1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3  Madge Ambassador ATM Adapter driver.
   4  Copyright (C) 1995-1999  Madge Networks Ltd.
   5
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
   6*/
   7
   8/* * dedicated to the memory of Graham Gordon 1971-1998 * */
   9
  10#include <linux/module.h>
  11#include <linux/types.h>
  12#include <linux/pci.h>
  13#include <linux/kernel.h>
  14#include <linux/init.h>
  15#include <linux/ioport.h>
  16#include <linux/atmdev.h>
  17#include <linux/delay.h>
  18#include <linux/interrupt.h>
  19#include <linux/poison.h>
  20#include <linux/bitrev.h>
  21#include <linux/mutex.h>
  22#include <linux/firmware.h>
  23#include <linux/ihex.h>
  24#include <linux/slab.h>
  25
  26#include <linux/atomic.h>
  27#include <asm/io.h>
  28#include <asm/byteorder.h>
  29
  30#include "ambassador.h"
  31
  32#define maintainer_string "Giuliano Procida at Madge Networks <gprocida@madge.com>"
  33#define description_string "Madge ATM Ambassador driver"
  34#define version_string "1.2.4"
  35
  36static inline void __init show_version (void) {
  37  printk ("%s version %s\n", description_string, version_string);
  38}
  39
  40/*
  41  
  42  Theory of Operation
  43  
  44  I Hardware, detection, initialisation and shutdown.
  45  
  46  1. Supported Hardware
  47  
  48  This driver is for the PCI ATMizer-based Ambassador card (except
  49  very early versions). It is not suitable for the similar EISA "TR7"
  50  card. Commercially, both cards are known as Collage Server ATM
  51  adapters.
  52  
  53  The loader supports image transfer to the card, image start and few
  54  other miscellaneous commands.
  55  
  56  Only AAL5 is supported with vpi = 0 and vci in the range 0 to 1023.
  57  
  58  The cards are big-endian.
  59  
  60  2. Detection
  61  
  62  Standard PCI stuff, the early cards are detected and rejected.
  63  
  64  3. Initialisation
  65  
  66  The cards are reset and the self-test results are checked. The
  67  microcode image is then transferred and started. This waits for a
  68  pointer to a descriptor containing details of the host-based queues
  69  and buffers and various parameters etc. Once they are processed
  70  normal operations may begin. The BIA is read using a microcode
  71  command.
  72  
  73  4. Shutdown
  74  
  75  This may be accomplished either by a card reset or via the microcode
  76  shutdown command. Further investigation required.
  77  
  78  5. Persistent state
  79  
  80  The card reset does not affect PCI configuration (good) or the
  81  contents of several other "shared run-time registers" (bad) which
  82  include doorbell and interrupt control as well as EEPROM and PCI
  83  control. The driver must be careful when modifying these registers
  84  not to touch bits it does not use and to undo any changes at exit.
  85  
  86  II Driver software
  87  
  88  0. Generalities
  89  
  90  The adapter is quite intelligent (fast) and has a simple interface
  91  (few features). VPI is always zero, 1024 VCIs are supported. There
  92  is limited cell rate support. UBR channels can be capped and ABR
  93  (explicit rate, but not EFCI) is supported. There is no CBR or VBR
  94  support.
  95  
  96  1. Driver <-> Adapter Communication
  97  
  98  Apart from the basic loader commands, the driver communicates
  99  through three entities: the command queue (CQ), the transmit queue
 100  pair (TXQ) and the receive queue pairs (RXQ). These three entities
 101  are set up by the host and passed to the microcode just after it has
 102  been started.
 103  
 104  All queues are host-based circular queues. They are contiguous and
 105  (due to hardware limitations) have some restrictions as to their
 106  locations in (bus) memory. They are of the "full means the same as
 107  empty so don't do that" variety since the adapter uses pointers
 108  internally.
 109  
 110  The queue pairs work as follows: one queue is for supply to the
 111  adapter, items in it are pending and are owned by the adapter; the
 112  other is the queue for return from the adapter, items in it have
 113  been dealt with by the adapter. The host adds items to the supply
 114  (TX descriptors and free RX buffer descriptors) and removes items
 115  from the return (TX and RX completions). The adapter deals with out
 116  of order completions.
 117  
 118  Interrupts (card to host) and the doorbell (host to card) are used
 119  for signalling.
 120  
 121  1. CQ
 122  
 123  This is to communicate "open VC", "close VC", "get stats" etc. to
 124  the adapter. At most one command is retired every millisecond by the
 125  card. There is no out of order completion or notification. The
 126  driver needs to check the return code of the command, waiting as
 127  appropriate.
 128  
 129  2. TXQ
 130  
 131  TX supply items are of variable length (scatter gather support) and
 132  so the queue items are (more or less) pointers to the real thing.
 133  Each TX supply item contains a unique, host-supplied handle (the skb
 134  bus address seems most sensible as this works for Alphas as well,
 135  there is no need to do any endian conversions on the handles).
 136  
 137  TX return items consist of just the handles above.
 138  
 139  3. RXQ (up to 4 of these with different lengths and buffer sizes)
 140  
 141  RX supply items consist of a unique, host-supplied handle (the skb
 142  bus address again) and a pointer to the buffer data area.
 143  
 144  RX return items consist of the handle above, the VC, length and a
 145  status word. This just screams "oh so easy" doesn't it?
 146
 147  Note on RX pool sizes:
 148   
 149  Each pool should have enough buffers to handle a back-to-back stream
 150  of minimum sized frames on a single VC. For example:
 151  
 152    frame spacing = 3us (about right)
 153    
 154    delay = IRQ lat + RX handling + RX buffer replenish = 20 (us)  (a guess)
 155    
 156    min number of buffers for one VC = 1 + delay/spacing (buffers)
 157
 158    delay/spacing = latency = (20+2)/3 = 7 (buffers)  (rounding up)
 159    
 160  The 20us delay assumes that there is no need to sleep; if we need to
 161  sleep to get buffers we are going to drop frames anyway.
 162  
 163  In fact, each pool should have enough buffers to support the
 164  simultaneous reassembly of a separate frame on each VC and cope with
 165  the case in which frames complete in round robin cell fashion on
 166  each VC.
 167  
 168  Only one frame can complete at each cell arrival, so if "n" VCs are
 169  open, the worst case is to have them all complete frames together
 170  followed by all starting new frames together.
 171  
 172    desired number of buffers = n + delay/spacing
 173    
 174  These are the extreme requirements, however, they are "n+k" for some
 175  "k" so we have only the constant to choose. This is the argument
 176  rx_lats which current defaults to 7.
 177  
 178  Actually, "n ? n+k : 0" is better and this is what is implemented,
 179  subject to the limit given by the pool size.
 180  
 181  4. Driver locking
 182  
 183  Simple spinlocks are used around the TX and RX queue mechanisms.
 184  Anyone with a faster, working method is welcome to implement it.
 185  
 186  The adapter command queue is protected with a spinlock. We always
 187  wait for commands to complete.
 188  
 189  A more complex form of locking is used around parts of the VC open
 190  and close functions. There are three reasons for a lock: 1. we need
 191  to do atomic rate reservation and release (not used yet), 2. Opening
 192  sometimes involves two adapter commands which must not be separated
 193  by another command on the same VC, 3. the changes to RX pool size
 194  must be atomic. The lock needs to work over context switches, so we
 195  use a semaphore.
 196  
 197  III Hardware Features and Microcode Bugs
 198  
 199  1. Byte Ordering
 200  
 201  *%^"$&%^$*&^"$(%^$#&^%$(&#%$*(&^#%!"!"!*!
 202  
 203  2. Memory access
 204  
 205  All structures that are not accessed using DMA must be 4-byte
 206  aligned (not a problem) and must not cross 4MB boundaries.
 207  
 208  There is a DMA memory hole at E0000000-E00000FF (groan).
 209  
 210  TX fragments (DMA read) must not cross 4MB boundaries (would be 16MB
 211  but for a hardware bug).
 212  
 213  RX buffers (DMA write) must not cross 16MB boundaries and must
 214  include spare trailing bytes up to the next 4-byte boundary; they
 215  will be written with rubbish.
 216  
 217  The PLX likes to prefetch; if reading up to 4 u32 past the end of
 218  each TX fragment is not a problem, then TX can be made to go a
 219  little faster by passing a flag at init that disables a prefetch
 220  workaround. We do not pass this flag. (new microcode only)
 221  
 222  Now we:
 223  . Note that alloc_skb rounds up size to a 16byte boundary.  
 224  . Ensure all areas do not traverse 4MB boundaries.
 225  . Ensure all areas do not start at a E00000xx bus address.
 226  (I cannot be certain, but this may always hold with Linux)
 227  . Make all failures cause a loud message.
 228  . Discard non-conforming SKBs (causes TX failure or RX fill delay).
 229  . Discard non-conforming TX fragment descriptors (the TX fails).
 230  In the future we could:
 231  . Allow RX areas that traverse 4MB (but not 16MB) boundaries.
 232  . Segment TX areas into some/more fragments, when necessary.
 233  . Relax checks for non-DMA items (ignore hole).
 234  . Give scatter-gather (iovec) requirements using ???. (?)
 235  
 236  3. VC close is broken (only for new microcode)
 237  
 238  The VC close adapter microcode command fails to do anything if any
 239  frames have been received on the VC but none have been transmitted.
 240  Frames continue to be reassembled and passed (with IRQ) to the
 241  driver.
 242  
 243  IV To Do List
 244  
 245  . Fix bugs!
 246  
 247  . Timer code may be broken.
 248  
 249  . Deal with buggy VC close (somehow) in microcode 12.
 250  
 251  . Handle interrupted and/or non-blocking writes - is this a job for
 252    the protocol layer?
 253  
 254  . Add code to break up TX fragments when they span 4MB boundaries.
 255  
 256  . Add SUNI phy layer (need to know where SUNI lives on card).
 257  
 258  . Implement a tx_alloc fn to (a) satisfy TX alignment etc. and (b)
 259    leave extra headroom space for Ambassador TX descriptors.
 260  
 261  . Understand these elements of struct atm_vcc: recvq (proto?),
 262    sleep, callback, listenq, backlog_quota, reply and user_back.
 263  
 264  . Adjust TX/RX skb allocation to favour IP with LANE/CLIP (configurable).
 265  
 266  . Impose a TX-pending limit (2?) on each VC, help avoid TX q overflow.
 267  
 268  . Decide whether RX buffer recycling is or can be made completely safe;
 269    turn it back on. It looks like Werner is going to axe this.
 270  
 271  . Implement QoS changes on open VCs (involves extracting parts of VC open
 272    and close into separate functions and using them to make changes).
 273  
 274  . Hack on command queue so that someone can issue multiple commands and wait
 275    on the last one (OR only "no-op" or "wait" commands are waited for).
 276  
 277  . Eliminate need for while-schedule around do_command.
