1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * Char device for device raw access
   4 *
   5 * Copyright (C) 2005-2007  Kristian Hoegsberg <krh@bitplanet.net>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
   6 */
   7
   8#include <linux/bug.h>
   9#include <linux/compat.h>
  10#include <linux/delay.h>
  11#include <linux/device.h>
  12#include <linux/dma-mapping.h>
  13#include <linux/errno.h>
  14#include <linux/firewire.h>
  15#include <linux/firewire-cdev.h>
  16#include <linux/idr.h>
  17#include <linux/irqflags.h>
  18#include <linux/jiffies.h>
  19#include <linux/kernel.h>
  20#include <linux/kref.h>
  21#include <linux/mm.h>
  22#include <linux/module.h>
  23#include <linux/mutex.h>
  24#include <linux/poll.h>
  25#include <linux/sched.h> /* required for linux/wait.h */
  26#include <linux/slab.h>
  27#include <linux/spinlock.h>
  28#include <linux/string.h>
  29#include <linux/time.h>
  30#include <linux/uaccess.h>
  31#include <linux/vmalloc.h>
  32#include <linux/wait.h>
  33#include <linux/workqueue.h>
  34
 
  35
  36#include "core.h"
  37
  38/*
  39 * ABI version history is documented in linux/firewire-cdev.h.
  40 */
  41#define FW_CDEV_KERNEL_VERSION			5
  42#define FW_CDEV_VERSION_EVENT_REQUEST2		4
  43#define FW_CDEV_VERSION_ALLOCATE_REGION_END	4
  44#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW	5
  45
  46struct client {
  47	u32 version;
  48	struct fw_device *device;
  49
  50	spinlock_t lock;
  51	bool in_shutdown;
  52	struct idr resource_idr;
  53	struct list_head event_list;
  54	wait_queue_head_t wait;
  55	wait_queue_head_t tx_flush_wait;
  56	u64 bus_reset_closure;
  57
  58	struct fw_iso_context *iso_context;
  59	u64 iso_closure;
  60	struct fw_iso_buffer buffer;
  61	unsigned long vm_start;
  62	bool buffer_is_mapped;
  63
  64	struct list_head phy_receiver_link;
  65	u64 phy_receiver_closure;
  66
  67	struct list_head link;
  68	struct kref kref;
  69};
  70
  71static inline void client_get(struct client *client)
  72{
  73	kref_get(&client->kref);
  74}
  75
  76static void client_release(struct kref *kref)
  77{
  78	struct client *client = container_of(kref, struct client, kref);
  79
  80	fw_device_put(client->device);
  81	kfree(client);
  82}
  83
  84static void client_put(struct client *client)
  85{
  86	kref_put(&client->kref, client_release);
  87}
  88
  89struct client_resource;
  90typedef void (*client_resource_release_fn_t)(struct client *,
  91					     struct client_resource *);
  92struct client_resource {
  93	client_resource_release_fn_t release;
  94	int handle;
  95};
  96
  97struct address_handler_resource {
  98	struct client_resource resource;
  99	struct fw_address_handler handler;
 100	__u64 closure;
 101	struct client *client;
 102};
 103
 104struct outbound_transaction_resource {
 105	struct client_resource resource;
 106	struct fw_transaction transaction;
 107};
 108
 109struct inbound_transaction_resource {
 110	struct client_resource resource;
 111	struct fw_card *card;
 112	struct fw_request *request;
 113	void *data;
 114	size_t length;
 115};
 116
 117struct descriptor_resource {
 118	struct client_resource resource;
 119	struct fw_descriptor descriptor;
 120	u32 data[];
 121};
 122
 123struct iso_resource {
 124	struct client_resource resource;
 125	struct client *client;
 126	/* Schedule work and access todo only with client->lock held. */
 127	struct delayed_work work;
 128	enum {ISO_RES_ALLOC, ISO_RES_REALLOC, ISO_RES_DEALLOC,
 129	      ISO_RES_ALLOC_ONCE, ISO_RES_DEALLOC_ONCE,} todo;
 130	int generation;
 131	u64 channels;
 132	s32 bandwidth;
 133	struct iso_resource_event *e_alloc, *e_dealloc;
 134};
 135
 136static void release_iso_resource(struct client *, struct client_resource *);
 137
 138static void schedule_iso_resource(struct iso_resource *r, unsigned long delay)
 139{
 140	client_get(r->client);
 141	if (!queue_delayed_work(fw_workqueue, &r->work, delay))
 142		client_put(r->client);
 143}
 144
 145static void schedule_if_iso_resource(struct client_resource *resource)
 146{
 147	if (resource->release == release_iso_resource)
 148		schedule_iso_resource(container_of(resource,
 149					struct iso_resource, resource), 0);
 150}
 151
 152/*
 153 * dequeue_event() just kfree()'s the event, so the event has to be
 154 * the first field in a struct XYZ_event.
 155 */
 156struct event {
 157	struct { void *data; size_t size; } v[2];
 158	struct list_head link;
 159};
 160
 161struct bus_reset_event {
 162	struct event event;
 163	struct fw_cdev_event_bus_reset reset;
 164};
 165
 166struct outbound_transaction_event {
 167	struct event event;
 168	struct client *client;
 169	struct outbound_transaction_resource r;
 170	struct fw_cdev_event_response response;
 171};
 172
 173struct inbound_transaction_event {
 174	struct event event;
 175	union {
 176		struct fw_cdev_event_request request;
 177		struct fw_cdev_event_request2 request2;
 178	} req;
 179};
 180
 181struct iso_interrupt_event {
 182	struct event event;
 183	struct fw_cdev_event_iso_interrupt interrupt;
 184};
 185
 186struct iso_interrupt_mc_event {
 187	struct event event;
 188	struct fw_cdev_event_iso_interrupt_mc interrupt;
 189};
 190
 191struct iso_resource_event {
 192	struct event event;
 193	struct fw_cdev_event_iso_resource iso_resource;
 194};
 195
 196struct outbound_phy_packet_event {
 197	struct event event;
 198	struct client *client;
 199	struct fw_packet p;
 200	struct fw_cdev_event_phy_packet phy_packet;
 201};
 202
 203struct inbound_phy_packet_event {
 204	struct event event;
 205	struct fw_cdev_event_phy_packet phy_packet;
 206};
 207
 208#ifdef CONFIG_COMPAT
 209static void __user *u64_to_uptr(u64 value)
 210{
 211	if (in_compat_syscall())
 212		return compat_ptr(value);
 213	else
 214		return (void __user *)(unsigned long)value;
 215}
 216
 217static u64 uptr_to_u64(void __user *ptr)
 218{
 219	if (in_compat_syscall())
 220		return ptr_to_compat(ptr);
 221	else
 222		return (u64)(unsigned long)ptr;
 223}
 224#else
 225static inline void __user *u64_to_uptr(u64 value)
 226{
 227	return (void __user *)(unsigned long)value;
 228}
 229
 230static inline u64 uptr_to_u64(void __user *ptr)
 231{
 232	return (u64)(unsigned long)ptr;
 233}
 234#endif /* CONFIG_COMPAT */
 235
 236static int fw_device_op_open(struct inode *inode, struct file *file)
 237{
 238	struct fw_device *device;
 239	struct client *client;
 240
 241	device = fw_device_get_by_devt(inode->i_rdev);
 242	if (device == NULL)
 243		return -ENODEV;
 244
 245	if (fw_device_is_shutdown(device)) {
 246		fw_device_put(device);
 247		return -ENODEV;
 248	}
 249
 250	client = kzalloc(sizeof(*client), GFP_KERNEL);
 251	if (client == NULL) {
 252		fw_device_put(device);
 253		return -ENOMEM;
 254	}
 255
 256	client->device = device;
 257	spin_lock_init(&client->lock);
 258	idr_init(&client->resource_idr);
 259	INIT_LIST_HEAD(&client->event_list);
 260	init_waitqueue_head(&client->wait);
 261	init_waitqueue_head(&client->tx_flush_wait);
 262	INIT_LIST_HEAD(&client->phy_receiver_link);
 263	INIT_LIST_HEAD(&client->link);
 264	kref_init(&client->kref);
 265
 266	file->private_data = client;
 267
 268	return nonseekable_open(inode, file);
 269}
 270
 271static void queue_event(struct client *client, struct event *event,
 272			void *data0, size_t size0, void *data1, size_t size1)
 273{
 274	unsigned long flags;
 275
 276	event->v[0].data = data0;
 277	event->v[0].size = size0;
 278	event->v[1].data = data1;
 279	event->v[1].size = size1;
 280
 281	spin_lock_irqsave(&client->lock, flags);
 282	if (client->in_shutdown)
 283		kfree(event);
 284	else
 285		list_add_tail(&event->link, &client->event_list);
 286	spin_unlock_irqrestore(&client->lock, flags);
 287
 288	wake_up_interruptible(&client->wait);
 289}
 290
 291static int dequeue_event(struct client *client,
 292			 char __user *buffer, size_t count)
 293{
 294	struct event *event;
 295	size_t size, total;
 296	int i, ret;
 297
 298	ret = wait_event_interruptible(client->wait,
 299			!list_empty(&client->event_list) ||
 300			fw_device_is_shutdown(client->device));
 301	if (ret < 0)
 302		return ret;
 303
 304	if (list_empty(&client->event_list) &&
 305		       fw_device_is_shutdown(client->device))
 306		return -ENODEV;
 307
 308	spin_lock_irq(&client->lock);
 309	event = list_first_entry(&client->event_list, struct event, link);
 310	list_del(&event->link);
 311	spin_unlock_irq(&client->lock);
 312
 313	total = 0;
 314	for (i = 0; i < ARRAY_SIZE(event->v) && total < count; i++) {
 315		size = min(event->v[i].size, count - total);
 316		if (copy_to_user(buffer + total, event->v[i].data, size)) {
 317			ret = -EFAULT;
 318			goto out;
 319		}
 320		total += size;
 321	}
 322	ret = total;
 323
 324 out:
 325	kfree(event);
 326
 327	return ret;
 328}
 329
 330static ssize_t fw_device_op_read(struct file *file, char __user *buffer,
 331				 size_t count, loff_t *offset)
 332{
 333	struct client *client = file->private_data;
 334
 335	return dequeue_event(client, buffer, count);
 336}
 337
 338static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
 339				 struct client *client)
 340{
 341	struct fw_card *card = client->device->card;
 342
 343	spin_lock_irq(&card->lock);
 344
 345	event->closure	     = client->bus_reset_closure;
 346	event->type          = FW_CDEV_EVENT_BUS_RESET;
 347	event->generation    = client->device->generation;
 348	event->node_id       = client->device->node_id;
 349	event->local_node_id = card->local_node->node_id;
 350	event->bm_node_id    = card->bm_node_id;
 351	event->irm_node_id   = card->irm_node->node_id;
 352	event->root_node_id  = card->root_node->node_id;
 353
 354	spin_unlock_irq(&card->lock);
 355}
 356
 357static void for_each_client(struct fw_device *device,
 358			    void (*callback)(struct client *client))
 359{
 360	struct client *c;
 361
 362	mutex_lock(&device->client_list_mutex);
 363	list_for_each_entry(c, &device->client_list, link)
 364		callback(c);
 365	mutex_unlock(&device->client_list_mutex);
 366}
 367
 368static int schedule_reallocations(int id, void *p, void *data)
 369{
 370	schedule_if_iso_resource(p);
 371
 372	return 0;
 373}
 374
 375static void queue_bus_reset_event(struct client *client)
 376{
 377	struct bus_reset_event *e;
 378
 379	e = kzalloc(sizeof(*e), GFP_KERNEL);
 380	if (e == NULL)
 
