drivers/firewire/core-cdev.c

   1 /*
   2  * Char device for device raw access
   3  *
   4  * Copyright (C) 2005-2007  Kristian Hoegsberg <krh@bitplanet.net>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software Foundation,
  18  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19  */
  20
  21 #include <linux/compat.h>
  22 #include <linux/delay.h>
  23 #include <linux/device.h>
  24 #include <linux/errno.h>
  25 #include <linux/firewire.h>
  26 #include <linux/firewire-cdev.h>
  27 #include <linux/idr.h>
  28 #include <linux/irqflags.h>
  29 #include <linux/jiffies.h>
  30 #include <linux/kernel.h>
  31 #include <linux/kref.h>
  32 #include <linux/mm.h>
  33 #include <linux/module.h>
  34 #include <linux/mutex.h>
  35 #include <linux/poll.h>
  36 #include <linux/sched.h>
  37 #include <linux/spinlock.h>
  38 #include <linux/string.h>
  39 #include <linux/time.h>
  40 #include <linux/uaccess.h>
  41 #include <linux/vmalloc.h>
  42 #include <linux/wait.h>
  43 #include <linux/workqueue.h>
  44
  45 #include <asm/system.h>
  46
  47 #include "core.h"
  48
  49 /*
  50  * ABI version history is documented in linux/firewire-cdev.h.
  51  */
  52 #define FW_CDEV_KERNEL_VERSION          4
  53 #define FW_CDEV_VERSION_EVENT_REQUEST2  4
  54
  55 struct client {
  56         u32 version;
  57         struct fw_device *device;
  58
  59         spinlock_t lock;
  60         bool in_shutdown;
  61         struct idr resource_idr;
  62         struct list_head event_list;
  63         wait_queue_head_t wait;
  64         u64 bus_reset_closure;
  65
  66         struct fw_iso_context *iso_context;
  67         u64 iso_closure;
  68         struct fw_iso_buffer buffer;
  69         unsigned long vm_start;
  70
  71         struct list_head link;
  72         struct kref kref;
  73 };
  74
  75 static inline void client_get(struct client *client)
  76 {
  77         kref_get(&client->kref);
  78 }
  79
  80 static void client_release(struct kref *kref)
  81 {
  82         struct client *client = container_of(kref, struct client, kref);
  83
  84         fw_device_put(client->device);
  85         kfree(client);
  86 }
  87
  88 static void client_put(struct client *client)
  89 {
  90         kref_put(&client->kref, client_release);
  91 }
  92
  93 struct client_resource;
  94 typedef void (*client_resource_release_fn_t)(struct client *,
  95                                              struct client_resource *);
  96 struct client_resource {
  97         client_resource_release_fn_t release;
  98         int handle;
  99 };
 100
 101 struct address_handler_resource {
 102         struct client_resource resource;
 103         struct fw_address_handler handler;
 104         __u64 closure;
 105         struct client *client;
 106 };
 107
 108 struct outbound_transaction_resource {
 109         struct client_resource resource;
 110         struct fw_transaction transaction;
 111 };
 112
 113 struct inbound_transaction_resource {
 114         struct client_resource resource;
 115         struct fw_card *card;
 116         struct fw_request *request;
 117         void *data;
 118         size_t length;
 119 };
 120
 121 struct descriptor_resource {
 122         struct client_resource resource;
 123         struct fw_descriptor descriptor;
 124         u32 data[0];
 125 };
 126
 127 struct iso_resource {
 128         struct client_resource resource;
 129         struct client *client;
 130         /* Schedule work and access todo only with client->lock held. */
 131         struct delayed_work work;
 132         enum {ISO_RES_ALLOC, ISO_RES_REALLOC, ISO_RES_DEALLOC,
 133               ISO_RES_ALLOC_ONCE, ISO_RES_DEALLOC_ONCE,} todo;
 134         int generation;
 135         u64 channels;
 136         s32 bandwidth;
 137         __be32 transaction_data[2];
 138         struct iso_resource_event *e_alloc, *e_dealloc;
 139 };
 140
 141 static void release_iso_resource(struct client *, struct client_resource *);
 142
 143 static void schedule_iso_resource(struct iso_resource *r, unsigned long delay)
 144 {
 145         client_get(r->client);
 146         if (!schedule_delayed_work(&r->work, delay))
 147                 client_put(r->client);
 148 }
 149
 150 static void schedule_if_iso_resource(struct client_resource *resource)
 151 {
 152         if (resource->release == release_iso_resource)
 153                 schedule_iso_resource(container_of(resource,
 154                                         struct iso_resource, resource), 0);
 155 }
 156
 157 /*
 158  * dequeue_event() just kfree()'s the event, so the event has to be
 159  * the first field in a struct XYZ_event.
