1 /* 2 * Char device for device raw access 3 * 4 * Copyright (C) 2005-2007 Kristian Hoegsberg <krh@bitplanet.net> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software Foundation, 18 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 19 */ 20 21 #include <linux/compat.h> 22 #include <linux/delay.h> 23 #include <linux/device.h> 24 #include <linux/errno.h> 25 #include <linux/firewire.h> 26 #include <linux/firewire-cdev.h> 27 #include <linux/idr.h> 28 #include <linux/jiffies.h> 29 #include <linux/kernel.h> 30 #include <linux/kref.h> 31 #include <linux/mm.h> 32 #include <linux/module.h> 33 #include <linux/mutex.h> 34 #include <linux/poll.h> 35 #include <linux/preempt.h> 36 #include <linux/sched.h> 37 #include <linux/spinlock.h> 38 #include <linux/string.h> 39 #include <linux/time.h> 40 #include <linux/uaccess.h> 41 #include <linux/vmalloc.h> 42 #include <linux/wait.h> 43 #include <linux/workqueue.h> 44 45 #include <asm/system.h> 46 47 #include "core.h" 48 49 struct client { 50 u32 version; 51 struct fw_device *device; 52 53 spinlock_t lock; 54 bool in_shutdown; 55 struct idr resource_idr; 56 struct list_head event_list; 57 wait_queue_head_t wait; 58 u64 bus_reset_closure; 59 60 struct fw_iso_context *iso_context; 61 u64 iso_closure; 62 struct fw_iso_buffer buffer; 63 unsigned long vm_start; 64 65 struct list_head link; 66 struct kref kref; 67 }; 68 69 static inline void client_get(struct client *client) 70 { 71 kref_get(&client->kref); 72 } 73 74 static void client_release(struct kref *kref) 75 { 76 struct client *client = container_of(kref, struct client, kref); 77 78 fw_device_put(client->device); 79 kfree(client); 80 } 81 82 static void client_put(struct client *client) 83 { 84 kref_put(&client->kref, client_release); 85 } 86 87 struct client_resource; 88 typedef void (*client_resource_release_fn_t)(struct client *, 89 struct client_resource *); 90 struct client_resource { 91 client_resource_release_fn_t release; 92 int handle; 93 }; 94 95 struct address_handler_resource { 96 struct client_resource resource; 97 struct fw_address_handler handler; 98 __u64 closure; 99 struct client *client; 100 }; 101 102 struct outbound_transaction_resource { 103 struct client_resource resource; 104 struct fw_transaction transaction; 105 }; 106 107 struct inbound_transaction_resource { 108 struct client_resource resource; 109 struct fw_request *request; 110 void *data; 111 size_t length; 112 }; 113 114 struct descriptor_resource { 115 struct client_resource resource; 116 struct fw_descriptor descriptor; 117 u32 data[0]; 118 }; 119 120 struct iso_resource { 121 struct client_resource resource; 122 struct client *client; 123 /* Schedule work and access todo only with client->lock held. */ 124 struct delayed_work work; 125 enum {ISO_RES_ALLOC, ISO_RES_REALLOC, ISO_RES_DEALLOC, 126 ISO_RES_ALLOC_ONCE, ISO_RES_DEALLOC_ONCE,} todo; 127 int generation; 128 u64 channels; 129 s32 bandwidth; 130 __be32 transaction_data[2]; 131 struct iso_resource_event *e_alloc, *e_dealloc; 132 }; 133 134 static void release_iso_resource(struct client *, struct client_resource *); 135 136 static void schedule_iso_resource(struct iso_resource *r, unsigned long delay) 137 { 138 client_get(r->client); 139 if (!schedule_delayed_work(&r->work, delay)) 140 client_put(r->client); 141 } 142 143 static void schedule_if_iso_resource(struct client_resource *resource) 144 { 145 if (resource->release == release_iso_resource) 146 schedule_iso_resource(container_of(resource, 147 struct iso_resource, resource), 0); 148 } 149 150 /* 151 * dequeue_event() just kfree()'s the event, so the event has to be 152 * the first field in a struct XYZ_event. 153 */ 154 struct event { 155 struct { void *data; size_t size; } v[2]; 156 struct list_head link; 157 }; 158 159 struct bus_reset_event { 160 struct event event; 161 struct fw_cdev_event_bus_reset reset; 162 }; 163 164 struct outbound_transaction_event { 165 struct event event; 166 struct client *client; 167 struct outbound_transaction_resource r; 168 struct fw_cdev_event_response response; 169 }; 170 171 struct inbound_transaction_event { 172 struct event event; 173 struct fw_cdev_event_request request; 174 }; 175 176 struct iso_interrupt_event { 177 struct event event; 178 struct fw_cdev_event_iso_interrupt interrupt; 179 }; 180 181 struct iso_resource_event { 182 struct event event; 183 struct fw_cdev_event_iso_resource iso_resource; 184 }; 185 186 static inline void __user *u64_to_uptr(__u64 value) 187 { 188 return (void __user *)(unsigned long)value; 189 } 190 191 static inline __u64 uptr_to_u64(void __user *ptr) 192 { 193 return (__u64)(unsigned long)ptr; 194 } 195 196 static int fw_device_op_open(struct inode *inode, struct file *file) 197 { 198 struct fw_device *device; 199 struct client *client; 200 201 device = fw_device_get_by_devt(inode->i_rdev); 202 if (device == NULL) 203 return -ENODEV; 204 205 if (fw_device_is_shutdown(device)) { 206 fw_device_put(device); 207 return -ENODEV; 208 } 209 210 client = kzalloc(sizeof(*client), GFP_KERNEL); 211 if (client == NULL) { 212 fw_device_put(device); 213 return -ENOMEM; 214 } 215 216 client->device = device; 217 spin_lock_init(&client->lock); 218 idr_init(&client->resource_idr); 219 INIT_LIST_HEAD(&client->event_list); 220 init_waitqueue_head(&client->wait); 