 381		return;
 
 382
 383	fill_bus_reset_event(&e->reset, client);
 384
 385	queue_event(client, &e->event,
 386		    &e->reset, sizeof(e->reset), NULL, 0);
 387
 388	spin_lock_irq(&client->lock);
 389	idr_for_each(&client->resource_idr, schedule_reallocations, client);
 390	spin_unlock_irq(&client->lock);
 391}
 392
 393void fw_device_cdev_update(struct fw_device *device)
 394{
 395	for_each_client(device, queue_bus_reset_event);
 396}
 397
 398static void wake_up_client(struct client *client)
 399{
 400	wake_up_interruptible(&client->wait);
 401}
 402
 403void fw_device_cdev_remove(struct fw_device *device)
 404{
 405	for_each_client(device, wake_up_client);
 406}
 407
 408union ioctl_arg {
 409	struct fw_cdev_get_info			get_info;
 410	struct fw_cdev_send_request		send_request;
 411	struct fw_cdev_allocate			allocate;
 412	struct fw_cdev_deallocate		deallocate;
 413	struct fw_cdev_send_response		send_response;
 414	struct fw_cdev_initiate_bus_reset	initiate_bus_reset;
 415	struct fw_cdev_add_descriptor		add_descriptor;
 416	struct fw_cdev_remove_descriptor	remove_descriptor;
 417	struct fw_cdev_create_iso_context	create_iso_context;
 418	struct fw_cdev_queue_iso		queue_iso;
 419	struct fw_cdev_start_iso		start_iso;
 420	struct fw_cdev_stop_iso			stop_iso;
 421	struct fw_cdev_get_cycle_timer		get_cycle_timer;
 422	struct fw_cdev_allocate_iso_resource	allocate_iso_resource;
 423	struct fw_cdev_send_stream_packet	send_stream_packet;
 424	struct fw_cdev_get_cycle_timer2		get_cycle_timer2;
 425	struct fw_cdev_send_phy_packet		send_phy_packet;
 426	struct fw_cdev_receive_phy_packets	receive_phy_packets;
 427	struct fw_cdev_set_iso_channels		set_iso_channels;
 428	struct fw_cdev_flush_iso		flush_iso;
 429};
 430
 431static int ioctl_get_info(struct client *client, union ioctl_arg *arg)
 432{
 433	struct fw_cdev_get_info *a = &arg->get_info;
 434	struct fw_cdev_event_bus_reset bus_reset;
 435	unsigned long ret = 0;
 436
 437	client->version = a->version;
 438	a->version = FW_CDEV_KERNEL_VERSION;
 439	a->card = client->device->card->index;
 440
 441	down_read(&fw_device_rwsem);
 442
 443	if (a->rom != 0) {
 444		size_t want = a->rom_length;
 445		size_t have = client->device->config_rom_length * 4;
 446
 447		ret = copy_to_user(u64_to_uptr(a->rom),
 448				   client->device->config_rom, min(want, have));
 449	}
 450	a->rom_length = client->device->config_rom_length * 4;
 451
 452	up_read(&fw_device_rwsem);
 453
 454	if (ret != 0)
 455		return -EFAULT;
 456
 457	mutex_lock(&client->device->client_list_mutex);
 458
 459	client->bus_reset_closure = a->bus_reset_closure;
 460	if (a->bus_reset != 0) {
 461		fill_bus_reset_event(&bus_reset, client);
 462		/* unaligned size of bus_reset is 36 bytes */
 463		ret = copy_to_user(u64_to_uptr(a->bus_reset), &bus_reset, 36);
 464	}
 465	if (ret == 0 && list_empty(&client->link))
 466		list_add_tail(&client->link, &client->device->client_list);
 467
 468	mutex_unlock(&client->device->client_list_mutex);
 469
 470	return ret ? -EFAULT : 0;
 471}
 472
 473static int add_client_resource(struct client *client,
 474			       struct client_resource *resource, gfp_t gfp_mask)
 475{
 476	bool preload = gfpflags_allow_blocking(gfp_mask);
 477	unsigned long flags;
 478	int ret;
 479
 480	if (preload)
 481		idr_preload(gfp_mask);
 482	spin_lock_irqsave(&client->lock, flags);
 483
 
 484	if (client->in_shutdown)
 485		ret = -ECANCELED;
 486	else
 487		ret = idr_alloc(&client->resource_idr, resource, 0, 0,
 488				GFP_NOWAIT);
 489	if (ret >= 0) {
 490		resource->handle = ret;
 491		client_get(client);
 492		schedule_if_iso_resource(resource);
 493	}
 494
 495	spin_unlock_irqrestore(&client->lock, flags);
 496	if (preload)
 497		idr_preload_end();
 
