xref: /src/sys/dev/usb/utoppy.c

/*	$NetBSD: utoppy.c,v 1.36 2022/03/03 06:05:38 riastradh Exp $	*/

/*-
 * Copyright (c) 2006 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Steve C. Woodford.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: utoppy.c,v 1.36 2022/03/03 06:05:38 riastradh Exp $");

#ifdef _KERNEL_OPT
#include "opt_usb.h"
#endif

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/proc.h>
#include <sys/kernel.h>
#include <sys/fcntl.h>
#include <sys/device.h>
#include <sys/ioctl.h>
#include <sys/uio.h>
#include <sys/conf.h>
#include <sys/vnode.h>
#include <sys/bus.h>

#include <lib/libkern/crc16.h>

#include <dev/usb/usb.h>
#include <dev/usb/usbdi.h>
#include <dev/usb/usbdivar.h>
#include <dev/usb/usbdi_util.h>
#include <dev/usb/usbdevs.h>
#include <dev/usb/usb_quirks.h>
#include <dev/usb/utoppy.h>

#include "ioconf.h"

#undef UTOPPY_DEBUG
#ifdef UTOPPY_DEBUG
#define	UTOPPY_DBG_OPEN		0x0001
#define	UTOPPY_DBG_CLOSE	0x0002
#define	UTOPPY_DBG_READ		0x0004
#define	UTOPPY_DBG_WRITE	0x0008
#define	UTOPPY_DBG_IOCTL	0x0010
#define	UTOPPY_DBG_SEND_PACKET	0x0020
#define	UTOPPY_DBG_RECV_PACKET	0x0040
#define	UTOPPY_DBG_ADDPATH	0x0080
#define	UTOPPY_DBG_READDIR	0x0100
#define	UTOPPY_DBG_DUMP		0x0200
#define	DPRINTF(l, m)				\
		do {				\
			if (utoppy_debug & l)	\
				printf m;	\
		} while (/*CONSTCOND*/0)
static int utoppy_debug = 0;
static void utoppy_dump_packet(const void *, size_t);
#define	DDUMP_PACKET(p, l)					\
		do {						\
			if (utoppy_debug & UTOPPY_DBG_DUMP)	\
				utoppy_dump_packet((p), (l));	\
		} while (/*CONSTCOND*/0)
#else
#define	DPRINTF(l, m)		/* nothing */
#define	DDUMP_PACKET(p, l)	/* nothing */
#endif


#define	UTOPPY_CONFIG_NO	1
#define	UTOPPY_NUMENDPOINTS	2

#define	UTOPPY_BSIZE		0xffff
#define	UTOPPY_FRAG_SIZE	0x1000
#define	UTOPPY_HEADER_SIZE	8
#define	UTOPPY_SHORT_TIMEOUT	(500)		/* 0.5 seconds */
#define	UTOPPY_LONG_TIMEOUT	(10 * 1000)	/* 10 seconds */

/* Protocol Commands and Responses */
#define	UTOPPY_RESP_ERROR		0x0001
#define	UTOPPY_CMD_ACK			0x0002
#define	 UTOPPY_RESP_SUCCESS		UTOPPY_CMD_ACK
#define	UTOPPY_CMD_CANCEL		0x0003
#define	UTOPPY_CMD_READY		0x0100
#define	UTOPPY_CMD_RESET		0x0101
#define	UTOPPY_CMD_TURBO		0x0102
#define	UTOPPY_CMD_STATS		0x1000
#define  UTOPPY_RESP_STATS_DATA		0x1001
#define	UTOPPY_CMD_READDIR		0x1002
#define	 UTOPPY_RESP_READDIR_DATA	0x1003
#define	 UTOPPY_RESP_READDIR_END	0x1004
#define	UTOPPY_CMD_DELETE		0x1005
#define	UTOPPY_CMD_RENAME		0x1006
#define	UTOPPY_CMD_MKDIR		0x1007
#define	UTOPPY_CMD_FILE			0x1008
#define  UTOPPY_FILE_WRITE		0
#define  UTOPPY_FILE_READ		1
#define	 UTOPPY_RESP_FILE_HEADER	0x1009
#define	 UTOPPY_RESP_FILE_DATA		0x100a
#define	 UTOPPY_RESP_FILE_END		0x100b

enum utoppy_state {
	UTOPPY_STATE_CLOSED,
	UTOPPY_STATE_OPENING,
	UTOPPY_STATE_IDLE,
	UTOPPY_STATE_READDIR,
	UTOPPY_STATE_READFILE,
	UTOPPY_STATE_WRITEFILE
};

struct utoppy_softc {
	device_t sc_dev;
	struct usbd_device *sc_udev;	/* device */
	struct usbd_interface *sc_iface;	/* interface */
	int sc_dying;
	int sc_refcnt;

	enum utoppy_state sc_state;
	u_int sc_turbo_mode;

	int sc_out;
	struct usbd_pipe *sc_out_pipe;	/* bulk out pipe */
	struct usbd_xfer *sc_out_xfer;
	void *sc_out_buf;
	void *sc_out_data;
	uint64_t sc_wr_offset;
	uint64_t sc_wr_size;

	int sc_in;
	struct usbd_pipe *sc_in_pipe;	/* bulk in pipe */
	struct usbd_xfer *sc_in_xfer;
	void *sc_in_buf;
	void *sc_in_data;
	size_t sc_in_len;
	u_int sc_in_offset;
};

struct utoppy_header {
	uint16_t h_len;
	uint16_t h_crc;
	uint16_t h_cmd2;
	uint16_t h_cmd;
	uint8_t h_data[0];
};
#define	UTOPPY_OUT_INIT(sc)					\
	do {							\
		struct utoppy_header *_h = sc->sc_out_data;	\
		_h->h_len = 0;					\
	} while (/*CONSTCOND*/0)

#define	UTOPPY_MJD_1970 40587u	/* MJD value for Jan 1 00:00:00 1970 */

#define	UTOPPY_FTYPE_DIR	1
#define	UTOPPY_FTYPE_FILE	2

#define	UTOPPY_IN_DATA(sc)	\
 ((void*)&(((uint8_t*)(sc)->sc_in_data)[(sc)->sc_in_offset+UTOPPY_HEADER_SIZE]))

static dev_type_open(utoppyopen);
static dev_type_close(utoppyclose);
static dev_type_read(utoppyread);
static dev_type_write(utoppywrite);
static dev_type_ioctl(utoppyioctl);

const struct cdevsw utoppy_cdevsw = {
	.d_open = utoppyopen,
	.d_close = utoppyclose,
	.d_read = utoppyread,
	.d_write = utoppywrite,
	.d_ioctl = utoppyioctl,
	.d_stop = nostop,
	.d_tty = notty,
	.d_poll = nopoll,
	.d_mmap = nommap,
	.d_kqfilter = nokqfilter,
	.d_discard = nodiscard,
	.d_flag = D_OTHER
};

#define	UTOPPYUNIT(n)	(minor(n))

static int	utoppy_match(device_t, cfdata_t, void *);
static void	utoppy_attach(device_t, device_t, void *);
static int	utoppy_detach(device_t, int);
static int	utoppy_activate(device_t, enum devact);

