xref: /freebsd/sys/dev/usb/usb_dev.c (revision 3a3f90c6c3cc3124c6f4df8a11b57c8a36a2d13c)
1 /* $FreeBSD$ */
2 /*-
3  * Copyright (c) 2006-2008 Hans Petter Selasky. All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  *
27  * usb2_dev.c - An abstraction layer for creating devices under /dev/...
28  */
29 
30 #include <dev/usb/usb.h>
31 #include <dev/usb/usb_ioctl.h>
32 #include <dev/usb/usb_defs.h>
33 #include <dev/usb/usb_mfunc.h>
34 #include <dev/usb/usb_error.h>
35 
36 #define	USB_DEBUG_VAR usb2_fifo_debug
37 
38 #include <dev/usb/usb_core.h>
39 #include <dev/usb/usb_mbuf.h>
40 #include <dev/usb/usb_dev.h>
41 #include <dev/usb/usb_process.h>
42 #include <dev/usb/usb_device.h>
43 #include <dev/usb/usb_debug.h>
44 #include <dev/usb/usb_busdma.h>
45 #include <dev/usb/usb_generic.h>
46 #include <dev/usb/usb_dynamic.h>
47 #include <dev/usb/usb_util.h>
48 
49 #include <dev/usb/usb_controller.h>
50 #include <dev/usb/usb_bus.h>
51 
52 #include <sys/filio.h>
53 #include <sys/ttycom.h>
54 #include <sys/syscallsubr.h>
55 
56 #include <machine/stdarg.h>
57 
58 #if USB_DEBUG
59 static int usb2_fifo_debug = 0;
60 
61 SYSCTL_NODE(_hw_usb2, OID_AUTO, dev, CTLFLAG_RW, 0, "USB device");
62 SYSCTL_INT(_hw_usb2_dev, OID_AUTO, debug, CTLFLAG_RW,
63     &usb2_fifo_debug, 0, "Debug Level");
64 #endif
65 
66 #if ((__FreeBSD_version >= 700001) || (__FreeBSD_version == 0) || \
67      ((__FreeBSD_version >= 600034) && (__FreeBSD_version < 700000)))
68 #define	USB_UCRED struct ucred *ucred,
69 #else
70 #define	USB_UCRED
71 #endif
72 
73 /* prototypes */
74 
75 static uint32_t	usb2_path_convert_one(const char **);
76 static uint32_t	usb2_path_convert(const char *);
77 static int	usb2_check_access(int, struct usb2_perm *);
78 static int	usb2_fifo_open(struct usb2_fifo *, struct file *,
79 		    struct thread *, int);
80 static void	usb2_fifo_close(struct usb2_fifo *, struct thread *, int);
81 static void	usb2_dev_init(void *);
82 static void	usb2_dev_init_post(void *);
83 static void	usb2_dev_uninit(void *);
84 static int	usb2_fifo_uiomove(struct usb2_fifo *, void *, int,
85 		    struct uio *);
86 static void	usb2_fifo_check_methods(struct usb2_fifo_methods *);
87 static void	usb2_clone(void *, USB_UCRED char *, int, struct cdev **);
88 static struct	usb2_fifo *usb2_fifo_alloc(void);
89 static struct	usb2_pipe *usb2_dev_get_pipe(struct usb2_device *, uint8_t,
90 		    uint8_t, uint8_t);
91 
92 static d_fdopen_t usb2_fdopen;
93 static d_close_t usb2_close;
94 static d_ioctl_t usb2_ioctl;
95 
96 static fo_rdwr_t usb2_read_f;
97 static fo_rdwr_t usb2_write_f;
98 
99 #if __FreeBSD_version > 800009
100 static fo_truncate_t usb2_truncate_f;
101 
102 #endif
103 static fo_ioctl_t usb2_ioctl_f;
104 static fo_poll_t usb2_poll_f;
105 static fo_kqfilter_t usb2_kqfilter_f;
106 static fo_stat_t usb2_stat_f;
107 static fo_close_t usb2_close_f;
108 
109 static usb2_fifo_open_t usb2_fifo_dummy_open;
110 static usb2_fifo_close_t usb2_fifo_dummy_close;
111 static usb2_fifo_ioctl_t usb2_fifo_dummy_ioctl;
112 static usb2_fifo_cmd_t usb2_fifo_dummy_cmd;
113 
114 static struct usb2_perm usb2_perm = {
115 	.uid = UID_ROOT,
116 	.gid = GID_OPERATOR,
117 	.mode = 0660,
118 };
119 
120 static struct cdevsw usb2_devsw = {
121 	.d_version = D_VERSION,
122 	.d_fdopen = usb2_fdopen,
123 	.d_close = usb2_close,
124 	.d_ioctl = usb2_ioctl,
125 	.d_name = "usb",
126 	.d_flags = D_TRACKCLOSE,
127 };
128 
129 static struct fileops usb2_ops_f = {
130 	.fo_read = usb2_read_f,
131 	.fo_write = usb2_write_f,
132 #if __FreeBSD_version > 800009
133 	.fo_truncate = usb2_truncate_f,
134 #endif
135 	.fo_ioctl = usb2_ioctl_f,
136 	.fo_poll = usb2_poll_f,
137 	.fo_kqfilter = usb2_kqfilter_f,
138 	.fo_stat = usb2_stat_f,
139 	.fo_close = usb2_close_f,
140 	.fo_flags = DFLAG_PASSABLE | DFLAG_SEEKABLE
141 };
142 
143 static const dev_clone_fn usb2_clone_ptr = &usb2_clone;
144 static struct cdev *usb2_dev;
145 static uint32_t usb2_last_devloc = 0 - 1;
146 static eventhandler_tag usb2_clone_tag;
147 static void *usb2_old_f_data;
148 static struct fileops *usb2_old_f_ops;
149 static TAILQ_HEAD(, usb2_symlink) usb2_sym_head;
150 static struct sx usb2_sym_lock;
151 
152 struct mtx usb2_ref_lock;
153 
154 static uint32_t
155 usb2_path_convert_one(const char **pp)
156 {
157 	const char *ptr;
158 	uint32_t temp = 0;
159 
160 	ptr = *pp;
161 
162 	while ((*ptr >= '0') && (*ptr <= '9')) {
163 		temp *= 10;
164 		temp += (*ptr - '0');
165 		if (temp >= 1000000) {
166 			/* catch overflow early */
167 			return (0 - 1);
168 		}
169 		ptr++;
170 	}
171 
172 	if (*ptr == '.') {
173 		/* skip dot */
174 		ptr++;
175 	}
176 	*pp = ptr;
177 
178 	return (temp);
179 }
180 
181 /*------------------------------------------------------------------------*
182  *	usb2_path_convert
183  *
184  * Path format: "/dev/usb<bus>.<dev>.<iface>.<fifo>"
185  *
186  * Returns: Path converted into numerical format.
187  *------------------------------------------------------------------------*/
188 static uint32_t
189 usb2_path_convert(const char *path)
190 {
191 	uint32_t temp;
192 	uint32_t devloc;
193 
194 	devloc = 0;
195 
196 	temp = usb2_path_convert_one(&path);
197 
198 	if (temp >= USB_BUS_MAX) {
199 		return (0 - 1);
200 	}
201 	devloc += temp;
202 
203 	temp = usb2_path_convert_one(&path);
204 
205 	if (temp >= USB_DEV_MAX) {
206 		return (0 - 1);
207 	}
208 	devloc += (temp * USB_BUS_MAX);
209 
210 	temp = usb2_path_convert_one(&path);
211 
212 	if (temp >= USB_IFACE_MAX) {
213 		return (0 - 1);
214 	}
215 	devloc += (temp * USB_DEV_MAX * USB_BUS_MAX);
216 
217 	temp = usb2_path_convert_one(&path);
218 
219 	if (temp >= ((USB_FIFO_MAX / 2) + (USB_EP_MAX / 2))) {
220 		return (0 - 1);
221 	}
222 	devloc += (temp * USB_IFACE_MAX * USB_DEV_MAX * USB_BUS_MAX);
223 
224 	return (devloc);
225 }
226 
227 /*------------------------------------------------------------------------*
228  *	usb2_set_iface_perm
229  *
230  * This function will set the interface permissions.
231  *------------------------------------------------------------------------*/
232 void
233 usb2_set_iface_perm(struct usb2_device *udev, uint8_t iface_index,
234     uint32_t uid, uint32_t gid, uint16_t mode)
235 {
236 	struct usb2_interface *iface;
237 
238 	iface = usb2_get_iface(udev, iface_index);
239 	if (iface && iface->idesc) {
240 		mtx_lock(&usb2_ref_lock);
241 		iface->perm.uid = uid;
242 		iface->perm.gid = gid;
243 		iface->perm.mode = mode;
244 		mtx_unlock(&usb2_ref_lock);
245 
246 	}
247 }
248 
249 /*------------------------------------------------------------------------*
250  *	usb2_set_perm
251  *
252  * This function will set the permissions at the given level.
253  *
254  * Return values:
255  *    0: Success.
256  * Else: Failure.
257  *------------------------------------------------------------------------*/
258 static int
259 usb2_set_perm(struct usb2_dev_perm *psrc, uint8_t level)
260 {
261 	struct usb2_location loc;
262 	struct usb2_perm *pdst;
263 	uint32_t devloc;
264 	int error;
265 
266 	/* check if the current thread can change USB permissions. */
267 	error = priv_check(curthread, PRIV_ROOT);
268 	if (error) {
269 		return (error);
270 	}
271 	/* range check device location */
272 	if ((psrc->bus_index >= USB_BUS_MAX) ||
273 	    (psrc->dev_index >= USB_DEV_MAX) ||
274 	    (psrc->iface_index >= USB_IFACE_MAX)) {
275 		return (EINVAL);
276 	}
277 	if (level == 1)
278 		devloc = USB_BUS_MAX;	/* use root-HUB to access bus */
279 	else
280 		devloc = 0;
281 	switch (level) {
282 	case 3:
283 		devloc += psrc->iface_index *
284 		    USB_DEV_MAX * USB_BUS_MAX;
285 		/* FALLTHROUGH */
286 	case 2:
287 		devloc += psrc->dev_index *
288 		    USB_BUS_MAX;
289 		/* FALLTHROUGH */
290 	case 1:
291 		devloc += psrc->bus_index;
292 		break;
293 	default:
294 		break;
295 	}
296 
297 	if ((level > 0) && (level < 4)) {
298 		error = usb2_ref_device(NULL, &loc, devloc);
299 		if (error) {
300 			return (error);
301 		}
302 	}
303 	switch (level) {
304 	case 3:
305 		if (loc.iface == NULL) {
306 			usb2_unref_device(&loc);
307 			return (EINVAL);
308 		}
309 		pdst = &loc.iface->perm;
310 		break;
311 	case 2:
312 		pdst = &loc.udev->perm;
313 		break;
314 	case 1:
315 		pdst = &loc.bus->perm;
316 		break;
317 	default:
318 		pdst = &usb2_perm;
319 		break;
320 	}
321 
322 	/* all permissions are protected by "usb2_ref_lock" */
323 	mtx_lock(&usb2_ref_lock);
324 	pdst->uid = psrc->user_id;
325 	pdst->gid = psrc->group_id;
326 	pdst->mode = psrc->mode;
327 	mtx_unlock(&usb2_ref_lock);
328 
329 	if ((level > 0) && (level < 4)) {
330 		usb2_unref_device(&loc);
331 	}
332 	return (0);			/* success */
333 }
334 
335 /*------------------------------------------------------------------------*
336  *	usb2_get_perm
337  *
338  * This function will get the permissions at the given level.
339  *
340  * Return values:
341  *    0: Success.
342  * Else: Failure.