 278  
 279*/
 280
 281static void do_housekeeping (struct timer_list *t);
 282/********** globals **********/
 283
 284static unsigned short debug = 0;
 285static unsigned int cmds = 8;
 286static unsigned int txs = 32;
 287static unsigned int rxs[NUM_RX_POOLS] = { 64, 64, 64, 64 };
 288static unsigned int rxs_bs[NUM_RX_POOLS] = { 4080, 12240, 36720, 65535 };
 289static unsigned int rx_lats = 7;
 290static unsigned char pci_lat = 0;
 291
 292static const unsigned long onegigmask = -1 << 30;
 293
 294/********** access to adapter **********/
 295
 296static inline void wr_plain (const amb_dev * dev, size_t addr, u32 data) {
 297  PRINTD (DBG_FLOW|DBG_REGS, "wr: %08zx <- %08x", addr, data);
 298#ifdef AMB_MMIO
 299  dev->membase[addr / sizeof(u32)] = data;
 300#else
 301  outl (data, dev->iobase + addr);
 302#endif
 303}
 304
 305static inline u32 rd_plain (const amb_dev * dev, size_t addr) {
 306#ifdef AMB_MMIO
 307  u32 data = dev->membase[addr / sizeof(u32)];
 308#else
 309  u32 data = inl (dev->iobase + addr);
 310#endif
 311  PRINTD (DBG_FLOW|DBG_REGS, "rd: %08zx -> %08x", addr, data);
 312  return data;
 313}
 314
 315static inline void wr_mem (const amb_dev * dev, size_t addr, u32 data) {
 316  __be32 be = cpu_to_be32 (data);
 317  PRINTD (DBG_FLOW|DBG_REGS, "wr: %08zx <- %08x b[%08x]", addr, data, be);
 318#ifdef AMB_MMIO
 319  dev->membase[addr / sizeof(u32)] = be;
 320#else
 321  outl (be, dev->iobase + addr);
 322#endif
 323}
 324
 325static inline u32 rd_mem (const amb_dev * dev, size_t addr) {
 326#ifdef AMB_MMIO
 327  __be32 be = dev->membase[addr / sizeof(u32)];
 328#else
 329  __be32 be = inl (dev->iobase + addr);
 330#endif
 331  u32 data = be32_to_cpu (be);
 332  PRINTD (DBG_FLOW|DBG_REGS, "rd: %08zx -> %08x b[%08x]", addr, data, be);
 333  return data;
 334}
 335
 336/********** dump routines **********/
 337
 338static inline void dump_registers (const amb_dev * dev) {
 339#ifdef DEBUG_AMBASSADOR
 340  if (debug & DBG_REGS) {
 341    size_t i;
 342    PRINTD (DBG_REGS, "reading PLX control: ");
 343    for (i = 0x00; i < 0x30; i += sizeof(u32))
 344      rd_mem (dev, i);
 345    PRINTD (DBG_REGS, "reading mailboxes: ");
 346    for (i = 0x40; i < 0x60; i += sizeof(u32))
 347      rd_mem (dev, i);
 348    PRINTD (DBG_REGS, "reading doorb irqev irqen reset:");
 349    for (i = 0x60; i < 0x70; i += sizeof(u32))
 350      rd_mem (dev, i);
 351  }
 352#else
 353  (void) dev;
 354#endif
 355  return;
 356}
 357
 358static inline void dump_loader_block (volatile loader_block * lb) {
 359#ifdef DEBUG_AMBASSADOR
 360  unsigned int i;
 361  PRINTDB (DBG_LOAD, "lb @ %p; res: %d, cmd: %d, pay:",
 362	   lb, be32_to_cpu (lb->result), be32_to_cpu (lb->command));
 363  for (i = 0; i < MAX_COMMAND_DATA; ++i)
 364    PRINTDM (DBG_LOAD, " %08x", be32_to_cpu (lb->payload.data[i]));
 365  PRINTDE (DBG_LOAD, ", vld: %08x", be32_to_cpu (lb->valid));
 366#else
 367  (void) lb;
 368#endif
 369  return;
 370}
 371
 372static inline void dump_command (command * cmd) {
 373#ifdef DEBUG_AMBASSADOR
 374  unsigned int i;
 375  PRINTDB (DBG_CMD, "cmd @ %p, req: %08x, pars:",
 376	   cmd, /*be32_to_cpu*/ (cmd->request));
 377  for (i = 0; i < 3; ++i)
 378    PRINTDM (DBG_CMD, " %08x", /*be32_to_cpu*/ (cmd->args.par[i]));
 379  PRINTDE (DBG_CMD, "");
 380#else
 381  (void) cmd;
 382#endif
 383  return;
 384}
 385
 386static inline void dump_skb (char * prefix, unsigned int vc, struct sk_buff * skb) {
 387#ifdef DEBUG_AMBASSADOR
 388  unsigned int i;
 389  unsigned char * data = skb->data;
 390  PRINTDB (DBG_DATA, "%s(%u) ", prefix, vc);
 391  for (i=0; i<skb->len && i < 256;i++)
 392    PRINTDM (DBG_DATA, "%02x ", data[i]);
 393  PRINTDE (DBG_DATA,"");
 394#else
 395  (void) prefix;
 396  (void) vc;
 397  (void) skb;
 398#endif
 399  return;
 400}
 401
 402/********** check memory areas for use by Ambassador **********/
 403
 404/* see limitations under Hardware Features */
 405
 406static int check_area (void * start, size_t length) {
 407  // assumes length > 0
 408  const u32 fourmegmask = -1 << 22;
 409  const u32 twofivesixmask = -1 << 8;
 410  const u32 starthole = 0xE0000000;
 411  u32 startaddress = virt_to_bus (start);
 412  u32 lastaddress = startaddress+length-1;
 413  if ((startaddress ^ lastaddress) & fourmegmask ||
 414      (startaddress & twofivesixmask) == starthole) {
 415    PRINTK (KERN_ERR, "check_area failure: [%x,%x] - mail maintainer!",
 416	    startaddress, lastaddress);
 417    return -1;
 418  } else {
 419    return 0;
 420  }
 421}
 422
 423/********** free an skb (as per ATM device driver documentation) **********/
 424
 425static void amb_kfree_skb (struct sk_buff * skb) {
 426  if (ATM_SKB(skb)->vcc->pop) {
 427    ATM_SKB(skb)->vcc->pop (ATM_SKB(skb)->vcc, skb);
 428  } else {
 429    dev_kfree_skb_any (skb);
 430  }
 431}
 432
 433/********** TX completion **********/
 434
 435static void tx_complete (amb_dev * dev, tx_out * tx) {
 436  tx_simple * tx_descr = bus_to_virt (tx->handle);
 437  struct sk_buff * skb = tx_descr->skb;
 438  
 439  PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
 440  
 441  // VC layer stats
 442  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
 443  
 444  // free the descriptor
 445  kfree (tx_descr);
 446  
 447  // free the skb
 448  amb_kfree_skb (skb);
 449  
 450  dev->stats.tx_ok++;
 451  return;
 452}
 453
 454/********** RX completion **********/
 455
 456static void rx_complete (amb_dev * dev, rx_out * rx) {
 457  struct sk_buff * skb = bus_to_virt (rx->handle);
 458  u16 vc = be16_to_cpu (rx->vc);
 459  // unused: u16 lec_id = be16_to_cpu (rx->lec_id);
 460  u16 status = be16_to_cpu (rx->status);
 461  u16 rx_len = be16_to_cpu (rx->length);
 462  
 463  PRINTD (DBG_FLOW|DBG_RX, "rx_complete %p %p (len=%hu)", dev, rx, rx_len);
 464  
 465  // XXX move this in and add to VC stats ???
 466  if (!status) {
 467    struct atm_vcc * atm_vcc = dev->rxer[vc];
 468    dev->stats.rx.ok++;
 469    
 470    if (atm_vcc) {
 471      
 472      if (rx_len <= atm_vcc->qos.rxtp.max_sdu) {
 473	
 474	if (atm_charge (atm_vcc, skb->truesize)) {
 475	  
 476	  // prepare socket buffer
 477	  ATM_SKB(skb)->vcc = atm_vcc;
 478	  skb_put (skb, rx_len);
 479	  
 480	  dump_skb ("<<<", vc, skb);
 481	  
 482	  // VC layer stats
 483	  atomic_inc(&atm_vcc->stats->rx);
 484	  __net_timestamp(skb);
 485	  // end of our responsibility
 486	  atm_vcc->push (atm_vcc, skb);
 487	  return;
 488	  
 489	} else {
 490	  // someone fix this (message), please!
 491	  PRINTD (DBG_INFO|DBG_RX, "dropped thanks to atm_charge (vc %hu, truesize %u)", vc, skb->truesize);
 492	  // drop stats incremented in atm_charge
 493	}
 494	
 495      } else {
 496      	PRINTK (KERN_INFO, "dropped over-size frame");
 497	// should we count this?
 498	atomic_inc(&atm_vcc->stats->rx_drop);
 499      }
 500      
 501    } else {
 502      PRINTD (DBG_WARN|DBG_RX, "got frame but RX closed for channel %hu", vc);
 503      // this is an adapter bug, only in new version of microcode
 504    }
 505    
 506  } else {
 507    dev->stats.rx.error++;
 508    if (status & CRC_ERR)
 509      dev->stats.rx.badcrc++;
 510    if (status & LEN_ERR)
 511      dev->stats.rx.toolong++;
 512    if (status & ABORT_ERR)
 513      dev->stats.rx.aborted++;
 514    if (status & UNUSED_ERR)
 515      dev->stats.rx.unused++;
 516  }
 517  
 518  dev_kfree_skb_any (skb);
 519  return;
 520}
 521
 522/*
 523  
 524  Note on queue handling.
 525  
 526  Here "give" and "take" refer to queue entries and a queue (pair)
 527  rather than frames to or from the host or adapter. Empty frame
 528  buffers are given to the RX queue pair and returned unused or
 529  containing RX frames. TX frames (well, pointers to TX fragment
 530  lists) are given to the TX queue pair, completions are returned.
 531  
 532*/
 533
 534/********** command queue **********/
 535
 536// I really don't like this, but it's the best I can do at the moment
 537
 538// also, the callers are responsible for byte order as the microcode
 539// sometimes does 16-bit accesses (yuk yuk yuk)
 540
 541static int command_do (amb_dev * dev, command * cmd) {
 542  amb_cq * cq = &dev->cq;
 543  volatile amb_cq_ptrs * ptrs = &cq->ptrs;
 544  command * my_slot;
 545  
 546  PRINTD (DBG_FLOW|DBG_CMD, "command_do %p", dev);
 547  
 548  if (test_bit (dead, &dev->flags))
 549    return 0;
 550  
 551  spin_lock (&cq->lock);
 552  
 553  // if not full...
 554  if (cq->pending < cq->maximum) {
 555    // remember my slot for later
 556    my_slot = ptrs->in;
 557    PRINTD (DBG_CMD, "command in slot %p", my_slot);
 558    
 559    dump_command (cmd);
 560    
 561    // copy command in
 562    *ptrs->in = *cmd;
 563    cq->pending++;
 564    ptrs->in = NEXTQ (ptrs->in, ptrs->start, ptrs->limit);
 565    
 566    // mail the command
 567    wr_mem (dev, offsetof(amb_mem, mb.adapter.cmd_address), virt_to_bus (ptrs->in));
 568    
 569    if (cq->pending > cq->high)
 570      cq->high = cq->pending;
 571    spin_unlock (&cq->lock);
 572    
 573    // these comments were in a while-loop before, msleep removes the loop
 574    // go to sleep
 575    // PRINTD (DBG_CMD, "wait: sleeping %lu for command", timeout);
 576    msleep(cq->pending);
 577    
 578    // wait for my slot to be reached (all waiters are here or above, until...)