 160  */
 161 struct event {
 162         struct { void *data; size_t size; } v[2];
 163         struct list_head link;
 164 };
 165
 166 struct bus_reset_event {
 167         struct event event;
 168         struct fw_cdev_event_bus_reset reset;
 169 };
 170
 171 struct outbound_transaction_event {
 172         struct event event;
 173         struct client *client;
 174         struct outbound_transaction_resource r;
 175         struct fw_cdev_event_response response;
 176 };
 177
 178 struct inbound_transaction_event {
 179         struct event event;
 180         union {
 181                 struct fw_cdev_event_request request;
 182                 struct fw_cdev_event_request2 request2;
 183         } req;
 184 };
 185
 186 struct iso_interrupt_event {
 187         struct event event;
 188         struct fw_cdev_event_iso_interrupt interrupt;
 189 };
 190
 191 struct iso_resource_event {
 192         struct event event;
 193         struct fw_cdev_event_iso_resource iso_resource;
 194 };
 195
 196 static inline void __user *u64_to_uptr(__u64 value)
 197 {
 198         return (void __user *)(unsigned long)value;
 199 }
 200
 201 static inline __u64 uptr_to_u64(void __user *ptr)
 202 {
 203         return (__u64)(unsigned long)ptr;
 204 }
 205
 206 static int fw_device_op_open(struct inode *inode, struct file *file)
 207 {
 208         struct fw_device *device;
 209         struct client *client;
 210
 211         device = fw_device_get_by_devt(inode->i_rdev);
 212         if (device == NULL)
 213                 return -ENODEV;
 214
 215         if (fw_device_is_shutdown(device)) {
 216                 fw_device_put(device);
 217                 return -ENODEV;
 218         }
 219
 220         client = kzalloc(sizeof(*client), GFP_KERNEL);
 221         if (client == NULL) {
 222                 fw_device_put(device);
 223                 return -ENOMEM;
 224         }
 225
 226         client->device = device;
 227         spin_lock_init(&client->lock);
 228         idr_init(&client->resource_idr);
 229         INIT_LIST_HEAD(&client->event_list);
 230         init_waitqueue_head(&client->wait);
 231         kref_init(&client->kref);
 232
 233         file->private_data = client;
 234
 235         mutex_lock(&device->client_list_mutex);
 236         list_add_tail(&client->link, &device->client_list);
 237         mutex_unlock(&device->client_list_mutex);
 238
 239         return nonseekable_open(inode, file);
 240 }
 241
 242 static void queue_event(struct client *client, struct event *event,
 243                         void *data0, size_t size0, void *data1, size_t size1)
 244 {
 245         unsigned long flags;
 246
 247         event->v[0].data = data0;
 248         event->v[0].size = size0;
 249         event->v[1].data = data1;
 250         event->v[1].size = size1;
 251
 252         spin_lock_irqsave(&client->lock, flags);
 253         if (client->in_shutdown)
 254                 kfree(event);
 255         else
 256                 list_add_tail(&event->link, &client->event_list);
 257         spin_unlock_irqrestore(&client->lock, flags);
 258
 259         wake_up_interruptible(&client->wait);
 260 }
 261
 262 static int dequeue_event(struct client *client,
 263                          char __user *buffer, size_t count)
 264 {
 265         struct event *event;
 266         size_t size, total;
 267         int i, ret;
 268
 269         ret = wait_event_interruptible(client->wait,
 270                         !list_empty(&client->event_list) ||
 271                         fw_device_is_shutdown(client->device));
 272         if (ret < 0)
 273                 return ret;
 274
 275         if (list_empty(&client->event_list) &&
 276                        fw_device_is_shutdown(client->device))
 277                 return -ENODEV;
 278
 279         spin_lock_irq(&client->lock);
 280         event = list_first_entry(&client->event_list, struct event, link);
 281         list_del(&event->link);
 282         spin_unlock_irq(&client->lock);
 283
 284         total = 0;
 285         for (i = 0; i < ARRAY_SIZE(event->v) && total < count; i++) {
 286                 size = min(event->v[i].size, count - total);
 287                 if (copy_to_user(buffer + total, event->v[i].data, size)) {
 288                         ret = -EFAULT;
 289                         goto out;
 290                 }
 291                 total += size;
 292         }
 293         ret = total;
 294
 295  out:
 296         kfree(event);
 297
 298         return ret;
 299 }
 300
 301 static ssize_t fw_device_op_read(struct file *file, char __user *buffer,
 302                                  size_t count, loff_t *offset)
 303 {
 304         struct client *client = file->private_data;
 305
 306         return dequeue_event(client, buffer, count);
 307 }
 308
 309 static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
 310                                  struct client *client)
 311 {
 312         struct fw_card *card = client->device->card;
 313
 314         spin_lock_irq(&card->lock);
 315
 316         event->closure       = client->bus_reset_closure;
 317         event->type          = FW_CDEV_EVENT_BUS_RESET;
 318         event->generation    = client->device->generation;
 319         event->node_id       = client->device->node_id;
 320         event->local_node_id = card->local_node->node_id;