221 kref_init(&client->kref); 222 223 file->private_data = client; 224 225 mutex_lock(&device->client_list_mutex); 226 list_add_tail(&client->link, &device->client_list); 227 mutex_unlock(&device->client_list_mutex); 228 229 return 0; 230 } 231 232 static void queue_event(struct client *client, struct event *event, 233 void *data0, size_t size0, void *data1, size_t size1) 234 { 235 unsigned long flags; 236 237 event->v[0].data = data0; 238 event->v[0].size = size0; 239 event->v[1].data = data1; 240 event->v[1].size = size1; 241 242 spin_lock_irqsave(&client->lock, flags); 243 if (client->in_shutdown) 244 kfree(event); 245 else 246 list_add_tail(&event->link, &client->event_list); 247 spin_unlock_irqrestore(&client->lock, flags); 248 249 wake_up_interruptible(&client->wait); 250 } 251 252 static int dequeue_event(struct client *client, 253 char __user *buffer, size_t count) 254 { 255 struct event *event; 256 size_t size, total; 257 int i, ret; 258 259 ret = wait_event_interruptible(client->wait, 260 !list_empty(&client->event_list) || 261 fw_device_is_shutdown(client->device)); 262 if (ret < 0) 263 return ret; 264 265 if (list_empty(&client->event_list) && 266 fw_device_is_shutdown(client->device)) 267 return -ENODEV; 268 269 spin_lock_irq(&client->lock); 270 event = list_first_entry(&client->event_list, struct event, link); 271 list_del(&event->link); 272 spin_unlock_irq(&client->lock); 273 274 total = 0; 275 for (i = 0; i < ARRAY_SIZE(event->v) && total < count; i++) { 276 size = min(event->v[i].size, count - total); 277 if (copy_to_user(buffer + total, event->v[i].data, size)) { 278 ret = -EFAULT; 279 goto out; 280 } 281 total += size; 282 } 283 ret = total; 284 285 out: 286 kfree(event); 287 288 return ret; 289 } 290 291 static ssize_t fw_device_op_read(struct file *file, char __user *buffer, 292 size_t count, loff_t *offset) 293 { 294 struct client *client = file->private_data; 295 296 return dequeue_event(client, buffer, count); 297 } 298 299 static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event, 300 struct client *client) 301 { 302 struct fw_card *card = client->device->card; 303 304 spin_lock_irq(&card->lock); 305 306 event->closure = client->bus_reset_closure; 307 event->type = FW_CDEV_EVENT_BUS_RESET; 308 event->generation = client->device->generation; 309 event->node_id = client->device->node_id; 310 event->local_node_id = card->local_node->node_id; 311 event->bm_node_id = 0; /* FIXME: We don't track the BM. */ 312 event->irm_node_id = card->irm_node->node_id; 313 event->root_node_id = card->root_node->node_id; 314 315 spin_unlock_irq(&card->lock); 316 } 317 318 static void for_each_client(struct fw_device *device, 319 void (*callback)(struct client *client)) 320 { 321 struct client *c; 322 323 mutex_lock(&device->client_list_mutex); 324 list_for_each_entry(c, &device->client_list, link) 325 callback(c); 326 mutex_unlock(&device->client_list_mutex); 327 } 328 329 static int schedule_reallocations(int id, void *p, void *data) 330 { 331 schedule_if_iso_resource(p); 332 333 return 0; 334 } 335 336 static void queue_bus_reset_event(struct client *client) 337 { 338 struct bus_reset_event *e; 339 340 e = kzalloc(sizeof(*e), GFP_KERNEL); 341 if (e == NULL) { 342 fw_notify("Out of memory when allocating bus reset event\n"); 343 return; 344 } 345 346 fill_bus_reset_event(&e->reset, client); 347 348 queue_event(client, &e->event, 349 &e->reset, sizeof(e->reset), NULL, 0); 350 351 spin_lock_irq(&client->lock); 352 idr_for_each(&client->resource_idr, schedule_reallocations, client); 353 spin_unlock_irq(&client->lock); 354 } 355 356 void fw_device_cdev_update(struct fw_device *device) 357 { 358 for_each_client(device, queue_bus_reset_event); 359 } 360 361 static void wake_up_client(struct client *client) 362 { 363 wake_up_interruptible(&client->wait); 364 } 365 366 void fw_device_cdev_remove(struct fw_device *device) 367 { 368 for_each_client(device, wake_up_client); 369 } 370 371 static int ioctl_get_info(struct client *client, void *buffer) 372 { 373 struct fw_cdev_get_info *get_info = buffer; 374 struct fw_cdev_event_bus_reset bus_reset; 375 unsigned long ret = 0; 376 377 client->version = get_info->version; 378 get_info->version = FW_CDEV_VERSION; 379 get_info->card = client->device->card->index; 380 381 down_read(&fw_device_rwsem); 382 383 if (get_info->rom != 0) { 384 void __user *uptr = u64_to_uptr(get_info->rom); 385 size_t want = get_info->rom_length; 386 size_t have = client->device->config_rom_length * 4; 387 388 ret = copy_to_user(uptr, client->device->config_rom, 389 min(want, have)); 390 } 391 get_info->rom_length = client->device->config_rom_length * 4; 392 393 up_read(&fw_device_rwsem); 394 395 if (ret != 0) 396 return -EFAULT; 397 398 client->bus_reset_closure = get_info->bus_reset_closure; 399 if (get_info->bus_reset != 0) { 400 void __user *uptr = u64_to_uptr(get_info->bus_reset); 401 402 fill_bus_reset_event(&bus_reset, client); 403 if (copy_to_user(uptr, &bus_reset, sizeof(bus_reset))) 404 return -EFAULT; 405 } 406 407 return 0; 408 } 409 410 static int add_client_resource(struct client *client, 411 struct client_resource *resource, gfp_t gfp_mask) 412 { 413 unsigned long flags; 414 int ret; 415 416 retry: 417 if (idr_pre_get(&client->resource_idr, gfp_mask) == 