 579    while (ptrs->out != my_slot) {
 580      PRINTD (DBG_CMD, "wait: command slot (now at %p)", ptrs->out);
 581      set_current_state(TASK_UNINTERRUPTIBLE);
 582      schedule();
 583    }
 584    
 585    // wait on my slot (... one gets to its slot, and... )
 586    while (ptrs->out->request != cpu_to_be32 (SRB_COMPLETE)) {
 587      PRINTD (DBG_CMD, "wait: command slot completion");
 588      set_current_state(TASK_UNINTERRUPTIBLE);
 589      schedule();
 590    }
 591    
 592    PRINTD (DBG_CMD, "command complete");
 593    // update queue (... moves the queue along to the next slot)
 594    spin_lock (&cq->lock);
 595    cq->pending--;
 596    // copy command out
 597    *cmd = *ptrs->out;
 598    ptrs->out = NEXTQ (ptrs->out, ptrs->start, ptrs->limit);
 599    spin_unlock (&cq->lock);
 600    
 601    return 0;
 602  } else {
 603    cq->filled++;
 604    spin_unlock (&cq->lock);
 605    return -EAGAIN;
 606  }
 607  
 608}
 609
 610/********** TX queue pair **********/
 611
 612static int tx_give (amb_dev * dev, tx_in * tx) {
 613  amb_txq * txq = &dev->txq;
 614  unsigned long flags;
 615  
 616  PRINTD (DBG_FLOW|DBG_TX, "tx_give %p", dev);
 617
 618  if (test_bit (dead, &dev->flags))
 619    return 0;
 620  
 621  spin_lock_irqsave (&txq->lock, flags);
 622  
 623  if (txq->pending < txq->maximum) {
 624    PRINTD (DBG_TX, "TX in slot %p", txq->in.ptr);
 625
 626    *txq->in.ptr = *tx;
 627    txq->pending++;
 628    txq->in.ptr = NEXTQ (txq->in.ptr, txq->in.start, txq->in.limit);
 629    // hand over the TX and ring the bell
 630    wr_mem (dev, offsetof(amb_mem, mb.adapter.tx_address), virt_to_bus (txq->in.ptr));
 631    wr_mem (dev, offsetof(amb_mem, doorbell), TX_FRAME);
 632    
 633    if (txq->pending > txq->high)
 634      txq->high = txq->pending;
 635    spin_unlock_irqrestore (&txq->lock, flags);
 636    return 0;
 637  } else {
 638    txq->filled++;
 639    spin_unlock_irqrestore (&txq->lock, flags);
 640    return -EAGAIN;
 641  }
 642}
 643
 644static int tx_take (amb_dev * dev) {
 645  amb_txq * txq = &dev->txq;
 646  unsigned long flags;
 647  
 648  PRINTD (DBG_FLOW|DBG_TX, "tx_take %p", dev);
 649  
 650  spin_lock_irqsave (&txq->lock, flags);
 651  
 652  if (txq->pending && txq->out.ptr->handle) {
 653    // deal with TX completion
 654    tx_complete (dev, txq->out.ptr);
 655    // mark unused again
 656    txq->out.ptr->handle = 0;
 657    // remove item
 658    txq->pending--;
 659    txq->out.ptr = NEXTQ (txq->out.ptr, txq->out.start, txq->out.limit);
 660    
 661    spin_unlock_irqrestore (&txq->lock, flags);
 662    return 0;
 663  } else {
 664    
 665    spin_unlock_irqrestore (&txq->lock, flags);
 666    return -1;
 667  }
 668}
 669
 670/********** RX queue pairs **********/
 671
 672static int rx_give (amb_dev * dev, rx_in * rx, unsigned char pool) {
 673  amb_rxq * rxq = &dev->rxq[pool];
 674  unsigned long flags;
 675  
 676  PRINTD (DBG_FLOW|DBG_RX, "rx_give %p[%hu]", dev, pool);
 677  
 678  spin_lock_irqsave (&rxq->lock, flags);
 679  
 680  if (rxq->pending < rxq->maximum) {
 681    PRINTD (DBG_RX, "RX in slot %p", rxq->in.ptr);
 682
 683    *rxq->in.ptr = *rx;
 684    rxq->pending++;
 685    rxq->in.ptr = NEXTQ (rxq->in.ptr, rxq->in.start, rxq->in.limit);
 686    // hand over the RX buffer
 687    wr_mem (dev, offsetof(amb_mem, mb.adapter.rx_address[pool]), virt_to_bus (rxq->in.ptr));
 688    
 689    spin_unlock_irqrestore (&rxq->lock, flags);
 690    return 0;
 691  } else {
 692    spin_unlock_irqrestore (&rxq->lock, flags);
 693    return -1;
 694  }
 695}
 696
 697static int rx_take (amb_dev * dev, unsigned char pool) {
 698  amb_rxq * rxq = &dev->rxq[pool];
 699  unsigned long flags;
 700  
 701  PRINTD (DBG_FLOW|DBG_RX, "rx_take %p[%hu]", dev, pool);
 702  
 703  spin_lock_irqsave (&rxq->lock, flags);
 704  
 705  if (rxq->pending && (rxq->out.ptr->status || rxq->out.ptr->length)) {
 706    // deal with RX completion
 707    rx_complete (dev, rxq->out.ptr);
 708    // mark unused again
 709    rxq->out.ptr->status = 0;
 710    rxq->out.ptr->length = 0;
 711    // remove item
 712    rxq->pending--;
 713    rxq->out.ptr = NEXTQ (rxq->out.ptr, rxq->out.start, rxq->out.limit);
 714    
 715    if (rxq->pending < rxq->low)
 716      rxq->low = rxq->pending;
 717    spin_unlock_irqrestore (&rxq->lock, flags);
 718    return 0;
 719  } else {
 720    if (!rxq->pending && rxq->buffers_wanted)
 721      rxq->emptied++;
 722    spin_unlock_irqrestore (&rxq->lock, flags);
 723    return -1;
 724  }
 725}
 726
 727/********** RX Pool handling **********/
 728
 729/* pre: buffers_wanted = 0, post: pending = 0 */
 730static void drain_rx_pool (amb_dev * dev, unsigned char pool) {
 731  amb_rxq * rxq = &dev->rxq[pool];
 732  
 733  PRINTD (DBG_FLOW|DBG_POOL, "drain_rx_pool %p %hu", dev, pool);
 734  
 735  if (test_bit (dead, &dev->flags))
 736    return;
 737  
 738  /* we are not quite like the fill pool routines as we cannot just
 739     remove one buffer, we have to remove all of them, but we might as
 740     well pretend... */
 741  if (rxq->pending > rxq->buffers_wanted) {
 742    command cmd;
 743    cmd.request = cpu_to_be32 (SRB_FLUSH_BUFFER_Q);
 744    cmd.args.flush.flags = cpu_to_be32 (pool << SRB_POOL_SHIFT);
 745    while (command_do (dev, &cmd))
 746      schedule();
 747    /* the pool may also be emptied via the interrupt handler */
 748    while (rxq->pending > rxq->buffers_wanted)
 749      if (rx_take (dev, pool))
 750	schedule();
 751  }
 752  
 753  return;
 754}
 755
 756static void drain_rx_pools (amb_dev * dev) {
 757  unsigned char pool;
 758  
 759  PRINTD (DBG_FLOW|DBG_POOL, "drain_rx_pools %p", dev);
 760  
 761  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
 762    drain_rx_pool (dev, pool);
 763}
 764
 765static void fill_rx_pool (amb_dev * dev, unsigned char pool,
 766                                 gfp_t priority)
 767{
 768  rx_in rx;
 769  amb_rxq * rxq;
 770  
 771  PRINTD (DBG_FLOW|DBG_POOL, "fill_rx_pool %p %hu %x", dev, pool, priority);
 772  
 773  if (test_bit (dead, &dev->flags))
 774    return;
 775  
 776  rxq = &dev->rxq[pool];
 777  while (rxq->pending < rxq->maximum && rxq->pending < rxq->buffers_wanted) {
 778    
 779    struct sk_buff * skb = alloc_skb (rxq->buffer_size, priority);
 780    if (!skb) {
 781      PRINTD (DBG_SKB|DBG_POOL, "failed to allocate skb for RX pool %hu", pool);
 782      return;
 783    }
 784    if (check_area (skb->data, skb->truesize)) {
 785      dev_kfree_skb_any (skb);
 786      return;
 787    }
 788    // cast needed as there is no %? for pointer differences
 789    PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
 790	    skb, skb->head, (long) skb_end_offset(skb));
 791    rx.handle = virt_to_bus (skb);
 792    rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
 793    if (rx_give (dev, &rx, pool))
 794      dev_kfree_skb_any (skb);
 795    
 796  }
 797  
 798  return;
 799}
 800
 801// top up all RX pools
 802static void fill_rx_pools (amb_dev * dev) {
 803  unsigned char pool;
 804  
 805  PRINTD (DBG_FLOW|DBG_POOL, "fill_rx_pools %p", dev);
 806  
 807  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
 808    fill_rx_pool (dev, pool, GFP_ATOMIC);
 809  
 810  return;
 811}
 812
 813/********** enable host interrupts **********/
 814
 815static void interrupts_on (amb_dev * dev) {
 816  wr_plain (dev, offsetof(amb_mem, interrupt_control),
 817	    rd_plain (dev, offsetof(amb_mem, interrupt_control))
 818	    | AMB_INTERRUPT_BITS);
 819}
 820
 821/********** disable host interrupts **********/
 822
 823static void interrupts_off (amb_dev * dev) {
 824  wr_plain (dev, offsetof(amb_mem, interrupt_control),
 825	    rd_plain (dev, offsetof(amb_mem, interrupt_control))
 826	    &~ AMB_INTERRUPT_BITS);
 827}
 828
 829/********** interrupt handling **********/
 830
 831static irqreturn_t interrupt_handler(int irq, void *dev_id) {
 832  amb_dev * dev = dev_id;
 833  
 834  PRINTD (DBG_IRQ|DBG_FLOW, "interrupt_handler: %p", dev_id);
 835  
 836  {
 837    u32 interrupt = rd_plain (dev, offsetof(amb_mem, interrupt));
 838  
 839    // for us or someone else sharing the same interrupt
 840    if (!interrupt) {
 841      PRINTD (DBG_IRQ, "irq not for me: %d", irq);
 842      return IRQ_NONE;
 843    }
 844    
 845    // definitely for us
 846    PRINTD (DBG_IRQ, "FYI: interrupt was %08x", interrupt);
 847    wr_plain (dev, offsetof(amb_mem, interrupt), -1);
 848  }
 849  
 850  {
 851    unsigned int irq_work = 0;
 852    unsigned char pool;
 853    for (pool = 0; pool < NUM_RX_POOLS; ++pool)
 854      while (!rx_take (dev, pool))
 855	++irq_work;
 856    while (!tx_take (dev))
 857      ++irq_work;
 858  
 859    if (irq_work) {
 860      fill_rx_pools (dev);
 861
 862      PRINTD (DBG_IRQ, "work done: %u", irq_work);
 863    } else {
 864      PRINTD (DBG_IRQ|DBG_WARN, "no work done");
 865    }
 866  }
 867  
 868  PRINTD (DBG_IRQ|DBG_FLOW, "interrupt_handler done: %p", dev_id);
 869  return IRQ_HANDLED;
 870}
 871
 872/********** make rate (not quite as much fun as Horizon) **********/
 873
 874static int make_rate (unsigned int rate, rounding r,
 875		      u16 * bits, unsigned int * actual) {
 876  unsigned char exp = -1; // hush gcc
 877  unsigned int man = -1;  // hush gcc
 878  
 879  PRINTD (DBG_FLOW|DBG_QOS, "make_rate %u", rate);
 880  
 881  // rates in cells per second, ITU format (nasty 16-bit floating-point)
 882  // given 5-bit e and 9-bit m:
 883  // rate = EITHER (1+m/2^9)*2^e    OR 0
 884  // bits = EITHER 1<<14 | e<<9 | m OR 0
 885  // (bit 15 is "reserved", bit 14 "non-zero")
 886  // smallest rate is 0 (special representation)
 887  // largest rate is (1+511/512)*2^31 = 4290772992 (< 2^32-1)
 888  // smallest non-zero rate is (1+0/512)*2^0 = 1 (> 0)
 889  // simple algorithm:
 890  // find position of top bit, this gives e
 891  // remove top bit and shift (rounding if feeling clever) by 9-e
 892  
 893  // ucode bug: please don't set bit 14! so 0 rate not representable
 894  
 895  if (rate > 0xffc00000U) {
 896    // larger than largest representable rate
 897    
 898    if (r == round_up) {
 899	return -EINVAL;
 900    } else {
 901      exp = 31;
 902      man = 511;
 903    }
 904    
 905  } else if (rate) {
 906    // representable rate
 907    
 908    exp = 31;
 909    man = rate;
 910    
 911    // invariant: rate = man*2^(exp-31)
 912    while (!(man & (1<<31))) {
 913      exp = exp - 1;
 914      man = man<<1;
 915    }
 916    
 917    // man has top bit set
 918    // rate = (2^31+(man-2^31))*2^(exp-31)
 919    // rate = (1+(man-2^31)/2^31)*2^exp
 920    man = man<<1;
 921    man &= 0xffffffffU; // a nop on 32-bit systems
 922    // rate = (1+man/2^32)*2^exp
 923    
 924    // exp is in the range 0 to 31, man is in the range 0 to 2^32-1
 925    // time to lose significance... we want m in the range 0 to 2^9-1
 926    // rounding presents a minor problem... we first decide which way
 927    // we are rounding (based on given rounding direction and possibly
 928    // the bits of the mantissa that are to be discarded).