 321         event->bm_node_id    = card->bm_node_id;
 322         event->irm_node_id   = card->irm_node->node_id;
 323         event->root_node_id  = card->root_node->node_id;
 324
 325         spin_unlock_irq(&card->lock);
 326 }
 327
 328 static void for_each_client(struct fw_device *device,
 329                             void (*callback)(struct client *client))
 330 {
 331         struct client *c;
 332
 333         mutex_lock(&device->client_list_mutex);
 334         list_for_each_entry(c, &device->client_list, link)
 335                 callback(c);
 336         mutex_unlock(&device->client_list_mutex);
 337 }
 338
 339 static int schedule_reallocations(int id, void *p, void *data)
 340 {
 341         schedule_if_iso_resource(p);
 342
 343         return 0;
 344 }
 345
 346 static void queue_bus_reset_event(struct client *client)
 347 {
 348         struct bus_reset_event *e;
 349
 350         e = kzalloc(sizeof(*e), GFP_KERNEL);
 351         if (e == NULL) {
 352                 fw_notify("Out of memory when allocating bus reset event\n");
 353                 return;
 354         }
 355
 356         fill_bus_reset_event(&e->reset, client);
 357
 358         queue_event(client, &e->event,
 359                     &e->reset, sizeof(e->reset), NULL, 0);
 360
 361         spin_lock_irq(&client->lock);
 362         idr_for_each(&client->resource_idr, schedule_reallocations, client);
 363         spin_unlock_irq(&client->lock);
 364 }
 365
 366 void fw_device_cdev_update(struct fw_device *device)
 367 {
 368         for_each_client(device, queue_bus_reset_event);
 369 }
 370
 371 static void wake_up_client(struct client *client)
 372 {
 373         wake_up_interruptible(&client->wait);
 374 }
 375
 376 void fw_device_cdev_remove(struct fw_device *device)
 377 {
 378         for_each_client(device, wake_up_client);
 379 }
 380
 381 union ioctl_arg {
 382         struct fw_cdev_get_info                 get_info;
 383         struct fw_cdev_send_request             send_request;
 384         struct fw_cdev_allocate                 allocate;
 385         struct fw_cdev_deallocate               deallocate;
 386         struct fw_cdev_send_response            send_response;
 387         struct fw_cdev_initiate_bus_reset       initiate_bus_reset;
 388         struct fw_cdev_add_descriptor           add_descriptor;
 389         struct fw_cdev_remove_descriptor        remove_descriptor;
 390         struct fw_cdev_create_iso_context       create_iso_context;
 391         struct fw_cdev_queue_iso                queue_iso;
 392         struct fw_cdev_start_iso                start_iso;
 393         struct fw_cdev_stop_iso                 stop_iso;
 394         struct fw_cdev_get_cycle_timer          get_cycle_timer;
 395         struct fw_cdev_allocate_iso_resource    allocate_iso_resource;
 396         struct fw_cdev_send_stream_packet       send_stream_packet;
 397         struct fw_cdev_get_cycle_timer2         get_cycle_timer2;
 398 };
 399
 400 static int ioctl_get_info(struct client *client, union ioctl_arg *arg)
 401 {
 402         struct fw_cdev_get_info *a = &arg->get_info;
 403         struct fw_cdev_event_bus_reset bus_reset;
 404         unsigned long ret = 0;
 405
 406         client->version = a->version;
 407         a->version = FW_CDEV_KERNEL_VERSION;
 408         a->card = client->device->card->index;
 409
 410         down_read(&fw_device_rwsem);
 411
 412         if (a->rom != 0) {
 413                 size_t want = a->rom_length;
 414                 size_t have = client->device->config_rom_length * 4;
 415
 416                 ret = copy_to_user(u64_to_uptr(a->rom),
 417                                    client->device->config_rom, min(want, have));
 418         }
 419         a->rom_length = client->device->config_rom_length * 4;
 420
 421         up_read(&fw_device_rwsem);
 422
 423         if (ret != 0)
 424                 return -EFAULT;
 425
 426         client->bus_reset_closure = a->bus_reset_closure;
 427         if (a->bus_reset != 0) {
 428                 fill_bus_reset_event(&bus_reset, client);
 429                 if (copy_to_user(u64_to_uptr(a->bus_reset),
 430                                  &bus_reset, sizeof(bus_reset)))
 431                         return -EFAULT;
 432         }
 433
 434         return 0;
 435 }
 436
 437 static int add_client_resource(struct client *client,
 438                                struct client_resource *resource, gfp_t gfp_mask)
 439 {
 440         unsigned long flags;
 441         int ret;
 442
 443  retry:
 444         if (idr_pre_get(&client->resource_idr, gfp_mask) == 0)
 445                 return -ENOMEM;
 446
 447         spin_lock_irqsave(&client->lock, flags);
 448         if (client->in_shutdown)
 449                 ret = -ECANCELED;
 450         else
 451                 ret = idr_get_new(&client->resource_idr, resource,
 452                                   &resource->handle);
 453         if (ret >= 0) {
 454                 client_get(client);
 455                 schedule_if_iso_resource(resource);
 456         }
 457         spin_unlock_irqrestore(&client->lock, flags);
 458
 459         if (ret == -EAGAIN)
 460                 goto retry;
 461
 462         return ret < 0 ? ret : 0;
 463 }
 464
 465 static int release_client_resource(struct client *client, u32 handle,
 466                                    client_resource_release_fn_t release,
