include opt_ntp.h for PPS_SYNC

ucom(4): Simplify logic fixing PR kern/57259.

cv_timedwait only ever returns 0 or EWOULDBLOCK, so this would always
return ERESTART anyway.

No functional change intended.

In the HUP-wait path in ucomopen():
- Use cv_timedwait() rather than cv_timedwait_sig(); the wait here is
bounded (and fairly short besides) and seems appropriate to treat like
other uninterruptible waits. The behavior is now consistent with com(4)
in this regard.
- Map EWOULDBLOCK return from cv_timedwait() to 0, as the successful passage
of time is not an error in this case.
- If the HUP-wait time has passed, clear the HUP-wait timestamp.

kern/57259 (although insufficient -- another change to vfs_syscalls.c
is required)

ucom(4): Missed a spot in previous -- nix now-unused local.

ucom(4): Nix broken error branch.

This error branch was introduced to make the system act, when a USB
serial adapter is yanked, as if the other end had spat out a line
feed in an attempt to wake any sleeping readers so they will stop
using the USB serial port.

This is no longer necessary, because ttycancel will wake them anyway,
and it is actually harmful because it puts stuff in the output queue
(CR LF) that will never be processed, causing subsequent users to
hang trying to open the device.

Problem found and patch tested by tih@.

branches: 1.134.2;
ucom(4): Convert to ttylock/ttyunlock.

ucom(4): Make sure rndsource is attached before use and detach.

Reported-by: syzbot+04fb6786e0cf873905e8@syzkaller.appspotmail.com

ucom(4): Use tty_unit -- save a couple lines of code.

ucom(4): Fix unit numbering for devsw/autoconf cross-wiring.

Should introduce a tty_unit function to use here but this'll do for
now to fix the bug I introduced in ucom(4).

ucom(4): Rework open/close/attach/detach logic.

- Defer sleep after hangup until open.

No need to make close hang; we just need to make sure some time has
passed before we next try to open.

This changes the wchan for the sleep. Oh well.

- Use .d_cfdriver/devtounit/cancel to resolve races between attach,
detach, open, close, and revoke.

- Use a separate .sc_closing flag instead of a UCOM_CLOSING state.
ucomcancel/ucomclose owns this flag, and it may be set in any state
(except UCOM_DEAD). UCOM_OPENING remains owned by ucomopen, which
might be interrupted by cancel/close.

- Rework error branches in ucomopen. Much simpler this way.

- Nix unnecessary reference counting.

ucom(4): Fix earlier mistake causing pipes not to be closed.

In revision 1.123, mrg@ changed what he thought was a double-close,
but was actually abort&close (as is appropriate) to just abort (which
is not enough -- leaks the pipe). This restores the abort&close.

The original `bug' was found by code inspection, whereas this bug was
found by asserting in usb_subr.c that no pipes are open on device
disconnection after detach; the asserts actually triggered with
several ucom(4) devices, and no longer trigger with this change.

XXX pullup-9

branches: 1.128.6;
properly wait for refcounts to drain.
fixes panic at detach that jmnceill saw.

XXX: pullup-[89].

revert the 0x% -> %# change for fixed width formats pointed out by uwe.

PR/55068: sc.dying: Fix printf formats:
- no %s/%p for kernel log
- 0x% -> %#
- always %j for kernel log

branches: 1.125.2;
clean up ucom parents some more:
- it's always "bool sc_dying" now, with true/false
- heavy use of static functions
- remove all ucom parent ca_activate callbacks. they're never called.
- callbacks should generally do little to nothing if sc_dying is set
- open resources should be released in detach after setting sc_dying
- don't complain about usbd_abort_pipe() or usbd_close_pipe() failure
- when releasing resources, zero the softc member as well
- remove ucom_methods members no longer destined to be filled in
- generally, DPRINTF() before sc_dying short circuit
- use EIO when dying, not ENXIO or 0
- add some ucom_open() callbacks that simply return EIO if dying

remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h

fix a locking botch in ucomhwiflow():

tty.c always calls t_hwiflow() with tty_lock held, and the caller
of this for ucom always holds sc->sc_lock when calling down into
the tty layer.

don't try to re-take the sc_lock in ucomhwiflow() (locking against
myself is triggered here currently), but instead assert that the
lock is already held _and_ that tty_lock is held.


in ucom_detach(), when closing pipes set sc_bulkin_pipe and
sc_bulkout_pipe to NULL. fixes bug noticed by code inspection:
a failed detach would attempt to close them a second time.

fix umodem(4) detach:

- ucom(4) needs kpreempt disabled around softint_schedule()
- switch a copied printf() to aprint_error_dev()
- use static normally in umodem_common.c
- remove unused sc_openings in softc, convert sc_dying to real bool
- add sc_refcnt, sc_lock and sc_detach_cv to softc. usage is:
- sc_dying is protected by sc_lock
- sc_detach_cv is matched with sc_lock for cv operations
- sc_refcnt is increased in open and decreased in close, any time
it is decreased, it is checked for less than zero, and a broadcast
performed on sc_detach_cv. detach waits for sc_refcnt.
- umodem_param() and umodem_set() check for sc_dying

this fixes pullout out an open ucom@umodem.

@skrll.

XXX: pullup

restore error reporting in ucomparam() lost in 1.115

branches: 1.120.2; 1.120.4;
PR kern/52931 Kernel panics with Atheros usb wireless interface

Audit the flags to usbd_create_xfer so that USBD_FORCE_SHORT_XFER is
supplied wherever such a transfer is setup. We can drop
USBD_SHORT_XFER_OK as it has not bearing on number of TDs

Update the kernhist(9) kernel history code to address issues identified
in PR kern/52639, as well as some general cleaning-up...

(As proposed on tech-kern@ with additional changes and enhancements.)

Details of changes:

* All history arguments are now stored as uintmax_t values[1], both in
the kernel and in the structures used for exporting the history data
to userland via sysctl(9). This avoids problems on some architectures
where passing a 64-bit (or larger) value to printf(3) can cause it to
process the value as multiple arguments. (This can be particularly
problematic when printf()'s format string is not a literal, since in
that case the compiler cannot know how large each argument should be.)

* Update the data structures used for exporting kernel history data to
include a version number as well as the length of history arguments.

* All [2] existing users of kernhist(9) have had their format strings
updated. Each format specifier now includes an explicit length
modifier 'j' to refer to numeric values of the size of uintmax_t.

* All [2] existing users of kernhist(9) have had their format strings
updated to replace uses of "%p" with "%#jx", and the pointer
arguments are now cast to (uintptr_t) before being subsequently cast
to (uintmax_t). This is needed to avoid compiler warnings about
casting "pointer to integer of a different size."

* All [2] existing users of kernhist(9) have had instances of "%s" or
"%c" format strings replaced with numeric formats; several instances
of mis-match between format string and argument list have been fixed.

* vmstat(1) has been modified to handle the new size of arguments in the
history data as exported by sysctl(9).

* vmstat(1) now provides a warning message if the history requested with
the -u option does not exist (previously, this condition was silently
ignored, with only a single blank line being printed).