 498
 499	return ret < 0 ? ret : 0;
 500}
 501
 502static int release_client_resource(struct client *client, u32 handle,
 503				   client_resource_release_fn_t release,
 504				   struct client_resource **return_resource)
 505{
 506	struct client_resource *resource;
 507
 508	spin_lock_irq(&client->lock);
 509	if (client->in_shutdown)
 510		resource = NULL;
 511	else
 512		resource = idr_find(&client->resource_idr, handle);
 513	if (resource && resource->release == release)
 514		idr_remove(&client->resource_idr, handle);
 515	spin_unlock_irq(&client->lock);
 516
 517	if (!(resource && resource->release == release))
 518		return -EINVAL;
 519
 520	if (return_resource)
 521		*return_resource = resource;
 522	else
 523		resource->release(client, resource);
 524
 525	client_put(client);
 526
 527	return 0;
 528}
 529
 530static void release_transaction(struct client *client,
 531				struct client_resource *resource)
 532{
 533}
 534
 535static void complete_transaction(struct fw_card *card, int rcode,
 536				 void *payload, size_t length, void *data)
 537{
 538	struct outbound_transaction_event *e = data;
 539	struct fw_cdev_event_response *rsp = &e->response;
 540	struct client *client = e->client;
 541	unsigned long flags;
 542
 543	if (length < rsp->length)
 544		rsp->length = length;
 545	if (rcode == RCODE_COMPLETE)
 546		memcpy(rsp->data, payload, rsp->length);
 547
 548	spin_lock_irqsave(&client->lock, flags);
 549	idr_remove(&client->resource_idr, e->r.resource.handle);
 550	if (client->in_shutdown)
 551		wake_up(&client->tx_flush_wait);
 552	spin_unlock_irqrestore(&client->lock, flags);
 553
 554	rsp->type = FW_CDEV_EVENT_RESPONSE;
 555	rsp->rcode = rcode;
 556
 557	/*
 558	 * In the case that sizeof(*rsp) doesn't align with the position of the
 559	 * data, and the read is short, preserve an extra copy of the data
 560	 * to stay compatible with a pre-2.6.27 bug.  Since the bug is harmless
 561	 * for short reads and some apps depended on it, this is both safe
 562	 * and prudent for compatibility.
 563	 */
 564	if (rsp->length <= sizeof(*rsp) - offsetof(typeof(*rsp), data))
 565		queue_event(client, &e->event, rsp, sizeof(*rsp),
 566			    rsp->data, rsp->length);
 567	else
 568		queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length,
 569			    NULL, 0);
 570
 571	/* Drop the idr's reference */
 572	client_put(client);
 573}
 574
 575static int init_request(struct client *client,
 576			struct fw_cdev_send_request *request,
 577			int destination_id, int speed)
 578{
 579	struct outbound_transaction_event *e;
 580	int ret;
 581
 582	if (request->tcode != TCODE_STREAM_DATA &&
 583	    (request->length > 4096 || request->length > 512 << speed))
 584		return -EIO;
 585
 586	if (request->tcode == TCODE_WRITE_QUADLET_REQUEST &&
 587	    request->length < 4)
 588		return -EINVAL;
 589
 590	e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL);
 591	if (e == NULL)
 592		return -ENOMEM;
 593
 594	e->client = client;
 595	e->response.length = request->length;
 596	e->response.closure = request->closure;
 597
 598	if (request->data &&
 599	    copy_from_user(e->response.data,
 600			   u64_to_uptr(request->data), request->length)) {
 601		ret = -EFAULT;
 602		goto failed;
 603	}
 604
 605	e->r.resource.release = release_transaction;
 606	ret = add_client_resource(client, &e->r.resource, GFP_KERNEL);
 607	if (ret < 0)
 608		goto failed;
 609
 610	fw_send_request(client->device->card, &e->r.transaction,
 611			request->tcode, destination_id, request->generation,
 612			speed, request->offset, e->response.data,
 613			request->length, complete_transaction, e);
 614	return 0;
 615
 616 failed:
 617	kfree(e);
 618
 619	return ret;
 620}
 621
 622static int ioctl_send_request(struct client *client, union ioctl_arg *arg)
 623{
 624	switch (arg->send_request.tcode) {
 625	case TCODE_WRITE_QUADLET_REQUEST:
 626	case TCODE_WRITE_BLOCK_REQUEST:
 627	case TCODE_READ_QUADLET_REQUEST:
 628	case TCODE_READ_BLOCK_REQUEST:
 629	case TCODE_LOCK_MASK_SWAP:
 630	case TCODE_LOCK_COMPARE_SWAP:
 631	case TCODE_LOCK_FETCH_ADD:
 632	case TCODE_LOCK_LITTLE_ADD:
 633	case TCODE_LOCK_BOUNDED_ADD:
 634	case TCODE_LOCK_WRAP_ADD:
 635	case TCODE_LOCK_VENDOR_DEPENDENT:
 636		break;
 637	default:
 638		return -EINVAL;
 639	}
 640
 641	return init_request(client, &arg->send_request, client->device->node_id,
 642			    client->device->max_speed);
 643}
 644
 645static inline bool is_fcp_request(struct fw_request *request)
 646{
 647	return request == NULL;
 648}
 649
 650static void release_request(struct client *client,
 651			    struct client_resource *resource)
 652{
 653	struct inbound_transaction_resource *r = container_of(resource,
 654			struct inbound_transaction_resource, resource);
 655
 656	if (is_fcp_request(r->request))
 657		kfree(r->data);
 658	else
 659		fw_send_response(r->card, r->request, RCODE_CONFLICT_ERROR);
 660
 661	fw_card_put(r->card);
 662	kfree(r);
 663}
 664
 665static void handle_request(struct fw_card *card, struct fw_request *request,
 666			   int tcode, int destination, int source,
 667			   int generation, unsigned long long offset,
 668			   void *payload, size_t length, void *callback_data)
 669{
 670	struct address_handler_resource *handler = callback_data;
 671	struct inbound_transaction_resource *r;
 672	struct inbound_transaction_event *e;
 673	size_t event_size0;
 674	void *fcp_frame = NULL;
 675	int ret;
 676
 677	/* card may be different from handler->client->device->card */
 678	fw_card_get(card);
 679
 680	r = kmalloc(sizeof(*r), GFP_ATOMIC);
 681	e = kmalloc(sizeof(*e), GFP_ATOMIC);
 682	if (r == NULL || e == NULL)
 