343  *------------------------------------------------------------------------*/
344 static int
345 usb2_get_perm(struct usb2_dev_perm *pdst, uint8_t level)
346 {
347 	struct usb2_location loc;
348 	struct usb2_perm *psrc;
349 	uint32_t devloc;
350 	int error;
351 
352 	if ((pdst->bus_index >= USB_BUS_MAX) ||
353 	    (pdst->dev_index >= USB_DEV_MAX) ||
354 	    (pdst->iface_index >= USB_IFACE_MAX)) {
355 		return (EINVAL);
356 	}
357 	if (level == 1)
358 		devloc = USB_BUS_MAX;	/* use root-HUB to access bus */
359 	else
360 		devloc = 0;
361 	switch (level) {
362 	case 3:
363 		devloc += pdst->iface_index *
364 		    USB_DEV_MAX * USB_BUS_MAX;
365 		/* FALLTHROUGH */
366 	case 2:
367 		devloc += pdst->dev_index *
368 		    USB_BUS_MAX;
369 		/* FALLTHROUGH */
370 	case 1:
371 		devloc += pdst->bus_index;
372 		break;
373 	default:
374 		break;
375 	}
376 
377 	if ((level > 0) && (level < 4)) {
378 		error = usb2_ref_device(NULL, &loc, devloc);
379 		if (error) {
380 			return (error);
381 		}
382 	}
383 	switch (level) {
384 	case 3:
385 		if (loc.iface == NULL) {
386 			usb2_unref_device(&loc);
387 			return (EINVAL);
388 		}
389 		psrc = &loc.iface->perm;
390 		break;
391 	case 2:
392 		psrc = &loc.udev->perm;
393 		break;
394 	case 1:
395 		psrc = &loc.bus->perm;
396 		break;
397 	default:
398 		psrc = &usb2_perm;
399 		break;
400 	}
401 
402 	/* all permissions are protected by "usb2_ref_lock" */
403 	mtx_lock(&usb2_ref_lock);
404 	if (psrc->mode != 0) {
405 		pdst->user_id = psrc->uid;
406 		pdst->group_id = psrc->gid;
407 		pdst->mode = psrc->mode;
408 	} else {
409 		/* access entry at this level and location is not active */
410 		pdst->user_id = 0;
411 		pdst->group_id = 0;
412 		pdst->mode = 0;
413 	}
414 	mtx_unlock(&usb2_ref_lock);
415 
416 	if ((level > 0) && (level < 4)) {
417 		usb2_unref_device(&loc);
418 	}
419 	return (0);
420 }
421 
422 /*------------------------------------------------------------------------*
423  *	usb2_check_access
424  *
425  * This function will verify the given access information.
426  *
427  * Return values:
428  * 0: Access granted.
429  * Else: No access granted.
430  *------------------------------------------------------------------------*/
431 static int
432 usb2_check_access(int fflags, struct usb2_perm *puser)
433 {
434 	mode_t accmode;
435 
436 	if ((fflags & (FWRITE | FREAD)) && (puser->mode != 0)) {
437 		/* continue */
438 	} else {
439 		return (EPERM);		/* no access */
440 	}
441 
442 	accmode = 0;
443 	if (fflags & FWRITE)
444 		accmode |= VWRITE;
445 	if (fflags & FREAD)
446 		accmode |= VREAD;
447 
448 	return (vaccess(VCHR, puser->mode, puser->uid,
449 	    puser->gid, accmode, curthread->td_ucred, NULL));
450 }
451 
452 /*------------------------------------------------------------------------*
453  *	usb2_ref_device
454  *
455  * This function is used to atomically refer an USB device by its
456  * device location. If this function returns success the USB device
457  * will not dissappear until the USB device is unreferenced.
458  *
459  * Return values:
460  *  0: Success, refcount incremented on the given USB device.
461  *  Else: Failure.
462  *------------------------------------------------------------------------*/
463 usb2_error_t
464 usb2_ref_device(struct file *fp, struct usb2_location *ploc, uint32_t devloc)
465 {
466 	struct usb2_fifo **ppf;
467 	struct usb2_fifo *f;
468 	int fflags;
469 	uint8_t dev_ep_index;
470 
471 	if (fp) {
472 		/* check if we need uref */
473 		ploc->is_uref = devloc ? 0 : 1;
474 		/* get devloc - already verified */
475 		devloc = USB_P2U(fp->f_data);
476 		/* get file flags */
477 		fflags = fp->f_flag;
478 	} else {
479 		/* only ref device */
480 		fflags = 0;
481 		/* search for FIFO */
482 		ploc->is_uref = 1;
483 		/* check "devloc" */
484 		if (devloc >= (USB_BUS_MAX * USB_DEV_MAX *
485 		    USB_IFACE_MAX * ((USB_EP_MAX / 2) + (USB_FIFO_MAX / 2)))) {
486 			return (USB_ERR_INVAL);
487 		}
488 	}
489 
490 	/* store device location */
491 	ploc->devloc = devloc;
492 	ploc->bus_index = devloc % USB_BUS_MAX;
493 	ploc->dev_index = (devloc / USB_BUS_MAX) % USB_DEV_MAX;
494 	ploc->iface_index = (devloc / (USB_BUS_MAX *
495 	    USB_DEV_MAX)) % USB_IFACE_MAX;
496 	ploc->fifo_index = (devloc / (USB_BUS_MAX * USB_DEV_MAX *
497 	    USB_IFACE_MAX));
498 
499 	mtx_lock(&usb2_ref_lock);
500 	ploc->bus = devclass_get_softc(usb2_devclass_ptr, ploc->bus_index);
501 	if (ploc->bus == NULL) {
502 		DPRINTFN(2, "no bus at %u\n", ploc->bus_index);
503 		goto error;
504 	}
505 	if (ploc->dev_index >= ploc->bus->devices_max) {
506 		DPRINTFN(2, "invalid dev index, %u\n", ploc->dev_index);
507 		goto error;
508 	}
509 	ploc->udev = ploc->bus->devices[ploc->dev_index];
510 	if (ploc->udev == NULL) {
511 		DPRINTFN(2, "no device at %u\n", ploc->dev_index);
512 		goto error;
513 	}
514 	if (ploc->udev->refcount == USB_DEV_REF_MAX) {
515 		DPRINTFN(2, "no dev ref\n");
516 		goto error;
517 	}
518 	/* check if we are doing an open */
519 	if (fp == NULL) {
520 		/* set defaults */
521 		ploc->txfifo = NULL;
522 		ploc->rxfifo = NULL;
523 		ploc->is_write = 0;
524 		ploc->is_read = 0;
525 		ploc->is_usbfs = 0;
526 		/* NOTE: variable overloading: */
527 		dev_ep_index = ploc->fifo_index;
528 	} else {
529 		/* initialise "is_usbfs" flag */
530 		ploc->is_usbfs = 0;
531 		dev_ep_index = 255;	/* dummy */
532 
533 		/* check for write */
534 		if (fflags & FWRITE) {
535 			ppf = ploc->udev->fifo;
536 			f = ppf[ploc->fifo_index + USB_FIFO_TX];
537 			ploc->txfifo = f;
538 			ploc->is_write = 1;	/* ref */
539 			if ((f == NULL) ||
540 			    (f->refcount == USB_FIFO_REF_MAX) ||
541 			    (f->curr_file != fp)) {
542 				goto error;
543 			}
544 			/* check if USB-FS is active */
545 			if (f->fs_ep_max != 0) {
546 				ploc->is_usbfs = 1;
547 			}
548 			/*
549 			 * Get real endpoint index associated with
550 			 * this FIFO:
551 			 */
552 			dev_ep_index = f->dev_ep_index;
553 		} else {
554 			ploc->txfifo = NULL;
555 			ploc->is_write = 0;	/* no ref */
556 		}
557 
558 		/* check for read */
559 		if (fflags & FREAD) {
560 			ppf = ploc->udev->fifo;
561 			f = ppf[ploc->fifo_index + USB_FIFO_RX];
562 			ploc->rxfifo = f;
563 			ploc->is_read = 1;	/* ref */
564 			if ((f == NULL) ||
565 			    (f->refcount == USB_FIFO_REF_MAX) ||
566 			    (f->curr_file != fp)) {
567 				goto error;
568 			}
569 			/* check if USB-FS is active */
570 			if (f->fs_ep_max != 0) {
571 				ploc->is_usbfs = 1;
572 			}
573 			/*
574 			 * Get real endpoint index associated with
575 			 * this FIFO:
576 			 */
577 			dev_ep_index = f->dev_ep_index;
578 		} else {
579 			ploc->rxfifo = NULL;
580 			ploc->is_read = 0;	/* no ref */
581 		}
582 	}
583 
584 	/* check if we require an interface */
585 	ploc->iface = usb2_get_iface(ploc->udev, ploc->iface_index);
586 	if (dev_ep_index != 0) {
587 		/* non control endpoint - we need an interface */
588 		if (ploc->iface == NULL) {
589 			DPRINTFN(2, "no iface\n");
590 			goto error;
591 		}
592 		if (ploc->iface->idesc == NULL) {
593 			DPRINTFN(2, "no idesc\n");
594 			goto error;
595 		}
596 	}
597 	/* when everything is OK we increment the refcounts */
598 	if (ploc->is_write) {
599 		DPRINTFN(2, "ref write\n");
600 		ploc->txfifo->refcount++;
601 	}
602 	if (ploc->is_read) {
603 		DPRINTFN(2, "ref read\n");
604 		ploc->rxfifo->refcount++;
605 	}
606 	if (ploc->is_uref) {
607 		DPRINTFN(2, "ref udev - needed\n");
608 		ploc->udev->refcount++;
609 	}
610 	mtx_unlock(&usb2_ref_lock);
611 
612 	if (ploc->is_uref) {
613 		/*
614 		 * We are about to alter the bus-state. Apply the
615 		 * required locks.
616 		 */
617 		sx_xlock(ploc->udev->default_sx + 1);
618 		mtx_lock(&Giant);	/* XXX */
619 	}
620 	return (0);
621 
622 error:
623 	mtx_unlock(&usb2_ref_lock);
624 	DPRINTFN(2, "fail\n");
625 	return (USB_ERR_INVAL);
626 }
627 
628 /*------------------------------------------------------------------------*
629  *	usb2_uref_location
630  *
631  * This function is used to upgrade an USB reference to include the
632  * USB device reference on a USB location.
633  *
634  * Return values:
635  *  0: Success, refcount incremented on the given USB device.
636  *  Else: Failure.
637  *------------------------------------------------------------------------*/
638 static usb2_error_t
639 usb2_uref_location(struct usb2_location *ploc)
640 {
641 	/*
642 	 * Check if we already got an USB reference on this location:
643 	 */
644 	if (ploc->is_uref) {
645 		return (0);		/* success */
646 	}
647 	mtx_lock(&usb2_ref_lock);
648 	if (ploc->bus != devclass_get_softc(usb2_devclass_ptr, ploc->bus_index)) {
649 		DPRINTFN(2, "bus changed at %u\n", ploc->bus_index);
650 		goto error;
651 	}
652 	if (ploc->udev != ploc->bus->devices[ploc->dev_index]) {
653 		DPRINTFN(2, "device changed at %u\n", ploc->dev_index);
654 		goto error;
655 	}
656 	if (ploc->udev->refcount == USB_DEV_REF_MAX) {
657 		DPRINTFN(2, "no dev ref\n");
658 		goto error;
659 	}
660 	DPRINTFN(2, "ref udev\n");
661 	ploc->udev->refcount++;
662 	mtx_unlock(&usb2_ref_lock);
663 
664 	/* set "uref" */
665 	ploc->is_uref = 1;
666 
667 	/*
668 	 * We are about to alter the bus-state. Apply the
669 	 * required locks.
670 	 */
671 	sx_xlock(ploc->udev->default_sx + 1);
672 	mtx_lock(&Giant);		/* XXX */
673 	return (0);
674 
675 error:
676 	mtx_unlock(&usb2_ref_lock);
677 	DPRINTFN(2, "fail\n");
678 	return (USB_ERR_INVAL);
679 }
680 
681 /*------------------------------------------------------------------------*
682  *	usb2_unref_device
683  *
684  * This function will release the reference count by one unit for the
685  * given USB device.