* vmstat(1) now checks the version and argument length included in the
data exported via sysctl(9) and exits if they do not match the values
with which vmstat was built.

* The kernhist(9) man-page has been updated to note the additional
requirements imposed on the format strings, along with several other
minor changes and enhancements.

[1] It would have been possible to use an explicit length (for example,
uint64_t) for the history arguments. But that would require another
"rototill" of all the users in the future when we add support for an
architecture that supports a larger size. Also, the printf(3) format
specifiers for explicitly-sized values, such as "%"PRIu64, are much
more verbose (and less aesthetically appealing, IMHO) than simply
using "%ju".

[2] I've tried very hard to find "all [the] existing users of kernhist(9)"
but it is possible that I've missed some of them. I would be glad to
update any stragglers that anyone identifies.

branches: 1.118.6; 1.118.8;
Don't hold softc lock when calling ucom_read

PR/51714: uftdi (on xhci): mutex_vector_enter: locking against myself

Whitespace

Ensure the softc lock is not held in ucom_shutdown as the call to ucom_dtr
can sleep.

Pull across various locking and reference counting fixes from nick-nhusb.

Do not hold the softc lock (IPL_SOFTUSB) unnecessarily and specifically
across ucomparam (and the ucom_param method). The method can sleep wait-
ing for transfers... any input/output will try to acquire the lock and get
stuck

branches: 1.113.2;
All com devices have an issue that they sleep in the final close
when they signal a hangup while still using the device. This allows
a concurrent open to succeed without proper locking because it
only checks the state of the tty layer.

This issue triggers an assertion in ucom due to a reused USB xfer,
but it can also cause misbehaviour in other com devices.

For now in ucom:
- make open block while close is in progress
- also serialize close operations

Fixup ucom_cleanup to not forget our pipe handles.

Simplify ucomreadcb by dealing with the USBD_CANCELLED separately and
not taking sc_lock. We can't hold sc_lock while aborting now.

Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Add the port number to the device properties to make it easier to relate
a specific ucom instance with the physical port of multi-port devices
like the FTDI 4232.

Convert sys/dev to use <sys/rndsource.h>.

branches: 1.108.2;
centralize the dialout/call unit macros.

branches: 1.107.2;
Merge tls-earlyentropy branch into HEAD.

Add PPS support to ucom(4).

This is basically cribbed from regular serial ports, and just adds
hooks to call the pps support routines.

Also, note in the ucom(4) man page that there is about 1 ms of
latency. Discussed on tech-kern in October of 2013, with the only
concern being that someone who didn't know what they were doing might
set up a stratum 1 server, and that somehow might have worse
timekeeping than whatever else that person might have done; the man
page comment is a mitigation for this.

This patch has been live-tested in netbsd-5/i386 and netbsd-6/i386,
and has been running on machines without a USB-serial GPS device for
most of a year with no adverse consequences (very little happens if
the PPS ioctls are not invoked).

Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.

remove hack for PR/42848

branches: 1.103.2;
Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.

branches: 1.102.2;
drop trailing whitespace.

Sometimes the device disappears out from under us and device_lookup_private()
will return NULL. Be paranoid about this to prevent NULL pointer dereferences.

Don't rely on TS_BUSY to determine wether there is a buffer
available. Instead handle a possible buffer shortage.
Also aquire lock when modifying t_state.

branches: 1.99.2;
pull down from usbmp branch:

- rename usb_detach_{wake,waitup}() to usb_detach_{wake,waitup}old()
- use some c99 struct .initialisers

remove any remnants of freebsd/openbsd code.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

Stopgap XXX kludge for PR kern/42848 and PR kern/45013.

Someone should really find and fix the real problem,
but it's better to not crash in the meantime.

Don't notify about zero length reads without UCOM_DEBUG && ucomdebug > 0.
It's typical for uslsa(4) hardware to do this occasionally.

In ucompoll() also bail out if we don't have a valid softc.
Seems to prevent occasional crashes when a open ucom is removed.

Revert previous due to active usbmp branch(es).

Adjust-away inconsistent and trailing whitespace.

It's tp->t_dev, not tp->tp_dev. Corrects commit prior to previous.

const-ify struct ucom_methods pointer within ucom(4).

Make commented-out code in ucomstop() compilable.

branches: 1.88.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.87.4;
Rename ttymalloc() to tty_alloc(), and ttyfree() to tty_free() for
consistency. Remove some unnecessary malloc.h inclusions as well.

branches: 1.86.2;
don't clear TS_BUSY in ucomclose().
This fixes kernel crash in ucomstart() with "echo Hello > /dev/ttyU0".

Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

remove debugging statements that have no chance of working (they crash)
since they are called from a context where we cannot log.

branches: 1.83.2;
printf -> aprint_normal to avoid empty linefeeds and partial messages
for AB_QUIET.

branches: 1.82.2;
Optimize for higher speeds, e.g. when used as part of a 3G modem.
Contributed anonymously.

Simplify device-activation hooks.

typo in comment.

Change major()/minor() to return 32-bit types again, called
devmajor_t/devminor_t, as proposed on tech-kern.
This avoids 64-bit arithmetics and 64-bit printf formats in parts
of the kernel where it is not really useful, and helps clarity.

make this compile

branches: 1.77.6;
Split device_t and softc for all USB device drivers, and related cosmetic
changes.

Matthias Drochner kindly reviewed this patch, and tested ums, ubt, uaudio
and ral. I tested umass myself.

branches: 1.76.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.75.2; 1.75.4;
use aprint_*_dev and device_xname

branches: 1.74.6;
Add pmf register/deregister to ucom and ugensa. (Addtionally, let a
Sierra wireless card be recognized as a ugensa.)

branches: 1.73.6;
- Factor out too many copies of the same bit of tty code.
- Fix another tty signalling/wakeup problem.

Call ttwakeup() with tty_lock held.

Call ttyflush() with tty_lock held.

branches: 1.70.14; 1.70.16; 1.70.20; 1.70.22;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.69.4; 1.69.10;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

More from Matt Fleming:

Adapt to KAUTH_DEVICE_TTY_PRIVSET and KAUTH_DEVICE_TTY_OPEN.

Adapt MD code to KAUTH_DEVICE_TTY_OPEN, batch #2 from Matt Fleming, thanks!

Also, add forgotten splx() calls in some places.

branches: 1.65.4; 1.65.6;
- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

Assert RTS on open. Fixes PR kern/33929.

branches: 1.63.4;
integrate kauth.

Use device_unit().

branches: 1.61.2; 1.61.4; 1.61.6;
Use device_is_active() rather than testing dv_flags for DVF_ACTIVE
directly.

branches: 1.60.2; 1.60.4; 1.60.6;
merge ktrace-lwp.

Remove duplicated "portno %d" from the attach message.

Change the driver open function's conditional for overriding exclusive tty
use from checking the proc's uid to suser(9), and account for the use of
privileges. Noted by David Holland in PR kern/31126.

s/locdesc_t/int/g

branches: 1.56.2;
PR-30566: Poll must not return <sys/errno.h> values.
Start with those places I can easily test.

