc	*sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1685 
1686 	UBT_NG_LOCK(sc);
1687 
1688 	if (hook != sc->sc_hook) {
1689 		UBT_NG_UNLOCK(sc);
1690 
1691 		return (EINVAL);
1692 	}
1693 
1694 	sc->sc_hook = NULL;
1695 
1696 	/* Kick off task to stop all USB xfers */
1697 	ubt_task_schedule(sc, UBT_FLAG_T_STOP_ALL);
1698 
1699 	/* Drain queues */
1700 	NG_BT_MBUFQ_DRAIN(&sc->sc_cmdq);
1701 	NG_BT_MBUFQ_DRAIN(&sc->sc_aclq);
1702 	NG_BT_MBUFQ_DRAIN(&sc->sc_scoq);
1703 
1704 	UBT_NG_UNLOCK(sc);
1705 
1706 	return (0);
1707 } /* ng_ubt_disconnect */
1708 
1709 /*
1710  * Process control message.
1711  * Netgraph context.
1712  */
1713 
1714 static int
1715 ng_ubt_rcvmsg(node_p node, item_p item, hook_p lasthook)
1716 {
1717 	struct ubt_softc	*sc = NG_NODE_PRIVATE(node);
1718 	struct ng_mesg		*msg, *rsp = NULL;
1719 	struct ng_bt_mbufq	*q;
1720 	int			error = 0, queue, qlen;
1721 
1722 	NGI_GET_MSG(item, msg);
1723 
1724 	switch (msg->header.typecookie) {
1725 	case NGM_GENERIC_COOKIE:
1726 		switch (msg->header.cmd) {
1727 		case NGM_TEXT_STATUS:
1728 			NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
1729 			if (rsp == NULL) {
1730 				error = ENOMEM;
1731 				break;
1732 			}
1733 
1734 			snprintf(rsp->data, NG_TEXTRESPONSE,
1735 				"Hook: %s\n" \
1736 				"Task flags: %#x\n" \
1737 				"Debug: %d\n" \
1738 				"CMD queue: [have:%d,max:%d]\n" \
1739 				"ACL queue: [have:%d,max:%d]\n" \
1740 				"SCO queue: [have:%d,max:%d]",
1741 				(sc->sc_hook != NULL) ? NG_UBT_HOOK : "",
1742 				sc->sc_task_flags,
1743 				sc->sc_debug,
1744 				sc->sc_cmdq.len,
1745 				sc->sc_cmdq.maxlen,
1746 				sc->sc_aclq.len,
1747 				sc->sc_aclq.maxlen,
1748 				sc->sc_scoq.len,
1749 				sc->sc_scoq.maxlen);
1750 			break;
1751 
1752 		default:
1753 			error = EINVAL;
1754 			break;
1755 		}
1756 		break;
1757 
1758 	case NGM_UBT_COOKIE:
1759 		switch (msg->header.cmd) {
1760 		case NGM_UBT_NODE_SET_DEBUG:
1761 			if (msg->header.arglen != sizeof(ng_ubt_node_debug_ep)){
1762 				error = EMSGSIZE;
1763 				break;
1764 			}
1765 
1766 			sc->sc_debug = *((ng_ubt_node_debug_ep *) (msg->data));
1767 			break;
1768 
1769 		case NGM_UBT_NODE_GET_DEBUG:
1770 			NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_debug_ep),
1771 			    M_NOWAIT);
1772 			if (rsp == NULL) {
1773 				error = ENOMEM;
1774 				break;
1775 			}
1776 
1777 			*((ng_ubt_node_debug_ep *) (rsp->data)) = sc->sc_debug;
1778 			break;
1779 
1780 		case NGM_UBT_NODE_SET_QLEN:
1781 			if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1782 				error = EMSGSIZE;
1783 				break;
1784 			}
1785 
1786 			queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1787 			qlen = ((ng_ubt_node_qlen_ep *) (msg->data))->qlen;