CFATTACH_DECL_NEW(utoppy, sizeof(struct utoppy_softc), utoppy_match,
    utoppy_attach, utoppy_detach, utoppy_activate);

static int
utoppy_match(device_t parent, cfdata_t match, void *aux)
{
	struct usb_attach_arg *uaa = aux;

	if (uaa->uaa_vendor == USB_VENDOR_TOPFIELD &&
	    uaa->uaa_product == USB_PRODUCT_TOPFIELD_TF5000PVR)
		return UMATCH_VENDOR_PRODUCT;

	return UMATCH_NONE;
}

static void
utoppy_attach(device_t parent, device_t self, void *aux)
{
	struct utoppy_softc *sc = device_private(self);
	struct usb_attach_arg *uaa = aux;
	struct usbd_device *dev = uaa->uaa_device;
	struct usbd_interface *iface;
	usb_endpoint_descriptor_t *ed;
	char *devinfop;
	uint8_t epcount;
	int i;

	sc->sc_dev = self;

	aprint_naive("\n");
	aprint_normal("\n");

	devinfop = usbd_devinfo_alloc(dev, 0);
	aprint_normal_dev(self, "%s\n", devinfop);
	usbd_devinfo_free(devinfop);

	sc->sc_dying = 0;
	sc->sc_refcnt = 0;
	sc->sc_udev = dev;

	if (usbd_set_config_index(dev, 0, 1)
	    || usbd_device2interface_handle(dev, 0, &iface)) {
		aprint_error_dev(self, "Configuration failed\n");
		return;
	}

	epcount = 0;
	(void) usbd_endpoint_count(iface, &epcount);
	if (epcount != UTOPPY_NUMENDPOINTS) {
		aprint_error_dev(self, "Expected %d endpoints, got %d\n",
		    UTOPPY_NUMENDPOINTS, epcount);
		return;
	}

	sc->sc_in = -1;
	sc->sc_out = -1;

	for (i = 0; i < epcount; i++) {
		ed = usbd_interface2endpoint_descriptor(iface, i);
		if (ed == NULL) {
			aprint_error_dev(self, "couldn't get ep %d\n", i);
			return;
		}

		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) {
			sc->sc_in = ed->bEndpointAddress;
		} else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
			   UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) {
			sc->sc_out = ed->bEndpointAddress;
		}
	}

	if (sc->sc_out == -1 || sc->sc_in == -1) {
		aprint_error_dev(self,
		    "could not find bulk in/out endpoints\n");
		sc->sc_dying = 1;
		return;
	}

	sc->sc_iface = iface;
	sc->sc_udev = dev;

	sc->sc_out_pipe = NULL;
	sc->sc_in_pipe = NULL;

	if (usbd_open_pipe(sc->sc_iface, sc->sc_out, 0, &sc->sc_out_pipe)) {
		DPRINTF(UTOPPY_DBG_OPEN, ("%s: usbd_open_pipe(OUT) failed\n",
		    device_xname(sc->sc_dev)));
		aprint_error_dev(self, "could not open OUT pipe\n");
		sc->sc_dying = 1;
		return;
	}

	if (usbd_open_pipe(sc->sc_iface, sc->sc_in, 0, &sc->sc_in_pipe)) {
		DPRINTF(UTOPPY_DBG_OPEN, ("%s: usbd_open_pipe(IN) failed\n",
		    device_xname(sc->sc_dev)));
		aprint_error_dev(self, "could not open IN pipe\n");

		usbd_close_pipe(sc->sc_out_pipe);
		sc->sc_out_pipe = NULL;
		sc->sc_dying = 1;
		return;
	}

	int error;
	error = usbd_create_xfer(sc->sc_out_pipe, UTOPPY_FRAG_SIZE, 0, 0,
	    &sc->sc_out_xfer);
	if (error) {
		aprint_error_dev(self, "could not allocate bulk out xfer\n");
		goto fail0;
	}

	error = usbd_create_xfer(sc->sc_in_pipe, UTOPPY_FRAG_SIZE,
	    0, 0, &sc->sc_in_xfer);
	if (error) {
		aprint_error_dev(self, "could not allocate bulk in xfer\n");
		goto fail1;
	}

	sc->sc_out_buf = usbd_get_buffer(sc->sc_out_xfer);
	sc->sc_in_buf = usbd_get_buffer(sc->sc_in_xfer);

	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev);

	return;

 fail1:	usbd_destroy_xfer(sc->sc_out_xfer);
	sc->sc_out_xfer = NULL;

 fail0:	sc->sc_dying = 1;
	return;
}

static int
utoppy_activate(device_t self, enum devact act)
{
	struct utoppy_softc *sc = device_private(self);

	switch (act) {
	case DVACT_DEACTIVATE:
		sc->sc_dying = 1;
		return 0;
	default:
		return EOPNOTSUPP;
	}
}

static int
utoppy_detach(device_t self, int flags)
{
	struct utoppy_softc *sc = device_private(self);
	int maj, mn;
	int s;

	sc->sc_dying = 1;
	if (sc->sc_out_pipe != NULL)
		usbd_abort_pipe(sc->sc_out_pipe);
	if (sc->sc_in_pipe != NULL)
		usbd_abort_pipe(sc->sc_in_pipe);

	if (sc->sc_in_xfer != NULL)
		usbd_destroy_xfer(sc->sc_in_xfer);
	if (sc->sc_out_xfer != NULL)
		usbd_destroy_xfer(sc->sc_out_xfer);

	if (sc->sc_out_pipe != NULL)
		usbd_close_pipe(sc->sc_out_pipe);
	if (sc->sc_in_pipe != NULL)
		usbd_close_pipe(sc->sc_in_pipe);

	s = splusb();
	if (--sc->sc_refcnt >= 0)
		usb_detach_waitold(sc->sc_dev);
	splx(s);

	/* locate the major number */
	maj = cdevsw_lookup_major(&utoppy_cdevsw);

	/* Nuke the vnodes for any open instances (calls close). */
	mn = device_unit(self);
	vdevgone(maj, mn, mn, VCHR);

	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev, sc->sc_dev);

	return 0;
}

#define	UTOPPY_CRC16(ccrc,b)	crc16_byte((ccrc), (b)) /* from crc16.h */

static const int utoppy_usbdstatus_lookup[] = {
	0,		/* USBD_NORMAL_COMPLETION */
	EINPROGRESS,	/* USBD_IN_PROGRESS */
	EALREADY,	/* USBD_PENDING_REQUESTS */
	EAGAIN,		/* USBD_NOT_STARTED */
	EINVAL,		/* USBD_INVAL */
	ENOMEM,		/* USBD_NOMEM */
	ECONNRESET,	/* USBD_CANCELLED */
	EFAULT,		/* USBD_BAD_ADDRESS */
	EBUSY,		/* USBD_IN_USE */
	EADDRNOTAVAIL,	/* USBD_NO_ADDR */
	ENETDOWN,	/* USBD_SET_ADDR_FAILED */
	EIO,		/* USBD_NO_POWER */
	EMLINK,		/* USBD_TOO_DEEP */
	EIO,		/* USBD_IOERROR */
	ENXIO,		/* USBD_NOT_CONFIGURED */
	ETIMEDOUT,	/* USBD_TIMEOUT */
	EBADMSG,	/* USBD_SHORT_XFER */
	EHOSTDOWN,	/* USBD_STALLED */
	EINTR		/* USBD_INTERRUPTED */
};

static __inline int
utoppy_usbd_status2errno(usbd_status err)
{

	if (err >= USBD_ERROR_MAX)
		return EFAULT;
	return utoppy_usbdstatus_lookup[err];
}