- const poisoning
- eliminate variable shadowing

Handle DCD differently so it's not always asserted. From kern/30268 from
Wolfgang Stukenbrock.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

Make the DPRINTF text for bulk in/out opening errors match which one
is in and which one is out.

branches: 1.51.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Use aprint_normal() in cfprint routines.

Avoid strict-alias warnings.

merge kqueue branch into -current

kqueue provides a stateful and efficient event notification framework
currently supported events include socket, file, directory, fifo,
pipe, tty and device changes, and monitoring of processes and signals

kqueue is supported by all writable filesystems in NetBSD tree
(with exception of Coda) and all device drivers supporting poll(2)

based on work done by Jonathan Lemon for FreeBSD
initial NetBSD port done by Luke Mewburn and Jason Thorpe

Introduce a new routine, config_match(), which invokes the
cfattach->ca_match function in behalf of the caller. Use it
rather than invoking cfattach->ca_match directly.

Remove breaks after returns, unreachable returns and returns after
returns(!).

Merge the gehenna-devsw branch into the trunk.

This merge changes the device switch tables from static array to
dynamically generated by config(8).

- All device switches is defined as a constant structure in device drivers.

- The new grammer ``device-major'' is introduced to ``files''.

device-major <prefix> char <num> [block <num>] [<rules>]

- All device major numbers must be listed up in port dependent majors.<arch>
by using this grammer.

- Added the new naming convention.
The name of the device switch must be <prefix>_[bc]devsw for auto-generation
of device switch tables.

- The backward compatibility of loading block/character device
switch by LKM framework is broken. This is necessary to convert
from block/character device major to device name in runtime and vice versa.

- The restriction to assign device major by LKM is completely removed.
We don't need to reserve LKM entries for dynamic loading of device switch.

- In compile time, device major numbers list is packed into the kernel and
the LKM framework will refer it to assign device major number dynamically.

Get rid of trailing white space.

branches: 1.42.4;
Convert ioctl code to use EPASSTHROUGH instead of -1 or ENOTTY for
indicating an unhandled "command". ERESTART is -1, which can lead to
confusion. ERESTART has been moved to -3 and EPASSTHROUGH has been
placed at -4. No ioctl code should now return -1 anywhere. The
ioctl() system call is now properly restartable.

Make a typedef for struct proc to make portingeasier.

add RCSIDs

branches: 1.39.2;
Clear busy flag on write error. From PR 13731, IWAMOTO Toshihiro.

branches: 1.38.2;
Add `l_poll' to `struct linesw' and provide an xxxpoll() entry point
in each tty driver to indirect through it.

This allows tty line-disciplines to handle poll(2) system calls.

Print portno when attaching.

branches: 1.36.2;
Fiddle enough with the tty so that it wakes up on detach and drops
the reference count on the ucom.

Ad support for an extra message in the ucom attach code.

Null out pointers when closing pipes.
Try to wake upper layer on error.

Rearrange detach code so it is more likely to survive detaching an open
device (it's still not waking up readers properly).

Adapt to the new line discipline scheme.

make ucom into a random source, type TTY

Remove some // type comments.

Change the second argument of tiocm_to_ucom to u_long,
since the second argument of ioctl is a u_long value.

Cleanup the error handling code introduced in rev. 1.26. Commented by jhawk.
No functional change.

Make the control line handling a little better. Avoid a DTR/RTS issue
from uninitialized sc_mcr by not calling ucom_{dtr,rts} if possible.

XXX Flow control is still incomplete and needs more work.

In ucomopen(), make sure to call splx() before returning
when initialization fails.

Handle output packet headers in a cleaner way. From IWAMOTO Toshihiro
<iwamoto@sat.t.u-tokyo.ac.jp>, fixes kern/10573.

branches: 1.24.2;
Bring the coding style into the 80s, i.e., get rid of __P and use
ANSI prototypes and declarations.

branches: 1.23.2;
Change my email address.

Add a capability for pre/post processing on write/read.

fix build of ucom. (static/non-static)

Remove a couple of Static that shouldn't be there.

Let the parent device of a ucom decide what size the read and write
buffers should be since it knows about the speed.
Increase the buffer size of uvisor.
XXX The uvisor is still pitifully slow. There must be a problem somewhere.

Make it compile without USB_DEBUG. From Chris Jones.

Use reference counting on the softc so detach doesn't blow it away prematurely.

Change (almost) all static to Static. The symbol `Static' can then be defined
to `' or `static' depending on if you want to debug or not.

Use NULL instead of 0.

Add methods for ucom to call back on open/close.

Make it compile even if you leave out the ucom attachment.

Split the umodem driver into two parts: the part that emulates a tty over
two bulk pipes, and the setup and status fiddling goo.
This allows the former part to be shared by other drivers that need to
look like a tty.

A number of stylistic changes to increase readability (many suggested
by Nick Hibma):
use NULL not 0
declare all local definitions static
rename s/usbd_request/usbd_xfer/ s/reqh/xfer/
rename s/r/err/
use implicit test for no err
KNF

branches: 1.10.2; 1.10.4; 1.10.8;
Change the internal API to allow DMA buffers to be pre-allocated by
the device driver instead of happening automagically in the HC driver.
This affects both the HC-USBD interface as well as the USBD-device
interface.
This change will allow DMA buffers to be reused e.g. in isochronous
traffic.

Add isochronous support to the UHCI driver (not for OHCI yet).

Some changes from FreeBSD (no functional differences).

Totally redo the way device detach is done. It now uses a kernel event
thread and the config detach method.
Squish a number of space leaks on detach.

branches: 1.7.4;
Some minor updates from FreeBSD.

Various little fixes from the FreeBSD version.

Fix some FreeBSD compiler warnings.

Remove #include that slipped in at FreeBSD merge.

Merge changes to make the USB stack work with FreeBSD. The original
diffs from Nick Hibma <n_hibma@freebsd.org>, but with substantial
changes from me.
XXX Not tested on FreeBSD yet.

Improvement to the ugen driver.
Better error checking.
Some code rearrengment.

Add stub for a modem driver.

ucom(4): Simplify logic fixing PR kern/57259.

cv_timedwait only ever returns 0 or EWOULDBLOCK, so this would always
return ERESTART anyway.

No functional change intended.

In the HUP-wait path in ucomopen():
- Use cv_timedwait() rather than cv_timedwait_sig(); the wait here is
bounded (and fairly short besides) and seems appropriate to treat like
other uninterruptible waits. The behavior is now consistent with com(4)
in this regard.
- Map EWOULDBLOCK return from cv_timedwait() to 0, as the successful passage
of time is not an error in this case.
- If the HUP-wait time has passed, clear the HUP-wait timestamp.

kern/57259 (although insufficient -- another change to vfs_syscalls.c
is required)

ucom(4): Missed a spot in previous -- nix now-unused local.

ucom(4): Nix broken error branch.

This error branch was introduced to make the system act, when a USB
serial adapter is yanked, as if the other end had spat out a line
feed in an attempt to wake any sleeping readers so they will stop
using the USB serial port.

