uhidev(9): Define UHIDEV_MAXREPID = 255.

Report ids are limited by the HID spec to a single byte.

- Clamp max report id in report descriptor to this.

- Prune dead refcnt-overflow error branches. Assert instead.

uhidev(9): Make uhidev state opaque.

This makes the API simpler and clearer and gives us more latitude to
fix bugs in the state management without breaking the ABI.

XXX kernel ABI change to signature of uhidev_get_report_desc and
uhidev_open, and to struct uhidev_attach_arg, requires bump for
uhidev driver modules

uhidev(9): Make uhidev_stop work reliably.

uhidev(9): Move struct uhidev_softc into uhidev.c.

No longer part of any ABI for uhidev modules.

uhidev(9): New uhidev_write_async.

Like uhidev_write but issues the transfer asynchronously with a
callback.

Use it in ucycom(4).

Also, clear endpoint stalls asynchronously -- can't do them
synchronously in xfer callbacks which run at softint and therefore
can't wait in cv_wait as usbd_do_request does.

uhidev(9): Partially fix uhidev_write aborting.

In my previous change, I intended to make uhidev_stop abort any
pending write -- but I forgot to initialize sc->sc_writereportid, so
it never did anything.

This changes the API and ABI of uhidev_write so it takes the struct
uhidev pointer, rather than the struct uhidev_softc pointer; this way
uhidev_write knows what the report id of the client is, so it can
arrange to have uhidev_stop abort only this one.

XXX Except it still doesn't actually work because we do this
unlocked, ugh, so the write might complete before we abort anything.
To be fixed some more in a later change.

XXX kernel ABI change to uhidev_write signature, used by uhidev
driver modules, requires bump

usb: Overhaul uhid(4) and uhidev(4) locking.

- uhidev API rules:

1. Call uhidev_open when you want exclusive use of a report id.
After it succeeds, you will get interrupts.

2. Call uhidev_close when done with exclusive use of a report id.
After it returns, you will no longer get interrupts.

=> uhidev_open/close do not nest.

3. uhidev_write no longer requires the caller to have exclusive
access -- if there is a write in progress, it will block
interruptibly until done. This way drivers for individual
report ids need not work separately to coordinate their writes.

4. You must uhidev_stop to abort any pending writes on the same
report id. (uhidev_stop no longer does anything else -- to
ensure no more interrupts, just use uhidev_close.)

- Fix uhidev_open/close locking -- uhidev now has an interruptible
config lock held only on first open and last close by any report id
in the device, to serialize the transition between zero and nonzero
numbers of references which requires opening/closing pipes and
allocating/freeing buffers.

- Make /dev/uhidN selnotify(POLLHUP) when the device is yanked.

- Factor uhid device lookup and reference counting and dying
detection and so on into uhid_enter/exit.

- Nix struct uhid_softc::sc_access_lock. This served no purpose but
to confuse me when trying to understand the logic of this beast
(and to ensure uhidev_write exclusion, but it was uninterruptible,
which is wrong for something that implements userland operations,
and didn't actually work because uhidev_write did nothing to
coordinate between different report ids).

- Fix locking in select/poll.

- Use atomics to manage UHID_IMMED to keep it simple. (sc_lock would
be fine too but it makes the code more verbose.)

- Omit needless UHID_ASLP -- cv_broadcast already has this
micro-optimization.


With these changes, my Pinebook survives

for i in `jot 100`; do
echo '###' $i
for j in `jot 16`; do
usbhidctl -rf /dev/uhid$j >/dev/null &
done
wait
done

while plugging and unplugging uhid(4) devices (U2F keys), and the U2F
keys still work as U2F keys.


ok nick, mrg

XXX pullup-9
XXX pullup-8?


Note on ABI and pullups: This changes the layout of struct
uhidev_softc, but with the sole exception of ucycom(4) -- which at
the moment is completely broken and unusable -- the only members that
USB HID drivers use are sc_udev and sc_iface, which haven't changed.
The layout of struct uhidev, which is allocated by each USB HID
driver in its own softc structure, is unchanged.

branches: 1.20.4; 1.20.12;
use sc_lock not sc_access_lock to check UHIDEV_OPEN.

fixes a soft hang when usbhidaction has a uhid open and bzflag
tries to open it as well.