#ifdef UTOPPY_DEBUG
static const char *
utoppy_state_string(enum utoppy_state state)
{
	const char *str;

	switch (state) {
	case UTOPPY_STATE_CLOSED:
		str = "CLOSED";
		break;
	case UTOPPY_STATE_OPENING:
		str = "OPENING";
		break;
	case UTOPPY_STATE_IDLE:
		str = "IDLE";
		break;
	case UTOPPY_STATE_READDIR:
		str = "READ DIRECTORY";
		break;
	case UTOPPY_STATE_READFILE:
		str = "READ FILE";
		break;
	case UTOPPY_STATE_WRITEFILE:
		str = "WRITE FILE";
		break;
	default:
		str = "INVALID!";
		break;
	}

	return str;
}

static void
utoppy_dump_packet(const void *b, size_t len)
{
	const uint8_t *buf = b, *l;
	uint8_t c;
	size_t i, j;

	if (len == 0)
		return;

	len = uimin(len, 256);

	printf("00: ");

	for (i = 0, l = buf; i < len; i++) {
		printf("%02x ", *buf++);

		if ((i % 16) == 15) {
			for (j = 0; j < 16; j++) {
				c = *l++;
				if (c < ' ' || c > 0x7e)
					c = '.';
				printf("%c", c);
			}

			printf("\n");
			l = buf;

			if ((i + 1) < len)
				printf("%02x: ", (u_int)i + 1);
		}
	}

	while ((i++ % 16) != 0)
		printf("   ");

	if (l < buf) {
		while (l < buf) {
			c = *l++;
			if (c < ' ' || c > 0x7e)
				c = '.';
			printf("%c", c);
		}

		printf("\n");
	}
}
#endif

static usbd_status
utoppy_bulk_transfer(struct usbd_xfer *xfer, struct usbd_pipe *pipe,
    uint16_t flags, uint32_t timeout, void *buf, uint32_t *size)
{
	usbd_status err;

	usbd_setup_xfer(xfer, 0, buf, *size, flags, timeout, NULL);

	err = usbd_sync_transfer_sig(xfer);

	usbd_get_xfer_status(xfer, NULL, NULL, size, NULL);
	return err;
}

static int
utoppy_send_packet(struct utoppy_softc *sc, uint16_t cmd, uint32_t timeout)
{
	struct utoppy_header *h;
	usbd_status err;
	uint32_t len;
	uint16_t dlen, crc;
	uint8_t *data, *e, t1, t2;

	h = sc->sc_out_data;

	DPRINTF(UTOPPY_DBG_SEND_PACKET, ("%s: utoppy_send_packet: cmd 0x%04x, "
	    "len %d\n", device_xname(sc->sc_dev), (u_int)cmd, h->h_len));

	dlen = h->h_len;
	len = dlen + UTOPPY_HEADER_SIZE;

	if (len & 1)
		len++;
	if ((len % 64) == 0)
		len += 2;

	if (len >= UTOPPY_BSIZE) {
		DPRINTF(UTOPPY_DBG_SEND_PACKET, ("%s: utoppy_send_packet: "
		    "packet too big (%d)\n", device_xname(sc->sc_dev),
		    (int)len));
		return EINVAL;
	}

	h->h_len = htole16(dlen + UTOPPY_HEADER_SIZE);
	h->h_cmd2 = 0;
	h->h_cmd = htole16(cmd);

	/* The command word is part of the CRC */
	crc = UTOPPY_CRC16(0,   0);
	crc = UTOPPY_CRC16(crc, 0);
	crc = UTOPPY_CRC16(crc, cmd >> 8);
	crc = UTOPPY_CRC16(crc, cmd);

	/*
	 * If there is data following the header, calculate the CRC and
	 * byte-swap as we go.
	 */
	if (dlen) {
		data = h->h_data;
		e = data + (dlen & ~1);

		do {
			t1 = data[0];
			t2 = data[1];
			crc = UTOPPY_CRC16(crc, t1);
			crc = UTOPPY_CRC16(crc, t2);
			*data++ = t2;
			*data++ = t1;
		} while (data < e);

		if (dlen & 1) {
			t1 = data[0];
			crc = UTOPPY_CRC16(crc, t1);
			data[1] = t1;
		}
	}

	h->h_crc = htole16(crc);
	data = sc->sc_out_data;

	DPRINTF(UTOPPY_DBG_SEND_PACKET, ("%s: utoppy_send_packet: total len "
	    "%d...\n", device_xname(sc->sc_dev), (int)len));
	DDUMP_PACKET(data, len);

	do {
		uint32_t thislen;

		thislen = uimin(len, UTOPPY_FRAG_SIZE);

		memcpy(sc->sc_out_buf, data, thislen);

		err = utoppy_bulk_transfer(sc->sc_out_xfer, sc->sc_out_pipe,
		    0, timeout, sc->sc_out_buf, &thislen);

		if (thislen != uimin(len, UTOPPY_FRAG_SIZE)) {
			DPRINTF(UTOPPY_DBG_SEND_PACKET, ("%s: "
			    "utoppy_send_packet: sent %ld, err %d\n",
			    device_xname(sc->sc_dev), (u_long)thislen, err));
		}

		if (err == 0) {
			len -= thislen;
			data += thislen;
		}
	} while (err == 0 && len);

	DPRINTF(UTOPPY_DBG_SEND_PACKET, ("%s: utoppy_send_packet: "
	    "usbd_bulk_transfer() returned %d.\n",
	    device_xname(sc->sc_dev),err));

	return err ? utoppy_usbd_status2errno(err) : 0;
}

static int
utoppy_recv_packet(struct utoppy_softc *sc, uint16_t *respp, uint32_t timeout)
{
	struct utoppy_header *h;
	usbd_status err;
	uint32_t len, thislen, requested, bytesleft;
	uint16_t crc;
	uint8_t *data, *e, t1, t2;

	data = sc->sc_in_data;
	len = 0;
	bytesleft = UTOPPY_BSIZE;

	DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: utoppy_recv_packet: ...\n",
	    device_xname(sc->sc_dev)));

	do {
		requested = thislen = uimin(bytesleft, UTOPPY_FRAG_SIZE);

		err = utoppy_bulk_transfer(sc->sc_in_xfer, sc->sc_in_pipe,
		    USBD_SHORT_XFER_OK, timeout, sc->sc_in_buf,
		    &thislen);

		DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: utoppy_recv_packet: "
		    "usbd_bulk_transfer() returned %d, thislen %d, data %p\n",
		    device_xname(sc->sc_dev), err, (u_int)thislen, data));

		if (err == 0) {
			memcpy(data, sc->sc_in_buf, thislen);
			DDUMP_PACKET(data, thislen);
			len += thislen;
			bytesleft -= thislen;
			data += thislen;
		}
	} while (err == 0 && bytesleft && thislen == requested);

	if (err)
		return utoppy_usbd_status2errno(err);

	h = sc->sc_in_data;

	DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: utoppy_recv_packet: received %d "
	    "bytes in total to %p\n", device_xname(sc->sc_dev), (u_int)len, h));
	DDUMP_PACKET(h, len);

	if (len < UTOPPY_HEADER_SIZE || len < (uint32_t)le16toh(h->h_len)) {
		DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: utoppy_recv_packet: bad "
		    " length (len %d, h_len %d)\n", device_xname(sc->sc_dev),
		    (int)len, le16toh(h->h_len)));
		return EIO;
	}

	len = h->h_len = le16toh(h->h_len);
	h->h_crc = le16toh(h->h_crc);
	*respp = h->h_cmd = le16toh(h->h_cmd);
	h->h_cmd2 = le16toh(h->h_cmd2);

	/*
	 * To maximise data throughput when transferring files, acknowledge
	 * data blocks as soon as we receive them. If we detect an error
	 * later on, we can always cancel.
	 */
	if (*respp == UTOPPY_RESP_FILE_DATA) {
		DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: utoppy_recv_packet: "
		    "ACKing file data\n", device_xname(sc->sc_dev)));

		UTOPPY_OUT_INIT(sc);
		err = utoppy_send_packet(sc, UTOPPY_CMD_ACK,
		    UTOPPY_SHORT_TIMEOUT);
		if (err) {
			DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: "
			    "utoppy_recv_packet: failed to ACK file data: %d\n",
			    device_xname(sc->sc_dev), err));
			return err;
		}
	}