686  *------------------------------------------------------------------------*/
687 void
688 usb2_unref_device(struct usb2_location *ploc)
689 {
690 	if (ploc->is_uref) {
691 		mtx_unlock(&Giant);	/* XXX */
692 		sx_unlock(ploc->udev->default_sx + 1);
693 	}
694 	mtx_lock(&usb2_ref_lock);
695 	if (ploc->is_read) {
696 		if (--(ploc->rxfifo->refcount) == 0) {
697 			usb2_cv_signal(&ploc->rxfifo->cv_drain);
698 		}
699 	}
700 	if (ploc->is_write) {
701 		if (--(ploc->txfifo->refcount) == 0) {
702 			usb2_cv_signal(&ploc->txfifo->cv_drain);
703 		}
704 	}
705 	if (ploc->is_uref) {
706 		if (--(ploc->udev->refcount) == 0) {
707 			usb2_cv_signal(ploc->udev->default_cv + 1);
708 		}
709 	}
710 	mtx_unlock(&usb2_ref_lock);
711 }
712 
713 static struct usb2_fifo *
714 usb2_fifo_alloc(void)
715 {
716 	struct usb2_fifo *f;
717 
718 	f = malloc(sizeof(*f), M_USBDEV, M_WAITOK | M_ZERO);
719 	if (f) {
720 		usb2_cv_init(&f->cv_io, "FIFO-IO");
721 		usb2_cv_init(&f->cv_drain, "FIFO-DRAIN");
722 		f->refcount = 1;
723 	}
724 	return (f);
725 }
726 
727 /*------------------------------------------------------------------------*
728  *	usb2_fifo_create
729  *------------------------------------------------------------------------*/
730 static int
731 usb2_fifo_create(struct usb2_location *ploc, uint32_t *pdevloc, int fflags)
732 {
733 	struct usb2_device *udev = ploc->udev;
734 	struct usb2_fifo *f;
735 	struct usb2_pipe *pipe;
736 	uint8_t iface_index = ploc->iface_index;
737 
738 	/* NOTE: variable overloading: */
739 	uint8_t dev_ep_index = ploc->fifo_index;
740 	uint8_t n;
741 	uint8_t is_tx;
742 	uint8_t is_rx;
743 	uint8_t no_null;
744 	uint8_t is_busy;
745 
746 	is_tx = (fflags & FWRITE) ? 1 : 0;
747 	is_rx = (fflags & FREAD) ? 1 : 0;
748 	no_null = 1;
749 	is_busy = 0;
750 
751 	/* search for a free FIFO slot */
752 
753 	for (n = 0;; n += 2) {
754 
755 		if (n == USB_FIFO_MAX) {
756 			if (no_null) {
757 				no_null = 0;
758 				n = 0;
759 			} else {
760 				/* end of FIFOs reached */
761 				return (ENOMEM);
762 			}
763 		}
764 		/* Check for TX FIFO */
765 		if (is_tx) {
766 			f = udev->fifo[n + USB_FIFO_TX];
767 			if (f != NULL) {
768 				if (f->dev_ep_index != dev_ep_index) {
769 					/* wrong endpoint index */
770 					continue;
771 				}
772 				if ((dev_ep_index != 0) &&
773 				    (f->iface_index != iface_index)) {
774 					/* wrong interface index */
775 					continue;
776 				}
777 				if (f->curr_file != NULL) {
778 					/* FIFO is opened */
779 					is_busy = 1;
780 					continue;
781 				}
782 			} else if (no_null) {
783 				continue;
784 			}
785 		}
786 		/* Check for RX FIFO */
787 		if (is_rx) {
788 			f = udev->fifo[n + USB_FIFO_RX];
789 			if (f != NULL) {
790 				if (f->dev_ep_index != dev_ep_index) {
791 					/* wrong endpoint index */
792 					continue;
793 				}
794 				if ((dev_ep_index != 0) &&
795 				    (f->iface_index != iface_index)) {
796 					/* wrong interface index */
797 					continue;
798 				}
799 				if (f->curr_file != NULL) {
800 					/* FIFO is opened */
801 					is_busy = 1;
802 					continue;
803 				}
804 			} else if (no_null) {
805 				continue;
806 			}
807 		}
808 		break;
809 	}
810 
811 	if (no_null == 0) {
812 		if (dev_ep_index >= (USB_EP_MAX / 2)) {
813 			/* we don't create any endpoints in this range */
814 			return (is_busy ? EBUSY : EINVAL);
815 		}
816 	}
817 	/* Check TX FIFO */
818 	if (is_tx &&
819 	    (udev->fifo[n + USB_FIFO_TX] == NULL)) {
820 		pipe = usb2_dev_get_pipe(udev,
821 		    iface_index, dev_ep_index, USB_FIFO_TX);
822 		if (pipe == NULL) {
823 			return (EINVAL);
824 		}
825 		f = usb2_fifo_alloc();
826 		if (f == NULL) {
827 			return (ENOMEM);
828 		}
829 		/* update some fields */
830 		f->fifo_index = n + USB_FIFO_TX;
831 		f->dev_ep_index = dev_ep_index;
832 		f->priv_mtx = udev->default_mtx;
833 		f->priv_sc0 = pipe;
834 		f->methods = &usb2_ugen_methods;
835 		f->iface_index = iface_index;
836 		f->udev = udev;
837 		mtx_lock(&usb2_ref_lock);
838 		udev->fifo[n + USB_FIFO_TX] = f;
839 		mtx_unlock(&usb2_ref_lock);
840 	}
841 	/* Check RX FIFO */
842 	if (is_rx &&
843 	    (udev->fifo[n + USB_FIFO_RX] == NULL)) {
844 
845 		pipe = usb2_dev_get_pipe(udev,
846 		    iface_index, dev_ep_index, USB_FIFO_RX);
847 		if (pipe == NULL) {
848 			return (EINVAL);
849 		}
850 		f = usb2_fifo_alloc();
851 		if (f == NULL) {
852 			return (ENOMEM);
853 		}
854 		/* update some fields */
855 		f->fifo_index = n + USB_FIFO_RX;
856 		f->dev_ep_index = dev_ep_index;
857 		f->priv_mtx = udev->default_mtx;
858 		f->priv_sc0 = pipe;
859 		f->methods = &usb2_ugen_methods;
860 		f->iface_index = iface_index;
861 		f->udev = udev;
862 		mtx_lock(&usb2_ref_lock);
863 		udev->fifo[n + USB_FIFO_RX] = f;
864 		mtx_unlock(&usb2_ref_lock);
865 	}
866 	if (is_tx) {
867 		ploc->txfifo = udev->fifo[n + USB_FIFO_TX];
868 	}
869 	if (is_rx) {
870 		ploc->rxfifo = udev->fifo[n + USB_FIFO_RX];
871 	}
872 	/* replace endpoint index by FIFO index */
873 
874 	(*pdevloc) %= (USB_BUS_MAX * USB_DEV_MAX * USB_IFACE_MAX);
875 	(*pdevloc) += (USB_BUS_MAX * USB_DEV_MAX * USB_IFACE_MAX) * n;
876 
877 	/* complete */
878 
879 	return (0);
880 }
881 
882 void
883 usb2_fifo_free(struct usb2_fifo *f)
884 {
885 	uint8_t n;
886 
887 	if (f == NULL) {
888 		/* be NULL safe */
889 		return;
890 	}
891 	/* destroy symlink devices, if any */
892 	for (n = 0; n != 2; n++) {
893 		if (f->symlink[n]) {
894 			usb2_free_symlink(f->symlink[n]);
895 			f->symlink[n] = NULL;
896 		}
897 	}
898 	mtx_lock(&usb2_ref_lock);
899 
900 	/* delink ourselves to stop calls from userland */
901 	if ((f->fifo_index < USB_FIFO_MAX) &&
902 	    (f->udev != NULL) &&
903 	    (f->udev->fifo[f->fifo_index] == f)) {
904 		f->udev->fifo[f->fifo_index] = NULL;
905 	} else {
906 		DPRINTFN(0, "USB FIFO %p has not been linked!\n", f);
907 	}
908 
909 	/* decrease refcount */
910 	f->refcount--;
911 	/* prevent any write flush */
912 	f->flag_iserror = 1;
913 	/* need to wait until all callers have exited */
914 	while (f->refcount != 0) {
915 		mtx_unlock(&usb2_ref_lock);	/* avoid LOR */
916 		mtx_lock(f->priv_mtx);
917 		/* get I/O thread out of any sleep state */
918 		if (f->flag_sleeping) {
919 			f->flag_sleeping = 0;
920 			usb2_cv_broadcast(&f->cv_io);
921 		}
922 		mtx_unlock(f->priv_mtx);
923 		mtx_lock(&usb2_ref_lock);
924 
925 		/* wait for sync */
926 		usb2_cv_wait(&f->cv_drain, &usb2_ref_lock);
927 	}
928 	mtx_unlock(&usb2_ref_lock);
929 
930 	/* take care of closing the device here, if any */
931 	usb2_fifo_close(f, curthread, 0);
932 
933 	usb2_cv_destroy(&f->cv_io);
934 	usb2_cv_destroy(&f->cv_drain);
935 
936 	free(f, M_USBDEV);
937 }
938 
939 static struct usb2_pipe *
940 usb2_dev_get_pipe(struct usb2_device *udev,
941     uint8_t iface_index, uint8_t ep_index, uint8_t dir)
942 {
943 	struct usb2_pipe *pipe;
944 	uint8_t ep_dir;
945 
946 	if (ep_index == 0) {
947 		pipe = &udev->default_pipe;
948 	} else {
949 		if (dir == USB_FIFO_RX) {
950 			if (udev->flags.usb2_mode == USB_MODE_HOST) {
951 				ep_dir = UE_DIR_IN;
952 			} else {
953 				ep_dir = UE_DIR_OUT;
954 			}
955 		} else {
956 			if (udev->flags.usb2_mode == USB_MODE_HOST) {
957 				ep_dir = UE_DIR_OUT;
958 			} else {
959 				ep_dir = UE_DIR_IN;
960 			}
961 		}
962 		pipe = usb2_get_pipe_by_addr(udev, ep_index | ep_dir);
963 	}
964 
965 	if (pipe == NULL) {
966 		/* if the pipe does not exist then return */
967 		return (NULL);
968 	}
969 	if (pipe->edesc == NULL) {
970 		/* invalid pipe */
971 		return (NULL);
972 	}
973 	if (ep_index != 0) {
974 		if (pipe->iface_index != iface_index) {
975 			/*
976 			 * Permissions violation - trying to access a
977 			 * pipe that does not belong to the interface.