0) 418 return -ENOMEM; 419 420 spin_lock_irqsave(&client->lock, flags); 421 if (client->in_shutdown) 422 ret = -ECANCELED; 423 else 424 ret = idr_get_new(&client->resource_idr, resource, 425 &resource->handle); 426 if (ret >= 0) { 427 client_get(client); 428 schedule_if_iso_resource(resource); 429 } 430 spin_unlock_irqrestore(&client->lock, flags); 431 432 if (ret == -EAGAIN) 433 goto retry; 434 435 return ret < 0 ? ret : 0; 436 } 437 438 static int release_client_resource(struct client *client, u32 handle, 439 client_resource_release_fn_t release, 440 struct client_resource **return_resource) 441 { 442 struct client_resource *resource; 443 444 spin_lock_irq(&client->lock); 445 if (client->in_shutdown) 446 resource = NULL; 447 else 448 resource = idr_find(&client->resource_idr, handle); 449 if (resource && resource->release == release) 450 idr_remove(&client->resource_idr, handle); 451 spin_unlock_irq(&client->lock); 452 453 if (!(resource && resource->release == release)) 454 return -EINVAL; 455 456 if (return_resource) 457 *return_resource = resource; 458 else 459 resource->release(client, resource); 460 461 client_put(client); 462 463 return 0; 464 } 465 466 static void release_transaction(struct client *client, 467 struct client_resource *resource) 468 { 469 struct outbound_transaction_resource *r = container_of(resource, 470 struct outbound_transaction_resource, resource); 471 472 fw_cancel_transaction(client->device->card, &r->transaction); 473 } 474 475 static void complete_transaction(struct fw_card *card, int rcode, 476 void *payload, size_t length, void *data) 477 { 478 struct outbound_transaction_event *e = data; 479 struct fw_cdev_event_response *rsp = &e->response; 480 struct client *client = e->client; 481 unsigned long flags; 482 483 if (length < rsp->length) 484 rsp->length = length; 485 if (rcode == RCODE_COMPLETE) 486 memcpy(rsp->data, payload, rsp->length); 487 488 spin_lock_irqsave(&client->lock, flags); 489 /* 490 * 1. If called while in shutdown, the idr tree must be left untouched. 491 * The idr handle will be removed and the client reference will be 492 * dropped later. 493 * 2. If the call chain was release_client_resource -> 494 * release_transaction -> complete_transaction (instead of a normal 495 * conclusion of the transaction), i.e. if this resource was already 496 * unregistered from the idr, the client reference will be dropped 497 * by release_client_resource and we must not drop it here. 498 */ 499 if (!client->in_shutdown && 500 idr_find(&client->resource_idr, e->r.resource.handle)) { 501 idr_remove(&client->resource_idr, e->r.resource.handle); 502 /* Drop the idr's reference */ 503 client_put(client); 504 } 505 spin_unlock_irqrestore(&client->lock, flags); 506 507 rsp->type = FW_CDEV_EVENT_RESPONSE; 508 rsp->rcode = rcode; 509 510 /* 511 * In the case that sizeof(*rsp) doesn't align with the position of the 512 * data, and the read is short, preserve an extra copy of the data 513 * to stay compatible with a pre-2.6.27 bug. Since the bug is harmless 514 * for short reads and some apps depended on it, this is both safe 515 * and prudent for compatibility. 516 */ 517 if (rsp->length <= sizeof(*rsp) - offsetof(typeof(*rsp), data)) 518 queue_event(client, &e->event, rsp, sizeof(*rsp), 519 rsp->data, rsp->length); 520 else 521 queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length, 522 NULL, 0); 523 524 /* Drop the transaction callback's reference */ 525 client_put(client); 526 } 527 528 static int init_request(struct client *client, 529 struct fw_cdev_send_request *request, 530 int destination_id, int speed) 531 { 532 struct outbound_transaction_event *e; 533 int ret; 534 535 if (request->tcode != TCODE_STREAM_DATA && 536 (request->length > 4096 || request->length > 512 << speed)) 537 return -EIO; 538 539 e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL); 540 if (e == NULL) 541 return -ENOMEM; 542 543 e->client = client; 544 e->response.length = request->length; 545 e->response.closure = request->closure; 546 547 if (request->data && 548 copy_from_user(e->response.data, 549 u64_to_uptr(request->data), request->length)) { 550 ret = -EFAULT; 551 goto failed; 552 } 553 554 e->r.resource.release = release_transaction; 555 ret = add_client_resource(client, &e->r.resource, GFP_KERNEL); 556 if (ret < 0) 557 goto failed; 558 559 /* Get a reference for the transaction callback */ 560 client_get(client); 561 562 fw_send_request(client->device->card, &e->r.transaction, 563 request->tcode, destination_id, request->generation, 564 speed, request->offset, e->response.data, 565 request->length, complete_transaction, e); 566 return 0; 567 568 failed: 569 kfree(e); 570 571 return ret; 572 } 573 574 static int ioctl_send_request(struct client *client, void *buffer) 575 { 576 struct fw_cdev_send_request *request = buffer; 577 578 switch (request->tcode) { 579 case TCODE_WRITE_QUADLET_REQUEST: 580 case TCODE_WRITE_BLOCK_REQUEST: 581 case TCODE_READ_QUADLET_REQUEST: 582 case TCODE_READ_BLOCK_REQUEST: 583 case TCODE_LOCK_MASK_SWAP: 584 case TCODE_LOCK_COMPARE_SWAP: 585 case TCODE_LOCK_FETCH_ADD: 586 case TCODE_LOCK_LITTLE_ADD: 587 case TCODE_LOCK_BOUNDED_ADD: 588 case TCODE_LOCK_WRAP_ADD: 589 case TCODE_LOCK_VENDOR_DEPENDENT: 590 break; 591 default: 592 return -EINVAL; 593 } 594 595 return init_request(client, request, client->device->node_id, 596 client->device->max_speed); 597 } 598 599 static inline bool is_fcp_request(struct fw_request *request) 600 { 601 return request == NULL; 602 } 603 604 static void release_request(struct client *client, 605 struct client_resource *resource) 606 { 607 struct inbound_transaction_resource *r = container_of(resource, 608 struct inbound_transaction_resource, resource); 609 610 if (is_fcp_request(r->request)) 611 kfree(r->data); 612 else 613 fw_send_response(client->device->card, r->request, 614 RCODE_CONFLICT_ERROR); 615 kfree(r); 616 } 617 618 static void handle_request(struct fw_card *card, struct fw_request *request, 619 int tcode, int destination, int source, 620 int generation, int speed, 621 unsigned long long offset, 622 void *payload, size_t length, void *callback_data) 623 { 624 struct address_handler_resource *handler = callback_data; 625 struct inbound_transaction_resource *r; 626 struct inbound_transaction_event *e; 627 void *fcp_frame = NULL; 628 int ret; 629 630 r = kmalloc(sizeof(*r), GFP_ATOMIC); 631 e = kmalloc(sizeof(*e), GFP_ATOMIC); 632 if (r == NULL || e == NULL) 633 goto failed; 634 635 r->request = request; 636 r->data = payload; 637 r->length = length; 638 639 if (is_fcp_request(request)) { 640 /* 641 * FIXME: Let core-transaction.c manage a 642 * single reference-counted copy? 643 */ 644 fcp_frame = kmemdup(payload, length, GFP_ATOMIC); 645 if (fcp_frame == NULL) 646 goto failed; 647 648 r->data = fcp_frame; 649 } 650 651 r->resource.release = release_request; 652 ret = add_client_resource(handler->client, &r->resource, GFP_ATOMIC); 653 if (ret < 0) 654 goto failed; 655 656 e->request.type = FW_CDEV_EVENT_REQUEST; 657 e->request.tcode = tcode; 658 e->request.offset = offset; 659 e->request.length = length; 660 e->request.handle = r->resource.handle; 661 e->request.closure = handler->closure; 662 663 queue_event(handler->client, &e->event, 664 &e->request, sizeof(e->request), r->data, length); 665 return; 666 667 failed: 668 kfree(r); 669 kfree(e); 670 kfree(fcp_frame); 671 672 if (!is_fcp_request(request)) 673 fw_send_response(card, request, RCODE_CONFLICT_ERROR); 674 } 675 676 static void release_address_handler(struct client *client, 677 struct client_resource *resource) 678 { 679 struct address_handler_resource *r = 680 container_of(resource, struct address_handler_resource, resource); 681 682 fw_core_remove_address_handler(&r->handler); 683 kfree(r); 684 } 685 686 static int ioctl_allocate(struct client *client, void *buffer) 687 { 688 struct fw_cdev_allocate *request = buffer; 689 struct address_handler_resource *r; 690 struct fw_address_region region; 691 int ret; 692 693 r = kmalloc(sizeof(*r), GFP_KERNEL); 694 if (r == NULL) 695 return -ENOMEM; 696 697 region.start = request->offset; 698 region.end = request->offset + request->length; 699 r->handler.length = request->length; 700 r->handler.address_callback = handle_request; 701 r->handler.callback_data = r; 702 r->closure = request->closure; 703 r->client = client; 704 705 ret = fw_core_add_address_handler(&r->handler, ®ion); 706 if (ret < 0) { 707 kfree(r); 708 return ret; 709 } 710 711 r->resource.release = release_address_handler; 712 ret = add_client_resource(client, &r->resource, GFP_KERNEL); 713 if (ret < 0) { 714 release_address_handler(client, &r->resource); 715 return ret; 716 } 717 request->handle = r->resource.handle; 718 719 return 0; 720 } 721 722 static int ioctl_deallocate(struct client *client, void *buffer) 723 { 724 struct fw_cdev_deallocate *request = buffer; 725 726 return release_client_resource(client, request->handle, 727 release_address_handler, NULL); 728 } 729 730 static int ioctl_send_response(struct client *client, void *buffer) 731 { 732 struct fw_cdev_send_response *request = buffer; 733 struct client_resource *resource; 734 struct inbound_transaction_resource *r; 735 int ret = 0; 736 737 if (release_client_resource(client, request->handle, 738 release_request, &resource) < 0) 739 return -EINVAL; 740 741 r = container_of(resource, struct inbound_transaction_resource, 742 resource); 743 if (is_fcp_request(r->request)) 744 goto out; 745 746 if (request->length < r->length) 747 r->length = request->length; 748 if (copy_from_user(r->data, u64_to_uptr(request->data), r->length)) { 749 ret = -EFAULT; 750 kfree(r->request); 751 goto out; 752 } 753 fw_send_response(client->device->card, r->request, request->rcode); 754 out: 755 kfree(r); 756 757 return ret; 758 } 759 760 static int ioctl_initiate_bus_reset(struct client *client, void *buffer) 761 { 762 struct fw_cdev_initiate_bus_reset *request = buffer; 763 int short_reset; 764 765 short_reset = (request->type == FW_CDEV_SHORT_RESET); 766 767 return fw_core_initiate_bus_reset(client->device->card, short_reset); 768 } 769 770 static void release_descriptor(struct client *client, 771 struct client_resource *resource) 772 { 773 struct descriptor_resource *r = 774 container_of(resource, struct descriptor_resource, resource); 775 776 fw_core_remove_descriptor(&r->descriptor); 777 kfree(r); 778 } 779 780 static int ioctl_add_descriptor(struct client *client, void *buffer) 781 { 782 struct fw_cdev_add_descriptor *request = buffer; 783 struct descriptor_resource *r; 784 int ret; 785 786 /* Access policy: Allow this ioctl only on local nodes' device files. */ 787 if (!client->device->is_local) 788 return -ENOSYS; 789 790 if (request->length > 256) 791 return -EINVAL; 792 793 r = kmalloc(sizeof(*r) + request->length * 4, GFP_KERNEL); 794 if (r == NULL) 795 return -ENOMEM; 796 797 if (copy_from_user(r->data, 798 u64_to_uptr(request->data), request->length * 4)) { 799 ret = -EFAULT; 800 goto failed; 801 } 802 803 r->descriptor.length = request->length; 804 r->descriptor.immediate = request->immediate; 805 r->descriptor.key = request->key; 806 r->descriptor.data = r->data; 807 808 ret = fw_core_add_descriptor(&r->descriptor); 809 if (ret < 0) 810 goto failed; 811 812 r->resource.release = release_descriptor; 813 ret = add_client_resource(client, &r->resource, GFP_KERNEL); 814 if (ret < 0) { 815 fw_core_remove_descriptor(&r->descriptor); 816 goto failed; 817 } 818 request->handle = r->resource.handle; 819 820 return 0; 821 failed: 822 kfree(r); 823 824 return ret; 825 } 826 827 static int ioctl_remove_descriptor(struct client *client, void *buffer) 828 { 829 struct fw_cdev_remove_descriptor *request = buffer; 830 831 return release_client_resource(client, request->handle, 832 release_descriptor, NULL); 833 } 834 835 static void iso_callback(struct fw_iso_context *context, u32 cycle, 836 size_t header_length, void *header, void *data) 837 { 838 struct client *client = data; 839 struct iso_interrupt_event *e; 840 841 e = kzalloc(sizeof(*e) + header_length, GFP_ATOMIC); 842 if (e == NULL) 843 return; 844 845 e->interrupt.type = FW_CDEV_EVENT_ISO_INTERRUPT; 846 e->interrupt.closure = client->iso_closure; 847 e->interrupt.cycle = cycle; 848 e->interrupt.header_length = header_length; 849 memcpy(e->interrupt.header, header, header_length); 850 queue_event(client, &e->event, &e->interrupt, 851 sizeof(e->interrupt) + header_length, NULL, 0); 852 } 853 854 static int ioctl_create_iso_context(struct client *client, void *buffer) 855 { 856 struct fw_cdev_create_iso_context *request = buffer; 857 struct fw_iso_context *context; 858 859 /* We only support one context at this time. */ 860 if (client->iso_context != NULL) 861 return -EBUSY; 862 863 if (request->channel > 63) 864 return -EINVAL; 865 866 switch (request->type) { 867 case FW_ISO_CONTEXT_RECEIVE: 868 if (request->header_size < 4 || (request->header_size & 3)) 869 return -EINVAL; 870 871 break; 872 873 case FW_ISO_CONTEXT_TRANSMIT: 874 if (request->speed > SCODE_3200) 875 return -EINVAL; 876 877 break; 878 879 default: 880 return -EINVAL; 881 } 882 883 context = fw_iso_context_create(client->device->card, 884 request->type, 885 request->channel, 886 request->speed, 887 request->header_size, 888 iso_callback, client); 889 if (IS_ERR(context)) 890 return PTR_ERR(context); 891 892 client->iso_closure = request->closure; 893 client->iso_context = context; 894 895 /* We only support one context at this time. */ 896 request->handle = 0; 897 898 return 0; 899 } 900 901 /* Macros for decoding the iso packet control header. */ 902 #define GET_PAYLOAD_LENGTH(v) ((v) & 0xffff) 903 #define GET_INTERRUPT(v) (((v) >> 16) & 0x01) 904 #define GET_SKIP(v) (((v) >> 17) & 0x01) 905 #define GET_TAG(v) (((v) >> 18) & 0x03) 906 #define GET_SY(v) (((v) >> 20) & 0x0f) 907 #define GET_HEADER_LENGTH(v) (((v) >> 24) & 0xff) 908 909 static int ioctl_queue_iso(struct client *client, void *buffer) 910 { 911 struct fw_cdev_queue_iso *request = buffer; 912 struct fw_cdev_iso_packet __user *p, *end, *next; 913 struct fw_iso_context *ctx = client->iso_context; 914 unsigned long payload, buffer_end, header_length; 915 u32 control; 916 int count; 917 struct { 918 struct fw_iso_packet packet; 919 u8 header[256]; 920 } u; 921 922 if (ctx == NULL || request->handle != 0) 923 return -EINVAL; 924 925 /* 926 * If the user passes a non-NULL data pointer, has mmap()'ed 927 * the iso buffer, and the pointer points inside the buffer, 928 * we setup the payload pointers accordingly. Otherwise we 929 * set them both to 0, which will still let packets with 930 * payload_length == 0 through. In other words, if no packets 931 * use the indirect payload, the iso buffer need not be mapped 932 * and the request->data pointer is ignored. 933 */ 934 935 payload = (unsigned long)request->data - client->vm_start; 936 buffer_end = client->buffer.page_count << PAGE_SHIFT; 937 if (request->data == 0 || client->buffer.pages == NULL || 938 payload >= buffer_end) { 939 payload = 0; 940 buffer_end = 0; 941 } 942 943 p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(request->packets); 944 945 if (!access_ok(VERIFY_READ, p, request->size)) 946 return -EFAULT; 947 948 end = (void __user *)p + request->size; 949 count = 0; 950 while (p < end) { 951 if (get_user(control, &p->control)) 952 return -EFAULT; 953 u.packet.payload_length = GET_PAYLOAD_LENGTH(control); 954 u.packet.interrupt = GET_INTERRUPT(control); 955 u.packet.skip = GET_SKIP(control); 956 u.packet.tag = GET_TAG(control); 957 u.packet.sy = GET_SY(control); 958 u.packet.header_length = GET_HEADER_LENGTH(control); 959 960 if (ctx->type == FW_ISO_CONTEXT_TRANSMIT) { 961 header_length = u.packet.header_length; 962 } else { 963 /* 964 * We require that header_length is a multiple of 965 * the fixed header