XXX: pullup-7, pullup-8 (where i saw this originally.)

branches: 1.19.18;
Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Convert sys/dev to use <sys/rndsource.h>.

properly protect uhid's sc_q member with sc_lock. should fix PR#49728.
while here, remove D_MPSAFE from uhid* and all uhid users, as it really
needs all the callers to be safe and they're not.

XXX: pullup-7

Add Xbox One controller support. Report descriptor from https://github.com/lloeki/xbox_one_controller

branches: 1.15.2; 1.15.4;
PR/48908: Cannot open /dev/uhid? when another report id at the same uhidev
was already opened.

Restore the sc reference counting lost in usbmp merge.

branches: 1.14.2;
Remove usbd_do_request_async. It's callback was calling usbd_free_xfer
from softint context.

Adjust callers appropriately

- usbd_clear_endpoint_stall_async is already triggered via a
usb_task, so simply call usbd_do_request.

- uhidev_set_report_async had one caller in ukbd_set_leds.
Convert this usage to use usb_task as well.

Discussed with mrg@

branches: 1.13.2; 1.13.4;
merge the jmcneill-usbmp branch. many thanks to jared for the
initial work, and every one else who has tested things for me.
this is largely my fault at this point :-)

the main changes are something like:

- usbd_bus_methods{} gains a get_lock() to enable the
host controller to provide a lock for the USB code.
if the lock isn't provided, old-style protection is
(partially) applied.

- ehci/ohci/uhci have been converted to the new
interfaces, including mutex/cv/etc conversion.

- usbdivar.h contains a discussion about locking and
what locks are held for which method calls. more
to come for usbdi(9) here.

- audio drivers (uaudio, umidi, auvitek) have been
properly SMPified now that USB is ready.

- scsi drivers have been modified to take the kernel
lock explicitly before calling into scsi code.

- usb pipes are associated with a lock, that is the
same as the controller lock. (this could be split
up further in the future.)

- several usbfoo_locked() or usbfoo_unlocked()
functions have been added to the usbdi(9) to
enable functionality with or without the USB
lock (per controller) already being held.

the TODO.usbmp file has specific details on what is left to
do, including what device-specific changes should be done now
that the whole framework is ready.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

branches: 1.11.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.10.8;
Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

branches: 1.9.18; 1.9.20;
Fix a dereference if a softc pointer which can legally be zero, leading
to a crash reported by Christoph Egger in a followup to PR kern/38528.
For consistency, keep track of the device_t pointer to child devices
rather than the softc. We really shouldn't mess with child's softc data.

branches: 1.8.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.7.32; 1.7.34; 1.7.36;
Introduce different autoconf interface attributes for USB drivers
matching (and handling) a whole device and those which match an
interface only. This will allow to enforce some rules, eg that
the former don't use interface information for matching or that the
latter don't modify global device state.
The previous way left too much freedom do the drivers which led to
inconsistencies and abuse.
For now, I've not changed locators and submatch rules, this will
happen later.
There should not be any change in behaviour, except in the case of
some drivers which did behave inconsistently:
if_atu, if_axe, uep: matched the configured device in the interface
stage, but did configuration again. I've converted them to match
in the device stage.
ustir, utoppy: matched in the interface stage, but only against
vendor/device information, and used any configuration/interface
without checking. Changed to match in device stage, and added
some simple code to configure and use the first interface.
If you have one of those devices, please test!

branches: 1.6.26; 1.6.30; 1.6.32; 1.6.36;
Normally a ugen device only attaches if no other driver wants the device.
Add the ability to force ugen to attach with very high priority if "flags 1"
is specified. This can be used with the vendor and product locators to
force ugen to be used for certain devices.
Similarly, uhid only attaches if no other HID driver (ums or ukbd) wants it.
Again, "flags 1" will force uhid to attach anyway.

branches: 1.5.2; 1.5.8;
Add support for optional interrupt output pipes as described in the
HID specicification version 1.11.

Reviewed by Lennart. Thanks.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

branches: 1.3.6;
Add support for uhidev children (eg, ums, ukbd) as rnd entropy
sources.