 467                                    struct client_resource **return_resource)
 468 {
 469         struct client_resource *resource;
 470
 471         spin_lock_irq(&client->lock);
 472         if (client->in_shutdown)
 473                 resource = NULL;
 474         else
 475                 resource = idr_find(&client->resource_idr, handle);
 476         if (resource && resource->release == release)
 477                 idr_remove(&client->resource_idr, handle);
 478         spin_unlock_irq(&client->lock);
 479
 480         if (!(resource && resource->release == release))
 481                 return -EINVAL;
 482
 483         if (return_resource)
 484                 *return_resource = resource;
 485         else
 486                 resource->release(client, resource);
 487
 488         client_put(client);
 489
 490         return 0;
 491 }
 492
 493 static void release_transaction(struct client *client,
 494                                 struct client_resource *resource)
 495 {
 496         struct outbound_transaction_resource *r = container_of(resource,
 497                         struct outbound_transaction_resource, resource);
 498
 499         fw_cancel_transaction(client->device->card, &r->transaction);
 500 }
 501
 502 static void complete_transaction(struct fw_card *card, int rcode,
 503                                  void *payload, size_t length, void *data)
 504 {
 505         struct outbound_transaction_event *e = data;
 506         struct fw_cdev_event_response *rsp = &e->response;
 507         struct client *client = e->client;
 508         unsigned long flags;
 509
 510         if (length < rsp->length)
 511                 rsp->length = length;
 512         if (rcode == RCODE_COMPLETE)
 513                 memcpy(rsp->data, payload, rsp->length);
 514
 515         spin_lock_irqsave(&client->lock, flags);
 516         /*
 517          * 1. If called while in shutdown, the idr tree must be left untouched.
 518          *    The idr handle will be removed and the client reference will be
 519          *    dropped later.
 520          * 2. If the call chain was release_client_resource ->
 521          *    release_transaction -> complete_transaction (instead of a normal
 522          *    conclusion of the transaction), i.e. if this resource was already
 523          *    unregistered from the idr, the client reference will be dropped
 524          *    by release_client_resource and we must not drop it here.
 525          */
 526         if (!client->in_shutdown &&
 527             idr_find(&client->resource_idr, e->r.resource.handle)) {
 528                 idr_remove(&client->resource_idr, e->r.resource.handle);
 529                 /* Drop the idr's reference */
 530                 client_put(client);
 531         }
 532         spin_unlock_irqrestore(&client->lock, flags);
 533
 534         rsp->type = FW_CDEV_EVENT_RESPONSE;
 535         rsp->rcode = rcode;
 536
 537         /*
 538          * In the case that sizeof(*rsp) doesn't align with the position of the
 539          * data, and the read is short, preserve an extra copy of the data
 540          * to stay compatible with a pre-2.6.27 bug.  Since the bug is harmless
 541          * for short reads and some apps depended on it, this is both safe
 542          * and prudent for compatibility.
 543          */
 544         if (rsp->length <= sizeof(*rsp) - offsetof(typeof(*rsp), data))
 545                 queue_event(client, &e->event, rsp, sizeof(*rsp),
 546                             rsp->data, rsp->length);
 547         else
 548                 queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length,
 549                             NULL, 0);
 550
 551         /* Drop the transaction callback's reference */
 552         client_put(client);
 553 }
 554
 555 static int init_request(struct client *client,
 556                         struct fw_cdev_send_request *request,
 557                         int destination_id, int speed)
 558 {
 559         struct outbound_transaction_event *e;
 560         int ret;
 561
 562         if (request->tcode != TCODE_STREAM_DATA &&
 563             (request->length > 4096 || request->length > 512 << speed))
 564                 return -EIO;
 565
 566         if (request->tcode == TCODE_WRITE_QUADLET_REQUEST &&
 567             request->length < 4)
 568                 return -EINVAL;
 569
 570         e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL);
 571         if (e == NULL)
 572                 return -ENOMEM;
 573
 574         e->client = client;
 575         e->response.length = request->length;
 576         e->response.closure = request->closure;
 577
 578         if (request->data &&
 579             copy_from_user(e->response.data,
 580                            u64_to_uptr(request->data), request->length)) {
 581                 ret = -EFAULT;
 582                 goto failed;
 583         }
 584
 585         e->r.resource.release = release_transaction;
 586         ret = add_client_resource(client, &e->r.resource, GFP_KERNEL);
 587         if (ret < 0)
 588                 goto failed;
 589
 590         /* Get a reference for the transaction callback */
 591         client_get(client);
 592
 593         fw_send_request(client->device->card, &e->r.transaction,
 594                         request->tcode, destination_id, request->generation,