size, ctx->header_size. 966 */ 967 if (ctx->header_size == 0) { 968 if (u.packet.header_length > 0) 969 return -EINVAL; 970 } else if (u.packet.header_length % ctx->header_size != 0) { 971 return -EINVAL; 972 } 973 header_length = 0; 974 } 975 976 next = (struct fw_cdev_iso_packet __user *) 977 &p->header[header_length / 4]; 978 if (next > end) 979 return -EINVAL; 980 if (__copy_from_user 981 (u.packet.header, p->header, header_length)) 982 return -EFAULT; 983 if (u.packet.skip && ctx->type == FW_ISO_CONTEXT_TRANSMIT && 984 u.packet.header_length + u.packet.payload_length > 0) 985 return -EINVAL; 986 if (payload + u.packet.payload_length > buffer_end) 987 return -EINVAL; 988 989 if (fw_iso_context_queue(ctx, &u.packet, 990 &client->buffer, payload)) 991 break; 992 993 p = next; 994 payload += u.packet.payload_length; 995 count++; 996 } 997 998 request->size -= uptr_to_u64(p) - request->packets; 999 request->packets = uptr_to_u64(p); 1000 request->data = client->vm_start + payload; 1001 1002 return count; 1003 } 1004 1005 static int ioctl_start_iso(struct client *client, void *buffer) 1006 { 1007 struct fw_cdev_start_iso *request = buffer; 1008 1009 if (client->iso_context == NULL || request->handle != 0) 1010 return -EINVAL; 1011 1012 if (client->iso_context->type == FW_ISO_CONTEXT_RECEIVE) { 1013 if (request->tags == 0 || request->tags > 15) 1014 return -EINVAL; 1015 1016 if (request->sync > 15) 1017 return -EINVAL; 1018 } 1019 1020 return fw_iso_context_start(client->iso_context, request->cycle, 1021 request->sync, request->tags); 1022 } 1023 1024 static int ioctl_stop_iso(struct client *client, void *buffer) 1025 { 1026 struct fw_cdev_stop_iso *request = buffer; 1027 1028 if (client->iso_context == NULL || request->handle != 0) 1029 return -EINVAL; 1030 1031 return fw_iso_context_stop(client->iso_context); 1032 } 1033 1034 static int ioctl_get_cycle_timer(struct client *client, void *buffer) 1035 { 1036 struct fw_cdev_get_cycle_timer *request = buffer; 1037 struct fw_card *card = client->device->card; 1038 unsigned long long bus_time; 1039 struct timeval tv; 1040 unsigned long flags; 1041 1042 preempt_disable(); 1043 local_irq_save(flags); 1044 1045 bus_time = card->driver->get_bus_time(card); 1046 do_gettimeofday(&tv); 1047 1048 local_irq_restore(flags); 1049 preempt_enable(); 1050 1051 request->local_time = tv.tv_sec * 1000000ULL + tv.tv_usec; 1052 request->cycle_timer = bus_time & 0xffffffff; 1053 return 0; 1054 } 1055 1056 static void iso_resource_work(struct work_struct *work) 1057 { 1058 struct iso_resource_event *e; 1059 struct iso_resource *r = 1060 container_of(work, struct iso_resource, work.work); 1061 struct client *client = r->client; 1062 int generation, channel, bandwidth, todo; 1063 bool skip, free, success; 1064 1065 spin_lock_irq(&client->lock); 1066 generation = client->device->generation; 1067 todo = r->todo; 1068 /* Allow 1000ms grace period for other reallocations. */ 1069 if (todo == ISO_RES_ALLOC && 1070 time_is_after_jiffies(client->device->card->reset_jiffies + HZ)) { 1071 schedule_iso_resource(r, DIV_ROUND_UP(HZ, 3)); 1072 skip = true; 1073 } else { 1074 /* We could be called twice within the same generation. */ 1075 skip = todo == ISO_RES_REALLOC && 1076 r->generation == generation; 1077 } 1078 free = todo == ISO_RES_DEALLOC || 1079 todo == ISO_RES_ALLOC_ONCE || 1080 todo == ISO_RES_DEALLOC_ONCE; 1081 r->generation = generation; 1082 spin_unlock_irq(&client->lock); 1083 1084 if (skip) 1085 goto out; 1086 1087 bandwidth = r->bandwidth; 1088 1089 fw_iso_resource_manage(client->device->card, generation, 1090 r->channels, &channel, &bandwidth, 1091 todo == ISO_RES_ALLOC || 1092 todo == ISO_RES_REALLOC || 1093 todo == ISO_RES_ALLOC_ONCE, 1094 r->transaction_data); 1095 /* 1096 * Is this generation outdated already? As long as this resource sticks 1097 * in the idr, it will be scheduled again for a newer generation or at 1098 * shutdown. 1099 */ 1100 if (channel == -EAGAIN && 1101 (todo == ISO_RES_ALLOC || todo == ISO_RES_REALLOC)) 1102 goto out; 1103 1104 success = channel >= 0 || bandwidth > 0; 1105 1106 spin_lock_irq(&client->lock); 1107 /* 1108 * Transit from allocation to reallocation, except if the client 1109 * requested deallocation in the meantime. 1110 */ 1111 if (r->todo == ISO_RES_ALLOC) 1112 r->todo = ISO_RES_REALLOC; 1113 /* 1114 * Allocation or reallocation failure? Pull this resource out of the 1115 * idr and prepare for deletion, unless the client is shutting down. 1116 */ 1117 if (r->todo == ISO_RES_REALLOC && !success && 1118 !client->in_shutdown && 1119 idr_find(&client->resource_idr, r->resource.handle)) { 1120 idr_remove(&client->resource_idr, r->resource.handle); 1121 client_put(client); 1122 free = true; 1123 } 1124 spin_unlock_irq(&client->lock); 1125 1126 if (todo == ISO_RES_ALLOC && channel >= 0) 1127 r->channels = 1ULL << channel; 1128 1129 if (todo == ISO_RES_REALLOC && success) 1130 goto out; 1131 1132 if (todo == ISO_RES_ALLOC || todo == ISO_RES_ALLOC_ONCE) { 1133 e = r->e_alloc; 1134 r->e_alloc = NULL; 1135 } else { 1136 e = r->e_dealloc; 1137 r->e_dealloc = NULL; 1138 } 1139 e->iso_resource.handle = r->resource.handle; 1140 e->iso_resource.channel = channel; 1141 e->iso_resource.bandwidth = bandwidth; 1142 1143 queue_event(client, &e->event, 