Multifunction devices, such as keyboards with built-in mice or
scrollwheels on different interfaces and/or repid's are each handled
as a separate entropy source.

branches: 1.2.2; 1.2.4;
Be more paranoid about input sizes.

Introduce an extra driver level for HID devices, uhidev. This uhidev driver
attaches to the hub, and HID drivers (ums, ukbd, and uhid) attach to
uhidev. The reason for this change is that some HID devices report multiple
components (like a keyboard and a mouse) using the same interface, but with
different report identifiers. The report identifier can be specified with
a locator for the HID drivers.
Furthermore, change the ukbd driver to handle other formats than the boot
protocol.

usb: Overhaul uhid(4) and uhidev(4) locking.

- uhidev API rules:

1. Call uhidev_open when you want exclusive use of a report id.
After it succeeds, you will get interrupts.

2. Call uhidev_close when done with exclusive use of a report id.
After it returns, you will no longer get interrupts.

=> uhidev_open/close do not nest.

3. uhidev_write no longer requires the caller to have exclusive
access -- if there is a write in progress, it will block
interruptibly until done. This way drivers for individual
report ids need not work separately to coordinate their writes.

4. You must uhidev_stop to abort any pending writes on the same
report id. (uhidev_stop no longer does anything else -- to
ensure no more interrupts, just use uhidev_close.)

- Fix uhidev_open/close locking -- uhidev now has an interruptible
config lock held only on first open and last close by any report id
in the device, to serialize the transition between zero and nonzero
numbers of references which requires opening/closing pipes and
allocating/freeing buffers.

- Make /dev/uhidN selnotify(POLLHUP) when the device is yanked.

- Factor uhid device lookup and reference counting and dying
detection and so on into uhid_enter/exit.

- Nix struct uhid_softc::sc_access_lock. This served no purpose but
to confuse me when trying to understand the logic of this beast
(and to ensure uhidev_write exclusion, but it was uninterruptible,
which is wrong for something that implements userland operations,
and didn't actually work because uhidev_write did nothing to
coordinate between different report ids).

- Fix locking in select/poll.

- Use atomics to manage UHID_IMMED to keep it simple. (sc_lock would
be fine too but it makes the code more verbose.)

- Omit needless UHID_ASLP -- cv_broadcast already has this
micro-optimization.


With these changes, my Pinebook survives

for i in `jot 100`; do
echo '###' $i
for j in `jot 16`; do
usbhidctl -rf /dev/uhid$j >/dev/null &
done
wait
done

while plugging and unplugging uhid(4) devices (U2F keys), and the U2F
keys still work as U2F keys.


ok nick, mrg

XXX pullup-9
XXX pullup-8?


Note on ABI and pullups: This changes the layout of struct
uhidev_softc, but with the sole exception of ucycom(4) -- which at
the moment is completely broken and unusable -- the only members that
USB HID drivers use are sc_udev and sc_iface, which haven't changed.
The layout of struct uhidev, which is allocated by each USB HID
driver in its own softc structure, is unchanged.

use sc_lock not sc_access_lock to check UHIDEV_OPEN.

fixes a soft hang when usbhidaction has a uhid open and bzflag
tries to open it as well.

XXX: pullup-7, pullup-8 (where i saw this originally.)

branches: 1.19.18;
Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Convert sys/dev to use <sys/rndsource.h>.

properly protect uhid's sc_q member with sc_lock. should fix PR#49728.
while here, remove D_MPSAFE from uhid* and all uhid users, as it really
needs all the callers to be safe and they're not.

XXX: pullup-7

Add Xbox One controller support. Report descriptor from https://github.com/lloeki/xbox_one_controller

branches: 1.15.2; 1.15.4;
PR/48908: Cannot open /dev/uhid? when another report id at the same uhidev
was already opened.

Restore the sc reference counting lost in usbmp merge.

branches: 1.14.2;
Remove usbd_do_request_async. It's callback was calling usbd_free_xfer
from softint context.

Adjust callers appropriately

- usbd_clear_endpoint_stall_async is already triggered via a
usb_task, so simply call usbd_do_request.

- uhidev_set_report_async had one caller in ukbd_set_leds.
Convert this usage to use usb_task as well.