	/* The command word is part of the CRC */
	crc = UTOPPY_CRC16(0,   h->h_cmd2 >> 8);
	crc = UTOPPY_CRC16(crc, h->h_cmd2);
	crc = UTOPPY_CRC16(crc, h->h_cmd >> 8);
	crc = UTOPPY_CRC16(crc, h->h_cmd);

	/*
	 * Extract any payload, byte-swapping and calculating the CRC16
	 * as we go.
	 */
	if (len > UTOPPY_HEADER_SIZE) {
		data = h->h_data;
		e = data + ((len & ~1) - UTOPPY_HEADER_SIZE);

		while (data < e) {
			t1 = data[0];
			t2 = data[1];
			crc = UTOPPY_CRC16(crc, t2);
			crc = UTOPPY_CRC16(crc, t1);
			*data++ = t2;
			*data++ = t1;
		}

		if (len & 1) {
			t1 = data[1];
			crc = UTOPPY_CRC16(crc, t1);
			*data = t1;
		}
	}

	sc->sc_in_len = (size_t) len - UTOPPY_HEADER_SIZE;
	sc->sc_in_offset = 0;

	DPRINTF(UTOPPY_DBG_RECV_PACKET, ("%s: utoppy_recv_packet: len %d, "
	    "crc 0x%04x, hdrcrc 0x%04x\n", device_xname(sc->sc_dev),
	    (int)len, crc, h->h_crc));
	DDUMP_PACKET(h, len);

	return (crc == h->h_crc) ? 0 : EBADMSG;
}

static __inline void *
utoppy_current_ptr(void *b)
{
	struct utoppy_header *h = b;

	return &h->h_data[h->h_len];
}

static __inline void
utoppy_advance_ptr(void *b, size_t len)
{
	struct utoppy_header *h = b;

	h->h_len += len;
}

static __inline void
utoppy_add_8(struct utoppy_softc *sc, uint8_t v)
{
	struct utoppy_header *h = sc->sc_out_data;
	uint8_t *p;

	p = utoppy_current_ptr(h);
	*p = v;
	utoppy_advance_ptr(h, sizeof(v));
}

static __inline void
utoppy_add_16(struct utoppy_softc *sc, uint16_t v)
{
	struct utoppy_header *h = sc->sc_out_data;
	uint8_t *p;

	p = utoppy_current_ptr(h);
	*p++ = (uint8_t)(v >> 8);
	*p = (uint8_t)v;
	utoppy_advance_ptr(h, sizeof(v));
}

static __inline void
utoppy_add_32(struct utoppy_softc *sc, uint32_t v)
{
	struct utoppy_header *h = sc->sc_out_data;
	uint8_t *p;

	p = utoppy_current_ptr(h);
	*p++ = (uint8_t)(v >> 24);
	*p++ = (uint8_t)(v >> 16);
	*p++ = (uint8_t)(v >> 8);
	*p = (uint8_t)v;
	utoppy_advance_ptr(h, sizeof(v));
}

static __inline void
utoppy_add_64(struct utoppy_softc *sc, uint64_t v)
{
	struct utoppy_header *h = sc->sc_out_data;
	uint8_t *p;

	p = utoppy_current_ptr(h);
	*p++ = (uint8_t)(v >> 56);
	*p++ = (uint8_t)(v >> 48);
	*p++ = (uint8_t)(v >> 40);
	*p++ = (uint8_t)(v >> 32);
	*p++ = (uint8_t)(v >> 24);
	*p++ = (uint8_t)(v >> 16);
	*p++ = (uint8_t)(v >> 8);
	*p = (uint8_t)v;
	utoppy_advance_ptr(h, sizeof(v));
}

static __inline void
utoppy_add_string(struct utoppy_softc *sc, const char *str, size_t len)
{
	struct utoppy_header *h = sc->sc_out_data;
	char *p;

	p = utoppy_current_ptr(h);
	memset(p, 0, len);
	strncpy(p, str, len);
	utoppy_advance_ptr(h, len);
}

static int
utoppy_add_path(struct utoppy_softc *sc, const char *path, int putlen)
{
	struct utoppy_header *h = sc->sc_out_data;
	uint8_t *p, *str, *s;
	size_t len;
	int err;

	p = utoppy_current_ptr(h);

	str = putlen ? (p + sizeof(uint16_t)) : p;

	err = copyinstr(path, str, UTOPPY_MAX_FILENAME_LEN, &len);

	DPRINTF(UTOPPY_DBG_ADDPATH, ("utoppy_add_path: err %d, len %d\n",
	    err, (int)len));

	if (err)
		return err;

	if (len < 2)
		return EINVAL;

	/*
	 * copyinstr(9) has already copied the terminating NUL character,
	 * but we append another one in case we have to pad the length
	 * later on.
	 */
	str[len] = '\0';

	/*
	 * The Toppy uses backslash as the directory separator, so convert
	 * all forward slashes.
	 */
	for (s = &str[len - 2]; s >= str; s--)
		if (*s == '/')
			*s = '\\';

	if ((len + h->h_len) & 1)
		len++;

	if (putlen)
		utoppy_add_16(sc, len);

	utoppy_advance_ptr(h, len);

	DPRINTF(UTOPPY_DBG_ADDPATH, ("utoppy_add_path: final len %d\n",
	    (u_int)len));

	return 0;
}

static __inline int
utoppy_get_8(struct utoppy_softc *sc, uint8_t *vp)
{
	uint8_t *p;

	if (sc->sc_in_len < sizeof(*vp))
		return 1;

	p = UTOPPY_IN_DATA(sc);
	*vp = *p;
	sc->sc_in_offset += sizeof(*vp);
	sc->sc_in_len -= sizeof(*vp);
	return 0;
}

static __inline int
utoppy_get_16(struct utoppy_softc *sc, uint16_t *vp)
{
	uint16_t v;
	uint8_t *p;

	if (sc->sc_in_len < sizeof(v))
		return 1;

	p = UTOPPY_IN_DATA(sc);
	v = *p++;
	v = (v << 8) | *p;
	*vp = v;
	sc->sc_in_offset += sizeof(v);
	sc->sc_in_len -= sizeof(v);
	return 0;
}

static __inline int
utoppy_get_32(struct utoppy_softc *sc, uint32_t *vp)
{
	uint32_t v;
	uint8_t *p;

	if (sc->sc_in_len < sizeof(v))
		return 1;

	p = UTOPPY_IN_DATA(sc);
	v = *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p;
	*vp = v;
	sc->sc_in_offset += sizeof(v);
	sc->sc_in_len -= sizeof(v);
	return 0;
}

static __inline int
utoppy_get_64(struct utoppy_softc *sc, uint64_t *vp)
{
	uint64_t v;
	uint8_t *p;

	if (sc->sc_in_len < sizeof(v))
		return 1;

	p = UTOPPY_IN_DATA(sc);
	v = *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p++;
	v = (v << 8) | *p;
	*vp = v;
	sc->sc_in_offset += sizeof(v);
	sc->sc_in_len -= sizeof(v);
	return 0;
}

static __inline int
utoppy_get_string(struct utoppy_softc *sc, char *str, size_t len)
{
	char *p;

	if (sc->sc_in_len < len)
		return 1;

	memset(str, 0, len);
	p = UTOPPY_IN_DATA(sc);
	strncpy(str, p, len);
	sc->sc_in_offset += len;
	sc->sc_in_len -= len;
	return 0;
}

static int
utoppy_command(struct utoppy_softc *sc, uint16_t cmd, int timeout,
    uint16_t *presp)
{
	int err;

	err = utoppy_send_packet(sc, cmd, timeout);
	if (err)
		return err;

	err = utoppy_recv_packet(sc, presp, timeout);
	if (err == EBADMSG) {
		UTOPPY_OUT_INIT(sc);
		utoppy_send_packet(sc, UTOPPY_RESP_ERROR, timeout);
	}

	return err;
}

static int
utoppy_timestamp_decode(struct utoppy_softc *sc, time_t *tp)
{
	uint16_t mjd;
	uint8_t hour, minute, sec;
	uint32_t rv;

	if (utoppy_get_16(sc, &mjd) || utoppy_get_8(sc, &hour) ||
	    utoppy_get_8(sc, &minute) || utoppy_get_8(sc, &sec))
		return 1;

	if (mjd == 0xffffu && hour == 0xffu && minute == 0xffu && sec == 0xffu){
		*tp = 0;
		return 0;
	}

	rv = (mjd < UTOPPY_MJD_1970) ? UTOPPY_MJD_1970 : (uint32_t) mjd;