1788 
1789 			switch (queue) {
1790 			case NGM_UBT_NODE_QUEUE_CMD:
1791 				q = &sc->sc_cmdq;
1792 				break;
1793 
1794 			case NGM_UBT_NODE_QUEUE_ACL:
1795 				q = &sc->sc_aclq;
1796 				break;
1797 
1798 			case NGM_UBT_NODE_QUEUE_SCO:
1799 				q = &sc->sc_scoq;
1800 				break;
1801 
1802 			default:
1803 				error = EINVAL;
1804 				goto done;
1805 				/* NOT REACHED */
1806 			}
1807 
1808 			q->maxlen = qlen;
1809 			break;
1810 
1811 		case NGM_UBT_NODE_GET_QLEN:
1812 			if (msg->header.arglen != sizeof(ng_ubt_node_qlen_ep)) {
1813 				error = EMSGSIZE;
1814 				break;
1815 			}
1816 
1817 			queue = ((ng_ubt_node_qlen_ep *) (msg->data))->queue;
1818 
1819 			switch (queue) {
1820 			case NGM_UBT_NODE_QUEUE_CMD:
1821 				q = &sc->sc_cmdq;
1822 				break;
1823 
1824 			case NGM_UBT_NODE_QUEUE_ACL:
1825 				q = &sc->sc_aclq;
1826 				break;
1827 
1828 			case NGM_UBT_NODE_QUEUE_SCO:
1829 				q = &sc->sc_scoq;
1830 				break;
1831 
1832 			default:
1833 				error = EINVAL;
1834 				goto done;
1835 				/* NOT REACHED */
1836 			}
1837 
1838 			NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_qlen_ep),
1839 				M_NOWAIT);
1840 			if (rsp == NULL) {
1841 				error = ENOMEM;
1842 				break;
1843 			}
1844 
1845 			((ng_ubt_node_qlen_ep *) (rsp->data))->queue = queue;
1846 			((ng_ubt_node_qlen_ep *) (rsp->data))->qlen = q->maxlen;
1847 			break;
1848 
1849 		case NGM_UBT_NODE_GET_STAT:
1850 			NG_MKRESPONSE(rsp, msg, sizeof(ng_ubt_node_stat_ep),
1851 			    M_NOWAIT);
1852 			if (rsp == NULL) {
1853 				error = ENOMEM;
1854 				break;
1855 			}
1856 
1857 			bcopy(&sc->sc_stat, rsp->data,
1858 				sizeof(ng_ubt_node_stat_ep));
1859 			break;
1860 
1861 		case NGM_UBT_NODE_RESET_STAT:
1862 			UBT_STAT_RESET(sc);
1863 			break;
1864 
1865 		default:
1866 			error = EINVAL;
1867 			break;
1868 		}
1869 		break;
1870 
1871 	default:
1872 		error = EINVAL;
1873 		break;
1874 	}
1875 done:
1876 	NG_RESPOND_MSG(error, node, item, rsp);
1877 	NG_FREE_MSG(msg);
1878 
1879 	return (error);
1880 } /* ng_ubt_rcvmsg */
1881 
1882 /*
1883  * Process data.
1884  * Netgraph context.
1885  */
1886 
1887 static int
1888 ng_ubt_rcvdata(hook_p hook, item_p item)
1889 {
1890 	struct ubt_softc	*sc = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1891 	struct mbuf		*m;
1892 	struct ng_bt_mbufq	*q;
1893 	int			action, error = 0;
1894 
1895 	if (hook != sc->sc_hook) {
1896 		error = EINVAL;
1897 		goto done;
1898 	}
1899 
1900 	/* Deatch mbuf and get HCI frame type */
1901 	NGI_GET_M(item, m);
1902 
1903 	/*
1904 	 * Minimal size of the HCI frame is 4 bytes: 1 byte frame type,
1905 	 * 2 bytes connection handle and at least 1 byte of length.