 595                         speed, request->offset, e->response.data,
 596                         request->length, complete_transaction, e);
 597         return 0;
 598
 599  failed:
 600         kfree(e);
 601
 602         return ret;
 603 }
 604
 605 static int ioctl_send_request(struct client *client, union ioctl_arg *arg)
 606 {
 607         switch (arg->send_request.tcode) {
 608         case TCODE_WRITE_QUADLET_REQUEST:
 609         case TCODE_WRITE_BLOCK_REQUEST:
 610         case TCODE_READ_QUADLET_REQUEST:
 611         case TCODE_READ_BLOCK_REQUEST:
 612         case TCODE_LOCK_MASK_SWAP:
 613         case TCODE_LOCK_COMPARE_SWAP:
 614         case TCODE_LOCK_FETCH_ADD:
 615         case TCODE_LOCK_LITTLE_ADD:
 616         case TCODE_LOCK_BOUNDED_ADD:
 617         case TCODE_LOCK_WRAP_ADD:
 618         case TCODE_LOCK_VENDOR_DEPENDENT:
 619                 break;
 620         default:
 621                 return -EINVAL;
 622         }
 623
 624         return init_request(client, &arg->send_request, client->device->node_id,
 625                             client->device->max_speed);
 626 }
 627
 628 static inline bool is_fcp_request(struct fw_request *request)
 629 {
 630         return request == NULL;
 631 }
 632
 633 static void release_request(struct client *client,
 634                             struct client_resource *resource)
 635 {
 636         struct inbound_transaction_resource *r = container_of(resource,
 637                         struct inbound_transaction_resource, resource);
 638
 639         if (is_fcp_request(r->request))
 640                 kfree(r->data);
 641         else
 642                 fw_send_response(r->card, r->request, RCODE_CONFLICT_ERROR);
 643
 644         fw_card_put(r->card);
 645         kfree(r);
 646 }
 647
 648 static void handle_request(struct fw_card *card, struct fw_request *request,
 649                            int tcode, int destination, int source,
 650                            int generation, unsigned long long offset,
 651                            void *payload, size_t length, void *callback_data)
 652 {
 653         struct address_handler_resource *handler = callback_data;
 654         struct inbound_transaction_resource *r;
 655         struct inbound_transaction_event *e;
 656         size_t event_size0;
 657         void *fcp_frame = NULL;
 658         int ret;
 659
 660         /* card may be different from handler->client->device->card */
 661         fw_card_get(card);
 662
 663         r = kmalloc(sizeof(*r), GFP_ATOMIC);
 664         e = kmalloc(sizeof(*e), GFP_ATOMIC);
 665         if (r == NULL || e == NULL)
 666                 goto failed;
 667
 668         r->card    = card;
 669         r->request = request;
 670         r->data    = payload;
 671         r->length  = length;
 672
 673         if (is_fcp_request(request)) {
 674                 /*
 675                  * FIXME: Let core-transaction.c manage a
 676                  * single reference-counted copy?
 677                  */
 678                 fcp_frame = kmemdup(payload, length, GFP_ATOMIC);
 679                 if (fcp_frame == NULL)
 680                         goto failed;
 681
 682                 r->data = fcp_frame;
 683         }
 684
 685         r->resource.release = release_request;
 686         ret = add_client_resource(handler->client, &r->resource, GFP_ATOMIC);
 687         if (ret < 0)
 688                 goto failed;
 689
 690         if (handler->client->version < FW_CDEV_VERSION_EVENT_REQUEST2) {
 691                 struct fw_cdev_event_request *req = &e->req.request;
 692
 693                 if (tcode & 0x10)
 694                         tcode = TCODE_LOCK_REQUEST;
 695
 696                 req->type       = FW_CDEV_EVENT_REQUEST;
 697                 req->tcode      = tcode;
 698                 req->offset     = offset;
 699                 req->length     = length;
 700                 req->handle     = r->resource.handle;
 701                 req->closure    = handler->closure;
 702                 event_size0     = sizeof(*req);
 703         } else {
 704                 struct fw_cdev_event_request2 *req = &e->req.request2;
 705
 706                 req->type       = FW_CDEV_EVENT_REQUEST2;
 707                 req->tcode      = tcode;
 708                 req->offset     = offset;
 709                 req->source_node_id = source;
 710                 req->destination_node_id = destination;
 711                 req->card       = card->index;
 712                 req->generation = generation;
 713                 req->length     = length;
 714                 req->handle     = r->resource.handle;
 715                 req->closure    = handler->closure;
 716                 event_size0     = sizeof(*req);
 717         }
 718
 719         queue_event(handler->client, &e->event,
 720                     &e->req, event_size0, r->data, length);
 721         return;
 722
 723  failed:
 724         kfree(r);
 725         kfree(e);
 726         kfree(fcp_frame);
 727
 728         if (!is_fcp_request(request))
 729                 fw_send_response(card, request, RCODE_CONFLICT_ERROR);
 730
 731         fw_card_put(card);
 732 }
 733
 734 static void release_address_handler(struct client *client,
 735                                     struct client_resource *resource)
 736 {
 737         struct address_handler_resource *r =