 929    
 930    switch (r) {
 931      case round_down: {
 932	// just truncate
 933	man = man>>(32-9);
 934	break;
 935      }
 936      case round_up: {
 937	// check all bits that we are discarding
 938	if (man & (~0U>>9)) {
 939	  man = (man>>(32-9)) + 1;
 940	  if (man == (1<<9)) {
 941	    // no need to check for round up outside of range
 942	    man = 0;
 943	    exp += 1;
 944	  }
 945	} else {
 946	  man = (man>>(32-9));
 947	}
 948	break;
 949      }
 950      case round_nearest: {
 951	// check msb that we are discarding
 952	if (man & (1<<(32-9-1))) {
 953	  man = (man>>(32-9)) + 1;
 954	  if (man == (1<<9)) {
 955	    // no need to check for round up outside of range
 956	    man = 0;
 957	    exp += 1;
 958	  }
 959	} else {
 960	  man = (man>>(32-9));
 961	}
 962	break;
 963      }
 964    }
 965    
 966  } else {
 967    // zero rate - not representable
 968    
 969    if (r == round_down) {
 970      return -EINVAL;
 971    } else {
 972      exp = 0;
 973      man = 0;
 974    }
 975    
 976  }
 977  
 978  PRINTD (DBG_QOS, "rate: man=%u, exp=%hu", man, exp);
 979  
 980  if (bits)
 981    *bits = /* (1<<14) | */ (exp<<9) | man;
 982  
 983  if (actual)
 984    *actual = (exp >= 9)
 985      ? (1 << exp) + (man << (exp-9))
 986      : (1 << exp) + ((man + (1<<(9-exp-1))) >> (9-exp));
 987  
 988  return 0;
 989}
 990
 991/********** Linux ATM Operations **********/
 992
 993// some are not yet implemented while others do not make sense for
 994// this device
 995
 996/********** Open a VC **********/
 997
 998static int amb_open (struct atm_vcc * atm_vcc)
 999{
1000  int error;
1001  
1002  struct atm_qos * qos;
1003  struct atm_trafprm * txtp;
1004  struct atm_trafprm * rxtp;
1005  u16 tx_rate_bits = -1; // hush gcc
1006  u16 tx_vc_bits = -1; // hush gcc
1007  u16 tx_frame_bits = -1; // hush gcc
1008  
1009  amb_dev * dev = AMB_DEV(atm_vcc->dev);
1010  amb_vcc * vcc;
1011  unsigned char pool = -1; // hush gcc
1012  short vpi = atm_vcc->vpi;
1013  int vci = atm_vcc->vci;
1014  
1015  PRINTD (DBG_FLOW|DBG_VCC, "amb_open %x %x", vpi, vci);
1016  
1017#ifdef ATM_VPI_UNSPEC
1018  // UNSPEC is deprecated, remove this code eventually
1019  if (vpi == ATM_VPI_UNSPEC || vci == ATM_VCI_UNSPEC) {
1020    PRINTK (KERN_WARNING, "rejecting open with unspecified VPI/VCI (deprecated)");
1021    return -EINVAL;
1022  }
1023#endif
1024  
1025  if (!(0 <= vpi && vpi < (1<<NUM_VPI_BITS) &&
1026	0 <= vci && vci < (1<<NUM_VCI_BITS))) {
1027    PRINTD (DBG_WARN|DBG_VCC, "VPI/VCI out of range: %hd/%d", vpi, vci);
1028    return -EINVAL;
1029  }
1030  
1031  qos = &atm_vcc->qos;
1032  
1033  if (qos->aal != ATM_AAL5) {
1034    PRINTD (DBG_QOS, "AAL not supported");
1035    return -EINVAL;
1036  }
1037  
1038  // traffic parameters
1039  
1040  PRINTD (DBG_QOS, "TX:");
1041  txtp = &qos->txtp;
1042  if (txtp->traffic_class != ATM_NONE) {
1043    switch (txtp->traffic_class) {
1044      case ATM_UBR: {
1045	// we take "the PCR" as a rate-cap
1046	int pcr = atm_pcr_goal (txtp);
1047	if (!pcr) {
1048	  // no rate cap
1049	  tx_rate_bits = 0;
1050	  tx_vc_bits = TX_UBR;
1051	  tx_frame_bits = TX_FRAME_NOTCAP;
1052	} else {
1053	  rounding r;
1054	  if (pcr < 0) {
1055	    r = round_down;
1056	    pcr = -pcr;
1057	  } else {
1058	    r = round_up;
1059	  }
1060	  error = make_rate (pcr, r, &tx_rate_bits, NULL);
1061	  if (error)
1062	    return error;
1063	  tx_vc_bits = TX_UBR_CAPPED;
1064	  tx_frame_bits = TX_FRAME_CAPPED;
1065	}
1066	break;
1067      }
1068#if 0
1069      case ATM_ABR: {
1070	pcr = atm_pcr_goal (txtp);
1071	PRINTD (DBG_QOS, "pcr goal = %d", pcr);
1072	break;
1073      }
1074#endif
1075      default: {
1076	// PRINTD (DBG_QOS, "request for non-UBR/ABR denied");
1077	PRINTD (DBG_QOS, "request for non-UBR denied");
1078	return -EINVAL;
1079      }
1080    }
1081    PRINTD (DBG_QOS, "tx_rate_bits=%hx, tx_vc_bits=%hx",
1082	    tx_rate_bits, tx_vc_bits);
1083  }
1084  
1085  PRINTD (DBG_QOS, "RX:");
1086  rxtp = &qos->rxtp;
1087  if (rxtp->traffic_class == ATM_NONE) {
1088    // do nothing
1089  } else {
1090    // choose an RX pool (arranged in increasing size)
1091    for (pool = 0; pool < NUM_RX_POOLS; ++pool)
1092      if ((unsigned int) rxtp->max_sdu <= dev->rxq[pool].buffer_size) {
1093	PRINTD (DBG_VCC|DBG_QOS|DBG_POOL, "chose pool %hu (max_sdu %u <= %u)",
1094		pool, rxtp->max_sdu, dev->rxq[pool].buffer_size);
1095	break;
1096      }
1097    if (pool == NUM_RX_POOLS) {
1098      PRINTD (DBG_WARN|DBG_VCC|DBG_QOS|DBG_POOL,
1099	      "no pool suitable for VC (RX max_sdu %d is too large)",
1100	      rxtp->max_sdu);
1101      return -EINVAL;
1102    }
1103    
1104    switch (rxtp->traffic_class) {
1105      case ATM_UBR: {
1106	break;
1107      }
1108#if 0
1109      case ATM_ABR: {
1110	pcr = atm_pcr_goal (rxtp);
1111	PRINTD (DBG_QOS, "pcr goal = %d", pcr);
1112	break;
1113      }
1114#endif
1115      default: {
1116	// PRINTD (DBG_QOS, "request for non-UBR/ABR denied");
1117	PRINTD (DBG_QOS, "request for non-UBR denied");
1118	return -EINVAL;
1119      }
1120    }
1121  }
1122  
1123  // get space for our vcc stuff
1124  vcc = kmalloc (sizeof(amb_vcc), GFP_KERNEL);
1125  if (!vcc) {
1126    PRINTK (KERN_ERR, "out of memory!");
1127    return -ENOMEM;
1128  }
1129  atm_vcc->dev_data = (void *) vcc;
1130  
1131  // no failures beyond this point
1132  
1133  // we are not really "immediately before allocating the connection
1134  // identifier in hardware", but it will just have to do!
1135  set_bit(ATM_VF_ADDR,&atm_vcc->flags);
1136  
1137  if (txtp->traffic_class != ATM_NONE) {
1138    command cmd;
1139    
1140    vcc->tx_frame_bits = tx_frame_bits;
1141    
1142    mutex_lock(&dev->vcc_sf);
1143    if (dev->rxer[vci]) {
1144      // RXer on the channel already, just modify rate...