1144 &e->iso_resource, sizeof(e->iso_resource), NULL, 0); 1145 1146 if (free) { 1147 cancel_delayed_work(&r->work); 1148 kfree(r->e_alloc); 1149 kfree(r->e_dealloc); 1150 kfree(r); 1151 } 1152 out: 1153 client_put(client); 1154 } 1155 1156 static void release_iso_resource(struct client *client, 1157 struct client_resource *resource) 1158 { 1159 struct iso_resource *r = 1160 container_of(resource, struct iso_resource, resource); 1161 1162 spin_lock_irq(&client->lock); 1163 r->todo = ISO_RES_DEALLOC; 1164 schedule_iso_resource(r, 0); 1165 spin_unlock_irq(&client->lock); 1166 } 1167 1168 static int init_iso_resource(struct client *client, 1169 struct fw_cdev_allocate_iso_resource *request, int todo) 1170 { 1171 struct iso_resource_event *e1, *e2; 1172 struct iso_resource *r; 1173 int ret; 1174 1175 if ((request->channels == 0 && request->bandwidth == 0) || 1176 request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL || 1177 request->bandwidth < 0) 1178 return -EINVAL; 1179 1180 r = kmalloc(sizeof(*r), GFP_KERNEL); 1181 e1 = kmalloc(sizeof(*e1), GFP_KERNEL); 1182 e2 = kmalloc(sizeof(*e2), GFP_KERNEL); 1183 if (r == NULL || e1 == NULL || e2 == NULL) { 1184 ret = -ENOMEM; 1185 goto fail; 1186 } 1187 1188 INIT_DELAYED_WORK(&r->work, iso_resource_work); 1189 r->client = client; 1190 r->todo = todo; 1191 r->generation = -1; 1192 r->channels = request->channels; 1193 r->bandwidth = request->bandwidth; 1194 r->e_alloc = e1; 1195 r->e_dealloc = e2; 1196 1197 e1->iso_resource.closure = request->closure; 1198 e1->iso_resource.type = FW_CDEV_EVENT_ISO_RESOURCE_ALLOCATED; 1199 e2->iso_resource.closure = request->closure; 1200 e2->iso_resource.type = FW_CDEV_EVENT_ISO_RESOURCE_DEALLOCATED; 1201 1202 if (todo == ISO_RES_ALLOC) { 1203 r->resource.release = release_iso_resource; 1204 ret = add_client_resource(client, &r->resource, GFP_KERNEL); 1205 if (ret < 0) 1206 goto fail; 1207 } else { 1208 r->resource.release = NULL; 1209 r->resource.handle = -1; 1210 schedule_iso_resource(r, 0); 1211 } 1212 request->handle = r->resource.handle; 1213 1214 return 0; 1215 fail: 1216 kfree(r); 1217 kfree(e1); 1218 kfree(e2); 1219 1220 return ret; 1221 } 1222 1223 static int ioctl_allocate_iso_resource(struct client *client, void *buffer) 1224 { 1225 struct fw_cdev_allocate_iso_resource *request = buffer; 1226 1227 return init_iso_resource(client, request, ISO_RES_ALLOC); 1228 } 1229 1230 static int ioctl_deallocate_iso_resource(struct client *client, void *buffer) 1231 { 1232 struct fw_cdev_deallocate *request = buffer; 1233 1234 return release_client_resource(client, request->handle, 1235 release_iso_resource, NULL); 1236 } 1237 1238 static int ioctl_allocate_iso_resource_once(struct client *client, void *buffer) 1239 { 1240 struct fw_cdev_allocate_iso_resource *request = buffer; 1241 1242 return init_iso_resource(client, request, ISO_RES_ALLOC_ONCE); 1243 } 1244 1245 static int ioctl_deallocate_iso_resource_once(struct client *client, void *buffer) 1246 { 1247 struct fw_cdev_allocate_iso_resource *request = buffer; 1248 1249 return init_iso_resource(client, request, ISO_RES_DEALLOC_ONCE); 1250 } 1251 1252 /* 1253 * Returns a speed code: Maximum speed to or from this device, 1254 * limited by the device's link speed, the local node's link speed, 1255 * and all PHY port speeds between the two links. 1256 */ 1257 static int ioctl_get_speed(struct client *client, void *buffer) 1258 { 1259 return client->device->max_speed; 1260 } 1261 1262 static int ioctl_send_broadcast_request(struct client *client, void *buffer) 1263 { 1264 struct fw_cdev_send_request *request = buffer; 1265 1266 switch (request->tcode) { 1267 case TCODE_WRITE_QUADLET_REQUEST: 1268 case TCODE_WRITE_BLOCK_REQUEST: 1269 break; 1270 default: 1271 return -EINVAL; 1272 } 1273 1274 /* Security policy: Only allow accesses to Units Space. */ 1275 if (request->offset < CSR_REGISTER_BASE + CSR_CONFIG_ROM_END) 1276 return -EACCES; 1277 1278 return init_request(client, request, LOCAL_BUS | 0x3f, SCODE_100); 1279 } 1280 1281 static int ioctl_send_stream_packet(struct client *client, void *buffer) 1282 { 1283 struct fw_cdev_send_stream_packet *p = buffer; 1284 struct fw_cdev_send_request request; 1285 int dest; 1286 1287 if (p->speed > client->device->card->link_speed || 1288 p->length > 1024 << p->speed) 1289 return -EIO; 1290 1291 if (p->tag > 3 || p->channel > 63 || p->sy > 15) 1292 return -EINVAL; 1293 1294 dest = fw_stream_packet_destination_id(p->tag, p->channel, p->sy); 1295 request.tcode = TCODE_STREAM_DATA; 1296 request.length = p->length; 1297 request.closure = p->closure; 1298 request.data = p->data; 1299 request.generation = p->generation; 1300 1301 return init_request(client, &request, dest, p->speed); 1302 } 1303 1304 static int (* const ioctl_handlers[])(struct client *client, void *buffer) = { 1305 ioctl_get_info, 1306 ioctl_send_request, 1307 ioctl_allocate, 1308 ioctl_deallocate, 1309 ioctl_send_response, 1310 ioctl_initiate_bus_reset, 1311 ioctl_add_descriptor, 1312 ioctl_remove_descriptor, 1313 ioctl_create_iso_context, 1314 ioctl_queue_iso, 1315 ioctl_start_iso, 1316 ioctl_stop_iso, 1317 ioctl_get_cycle_timer, 1318 ioctl_allocate_iso_resource, 1319 ioctl_deallocate_iso_resource, 1320 ioctl_allocate_iso_resource_once, 1321 ioctl_deallocate_iso_resource_once, 