Discussed with mrg@

branches: 1.13.2; 1.13.4;
merge the jmcneill-usbmp branch. many thanks to jared for the
initial work, and every one else who has tested things for me.
this is largely my fault at this point :-)

the main changes are something like:

- usbd_bus_methods{} gains a get_lock() to enable the
host controller to provide a lock for the USB code.
if the lock isn't provided, old-style protection is
(partially) applied.

- ehci/ohci/uhci have been converted to the new
interfaces, including mutex/cv/etc conversion.

- usbdivar.h contains a discussion about locking and
what locks are held for which method calls. more
to come for usbdi(9) here.

- audio drivers (uaudio, umidi, auvitek) have been
properly SMPified now that USB is ready.

- scsi drivers have been modified to take the kernel
lock explicitly before calling into scsi code.

- usb pipes are associated with a lock, that is the
same as the controller lock. (this could be split
up further in the future.)

- several usbfoo_locked() or usbfoo_unlocked()
functions have been added to the usbdi(9) to
enable functionality with or without the USB
lock (per controller) already being held.

the TODO.usbmp file has specific details on what is left to
do, including what device-specific changes should be done now
that the whole framework is ready.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

branches: 1.11.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.10.8;
Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

branches: 1.9.18; 1.9.20;
Fix a dereference if a softc pointer which can legally be zero, leading
to a crash reported by Christoph Egger in a followup to PR kern/38528.
For consistency, keep track of the device_t pointer to child devices
rather than the softc. We really shouldn't mess with child's softc data.

branches: 1.8.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.7.32; 1.7.34; 1.7.36;
Introduce different autoconf interface attributes for USB drivers
matching (and handling) a whole device and those which match an
interface only. This will allow to enforce some rules, eg that
the former don't use interface information for matching or that the
latter don't modify global device state.
The previous way left too much freedom do the drivers which led to
inconsistencies and abuse.
For now, I've not changed locators and submatch rules, this will
happen later.
There should not be any change in behaviour, except in the case of
some drivers which did behave inconsistently:
if_atu, if_axe, uep: matched the configured device in the interface
stage, but did configuration again. I've converted them to match
in the device stage.
ustir, utoppy: matched in the interface stage, but only against
vendor/device information, and used any configuration/interface
without checking. Changed to match in device stage, and added
some simple code to configure and use the first interface.
If you have one of those devices, please test!

branches: 1.6.26; 1.6.30; 1.6.32; 1.6.36;
Normally a ugen device only attaches if no other driver wants the device.
Add the ability to force ugen to attach with very high priority if "flags 1"
is specified. This can be used with the vendor and product locators to
force ugen to be used for certain devices.
Similarly, uhid only attaches if no other HID driver (ums or ukbd) wants it.
Again, "flags 1" will force uhid to attach anyway.

branches: 1.5.2; 1.5.8;
Add support for optional interrupt output pipes as described in the
HID specicification version 1.11.

Reviewed by Lennart. Thanks.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

branches: 1.3.6;
Add support for uhidev children (eg, ums, ukbd) as rnd entropy
sources.

Multifunction devices, such as keyboards with built-in mice or
scrollwheels on different interfaces and/or repid's are each handled
as a separate entropy source.

branches: 1.2.2; 1.2.4;
Be more paranoid about input sizes.

Introduce an extra driver level for HID devices, uhidev. This uhidev driver
attaches to the hub, and HID drivers (ums, ukbd, and uhid) attach to
uhidev. The reason for this change is that some HID devices report multiple
components (like a keyboard and a mouse) using the same interface, but with
different report identifiers. The report identifier can be specified with
a locator for the HID drivers.
Furthermore, change the ukbd driver to handle other formats than the boot
protocol.

use sc_lock not sc_access_lock to check UHIDEV_OPEN.

fixes a soft hang when usbhidaction has a uhid open and bzflag
tries to open it as well.

XXX: pullup-7, pullup-8 (where i saw this originally.)

Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Convert sys/dev to use <sys/rndsource.h>.

properly protect uhid's sc_q member with sc_lock. should fix PR#49728.
while here, remove D_MPSAFE from uhid* and all uhid users, as it really
needs all the callers to be safe and they're not.