1145      cmd.request = cpu_to_be32 (SRB_MODIFY_VC_RATE);
1146      cmd.args.modify_rate.vc = cpu_to_be32 (vci);  // vpi 0
1147      cmd.args.modify_rate.rate = cpu_to_be32 (tx_rate_bits << SRB_RATE_SHIFT);
1148      while (command_do (dev, &cmd))
1149	schedule();
1150      // ... and TX flags, preserving the RX pool
1151      cmd.request = cpu_to_be32 (SRB_MODIFY_VC_FLAGS);
1152      cmd.args.modify_flags.vc = cpu_to_be32 (vci);  // vpi 0
1153      cmd.args.modify_flags.flags = cpu_to_be32
1154	( (AMB_VCC(dev->rxer[vci])->rx_info.pool << SRB_POOL_SHIFT)
1155	  | (tx_vc_bits << SRB_FLAGS_SHIFT) );
1156      while (command_do (dev, &cmd))
1157	schedule();
1158    } else {
1159      // no RXer on the channel, just open (with pool zero)
1160      cmd.request = cpu_to_be32 (SRB_OPEN_VC);
1161      cmd.args.open.vc = cpu_to_be32 (vci);  // vpi 0
1162      cmd.args.open.flags = cpu_to_be32 (tx_vc_bits << SRB_FLAGS_SHIFT);
1163      cmd.args.open.rate = cpu_to_be32 (tx_rate_bits << SRB_RATE_SHIFT);
1164      while (command_do (dev, &cmd))
1165	schedule();
1166    }
1167    dev->txer[vci].tx_present = 1;
1168    mutex_unlock(&dev->vcc_sf);
1169  }
1170  
1171  if (rxtp->traffic_class != ATM_NONE) {
1172    command cmd;
1173    
1174    vcc->rx_info.pool = pool;
1175    
1176    mutex_lock(&dev->vcc_sf);
1177    /* grow RX buffer pool */
1178    if (!dev->rxq[pool].buffers_wanted)
1179      dev->rxq[pool].buffers_wanted = rx_lats;
1180    dev->rxq[pool].buffers_wanted += 1;
1181    fill_rx_pool (dev, pool, GFP_KERNEL);
1182    
1183    if (dev->txer[vci].tx_present) {
1184      // TXer on the channel already
1185      // switch (from pool zero) to this pool, preserving the TX bits
1186      cmd.request = cpu_to_be32 (SRB_MODIFY_VC_FLAGS);
1187      cmd.args.modify_flags.vc = cpu_to_be32 (vci);  // vpi 0
1188      cmd.args.modify_flags.flags = cpu_to_be32
1189	( (pool << SRB_POOL_SHIFT)
1190	  | (dev->txer[vci].tx_vc_bits << SRB_FLAGS_SHIFT) );
1191    } else {
1192      // no TXer on the channel, open the VC (with no rate info)
1193      cmd.request = cpu_to_be32 (SRB_OPEN_VC);
1194      cmd.args.open.vc = cpu_to_be32 (vci);  // vpi 0
1195      cmd.args.open.flags = cpu_to_be32 (pool << SRB_POOL_SHIFT);
1196      cmd.args.open.rate = cpu_to_be32 (0);
1197    }
1198    while (command_do (dev, &cmd))
1199      schedule();
1200    // this link allows RX frames through
1201    dev->rxer[vci] = atm_vcc;
1202    mutex_unlock(&dev->vcc_sf);
1203  }
1204  
1205  // indicate readiness
1206  set_bit(ATM_VF_READY,&atm_vcc->flags);
1207  
1208  return 0;
1209}
1210
1211/********** Close a VC **********/
1212
1213static void amb_close (struct atm_vcc * atm_vcc) {
1214  amb_dev * dev = AMB_DEV (atm_vcc->dev);
1215  amb_vcc * vcc = AMB_VCC (atm_vcc);
1216  u16 vci = atm_vcc->vci;
1217  
1218  PRINTD (DBG_VCC|DBG_FLOW, "amb_close");
1219  
1220  // indicate unreadiness
1221  clear_bit(ATM_VF_READY,&atm_vcc->flags);
1222  
1223  // disable TXing
1224  if (atm_vcc->qos.txtp.traffic_class != ATM_NONE) {
1225    command cmd;
1226    
1227    mutex_lock(&dev->vcc_sf);
1228    if (dev->rxer[vci]) {
1229      // RXer still on the channel, just modify rate... XXX not really needed
1230      cmd.request = cpu_to_be32 (SRB_MODIFY_VC_RATE);
1231      cmd.args.modify_rate.vc = cpu_to_be32 (vci);  // vpi 0
1232      cmd.args.modify_rate.rate = cpu_to_be32 (0);
1233      // ... and clear TX rate flags (XXX to stop RM cell output?), preserving RX pool
1234    } else {
1235      // no RXer on the channel, close channel
1236      cmd.request = cpu_to_be32 (SRB_CLOSE_VC);
1237      cmd.args.close.vc = cpu_to_be32 (vci); // vpi 0
1238    }
1239    dev->txer[vci].tx_present = 0;
1240    while (command_do (dev, &cmd))
1241      schedule();
1242    mutex_unlock(&dev->vcc_sf);
1243  }
1244  
1245  // disable RXing
1246  if (atm_vcc->qos.rxtp.traffic_class != ATM_NONE) {
1247    command cmd;
1248    
1249    // this is (the?) one reason why we need the amb_vcc struct
1250    unsigned char pool = vcc->rx_info.pool;
1251    
1252    mutex_lock(&dev->vcc_sf);
1253    if (dev->txer[vci].tx_present) {
1254      // TXer still on the channel, just go to pool zero XXX not really needed
1255      cmd.request = cpu_to_be32 (SRB_MODIFY_VC_FLAGS);
1256      cmd.args.modify_flags.vc = cpu_to_be32 (vci);  // vpi 0
1257      cmd.args.modify_flags.flags = cpu_to_be32
1258	(dev->txer[vci].tx_vc_bits << SRB_FLAGS_SHIFT);
1259    } else {
1260      // no TXer on the channel, close the VC
1261      cmd.request = cpu_to_be32 (SRB_CLOSE_VC);
1262      cmd.args.close.vc = cpu_to_be32 (vci); // vpi 0
1263    }
1264    // forget the rxer - no more skbs will be pushed
1265    if (atm_vcc != dev->rxer[vci])
1266      PRINTK (KERN_ERR, "%s vcc=%p rxer[vci]=%p",
1267	      "arghhh! we're going to die!",
1268	      vcc, dev->rxer[vci]);
1269    dev->rxer[vci] = NULL;
1270    while (command_do (dev, &cmd))
1271      schedule();
1272    
1273    /* shrink RX buffer pool */
1274    dev->rxq[pool].buffers_wanted -= 1;
1275    if (dev->rxq[pool].buffers_wanted == rx_lats) {
1276      dev->rxq[pool].buffers_wanted = 0;
1277      drain_rx_pool (dev, pool);
1278    }
1279    mutex_unlock(&dev->vcc_sf);
1280  }
1281  
1282  // free our structure
1283  kfree (vcc);
1284  
1285  // say the VPI/VCI is free again
1286  clear_bit(ATM_VF_ADDR,&atm_vcc->flags);
1287
1288  return;
1289}
1290
1291/********** Send **********/
1292
1293static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
1294  amb_dev * dev = AMB_DEV(atm_vcc->dev);
1295  amb_vcc * vcc = AMB_VCC(atm_vcc);
1296  u16 vc = atm_vcc->vci;
1297  unsigned int tx_len = skb->len;
1298  unsigned char * tx_data = skb->data;
1299  tx_simple * tx_descr;
1300  tx_in tx;
1301  
1302  if (test_bit (dead, &dev->flags))
1303    return -EIO;
1304  
1305  PRINTD (DBG_FLOW|DBG_TX, "amb_send vc %x data %p len %u",
1306	  vc, tx_data, tx_len);
1307  
1308  dump_skb (">>>", vc, skb);
1309  
1310  if (!dev->txer[vc].tx_present) {
1311    PRINTK (KERN_ERR, "attempt to send on RX-only VC %x", vc);
1312    return -EBADFD;
1313  }
1314  
1315  // this is a driver private field so we have to set it ourselves,
1316  // despite the fact that we are _required_ to use it to check for a
1317  // pop function
1318  ATM_SKB(skb)->vcc = atm_vcc;
1319  
1320  if (skb->len > (size_t) atm_vcc->qos.txtp.max_sdu) {
1321    PRINTK (KERN_ERR, "sk_buff length greater than agreed max_sdu, dropping...");
1322    return -EIO;
1323  }
1324  
1325  if (check_area (skb->data, skb->len)) {
1326    atomic_inc(&atm_vcc->stats->tx_err);
1327    return -ENOMEM; // ?
1328  }
1329  
1330  // allocate memory for fragments
1331  tx_descr = kmalloc (sizeof(tx_simple), GFP_KERNEL);
1332  if (!tx_descr) {
1333    PRINTK (KERN_ERR, "could not allocate TX descriptor");
1334    return -ENOMEM;
1335  }
1336  if (check_area (tx_descr, sizeof(tx_simple))) {
1337    kfree (tx_descr);
1338    return -ENOMEM;
1339  }
1340  PRINTD (DBG_TX, "fragment list allocated at %p", tx_descr);
1341  
1342  tx_descr->skb = skb;
1343  
1344  tx_descr->tx_frag.bytes = cpu_to_be32 (tx_len);
1345  tx_descr->tx_frag.address = cpu_to_be32 (virt_to_bus (tx_data));
1346  
1347  tx_descr->tx_frag_end.handle = virt_to_bus (tx_descr);
1348  tx_descr->tx_frag_end.vc = 0;
1349  tx_descr->tx_frag_end.next_descriptor_length = 0;
1350  tx_descr->tx_frag_end.next_descriptor = 0;
1351#ifdef AMB_NEW_MICROCODE
1352  tx_descr->tx_frag_end.cpcs_uu = 0;
1353  tx_descr->tx_frag_end.cpi = 0;
1354  tx_descr->tx_frag_end.pad = 0;
1355#endif
1356  
1357  tx.vc = cpu_to_be16 (vcc->tx_frame_bits | vc);
1358  tx.tx_descr_length = cpu_to_be16 (sizeof(tx_frag)+sizeof(tx_frag_end));
1359  tx.tx_descr_addr = cpu_to_be32 (virt_to_bus (&tx_descr->tx_frag));
1360  
1361  while (tx_give (dev, &tx))
1362    schedule();
1363  return 0;
1364}
1365
1366/********** Change QoS on a VC **********/
1367
1368// int amb_change_qos (struct atm_vcc * atm_vcc, struct atm_qos * qos, int flags);
1369
1370/********** Free RX Socket Buffer **********/
1371
1372#if 0
1373static void amb_free_rx_skb (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
1374  amb_dev * dev = AMB_DEV (atm_vcc->dev);
1375  amb_vcc * vcc = AMB_VCC (atm_vcc);
1376  unsigned char pool = vcc->rx_info.pool;
1377  rx_in rx;
1378  
1379  // This may be unsafe for various reasons that I cannot really guess
1380  // at. However, I note that the ATM layer calls kfree_skb rather
1381  // than dev_kfree_skb at this point so we are least covered as far
1382  // as buffer locking goes. There may be bugs if pcap clones RX skbs.
1383
1384  PRINTD (DBG_FLOW|DBG_SKB, "amb_rx_free skb %p (atm_vcc %p, vcc %p)",
1385	  skb, atm_vcc, vcc);
1386  
1387  rx.handle = virt_to_bus (skb);
1388  rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
1389  
1390  skb->data = skb->head;
1391  skb_reset_tail_pointer(skb);
1392  skb->len = 0;
1393  
1394  if (!rx_give (dev, &rx, pool)) {
1395    // success
1396    PRINTD (DBG_SKB|DBG_POOL, "recycled skb for pool %hu", pool);
1397    return;
1398  }
1399  
1400  // just do what the ATM layer would have done
1401  dev_kfree_skb_any (skb);
1402  
1403  return;
1404}
1405#endif
1406
1407/********** Proc File Output **********/
1408
1409static int amb_proc_read (struct atm_dev * atm_dev, loff_t * pos, char * page) {
1410  amb_dev * dev = AMB_DEV (atm_dev);
1411  int left = *pos;
1412  unsigned char pool;
1413  
1414  PRINTD (DBG_FLOW, "amb_proc_read");
1415  
1416  /* more diagnostics here? */
1417  
1418  if (!left--) {
1419    amb_stats * s = &dev->stats;
1420    return sprintf (page,
1421		    "frames: TX OK %lu, RX OK %lu, RX bad %lu "
1422		    "(CRC %lu, long %lu, aborted %lu, unused %lu).\n",
1423		    s->tx_ok, s->rx.ok, s->rx.error,
1424		    s->rx.badcrc, s->rx.toolong,
1425		    s->rx.aborted, s->rx.unused);
1426  }
1427  
1428  if (!left--) {
1429    amb_cq * c = &dev->cq;
1430    return sprintf (page, "cmd queue [cur/hi/max]: %u/%u/%u. ",
1431		    c->pending, c->high, c->maximum);
1432  }
1433  
1434  if (!left--) {
1435    amb_txq * t = &dev->txq;
1436    return sprintf (page, "TX queue [cur/max high full]: %u/%u %u %u.\n",
1437		    t->pending, t->maximum, t->high, t->filled);
1438  }
1439  
1440  if (!left--) {
1441    unsigned int count = sprintf (page, "RX queues [cur/max/req low empty]:");
1442    for (pool = 0; pool < NUM_RX_POOLS; ++pool) {
1443      amb_rxq * r = &dev->rxq[pool];
1444      count += sprintf (page+count, " %u/%u/%u %u %u",
1445			r->pending, r->maximum, r->buffers_wanted, r->low, r->emptied);
1446    }
1447    count += sprintf (page+count, ".\n");
1448    return count;
1449  }
1450  
1451  if (!left--) {
1452    unsigned int count = sprintf (page, "RX buffer sizes:");
1453    for (pool = 0; pool < NUM_RX_POOLS; ++pool) {
1454      amb_rxq * r = &dev->rxq[pool];
1455      count += sprintf (page+count, " %u", r->buffer_size);
1456    }
1457    count += sprintf (page+count, ".\n");
1458    return count;
1459  }
1460  
1461#if 0
1462  if (!left--) {
1463    // suni block etc?