1322 ioctl_get_speed, 1323 ioctl_send_broadcast_request, 1324 ioctl_send_stream_packet, 1325 }; 1326 1327 static int dispatch_ioctl(struct client *client, 1328 unsigned int cmd, void __user *arg) 1329 { 1330 char buffer[sizeof(union { 1331 struct fw_cdev_get_info _00; 1332 struct fw_cdev_send_request _01; 1333 struct fw_cdev_allocate _02; 1334 struct fw_cdev_deallocate _03; 1335 struct fw_cdev_send_response _04; 1336 struct fw_cdev_initiate_bus_reset _05; 1337 struct fw_cdev_add_descriptor _06; 1338 struct fw_cdev_remove_descriptor _07; 1339 struct fw_cdev_create_iso_context _08; 1340 struct fw_cdev_queue_iso _09; 1341 struct fw_cdev_start_iso _0a; 1342 struct fw_cdev_stop_iso _0b; 1343 struct fw_cdev_get_cycle_timer _0c; 1344 struct fw_cdev_allocate_iso_resource _0d; 1345 struct fw_cdev_send_stream_packet _13; 1346 })]; 1347 int ret; 1348 1349 if (_IOC_TYPE(cmd) != '#' || 1350 _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers)) 1351 return -EINVAL; 1352 1353 if (_IOC_DIR(cmd) & _IOC_WRITE) { 1354 if (_IOC_SIZE(cmd) > sizeof(buffer) || 1355 copy_from_user(buffer, arg, _IOC_SIZE(cmd))) 1356 return -EFAULT; 1357 } 1358 1359 ret = ioctl_handlers[_IOC_NR(cmd)](client, buffer); 1360 if (ret < 0) 1361 return ret; 1362 1363 if (_IOC_DIR(cmd) & _IOC_READ) { 1364 if (_IOC_SIZE(cmd) > sizeof(buffer) || 1365 copy_to_user(arg, buffer, _IOC_SIZE(cmd))) 1366 return -EFAULT; 1367 } 1368 1369 return ret; 1370 } 1371 1372 static long fw_device_op_ioctl(struct file *file, 1373 unsigned int cmd, unsigned long arg) 1374 { 1375 struct client *client = file->private_data; 1376 1377 if (fw_device_is_shutdown(client->device)) 1378 return -ENODEV; 1379 1380 return dispatch_ioctl(client, cmd, (void __user *) arg); 1381 } 1382 1383 #ifdef CONFIG_COMPAT 1384 static long fw_device_op_compat_ioctl(struct file *file, 1385 unsigned int cmd, unsigned long arg) 1386 { 1387 struct client *client = file->private_data; 1388 1389 if (fw_device_is_shutdown(client->device)) 1390 return -ENODEV; 1391 1392 return dispatch_ioctl(client, cmd, compat_ptr(arg)); 1393 } 1394 #endif 1395 1396 static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma) 1397 { 1398 struct client *client = file->private_data; 1399 enum dma_data_direction direction; 1400 unsigned long size; 1401 int page_count, ret; 1402 1403 if (fw_device_is_shutdown(client->device)) 1404 return -ENODEV; 1405 1406 /* FIXME: We could support multiple buffers, but we don't. */ 1407 if (client->buffer.pages != NULL) 1408 return -EBUSY; 1409 1410 if (!(vma->vm_flags & VM_SHARED)) 1411 return -EINVAL; 1412 1413 if (vma->vm_start & ~PAGE_MASK) 1414 return -EINVAL; 1415 1416 client->vm_start = vma->vm_start; 1417 size = vma->vm_end - vma->vm_start; 1418 page_count = size >> PAGE_SHIFT; 1419 if (size & ~PAGE_MASK) 1420 return -EINVAL; 1421 1422 if (vma->vm_flags & VM_WRITE) 1423 direction = DMA_TO_DEVICE; 1424 else 1425 direction = DMA_FROM_DEVICE; 1426 1427 ret = fw_iso_buffer_init(&client->buffer, client->device->card, 1428 page_count, direction); 1429 if (ret < 0) 1430 return ret; 1431 1432 ret = fw_iso_buffer_map(&client->buffer, vma); 1433 if (ret < 0) 1434 fw_iso_buffer_destroy(&client->buffer, client->device->card); 1435 1436 return ret; 1437 } 1438 1439 static int shutdown_resource(int id, void *p, void *data) 1440 { 1441 struct client_resource *resource = p; 1442 struct client *client = data; 1443 1444 resource->release(client, resource); 1445 client_put(client); 1446 1447 return 0; 1448 } 1449 1450 static int fw_device_op_release(struct inode *inode, struct file *file) 1451 { 1452 struct client *client = file->private_data; 1453 struct event *event, *next_event; 1454 1455 mutex_lock(&client->device->client_list_mutex); 1456 list_del(&client->link); 1457 mutex_unlock(&client->device->client_list_mutex); 1458 1459 if (client->iso_context) 1460 fw_iso_context_destroy(client->iso_context); 1461 1462 if (client->buffer.pages) 1463 fw_iso_buffer_destroy(&client->buffer, client->device->card); 1464 1465 /* Freeze client->resource_idr and client->event_list */ 1466 spin_lock_irq(&client->lock); 1467 client->in_shutdown = true; 1468 spin_unlock_irq(&client->lock); 1469 1470 idr_for_each(&client->resource_idr, shutdown_resource, client); 1471 idr_remove_all(&client->resource_idr); 1472 idr_destroy(&client->resource_idr); 1473 1474 list_for_each_entry_safe(event, next_event, &client->event_list, link) 1475 kfree(event); 1476 1477 client_put(client); 1478 1479 return 0; 1480 } 1481 1482 static unsigned int fw_device_op_poll(struct file *file, poll_table * pt) 1483 { 1484 struct client *client = file->private_data; 1485 unsigned int mask = 0; 1486 1487 poll_wait(file, &client->wait, pt); 1488 1489 if (fw_device_is_shutdown(client->device)) 1490 mask |= POLLHUP | POLLERR; 1491 if (!list_empty(&client->event_list)) 1492 mask |= POLLIN | POLLRDNORM; 1493 1494 return mask; 1495 } 1496 1497 const struct file_operations fw_device_ops = { 1498 .owner = THIS_MODULE, 1499 .open = fw_device_op_open, 1500 .read = fw_device_op_read, 1501 .unlocked_ioctl = fw_device_op_ioctl, 1502 .poll = fw_device_op_poll, 1503 .release = fw_device_op_release, 1504 .mmap = fw_device_op_mmap, 1505 1506 #ifdef CONFIG_COMPAT 1507 .compat_ioctl = fw_device_op_compat_ioctl, 1508 #endif 1509 }; 1510