 683		goto failed;
 684
 685	r->card    = card;
 686	r->request = request;
 687	r->data    = payload;
 688	r->length  = length;
 689
 690	if (is_fcp_request(request)) {
 691		/*
 692		 * FIXME: Let core-transaction.c manage a
 693		 * single reference-counted copy?
 694		 */
 695		fcp_frame = kmemdup(payload, length, GFP_ATOMIC);
 696		if (fcp_frame == NULL)
 697			goto failed;
 698
 699		r->data = fcp_frame;
 700	}
 701
 702	r->resource.release = release_request;
 703	ret = add_client_resource(handler->client, &r->resource, GFP_ATOMIC);
 704	if (ret < 0)
 705		goto failed;
 706
 707	if (handler->client->version < FW_CDEV_VERSION_EVENT_REQUEST2) {
 708		struct fw_cdev_event_request *req = &e->req.request;
 709
 710		if (tcode & 0x10)
 711			tcode = TCODE_LOCK_REQUEST;
 712
 713		req->type	= FW_CDEV_EVENT_REQUEST;
 714		req->tcode	= tcode;
 715		req->offset	= offset;
 716		req->length	= length;
 717		req->handle	= r->resource.handle;
 718		req->closure	= handler->closure;
 719		event_size0	= sizeof(*req);
 720	} else {
 721		struct fw_cdev_event_request2 *req = &e->req.request2;
 722
 723		req->type	= FW_CDEV_EVENT_REQUEST2;
 724		req->tcode	= tcode;
 725		req->offset	= offset;
 726		req->source_node_id = source;
 727		req->destination_node_id = destination;
 728		req->card	= card->index;
 729		req->generation	= generation;
 730		req->length	= length;
 731		req->handle	= r->resource.handle;
 732		req->closure	= handler->closure;
 733		event_size0	= sizeof(*req);
 734	}
 735
 736	queue_event(handler->client, &e->event,
 737		    &e->req, event_size0, r->data, length);
 738	return;
 739
 740 failed:
 741	kfree(r);
 742	kfree(e);
 743	kfree(fcp_frame);
 744
 745	if (!is_fcp_request(request))
 746		fw_send_response(card, request, RCODE_CONFLICT_ERROR);
 747
 748	fw_card_put(card);
 749}
 750
 751static void release_address_handler(struct client *client,
 752				    struct client_resource *resource)
 753{
 754	struct address_handler_resource *r =
 755	    container_of(resource, struct address_handler_resource, resource);
 756
 757	fw_core_remove_address_handler(&r->handler);
 758	kfree(r);
 759}
 760
 761static int ioctl_allocate(struct client *client, union ioctl_arg *arg)
 762{
 763	struct fw_cdev_allocate *a = &arg->allocate;
 764	struct address_handler_resource *r;
 765	struct fw_address_region region;
 766	int ret;
 767
 768	r = kmalloc(sizeof(*r), GFP_KERNEL);
 769	if (r == NULL)
 770		return -ENOMEM;
 771
 772	region.start = a->offset;
 773	if (client->version < FW_CDEV_VERSION_ALLOCATE_REGION_END)
 774		region.end = a->offset + a->length;
 775	else
 776		region.end = a->region_end;
 777
 778	r->handler.length           = a->length;
 779	r->handler.address_callback = handle_request;
 780	r->handler.callback_data    = r;
 781	r->closure   = a->closure;
 782	r->client    = client;
 783
 784	ret = fw_core_add_address_handler(&r->handler, &region);
 785	if (ret < 0) {
 786		kfree(r);
 787		return ret;
 788	}
 789	a->offset = r->handler.offset;
 790
 791	r->resource.release = release_address_handler;
 792	ret = add_client_resource(client, &r->resource, GFP_KERNEL);
 793	if (ret < 0) {
 794		release_address_handler(client, &r->resource);
 795		return ret;
 796	}
 797	a->handle = r->resource.handle;
 798
 799	return 0;
 800}
 801
 802static int ioctl_deallocate(struct client *client, union ioctl_arg *arg)
 803{
 804	return release_client_resource(client, arg->deallocate.handle,
 805				       release_address_handler, NULL);
 806}
 807
 808static int ioctl_send_response(struct client *client, union ioctl_arg *arg)
 809{
 810	struct fw_cdev_send_response *a = &arg->send_response;
 811	struct client_resource *resource;
 812	struct inbound_transaction_resource *r;
 813	int ret = 0;
 814
 815	if (release_client_resource(client, a->handle,
 816				    release_request, &resource) < 0)
 817		return -EINVAL;
 818
 819	r = container_of(resource, struct inbound_transaction_resource,
 820			 resource);
 821	if (is_fcp_request(r->request))
 822		goto out;
 823
 824	if (a->length != fw_get_response_length(r->request)) {
 825		ret = -EINVAL;
 826		kfree(r->request);
 827		goto out;
 828	}
 829	if (copy_from_user(r->data, u64_to_uptr(a->data), a->length)) {
 830		ret = -EFAULT;
 831		kfree(r->request);
 832		goto out;
 833	}
 834	fw_send_response(r->card, r->request, a->rcode);
 835 out:
 836	fw_card_put(r->card);
 837	kfree(r);
 838
 839	return ret;
 840}
 841
 842static int ioctl_initiate_bus_reset(struct client *client, union ioctl_arg *arg)
 843{
 844	fw_schedule_bus_reset(client->device->card, true,
 845			arg->initiate_bus_reset.type == FW_CDEV_SHORT_RESET);
 846	return 0;
 847}
 848
 849static void release_descriptor(struct client *client,
 850			       struct client_resource *resource)
 851{
 852	struct descriptor_resource *r =
 853		container_of(resource, struct descriptor_resource, resource);
 854
 855	fw_core_remove_descriptor(&r->descriptor);
 856	kfree(r);
 857}
 858
 859static int ioctl_add_descriptor(struct client *client, union ioctl_arg *arg)
 860{
 861	struct fw_cdev_add_descriptor *a = &arg->add_descriptor;
 862	struct descriptor_resource *r;
 863	int ret;
 864
 865	/* Access policy: Allow this ioctl only on local nodes' device files. */
 866	if (!client->device->is_local)
 867		return -ENOSYS;
 868
 869	if (a->length > 256)
 870		return -EINVAL;
 871
 872	r = kmalloc(sizeof(*r) + a->length * 4, GFP_KERNEL);
 873	if (r == NULL)
 874		return -ENOMEM;
 875
 876	if (copy_from_user(r->data, u64_to_uptr(a->data), a->length * 4)) {
 877		ret = -EFAULT;
 878		goto failed;
 879	}
 880
 881	r->descriptor.length    = a->length;
 882	r->descriptor.immediate = a->immediate;
 883	r->descriptor.key       = a->key;
 884	r->descriptor.data      = r->data;
 885
 886	ret = fw_core_add_descriptor(&r->descriptor);
 887	if (ret < 0)
 888		goto failed;
 889
 890	r->resource.release = release_descriptor;
 891	ret = add_client_resource(client, &r->resource, GFP_KERNEL);
 892	if (ret < 0) {
 893		fw_core_remove_descriptor(&r->descriptor);
 894		goto failed;
 895	}
 896	a->handle = r->resource.handle;
 897
 898	return 0;
 899 failed:
 900	kfree(r);
 901
 902	return ret;
 903}
 904
 905static int ioctl_remove_descriptor(struct client *client, union ioctl_arg *arg)
 906{
 907	return release_client_resource(client, arg->remove_descriptor.handle,
 908				       release_descriptor, NULL);
 909}
 910
 911static void iso_callback(struct fw_iso_context *context, u32 cycle,
 912			 size_t header_length, void *header, void *data)
 913{
 914	struct client *client = data;
 915	struct iso_interrupt_event *e;
 916
 917	e = kmalloc(sizeof(*e) + header_length, GFP_ATOMIC);
 918	if (e == NULL)
 
 919		return;
 920
 921	e->interrupt.type      = FW_CDEV_EVENT_ISO_INTERRUPT;
 922	e->interrupt.closure   = client->iso_closure;
 923	e->interrupt.cycle     = cycle;
 924	e->interrupt.header_length = header_length;
 925	memcpy(e->interrupt.header, header, header_length);
 926	queue_event(client, &e->event, &e->interrupt,
 927		    sizeof(e->interrupt) + header_length, NULL, 0);
 928}
 929
 930static void iso_mc_callback(struct fw_iso_context *context,
 931			    dma_addr_t completed, void *data)
 932{
 933	struct client *client = data;
 934	struct iso_interrupt_mc_event *e;
 935
 936	e = kmalloc(sizeof(*e), GFP_ATOMIC);
 937	if (e == NULL)
 