1464  }
1465#endif
1466  
1467  return 0;
1468}
1469
1470/********** Operation Structure **********/
1471
1472static const struct atmdev_ops amb_ops = {
1473  .open         = amb_open,
1474  .close	= amb_close,
1475  .send         = amb_send,
1476  .proc_read	= amb_proc_read,
1477  .owner	= THIS_MODULE,
1478};
1479
1480/********** housekeeping **********/
1481static void do_housekeeping (struct timer_list *t) {
1482  amb_dev * dev = from_timer(dev, t, housekeeping);
1483  
1484  // could collect device-specific (not driver/atm-linux) stats here
1485      
1486  // last resort refill once every ten seconds
1487  fill_rx_pools (dev);
1488  mod_timer(&dev->housekeeping, jiffies + 10*HZ);
1489  
1490  return;
1491}
1492
1493/********** creation of communication queues **********/
1494
1495static int create_queues(amb_dev *dev, unsigned int cmds, unsigned int txs,
1496			 unsigned int *rxs, unsigned int *rx_buffer_sizes)
1497{
1498  unsigned char pool;
1499  size_t total = 0;
1500  void * memory;
1501  void * limit;
1502  
1503  PRINTD (DBG_FLOW, "create_queues %p", dev);
1504  
1505  total += cmds * sizeof(command);
1506  
1507  total += txs * (sizeof(tx_in) + sizeof(tx_out));
1508  
1509  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
1510    total += rxs[pool] * (sizeof(rx_in) + sizeof(rx_out));
1511  
1512  memory = kmalloc (total, GFP_KERNEL);
1513  if (!memory) {
1514    PRINTK (KERN_ERR, "could not allocate queues");
1515    return -ENOMEM;
1516  }
1517  if (check_area (memory, total)) {
1518    PRINTK (KERN_ERR, "queues allocated in nasty area");
1519    kfree (memory);
1520    return -ENOMEM;
1521  }
1522  
1523  limit = memory + total;
1524  PRINTD (DBG_INIT, "queues from %p to %p", memory, limit);
1525  
1526  PRINTD (DBG_CMD, "command queue at %p", memory);
1527  
1528  {
1529    command * cmd = memory;
1530    amb_cq * cq = &dev->cq;
1531    
1532    cq->pending = 0;
1533    cq->high = 0;
1534    cq->maximum = cmds - 1;
1535    
1536    cq->ptrs.start = cmd;
1537    cq->ptrs.in = cmd;
1538    cq->ptrs.out = cmd;
1539    cq->ptrs.limit = cmd + cmds;
1540    
1541    memory = cq->ptrs.limit;
1542  }
1543  
1544  PRINTD (DBG_TX, "TX queue pair at %p", memory);
1545  
1546  {
1547    tx_in * in = memory;
1548    tx_out * out;
1549    amb_txq * txq = &dev->txq;
1550    
1551    txq->pending = 0;
1552    txq->high = 0;
1553    txq->filled = 0;
1554    txq->maximum = txs - 1;
1555    
1556    txq->in.start = in;
1557    txq->in.ptr = in;
1558    txq->in.limit = in + txs;
1559    
1560    memory = txq->in.limit;
1561    out = memory;
1562    
1563    txq->out.start = out;
1564    txq->out.ptr = out;
1565    txq->out.limit = out + txs;
1566    
1567    memory = txq->out.limit;
1568  }
1569  
1570  PRINTD (DBG_RX, "RX queue pairs at %p", memory);
1571  
1572  for (pool = 0; pool < NUM_RX_POOLS; ++pool) {
1573    rx_in * in = memory;
1574    rx_out * out;
1575    amb_rxq * rxq = &dev->rxq[pool];
1576    
1577    rxq->buffer_size = rx_buffer_sizes[pool];
1578    rxq->buffers_wanted = 0;
1579    
1580    rxq->pending = 0;
1581    rxq->low = rxs[pool] - 1;
1582    rxq->emptied = 0;
1583    rxq->maximum = rxs[pool] - 1;
1584    
1585    rxq->in.start = in;
1586    rxq->in.ptr = in;
1587    rxq->in.limit = in + rxs[pool];
1588    
1589    memory = rxq->in.limit;
1590    out = memory;
1591    
1592    rxq->out.start = out;
1593    rxq->out.ptr = out;
1594    rxq->out.limit = out + rxs[pool];
1595    
1596    memory = rxq->out.limit;
1597  }
1598  
1599  if (memory == limit) {
1600    return 0;
1601  } else {
1602    PRINTK (KERN_ERR, "bad queue alloc %p != %p (tell maintainer)", memory, limit);
1603    kfree (limit - total);
1604    return -ENOMEM;
1605  }
1606  
1607}
1608
1609/********** destruction of communication queues **********/
1610
1611static void destroy_queues (amb_dev * dev) {
1612  // all queues assumed empty
1613  void * memory = dev->cq.ptrs.start;
1614  // includes txq.in, txq.out, rxq[].in and rxq[].out
1615  
1616  PRINTD (DBG_FLOW, "destroy_queues %p", dev);
1617  
1618  PRINTD (DBG_INIT, "freeing queues at %p", memory);
1619  kfree (memory);
1620  
1621  return;
1622}
1623
1624/********** basic loader commands and error handling **********/
1625// centisecond timeouts - guessing away here
1626static unsigned int command_timeouts [] = {
1627	[host_memory_test]     = 15,
1628	[read_adapter_memory]  = 2,
1629	[write_adapter_memory] = 2,
1630	[adapter_start]        = 50,
1631	[get_version_number]   = 10,
1632	[interrupt_host]       = 1,
1633	[flash_erase_sector]   = 1,
1634	[adap_download_block]  = 1,
1635	[adap_erase_flash]     = 1,
1636	[adap_run_in_iram]     = 1,
1637	[adap_end_download]    = 1
1638};
1639
1640
1641static unsigned int command_successes [] = {
1642	[host_memory_test]     = COMMAND_PASSED_TEST,
1643	[read_adapter_memory]  = COMMAND_READ_DATA_OK,
1644	[write_adapter_memory] = COMMAND_WRITE_DATA_OK,
1645	[adapter_start]        = COMMAND_COMPLETE,
1646	[get_version_number]   = COMMAND_COMPLETE,
1647	[interrupt_host]       = COMMAND_COMPLETE,
1648	[flash_erase_sector]   = COMMAND_COMPLETE,
1649	[adap_download_block]  = COMMAND_COMPLETE,
1650	[adap_erase_flash]     = COMMAND_COMPLETE,
1651	[adap_run_in_iram]     = COMMAND_COMPLETE,
1652	[adap_end_download]    = COMMAND_COMPLETE
1653};
1654  
1655static  int decode_loader_result (loader_command cmd, u32 result)
1656{
1657	int res;
1658	const char *msg;
1659
1660	if (result == command_successes[cmd])
1661		return 0;
1662
1663	switch (result) {
1664		case BAD_COMMAND:
1665			res = -EINVAL;
1666			msg = "bad command";
1667			break;
1668		case COMMAND_IN_PROGRESS:
1669			res = -ETIMEDOUT;
1670			msg = "command in progress";
1671			break;
1672		case COMMAND_PASSED_TEST:
1673			res = 0;
1674			msg = "command passed test";
1675			break;
1676		case COMMAND_FAILED_TEST:
1677			res = -EIO;
1678			msg = "command failed test";
1679			break;
1680		case COMMAND_READ_DATA_OK:
1681			res = 0;
1682			msg = "command read data ok";
1683			break;
1684		case COMMAND_READ_BAD_ADDRESS:
1685			res = -EINVAL;
1686			msg = "command read bad address";
1687			break;
1688		case COMMAND_WRITE_DATA_OK:
1689			res = 0;
1690			msg = "command write data ok";
1691			break;
1692		case COMMAND_WRITE_BAD_ADDRESS:
1693			res = -EINVAL;
1694			msg = "command write bad address";
1695			break;
1696		case COMMAND_WRITE_FLASH_FAILURE:
1697			res = -EIO;
1698			msg = "command write flash failure";
1699			break;
1700		case COMMAND_COMPLETE:
1701			res = 0;
1702			msg = "command complete";
1703			break;
1704		case COMMAND_FLASH_ERASE_FAILURE:
1705			res = -EIO;
1706			msg = "command flash erase failure";
1707			break;
1708		case COMMAND_WRITE_BAD_DATA:
1709			res = -EINVAL;
1710			msg = "command write bad data";
1711			break;
1712		default:
1713			res = -EINVAL;
1714			msg = "unknown error";
1715			PRINTD (DBG_LOAD|DBG_ERR,
1716				"decode_loader_result got %d=%x !",
1717				result, result);
1718			break;
1719	}
1720
1721	PRINTK (KERN_ERR, "%s", msg);
1722	return res;
1723}
1724
1725static int do_loader_command(volatile loader_block *lb, const amb_dev *dev,
1726			     loader_command cmd)
1727{
1728  
1729  unsigned long timeout;
1730  
1731  PRINTD (DBG_FLOW|DBG_LOAD, "do_loader_command");
1732  
1733  /* do a command
1734     
1735     Set the return value to zero, set the command type and set the
1736     valid entry to the right magic value. The payload is already
1737     correctly byte-ordered so we leave it alone. Hit the doorbell
1738     with the bus address of this structure.
1739     
1740  */
1741  
1742  lb->result = 0;
1743  lb->command = cpu_to_be32 (cmd);
1744  lb->valid = cpu_to_be32 (DMA_VALID);
1745  // dump_registers (dev);
1746  // dump_loader_block (lb);
1747  wr_mem (dev, offsetof(amb_mem, doorbell), virt_to_bus (lb) & ~onegigmask);
1748  
1749  timeout = command_timeouts[cmd] * 10;
1750  
1751  while (!lb->result || lb->result == cpu_to_be32 (COMMAND_IN_PROGRESS))
1752    if (timeout) {
1753      timeout = msleep_interruptible(timeout);
1754    } else {
1755      PRINTD (DBG_LOAD|DBG_ERR, "command %d timed out", cmd);
1756      dump_registers (dev);
1757      dump_loader_block (lb);
1758      return -ETIMEDOUT;
1759    }
1760  
1761  if (cmd == adapter_start) {
1762    // wait for start command to acknowledge...