 738             container_of(resource, struct address_handler_resource, resource);
 739
 740         fw_core_remove_address_handler(&r->handler);
 741         kfree(r);
 742 }
 743
 744 static int ioctl_allocate(struct client *client, union ioctl_arg *arg)
 745 {
 746         struct fw_cdev_allocate *a = &arg->allocate;
 747         struct address_handler_resource *r;
 748         struct fw_address_region region;
 749         int ret;
 750
 751         r = kmalloc(sizeof(*r), GFP_KERNEL);
 752         if (r == NULL)
 753                 return -ENOMEM;
 754
 755         region.start = a->offset;
 756         region.end   = a->offset + a->length;
 757         r->handler.length           = a->length;
 758         r->handler.address_callback = handle_request;
 759         r->handler.callback_data    = r;
 760         r->closure   = a->closure;
 761         r->client    = client;
 762
 763         ret = fw_core_add_address_handler(&r->handler, &region);
 764         if (ret < 0) {
 765                 kfree(r);
 766                 return ret;
 767         }
 768
 769         r->resource.release = release_address_handler;
 770         ret = add_client_resource(client, &r->resource, GFP_KERNEL);
 771         if (ret < 0) {
 772                 release_address_handler(client, &r->resource);
 773                 return ret;
 774         }
 775         a->handle = r->resource.handle;
 776
 777         return 0;
 778 }
 779
 780 static int ioctl_deallocate(struct client *client, union ioctl_arg *arg)
 781 {
 782         return release_client_resource(client, arg->deallocate.handle,
 783                                        release_address_handler, NULL);
 784 }
 785
 786 static int ioctl_send_response(struct client *client, union ioctl_arg *arg)
 787 {
 788         struct fw_cdev_send_response *a = &arg->send_response;
 789         struct client_resource *resource;
 790         struct inbound_transaction_resource *r;
 791         int ret = 0;
 792
 793         if (release_client_resource(client, a->handle,
 794                                     release_request, &resource) < 0)
 795                 return -EINVAL;
 796
 797         r = container_of(resource, struct inbound_transaction_resource,
 798                          resource);
 799         if (is_fcp_request(r->request))
 800                 goto out;
 801
 802         if (a->length != fw_get_response_length(r->request)) {
 803                 ret = -EINVAL;
 804                 kfree(r->request);
 805                 goto out;
 806         }
 807         if (copy_from_user(r->data, u64_to_uptr(a->data), a->length)) {
 808                 ret = -EFAULT;
 809                 kfree(r->request);
 810                 goto out;
 811         }
 812         fw_send_response(r->card, r->request, a->rcode);
 813  out:
 814         fw_card_put(r->card);
 815         kfree(r);
 816
 817         return ret;
 818 }
 819
 820 static int ioctl_initiate_bus_reset(struct client *client, union ioctl_arg *arg)
 821 {
 822         return fw_core_initiate_bus_reset(client->device->card,
 823                         arg->initiate_bus_reset.type == FW_CDEV_SHORT_RESET);
 824 }
 825
 826 static void release_descriptor(struct client *client,
 827                                struct client_resource *resource)
 828 {
 829         struct descriptor_resource *r =
 830                 container_of(resource, struct descriptor_resource, resource);
 831
 832         fw_core_remove_descriptor(&r->descriptor);
 833         kfree(r);
 834 }
 835
 836 static int ioctl_add_descriptor(struct client *client, union ioctl_arg *arg)
 837 {
 838         struct fw_cdev_add_descriptor *a = &arg->add_descriptor;
 839         struct descriptor_resource *r;
 840         int ret;
 841
 842         /* Access policy: Allow this ioctl only on local nodes' device files. */
 843         if (!client->device->is_local)
 844                 return -ENOSYS;
 845
 846         if (a->length > 256)
 847                 return -EINVAL;
 848
 849         r = kmalloc(sizeof(*r) + a->length * 4, GFP_KERNEL);
 850         if (r == NULL)
 851                 return -ENOMEM;
 852
 853         if (copy_from_user(r->data, u64_to_uptr(a->data), a->length * 4)) {
 854                 ret = -EFAULT;
 855                 goto failed;
 856         }
 857
 858         r->descriptor.length    = a->length;
 859         r->descriptor.immediate = a->immediate;
 860         r->descriptor.key       = a->key;
 861         r->descriptor.data      = r->data;
 862
 863         ret = fw_core_add_descriptor(&r->descriptor);
 864         if (ret < 0)
 865                 goto failed;
 866
 867         r->resource.release = release_descriptor;
 868         ret = add_client_resource(client, &r->resource, GFP_KERNEL);
 869         if (ret < 0) {
 870                 fw_core_remove_descriptor(&r->descriptor);
 871                 goto failed;
 872         }
 873         a->handle = r->resource.handle;
 874
 875         return 0;
 876  failed:
 877         kfree(r);
 878
 879         return ret;
 880 }
 881
 882 static int ioctl_remove_descriptor(struct client *client, union ioctl_arg *arg)
 883 {
 884         return release_client_resource(client, arg->remove_descriptor.handle,
 885                                        release_descriptor, NULL);
 886 }
 887
 888 static void iso_callback(struct fw_iso_context *context, u32 cycle,