 938		return;
 939
 940	e->interrupt.type      = FW_CDEV_EVENT_ISO_INTERRUPT_MULTICHANNEL;
 941	e->interrupt.closure   = client->iso_closure;
 942	e->interrupt.completed = fw_iso_buffer_lookup(&client->buffer,
 943						      completed);
 944	queue_event(client, &e->event, &e->interrupt,
 945		    sizeof(e->interrupt), NULL, 0);
 946}
 947
 948static enum dma_data_direction iso_dma_direction(struct fw_iso_context *context)
 949{
 950		if (context->type == FW_ISO_CONTEXT_TRANSMIT)
 951			return DMA_TO_DEVICE;
 952		else
 953			return DMA_FROM_DEVICE;
 954}
 955
 956static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
 957{
 958	struct fw_cdev_create_iso_context *a = &arg->create_iso_context;
 959	struct fw_iso_context *context;
 960	fw_iso_callback_t cb;
 961	int ret;
 962
 963	BUILD_BUG_ON(FW_CDEV_ISO_CONTEXT_TRANSMIT != FW_ISO_CONTEXT_TRANSMIT ||
 964		     FW_CDEV_ISO_CONTEXT_RECEIVE  != FW_ISO_CONTEXT_RECEIVE  ||
 965		     FW_CDEV_ISO_CONTEXT_RECEIVE_MULTICHANNEL !=
 966					FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL);
 967
 968	switch (a->type) {
 969	case FW_ISO_CONTEXT_TRANSMIT:
 970		if (a->speed > SCODE_3200 || a->channel > 63)
 971			return -EINVAL;
 972
 973		cb = iso_callback;
 974		break;
 975
 976	case FW_ISO_CONTEXT_RECEIVE:
 977		if (a->header_size < 4 || (a->header_size & 3) ||
 978		    a->channel > 63)
 979			return -EINVAL;
 980
 981		cb = iso_callback;
 982		break;
 983
 984	case FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL:
 985		cb = (fw_iso_callback_t)iso_mc_callback;
 986		break;
 987
 988	default:
 989		return -EINVAL;
 990	}
 991
 992	context = fw_iso_context_create(client->device->card, a->type,
 993			a->channel, a->speed, a->header_size, cb, client);
 994	if (IS_ERR(context))
 995		return PTR_ERR(context);
 996	if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)
 997		context->drop_overflow_headers = true;
 998
 999	/* We only support one context at this time. */
1000	spin_lock_irq(&client->lock);
1001	if (client->iso_context != NULL) {
1002		spin_unlock_irq(&client->lock);
1003		fw_iso_context_destroy(context);
1004
1005		return -EBUSY;
1006	}
1007	if (!client->buffer_is_mapped) {
1008		ret = fw_iso_buffer_map_dma(&client->buffer,
1009					    client->device->card,
1010					    iso_dma_direction(context));
1011		if (ret < 0) {
1012			spin_unlock_irq(&client->lock);
1013			fw_iso_context_destroy(context);
1014
1015			return ret;
1016		}
1017		client->buffer_is_mapped = true;
1018	}
1019	client->iso_closure = a->closure;
1020	client->iso_context = context;
1021	spin_unlock_irq(&client->lock);
1022
1023	a->handle = 0;
1024
1025	return 0;
1026}
1027
1028static int ioctl_set_iso_channels(struct client *client, union ioctl_arg *arg)
1029{
1030	struct fw_cdev_set_iso_channels *a = &arg->set_iso_channels;
1031	struct fw_iso_context *ctx = client->iso_context;
1032
1033	if (ctx == NULL || a->handle != 0)
1034		return -EINVAL;
1035
1036	return fw_iso_context_set_channels(ctx, &a->channels);
1037}
1038
1039/* Macros for decoding the iso packet control header. */
1040#define GET_PAYLOAD_LENGTH(v)	((v) & 0xffff)
1041#define GET_INTERRUPT(v)	(((v) >> 16) & 0x01)
1042#define GET_SKIP(v)		(((v) >> 17) & 0x01)
1043#define GET_TAG(v)		(((v) >> 18) & 0x03)
1044#define GET_SY(v)		(((v) >> 20) & 0x0f)
1045#define GET_HEADER_LENGTH(v)	(((v) >> 24) & 0xff)
1046
1047static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
1048{
1049	struct fw_cdev_queue_iso *a = &arg->queue_iso;
1050	struct fw_cdev_iso_packet __user *p, *end, *next;
1051	struct fw_iso_context *ctx = client->iso_context;
1052	unsigned long payload, buffer_end, transmit_header_bytes = 0;
1053	u32 control;
1054	int count;
1055	struct {
1056		struct fw_iso_packet packet;
1057		u8 header[256];
1058	} u;
1059
1060	if (ctx == NULL || a->handle != 0)
1061		return -EINVAL;
1062
1063	/*
1064	 * If the user passes a non-NULL data pointer, has mmap()'ed
1065	 * the iso buffer, and the pointer points inside the buffer,
1066	 * we setup the payload pointers accordingly.  Otherwise we
1067	 * set them both to 0, which will still let packets with
1068	 * payload_length == 0 through.  In other words, if no packets
1069	 * use the indirect payload, the iso buffer need not be mapped
1070	 * and the a->data pointer is ignored.
1071	 */
1072	payload = (unsigned long)a->data - client->vm_start;
1073	buffer_end = client->buffer.page_count << PAGE_SHIFT;
1074	if (a->data == 0 || client->buffer.pages == NULL ||
1075	    payload >= buffer_end) {
1076		payload = 0;
1077		buffer_end = 0;
1078	}
1079
1080	if (ctx->type == FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL && payload & 3)
1081		return -EINVAL;
1082
1083	p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(a->packets);
 