978 			 */
979 			return (NULL);
980 		}
981 	}
982 	return (pipe);			/* success */
983 }
984 
985 /*------------------------------------------------------------------------*
986  *	usb2_fifo_open
987  *
988  * Returns:
989  * 0: Success
990  * Else: Failure
991  *------------------------------------------------------------------------*/
992 static int
993 usb2_fifo_open(struct usb2_fifo *f, struct file *fp, struct thread *td,
994     int fflags)
995 {
996 	int err;
997 
998 	if (f == NULL) {
999 		/* no FIFO there */
1000 		DPRINTFN(2, "no FIFO\n");
1001 		return (ENXIO);
1002 	}
1003 	/* remove FWRITE and FREAD flags */
1004 	fflags &= ~(FWRITE | FREAD);
1005 
1006 	/* set correct file flags */
1007 	if ((f->fifo_index & 1) == USB_FIFO_TX) {
1008 		fflags |= FWRITE;
1009 	} else {
1010 		fflags |= FREAD;
1011 	}
1012 
1013 	/* check if we are already opened */
1014 	/* we don't need any locks when checking this variable */
1015 	if (f->curr_file) {
1016 		err = EBUSY;
1017 		goto done;
1018 	}
1019 	/* call open method */
1020 	err = (f->methods->f_open) (f, fflags, td);
1021 	if (err) {
1022 		goto done;
1023 	}
1024 	mtx_lock(f->priv_mtx);
1025 
1026 	/* reset sleep flag */
1027 	f->flag_sleeping = 0;
1028 
1029 	/* reset error flag */
1030 	f->flag_iserror = 0;
1031 
1032 	/* reset complete flag */
1033 	f->flag_iscomplete = 0;
1034 
1035 	/* reset select flag */
1036 	f->flag_isselect = 0;
1037 
1038 	/* reset flushing flag */
1039 	f->flag_flushing = 0;
1040 
1041 	/* reset ASYNC proc flag */
1042 	f->async_p = NULL;
1043 
1044 	/* set which file we belong to */
1045 	mtx_lock(&usb2_ref_lock);
1046 	f->curr_file = fp;
1047 	mtx_unlock(&usb2_ref_lock);
1048 
1049 	/* reset queue */
1050 	usb2_fifo_reset(f);
1051 
1052 	mtx_unlock(f->priv_mtx);
1053 done:
1054 	return (err);
1055 }
1056 
1057 /*------------------------------------------------------------------------*
1058  *	usb2_fifo_reset
1059  *------------------------------------------------------------------------*/
1060 void
1061 usb2_fifo_reset(struct usb2_fifo *f)
1062 {
1063 	struct usb2_mbuf *m;
1064 
1065 	if (f == NULL) {
1066 		return;
1067 	}
1068 	while (1) {
1069 		USB_IF_DEQUEUE(&f->used_q, m);
1070 		if (m) {
1071 			USB_IF_ENQUEUE(&f->free_q, m);
1072 		} else {
1073 			break;
1074 		}
1075 	}
1076 }
1077 
1078 /*------------------------------------------------------------------------*
1079  *	usb2_fifo_close
1080  *------------------------------------------------------------------------*/
1081 static void
1082 usb2_fifo_close(struct usb2_fifo *f, struct thread *td, int fflags)
1083 {
1084 	int err;
1085 
1086 	/* check if we are not opened */
1087 	if (!f->curr_file) {
1088 		/* nothing to do - already closed */
1089 		return;
1090 	}
1091 	mtx_lock(f->priv_mtx);
1092 
1093 	/* clear current file flag */
1094 	f->curr_file = NULL;
1095 
1096 	/* check if we are selected */
1097 	if (f->flag_isselect) {
1098 		selwakeup(&f->selinfo);
1099 		f->flag_isselect = 0;
1100 	}
1101 	/* check if a thread wants SIGIO */
1102 	if (f->async_p != NULL) {
1103 		PROC_LOCK(f->async_p);
1104 		psignal(f->async_p, SIGIO);
1105 		PROC_UNLOCK(f->async_p);
1106 		f->async_p = NULL;
1107 	}
1108 	/* remove FWRITE and FREAD flags */
1109 	fflags &= ~(FWRITE | FREAD);
1110 
1111 	/* flush written data, if any */
1112 	if ((f->fifo_index & 1) == USB_FIFO_TX) {
1113 
1114 		if (!f->flag_iserror) {
1115 
1116 			/* set flushing flag */
1117 			f->flag_flushing = 1;
1118 
1119 			/* start write transfer, if not already started */
1120 			(f->methods->f_start_write) (f);
1121 
1122 			/* check if flushed already */
1123 			while (f->flag_flushing &&
1124 			    (!f->flag_iserror)) {
1125 				/* wait until all data has been written */
1126 				f->flag_sleeping = 1;
1127 				err = usb2_cv_wait_sig(&f->cv_io, f->priv_mtx);
1128 				if (err) {
1129 					DPRINTF("signal received\n");
1130 					break;
1131 				}
1132 			}
1133 		}
1134 		fflags |= FWRITE;
1135 
1136 		/* stop write transfer, if not already stopped */
1137 		(f->methods->f_stop_write) (f);
1138 	} else {
1139 		fflags |= FREAD;
1140 
1141 		/* stop write transfer, if not already stopped */
1142 		(f->methods->f_stop_read) (f);
1143 	}
1144 
1145 	/* check if we are sleeping */
1146 	if (f->flag_sleeping) {
1147 		DPRINTFN(2, "Sleeping at close!\n");
1148 	}
1149 	mtx_unlock(f->priv_mtx);
1150 
1151 	/* call close method */
1152 	(f->methods->f_close) (f, fflags, td);
1153 
1154 	DPRINTF("closed\n");
1155 }
1156 
1157 /*------------------------------------------------------------------------*
1158  *	usb2_check_thread_perm
1159  *
1160  * Returns:
1161  * 0: Has permission.
1162  * Else: No permission.
1163  *------------------------------------------------------------------------*/
1164 int
1165 usb2_check_thread_perm(struct usb2_device *udev, struct thread *td,
1166     int fflags, uint8_t iface_index, uint8_t ep_index)
1167 {
1168 	struct usb2_interface *iface;
1169 	int err;
1170 
1171 	if (ep_index != 0) {
1172 		/*
1173 		 * Non-control endpoints are always
1174 		 * associated with an interface:
1175 		 */
1176 		iface = usb2_get_iface(udev, iface_index);
1177 		if (iface == NULL) {
1178 			return (EINVAL);
1179 		}
1180 		if (iface->idesc == NULL) {
1181 			return (EINVAL);
1182 		}
1183 	} else {
1184 		iface = NULL;
1185 	}
1186 	/* scan down the permissions tree */
1187 	if ((iface != NULL) &&
1188 	    (usb2_check_access(fflags, &iface->perm) == 0)) {
1189 		/* we got access through the interface */
1190 		err = 0;
1191 	} else if (udev &&
1192 	    (usb2_check_access(fflags, &udev->perm) == 0)) {
1193 		/* we got access through the device */
1194 		err = 0;
1195 	} else if (udev->bus &&
1196 	    (usb2_check_access(fflags, &udev->bus->perm) == 0)) {
1197 		/* we got access through the USB bus */
1198 		err = 0;
1199 	} else if (usb2_check_access(fflags, &usb2_perm) == 0) {
1200 		/* we got general access */
1201 		err = 0;
1202 	} else {
1203 		/* no access */
1204 		err = EPERM;
1205 	}
1206 	return (err);
1207 }
1208 
1209 /*------------------------------------------------------------------------*
1210  *	usb2_fdopen - cdev callback
1211  *------------------------------------------------------------------------*/
1212 static int
1213 usb2_fdopen(struct cdev *dev, int xxx_oflags, struct thread *td,
1214     struct file *fp)
1215 {
1216 	struct usb2_location loc;
1217 	uint32_t devloc;
1218 	int err;
1219 	int fflags;
1220 
1221 	DPRINTFN(2, "oflags=0x%08x\n", xxx_oflags);
1222 
1223 	devloc = usb2_last_devloc;
1224 	usb2_last_devloc = (0 - 1);	/* reset "usb2_last_devloc" */
1225 
1226 	if (fp == NULL) {
1227 		DPRINTFN(2, "fp == NULL\n");
1228 		return (ENXIO);
1229 	}
1230 	if (usb2_old_f_data != fp->f_data) {
1231 		if (usb2_old_f_data != NULL) {
1232 			DPRINTFN(0, "File data mismatch!\n");
1233 			return (ENXIO);
1234 		}
1235 		usb2_old_f_data = fp->f_data;
1236 	}
1237 	if (usb2_old_f_ops != fp->f_ops) {
1238 		if (usb2_old_f_ops != NULL) {
1239 			DPRINTFN(0, "File ops mismatch!\n");
1240 			return (ENXIO);
1241 		}
1242 		usb2_old_f_ops = fp->f_ops;
1243 	}
1244 	fflags = fp->f_flag;
1245 	DPRINTFN(2, "fflags=0x%08x\n", fflags);
1246 
1247 	if (!(fflags & (FREAD | FWRITE))) {
1248 		/* should not happen */
1249 		return (EPERM);
1250 	}
1251 	if (devloc == (uint32_t)(0 - 2)) {
1252 		/* tried to open "/dev/usb" */
1253 		return (0);
1254 	} else if (devloc == (uint32_t)(0 - 1)) {
1255 		/* tried to open "/dev/usb " */
1256 		DPRINTFN(2, "no devloc\n");
1257 		return (ENXIO);
1258 	}
1259 	err = usb2_ref_device(NULL, &loc, devloc);
1260 	if (err) {
1261 		DPRINTFN(2, "cannot ref device\n");
1262 		return (ENXIO);
1263 	}
1264 	/*
1265 	 * NOTE: Variable overloading. "usb2_fifo_create" will update
1266 	 * the FIFO index. Right here we can assume that the
1267 	 * "fifo_index" is the same like the endpoint number without
1268 	 * direction mask, if the "fifo_index" is less than 16.
1269 	 */
1270 	err = usb2_check_thread_perm(loc.udev, td, fflags,
1271 	    loc.iface_index, loc.fifo_index);
1272 
1273 	/* check for error */
1274 	if (err) {
1275 		usb2_unref_device(&loc);
1276 		return (err);
1277 	}
1278 	/* create FIFOs, if any */
1279 	err = usb2_fifo_create(&loc, &devloc, fflags);
1280 	/* check for error */
1281 	if (err) {
1282 		usb2_unref_device(&loc);
1283 		return (err);
1284 	}
1285 	if (fflags & FREAD) {
1286 		err = usb2_fifo_open(loc.rxfifo, fp, td, fflags);
1287 		if (err) {
1288 			DPRINTFN(2, "read open failed\n");
1289 			usb2_unref_device(&loc);
1290 			return (err);
1291 		}
1292 	}
1293 	if (fflags & FWRITE) {
1294 		err = usb2_fifo_open(loc.txfifo, fp, td, fflags);
1295 		if (err) {
1296 			DPRINTFN(2, "write open failed\n");
1297 			if (fflags & FREAD) {
1298 				usb2_fifo_close(loc.rxfifo, td,
1299 				    fflags);
1300 			}
1301 			usb2_unref_device(&loc);
1302 			return (err);
1303 		}
1304 	}
1305 	/*
1306 	 * Take over the file so that we get all the callbacks
1307 	 * directly and don't have to create another device:
1308 	 */
1309 	finit(fp, fp->f_flag, DTYPE_VNODE,
1310 	    ((uint8_t *)0) + devloc, &usb2_ops_f);
1311 
1312 	usb2_unref_device(&loc);
1313 
1314 	DPRINTFN(2, "error=%d\n", err);
1315 
1316 	return (err);
1317 }
1318 
1319 /*------------------------------------------------------------------------*
1320  *	usb2_close - cdev callback
1321  *------------------------------------------------------------------------*/
1322 static int
1323 usb2_close(struct cdev *dev, int flag, int mode, struct thread *p)
1324 {
1325 	DPRINTF("\n");
1326 	return (0);			/* nothing to do */
1327 }
1328 
1329 /*------------------------------------------------------------------------*
1330  *	usb2_close - cdev callback
1331  *------------------------------------------------------------------------*/
1332 static int
1333 usb2_ioctl(struct cdev *dev, u_long cmd, caddr_t data,
1334     int fflag, struct thread *td)
1335 {
1336 	union {
1337 		struct usb2_read_dir *urd;
1338 		struct usb2_dev_perm *udp;
1339 		void   *data;
1340 	}     u;
1341 	int err;
1342 
1343 	u.data = data;
1344 
1345 	switch (cmd) {
1346 	case USB_READ_DIR:
1347 		err = usb2_read_symlink(u.urd->urd_data,
1348 		    u.urd->urd_startentry, u.urd->urd_maxlen);
1349 		break;
1350 	case USB_SET_IFACE_PERM:
1351 		err = usb2_set_perm(u.udp, 3);
1352 		break;
1353 	case USB_SET_DEVICE_PERM:
1354 		err = usb2_set_perm(u.udp, 2);
1355 		break;
1356 	case USB_SET_BUS_PERM:
1357 		err = usb2_set_perm(u.udp, 1);
1358 		break;
1359 	case USB_SET_ROOT_PERM:
1360 		err = usb2_set_perm(u.udp, 0);
1361 		break;
1362 	case USB_GET_IFACE_PERM:
1363 		err = usb2_get_perm(u.udp, 3);
1364 		break;
1365 	case USB_GET_DEVICE_PERM:
1366 		err = usb2_get_perm(u.udp, 2);
1367 		break;
1368 	case USB_GET_BUS_PERM:
1369 		err = usb2_get_perm(u.udp, 1);
1370 		break;
1371 	case USB_GET_ROOT_PERM:
1372 		err = usb2_get_perm(u.udp, 0);
1373 		break;
1374 	case USB_DEV_QUIRK_GET:
1375 	case USB_QUIRK_NAME_GET:
1376 	case USB_DEV_QUIRK_ADD:
1377 	case USB_DEV_QUIRK_REMOVE:
1378 		err = usb2_quirk_ioctl_p(cmd, data, fflag, td);
1379 		break;
1380 	default:
1381 		err = ENOTTY;
1382 		break;
1383 	}
1384 	return (err);
1385 }
1386 
1387 /*------------------------------------------------------------------------*
1388  *      usb2_clone - cdev callback
1389  *
1390  * This function is the kernel clone callback for "/dev/usbX.Y".