This is no longer necessary, because ttycancel will wake them anyway,
and it is actually harmful because it puts stuff in the output queue
(CR LF) that will never be processed, causing subsequent users to
hang trying to open the device.

Problem found and patch tested by tih@.

branches: 1.134.2;
ucom(4): Convert to ttylock/ttyunlock.

ucom(4): Make sure rndsource is attached before use and detach.

Reported-by: syzbot+04fb6786e0cf873905e8@syzkaller.appspotmail.com

ucom(4): Use tty_unit -- save a couple lines of code.

ucom(4): Fix unit numbering for devsw/autoconf cross-wiring.

Should introduce a tty_unit function to use here but this'll do for
now to fix the bug I introduced in ucom(4).

ucom(4): Rework open/close/attach/detach logic.

- Defer sleep after hangup until open.

No need to make close hang; we just need to make sure some time has
passed before we next try to open.

This changes the wchan for the sleep. Oh well.

- Use .d_cfdriver/devtounit/cancel to resolve races between attach,
detach, open, close, and revoke.

- Use a separate .sc_closing flag instead of a UCOM_CLOSING state.
ucomcancel/ucomclose owns this flag, and it may be set in any state
(except UCOM_DEAD). UCOM_OPENING remains owned by ucomopen, which
might be interrupted by cancel/close.

- Rework error branches in ucomopen. Much simpler this way.

- Nix unnecessary reference counting.

ucom(4): Fix earlier mistake causing pipes not to be closed.

In revision 1.123, mrg@ changed what he thought was a double-close,
but was actually abort&close (as is appropriate) to just abort (which
is not enough -- leaks the pipe). This restores the abort&close.

The original `bug' was found by code inspection, whereas this bug was
found by asserting in usb_subr.c that no pipes are open on device
disconnection after detach; the asserts actually triggered with
several ucom(4) devices, and no longer trigger with this change.

XXX pullup-9

branches: 1.128.6;
properly wait for refcounts to drain.
fixes panic at detach that jmnceill saw.

XXX: pullup-[89].

revert the 0x% -> %# change for fixed width formats pointed out by uwe.

PR/55068: sc.dying: Fix printf formats:
- no %s/%p for kernel log
- 0x% -> %#
- always %j for kernel log

branches: 1.125.2;
clean up ucom parents some more:
- it's always "bool sc_dying" now, with true/false
- heavy use of static functions
- remove all ucom parent ca_activate callbacks. they're never called.
- callbacks should generally do little to nothing if sc_dying is set
- open resources should be released in detach after setting sc_dying
- don't complain about usbd_abort_pipe() or usbd_close_pipe() failure
- when releasing resources, zero the softc member as well
- remove ucom_methods members no longer destined to be filled in
- generally, DPRINTF() before sc_dying short circuit
- use EIO when dying, not ENXIO or 0
- add some ucom_open() callbacks that simply return EIO if dying

remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h

fix a locking botch in ucomhwiflow():

tty.c always calls t_hwiflow() with tty_lock held, and the caller
of this for ucom always holds sc->sc_lock when calling down into
the tty layer.

don't try to re-take the sc_lock in ucomhwiflow() (locking against
myself is triggered here currently), but instead assert that the
lock is already held _and_ that tty_lock is held.


in ucom_detach(), when closing pipes set sc_bulkin_pipe and
sc_bulkout_pipe to NULL. fixes bug noticed by code inspection:
a failed detach would attempt to close them a second time.

fix umodem(4) detach:

- ucom(4) needs kpreempt disabled around softint_schedule()
- switch a copied printf() to aprint_error_dev()
- use static normally in umodem_common.c
- remove unused sc_openings in softc, convert sc_dying to real bool
- add sc_refcnt, sc_lock and sc_detach_cv to softc. usage is:
- sc_dying is protected by sc_lock
- sc_detach_cv is matched with sc_lock for cv operations
- sc_refcnt is increased in open and decreased in close, any time
it is decreased, it is checked for less than zero, and a broadcast
performed on sc_detach_cv. detach waits for sc_refcnt.
- umodem_param() and umodem_set() check for sc_dying

this fixes pullout out an open ucom@umodem.

@skrll.

XXX: pullup

restore error reporting in ucomparam() lost in 1.115

branches: 1.120.2; 1.120.4;
PR kern/52931 Kernel panics with Atheros usb wireless interface

Audit the flags to usbd_create_xfer so that USBD_FORCE_SHORT_XFER is
supplied wherever such a transfer is setup. We can drop
USBD_SHORT_XFER_OK as it has not bearing on number of TDs

Update the kernhist(9) kernel history code to address issues identified
in PR kern/52639, as well as some general cleaning-up...

(As proposed on tech-kern@ with additional changes and enhancements.)

Details of changes:

* All history arguments are now stored as uintmax_t values[1], both in
the kernel and in the structures used for exporting the history data
to userland via sysctl(9). This avoids problems on some architectures
where passing a 64-bit (or larger) value to printf(3) can cause it to
process the value as multiple arguments. (This can be particularly
problematic when printf()'s format string is not a literal, since in
that case the compiler cannot know how large each argument should be.)

* Update the data structures used for exporting kernel history data to
include a version number as well as the length of history arguments.

* All [2] existing users of kernhist(9) have had their format strings
updated. Each format specifier now includes an explicit length
modifier 'j' to refer to numeric values of the size of uintmax_t.

* All [2] existing users of kernhist(9) have had their format strings
updated to replace uses of "%p" with "%#jx", and the pointer
arguments are now cast to (uintptr_t) before being subsequently cast
to (uintmax_t). This is needed to avoid compiler warnings about
casting "pointer to integer of a different size."

* All [2] existing users of kernhist(9) have had instances of "%s" or
"%c" format strings replaced with numeric formats; several instances
of mis-match between format string and argument list have been fixed.

* vmstat(1) has been modified to handle the new size of arguments in the
history data as exported by sysctl(9).

* vmstat(1) now provides a warning message if the history requested with
the -u option does not exist (previously, this condition was silently
ignored, with only a single blank line being printed).

* vmstat(1) now checks the version and argument length included in the
data exported via sysctl(9) and exits if they do not match the values
with which vmstat was built.

* The kernhist(9) man-page has been updated to note the additional
requirements imposed on the format strings, along with several other
minor changes and enhancements.

[1] It would have been possible to use an explicit length (for example,
uint64_t) for the history arguments. But that would require another
"rototill" of all the users in the future when we add support for an
architecture that supports a larger size. Also, the printf(3) format
specifiers for explicitly-sized values, such as "%"PRIu64, are much
more verbose (and less aesthetically appealing, IMHO) than simply
using "%ju".

[2] I've tried very hard to find "all [the] existing users of kernhist(9)"
but it is possible that I've missed some of them. I would be glad to
update any stragglers that anyone identifies.

branches: 1.118.6; 1.118.8;
Don't hold softc lock when calling ucom_read

PR/51714: uftdi (on xhci): mutex_vector_enter: locking against myself

Whitespace

Ensure the softc lock is not held in ucom_shutdown as the call to ucom_dtr
can sleep.

Pull across various locking and reference counting fixes from nick-nhusb.