 
1084
1085	end = (void __user *)p + a->size;
1086	count = 0;
1087	while (p < end) {
1088		if (get_user(control, &p->control))
1089			return -EFAULT;
1090		u.packet.payload_length = GET_PAYLOAD_LENGTH(control);
1091		u.packet.interrupt = GET_INTERRUPT(control);
1092		u.packet.skip = GET_SKIP(control);
1093		u.packet.tag = GET_TAG(control);
1094		u.packet.sy = GET_SY(control);
1095		u.packet.header_length = GET_HEADER_LENGTH(control);
1096
1097		switch (ctx->type) {
1098		case FW_ISO_CONTEXT_TRANSMIT:
1099			if (u.packet.header_length & 3)
1100				return -EINVAL;
1101			transmit_header_bytes = u.packet.header_length;
1102			break;
1103
1104		case FW_ISO_CONTEXT_RECEIVE:
1105			if (u.packet.header_length == 0 ||
1106			    u.packet.header_length % ctx->header_size != 0)
1107				return -EINVAL;
1108			break;
1109
1110		case FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL:
1111			if (u.packet.payload_length == 0 ||
1112			    u.packet.payload_length & 3)
1113				return -EINVAL;
1114			break;
1115		}
1116
1117		next = (struct fw_cdev_iso_packet __user *)
1118			&p->header[transmit_header_bytes / 4];
1119		if (next > end)
1120			return -EINVAL;
1121		if (copy_from_user
1122		    (u.packet.header, p->header, transmit_header_bytes))
1123			return -EFAULT;
1124		if (u.packet.skip && ctx->type == FW_ISO_CONTEXT_TRANSMIT &&
1125		    u.packet.header_length + u.packet.payload_length > 0)
1126			return -EINVAL;
1127		if (payload + u.packet.payload_length > buffer_end)
1128			return -EINVAL;
1129
1130		if (fw_iso_context_queue(ctx, &u.packet,
1131					 &client->buffer, payload))
1132			break;
1133
1134		p = next;
1135		payload += u.packet.payload_length;
1136		count++;
1137	}
1138	fw_iso_context_queue_flush(ctx);
1139
1140	a->size    -= uptr_to_u64(p) - a->packets;
1141	a->packets  = uptr_to_u64(p);
1142	a->data     = client->vm_start + payload;
1143
1144	return count;
1145}
1146
1147static int ioctl_start_iso(struct client *client, union ioctl_arg *arg)
1148{
1149	struct fw_cdev_start_iso *a = &arg->start_iso;
1150
1151	BUILD_BUG_ON(
1152	    FW_CDEV_ISO_CONTEXT_MATCH_TAG0 != FW_ISO_CONTEXT_MATCH_TAG0 ||
1153	    FW_CDEV_ISO_CONTEXT_MATCH_TAG1 != FW_ISO_CONTEXT_MATCH_TAG1 ||
1154	    FW_CDEV_ISO_CONTEXT_MATCH_TAG2 != FW_ISO_CONTEXT_MATCH_TAG2 ||
1155	    FW_CDEV_ISO_CONTEXT_MATCH_TAG3 != FW_ISO_CONTEXT_MATCH_TAG3 ||
1156	    FW_CDEV_ISO_CONTEXT_MATCH_ALL_TAGS != FW_ISO_CONTEXT_MATCH_ALL_TAGS);
1157
1158	if (client->iso_context == NULL || a->handle != 0)
1159		return -EINVAL;
1160
1161	if (client->iso_context->type == FW_ISO_CONTEXT_RECEIVE &&
1162	    (a->tags == 0 || a->tags > 15 || a->sync > 15))
1163		return -EINVAL;
1164
1165	return fw_iso_context_start(client->iso_context,
1166				    a->cycle, a->sync, a->tags);
1167}
1168
1169static int ioctl_stop_iso(struct client *client, union ioctl_arg *arg)
1170{
1171	struct fw_cdev_stop_iso *a = &arg->stop_iso;
1172
1173	if (client->iso_context == NULL || a->handle != 0)
1174		return -EINVAL;
1175
1176	return fw_iso_context_stop(client->iso_context);
1177}
1178
1179static int ioctl_flush_iso(struct client *client, union ioctl_arg *arg)
1180{
1181	struct fw_cdev_flush_iso *a = &arg->flush_iso;
1182
1183	if (client->iso_context == NULL || a->handle != 0)
1184		return -EINVAL;
1185
1186	return fw_iso_context_flush_completions(client->iso_context);
1187}
1188
1189static int ioctl_get_cycle_timer2(struct client *client, union ioctl_arg *arg)
1190{
1191	struct fw_cdev_get_cycle_timer2 *a = &arg->get_cycle_timer2;
1192	struct fw_card *card = client->device->card;
1193	struct timespec64 ts = {0, 0};
1194	u32 cycle_time;
1195	int ret = 0;
1196
1197	local_irq_disable();
1198
1199	cycle_time = card->driver->read_csr(card, CSR_CYCLE_TIME);
1200
1201	switch (a->clk_id) {
1202	case CLOCK_REALTIME:      ktime_get_real_ts64(&ts);	break;
1203	case CLOCK_MONOTONIC:     ktime_get_ts64(&ts);		break;
1204	case CLOCK_MONOTONIC_RAW: ktime_get_raw_ts64(&ts);	break;
1205	default:
1206		ret = -EINVAL;
1207	}
1208
1209	local_irq_enable();
1210
1211	a->tv_sec      = ts.tv_sec;
1212	a->tv_nsec     = ts.tv_nsec;
1213	a->cycle_timer = cycle_time;
1214
1215	return ret;
1216}
1217
1218static int ioctl_get_cycle_timer(struct client *client, union ioctl_arg *arg)
1219{
1220	struct fw_cdev_get_cycle_timer *a = &arg->get_cycle_timer;
1221	struct fw_cdev_get_cycle_timer2 ct2;
1222
1223	ct2.clk_id = CLOCK_REALTIME;
1224	ioctl_get_cycle_timer2(client, (union ioctl_arg *)&ct2);
1225
1226	a->local_time = ct2.tv_sec * USEC_PER_SEC + ct2.tv_nsec / NSEC_PER_USEC;
1227	a->cycle_timer = ct2.cycle_timer;
1228
1229	return 0;
1230}
1231
1232static void iso_resource_work(struct work_struct *work)
1233{
1234	struct iso_resource_event *e;
1235	struct iso_resource *r =
1236			container_of(work, struct iso_resource, work.work);
1237	struct client *client = r->client;
1238	int generation, channel, bandwidth, todo;
1239	bool skip, free, success;
1240
1241	spin_lock_irq(&client->lock);
1242	generation = client->device->generation;
1243	todo = r->todo;
1244	/* Allow 1000ms grace period for other reallocations. */
1245	if (todo == ISO_RES_ALLOC &&
1246	    time_before64(get_jiffies_64(),
1247			  client->device->card->reset_jiffies + HZ)) {
1248		schedule_iso_resource(r, DIV_ROUND_UP(HZ, 3));
1249		skip = true;
1250	} else {
1251		/* We could be called twice within the same generation. */
1252		skip = todo == ISO_RES_REALLOC &&
1253		       r->generation == generation;
1254	}
1255	free = todo == ISO_RES_DEALLOC ||
1256	       todo == ISO_RES_ALLOC_ONCE ||
1257	       todo == ISO_RES_DEALLOC_ONCE;
1258	r->generation = generation;
1259	spin_unlock_irq(&client->lock);
1260
1261	if (skip)
1262		goto out;
1263
1264	bandwidth = r->bandwidth;
1265
1266	fw_iso_resource_manage(client->device->card, generation,
1267			r->channels, &channel, &bandwidth,
1268			todo == ISO_RES_ALLOC ||
1269			todo == ISO_RES_REALLOC ||
1270			todo == ISO_RES_ALLOC_ONCE);
1271	/*
1272	 * Is this generation outdated already?  As long as this resource sticks
1273	 * in the idr, it will be scheduled again for a newer generation or at
1274	 * shutdown.
1275	 */
1276	if (channel == -EAGAIN &&
1277	    (todo == ISO_RES_ALLOC || todo == ISO_RES_REALLOC))
1278		goto out;
1279
1280	success = channel >= 0 || bandwidth > 0;
1281
1282	spin_lock_irq(&client->lock);
1283	/*
1284	 * Transit from allocation to reallocation, except if the client
1285	 * requested deallocation in the meantime.
1286	 */
1287	if (r->todo == ISO_RES_ALLOC)
1288		r->todo = ISO_RES_REALLOC;
1289	/*
1290	 * Allocation or reallocation failure?  Pull this resource out of the
1291	 * idr and prepare for deletion, unless the client is shutting down.
1292	 */
1293	if (r->todo == ISO_RES_REALLOC && !success &&
1294	    !client->in_shutdown &&
1295	    idr_remove(&client->resource_idr, r->resource.handle)) {
 
1296		client_put(client);
1297		free = true;
1298	}
1299	spin_unlock_irq(&client->lock);
1300
1301	if (todo == ISO_RES_ALLOC && channel >= 0)
1302		r->channels = 1ULL << channel;
1303
1304	if (todo == ISO_RES_REALLOC && success)
1305		goto out;
1306
1307	if (todo == ISO_RES_ALLOC || todo == ISO_RES_ALLOC_ONCE) {
1308		e = r->e_alloc;
1309		r->e_alloc = NULL;
1310	} else {
1311		e = r->e_dealloc;
1312		r->e_dealloc = NULL;
1313	}
1314	e->iso_resource.handle    = r->resource.handle;
1315	e->iso_resource.channel   = channel;
1316	e->iso_resource.bandwidth = bandwidth;
1317
1318	queue_event(client, &e->event,
1319		    &e->iso_resource, sizeof(e->iso_resource), NULL, 0);
1320
1321	if (free) {
1322		cancel_delayed_work(&r->work);
1323		kfree(r->e_alloc);
1324		kfree(r->e_dealloc);
1325		kfree(r);
1326	}
1327 out:
1328	client_put(client);
1329}
1330
1331static void release_iso_resource(struct client *client,
1332				 struct client_resource *resource)
1333{
1334	struct iso_resource *r =
1335		container_of(resource, struct iso_resource, resource);
1336
1337	spin_lock_irq(&client->lock);
1338	r->todo = ISO_RES_DEALLOC;
1339	schedule_iso_resource(r, 0);
1340	spin_unlock_irq(&client->lock);
1341}
1342
1343static int init_iso_resource(struct client *client,
1344		struct fw_cdev_allocate_iso_resource *request, int todo)
1345{
1346	struct iso_resource_event *e1, *e2;
1347	struct iso_resource *r;
1348	int ret;
1349
1350	if ((request->channels == 0 && request->bandwidth == 0) ||
1351	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
 