	/* Calculate seconds since 1970 */
	rv = (rv - UTOPPY_MJD_1970) * 60 * 60 * 24;

	/* Add in the hours, minutes, and seconds */
	rv += (uint32_t)hour * 60 * 60;
	rv += (uint32_t)minute * 60;
	rv += sec;
	*tp = (time_t)rv;

	return 0;
}

static void
utoppy_timestamp_encode(struct utoppy_softc *sc, time_t t)
{
	u_int mjd, hour, minute;

	mjd = t / (60 * 60 * 24);
	t -= mjd * 60 * 60 * 24;

	hour = t / (60 * 60);
	t -= hour * 60 * 60;

	minute = t / 60;
	t -= minute * 60;

	utoppy_add_16(sc, mjd + UTOPPY_MJD_1970);
	utoppy_add_8(sc, hour);
	utoppy_add_8(sc, minute);
	utoppy_add_8(sc, t);
}

static int
utoppy_turbo_mode(struct utoppy_softc *sc, int state)
{
	uint16_t r;
	int err;

	UTOPPY_OUT_INIT(sc);
	utoppy_add_32(sc, state);

	err = utoppy_command(sc, UTOPPY_CMD_TURBO, UTOPPY_SHORT_TIMEOUT, &r);
	if (err)
		return err;

	return (r == UTOPPY_RESP_SUCCESS) ? 0 : EIO;
}

static int
utoppy_check_ready(struct utoppy_softc *sc)
{
	uint16_t r;
	int err;

	UTOPPY_OUT_INIT(sc);

	err = utoppy_command(sc, UTOPPY_CMD_READY, UTOPPY_LONG_TIMEOUT, &r);
	if (err)
		return err;

	return (r == UTOPPY_RESP_SUCCESS) ? 0 : EIO;
}

static int
utoppy_cancel(struct utoppy_softc *sc)
{
	uint16_t r;
	int err, i;

	/*
	 * Issue the cancel command serveral times. the Toppy doesn't
	 * always respond to the first.
	 */
	for (i = 0; i < 3; i++) {
		UTOPPY_OUT_INIT(sc);
		err = utoppy_command(sc, UTOPPY_CMD_CANCEL,
		    UTOPPY_SHORT_TIMEOUT, &r);
		if (err == 0 && r == UTOPPY_RESP_SUCCESS)
			break;
		err = ETIMEDOUT;
	}

	if (err)
		return err;

	/*
	 * Make sure turbo mode is off, otherwise the Toppy will not
	 * respond to remote control input.
	 */
	(void) utoppy_turbo_mode(sc, 0);

	sc->sc_state = UTOPPY_STATE_IDLE;
	return 0;
}

static int
utoppy_stats(struct utoppy_softc *sc, struct utoppy_stats *us)
{
	uint32_t hsize, hfree;
	uint16_t r;
	int err;

	UTOPPY_OUT_INIT(sc);
	err = utoppy_command(sc, UTOPPY_CMD_STATS, UTOPPY_LONG_TIMEOUT, &r);
	if (err)
		return err;

	if (r != UTOPPY_RESP_STATS_DATA)
		return EIO;

	if (utoppy_get_32(sc, &hsize) || utoppy_get_32(sc, &hfree))
		return EIO;

	us->us_hdd_size = hsize;
	us->us_hdd_size *= 1024;
	us->us_hdd_free = hfree;
	us->us_hdd_free *= 1024;

	return 0;
}

static int
utoppy_readdir_next(struct utoppy_softc *sc)
{
	uint16_t resp;
	int err;

	DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: running...\n",
	    device_xname(sc->sc_dev)));

	/*
	 * Fetch the next READDIR response
	 */
	err = utoppy_recv_packet(sc, &resp, UTOPPY_LONG_TIMEOUT);
	if (err) {
		DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: "
		    "utoppy_recv_packet() returned %d\n",
		    device_xname(sc->sc_dev), err));
		if (err == EBADMSG) {
			UTOPPY_OUT_INIT(sc);
			utoppy_send_packet(sc, UTOPPY_RESP_ERROR,
			    UTOPPY_LONG_TIMEOUT);
		}
		utoppy_cancel(sc);
		return err;
	}

	DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: "
	    "utoppy_recv_packet() returned %d, len %ld\n",
	    device_xname(sc->sc_dev), err, (u_long)sc->sc_in_len));

	switch (resp) {
	case UTOPPY_RESP_READDIR_DATA:
		DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: "
		    "UTOPPY_RESP_READDIR_DATA\n", device_xname(sc->sc_dev)));

		UTOPPY_OUT_INIT(sc);
		err = utoppy_send_packet(sc, UTOPPY_CMD_ACK,
		    UTOPPY_LONG_TIMEOUT);
		if (err) {
			DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: "
			    "utoppy_send_packet(ACK) returned %d\n",
			    device_xname(sc->sc_dev), err));
			utoppy_cancel(sc);
			return err;
		}
		sc->sc_state = UTOPPY_STATE_READDIR;
		sc->sc_in_offset = 0;
		break;

	case UTOPPY_RESP_READDIR_END:
		DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: "
		    "UTOPPY_RESP_READDIR_END\n", device_xname(sc->sc_dev)));

		UTOPPY_OUT_INIT(sc);
		utoppy_send_packet(sc, UTOPPY_CMD_ACK, UTOPPY_SHORT_TIMEOUT);
		sc->sc_state = UTOPPY_STATE_IDLE;
		sc->sc_in_len = 0;
		break;

	default:
		DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_next: "
		    "bad response: %#x\n", device_xname(sc->sc_dev), resp));
		sc->sc_state = UTOPPY_STATE_IDLE;
		sc->sc_in_len = 0;
		return EIO;
	}

	return 0;
}

static size_t
utoppy_readdir_decode(struct utoppy_softc *sc, struct utoppy_dirent *ud)
{
	uint8_t ftype;

	DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_decode: bytes left"
	    " %d\n", device_xname(sc->sc_dev), (int)sc->sc_in_len));

	if (utoppy_timestamp_decode(sc, &ud->ud_mtime) ||
	    utoppy_get_8(sc, &ftype) || utoppy_get_64(sc, &ud->ud_size) ||
	    utoppy_get_string(sc, ud->ud_path, UTOPPY_MAX_FILENAME_LEN + 1) ||
	    utoppy_get_32(sc, &ud->ud_attributes)) {
		DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_decode: no "
		    "more to decode\n", device_xname(sc->sc_dev)));
		return 0;
	}

	switch (ftype) {
	case UTOPPY_FTYPE_DIR:
		ud->ud_type = UTOPPY_DIRENT_DIRECTORY;
		break;
	case UTOPPY_FTYPE_FILE:
		ud->ud_type = UTOPPY_DIRENT_FILE;
		break;
	default:
		ud->ud_type = UTOPPY_DIRENT_UNKNOWN;
		break;
	}

	DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppy_readdir_decode: %s '%s', "
	    "size %lld, time 0x%08lx, attr 0x%08x\n", device_xname(sc->sc_dev),
	    (ftype == UTOPPY_FTYPE_DIR) ? "DIR" :
	    ((ftype == UTOPPY_FTYPE_FILE) ? "FILE" : "UNKNOWN"), ud->ud_path,
	    ud->ud_size, (u_long)ud->ud_mtime, ud->ud_attributes));

	return 1;
}

static int
utoppy_readfile_next(struct utoppy_softc *sc)
{
	uint64_t off;
	uint16_t resp;
	int err;

	err = utoppy_recv_packet(sc, &resp, UTOPPY_LONG_TIMEOUT);
	if (err) {
		DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: "
		    "utoppy_recv_packet() returned %d\n",
		    device_xname(sc->sc_dev), err));
		utoppy_cancel(sc);
		return err;
	}

	switch (resp) {
	case UTOPPY_RESP_FILE_HEADER:
		/* ACK it */
		UTOPPY_OUT_INIT(sc);
		err = utoppy_send_packet(sc, UTOPPY_CMD_ACK,
		    UTOPPY_LONG_TIMEOUT);
		if (err) {
			DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: "
			    "utoppy_send_packet(UTOPPY_CMD_ACK) returned %d\n",
			    device_xname(sc->sc_dev), err));
			utoppy_cancel(sc);
			return err;
		}

		sc->sc_in_len = 0;
		DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: "
		    "FILE_HEADER done\n", device_xname(sc->sc_dev)));
		break;

	case UTOPPY_RESP_FILE_DATA:
		/* Already ACK'd */
		if (utoppy_get_64(sc, &off)) {
			DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: "
			    "UTOPPY_RESP_FILE_DATA did not provide offset\n",
			    device_xname(sc->sc_dev)));
			utoppy_cancel(sc);
			return EBADMSG;
		}

		DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: "
		    "UTOPPY_RESP_FILE_DATA: offset %lld, bytes left %ld\n",
		    device_xname(sc->sc_dev), off, (u_long)sc->sc_in_len));
		break;

	case UTOPPY_RESP_FILE_END:
		DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: "
		    "UTOPPY_RESP_FILE_END: sending ACK\n",
		    device_xname(sc->sc_dev)));
		UTOPPY_OUT_INIT(sc);
		utoppy_send_packet(sc, UTOPPY_CMD_ACK, UTOPPY_SHORT_TIMEOUT);
		/*FALLTHROUGH*/

	case UTOPPY_RESP_SUCCESS:
		sc->sc_state = UTOPPY_STATE_IDLE;
		(void) utoppy_turbo_mode(sc, 0);
		DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: all "
		    "done\n", device_xname(sc->sc_dev)));
		break;

	case UTOPPY_RESP_ERROR:
	default:
		DPRINTF(UTOPPY_DBG_READ, ("%s: utoppy_readfile_next: bad "
		    "response code 0x%0x\n", device_xname(sc->sc_dev), resp));
		utoppy_cancel(sc);
		return EIO;
	}

	return 0;
}

static int
utoppyopen(dev_t dev, int flag, int mode,
    struct lwp *l)
{
	struct utoppy_softc *sc;
	int error = 0;

	sc = device_lookup_private(&utoppy_cd, UTOPPYUNIT(dev));
	if (sc == NULL)
		return ENXIO;

	if (sc == NULL || sc->sc_iface == NULL || sc->sc_dying)
		return ENXIO;

	if (sc->sc_state != UTOPPY_STATE_CLOSED) {
		DPRINTF(UTOPPY_DBG_OPEN, ("%s: utoppyopen: already open\n",
		    device_xname(sc->sc_dev)));
		return EBUSY;
	}

	DPRINTF(UTOPPY_DBG_OPEN, ("%s: utoppyopen: opening...\n",
	    device_xname(sc->sc_dev)));

	sc->sc_refcnt++;
	sc->sc_state = UTOPPY_STATE_OPENING;
	sc->sc_turbo_mode = 0;
	sc->sc_out_data = kmem_alloc(UTOPPY_BSIZE + 1, KM_SLEEP);
	sc->sc_in_data = kmem_alloc(UTOPPY_BSIZE + 1, KM_SLEEP);

	if ((error = utoppy_cancel(sc)) != 0)
		goto error;

	if ((error = utoppy_check_ready(sc)) != 0) {
		DPRINTF(UTOPPY_DBG_OPEN, ("%s: utoppyopen: utoppy_check_ready()"
		    " returned %d\n", device_xname(sc->sc_dev), error));
	}

 error:
	sc->sc_state = error ? UTOPPY_STATE_CLOSED : UTOPPY_STATE_IDLE;

	DPRINTF(UTOPPY_DBG_OPEN, ("%s: utoppyopen: done. error %d, new state "
	    "'%s'\n", device_xname(sc->sc_dev), error,
	    utoppy_state_string(sc->sc_state)));

	if (--sc->sc_refcnt < 0)
		usb_detach_wakeupold(sc->sc_dev);

	return error;
}

static int
utoppyclose(dev_t dev, int flag, int mode, struct lwp *l)
{
	struct utoppy_softc *sc;

	sc = device_lookup_private(&utoppy_cd, UTOPPYUNIT(dev));

	DPRINTF(UTOPPY_DBG_CLOSE, ("%s: utoppyclose: closing...\n",
	    device_xname(sc->sc_dev)));

	if (sc->sc_state < UTOPPY_STATE_IDLE) {
		/* We are being forced to close before the open completed. */
		DPRINTF(UTOPPY_DBG_CLOSE, ("%s: utoppyclose: not properly "
		    "open: %s\n", device_xname(sc->sc_dev),
		    utoppy_state_string(sc->sc_state)));
		return 0;
	}

	if (sc->sc_out_data)
		(void) utoppy_cancel(sc);

	if (sc->sc_out_pipe != NULL) {
		usbd_abort_pipe(sc->sc_out_pipe);
		sc->sc_out_pipe = NULL;
	}

	if (sc->sc_in_pipe != NULL) {
		usbd_abort_pipe(sc->sc_in_pipe);
		sc->sc_in_pipe = NULL;
	}

	if (sc->sc_out_data) {
		kmem_free(sc->sc_out_data, UTOPPY_BSIZE + 1);
		sc->sc_out_data = NULL;
	}

	if (sc->sc_in_data) {
		kmem_free(sc->sc_in_data, UTOPPY_BSIZE + 1);
		sc->sc_in_data = NULL;
	}

	sc->sc_state = UTOPPY_STATE_CLOSED;

	DPRINTF(UTOPPY_DBG_CLOSE, ("%s: utoppyclose: done.\n",
	    device_xname(sc->sc_dev)));

	return 0;
}

static int
utoppyread(dev_t dev, struct uio *uio, int flags)
{
	struct utoppy_softc *sc;
	struct utoppy_dirent ud;
	size_t len;
	int err;

	sc = device_lookup_private(&utoppy_cd, UTOPPYUNIT(dev));

	if (sc->sc_dying)
		return EIO;

	sc->sc_refcnt++;