Do not hold the softc lock (IPL_SOFTUSB) unnecessarily and specifically
across ucomparam (and the ucom_param method). The method can sleep wait-
ing for transfers... any input/output will try to acquire the lock and get
stuck

branches: 1.113.2;
All com devices have an issue that they sleep in the final close
when they signal a hangup while still using the device. This allows
a concurrent open to succeed without proper locking because it
only checks the state of the tty layer.

This issue triggers an assertion in ucom due to a reused USB xfer,
but it can also cause misbehaviour in other com devices.

For now in ucom:
- make open block while close is in progress
- also serialize close operations

Fixup ucom_cleanup to not forget our pipe handles.

Simplify ucomreadcb by dealing with the USBD_CANCELLED separately and
not taking sc_lock. We can't hold sc_lock while aborting now.

Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Add the port number to the device properties to make it easier to relate
a specific ucom instance with the physical port of multi-port devices
like the FTDI 4232.

Convert sys/dev to use <sys/rndsource.h>.

branches: 1.108.2;
centralize the dialout/call unit macros.

branches: 1.107.2;
Merge tls-earlyentropy branch into HEAD.

Add PPS support to ucom(4).

This is basically cribbed from regular serial ports, and just adds
hooks to call the pps support routines.

Also, note in the ucom(4) man page that there is about 1 ms of
latency. Discussed on tech-kern in October of 2013, with the only
concern being that someone who didn't know what they were doing might
set up a stratum 1 server, and that somehow might have worse
timekeeping than whatever else that person might have done; the man
page comment is a mitigation for this.

This patch has been live-tested in netbsd-5/i386 and netbsd-6/i386,
and has been running on machines without a USB-serial GPS device for
most of a year with no adverse consequences (very little happens if
the PPS ioctls are not invoked).

Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.

remove hack for PR/42848

branches: 1.103.2;
Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.

branches: 1.102.2;
drop trailing whitespace.

Sometimes the device disappears out from under us and device_lookup_private()
will return NULL. Be paranoid about this to prevent NULL pointer dereferences.

Don't rely on TS_BUSY to determine wether there is a buffer
available. Instead handle a possible buffer shortage.
Also aquire lock when modifying t_state.

branches: 1.99.2;
pull down from usbmp branch:

- rename usb_detach_{wake,waitup}() to usb_detach_{wake,waitup}old()
- use some c99 struct .initialisers

remove any remnants of freebsd/openbsd code.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

Stopgap XXX kludge for PR kern/42848 and PR kern/45013.

Someone should really find and fix the real problem,
but it's better to not crash in the meantime.

Don't notify about zero length reads without UCOM_DEBUG && ucomdebug > 0.
It's typical for uslsa(4) hardware to do this occasionally.

In ucompoll() also bail out if we don't have a valid softc.
Seems to prevent occasional crashes when a open ucom is removed.

Revert previous due to active usbmp branch(es).

Adjust-away inconsistent and trailing whitespace.

It's tp->t_dev, not tp->tp_dev. Corrects commit prior to previous.

const-ify struct ucom_methods pointer within ucom(4).

Make commented-out code in ucomstop() compilable.

branches: 1.88.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.87.4;
Rename ttymalloc() to tty_alloc(), and ttyfree() to tty_free() for
consistency. Remove some unnecessary malloc.h inclusions as well.

branches: 1.86.2;
don't clear TS_BUSY in ucomclose().
This fixes kernel crash in ucomstart() with "echo Hello > /dev/ttyU0".

Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

remove debugging statements that have no chance of working (they crash)
since they are called from a context where we cannot log.

branches: 1.83.2;
printf -> aprint_normal to avoid empty linefeeds and partial messages
for AB_QUIET.

branches: 1.82.2;
Optimize for higher speeds, e.g. when used as part of a 3G modem.
Contributed anonymously.

Simplify device-activation hooks.

typo in comment.

Change major()/minor() to return 32-bit types again, called
devmajor_t/devminor_t, as proposed on tech-kern.
This avoids 64-bit arithmetics and 64-bit printf formats in parts
of the kernel where it is not really useful, and helps clarity.

make this compile

branches: 1.77.6;
Split device_t and softc for all USB device drivers, and related cosmetic
changes.

Matthias Drochner kindly reviewed this patch, and tested ums, ubt, uaudio
and ral. I tested umass myself.

branches: 1.76.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.75.2; 1.75.4;
use aprint_*_dev and device_xname

branches: 1.74.6;
Add pmf register/deregister to ucom and ugensa. (Addtionally, let a
Sierra wireless card be recognized as a ugensa.)

branches: 1.73.6;
- Factor out too many copies of the same bit of tty code.
- Fix another tty signalling/wakeup problem.

Call ttwakeup() with tty_lock held.

Call ttyflush() with tty_lock held.

branches: 1.70.14; 1.70.16; 1.70.20; 1.70.22;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.69.4; 1.69.10;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

More from Matt Fleming:

Adapt to KAUTH_DEVICE_TTY_PRIVSET and KAUTH_DEVICE_TTY_OPEN.

Adapt MD code to KAUTH_DEVICE_TTY_OPEN, batch #2 from Matt Fleming, thanks!

Also, add forgotten splx() calls in some places.

branches: 1.65.4; 1.65.6;
- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

Assert RTS on open. Fixes PR kern/33929.

branches: 1.63.4;
integrate kauth.

Use device_unit().

branches: 1.61.2; 1.61.4; 1.61.6;
Use device_is_active() rather than testing dv_flags for DVF_ACTIVE
directly.

branches: 1.60.2; 1.60.4; 1.60.6;
merge ktrace-lwp.

Remove duplicated "portno %d" from the attach message.

Change the driver open function's conditional for overriding exclusive tty
use from checking the proc's uid to suser(9), and account for the use of
privileges. Noted by David Holland in PR kern/31126.

s/locdesc_t/int/g

branches: 1.56.2;
PR-30566: Poll must not return <sys/errno.h> values.
Start with those places I can easily test.

- const poisoning
- eliminate variable shadowing

Handle DCD differently so it's not always asserted. From kern/30268 from
Wolfgang Stukenbrock.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

Make the DPRINTF text for bulk in/out opening errors match which one
is in and which one is out.

branches: 1.51.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Use aprint_normal() in cfprint routines.

Avoid strict-alias warnings.

merge kqueue branch into -current

kqueue provides a stateful and efficient event notification framework
currently supported events include socket, file, directory, fifo,
pipe, tty and device changes, and monitoring of processes and signals

kqueue is supported by all writable filesystems in NetBSD tree
(with exception of Coda) and all device drivers supporting poll(2)

based on work done by Jonathan Lemon for FreeBSD
initial NetBSD port done by Luke Mewburn and Jason Thorpe

Introduce a new routine, config_match(), which invokes the
cfattach->ca_match function in behalf of the caller. Use it
rather than invoking cfattach->ca_match directly.

Remove breaks after returns, unreachable returns and returns after
returns(!).

Merge the gehenna-devsw branch into the trunk.

This merge changes the device switch tables from static array to
dynamically generated by config(8).

- All device switches is defined as a constant structure in device drivers.