1391  *
1392  * NOTE: This function assumes that the clone and device open
1393  * operation is atomic.
1394  *------------------------------------------------------------------------*/
1395 static void
1396 usb2_clone(void *arg, USB_UCRED char *name, int namelen, struct cdev **dev)
1397 {
1398 	enum {
1399 		USB_DNAME_LEN = sizeof(USB_DEVICE_NAME) - 1,
1400 		USB_GNAME_LEN = sizeof(USB_GENERIC_NAME) - 1,
1401 	};
1402 
1403 	if (*dev) {
1404 		/* someone else has created a device */
1405 		return;
1406 	}
1407 	/* reset device location */
1408 	usb2_last_devloc = (uint32_t)(0 - 1);
1409 
1410 	/*
1411 	 * Check if we are matching "usb", "ugen" or an internal
1412 	 * symbolic link:
1413 	 */
1414 	if ((namelen >= USB_DNAME_LEN) &&
1415 	    (bcmp(name, USB_DEVICE_NAME, USB_DNAME_LEN) == 0)) {
1416 		if (namelen == USB_DNAME_LEN) {
1417 			/* USB management device location */
1418 			usb2_last_devloc = (uint32_t)(0 - 2);
1419 		} else {
1420 			/* USB endpoint */
1421 			usb2_last_devloc =
1422 			    usb2_path_convert(name + USB_DNAME_LEN);
1423 		}
1424 	} else if ((namelen >= USB_GNAME_LEN) &&
1425 	    (bcmp(name, USB_GENERIC_NAME, USB_GNAME_LEN) == 0)) {
1426 		if (namelen == USB_GNAME_LEN) {
1427 			/* USB management device location */
1428 			usb2_last_devloc = (uint32_t)(0 - 2);
1429 		} else {
1430 			/* USB endpoint */
1431 			usb2_last_devloc =
1432 			    usb2_path_convert(name + USB_GNAME_LEN);
1433 		}
1434 	}
1435 	if (usb2_last_devloc == (uint32_t)(0 - 1)) {
1436 		/* Search for symbolic link */
1437 		usb2_last_devloc =
1438 		    usb2_lookup_symlink(name, namelen);
1439 	}
1440 	if (usb2_last_devloc == (uint32_t)(0 - 1)) {
1441 		/* invalid location */
1442 		return;
1443 	}
1444 	dev_ref(usb2_dev);
1445 	*dev = usb2_dev;
1446 }
1447 
1448 static void
1449 usb2_dev_init(void *arg)
1450 {
1451 	mtx_init(&usb2_ref_lock, "USB ref mutex", NULL, MTX_DEF);
1452 	sx_init(&usb2_sym_lock, "USB sym mutex");
1453 	TAILQ_INIT(&usb2_sym_head);
1454 
1455 	/* check the UGEN methods */
1456 	usb2_fifo_check_methods(&usb2_ugen_methods);
1457 }
1458 
1459 SYSINIT(usb2_dev_init, SI_SUB_KLD, SI_ORDER_FIRST, usb2_dev_init, NULL);
1460 
1461 static void
1462 usb2_dev_init_post(void *arg)
1463 {
1464 	/*
1465 	 * Create a dummy device so that we are visible. This device
1466 	 * should never be opened. Therefore a space character is
1467 	 * appended after the USB device name.
1468 	 *
1469 	 * NOTE: The permissions of this device is 0666, because we
1470 	 * check the permissions again in the open routine against the
1471 	 * real USB permissions which are not 0666. Else USB access
1472 	 * will be limited to one user and one group.
1473 	 */
1474 	usb2_dev = make_dev(&usb2_devsw, 0, UID_ROOT, GID_OPERATOR,
1475 	    0666, USB_DEVICE_NAME " ");
1476 	if (usb2_dev == NULL) {
1477 		DPRINTFN(0, "Could not create usb bus device!\n");
1478 	}
1479 	usb2_clone_tag = EVENTHANDLER_REGISTER(dev_clone, usb2_clone_ptr, NULL, 1000);
1480 	if (usb2_clone_tag == NULL) {
1481 		DPRINTFN(0, "Registering clone handler failed!\n");
1482 	}
1483 }
1484 
1485 SYSINIT(usb2_dev_init_post, SI_SUB_KICK_SCHEDULER, SI_ORDER_FIRST, usb2_dev_init_post, NULL);
1486 
1487 static void
1488 usb2_dev_uninit(void *arg)
1489 {
1490 	if (usb2_clone_tag) {
1491 		EVENTHANDLER_DEREGISTER(dev_clone, usb2_clone_tag);
1492 		usb2_clone_tag = NULL;
1493 	}
1494 	if (usb2_dev) {
1495 		destroy_dev(usb2_dev);
1496 		usb2_dev = NULL;
1497 	}
1498 	mtx_destroy(&usb2_ref_lock);
1499 	sx_destroy(&usb2_sym_lock);
1500 }
1501 
1502 SYSUNINIT(usb2_dev_uninit, SI_SUB_KICK_SCHEDULER, SI_ORDER_ANY, usb2_dev_uninit, NULL);
1503 
1504 static int
1505 usb2_close_f(struct file *fp, struct thread *td)
1506 {
1507 	struct usb2_location loc;
1508 	int fflags;
1509 	int err;
1510 
1511 	fflags = fp->f_flag;
1512 
1513 	DPRINTFN(2, "fflags=%u\n", fflags);
1514 
1515 	err = usb2_ref_device(fp, &loc, 0 /* need uref */ );;
1516 
1517 	/* restore some file variables */
1518 	fp->f_ops = usb2_old_f_ops;
1519 	fp->f_data = usb2_old_f_data;
1520 
1521 	/* check for error */
1522 	if (err) {
1523 		DPRINTFN(2, "could not ref\n");
1524 		goto done;
1525 	}
1526 	if (fflags & FREAD) {
1527 		usb2_fifo_close(loc.rxfifo, td, fflags);
1528 	}
1529 	if (fflags & FWRITE) {
1530 		usb2_fifo_close(loc.txfifo, td, fflags);
1531 	}
1532 	usb2_unref_device(&loc);
1533 
1534 done:
1535 	/* call old close method */
1536 	USB_VNOPS_FO_CLOSE(fp, td, &err);
1537 
1538 	return (err);
1539 }
1540 
1541 static int
1542 usb2_ioctl_f_sub(struct usb2_fifo *f, u_long cmd, void *addr,
1543     struct thread *td)
1544 {
1545 	int error = 0;
1546 
1547 	switch (cmd) {
1548 	case FIODTYPE:
1549 		*(int *)addr = 0;	/* character device */
1550 		break;
1551 
1552 	case FIONBIO:
1553 		/* handled by upper FS layer */
1554 		break;
1555 
1556 	case FIOASYNC:
1557 		if (*(int *)addr) {
1558 			if (f->async_p != NULL) {
1559 				error = EBUSY;
1560 				break;
1561 			}
1562 			f->async_p = USB_TD_GET_PROC(td);
1563 		} else {
1564 			f->async_p = NULL;
1565 		}
1566 		break;
1567 
1568 		/* XXX this is not the most general solution */
1569 	case TIOCSPGRP:
1570 		if (f->async_p == NULL) {
1571 			error = EINVAL;
1572 			break;
1573 		}
1574 		if (*(int *)addr != USB_PROC_GET_GID(f->async_p)) {
1575 			error = EPERM;
1576 			break;
1577 		}
1578 		break;
1579 	default:
1580 		return (ENOIOCTL);
1581 	}
1582 	return (error);
1583 }
1584 
1585 static int
1586 usb2_ioctl_f(struct file *fp, u_long cmd, void *addr,
1587     struct ucred *cred, struct thread *td)
1588 {
1589 	struct usb2_location loc;
1590 	struct usb2_fifo *f;
1591 	int fflags;
1592 	int err;
1593 
1594 	err = usb2_ref_device(fp, &loc, 1 /* no uref */ );;
1595 	if (err) {
1596 		return (ENXIO);
1597 	}
1598 	fflags = fp->f_flag;
1599 
1600 	DPRINTFN(2, "fflags=%u, cmd=0x%lx\n", fflags, cmd);
1601 
1602 	f = NULL;			/* set default value */
1603 	err = ENOIOCTL;			/* set default value */
1604 
1605 	if (fflags & FWRITE) {
1606 		f = loc.txfifo;
1607 		err = usb2_ioctl_f_sub(f, cmd, addr, td);
1608 	}
1609 	if (fflags & FREAD) {
1610 		f = loc.rxfifo;
1611 		err = usb2_ioctl_f_sub(f, cmd, addr, td);
1612 	}
1613 	if (err == ENOIOCTL) {
1614 		err = (f->methods->f_ioctl) (f, cmd, addr, fflags, td);
1615 		if (err == ENOIOCTL) {
1616 			if (usb2_uref_location(&loc)) {
1617 				err = ENXIO;
1618 				goto done;
1619 			}
1620 			err = (f->methods->f_ioctl_post) (f, cmd, addr, fflags, td);
1621 		}
1622 	}
1623 	if (err == ENOIOCTL) {
1624 		err = ENOTTY;
1625 	}
1626 done:
1627 	usb2_unref_device(&loc);
1628 	return (err);
1629 }
1630 
1631 /* ARGSUSED */
1632 static int
1633 usb2_kqfilter_f(struct file *fp, struct knote *kn)
1634 {
1635 	return (ENXIO);
1636 }
1637 
1638 /* ARGSUSED */
1639 static int
1640 usb2_poll_f(struct file *fp, int events,
1641     struct ucred *cred, struct thread *td)
1642 {
1643 	struct usb2_location loc;
1644 	struct usb2_fifo *f;
1645 	struct usb2_mbuf *m;
1646 	int fflags;
1647 	int revents;
1648 
1649 	revents = usb2_ref_device(fp, &loc, 1 /* no uref */ );;
1650 	if (revents) {
1651 		return (POLLHUP);
1652 	}
1653 	fflags = fp->f_flag;
1654 
1655 	/* Figure out who needs service */
1656 
1657 	if ((events & (POLLOUT | POLLWRNORM)) &&
1658 	    (fflags & FWRITE)) {
1659 
1660 		f = loc.txfifo;
1661 
1662 		mtx_lock(f->priv_mtx);
1663 
1664 		if (!loc.is_usbfs) {
1665 			if (f->flag_iserror) {
1666 				/* we got an error */
1667 				m = (void *)1;
1668 			} else {
1669 				if (f->queue_data == NULL) {
1670 					/*
1671 					 * start write transfer, if not
1672 					 * already started
1673 					 */
1674 					(f->methods->f_start_write) (f);
1675 				}
1676 				/* check if any packets are available */
1677 				USB_IF_POLL(&f->free_q, m);
1678 			}
1679 		} else {
1680 			if (f->flag_iscomplete) {
1681 				m = (void *)1;
1682 			} else {
1683 				m = NULL;
1684 			}
1685 		}
1686 
1687 		if (m) {
1688 			revents |= events & (POLLOUT | POLLWRNORM);
1689 		} else {
1690 			f->flag_isselect = 1;
1691 			selrecord(td, &f->selinfo);
1692 		}
1693 
1694 		mtx_unlock(f->priv_mtx);
1695 	}
1696 	if ((events & (POLLIN | POLLRDNORM)) &&
1697 	    (fflags & FREAD)) {
1698 
1699 		f = loc.rxfifo;
1700 
1701 		mtx_lock(f->priv_mtx);
1702 
1703 		if (!loc.is_usbfs) {
1704 			if (f->flag_iserror) {
1705 				/* we have and error */
1706 				m = (void *)1;
1707 			} else {
1708 				if (f->queue_data == NULL) {
1709 					/*
1710 					 * start read transfer, if not
1711 					 * already started
1712 					 */
1713 					(f->methods->f_start_read) (f);
1714 				}
1715 				/* check if any packets are available */
1716 				USB_IF_POLL(&f->used_q, m);
1717 			}
1718 		} else {
1719 			if (f->flag_iscomplete) {
1720 				m = (void *)1;
1721 			} else {
1722 				m = NULL;
1723 			}
1724 		}
1725 
1726 		if (m) {
1727 			revents |= events & (POLLIN | POLLRDNORM);
1728 		} else {
1729 			f->flag_isselect = 1;
1730 			selrecord(td, &f->selinfo);
1731 
1732 			if (!loc.is_usbfs) {
1733 				/* start reading data */
1734 				(f->methods->f_start_read) (f);
1735 			}
1736 		}
1737 
1738 		mtx_unlock(f->priv_mtx);
1739 	}
1740 	usb2_unref_device(&loc);
1741 	return (revents);
1742 }
1743 
1744 /* ARGSUSED */
1745 static int
1746 usb2_read_f(struct file *fp, struct uio *uio, struct ucred *cred,
1747     int flags, struct thread *td)
1748 {
1749 	struct usb2_location loc;
1750 	struct usb2_fifo *f;
1751 	struct usb2_mbuf *m;
1752 	int fflags;
1753 	int resid;
1754 	int io_len;
1755 	int err;
1756 	uint8_t tr_data = 0;
1757 
1758 	DPRINTFN(2, "\n");
1759 
1760 	fflags = fp->f_flag & (O_NONBLOCK | O_DIRECT | FREAD | FWRITE);
1761 	if (fflags & O_DIRECT)
1762 		fflags |= IO_DIRECT;
1763 
1764 	err = usb2_ref_device(fp, &loc, 1 /* no uref */ );
1765 	if (err) {
1766 		return (ENXIO);
1767 	}
1768 	f = loc.rxfifo;
1769 	if (f == NULL) {
1770 		/* should not happen */
1771 		return (EPERM);
1772 	}
1773 	resid = uio->uio_resid;
1774 
1775 	if ((flags & FOF_OFFSET) == 0)
1776 		uio->uio_offset = fp->f_offset;
1777 
1778 	mtx_lock(f->priv_mtx);
1779 
1780 	/* check for permanent read error */
1781 	if (f->flag_iserror) {
1782 		err = EIO;
1783 		goto done;
1784 	}
1785 	/* check if USB-FS interface is active */
1786 	if (loc.is_usbfs) {
1787 		/*
1788 		 * The queue is used for events that should be
1789 		 * retrieved using the "USB_FS_COMPLETE" ioctl.