 889                          size_t header_length, void *header, void *data)
 890 {
 891         struct client *client = data;
 892         struct iso_interrupt_event *e;
 893
 894         e = kmalloc(sizeof(*e) + header_length, GFP_ATOMIC);
 895         if (e == NULL)
 896                 return;
 897
 898         e->interrupt.type      = FW_CDEV_EVENT_ISO_INTERRUPT;
 899         e->interrupt.closure   = client->iso_closure;
 900         e->interrupt.cycle     = cycle;
 901         e->interrupt.header_length = header_length;
 902         memcpy(e->interrupt.header, header, header_length);
 903         queue_event(client, &e->event, &e->interrupt,
 904                     sizeof(e->interrupt) + header_length, NULL, 0);
 905 }
 906
 907 static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
 908 {
 909         struct fw_cdev_create_iso_context *a = &arg->create_iso_context;
 910         struct fw_iso_context *context;
 911
 912         if (a->channel > 63)
 913                 return -EINVAL;
 914
 915         switch (a->type) {
 916         case FW_ISO_CONTEXT_RECEIVE:
 917                 if (a->header_size < 4 || (a->header_size & 3))
 918                         return -EINVAL;
 919                 break;
 920
 921         case FW_ISO_CONTEXT_TRANSMIT:
 922                 if (a->speed > SCODE_3200)
 923                         return -EINVAL;
 924                 break;
 925
 926         default:
 927                 return -EINVAL;
 928         }
 929
 930         context = fw_iso_context_create(client->device->card, a->type,
 931                                         a->channel, a->speed, a->header_size,
 932                                         iso_callback, client);
 933         if (IS_ERR(context))
 934                 return PTR_ERR(context);
 935
 936         /* We only support one context at this time. */
 937         spin_lock_irq(&client->lock);
 938         if (client->iso_context != NULL) {
 939                 spin_unlock_irq(&client->lock);
 940                 fw_iso_context_destroy(context);
 941                 return -EBUSY;
 942         }
 943         client->iso_closure = a->closure;
 944         client->iso_context = context;
 945         spin_unlock_irq(&client->lock);
 946
 947         a->handle = 0;
 948
 949         return 0;
 950 }
 951
 952 /* Macros for decoding the iso packet control header. */
 953 #define GET_PAYLOAD_LENGTH(v)   ((v) & 0xffff)
 954 #define GET_INTERRUPT(v)        (((v) >> 16) & 0x01)
 955 #define GET_SKIP(v)             (((v) >> 17) & 0x01)
 956 #define GET_TAG(v)              (((v) >> 18) & 0x03)
 957 #define GET_SY(v)               (((v) >> 20) & 0x0f)
 958 #define GET_HEADER_LENGTH(v)    (((v) >> 24) & 0xff)
 959
 960 static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
 961 {
 962         struct fw_cdev_queue_iso *a = &arg->queue_iso;
 963         struct fw_cdev_iso_packet __user *p, *end, *next;
 964         struct fw_iso_context *ctx = client->iso_context;
 965         unsigned long payload, buffer_end, header_length;
 966         u32 control;
 967         int count;
 968         struct {
 969                 struct fw_iso_packet packet;
 970                 u8 header[256];
 971         } u;
 972
 973         if (ctx == NULL || a->handle != 0)
 974                 return -EINVAL;
 975
 976         /*
 977          * If the user passes a non-NULL data pointer, has mmap()'ed
 978          * the iso buffer, and the pointer points inside the buffer,
 979          * we setup the payload pointers accordingly.  Otherwise we
 980          * set them both to 0, which will still let packets with
 981          * payload_length == 0 through.  In other words, if no packets
 982          * use the indirect payload, the iso buffer need not be mapped
 983          * and the a->data pointer is ignored.
 984          */
 985
 986         payload = (unsigned long)a->data - client->vm_start;
 987         buffer_end = client->buffer.page_count << PAGE_SHIFT;
 988         if (a->data == 0 || client->buffer.pages == NULL ||
 989             payload >= buffer_end) {
 990                 payload = 0;
 991                 buffer_end = 0;
 992         }
 993
 994         p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(a->packets);
 995
 996         if (!access_ok(VERIFY_READ, p, a->size))
 997                 return -EFAULT;
 998
 999         end = (void __user *)p + a->size;
1000         count = 0;
1001         while (p < end) {
1002                 if (get_user(control, &p->control))
1003                         return -EFAULT;
1004                 u.packet.payload_length = GET_PAYLOAD_LENGTH(control);
1005                 u.packet.interrupt = GET_INTERRUPT(control);
1006                 u.packet.skip = GET_SKIP(control);
1007                 u.packet.tag = GET_TAG(control);
1008                 u.packet.sy = GET_SY(control);
1009                 u.packet.header_length = GET_HEADER_LENGTH(control);
1010
1011                 if (ctx->type == FW_ISO_CONTEXT_TRANSMIT) {
1012                         if (u.packet.header_length % 4 != 0)
1013                                 return -EINVAL;
1014                         header_length = u.packet.header_length;
1015                 } else {
1016                         /*
1017                          * We require that header_length is a multiple of
1018                          * the fixed header size, ctx->header_size.