- The new grammer ``device-major'' is introduced to ``files''.

device-major <prefix> char <num> [block <num>] [<rules>]

- All device major numbers must be listed up in port dependent majors.<arch>
by using this grammer.

- Added the new naming convention.
The name of the device switch must be <prefix>_[bc]devsw for auto-generation
of device switch tables.

- The backward compatibility of loading block/character device
switch by LKM framework is broken. This is necessary to convert
from block/character device major to device name in runtime and vice versa.

- The restriction to assign device major by LKM is completely removed.
We don't need to reserve LKM entries for dynamic loading of device switch.

- In compile time, device major numbers list is packed into the kernel and
the LKM framework will refer it to assign device major number dynamically.

Get rid of trailing white space.

branches: 1.42.4;
Convert ioctl code to use EPASSTHROUGH instead of -1 or ENOTTY for
indicating an unhandled "command". ERESTART is -1, which can lead to
confusion. ERESTART has been moved to -3 and EPASSTHROUGH has been
placed at -4. No ioctl code should now return -1 anywhere. The
ioctl() system call is now properly restartable.

Make a typedef for struct proc to make portingeasier.

add RCSIDs

branches: 1.39.2;
Clear busy flag on write error. From PR 13731, IWAMOTO Toshihiro.

branches: 1.38.2;
Add `l_poll' to `struct linesw' and provide an xxxpoll() entry point
in each tty driver to indirect through it.

This allows tty line-disciplines to handle poll(2) system calls.

Print portno when attaching.

branches: 1.36.2;
Fiddle enough with the tty so that it wakes up on detach and drops
the reference count on the ucom.

Ad support for an extra message in the ucom attach code.

Null out pointers when closing pipes.
Try to wake upper layer on error.

Rearrange detach code so it is more likely to survive detaching an open
device (it's still not waking up readers properly).

Adapt to the new line discipline scheme.

make ucom into a random source, type TTY

Remove some // type comments.

Change the second argument of tiocm_to_ucom to u_long,
since the second argument of ioctl is a u_long value.

Cleanup the error handling code introduced in rev. 1.26. Commented by jhawk.
No functional change.

Make the control line handling a little better. Avoid a DTR/RTS issue
from uninitialized sc_mcr by not calling ucom_{dtr,rts} if possible.

XXX Flow control is still incomplete and needs more work.

In ucomopen(), make sure to call splx() before returning
when initialization fails.

Handle output packet headers in a cleaner way. From IWAMOTO Toshihiro
<iwamoto@sat.t.u-tokyo.ac.jp>, fixes kern/10573.

branches: 1.24.2;
Bring the coding style into the 80s, i.e., get rid of __P and use
ANSI prototypes and declarations.

branches: 1.23.2;
Change my email address.

Add a capability for pre/post processing on write/read.

fix build of ucom. (static/non-static)

Remove a couple of Static that shouldn't be there.

Let the parent device of a ucom decide what size the read and write
buffers should be since it knows about the speed.
Increase the buffer size of uvisor.
XXX The uvisor is still pitifully slow. There must be a problem somewhere.

Make it compile without USB_DEBUG. From Chris Jones.

Use reference counting on the softc so detach doesn't blow it away prematurely.

Change (almost) all static to Static. The symbol `Static' can then be defined
to `' or `static' depending on if you want to debug or not.

Use NULL instead of 0.

Add methods for ucom to call back on open/close.

Make it compile even if you leave out the ucom attachment.

Split the umodem driver into two parts: the part that emulates a tty over
two bulk pipes, and the setup and status fiddling goo.
This allows the former part to be shared by other drivers that need to
look like a tty.

A number of stylistic changes to increase readability (many suggested
by Nick Hibma):
use NULL not 0
declare all local definitions static
rename s/usbd_request/usbd_xfer/ s/reqh/xfer/
rename s/r/err/
use implicit test for no err
KNF

branches: 1.10.2; 1.10.4; 1.10.8;
Change the internal API to allow DMA buffers to be pre-allocated by
the device driver instead of happening automagically in the HC driver.
This affects both the HC-USBD interface as well as the USBD-device
interface.
This change will allow DMA buffers to be reused e.g. in isochronous
traffic.

Add isochronous support to the UHCI driver (not for OHCI yet).

Some changes from FreeBSD (no functional differences).

Totally redo the way device detach is done. It now uses a kernel event
thread and the config detach method.
Squish a number of space leaks on detach.

branches: 1.7.4;
Some minor updates from FreeBSD.

Various little fixes from the FreeBSD version.

Fix some FreeBSD compiler warnings.

Remove #include that slipped in at FreeBSD merge.

Merge changes to make the USB stack work with FreeBSD. The original
diffs from Nick Hibma <n_hibma@freebsd.org>, but with substantial
changes from me.
XXX Not tested on FreeBSD yet.

Improvement to the ugen driver.
Better error checking.
Some code rearrengment.

Add stub for a modem driver.

ucom(4): Missed a spot in previous -- nix now-unused local.

ucom(4): Nix broken error branch.

This error branch was introduced to make the system act, when a USB
serial adapter is yanked, as if the other end had spat out a line
feed in an attempt to wake any sleeping readers so they will stop
using the USB serial port.

This is no longer necessary, because ttycancel will wake them anyway,
and it is actually harmful because it puts stuff in the output queue
(CR LF) that will never be processed, causing subsequent users to
hang trying to open the device.

Problem found and patch tested by tih@.

ucom(4): Convert to ttylock/ttyunlock.

ucom(4): Make sure rndsource is attached before use and detach.

Reported-by: syzbot+04fb6786e0cf873905e8@syzkaller.appspotmail.com

ucom(4): Use tty_unit -- save a couple lines of code.

ucom(4): Fix unit numbering for devsw/autoconf cross-wiring.

Should introduce a tty_unit function to use here but this'll do for
now to fix the bug I introduced in ucom(4).

ucom(4): Rework open/close/attach/detach logic.

- Defer sleep after hangup until open.

No need to make close hang; we just need to make sure some time has
passed before we next try to open.

This changes the wchan for the sleep. Oh well.

- Use .d_cfdriver/devtounit/cancel to resolve races between attach,
detach, open, close, and revoke.

- Use a separate .sc_closing flag instead of a UCOM_CLOSING state.
ucomcancel/ucomclose owns this flag, and it may be set in any state
(except UCOM_DEAD). UCOM_OPENING remains owned by ucomopen, which
might be interrupted by cancel/close.

- Rework error branches in ucomopen. Much simpler this way.

- Nix unnecessary reference counting.

ucom(4): Fix earlier mistake causing pipes not to be closed.

In revision 1.123, mrg@ changed what he thought was a double-close,
but was actually abort&close (as is appropriate) to just abort (which
is not enough -- leaks the pipe). This restores the abort&close.

The original `bug' was found by code inspection, whereas this bug was
found by asserting in usb_subr.c that no pipes are open on device
disconnection after detach; the asserts actually triggered with
several ucom(4) devices, and no longer trigger with this change.

XXX pullup-9

branches: 1.128.6;
properly wait for refcounts to drain.
fixes panic at detach that jmnceill saw.