	DPRINTF(UTOPPY_DBG_READ, ("%s: utoppyread: reading: state '%s'\n",
	    device_xname(sc->sc_dev), utoppy_state_string(sc->sc_state)));

	switch (sc->sc_state) {
	case UTOPPY_STATE_READDIR:
		err = 0;
		while (err == 0 && uio->uio_resid >= sizeof(ud) &&
		    sc->sc_state != UTOPPY_STATE_IDLE) {
			if (utoppy_readdir_decode(sc, &ud) == 0)
				err = utoppy_readdir_next(sc);
			else
			if ((err = uiomove(&ud, sizeof(ud), uio)) != 0)
				utoppy_cancel(sc);
		}
		break;

	case UTOPPY_STATE_READFILE:
		err = 0;
		while (err == 0 && uio->uio_resid > 0 &&
		    sc->sc_state != UTOPPY_STATE_IDLE) {
			DPRINTF(UTOPPY_DBG_READ, ("%s: utoppyread: READFILE: "
			    "resid %ld, bytes_left %ld\n",
			    device_xname(sc->sc_dev), (u_long)uio->uio_resid,
			    (u_long)sc->sc_in_len));

			if (sc->sc_in_len == 0 &&
			    (err = utoppy_readfile_next(sc)) != 0) {
				DPRINTF(UTOPPY_DBG_READ, ("%s: utoppyread: "
				    "READFILE: utoppy_readfile_next returned "
				    "%d\n", device_xname(sc->sc_dev), err));
				break;
			}

			len = uimin(uio->uio_resid, sc->sc_in_len);
			if (len) {
				err = uiomove(UTOPPY_IN_DATA(sc), len, uio);
				if (err == 0) {
					sc->sc_in_offset += len;
					sc->sc_in_len -= len;
				}
			}
		}
		break;

	case UTOPPY_STATE_IDLE:
		err = 0;
		break;

	case UTOPPY_STATE_WRITEFILE:
		err = EBUSY;
		break;

	default:
		err = EIO;
		break;
	}

	DPRINTF(UTOPPY_DBG_READ, ("%s: utoppyread: done. err %d, state '%s'\n",
	    device_xname(sc->sc_dev), err, utoppy_state_string(sc->sc_state)));

	if (--sc->sc_refcnt < 0)
		usb_detach_wakeupold(sc->sc_dev);

	return err;
}

static int
utoppywrite(dev_t dev, struct uio *uio, int flags)
{
	struct utoppy_softc *sc;
	uint16_t resp;
	size_t len;
	int err;

	sc = device_lookup_private(&utoppy_cd, UTOPPYUNIT(dev));

	if (sc->sc_dying)
		return EIO;

	switch(sc->sc_state) {
	case UTOPPY_STATE_WRITEFILE:
		break;

	case UTOPPY_STATE_IDLE:
		return 0;

	default:
		return EIO;
	}

	sc->sc_refcnt++;
	err = 0;

	DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: PRE-WRITEFILE: resid "
	    "%ld, wr_size %lld, wr_offset %lld\n", device_xname(sc->sc_dev),
	    (u_long)uio->uio_resid, sc->sc_wr_size, sc->sc_wr_offset));

	while (sc->sc_state == UTOPPY_STATE_WRITEFILE &&
	    (len = uimin(uio->uio_resid, sc->sc_wr_size)) != 0) {

		len = uimin(len, UTOPPY_BSIZE - (UTOPPY_HEADER_SIZE +
		    sizeof(uint64_t) + 3));

		DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: uiomove(%ld)\n",
		    device_xname(sc->sc_dev), (u_long)len));

		UTOPPY_OUT_INIT(sc);
		utoppy_add_64(sc, sc->sc_wr_offset);

		err = uiomove(utoppy_current_ptr(sc->sc_out_data), len, uio);
		if (err) {
			DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: uiomove()"
			    " returned %d\n", device_xname(sc->sc_dev), err));
			break;
		}

		utoppy_advance_ptr(sc->sc_out_data, len);

		err = utoppy_command(sc, UTOPPY_RESP_FILE_DATA,
		    UTOPPY_LONG_TIMEOUT, &resp);
		if (err) {
			DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: "
			    "utoppy_command(UTOPPY_RESP_FILE_DATA) "
			    "returned %d\n", device_xname(sc->sc_dev), err));
			break;
		}
		if (resp != UTOPPY_RESP_SUCCESS) {
			DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: "
			    "utoppy_command(UTOPPY_RESP_FILE_DATA) returned "
			    "bad response %#x\n", device_xname(sc->sc_dev),
			    resp));
			utoppy_cancel(sc);
			err = EIO;
			break;
		}

		sc->sc_wr_offset += len;
		sc->sc_wr_size -= len;
	}

	DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: POST-WRITEFILE: resid "
	    "%ld, wr_size %lld, wr_offset %lld, err %d\n",
	    device_xname(sc->sc_dev), (u_long)uio->uio_resid, sc->sc_wr_size,
	    sc->sc_wr_offset, err));

	if (err == 0 && sc->sc_wr_size == 0) {
		DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: sending "
		    "FILE_END...\n", device_xname(sc->sc_dev)));
		UTOPPY_OUT_INIT(sc);
		err = utoppy_command(sc, UTOPPY_RESP_FILE_END,
		    UTOPPY_LONG_TIMEOUT, &resp);
		if (err) {
			DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: "
			    "utoppy_command(UTOPPY_RESP_FILE_END) returned "
			    "%d\n", device_xname(sc->sc_dev), err));

			utoppy_cancel(sc);
		}

		sc->sc_state = UTOPPY_STATE_IDLE;
		DPRINTF(UTOPPY_DBG_WRITE, ("%s: utoppywrite: state %s\n",
		    device_xname(sc->sc_dev),
		    utoppy_state_string(sc->sc_state)));
	}

	if (--sc->sc_refcnt < 0)
		usb_detach_wakeupold(sc->sc_dev);

	return err;
}

static int
utoppyioctl(dev_t dev, u_long cmd, void *data, int flag,
    struct lwp *l)
{
	struct utoppy_softc *sc;
	struct utoppy_rename *ur;
	struct utoppy_readfile *urf;
	struct utoppy_writefile *uw;
	char uwf[UTOPPY_MAX_FILENAME_LEN + 1], *uwfp;
	uint16_t resp;
	int err;

	sc = device_lookup_private(&utoppy_cd, UTOPPYUNIT(dev));

	if (sc->sc_dying)
		return EIO;

	DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: cmd 0x%08lx, state '%s'\n",
	    device_xname(sc->sc_dev), cmd, utoppy_state_string(sc->sc_state)));

	if (sc->sc_state != UTOPPY_STATE_IDLE && cmd != UTOPPYIOCANCEL) {
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: still busy.\n",
		    device_xname(sc->sc_dev)));
		return EBUSY;
	}

	sc->sc_refcnt++;

	switch (cmd) {
	case UTOPPYIOTURBO:
		err = 0;
		sc->sc_turbo_mode = *((int *)data) ? 1 : 0;
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIOTURBO: "
		    "%s\n", device_xname(sc->sc_dev),
		    sc->sc_turbo_mode ? "On" : "Off"));
		break;

	case UTOPPYIOCANCEL:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIOCANCEL\n",
		    device_xname(sc->sc_dev)));
		err = utoppy_cancel(sc);
		break;

	case UTOPPYIOREBOOT:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIOREBOOT\n",
		    device_xname(sc->sc_dev)));
		UTOPPY_OUT_INIT(sc);
		err = utoppy_command(sc, UTOPPY_CMD_RESET, UTOPPY_LONG_TIMEOUT,
		    &resp);
		if (err)
			break;

		if (resp != UTOPPY_RESP_SUCCESS)
			err = EIO;
		break;

	case UTOPPYIOSTATS:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIOSTATS\n",
		    device_xname(sc->sc_dev)));
		err = utoppy_stats(sc, (struct utoppy_stats *)data);
		break;

	case UTOPPYIORENAME:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIORENAME\n",
		    device_xname(sc->sc_dev)));
		ur = (struct utoppy_rename *)data;
		UTOPPY_OUT_INIT(sc);