XXX: pullup-7

Add Xbox One controller support. Report descriptor from https://github.com/lloeki/xbox_one_controller

branches: 1.15.2; 1.15.4;
PR/48908: Cannot open /dev/uhid? when another report id at the same uhidev
was already opened.

Restore the sc reference counting lost in usbmp merge.

branches: 1.14.2;
Remove usbd_do_request_async. It's callback was calling usbd_free_xfer
from softint context.

Adjust callers appropriately

- usbd_clear_endpoint_stall_async is already triggered via a
usb_task, so simply call usbd_do_request.

- uhidev_set_report_async had one caller in ukbd_set_leds.
Convert this usage to use usb_task as well.

Discussed with mrg@

branches: 1.13.2; 1.13.4;
merge the jmcneill-usbmp branch. many thanks to jared for the
initial work, and every one else who has tested things for me.
this is largely my fault at this point :-)

the main changes are something like:

- usbd_bus_methods{} gains a get_lock() to enable the
host controller to provide a lock for the USB code.
if the lock isn't provided, old-style protection is
(partially) applied.

- ehci/ohci/uhci have been converted to the new
interfaces, including mutex/cv/etc conversion.

- usbdivar.h contains a discussion about locking and
what locks are held for which method calls. more
to come for usbdi(9) here.

- audio drivers (uaudio, umidi, auvitek) have been
properly SMPified now that USB is ready.

- scsi drivers have been modified to take the kernel
lock explicitly before calling into scsi code.

- usb pipes are associated with a lock, that is the
same as the controller lock. (this could be split
up further in the future.)

- several usbfoo_locked() or usbfoo_unlocked()
functions have been added to the usbdi(9) to
enable functionality with or without the USB
lock (per controller) already being held.

the TODO.usbmp file has specific details on what is left to
do, including what device-specific changes should be done now
that the whole framework is ready.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

branches: 1.11.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.10.8;
Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

branches: 1.9.18; 1.9.20;
Fix a dereference if a softc pointer which can legally be zero, leading
to a crash reported by Christoph Egger in a followup to PR kern/38528.
For consistency, keep track of the device_t pointer to child devices
rather than the softc. We really shouldn't mess with child's softc data.

branches: 1.8.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.7.32; 1.7.34; 1.7.36;
Introduce different autoconf interface attributes for USB drivers
matching (and handling) a whole device and those which match an
interface only. This will allow to enforce some rules, eg that
the former don't use interface information for matching or that the
latter don't modify global device state.
The previous way left too much freedom do the drivers which led to
inconsistencies and abuse.
For now, I've not changed locators and submatch rules, this will
happen later.
There should not be any change in behaviour, except in the case of
some drivers which did behave inconsistently:
if_atu, if_axe, uep: matched the configured device in the interface
stage, but did configuration again. I've converted them to match
in the device stage.
ustir, utoppy: matched in the interface stage, but only against
vendor/device information, and used any configuration/interface
without checking. Changed to match in device stage, and added
some simple code to configure and use the first interface.
If you have one of those devices, please test!

branches: 1.6.26; 1.6.30; 1.6.32; 1.6.36;
Normally a ugen device only attaches if no other driver wants the device.
Add the ability to force ugen to attach with very high priority if "flags 1"
is specified. This can be used with the vendor and product locators to
force ugen to be used for certain devices.
Similarly, uhid only attaches if no other HID driver (ums or ukbd) wants it.
Again, "flags 1" will force uhid to attach anyway.

branches: 1.5.2; 1.5.8;
Add support for optional interrupt output pipes as described in the
HID specicification version 1.11.

Reviewed by Lennart. Thanks.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

branches: 1.3.6;
Add support for uhidev children (eg, ums, ukbd) as rnd entropy
sources.

Multifunction devices, such as keyboards with built-in mice or
scrollwheels on different interfaces and/or repid's are each handled
as a separate entropy source.

branches: 1.2.2; 1.2.4;
Be more paranoid about input sizes.