1352		return -EINVAL;
1353
1354	r  = kmalloc(sizeof(*r), GFP_KERNEL);
1355	e1 = kmalloc(sizeof(*e1), GFP_KERNEL);
1356	e2 = kmalloc(sizeof(*e2), GFP_KERNEL);
1357	if (r == NULL || e1 == NULL || e2 == NULL) {
1358		ret = -ENOMEM;
1359		goto fail;
1360	}
1361
1362	INIT_DELAYED_WORK(&r->work, iso_resource_work);
1363	r->client	= client;
1364	r->todo		= todo;
1365	r->generation	= -1;
1366	r->channels	= request->channels;
1367	r->bandwidth	= request->bandwidth;
1368	r->e_alloc	= e1;
1369	r->e_dealloc	= e2;
1370
1371	e1->iso_resource.closure = request->closure;
1372	e1->iso_resource.type    = FW_CDEV_EVENT_ISO_RESOURCE_ALLOCATED;
1373	e2->iso_resource.closure = request->closure;
1374	e2->iso_resource.type    = FW_CDEV_EVENT_ISO_RESOURCE_DEALLOCATED;
1375
1376	if (todo == ISO_RES_ALLOC) {
1377		r->resource.release = release_iso_resource;
1378		ret = add_client_resource(client, &r->resource, GFP_KERNEL);
1379		if (ret < 0)
1380			goto fail;
1381	} else {
1382		r->resource.release = NULL;
1383		r->resource.handle = -1;
1384		schedule_iso_resource(r, 0);
1385	}
1386	request->handle = r->resource.handle;
1387
1388	return 0;
1389 fail:
1390	kfree(r);
1391	kfree(e1);
1392	kfree(e2);
1393
1394	return ret;
1395}
1396
1397static int ioctl_allocate_iso_resource(struct client *client,
1398				       union ioctl_arg *arg)
1399{
1400	return init_iso_resource(client,
1401			&arg->allocate_iso_resource, ISO_RES_ALLOC);
1402}
1403
1404static int ioctl_deallocate_iso_resource(struct client *client,
1405					 union ioctl_arg *arg)
1406{
1407	return release_client_resource(client,
1408			arg->deallocate.handle, release_iso_resource, NULL);
1409}
1410
1411static int ioctl_allocate_iso_resource_once(struct client *client,
1412					    union ioctl_arg *arg)
1413{
1414	return init_iso_resource(client,
1415			&arg->allocate_iso_resource, ISO_RES_ALLOC_ONCE);
1416}
1417
1418static int ioctl_deallocate_iso_resource_once(struct client *client,
1419					      union ioctl_arg *arg)
1420{
1421	return init_iso_resource(client,
1422			&arg->allocate_iso_resource, ISO_RES_DEALLOC_ONCE);
1423}
1424
1425/*
1426 * Returns a speed code:  Maximum speed to or from this device,
1427 * limited by the device's link speed, the local node's link speed,
1428 * and all PHY port speeds between the two links.
1429 */
1430static int ioctl_get_speed(struct client *client, union ioctl_arg *arg)
1431{
1432	return client->device->max_speed;
1433}
1434
1435static int ioctl_send_broadcast_request(struct client *client,
1436					union ioctl_arg *arg)
1437{
1438	struct fw_cdev_send_request *a = &arg->send_request;
1439
1440	switch (a->tcode) {
1441	case TCODE_WRITE_QUADLET_REQUEST:
1442	case TCODE_WRITE_BLOCK_REQUEST:
1443		break;
1444	default:
1445		return -EINVAL;
1446	}
1447
1448	/* Security policy: Only allow accesses to Units Space. */
1449	if (a->offset < CSR_REGISTER_BASE + CSR_CONFIG_ROM_END)
1450		return -EACCES;
1451
1452	return init_request(client, a, LOCAL_BUS | 0x3f, SCODE_100);
1453}
1454
1455static int ioctl_send_stream_packet(struct client *client, union ioctl_arg *arg)
1456{
1457	struct fw_cdev_send_stream_packet *a = &arg->send_stream_packet;
1458	struct fw_cdev_send_request request;
1459	int dest;
1460
1461	if (a->speed > client->device->card->link_speed ||
1462	    a->length > 1024 << a->speed)
1463		return -EIO;
1464
1465	if (a->tag > 3 || a->channel > 63 || a->sy > 15)
1466		return -EINVAL;
1467
1468	dest = fw_stream_packet_destination_id(a->tag, a->channel, a->sy);
1469	request.tcode		= TCODE_STREAM_DATA;
1470	request.length		= a->length;
1471	request.closure		= a->closure;
1472	request.data		= a->data;
1473	request.generation	= a->generation;
1474
1475	return init_request(client, &request, dest, a->speed);
1476}
1477
1478static void outbound_phy_packet_callback(struct fw_packet *packet,
1479					 struct fw_card *card, int status)
1480{
1481	struct outbound_phy_packet_event *e =
1482		container_of(packet, struct outbound_phy_packet_event, p);
1483
1484	switch (status) {
1485	/* expected: */
1486	case ACK_COMPLETE:	e->phy_packet.rcode = RCODE_COMPLETE;	break;
1487	/* should never happen with PHY packets: */
1488	case ACK_PENDING:	e->phy_packet.rcode = RCODE_COMPLETE;	break;
1489	case ACK_BUSY_X:
1490	case ACK_BUSY_A:
1491	case ACK_BUSY_B:	e->phy_packet.rcode = RCODE_BUSY;	break;
1492	case ACK_DATA_ERROR:	e->phy_packet.rcode = RCODE_DATA_ERROR;	break;
1493	case ACK_TYPE_ERROR:	e->phy_packet.rcode = RCODE_TYPE_ERROR;	break;
1494	/* stale generation; cancelled; on certain controllers: no ack */
1495	default:		e->phy_packet.rcode = status;		break;
1496	}
1497	e->phy_packet.data[0] = packet->timestamp;
1498
1499	queue_event(e->client, &e->event, &e->phy_packet,
1500		    sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
1501	client_put(e->client);
1502}
1503
1504static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
1505{
1506	struct fw_cdev_send_phy_packet *a = &arg->send_phy_packet;
1507	struct fw_card *card = client->device->card;
1508	struct outbound_phy_packet_event *e;
1509
1510	/* Access policy: Allow this ioctl only on local nodes' device files. */
1511	if (!client->device->is_local)
1512		return -ENOSYS;
1513
1514	e = kzalloc(sizeof(*e) + 4, GFP_KERNEL);
1515	if (e == NULL)
1516		return -ENOMEM;
1517
1518	client_get(client);
1519	e->client		= client;
1520	e->p.speed		= SCODE_100;
1521	e->p.generation		= a->generation;
1522	e->p.header[0]		= TCODE_LINK_INTERNAL << 4;
1523	e->p.header[1]		= a->data[0];
1524	e->p.header[2]		= a->data[1];
1525	e->p.header_length	= 12;
1526	e->p.callback		= outbound_phy_packet_callback;
1527	e->phy_packet.closure	= a->closure;
1528	e->phy_packet.type	= FW_CDEV_EVENT_PHY_PACKET_SENT;
1529	if (is_ping_packet(a->data))
1530			e->phy_packet.length = 4;
1531
1532	card->driver->send_request(card, &e->p);
1533
1534	return 0;
1535}
1536
1537static int ioctl_receive_phy_packets(struct client *client, union ioctl_arg *arg)
1538{
1539	struct fw_cdev_receive_phy_packets *a = &arg->receive_phy_packets;
1540	struct fw_card *card = client->device->card;
1541
1542	/* Access policy: Allow this ioctl only on local nodes' device files. */
1543	if (!client->device->is_local)
1544		return -ENOSYS;
1545
1546	spin_lock_irq(&card->lock);
1547
1548	list_move_tail(&client->phy_receiver_link, &card->phy_receiver_list);
1549	client->phy_receiver_closure = a->closure;
1550
1551	spin_unlock_irq(&card->lock);
1552
1553	return 0;
1554}
1555
1556void fw_cdev_handle_phy_packet(struct fw_card *card, struct fw_packet *p)
1557{
1558	struct client *client;
1559	struct inbound_phy_packet_event *e;
1560	unsigned long flags;
1561
1562	spin_lock_irqsave(&card->lock, flags);
1563
1564	list_for_each_entry(client, &card->phy_receiver_list, phy_receiver_link) {
1565		e = kmalloc(sizeof(*e) + 8, GFP_ATOMIC);
1566		if (e == NULL)
 