1763    timeout = 100;
1764    while (rd_plain (dev, offsetof(amb_mem, doorbell)))
1765      if (timeout) {
1766	timeout = msleep_interruptible(timeout);
1767      } else {
1768	PRINTD (DBG_LOAD|DBG_ERR, "start command did not clear doorbell, res=%08x",
1769		be32_to_cpu (lb->result));
1770	dump_registers (dev);
1771	return -ETIMEDOUT;
1772      }
1773    return 0;
1774  } else {
1775    return decode_loader_result (cmd, be32_to_cpu (lb->result));
1776  }
1777  
1778}
1779
1780/* loader: determine loader version */
1781
1782static int get_loader_version(loader_block *lb, const amb_dev *dev,
1783			      u32 *version)
1784{
1785  int res;
1786  
1787  PRINTD (DBG_FLOW|DBG_LOAD, "get_loader_version");
1788  
1789  res = do_loader_command (lb, dev, get_version_number);
1790  if (res)
1791    return res;
1792  if (version)
1793    *version = be32_to_cpu (lb->payload.version);
1794  return 0;
1795}
1796
1797/* loader: write memory data blocks */
1798
1799static int loader_write(loader_block *lb, const amb_dev *dev,
1800			const struct ihex_binrec *rec)
1801{
1802  transfer_block * tb = &lb->payload.transfer;
1803  
1804  PRINTD (DBG_FLOW|DBG_LOAD, "loader_write");
1805
1806  tb->address = rec->addr;
1807  tb->count = cpu_to_be32(be16_to_cpu(rec->len) / 4);
1808  memcpy(tb->data, rec->data, be16_to_cpu(rec->len));
1809  return do_loader_command (lb, dev, write_adapter_memory);
1810}
1811
1812/* loader: verify memory data blocks */
1813
1814static int loader_verify(loader_block *lb, const amb_dev *dev,
1815			 const struct ihex_binrec *rec)
1816{
1817  transfer_block * tb = &lb->payload.transfer;
1818  int res;
1819  
1820  PRINTD (DBG_FLOW|DBG_LOAD, "loader_verify");
1821  
1822  tb->address = rec->addr;
1823  tb->count = cpu_to_be32(be16_to_cpu(rec->len) / 4);
1824  res = do_loader_command (lb, dev, read_adapter_memory);
1825  if (!res && memcmp(tb->data, rec->data, be16_to_cpu(rec->len)))
1826    res = -EINVAL;
1827  return res;
1828}
1829
1830/* loader: start microcode */
1831
1832static int loader_start(loader_block *lb, const amb_dev *dev, u32 address)
1833{
1834  PRINTD (DBG_FLOW|DBG_LOAD, "loader_start");
1835  
1836  lb->payload.start = cpu_to_be32 (address);
1837  return do_loader_command (lb, dev, adapter_start);
1838}
1839
1840/********** reset card **********/
1841
1842static inline void sf (const char * msg)
1843{
1844	PRINTK (KERN_ERR, "self-test failed: %s", msg);
1845}
1846
1847static int amb_reset (amb_dev * dev, int diags) {
1848  u32 word;
1849  
1850  PRINTD (DBG_FLOW|DBG_LOAD, "amb_reset");
1851  
1852  word = rd_plain (dev, offsetof(amb_mem, reset_control));
1853  // put card into reset state
1854  wr_plain (dev, offsetof(amb_mem, reset_control), word | AMB_RESET_BITS);
1855  // wait a short while
1856  udelay (10);
1857#if 1
1858  // put card into known good state
1859  wr_plain (dev, offsetof(amb_mem, interrupt_control), AMB_DOORBELL_BITS);
1860  // clear all interrupts just in case
1861  wr_plain (dev, offsetof(amb_mem, interrupt), -1);
1862#endif
1863  // clear self-test done flag
1864  wr_plain (dev, offsetof(amb_mem, mb.loader.ready), 0);
1865  // take card out of reset state
1866  wr_plain (dev, offsetof(amb_mem, reset_control), word &~ AMB_RESET_BITS);
1867  
1868  if (diags) { 
1869    unsigned long timeout;
1870    // 4.2 second wait
1871    msleep(4200);
1872    // half second time-out
1873    timeout = 500;
1874    while (!rd_plain (dev, offsetof(amb_mem, mb.loader.ready)))
1875      if (timeout) {
1876	timeout = msleep_interruptible(timeout);
1877      } else {
1878	PRINTD (DBG_LOAD|DBG_ERR, "reset timed out");
1879	return -ETIMEDOUT;
1880      }
1881    
1882    // get results of self-test
1883    // XXX double check byte-order
1884    word = rd_mem (dev, offsetof(amb_mem, mb.loader.result));
1885    if (word & SELF_TEST_FAILURE) {
1886      if (word & GPINT_TST_FAILURE)
1887	sf ("interrupt");
1888      if (word & SUNI_DATA_PATTERN_FAILURE)
1889	sf ("SUNI data pattern");
1890      if (word & SUNI_DATA_BITS_FAILURE)
1891	sf ("SUNI data bits");
1892      if (word & SUNI_UTOPIA_FAILURE)
1893	sf ("SUNI UTOPIA interface");
1894      if (word & SUNI_FIFO_FAILURE)
1895	sf ("SUNI cell buffer FIFO");
1896      if (word & SRAM_FAILURE)
1897	sf ("bad SRAM");
1898      // better return value?
1899      return -EIO;
1900    }
1901    
1902  }
1903  return 0;
1904}
1905
1906/********** transfer and start the microcode **********/
1907
1908static int ucode_init(loader_block *lb, amb_dev *dev)
1909{
1910  const struct firmware *fw;
1911  unsigned long start_address;
1912  const struct ihex_binrec *rec;
1913  const char *errmsg = NULL;
1914  int res;
1915
1916  res = request_ihex_firmware(&fw, "atmsar11.fw", &dev->pci_dev->dev);
1917  if (res) {
1918    PRINTK (KERN_ERR, "Cannot load microcode data");
1919    return res;
1920  }
1921
1922  /* First record contains just the start address */
1923  rec = (const struct ihex_binrec *)fw->data;
1924  if (be16_to_cpu(rec->len) != sizeof(__be32) || be32_to_cpu(rec->addr)) {
1925    errmsg = "no start record";
1926    goto fail;
1927  }
1928  start_address = be32_to_cpup((__be32 *)rec->data);
1929
1930  rec = ihex_next_binrec(rec);
1931
1932  PRINTD (DBG_FLOW|DBG_LOAD, "ucode_init");
1933
1934  while (rec) {
1935    PRINTD (DBG_LOAD, "starting region (%x, %u)", be32_to_cpu(rec->addr),
1936	    be16_to_cpu(rec->len));
1937    if (be16_to_cpu(rec->len) > 4 * MAX_TRANSFER_DATA) {
1938	    errmsg = "record too long";
1939	    goto fail;
1940    }
1941    if (be16_to_cpu(rec->len) & 3) {
1942	    errmsg = "odd number of bytes";
1943	    goto fail;
1944    }
1945    res = loader_write(lb, dev, rec);
1946    if (res)
1947      break;
1948
1949    res = loader_verify(lb, dev, rec);
1950    if (res)
1951      break;
1952    rec = ihex_next_binrec(rec);
1953  }
1954  release_firmware(fw);
1955  if (!res)
1956    res = loader_start(lb, dev, start_address);
1957
1958  return res;
1959fail:
1960  release_firmware(fw);
1961  PRINTK(KERN_ERR, "Bad microcode data (%s)", errmsg);
1962  return -EINVAL;
1963}
1964
1965/********** give adapter parameters **********/
1966  
1967static inline __be32 bus_addr(void * addr) {
1968    return cpu_to_be32 (virt_to_bus (addr));
1969}
1970
1971static int amb_talk(amb_dev *dev)
1972{
1973  adap_talk_block a;
1974  unsigned char pool;
1975  unsigned long timeout;
1976  
1977  PRINTD (DBG_FLOW, "amb_talk %p", dev);
1978  
1979  a.command_start = bus_addr (dev->cq.ptrs.start);
1980  a.command_end   = bus_addr (dev->cq.ptrs.limit);
1981  a.tx_start      = bus_addr (dev->txq.in.start);
1982  a.tx_end        = bus_addr (dev->txq.in.limit);
1983  a.txcom_start   = bus_addr (dev->txq.out.start);
1984  a.txcom_end     = bus_addr (dev->txq.out.limit);
1985  
1986  for (pool = 0; pool < NUM_RX_POOLS; ++pool) {
1987    // the other "a" items are set up by the adapter
1988    a.rec_struct[pool].buffer_start = bus_addr (dev->rxq[pool].in.start);
1989    a.rec_struct[pool].buffer_end   = bus_addr (dev->rxq[pool].in.limit);
1990    a.rec_struct[pool].rx_start     = bus_addr (dev->rxq[pool].out.start);
1991    a.rec_struct[pool].rx_end       = bus_addr (dev->rxq[pool].out.limit);
1992    a.rec_struct[pool].buffer_size = cpu_to_be32 (dev->rxq[pool].buffer_size);
1993  }
1994  
1995#ifdef AMB_NEW_MICROCODE
1996  // disable fast PLX prefetching
1997  a.init_flags = 0;
1998#endif
1999  
2000  // pass the structure
2001  wr_mem (dev, offsetof(amb_mem, doorbell), virt_to_bus (&a));
2002  
2003  // 2.2 second wait (must not touch doorbell during 2 second DMA test)
2004  msleep(2200);
2005  // give the adapter another half second?
2006  timeout = 500;
2007  while (rd_plain (dev, offsetof(amb_mem, doorbell)))
2008    if (timeout) {
2009      timeout = msleep_interruptible(timeout);
2010    } else {
2011      PRINTD (DBG_INIT|DBG_ERR, "adapter init timed out");
2012      return -ETIMEDOUT;
2013    }
2014  
2015  return 0;
2016}
2017
2018// get microcode version
2019static void amb_ucode_version(amb_dev *dev)
2020{
2021  u32 major;
2022  u32 minor;
2023  command cmd;
2024  cmd.request = cpu_to_be32 (SRB_GET_VERSION);
2025  while (command_do (dev, &cmd)) {
2026    set_current_state(TASK_UNINTERRUPTIBLE);
2027    schedule();
2028  }
2029  major = be32_to_cpu (cmd.args.version.major);
2030  minor = be32_to_cpu (cmd.args.version.minor);
2031  PRINTK (KERN_INFO, "microcode version is %u.%u", major, minor);
2032}
2033  
2034// get end station address
2035static void amb_esi(amb_dev *dev, u8 *esi)
2036{
2037  u32 lower4;
2038  u16 upper2;
2039  command cmd;
2040  
2041  cmd.request = cpu_to_be32 (SRB_GET_BIA);
2042  while (command_do (dev, &cmd)) {
2043    set_current_state(TASK_UNINTERRUPTIBLE);
2044    schedule();
2045  }
2046  lower4 = be32_to_cpu (cmd.args.bia.lower4);
2047  upper2 = be32_to_cpu (cmd.args.bia.upper2);
2048  PRINTD (DBG_LOAD, "BIA: lower4: %08x, upper2 %04x", lower4, upper2);
2049  
2050  if (esi) {
2051    unsigned int i;
2052    
2053    PRINTDB (DBG_INIT, "ESI:");
2054    for (i = 0; i < ESI_LEN; ++i) {
2055      if (i < 4)
2056	  esi[i] = bitrev8(lower4>>(8*i));
2057      else
2058	  esi[i] = bitrev8(upper2>>(8*(i-4)));
2059      PRINTDM (DBG_INIT, " %02x", esi[i]);
2060    }
2061    
2062    PRINTDE (DBG_INIT, "");
2063  }
2064  
2065  return;
2066}
2067  
2068static void fixup_plx_window (amb_dev *dev, loader_block *lb)
2069{
2070	// fix up the PLX-mapped window base address to match the block
2071	unsigned long blb;
2072	u32 mapreg;
2073	blb = virt_to_bus(lb);
2074	// the kernel stack had better not ever cross a 1Gb boundary!