1790 		 */
1791 		err = EINVAL;
1792 		goto done;
1793 	}
1794 	while (uio->uio_resid > 0) {
1795 
1796 		USB_IF_DEQUEUE(&f->used_q, m);
1797 
1798 		if (m == NULL) {
1799 
1800 			/* start read transfer, if not already started */
1801 
1802 			(f->methods->f_start_read) (f);
1803 
1804 			if (fflags & O_NONBLOCK) {
1805 				if (tr_data) {
1806 					/* return length before error */
1807 					break;
1808 				}
1809 				err = EWOULDBLOCK;
1810 				break;
1811 			}
1812 			DPRINTF("sleeping\n");
1813 
1814 			err = usb2_fifo_wait(f);
1815 			if (err) {
1816 				break;
1817 			}
1818 			continue;
1819 		}
1820 		if (f->methods->f_filter_read) {
1821 			/*
1822 			 * Sometimes it is convenient to process data at the
1823 			 * expense of a userland process instead of a kernel
1824 			 * process.
1825 			 */
1826 			(f->methods->f_filter_read) (f, m);
1827 		}
1828 		tr_data = 1;
1829 
1830 		io_len = MIN(m->cur_data_len, uio->uio_resid);
1831 
1832 		DPRINTFN(2, "transfer %d bytes from %p\n",
1833 		    io_len, m->cur_data_ptr);
1834 
1835 		err = usb2_fifo_uiomove(f,
1836 		    m->cur_data_ptr, io_len, uio);
1837 
1838 		m->cur_data_len -= io_len;
1839 		m->cur_data_ptr += io_len;
1840 
1841 		if (m->cur_data_len == 0) {
1842 
1843 			uint8_t last_packet;
1844 
1845 			last_packet = m->last_packet;
1846 
1847 			USB_IF_ENQUEUE(&f->free_q, m);
1848 
1849 			if (last_packet) {
1850 				/* keep framing */
1851 				break;
1852 			}
1853 		} else {
1854 			USB_IF_PREPEND(&f->used_q, m);
1855 		}
1856 
1857 		if (err) {
1858 			break;
1859 		}
1860 	}
1861 done:
1862 	mtx_unlock(f->priv_mtx);
1863 
1864 	usb2_unref_device(&loc);
1865 
1866 	if ((flags & FOF_OFFSET) == 0)
1867 		fp->f_offset = uio->uio_offset;
1868 	fp->f_nextoff = uio->uio_offset;
1869 	return (err);
1870 }
1871 
1872 static int
1873 usb2_stat_f(struct file *fp, struct stat *sb, struct ucred *cred, struct thread *td)
1874 {
1875 	return (USB_VNOPS_FO_STAT(fp, sb, cred, td));
1876 }
1877 
1878 #if __FreeBSD_version > 800009
1879 static int
1880 usb2_truncate_f(struct file *fp, off_t length, struct ucred *cred, struct thread *td)
1881 {
1882 	return (USB_VNOPS_FO_TRUNCATE(fp, length, cred, td));
1883 }
1884 
1885 #endif
1886 
1887 /* ARGSUSED */
1888 static int
1889 usb2_write_f(struct file *fp, struct uio *uio, struct ucred *cred,
1890     int flags, struct thread *td)
1891 {
1892 	struct usb2_location loc;
1893 	struct usb2_fifo *f;
1894 	struct usb2_mbuf *m;
1895 	int fflags;
1896 	int resid;
1897 	int io_len;
1898 	int err;
1899 	uint8_t tr_data = 0;
1900 
1901 	DPRINTFN(2, "\n");
1902 
1903 	fflags = fp->f_flag & (O_NONBLOCK | O_DIRECT |
1904 	    FREAD | FWRITE | O_FSYNC);
1905 	if (fflags & O_DIRECT)
1906 		fflags |= IO_DIRECT;
1907 
1908 	err = usb2_ref_device(fp, &loc, 1 /* no uref */ );
1909 	if (err) {
1910 		return (ENXIO);
1911 	}
1912 	f = loc.txfifo;
1913 	if (f == NULL) {
1914 		/* should not happen */
1915 		usb2_unref_device(&loc);
1916 		return (EPERM);
1917 	}
1918 	resid = uio->uio_resid;
1919 
1920 	if ((flags & FOF_OFFSET) == 0)
1921 		uio->uio_offset = fp->f_offset;
1922 
1923 	mtx_lock(f->priv_mtx);
1924 
1925 	/* check for permanent write error */
1926 	if (f->flag_iserror) {
1927 		err = EIO;
1928 		goto done;
1929 	}
1930 	/* check if USB-FS interface is active */
1931 	if (loc.is_usbfs) {
1932 		/*
1933 		 * The queue is used for events that should be
1934 		 * retrieved using the "USB_FS_COMPLETE" ioctl.
1935 		 */
1936 		err = EINVAL;
1937 		goto done;
1938 	}
1939 	if (f->queue_data == NULL) {
1940 		/* start write transfer, if not already started */
1941 		(f->methods->f_start_write) (f);
1942 	}
1943 	/* we allow writing zero length data */
1944 	do {
1945 		USB_IF_DEQUEUE(&f->free_q, m);
1946 
1947 		if (m == NULL) {
1948 
1949 			if (fflags & O_NONBLOCK) {
1950 				if (tr_data) {
1951 					/* return length before error */
1952 					break;
1953 				}
1954 				err = EWOULDBLOCK;
1955 				break;
1956 			}
1957 			DPRINTF("sleeping\n");
1958 
1959 			err = usb2_fifo_wait(f);
1960 			if (err) {
1961 				break;
1962 			}
1963 			continue;
1964 		}
1965 		tr_data = 1;
1966 
1967 		USB_MBUF_RESET(m);
1968 
1969 		io_len = MIN(m->cur_data_len, uio->uio_resid);
1970 
1971 		m->cur_data_len = io_len;
1972 
1973 		DPRINTFN(2, "transfer %d bytes to %p\n",
1974 		    io_len, m->cur_data_ptr);
1975 
1976 		err = usb2_fifo_uiomove(f,
1977 		    m->cur_data_ptr, io_len, uio);
1978 
1979 		if (err) {
1980 			USB_IF_ENQUEUE(&f->free_q, m);
1981 			break;
1982 		}
1983 		if (f->methods->f_filter_write) {
1984 			/*
1985 			 * Sometimes it is convenient to process data at the
1986 			 * expense of a userland process instead of a kernel
1987 			 * process.
1988 			 */
1989 			(f->methods->f_filter_write) (f, m);
1990 		}
1991 		USB_IF_ENQUEUE(&f->used_q, m);
1992 
1993 		(f->methods->f_start_write) (f);
1994 
1995 	} while (uio->uio_resid > 0);
1996 done:
1997 	mtx_unlock(f->priv_mtx);
1998 
1999 	usb2_unref_device(&loc);
2000 
2001 	if ((flags & FOF_OFFSET) == 0)
2002 		fp->f_offset = uio->uio_offset;
2003 	fp->f_nextoff = uio->uio_offset;
2004 
2005 	return (err);
2006 }
2007 
2008 static int
2009 usb2_fifo_uiomove(struct usb2_fifo *f, void *cp,
2010     int n, struct uio *uio)
2011 {
2012 	int error;
2013 
2014 	mtx_unlock(f->priv_mtx);
2015 
2016 	/*
2017 	 * "uiomove()" can sleep so one needs to make a wrapper,
2018 	 * exiting the mutex and checking things:
2019 	 */
2020 	error = uiomove(cp, n, uio);
2021 
2022 	mtx_lock(f->priv_mtx);
2023 
2024 	return (error);
2025 }
2026 
2027 int
2028 usb2_fifo_wait(struct usb2_fifo *f)
2029 {
2030 	int err;
2031 
2032 	mtx_assert(f->priv_mtx, MA_OWNED);
2033 
2034 	if (f->flag_iserror) {
2035 		/* we are gone */
2036 		return (EIO);
2037 	}
2038 	f->flag_sleeping = 1;
2039 
2040 	err = usb2_cv_wait_sig(&f->cv_io, f->priv_mtx);
2041 
2042 	if (f->flag_iserror) {
2043 		/* we are gone */
2044 		err = EIO;
2045 	}
2046 	return (err);
2047 }
2048 
2049 void
2050 usb2_fifo_signal(struct usb2_fifo *f)
2051 {
2052 	if (f->flag_sleeping) {
2053 		f->flag_sleeping = 0;
2054 		usb2_cv_broadcast(&f->cv_io);
2055 	}
2056 }
2057 
2058 void
2059 usb2_fifo_wakeup(struct usb2_fifo *f)
2060 {
2061 	usb2_fifo_signal(f);
2062 
2063 	if (f->flag_isselect) {
2064 		selwakeup(&f->selinfo);
2065 		f->flag_isselect = 0;
2066 	}
2067 	if (f->async_p != NULL) {
2068 		PROC_LOCK(f->async_p);
2069 		psignal(f->async_p, SIGIO);
2070 		PROC_UNLOCK(f->async_p);
2071 	}
2072 }
2073 
2074 /*------------------------------------------------------------------------*
2075  *	usb2_fifo_opened
2076  *
2077  * Returns:
2078  * 0: FIFO not opened.
2079  * Else: FIFO is opened.