Introduce an extra driver level for HID devices, uhidev. This uhidev driver
attaches to the hub, and HID drivers (ums, ukbd, and uhid) attach to
uhidev. The reason for this change is that some HID devices report multiple
components (like a keyboard and a mouse) using the same interface, but with
different report identifiers. The report identifier can be specified with
a locator for the HID drivers.
Furthermore, change the ukbd driver to handle other formats than the boot
protocol.

Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix

Convert sys/dev to use <sys/rndsource.h>.

properly protect uhid's sc_q member with sc_lock. should fix PR#49728.
while here, remove D_MPSAFE from uhid* and all uhid users, as it really
needs all the callers to be safe and they're not.

XXX: pullup-7

Add Xbox One controller support. Report descriptor from https://github.com/lloeki/xbox_one_controller

branches: 1.15.2; 1.15.4;
PR/48908: Cannot open /dev/uhid? when another report id at the same uhidev
was already opened.

Restore the sc reference counting lost in usbmp merge.

branches: 1.14.2;
Remove usbd_do_request_async. It's callback was calling usbd_free_xfer
from softint context.

Adjust callers appropriately

- usbd_clear_endpoint_stall_async is already triggered via a
usb_task, so simply call usbd_do_request.

- uhidev_set_report_async had one caller in ukbd_set_leds.
Convert this usage to use usb_task as well.

Discussed with mrg@

branches: 1.13.2; 1.13.4;
merge the jmcneill-usbmp branch. many thanks to jared for the
initial work, and every one else who has tested things for me.
this is largely my fault at this point :-)

the main changes are something like:

- usbd_bus_methods{} gains a get_lock() to enable the
host controller to provide a lock for the USB code.
if the lock isn't provided, old-style protection is
(partially) applied.

- ehci/ohci/uhci have been converted to the new
interfaces, including mutex/cv/etc conversion.

- usbdivar.h contains a discussion about locking and
what locks are held for which method calls. more
to come for usbdi(9) here.

- audio drivers (uaudio, umidi, auvitek) have been
properly SMPified now that USB is ready.

- scsi drivers have been modified to take the kernel
lock explicitly before calling into scsi code.

- usb pipes are associated with a lock, that is the
same as the controller lock. (this could be split
up further in the future.)

- several usbfoo_locked() or usbfoo_unlocked()
functions have been added to the usbdi(9) to
enable functionality with or without the USB
lock (per controller) already being held.

the TODO.usbmp file has specific details on what is left to
do, including what device-specific changes should be done now
that the whole framework is ready.

Entropy-pool implementation move and cleanup.

1) Move core entropy-pool code and source/sink/sample management code
to sys/kern from sys/dev.

2) Remove use of NRND as test for presence of entropy-pool code throughout
source tree.

3) Remove use of RND_ENABLED in device drivers as microoptimization to
avoid expensive operations on disabled entropy sources; make the
rnd_add calls do this directly so all callers benefit.

4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might
have lead to slight entropy overestimation for some sources.

5) Add new source types for environmental sensors, power sensors, VM
system events, and skew between clocks, with a sample implementation
for each.

ok releng to go in before the branch due to the difficulty of later
pullup (widespread #ifdef removal and moved files). Tested with release
builds on amd64 and evbarm and live testing on amd64.

branches: 1.11.2;
First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes
the following:

An initial cleanup and minor reorganization of the entropy pool
code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are
fixed. Some effort is made to accumulate entropy more quickly at
boot time.

A generic interface, "rndsink", is added, for stream generators to
request that they be re-keyed with good quality entropy from the pool
as soon as it is available.

The arc4random()/arc4randbytes() implementation in libkern is
adjusted to use the rndsink interface for rekeying, which helps
address the problem of low-quality keys at boot time.

An implementation of the FIPS 140-2 statistical tests for random
number generator quality is provided (libkern/rngtest.c). This
is based on Greg Rose's implementation from Qualcomm.

A new random stream generator, nist_ctr_drbg, is provided. It is
based on an implementation of the NIST SP800-90 CTR_DRBG by
Henric Jungheim. This generator users AES in a modified counter
mode to generate a backtracking-resistant random stream.