1906 	 * Panic on data frame that has size smaller than 4 bytes (it
1907 	 * should not happen)
1908 	 */
1909 
1910 	if (m->m_pkthdr.len < 4)
1911 		panic("HCI frame size is too small! pktlen=%d\n",
1912 			m->m_pkthdr.len);
1913 
1914 	/* Process HCI frame */
1915 	switch (*mtod(m, uint8_t *)) {	/* XXX call m_pullup ? */
1916 	case NG_HCI_CMD_PKT:
1917 		if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE)
1918 			panic("HCI command frame size is too big! " \
1919 				"buffer size=%zd, packet len=%d\n",
1920 				UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len);
1921 
1922 		q = &sc->sc_cmdq;
1923 		action = UBT_FLAG_T_START_CTRL;
1924 		break;
1925 
1926 	case NG_HCI_ACL_DATA_PKT:
1927 		if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE)
1928 			panic("ACL data frame size is too big! " \
1929 				"buffer size=%d, packet len=%d\n",
1930 				UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len);
1931 
1932 		q = &sc->sc_aclq;
1933 		action = UBT_FLAG_T_START_BULK;
1934 		break;
1935 
1936 	case NG_HCI_SCO_DATA_PKT:
1937 		q = &sc->sc_scoq;
1938 		action = 0;
1939 		break;
1940 
1941 	default:
1942 		UBT_ERR(sc, "Dropping unsupported HCI frame, type=0x%02x, " \
1943 			"pktlen=%d\n", *mtod(m, uint8_t *), m->m_pkthdr.len);
1944 
1945 		NG_FREE_M(m);
1946 		error = EINVAL;
1947 		goto done;
1948 		/* NOT REACHED */
1949 	}
1950 
1951 	UBT_NG_LOCK(sc);
1952 	if (NG_BT_MBUFQ_FULL(q)) {
1953 		NG_BT_MBUFQ_DROP(q);
1954 		UBT_NG_UNLOCK(sc);
1955 
1956 		UBT_ERR(sc, "Dropping HCI frame 0x%02x, len=%d. Queue full\n",
1957 			*mtod(m, uint8_t *), m->m_pkthdr.len);
1958 
1959 		NG_FREE_M(m);
1960 	} else {
1961 		/* Loose HCI packet type, enqueue mbuf and kick off task */
1962 		m_adj(m, sizeof(uint8_t));
1963 		NG_BT_MBUFQ_ENQUEUE(q, m);
1964 		ubt_task_schedule(sc, action);
1965 		UBT_NG_UNLOCK(sc);
1966 	}
1967 done:
1968 	NG_FREE_ITEM(item);
1969 
1970 	return (error);
1971 } /* ng_ubt_rcvdata */
1972 
1973 /****************************************************************************
1974  ****************************************************************************
1975  **                              Module
1976  ****************************************************************************
1977  ****************************************************************************/
1978 
1979 /*
1980  * Load/Unload the driver module
1981  */
1982 
1983 static int
1984 ubt_modevent(module_t mod, int event, void *data)
1985 {
1986 	int	error;
1987 
1988 	switch (event) {
1989 	case MOD_LOAD:
1990 		error = ng_newtype(&typestruct);
1991 		if (error != 0)
1992 			printf("%s: Could not register Netgraph node type, " \
1993 				"error=%d\n", NG_UBT_NODE_TYPE, error);
1994 		break;
1995 
1996 	case MOD_UNLOAD:
1997 		error = ng_rmtype(&typestruct);
1998 		break;
1999 
2000 	default:
2001 		error = EOPNOTSUPP;
2002 		break;
2003 	}
2004 
2005 	return (error);
2006 } /* ubt_modevent */
2007 
2008 static device_method_t	ubt_methods[] =
2009 {
2010 	DEVMETHOD(device_probe,	ubt_probe),
2011 	DEVMETHOD(device_attach, ubt_attach),
2012 	DEVMETHOD(device_detach, ubt_detach),
2013 	DEVMETHOD_END
2014 };
2015 
2016 driver_t		ubt_driver =
2017 {
2018 	.name =	   "ubt",
2019 	.methods = ubt_methods,
2020 	.size =	   sizeof(struct ubt_softc),
2021 };
2022 
2023 DRIVER_MODULE(ng_ubt, uhub, ubt_driver, ubt_modevent, 0);
2024 MODULE_VERSION(ng_ubt, NG_BLUETOOTH_VERSION);
2025 MODULE_DEPEND(ng_ubt, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
2026 MODULE_DEPEND(ng_ubt, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
2027 MODULE_DEPEND(ng_ubt, ng_bluetooth, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
2028 MODULE_DEPEND(ng_ubt, usb, 1, 1, 1);
2029 USB_PNP_HOST_INFO(ubt_devs);
2030