2075	mapreg = rd_plain (dev, offsetof(amb_mem, stuff[10]));
2076	mapreg &= ~onegigmask;
2077	mapreg |= blb & onegigmask;
2078	wr_plain (dev, offsetof(amb_mem, stuff[10]), mapreg);
2079	return;
2080}
2081
2082static int amb_init(amb_dev *dev)
2083{
2084  loader_block lb;
2085  
2086  u32 version;
2087  
2088  if (amb_reset (dev, 1)) {
2089    PRINTK (KERN_ERR, "card reset failed!");
2090  } else {
2091    fixup_plx_window (dev, &lb);
2092    
2093    if (get_loader_version (&lb, dev, &version)) {
2094      PRINTK (KERN_INFO, "failed to get loader version");
2095    } else {
2096      PRINTK (KERN_INFO, "loader version is %08x", version);
2097      
2098      if (ucode_init (&lb, dev)) {
2099	PRINTK (KERN_ERR, "microcode failure");
2100      } else if (create_queues (dev, cmds, txs, rxs, rxs_bs)) {
2101	PRINTK (KERN_ERR, "failed to get memory for queues");
2102      } else {
2103	
2104	if (amb_talk (dev)) {
2105	  PRINTK (KERN_ERR, "adapter did not accept queues");
2106	} else {
2107	  
2108	  amb_ucode_version (dev);
2109	  return 0;
2110	  
2111	} /* amb_talk */
2112	
2113	destroy_queues (dev);
2114      } /* create_queues, ucode_init */
2115      
2116      amb_reset (dev, 0);
2117    } /* get_loader_version */
2118    
2119  } /* amb_reset */
2120  
2121  return -EINVAL;
2122}
2123
2124static void setup_dev(amb_dev *dev, struct pci_dev *pci_dev) 
2125{
2126      unsigned char pool;
2127      
2128      // set up known dev items straight away
2129      dev->pci_dev = pci_dev; 
2130      pci_set_drvdata(pci_dev, dev);
2131      
2132      dev->iobase = pci_resource_start (pci_dev, 1);
2133      dev->irq = pci_dev->irq; 
2134      dev->membase = bus_to_virt(pci_resource_start(pci_dev, 0));
2135      
2136      // flags (currently only dead)
2137      dev->flags = 0;
2138      
2139      // Allocate cell rates (fibre)
2140      // ATM_OC3_PCR = 1555200000/8/270*260/53 - 29/53
2141      // to be really pedantic, this should be ATM_OC3c_PCR
2142      dev->tx_avail = ATM_OC3_PCR;
2143      dev->rx_avail = ATM_OC3_PCR;
2144      
2145      // semaphore for txer/rxer modifications - we cannot use a
2146      // spinlock as the critical region needs to switch processes
2147      mutex_init(&dev->vcc_sf);
2148      // queue manipulation spinlocks; we want atomic reads and
2149      // writes to the queue descriptors (handles IRQ and SMP)
2150      // consider replacing "int pending" -> "atomic_t available"
2151      // => problem related to who gets to move queue pointers
2152      spin_lock_init (&dev->cq.lock);
2153      spin_lock_init (&dev->txq.lock);
2154      for (pool = 0; pool < NUM_RX_POOLS; ++pool)
2155	spin_lock_init (&dev->rxq[pool].lock);
2156}
2157
2158static void setup_pci_dev(struct pci_dev *pci_dev)
2159{
2160	unsigned char lat;
2161      
2162	// enable bus master accesses
2163	pci_set_master(pci_dev);
2164
2165	// frobnicate latency (upwards, usually)
2166	pci_read_config_byte (pci_dev, PCI_LATENCY_TIMER, &lat);
2167
2168	if (!pci_lat)
2169		pci_lat = (lat < MIN_PCI_LATENCY) ? MIN_PCI_LATENCY : lat;
2170
2171	if (lat != pci_lat) {
2172		PRINTK (KERN_INFO, "Changing PCI latency timer from %hu to %hu",
2173			lat, pci_lat);
2174		pci_write_config_byte(pci_dev, PCI_LATENCY_TIMER, pci_lat);
2175	}
2176}
2177
2178static int amb_probe(struct pci_dev *pci_dev,
2179		     const struct pci_device_id *pci_ent)
2180{
2181	amb_dev * dev;
2182	int err;
2183	unsigned int irq;
2184      
2185	err = pci_enable_device(pci_dev);
2186	if (err < 0) {
2187		PRINTK (KERN_ERR, "skipped broken (PLX rev 2) card");
2188		goto out;
2189	}
2190
2191	// read resources from PCI configuration space
2192	irq = pci_dev->irq;
2193
2194	if (pci_dev->device == PCI_DEVICE_ID_MADGE_AMBASSADOR_BAD) {
2195		PRINTK (KERN_ERR, "skipped broken (PLX rev 2) card");
2196		err = -EINVAL;
2197		goto out_disable;
2198	}
2199
2200	PRINTD (DBG_INFO, "found Madge ATM adapter (amb) at"
2201		" IO %llx, IRQ %u, MEM %p",
2202		(unsigned long long)pci_resource_start(pci_dev, 1),
2203		irq, bus_to_virt(pci_resource_start(pci_dev, 0)));
2204
2205	// check IO region
2206	err = pci_request_region(pci_dev, 1, DEV_LABEL);
2207	if (err < 0) {
2208		PRINTK (KERN_ERR, "IO range already in use!");
2209		goto out_disable;
2210	}
2211
2212	dev = kzalloc(sizeof(amb_dev), GFP_KERNEL);
2213	if (!dev) {
2214		PRINTK (KERN_ERR, "out of memory!");
2215		err = -ENOMEM;
2216		goto out_release;
2217	}
2218
2219	setup_dev(dev, pci_dev);
2220
2221	err = amb_init(dev);
2222	if (err < 0) {
2223		PRINTK (KERN_ERR, "adapter initialisation failure");
2224		goto out_free;
2225	}
2226
2227	setup_pci_dev(pci_dev);
2228
2229	// grab (but share) IRQ and install handler
2230	err = request_irq(irq, interrupt_handler, IRQF_SHARED, DEV_LABEL, dev);
2231	if (err < 0) {
2232		PRINTK (KERN_ERR, "request IRQ failed!");
2233		goto out_reset;
2234	}
2235
2236	dev->atm_dev = atm_dev_register (DEV_LABEL, &pci_dev->dev, &amb_ops, -1,
2237					 NULL);
2238	if (!dev->atm_dev) {
2239		PRINTD (DBG_ERR, "failed to register Madge ATM adapter");
2240		err = -EINVAL;
2241		goto out_free_irq;
2242	}
2243
2244	PRINTD (DBG_INFO, "registered Madge ATM adapter (no. %d) (%p) at %p",
2245		dev->atm_dev->number, dev, dev->atm_dev);
2246	dev->atm_dev->dev_data = (void *) dev;
2247
2248	// register our address
2249	amb_esi (dev, dev->atm_dev->esi);
2250
2251	// 0 bits for vpi, 10 bits for vci
2252	dev->atm_dev->ci_range.vpi_bits = NUM_VPI_BITS;
2253	dev->atm_dev->ci_range.vci_bits = NUM_VCI_BITS;
2254
2255	timer_setup(&dev->housekeeping, do_housekeeping, 0);
 
 
2256	mod_timer(&dev->housekeeping, jiffies);
2257
2258	// enable host interrupts
2259	interrupts_on (dev);
2260
2261out:
2262	return err;
2263
2264out_free_irq:
2265	free_irq(irq, dev);
2266out_reset:
2267	amb_reset(dev, 0);
2268out_free:
2269	kfree(dev);
2270out_release:
2271	pci_release_region(pci_dev, 1);
2272out_disable:
2273	pci_disable_device(pci_dev);
2274	goto out;
2275}
2276
2277
2278static void amb_remove_one(struct pci_dev *pci_dev)
2279{
2280	struct amb_dev *dev;
2281
2282	dev = pci_get_drvdata(pci_dev);
2283
2284	PRINTD(DBG_INFO|DBG_INIT, "closing %p (atm_dev = %p)", dev, dev->atm_dev);
2285	del_timer_sync(&dev->housekeeping);
2286	// the drain should not be necessary
2287	drain_rx_pools(dev);
2288	interrupts_off(dev);
2289	amb_reset(dev, 0);
2290	free_irq(dev->irq, dev);
2291	pci_disable_device(pci_dev);
2292	destroy_queues(dev);
2293	atm_dev_deregister(dev->atm_dev);
2294	kfree(dev);
2295	pci_release_region(pci_dev, 1);
2296}
2297
2298static void __init amb_check_args (void) {
2299  unsigned char pool;
2300  unsigned int max_rx_size;
2301  
2302#ifdef DEBUG_AMBASSADOR
2303  PRINTK (KERN_NOTICE, "debug bitmap is %hx", debug &= DBG_MASK);
2304#else
2305  if (debug)
2306    PRINTK (KERN_NOTICE, "no debugging support");
2307#endif
2308  
2309  if (cmds < MIN_QUEUE_SIZE)
2310    PRINTK (KERN_NOTICE, "cmds has been raised to %u",
2311	    cmds = MIN_QUEUE_SIZE);
2312  
2313  if (txs < MIN_QUEUE_SIZE)
2314    PRINTK (KERN_NOTICE, "txs has been raised to %u",
2315	    txs = MIN_QUEUE_SIZE);
2316  
2317  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
2318    if (rxs[pool] < MIN_QUEUE_SIZE)
2319      PRINTK (KERN_NOTICE, "rxs[%hu] has been raised to %u",
2320	      pool, rxs[pool] = MIN_QUEUE_SIZE);
2321  
2322  // buffers sizes should be greater than zero and strictly increasing
2323  max_rx_size = 0;
2324  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
2325    if (rxs_bs[pool] <= max_rx_size)
2326      PRINTK (KERN_NOTICE, "useless pool (rxs_bs[%hu] = %u)",
2327	      pool, rxs_bs[pool]);
2328    else
2329      max_rx_size = rxs_bs[pool];
2330  
2331  if (rx_lats < MIN_RX_BUFFERS)
2332    PRINTK (KERN_NOTICE, "rx_lats has been raised to %u",
2333	    rx_lats = MIN_RX_BUFFERS);
2334  
2335  return;
2336}
2337
2338/********** module stuff **********/
2339
2340MODULE_AUTHOR(maintainer_string);
2341MODULE_DESCRIPTION(description_string);
2342MODULE_LICENSE("GPL");
2343MODULE_FIRMWARE("atmsar11.fw");
2344module_param(debug,   ushort, 0644);
2345module_param(cmds,    uint, 0);
2346module_param(txs,     uint, 0);
2347module_param_array(rxs,     uint, NULL, 0);
2348module_param_array(rxs_bs,  uint, NULL, 0);
2349module_param(rx_lats, uint, 0);
2350module_param(pci_lat, byte, 0);
2351MODULE_PARM_DESC(debug,   "debug bitmap, see .h file");
2352MODULE_PARM_DESC(cmds,    "number of command queue entries");
2353MODULE_PARM_DESC(txs,     "number of TX queue entries");
2354MODULE_PARM_DESC(rxs,     "number of RX queue entries [" __MODULE_STRING(NUM_RX_POOLS) "]");
2355MODULE_PARM_DESC(rxs_bs,  "size of RX buffers [" __MODULE_STRING(NUM_RX_POOLS) "]");
2356MODULE_PARM_DESC(rx_lats, "number of extra buffers to cope with RX latencies");
2357MODULE_PARM_DESC(pci_lat, "PCI latency in bus cycles");
2358
2359/********** module entry **********/
2360
2361static const struct pci_device_id amb_pci_tbl[] = {
2362	{ PCI_VDEVICE(MADGE, PCI_DEVICE_ID_MADGE_AMBASSADOR), 0 },
2363	{ PCI_VDEVICE(MADGE, PCI_DEVICE_ID_MADGE_AMBASSADOR_BAD), 0 },
2364	{ 0, }
2365};
2366
2367MODULE_DEVICE_TABLE(pci, amb_pci_tbl);
2368
2369static struct pci_driver amb_driver = {
2370	.name =		"amb",
2371	.probe =	amb_probe,
2372	.remove =	amb_remove_one,
2373	.id_table =	amb_pci_tbl,
2374};
2375
2376static int __init amb_module_init (void)
2377{
2378  PRINTD (DBG_FLOW|DBG_INIT, "init_module");
2379  
2380  BUILD_BUG_ON(sizeof(amb_mem) != 4*16 + 4*12);
 
 
 
 
 
2381  
2382  show_version();
2383  
2384  amb_check_args();
2385  
2386  // get the juice
2387  return pci_register_driver(&amb_driver);
2388}
2389
2390/********** module exit **********/
2391
2392static void __exit amb_module_exit (void)
2393{
2394  PRINTD (DBG_FLOW|DBG_INIT, "cleanup_module");
2395
2396  pci_unregister_driver(&amb_driver);
2397}
2398
2399module_init(amb_module_init);
2400module_exit(amb_module_exit);