An abstraction layer, "cprng", is provided for in-kernel consumers
of randomness. The arc4random/arc4randbytes API is deprecated for
in-kernel use. It is replaced by "cprng_strong". The current
cprng_fast implementation wraps the existing arc4random
implementation. The current cprng_strong implementation wraps the
new CTR_DRBG implementation. Both interfaces are rekeyed from
the entropy pool automatically at intervals justifiable from best
current cryptographic practice.

In some quick tests, cprng_fast() is about the same speed as
the old arc4randbytes(), and cprng_strong() is about 20% faster
than rnd_extract_data(). Performance is expected to improve.

The AES code in src/crypto/rijndael is no longer an optional
kernel component, as it is required by cprng_strong, which is
not an optional kernel component.

The entropy pool output is subjected to the rngtest tests at
startup time; if it fails, the system will reboot. There is
approximately a 3/10000 chance of a false positive from these
tests. Entropy pool _input_ from hardware random numbers is
subjected to the rngtest tests at attach time, as well as the
FIPS continuous-output test, to detect bad or stuck hardware
RNGs; if any are detected, they are detached, but the system
continues to run.

A problem with rndctl(8) is fixed -- datastructures with
pointers in arrays are no longer passed to userspace (this
was not a security problem, but rather a major issue for
compat32). A new kernel will require a new rndctl.

The sysctl kern.arandom() and kern.urandom() nodes are hooked
up to the new generators, but the /dev/*random pseudodevices
are not, yet.

Manual pages for the new kernel interfaces are forthcoming.

branches: 1.10.8;
Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change

branches: 1.9.18; 1.9.20;
Fix a dereference if a softc pointer which can legally be zero, leading
to a crash reported by Christoph Egger in a followup to PR kern/38528.
For consistency, keep track of the device_t pointer to child devices
rather than the softc. We really shouldn't mess with child's softc data.

branches: 1.8.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.7.32; 1.7.34; 1.7.36;
Introduce different autoconf interface attributes for USB drivers
matching (and handling) a whole device and those which match an
interface only. This will allow to enforce some rules, eg that
the former don't use interface information for matching or that the
latter don't modify global device state.
The previous way left too much freedom do the drivers which led to
inconsistencies and abuse.
For now, I've not changed locators and submatch rules, this will
happen later.
There should not be any change in behaviour, except in the case of
some drivers which did behave inconsistently:
if_atu, if_axe, uep: matched the configured device in the interface
stage, but did configuration again. I've converted them to match
in the device stage.
ustir, utoppy: matched in the interface stage, but only against
vendor/device information, and used any configuration/interface
without checking. Changed to match in device stage, and added
some simple code to configure and use the first interface.
If you have one of those devices, please test!

branches: 1.6.26; 1.6.30; 1.6.32; 1.6.36;
Normally a ugen device only attaches if no other driver wants the device.
Add the ability to force ugen to attach with very high priority if "flags 1"
is specified. This can be used with the vendor and product locators to
force ugen to be used for certain devices.
Similarly, uhid only attaches if no other HID driver (ums or ukbd) wants it.
Again, "flags 1" will force uhid to attach anyway.

branches: 1.5.2; 1.5.8;
Add support for optional interrupt output pipes as described in the
HID specicification version 1.11.

Reviewed by Lennart. Thanks.

a round of autoconf cleanup:
-convert submatch() style functions (passed to config_search() or
config_found_sm()) to the locator passing variants
-pass interface attributes in some cases
-make submatch() functions look uniformly as far as possible
-avoid macros which just hide cfdata members, and reduce dependencies
on "locators.h"

branches: 1.3.6;
Add support for uhidev children (eg, ums, ukbd) as rnd entropy
sources.

Multifunction devices, such as keyboards with built-in mice or
scrollwheels on different interfaces and/or repid's are each handled
as a separate entropy source.

branches: 1.2.2; 1.2.4;
Be more paranoid about input sizes.

Introduce an extra driver level for HID devices, uhidev. This uhidev driver
attaches to the hub, and HID drivers (ums, ukbd, and uhid) attach to
uhidev. The reason for this change is that some HID devices report multiple
components (like a keyboard and a mouse) using the same interface, but with
different report identifiers. The report identifier can be specified with
a locator for the HID drivers.
Furthermore, change the ukbd driver to handle other formats than the boot
protocol.