XXX: pullup-[89].

revert the 0x% -> %# change for fixed width formats pointed out by uwe.

PR/55068: sc.dying: Fix printf formats:
- no %s/%p for kernel log
- 0x% -> %#
- always %j for kernel log

branches: 1.125.2;
clean up ucom parents some more:
- it's always "bool sc_dying" now, with true/false
- heavy use of static functions
- remove all ucom parent ca_activate callbacks. they're never called.
- callbacks should generally do little to nothing if sc_dying is set
- open resources should be released in detach after setting sc_dying
- don't complain about usbd_abort_pipe() or usbd_close_pipe() failure
- when releasing resources, zero the softc member as well
- remove ucom_methods members no longer destined to be filled in
- generally, DPRINTF() before sc_dying short circuit
- use EIO when dying, not ENXIO or 0
- add some ucom_open() callbacks that simply return EIO if dying

remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h

fix a locking botch in ucomhwiflow():

tty.c always calls t_hwiflow() with tty_lock held, and the caller
of this for ucom always holds sc->sc_lock when calling down into
the tty layer.

don't try to re-take the sc_lock in ucomhwiflow() (locking against
myself is triggered here currently), but instead assert that the
lock is already held _and_ that tty_lock is held.


in ucom_detach(), when closing pipes set sc_bulkin_pipe and
sc_bulkout_pipe to NULL. fixes bug noticed by code inspection:
a failed detach would attempt to close them a second time.

fix umodem(4) detach:

- ucom(4) needs kpreempt disabled around softint_schedule()
- switch a copied printf() to aprint_error_dev()
- use static normally in umodem_common.c
- remove unused sc_openings in softc, convert sc_dying to real bool
- add sc_refcnt, sc_lock and sc_detach_cv to softc. usage is:
- sc_dying is protected by sc_lock
- sc_detach_cv is matched with sc_lock for cv operations
- sc_refcnt is increased in open and decreased in close, any time
it is decreased, it is checked for less than zero, and a broadcast
performed on sc_detach_cv. detach waits for sc_refcnt.
- umodem_param() and umodem_set() check for sc_dying

this fixes pullout out an open ucom@umodem.

@skrll.

XXX: pullup

restore error reporting in ucomparam() lost in 1.115

branches: 1.120.2; 1.120.4;
PR kern/52931 Kernel panics with Atheros usb wireless interface

Audit the flags to usbd_create_xfer so that USBD_FORCE_SHORT_XFER is
supplied wherever such a transfer is setup. We can drop
USBD_SHORT_XFER_OK as it has not bearing on number of TDs

Update the kernhist(9) kernel history code to address issues identified
in PR kern/52639, as well as some general cleaning-up...

(As proposed on tech-kern@ with additional changes and enhancements.)

Details of changes:

* All history arguments are now stored as uintmax_t values[1], both in
the kernel and in the structures used for exporting the history data
to userland via sysctl(9). This avoids problems on some architectures
where passing a 64-bit (or larger) value to printf(3) can cause it to
process the value as multiple arguments. (This can be particularly
problematic when printf()'s format string is not a literal, since in
that case the compiler cannot know how large each argument should be.)

* Update the data structures used for exporting kernel history data to
include a version number as well as the length of history arguments.

* All [2] existing users of kernhist(9) have had their format strings
updated. Each format specifier now includes an explicit length
modifier 'j' to refer to numeric values of the size of uintmax_t.

* All [2] existing users of kernhist(9) have had their format strings
updated to replace uses of "%p" with "%#jx", and the pointer
arguments are now cast to (uintptr_t) before being subsequently cast
to (uintmax_t). This is needed to avoid compiler warnings about
casting "pointer to integer of a different size."

* All [2] existing users of kernhist(9) have had instances of "%s" or
"%c" format strings replaced with numeric formats; several instances
of mis-match between format string and argument list have been fixed.

* vmstat(1) has been modified to handle the new size of arguments in the
history data as exported by sysctl(9).

* vmstat(1) now provides a warning message if the history requested with
the -u option does not exist (previously, this condition was silently
ignored, with only a single blank line being printed).

* vmstat(1) now checks the version and argument length included in the
data exported via sysctl(9) and exits if they do not match the values
with which vmstat was built.

* The kernhist(9) man-page has been updated to note the additional
requirements imposed on the format strings, along with several other
minor changes and enhancements.

[1] It would have been possible to use an explicit length (for example,
uint64_t) for the history arguments. But that would require another
"rototill" of all the users in the future when we add support for an
architecture that supports a larger size. Also, the printf(3) format
specifiers for explicitly-sized values, such as "%"PRIu64, are much
more verbose (and less aesthetically appealing, IMHO) than simply
using "%ju".

[2] I've tried very hard to find "all [the] existing users of kernhist(9)"
but it is possible that I've missed some of them. I would be glad to
update any stragglers that anyone identifies.

branches: 1.118.6; 1.118.8;
Don't hold softc lock when calling ucom_read

PR/51714: uftdi (on xhci): mutex_vector_enter: locking against myself

Whitespace

Ensure the softc lock is not held in ucom_shutdown as the call to ucom_dtr
can sleep.

Pull across various locking and reference counting fixes from nick-nhusb.

Do not hold the softc lock (IPL_SOFTUSB) unnecessarily and specifically
across ucomparam (and the ucom_param method). The method can sleep wait-
ing for transfers... any input/output will try to acquire the lock and get
stuck

branches: 1.113.2;
All com devices have an issue that they sleep in the final close
when they signal a hangup while still using the device. This allows
a concurrent open to succeed without proper locking because it
only checks the state of the tty layer.

This issue triggers an assertion in ucom due to a reused USB xfer,
but it can also cause misbehaviour in other com devices.

For now in ucom:
- make open block while close is in progress
- also serialize close operations

Fixup ucom_cleanup to not forget our pipe handles.

Simplify ucomreadcb by dealing with the USBD_CANCELLED separately and
not taking sc_lock. We can't hold sc_lock while aborting now.

Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Add the port number to the device properties to make it easier to relate
a specific ucom instance with the physical port of multi-port devices
like the FTDI 4232.

Convert sys/dev to use <sys/rndsource.h>.

branches: 1.108.2;
centralize the dialout/call unit macros.

branches: 1.107.2;
Merge tls-earlyentropy branch into HEAD.

Add PPS support to ucom(4).

This is basically cribbed from regular serial ports, and just adds
hooks to call the pps support routines.

Also, note in the ucom(4) man page that there is about 1 ms of
latency. Discussed on tech-kern in October of 2013, with the only
concern being that someone who didn't know what they were doing might
set up a stratum 1 server, and that somehow might have worse
timekeeping than whatever else that person might have done; the man
page comment is a mitigation for this.

This patch has been live-tested in netbsd-5/i386 and netbsd-6/i386,
and has been running on machines without a USB-serial GPS device for
most of a year with no adverse consequences (very little happens if
the PPS ioctls are not invoked).

Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.

remove hack for PR/42848

branches: 1.103.2;
Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.

branches: 1.102.2;
drop trailing whitespace.