2080  *------------------------------------------------------------------------*/
2081 uint8_t
2082 usb2_fifo_opened(struct usb2_fifo *f)
2083 {
2084 	uint8_t temp;
2085 	uint8_t do_unlock;
2086 
2087 	if (f == NULL) {
2088 		return (0);		/* be NULL safe */
2089 	}
2090 	if (mtx_owned(f->priv_mtx)) {
2091 		do_unlock = 0;
2092 	} else {
2093 		do_unlock = 1;
2094 		mtx_lock(f->priv_mtx);
2095 	}
2096 	temp = f->curr_file ? 1 : 0;
2097 	if (do_unlock) {
2098 		mtx_unlock(f->priv_mtx);
2099 	}
2100 	return (temp);
2101 }
2102 
2103 
2104 static int
2105 usb2_fifo_dummy_open(struct usb2_fifo *fifo,
2106     int fflags, struct thread *td)
2107 {
2108 	return (0);
2109 }
2110 
2111 static void
2112 usb2_fifo_dummy_close(struct usb2_fifo *fifo,
2113     int fflags, struct thread *td)
2114 {
2115 	return;
2116 }
2117 
2118 static int
2119 usb2_fifo_dummy_ioctl(struct usb2_fifo *fifo, u_long cmd, void *addr,
2120     int fflags, struct thread *td)
2121 {
2122 	return (ENOIOCTL);
2123 }
2124 
2125 static void
2126 usb2_fifo_dummy_cmd(struct usb2_fifo *fifo)
2127 {
2128 	fifo->flag_flushing = 0;	/* not flushing */
2129 }
2130 
2131 static void
2132 usb2_fifo_check_methods(struct usb2_fifo_methods *pm)
2133 {
2134 	/* check that all callback functions are OK */
2135 
2136 	if (pm->f_open == NULL)
2137 		pm->f_open = &usb2_fifo_dummy_open;
2138 
2139 	if (pm->f_close == NULL)
2140 		pm->f_close = &usb2_fifo_dummy_close;
2141 
2142 	if (pm->f_ioctl == NULL)
2143 		pm->f_ioctl = &usb2_fifo_dummy_ioctl;
2144 
2145 	if (pm->f_ioctl_post == NULL)
2146 		pm->f_ioctl_post = &usb2_fifo_dummy_ioctl;
2147 
2148 	if (pm->f_start_read == NULL)
2149 		pm->f_start_read = &usb2_fifo_dummy_cmd;
2150 
2151 	if (pm->f_stop_read == NULL)
2152 		pm->f_stop_read = &usb2_fifo_dummy_cmd;
2153 
2154 	if (pm->f_start_write == NULL)
2155 		pm->f_start_write = &usb2_fifo_dummy_cmd;
2156 
2157 	if (pm->f_stop_write == NULL)
2158 		pm->f_stop_write = &usb2_fifo_dummy_cmd;
2159 }
2160 
2161 /*------------------------------------------------------------------------*
2162  *	usb2_fifo_attach
2163  *
2164  * The following function will create a duplex FIFO.
2165  *
2166  * Return values:
2167  * 0: Success.
2168  * Else: Failure.
2169  *------------------------------------------------------------------------*/
2170 int
2171 usb2_fifo_attach(struct usb2_device *udev, void *priv_sc,
2172     struct mtx *priv_mtx, struct usb2_fifo_methods *pm,
2173     struct usb2_fifo_sc *f_sc, uint16_t unit, uint16_t subunit,
2174     uint8_t iface_index)
2175 {
2176 	struct usb2_fifo *f_tx;
2177 	struct usb2_fifo *f_rx;
2178 	char buf[32];
2179 	char src[32];
2180 	uint8_t n;
2181 
2182 	f_sc->fp[USB_FIFO_TX] = NULL;
2183 	f_sc->fp[USB_FIFO_RX] = NULL;
2184 
2185 	if (pm == NULL)
2186 		return (EINVAL);
2187 
2188 	/* check the methods */
2189 	usb2_fifo_check_methods(pm);
2190 
2191 	if (priv_mtx == NULL)
2192 		priv_mtx = &Giant;
2193 
2194 	/* search for a free FIFO slot */
2195 	for (n = 0;; n += 2) {
2196 
2197 		if (n == USB_FIFO_MAX) {
2198 			/* end of FIFOs reached */
2199 			return (ENOMEM);
2200 		}
2201 		/* Check for TX FIFO */
2202 		if (udev->fifo[n + USB_FIFO_TX] != NULL) {
2203 			continue;
2204 		}
2205 		/* Check for RX FIFO */
2206 		if (udev->fifo[n + USB_FIFO_RX] != NULL) {
2207 			continue;
2208 		}
2209 		break;
2210 	}
2211 
2212 	f_tx = usb2_fifo_alloc();
2213 	f_rx = usb2_fifo_alloc();
2214 
2215 	if ((f_tx == NULL) || (f_rx == NULL)) {
2216 		usb2_fifo_free(f_tx);
2217 		usb2_fifo_free(f_rx);
2218 		return (ENOMEM);
2219 	}
2220 	/* initialise FIFO structures */
2221 
2222 	f_tx->fifo_index = n + USB_FIFO_TX;
2223 	f_tx->dev_ep_index = (n / 2) + (USB_EP_MAX / 2);
2224 	f_tx->priv_mtx = priv_mtx;
2225 	f_tx->priv_sc0 = priv_sc;
2226 	f_tx->methods = pm;
2227 	f_tx->iface_index = iface_index;
2228 	f_tx->udev = udev;
2229 
2230 	f_rx->fifo_index = n + USB_FIFO_RX;
2231 	f_rx->dev_ep_index = (n / 2) + (USB_EP_MAX / 2);
2232 	f_rx->priv_mtx = priv_mtx;
2233 	f_rx->priv_sc0 = priv_sc;
2234 	f_rx->methods = pm;
2235 	f_rx->iface_index = iface_index;
2236 	f_rx->udev = udev;
2237 
2238 	f_sc->fp[USB_FIFO_TX] = f_tx;
2239 	f_sc->fp[USB_FIFO_RX] = f_rx;
2240 
2241 	mtx_lock(&usb2_ref_lock);
2242 	udev->fifo[f_tx->fifo_index] = f_tx;
2243 	udev->fifo[f_rx->fifo_index] = f_rx;
2244 	mtx_unlock(&usb2_ref_lock);
2245 
2246 	if (snprintf(src, sizeof(src),
2247 	    USB_DEVICE_NAME "%u.%u.%u.%u",
2248 	    device_get_unit(udev->bus->bdev),
2249 	    udev->device_index,
2250 	    iface_index,
2251 	    f_tx->dev_ep_index)) {
2252 		/* ignore */
2253 	}
2254 	for (n = 0; n != 4; n++) {
2255 
2256 		if (pm->basename[n] == NULL) {
2257 			continue;
2258 		}
2259 		if (subunit == 0xFFFF) {
2260 			if (snprintf(buf, sizeof(buf),
2261 			    "%s%u%s", pm->basename[n],
2262 			    unit, pm->postfix[n] ?
2263 			    pm->postfix[n] : "")) {
2264 				/* ignore */
2265 			}
2266 		} else {
2267 			if (snprintf(buf, sizeof(buf),
2268 			    "%s%u.%u%s", pm->basename[n],
2269 			    unit, subunit, pm->postfix[n] ?
2270 			    pm->postfix[n] : "")) {
2271 				/* ignore */
2272 			}
2273 		}
2274 
2275 		/*
2276 		 * Distribute the symbolic links into two FIFO structures:
2277 		 */
2278 		if (n & 1) {
2279 			f_rx->symlink[n / 2] =
2280 			    usb2_alloc_symlink(src, "%s", buf);
2281 		} else {
2282 			f_tx->symlink[n / 2] =
2283 			    usb2_alloc_symlink(src, "%s", buf);
2284 		}
2285 		printf("Symlink: %s -> %s\n", buf, src);
2286 	}
2287 
2288 	DPRINTFN(2, "attached %p/%p\n", f_tx, f_rx);
2289 	return (0);
2290 }
2291 
2292 /*------------------------------------------------------------------------*
2293  *	usb2_fifo_alloc_buffer
2294  *
2295  * Return values:
2296  * 0: Success
2297  * Else failure
2298  *------------------------------------------------------------------------*/
2299 int
2300 usb2_fifo_alloc_buffer(struct usb2_fifo *f, uint32_t bufsize,
2301     uint16_t nbuf)
2302 {
2303 	usb2_fifo_free_buffer(f);
2304 
2305 	/* allocate an endpoint */
2306 	f->free_q.ifq_maxlen = nbuf;
2307 	f->used_q.ifq_maxlen = nbuf;
2308 
2309 	f->queue_data = usb2_alloc_mbufs(
2310 	    M_USBDEV, &f->free_q, bufsize, nbuf);
2311 
2312 	if ((f->queue_data == NULL) && bufsize && nbuf) {
2313 		return (ENOMEM);
2314 	}
2315 	return (0);			/* success */
2316 }
2317 
2318 /*------------------------------------------------------------------------*
2319  *	usb2_fifo_free_buffer
2320  *
2321  * This function will free the buffers associated with a FIFO. This
2322  * function can be called multiple times in a row.
2323  *------------------------------------------------------------------------*/
2324 void
2325 usb2_fifo_free_buffer(struct usb2_fifo *f)
2326 {
2327 	if (f->queue_data) {
2328 		/* free old buffer */
2329 		free(f->queue_data, M_USBDEV);
2330 		f->queue_data = NULL;
2331 	}
2332 	/* reset queues */
2333 
2334 	bzero(&f->free_q, sizeof(f->free_q));
2335 	bzero(&f->used_q, sizeof(f->used_q));
2336 }
2337 
2338 void
2339 usb2_fifo_detach(struct usb2_fifo_sc *f_sc)
2340 {
2341 	if (f_sc == NULL) {
2342 		return;
2343 	}
2344 	usb2_fifo_free(f_sc->fp[USB_FIFO_TX]);
2345 	usb2_fifo_free(f_sc->fp[USB_FIFO_RX]);
2346 
2347 	f_sc->fp[USB_FIFO_TX] = NULL;
2348 	f_sc->fp[USB_FIFO_RX] = NULL;
2349 
2350 	DPRINTFN(2, "detached %p\n", f_sc);
2351 }
2352 
2353 uint32_t
2354 usb2_fifo_put_bytes_max(struct usb2_fifo *f)
2355 {
2356 	struct usb2_mbuf *m;
2357 	uint32_t len;
2358 
2359 	USB_IF_POLL(&f->free_q, m);
2360 
2361 	if (m) {
2362 		len = m->max_data_len;
2363 	} else {
2364 		len = 0;
2365 	}
2366 	return (len);
2367 }
2368 
2369 /*------------------------------------------------------------------------*
2370  *	usb2_fifo_put_data
2371  *
2372  * what:
2373  *  0 - normal operation
2374  *  1 - set last packet flag to enforce framing
2375  *------------------------------------------------------------------------*/
2376 void
2377 usb2_fifo_put_data(struct usb2_fifo *f, struct usb2_page_cache *pc,
2378     uint32_t offset, uint32_t len, uint8_t what)
2379 {
2380 	struct usb2_mbuf *m;
2381 	uint32_t io_len;
2382 
2383 	while (len || (what == 1)) {
2384 
2385 		USB_IF_DEQUEUE(&f->free_q, m);
2386 
2387 		if (m) {
2388 			USB_MBUF_RESET(m);
2389 
2390 			io_len = MIN(len, m->cur_data_len);
2391 
2392 			usb2_copy_out(pc, offset, m->cur_data_ptr, io_len);
2393 
2394 			m->cur_data_len = io_len;
2395 			offset += io_len;
2396 			len -= io_len;
2397 
2398 			if ((len == 0) && (what == 1)) {
2399 				m->last_packet = 1;
2400 			}
2401 			USB_IF_ENQUEUE(&f->used_q, m);
2402 
2403 			usb2_fifo_wakeup(f);
2404 
2405 			if ((len == 0) || (what == 1)) {
2406 				break;
2407 			}
2408 		} else {
2409 			break;
2410 		}
2411 	}
2412 }
2413 
2414 void
2415 usb2_fifo_put_data_linear(struct usb2_fifo *f, void *ptr,
2416     uint32_t len, uint8_t what)
2417 {
2418 	struct usb2_mbuf *m;
2419 	uint32_t io_len;
2420 
2421 	while (len || (what == 1)) {
2422 
2423 		USB_IF_DEQUEUE(&f->free_q, m);
2424 
2425 		if (m) {
2426 			USB_MBUF_RESET(m);
2427 
2428 			io_len = MIN(len, m->cur_data_len);
2429 
2430 			bcopy(ptr, m->cur_data_ptr, io_len);