1567			break;
1568
1569		e->phy_packet.closure	= client->phy_receiver_closure;
1570		e->phy_packet.type	= FW_CDEV_EVENT_PHY_PACKET_RECEIVED;
1571		e->phy_packet.rcode	= RCODE_COMPLETE;
1572		e->phy_packet.length	= 8;
1573		e->phy_packet.data[0]	= p->header[1];
1574		e->phy_packet.data[1]	= p->header[2];
1575		queue_event(client, &e->event,
1576			    &e->phy_packet, sizeof(e->phy_packet) + 8, NULL, 0);
1577	}
1578
1579	spin_unlock_irqrestore(&card->lock, flags);
1580}
1581
1582static int (* const ioctl_handlers[])(struct client *, union ioctl_arg *) = {
1583	[0x00] = ioctl_get_info,
1584	[0x01] = ioctl_send_request,
1585	[0x02] = ioctl_allocate,
1586	[0x03] = ioctl_deallocate,
1587	[0x04] = ioctl_send_response,
1588	[0x05] = ioctl_initiate_bus_reset,
1589	[0x06] = ioctl_add_descriptor,
1590	[0x07] = ioctl_remove_descriptor,
1591	[0x08] = ioctl_create_iso_context,
1592	[0x09] = ioctl_queue_iso,
1593	[0x0a] = ioctl_start_iso,
1594	[0x0b] = ioctl_stop_iso,
1595	[0x0c] = ioctl_get_cycle_timer,
1596	[0x0d] = ioctl_allocate_iso_resource,
1597	[0x0e] = ioctl_deallocate_iso_resource,
1598	[0x0f] = ioctl_allocate_iso_resource_once,
1599	[0x10] = ioctl_deallocate_iso_resource_once,
1600	[0x11] = ioctl_get_speed,
1601	[0x12] = ioctl_send_broadcast_request,
1602	[0x13] = ioctl_send_stream_packet,
1603	[0x14] = ioctl_get_cycle_timer2,
1604	[0x15] = ioctl_send_phy_packet,
1605	[0x16] = ioctl_receive_phy_packets,
1606	[0x17] = ioctl_set_iso_channels,
1607	[0x18] = ioctl_flush_iso,
1608};
1609
1610static int dispatch_ioctl(struct client *client,
1611			  unsigned int cmd, void __user *arg)
1612{
1613	union ioctl_arg buffer;
1614	int ret;
1615
1616	if (fw_device_is_shutdown(client->device))
1617		return -ENODEV;
1618
1619	if (_IOC_TYPE(cmd) != '#' ||
1620	    _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
1621	    _IOC_SIZE(cmd) > sizeof(buffer))
1622		return -ENOTTY;
1623
1624	memset(&buffer, 0, sizeof(buffer));
 
1625
1626	if (_IOC_DIR(cmd) & _IOC_WRITE)
1627		if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
1628			return -EFAULT;
1629
1630	ret = ioctl_handlers[_IOC_NR(cmd)](client, &buffer);
1631	if (ret < 0)
1632		return ret;
1633
1634	if (_IOC_DIR(cmd) & _IOC_READ)
1635		if (copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
1636			return -EFAULT;
1637
1638	return ret;
1639}
1640
1641static long fw_device_op_ioctl(struct file *file,
1642			       unsigned int cmd, unsigned long arg)
1643{
1644	return dispatch_ioctl(file->private_data, cmd, (void __user *)arg);
1645}
1646
 
 
 
 
 
 
 
 
1647static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
1648{
1649	struct client *client = file->private_data;
 
1650	unsigned long size;
1651	int page_count, ret;
1652
1653	if (fw_device_is_shutdown(client->device))
1654		return -ENODEV;
1655
1656	/* FIXME: We could support multiple buffers, but we don't. */
1657	if (client->buffer.pages != NULL)
1658		return -EBUSY;
1659
1660	if (!(vma->vm_flags & VM_SHARED))
1661		return -EINVAL;
1662
1663	if (vma->vm_start & ~PAGE_MASK)
1664		return -EINVAL;
1665
1666	client->vm_start = vma->vm_start;
1667	size = vma->vm_end - vma->vm_start;
1668	page_count = size >> PAGE_SHIFT;
1669	if (size & ~PAGE_MASK)
1670		return -EINVAL;
1671
1672	ret = fw_iso_buffer_alloc(&client->buffer, page_count);
1673	if (ret < 0)
1674		return ret;
 
1675
1676	spin_lock_irq(&client->lock);
1677	if (client->iso_context) {
1678		ret = fw_iso_buffer_map_dma(&client->buffer,
1679				client->device->card,
1680				iso_dma_direction(client->iso_context));
1681		client->buffer_is_mapped = (ret == 0);
1682	}
1683	spin_unlock_irq(&client->lock);
1684	if (ret < 0)
1685		goto fail;
1686
1687	ret = vm_map_pages_zero(vma, client->buffer.pages,
1688				client->buffer.page_count);
1689	if (ret < 0)
1690		goto fail;
1691
1692	return 0;
1693 fail:
1694	fw_iso_buffer_destroy(&client->buffer, client->device->card);
1695	return ret;
1696}
1697
1698static int is_outbound_transaction_resource(int id, void *p, void *data)
1699{
1700	struct client_resource *resource = p;
1701
1702	return resource->release == release_transaction;
1703}
1704
1705static int has_outbound_transactions(struct client *client)
1706{
1707	int ret;
1708
1709	spin_lock_irq(&client->lock);
1710	ret = idr_for_each(&client->resource_idr,
1711			   is_outbound_transaction_resource, NULL);
1712	spin_unlock_irq(&client->lock);
1713
1714	return ret;
1715}
1716
1717static int shutdown_resource(int id, void *p, void *data)
1718{
1719	struct client_resource *resource = p;
1720	struct client *client = data;
1721
1722	resource->release(client, resource);
1723	client_put(client);
1724
1725	return 0;
1726}
1727
1728static int fw_device_op_release(struct inode *inode, struct file *file)
1729{
1730	struct client *client = file->private_data;
1731	struct event *event, *next_event;
1732
1733	spin_lock_irq(&client->device->card->lock);
1734	list_del(&client->phy_receiver_link);
1735	spin_unlock_irq(&client->device->card->lock);
1736
1737	mutex_lock(&client->device->client_list_mutex);
1738	list_del(&client->link);
1739	mutex_unlock(&client->device->client_list_mutex);
1740
1741	if (client->iso_context)
1742		fw_iso_context_destroy(client->iso_context);
1743
1744	if (client->buffer.pages)
1745		fw_iso_buffer_destroy(&client->buffer, client->device->card);
1746
1747	/* Freeze client->resource_idr and client->event_list */
1748	spin_lock_irq(&client->lock);
1749	client->in_shutdown = true;
1750	spin_unlock_irq(&client->lock);
1751
1752	wait_event(client->tx_flush_wait, !has_outbound_transactions(client));
1753
1754	idr_for_each(&client->resource_idr, shutdown_resource, client);
 
1755	idr_destroy(&client->resource_idr);
1756
1757	list_for_each_entry_safe(event, next_event, &client->event_list, link)
1758		kfree(event);
1759
1760	client_put(client);
1761
1762	return 0;
1763}
1764
1765static __poll_t fw_device_op_poll(struct file *file, poll_table * pt)
1766{
1767	struct client *client = file->private_data;
1768	__poll_t mask = 0;
1769
1770	poll_wait(file, &client->wait, pt);
1771
1772	if (fw_device_is_shutdown(client->device))
1773		mask |= EPOLLHUP | EPOLLERR;
1774	if (!list_empty(&client->event_list))
1775		mask |= EPOLLIN | EPOLLRDNORM;
1776
1777	return mask;
1778}
1779
1780const struct file_operations fw_device_ops = {
1781	.owner		= THIS_MODULE,
1782	.llseek		= no_llseek,
1783	.open		= fw_device_op_open,
1784	.read		= fw_device_op_read,
1785	.unlocked_ioctl	= fw_device_op_ioctl,
1786	.mmap		= fw_device_op_mmap,
1787	.release	= fw_device_op_release,
1788	.poll		= fw_device_op_poll,
1789	.compat_ioctl	= compat_ptr_ioctl,
 
 
1790};