		if ((err = utoppy_add_path(sc, ur->ur_old_path, 1)) != 0)
			break;
		if ((err = utoppy_add_path(sc, ur->ur_new_path, 1)) != 0)
			break;

		err = utoppy_command(sc, UTOPPY_CMD_RENAME,
		    UTOPPY_LONG_TIMEOUT, &resp);
		if (err)
			break;

		if (resp != UTOPPY_RESP_SUCCESS)
			err = EIO;
		break;

	case UTOPPYIOMKDIR:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIOMKDIR\n",
		    device_xname(sc->sc_dev)));
		UTOPPY_OUT_INIT(sc);
		err = utoppy_add_path(sc, *((const char **)data), 1);
		if (err)
			break;

		err = utoppy_command(sc, UTOPPY_CMD_MKDIR, UTOPPY_LONG_TIMEOUT,
		    &resp);
		if (err)
			break;

		if (resp != UTOPPY_RESP_SUCCESS)
			err = EIO;
		break;

	case UTOPPYIODELETE:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIODELETE\n",
		    device_xname(sc->sc_dev)));
		UTOPPY_OUT_INIT(sc);
		err = utoppy_add_path(sc, *((const char **)data), 0);
		if (err)
			break;

		err = utoppy_command(sc, UTOPPY_CMD_DELETE, UTOPPY_LONG_TIMEOUT,
		    &resp);
		if (err)
			break;

		if (resp != UTOPPY_RESP_SUCCESS)
			err = EIO;
		break;

	case UTOPPYIOREADDIR:
		DPRINTF(UTOPPY_DBG_IOCTL, ("%s: utoppyioctl: UTOPPYIOREADDIR\n",
		    device_xname(sc->sc_dev)));
		UTOPPY_OUT_INIT(sc);
		err = utoppy_add_path(sc, *((const char **)data), 0);
		if (err) {
			DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppyioctl: "
			    "utoppy_add_path() returned %d\n",
			    device_xname(sc->sc_dev), err));
			break;
		}

		err = utoppy_send_packet(sc, UTOPPY_CMD_READDIR,
		    UTOPPY_LONG_TIMEOUT);
		if (err != 0) {
			DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppyioctl: "
			    "UTOPPY_CMD_READDIR returned %d\n",
			    device_xname(sc->sc_dev), err));
			break;
		}

		err = utoppy_readdir_next(sc);
		if (err) {
			DPRINTF(UTOPPY_DBG_READDIR, ("%s: utoppyioctl: "
			    "utoppy_readdir_next() returned %d\n",
			    device_xname(sc->sc_dev), err));
		}
		break;

	case UTOPPYIOREADFILE:
		urf = (struct utoppy_readfile *)data;

		DPRINTF(UTOPPY_DBG_IOCTL,("%s: utoppyioctl: UTOPPYIOREADFILE "
		    "%s, offset %lld\n", device_xname(sc->sc_dev),
		    urf->ur_path, urf->ur_offset));

		if ((err = utoppy_turbo_mode(sc, sc->sc_turbo_mode)) != 0)
			break;

		UTOPPY_OUT_INIT(sc);
		utoppy_add_8(sc, UTOPPY_FILE_READ);

		if ((err = utoppy_add_path(sc, urf->ur_path, 1)) != 0)
			break;

		utoppy_add_64(sc, urf->ur_offset);

		sc->sc_state = UTOPPY_STATE_READFILE;
		sc->sc_in_offset = 0;

		err = utoppy_send_packet(sc, UTOPPY_CMD_FILE,
		    UTOPPY_LONG_TIMEOUT);
		if (err == 0)
			err = utoppy_readfile_next(sc);
		break;

	case UTOPPYIOWRITEFILE:
		uw = (struct utoppy_writefile *)data;

		DPRINTF(UTOPPY_DBG_IOCTL,("%s: utoppyioctl: UTOPPYIOWRITEFILE "
		    "%s, size %lld, offset %lld\n", device_xname(sc->sc_dev),
		    uw->uw_path, uw->uw_size, uw->uw_offset));

		if ((err = utoppy_turbo_mode(sc, sc->sc_turbo_mode)) != 0)
			break;

		UTOPPY_OUT_INIT(sc);
		utoppy_add_8(sc, UTOPPY_FILE_WRITE);
		uwfp = utoppy_current_ptr(sc->sc_out_data);

		if ((err = utoppy_add_path(sc, uw->uw_path, 1)) != 0) {
			DPRINTF(UTOPPY_DBG_WRITE,("%s: utoppyioctl: add_path()"
			    " returned %d\n", device_xname(sc->sc_dev), err));
			break;
		}

		strncpy(uwf, &uwfp[2], sizeof(uwf));
		utoppy_add_64(sc, uw->uw_offset);

		err = utoppy_command(sc, UTOPPY_CMD_FILE, UTOPPY_LONG_TIMEOUT,
		    &resp);
		if (err) {
			DPRINTF(UTOPPY_DBG_WRITE,("%s: utoppyioctl: "
			    "utoppy_command(UTOPPY_CMD_FILE) returned "
			    "%d\n", device_xname(sc->sc_dev), err));
			break;
		}
		if (resp != UTOPPY_RESP_SUCCESS) {
			DPRINTF(UTOPPY_DBG_WRITE,("%s: utoppyioctl: "
			    "utoppy_command(UTOPPY_CMD_FILE) returned "
			    "bad response %#x\n", device_xname(sc->sc_dev),
			    resp));
			err = EIO;
			break;
		}

		UTOPPY_OUT_INIT(sc);
		utoppy_timestamp_encode(sc, uw->uw_mtime);
		utoppy_add_8(sc, UTOPPY_FTYPE_FILE);
		utoppy_add_64(sc, uw->uw_size);
		utoppy_add_string(sc, uwf, sizeof(uwf));
		utoppy_add_32(sc, 0);

		err = utoppy_command(sc, UTOPPY_RESP_FILE_HEADER,
		    UTOPPY_LONG_TIMEOUT, &resp);
		if (err) {
			DPRINTF(UTOPPY_DBG_WRITE,("%s: utoppyioctl: "
			    "utoppy_command(UTOPPY_RESP_FILE_HEADER) "
			    "returned %d\n", device_xname(sc->sc_dev), err));
			break;
		}
		if (resp != UTOPPY_RESP_SUCCESS) {
			DPRINTF(UTOPPY_DBG_WRITE,("%s: utoppyioctl: "
			    "utoppy_command(UTOPPY_RESP_FILE_HEADER) "
			    "returned bad response %#x\n",
			    device_xname(sc->sc_dev), resp));
			err = EIO;
			break;
		}

		sc->sc_wr_offset = uw->uw_offset;
		sc->sc_wr_size = uw->uw_size;
		sc->sc_state = UTOPPY_STATE_WRITEFILE;

		DPRINTF(UTOPPY_DBG_WRITE,("%s: utoppyioctl: Changing state to "
		    "%s. wr_offset %lld, wr_size %lld\n",
		    device_xname(sc->sc_dev), utoppy_state_string(sc->sc_state),
		    sc->sc_wr_offset, sc->sc_wr_size));
		break;

	default:
		DPRINTF(UTOPPY_DBG_IOCTL,("%s: utoppyioctl: Invalid cmd\n",
		    device_xname(sc->sc_dev)));
		err = ENODEV;
		break;
	}

	DPRINTF(UTOPPY_DBG_IOCTL,("%s: utoppyioctl: done. err %d, state '%s'\n",
	    device_xname(sc->sc_dev), err, utoppy_state_string(sc->sc_state)));

	if (err)
		utoppy_cancel(sc);

	if (--sc->sc_refcnt < 0)
		usb_detach_wakeupold(sc->sc_dev);

	return err;
}