2431 
2432 			m->cur_data_len = io_len;
2433 			ptr = USB_ADD_BYTES(ptr, io_len);
2434 			len -= io_len;
2435 
2436 			if ((len == 0) && (what == 1)) {
2437 				m->last_packet = 1;
2438 			}
2439 			USB_IF_ENQUEUE(&f->used_q, m);
2440 
2441 			usb2_fifo_wakeup(f);
2442 
2443 			if ((len == 0) || (what == 1)) {
2444 				break;
2445 			}
2446 		} else {
2447 			break;
2448 		}
2449 	}
2450 }
2451 
2452 uint8_t
2453 usb2_fifo_put_data_buffer(struct usb2_fifo *f, void *ptr, uint32_t len)
2454 {
2455 	struct usb2_mbuf *m;
2456 
2457 	USB_IF_DEQUEUE(&f->free_q, m);
2458 
2459 	if (m) {
2460 		m->cur_data_len = len;
2461 		m->cur_data_ptr = ptr;
2462 		USB_IF_ENQUEUE(&f->used_q, m);
2463 		usb2_fifo_wakeup(f);
2464 		return (1);
2465 	}
2466 	return (0);
2467 }
2468 
2469 void
2470 usb2_fifo_put_data_error(struct usb2_fifo *f)
2471 {
2472 	f->flag_iserror = 1;
2473 	usb2_fifo_wakeup(f);
2474 }
2475 
2476 /*------------------------------------------------------------------------*
2477  *	usb2_fifo_get_data
2478  *
2479  * what:
2480  *  0 - normal operation
2481  *  1 - only get one "usb2_mbuf"
2482  *
2483  * returns:
2484  *  0 - no more data
2485  *  1 - data in buffer
2486  *------------------------------------------------------------------------*/
2487 uint8_t
2488 usb2_fifo_get_data(struct usb2_fifo *f, struct usb2_page_cache *pc,
2489     uint32_t offset, uint32_t len, uint32_t *actlen,
2490     uint8_t what)
2491 {
2492 	struct usb2_mbuf *m;
2493 	uint32_t io_len;
2494 	uint8_t tr_data = 0;
2495 
2496 	actlen[0] = 0;
2497 
2498 	while (1) {
2499 
2500 		USB_IF_DEQUEUE(&f->used_q, m);
2501 
2502 		if (m) {
2503 
2504 			tr_data = 1;
2505 
2506 			io_len = MIN(len, m->cur_data_len);
2507 
2508 			usb2_copy_in(pc, offset, m->cur_data_ptr, io_len);
2509 
2510 			len -= io_len;
2511 			offset += io_len;
2512 			actlen[0] += io_len;
2513 			m->cur_data_ptr += io_len;
2514 			m->cur_data_len -= io_len;
2515 
2516 			if ((m->cur_data_len == 0) || (what == 1)) {
2517 				USB_IF_ENQUEUE(&f->free_q, m);
2518 
2519 				usb2_fifo_wakeup(f);
2520 
2521 				if (what == 1) {
2522 					break;
2523 				}
2524 			} else {
2525 				USB_IF_PREPEND(&f->used_q, m);
2526 			}
2527 		} else {
2528 
2529 			if (tr_data) {
2530 				/* wait for data to be written out */
2531 				break;
2532 			}
2533 			if (f->flag_flushing) {
2534 				f->flag_flushing = 0;
2535 				usb2_fifo_wakeup(f);
2536 			}
2537 			break;
2538 		}
2539 		if (len == 0) {
2540 			break;
2541 		}
2542 	}
2543 	return (tr_data);
2544 }
2545 
2546 uint8_t
2547 usb2_fifo_get_data_linear(struct usb2_fifo *f, void *ptr,
2548     uint32_t len, uint32_t *actlen, uint8_t what)
2549 {
2550 	struct usb2_mbuf *m;
2551 	uint32_t io_len;
2552 	uint8_t tr_data = 0;
2553 
2554 	actlen[0] = 0;
2555 
2556 	while (1) {
2557 
2558 		USB_IF_DEQUEUE(&f->used_q, m);
2559 
2560 		if (m) {
2561 
2562 			tr_data = 1;
2563 
2564 			io_len = MIN(len, m->cur_data_len);
2565 
2566 			bcopy(m->cur_data_ptr, ptr, io_len);
2567 
2568 			len -= io_len;
2569 			ptr = USB_ADD_BYTES(ptr, io_len);
2570 			actlen[0] += io_len;
2571 			m->cur_data_ptr += io_len;
2572 			m->cur_data_len -= io_len;
2573 
2574 			if ((m->cur_data_len == 0) || (what == 1)) {
2575 				USB_IF_ENQUEUE(&f->free_q, m);
2576 
2577 				usb2_fifo_wakeup(f);
2578 
2579 				if (what == 1) {
2580 					break;
2581 				}
2582 			} else {
2583 				USB_IF_PREPEND(&f->used_q, m);
2584 			}
2585 		} else {
2586 
2587 			if (tr_data) {
2588 				/* wait for data to be written out */
2589 				break;
2590 			}
2591 			if (f->flag_flushing) {
2592 				f->flag_flushing = 0;
2593 				usb2_fifo_wakeup(f);
2594 			}
2595 			break;
2596 		}
2597 		if (len == 0) {
2598 			break;
2599 		}
2600 	}
2601 	return (tr_data);
2602 }
2603 
2604 uint8_t
2605 usb2_fifo_get_data_buffer(struct usb2_fifo *f, void **pptr, uint32_t *plen)
2606 {
2607 	struct usb2_mbuf *m;
2608 
2609 	USB_IF_POLL(&f->used_q, m);
2610 
2611 	if (m) {
2612 		*plen = m->cur_data_len;
2613 		*pptr = m->cur_data_ptr;
2614 
2615 		return (1);
2616 	}
2617 	return (0);
2618 }
2619 
2620 void
2621 usb2_fifo_get_data_error(struct usb2_fifo *f)
2622 {
2623 	f->flag_iserror = 1;
2624 	usb2_fifo_wakeup(f);
2625 }
2626 
2627 /*------------------------------------------------------------------------*
2628  *	usb2_alloc_symlink
2629  *
2630  * Return values:
2631  * NULL: Failure
2632  * Else: Pointer to symlink entry
2633  *------------------------------------------------------------------------*/
2634 struct usb2_symlink *
2635 usb2_alloc_symlink(const char *target, const char *fmt,...)
2636 {
2637 	struct usb2_symlink *ps;
2638 	va_list ap;
2639 
2640 	ps = malloc(sizeof(*ps), M_USBDEV, M_WAITOK);
2641 	if (ps == NULL) {
2642 		return (ps);
2643 	}
2644 	strlcpy(ps->dst_path, target, sizeof(ps->dst_path));
2645 	ps->dst_len = strlen(ps->dst_path);
2646 
2647 	va_start(ap, fmt);
2648 	vsnrprintf(ps->src_path,
2649 	    sizeof(ps->src_path), 32, fmt, ap);
2650 	va_end(ap);
2651 	ps->src_len = strlen(ps->src_path);
2652 
2653 	sx_xlock(&usb2_sym_lock);
2654 	TAILQ_INSERT_TAIL(&usb2_sym_head, ps, sym_entry);
2655 	sx_unlock(&usb2_sym_lock);
2656 	return (ps);
2657 }
2658 
2659 /*------------------------------------------------------------------------*
2660  *	usb2_free_symlink
2661  *------------------------------------------------------------------------*/
2662 void
2663 usb2_free_symlink(struct usb2_symlink *ps)
2664 {
2665 	if (ps == NULL) {
2666 		return;
2667 	}
2668 	sx_xlock(&usb2_sym_lock);
2669 	TAILQ_REMOVE(&usb2_sym_head, ps, sym_entry);
2670 	sx_unlock(&usb2_sym_lock);
2671 
2672 	free(ps, M_USBDEV);
2673 }
2674 
2675 /*------------------------------------------------------------------------*
2676  *	usb2_lookup_symlink
2677  *
2678  * Return value:
2679  * Numerical device location
2680  *------------------------------------------------------------------------*/
2681 uint32_t
2682 usb2_lookup_symlink(const char *src_ptr, uint8_t src_len)
2683 {
2684 	enum {
2685 		USB_DNAME_LEN = sizeof(USB_DEVICE_NAME) - 1,
2686 	};
2687 	struct usb2_symlink *ps;
2688 	uint32_t temp;
2689 
2690 	sx_xlock(&usb2_sym_lock);
2691 
2692 	TAILQ_FOREACH(ps, &usb2_sym_head, sym_entry) {
2693 
2694 		if (src_len != ps->src_len)
2695 			continue;
2696 
2697 		if (memcmp(ps->src_path, src_ptr, src_len))
2698 			continue;
2699 
2700 		if (USB_DNAME_LEN > ps->dst_len)
2701 			continue;
2702 
2703 		if (memcmp(ps->dst_path, USB_DEVICE_NAME, USB_DNAME_LEN))
2704 			continue;
2705 
2706 		temp = usb2_path_convert(ps->dst_path + USB_DNAME_LEN);
2707 		sx_unlock(&usb2_sym_lock);
2708 
2709 		return (temp);
2710 	}
2711 	sx_unlock(&usb2_sym_lock);
2712 	return (0 - 1);
2713 }
2714 
2715 /*------------------------------------------------------------------------*
2716  *	usb2_read_symlink
2717  *
2718  * Return value:
2719  * 0: Success
2720  * Else: Failure
2721  *------------------------------------------------------------------------*/
2722 int
2723 usb2_read_symlink(uint8_t *user_ptr, uint32_t startentry, uint32_t user_len)
2724 {
2725 	struct usb2_symlink *ps;
2726 	uint32_t temp;
2727 	uint32_t delta = 0;
2728 	uint8_t len;
2729 	int error = 0;
2730 
2731 	sx_xlock(&usb2_sym_lock);
2732 
2733 	TAILQ_FOREACH(ps, &usb2_sym_head, sym_entry) {
2734 
2735 		/*
2736 		 * Compute total length of source and destination symlink
2737 		 * strings pluss one length byte and two NUL bytes:
2738 		 */
2739 		temp = ps->src_len + ps->dst_len + 3;
2740 
2741 		if (temp > 255) {
2742 			/*
2743 			 * Skip entry because this length cannot fit
2744 			 * into one byte:
2745 			 */
2746 			continue;
2747 		}
2748 		if (startentry != 0) {
2749 			/* decrement read offset */
2750 			startentry--;
2751 			continue;
2752 		}
2753 		if (temp > user_len) {
2754 			/* out of buffer space */
2755 			break;
2756 		}
2757 		len = temp;
2758 
2759 		/* copy out total length */
2760 
2761 		error = copyout(&len,
2762 		    USB_ADD_BYTES(user_ptr, delta), 1);
2763 		if (error) {
2764 			break;
2765 		}
2766 		delta += 1;
2767 
2768 		/* copy out source string */
2769 
2770 		error = copyout(ps->src_path,
2771 		    USB_ADD_BYTES(user_ptr, delta), ps->src_len);
2772 		if (error) {
2773 			break;
2774 		}
2775 		len = 0;
2776 		delta += ps->src_len;
2777 		error = copyout(&len,
2778 		    USB_ADD_BYTES(user_ptr, delta), 1);
2779 		if (error) {
2780 			break;
2781 		}
2782 		delta += 1;
2783 
2784 		/* copy out destination string */
2785 
2786 		error = copyout(ps->dst_path,
2787 		    USB_ADD_BYTES(user_ptr, delta), ps->dst_len);
2788 		if (error) {
2789 			break;
2790 		}
2791 		len = 0;
2792 		delta += ps->dst_len;
2793 		error = copyout(&len,
2794 		    USB_ADD_BYTES(user_ptr, delta), 1);
2795 		if (error) {
2796 			break;
2797 		}
2798 		delta += 1;
2799 
2800 		user_len -= temp;
2801 	}
2802 
2803 	/* a zero length entry indicates the end */
2804 
2805 	if ((user_len != 0) && (error == 0)) {
2806 
2807 		len = 0;
2808 
2809 		error = copyout(&len,
2810 		    USB_ADD_BYTES(user_ptr, delta), 1);
2811 	}
2812 	sx_unlock(&usb2_sym_lock);
2813 	return (error);
2814 }
2815