Sometimes the device disappears out from under us and device_lookup_private()
will return NULL. Be paranoid about this to prevent NULL pointer dereferences.

Don't rely on TS_BUSY to determine wether there is a buffer
available. Instead handle a possible buffer shortage.
Also aquire lock when modifying t_state.

branches: 1.99.2;
pull down from usbmp branch:

- rename usb_detach_{wake,waitup}() to usb_detach_{wake,waitup}old()
- use some c99 struct .initialisers

remove any remnants of freebsd/openbsd code.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

Stopgap XXX kludge for PR kern/42848 and PR kern/45013.

Someone should really find and fix the real problem,
but it's better to not crash in the meantime.

Don't notify about zero length reads without UCOM_DEBUG && ucomdebug > 0.
It's typical for uslsa(4) hardware to do this occasionally.

In ucompoll() also bail out if we don't have a valid softc.
Seems to prevent occasional crashes when a open ucom is removed.

Revert previous due to active usbmp branch(es).

Adjust-away inconsistent and trailing whitespace.

It's tp->t_dev, not tp->tp_dev. Corrects commit prior to previous.

const-ify struct ucom_methods pointer within ucom(4).

Make commented-out code in ucomstop() compilable.

branches: 1.88.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.87.4;
Rename ttymalloc() to tty_alloc(), and ttyfree() to tty_free() for
consistency. Remove some unnecessary malloc.h inclusions as well.

branches: 1.86.2;
don't clear TS_BUSY in ucomclose().
This fixes kernel crash in ucomstart() with "echo Hello > /dev/ttyU0".

Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

remove debugging statements that have no chance of working (they crash)
since they are called from a context where we cannot log.

branches: 1.83.2;
printf -> aprint_normal to avoid empty linefeeds and partial messages
for AB_QUIET.

branches: 1.82.2;
Optimize for higher speeds, e.g. when used as part of a 3G modem.
Contributed anonymously.

Simplify device-activation hooks.

typo in comment.

Change major()/minor() to return 32-bit types again, called
devmajor_t/devminor_t, as proposed on tech-kern.
This avoids 64-bit arithmetics and 64-bit printf formats in parts
of the kernel where it is not really useful, and helps clarity.

make this compile

branches: 1.77.6;
Split device_t and softc for all USB device drivers, and related cosmetic
changes.

Matthias Drochner kindly reviewed this patch, and tested ums, ubt, uaudio
and ral. I tested umass myself.

branches: 1.76.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.75.2; 1.75.4;
use aprint_*_dev and device_xname

branches: 1.74.6;
Add pmf register/deregister to ucom and ugensa. (Addtionally, let a
Sierra wireless card be recognized as a ugensa.)

branches: 1.73.6;
- Factor out too many copies of the same bit of tty code.
- Fix another tty signalling/wakeup problem.

Call ttwakeup() with tty_lock held.

Call ttyflush() with tty_lock held.

branches: 1.70.14; 1.70.16; 1.70.20; 1.70.22;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.69.4; 1.69.10;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

More from Matt Fleming:

Adapt to KAUTH_DEVICE_TTY_PRIVSET and KAUTH_DEVICE_TTY_OPEN.

Adapt MD code to KAUTH_DEVICE_TTY_OPEN, batch #2 from Matt Fleming, thanks!

Also, add forgotten splx() calls in some places.

branches: 1.65.4; 1.65.6;
- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

Assert RTS on open. Fixes PR kern/33929.

branches: 1.63.4;
integrate kauth.

Use device_unit().

branches: 1.61.2; 1.61.4; 1.61.6;
Use device_is_active() rather than testing dv_flags for DVF_ACTIVE
directly.

branches: 1.60.2; 1.60.4; 1.60.6;
merge ktrace-lwp.

Remove duplicated "portno %d" from the attach message.

Change the driver open function's conditional for overriding exclusive tty
use from checking the proc's uid to suser(9), and account for the use of
privileges. Noted by David Holland in PR kern/31126.

s/locdesc_t/int/g

branches: 1.56.2;
PR-30566: Poll must not return <sys/errno.h> values.
Start with those places I can easily test.

- const poisoning
- eliminate variable shadowing

Handle DCD differently so it's not always asserted. From kern/30268 from
Wolfgang Stukenbrock.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

Make the DPRINTF text for bulk in/out opening errors match which one
is in and which one is out.

branches: 1.51.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Use aprint_normal() in cfprint routines.

Avoid strict-alias warnings.

merge kqueue branch into -current

kqueue provides a stateful and efficient event notification framework
currently supported events include socket, file, directory, fifo,
pipe, tty and device changes, and monitoring of processes and signals

kqueue is supported by all writable filesystems in NetBSD tree
(with exception of Coda) and all device drivers supporting poll(2)

based on work done by Jonathan Lemon for FreeBSD
initial NetBSD port done by Luke Mewburn and Jason Thorpe

Introduce a new routine, config_match(), which invokes the
cfattach->ca_match function in behalf of the caller. Use it
rather than invoking cfattach->ca_match directly.

Remove breaks after returns, unreachable returns and returns after
returns(!).

Merge the gehenna-devsw branch into the trunk.

This merge changes the device switch tables from static array to
dynamically generated by config(8).

- All device switches is defined as a constant structure in device drivers.

- The new grammer ``device-major'' is introduced to ``files''.

device-major <prefix> char <num> [block <num>] [<rules>]

- All device major numbers must be listed up in port dependent majors.<arch>
by using this grammer.

- Added the new naming convention.
The name of the device switch must be <prefix>_[bc]devsw for auto-generation
of device switch tables.

- The backward compatibility of loading block/character device
switch by LKM framework is broken. This is necessary to convert
from block/character device major to device name in runtime and vice versa.

- The restriction to assign device major by LKM is completely removed.
We don't need to reserve LKM entries for dynamic loading of device switch.

- In compile time, device major numbers list is packed into the kernel and
the LKM framework will refer it to assign device major number dynamically.

Get rid of trailing white space.

branches: 1.42.4;
Convert ioctl code to use EPASSTHROUGH instead of -1 or ENOTTY for
indicating an unhandled "command". ERESTART is -1, which can lead to
confusion. ERESTART has been moved to -3 and EPASSTHROUGH has been
placed at -4. No ioctl code should now return -1 anywhere. The
ioctl() system call is now properly restartable.

Make a typedef for struct proc to make portingeasier.

add RCSIDs

branches: 1.39.2;
Clear busy flag on write error. From PR 13731, IWAMOTO Toshihiro.

branches: 1.38.2;
Add `l_poll' to `struct linesw' and provide an xxxpoll() entry point
in each tty driver to indirect through it.

This allows tty line-disciplines to handle poll(2) system calls.

Print portno when attaching.

branches: 1.36.2;
Fiddle enough with the tty so that it wakes up on detach and drops
the reference count on the ucom.

Ad support for an extra message in the ucom attach code.

Null out pointers when closing pipes.
Try to wake upper layer on error.

Rearrange detach code so it is more likely to survive detaching an open
device (it's still not waking up readers properly).

Adapt to the new line discipline scheme.

make ucom into a random source, type TTY