1019                          */
1020                         if (ctx->header_size == 0) {
1021                                 if (u.packet.header_length > 0)
1022                                         return -EINVAL;
1023                         } else if (u.packet.header_length == 0 ||
1024                                    u.packet.header_length % ctx->header_size != 0) {
1025                                 return -EINVAL;
1026                         }
1027                         header_length = 0;
1028                 }
1029
1030                 next = (struct fw_cdev_iso_packet __user *)
1031                         &p->header[header_length / 4];
1032                 if (next > end)
1033                         return -EINVAL;
1034                 if (__copy_from_user
1035                     (u.packet.header, p->header, header_length))
1036                         return -EFAULT;
1037                 if (u.packet.skip && ctx->type == FW_ISO_CONTEXT_TRANSMIT &&
1038                     u.packet.header_length + u.packet.payload_length > 0)
1039                         return -EINVAL;
1040                 if (payload + u.packet.payload_length > buffer_end)
1041                         return -EINVAL;
1042
1043                 if (fw_iso_context_queue(ctx, &u.packet,
1044                                          &client->buffer, payload))
1045                         break;
1046
1047                 p = next;
1048                 payload += u.packet.payload_length;
1049                 count++;
1050         }
1051
1052         a->size    -= uptr_to_u64(p) - a->packets;
1053         a->packets  = uptr_to_u64(p);
1054         a->data     = client->vm_start + payload;
1055
1056         return count;
1057 }
1058
1059 static int ioctl_start_iso(struct client *client, union ioctl_arg *arg)
1060 {
1061         struct fw_cdev_start_iso *a = &arg->start_iso;
1062
1063         if (client->iso_context == NULL || a->handle != 0)
1064                 return -EINVAL;
1065
1066         if (client->iso_context->type == FW_ISO_CONTEXT_RECEIVE &&
1067             (a->tags == 0 || a->tags > 15 || a->sync > 15))
1068                 return -EINVAL;
1069
1070         return fw_iso_context_start(client->iso_context,
1071                                     a->cycle, a->sync, a->tags);
1072 }
1073
1074 static int ioctl_stop_iso(struct client *client, union ioctl_arg *arg)
1075 {
1076         struct fw_cdev_stop_iso *a = &arg->stop_iso;
1077
1078         if (client->iso_context == NULL || a->handle != 0)
1079                 return -EINVAL;
1080
1081         return fw_iso_context_stop(client->iso_context);
1082 }
1083
1084 static int ioctl_get_cycle_timer2(struct client *client, union ioctl_arg *arg)
1085 {
1086         struct fw_cdev_get_cycle_timer2 *a = &arg->get_cycle_timer2;
1087         struct fw_card *card = client->device->card;
1088         struct timespec ts = {0, 0};
1089         u32 cycle_time;
1090         int ret = 0;
1091
1092         local_irq_disable();
1093
1094         cycle_time = card->driver->read_csr(card, CSR_CYCLE_TIME);
1095
1096         switch (a->clk_id) {
1097         case CLOCK_REALTIME:      getnstimeofday(&ts);                   break;
1098         case CLOCK_MONOTONIC:     do_posix_clock_monotonic_gettime(&ts); break;
1099         case CLOCK_MONOTONIC_RAW: getrawmonotonic(&ts);                  break;
1100         default:
1101                 ret = -EINVAL;
1102         }
1103
1104         local_irq_enable();
1105
1106         a->tv_sec      = ts.tv_sec;
1107         a->tv_nsec     = ts.tv_nsec;
1108         a->cycle_timer = cycle_time;
1109
1110         return ret;
1111 }
1112
1113 static int ioctl_get_cycle_timer(struct client *client, union ioctl_arg *arg)
1114 {
1115         struct fw_cdev_get_cycle_timer *a = &arg->get_cycle_timer;
1116         struct fw_cdev_get_cycle_timer2 ct2;
1117
1118         ct2.clk_id = CLOCK_REALTIME;
1119         ioctl_get_cycle_timer2(client, (union ioctl_arg *)&ct2);
1120
1121         a->local_time = ct2.tv_sec * USEC_PER_SEC + ct2.tv_nsec / NSEC_PER_USEC;
1122         a->cycle_timer = ct2.cycle_timer;
1123
1124         return 0;
1125 }
1126
1127 static void iso_resource_work(struct work_struct *work)
1128 {
1129         struct iso_resource_event *e;
1130         struct iso_resource *r =
1131                         container_of(work, struct iso_resource, work.work);
1132         struct client *client = r->client;
1133         int generation, channel, bandwidth, todo;
1134         bool skip, free, success;
1135
1136         spin_lock_irq(&client->lock);
1137         generation = client->device->generation;
1138         todo = r->todo;
1139         /* Allow 1000ms grace period for other reallocations. */
1140         if (todo == ISO_RES_ALLOC &&
1141             time_is_after_jiffies(client->device->card->reset_jiffies + HZ)) {
1142                 schedule_iso_resource(r, DIV_ROUND_UP(HZ, 3));
1143                 skip = true;
1144         } else {
1145                 /* We could be called twice within the same generation. */
1146                 skip = todo == ISO_RES_REALLOC &&
1147                        r->generation == generation;
1148         }
1149         free = todo == ISO_RES_DEALLOC ||
1150                todo == ISO_RES_ALLOC_ONCE ||
1151                todo == ISO_RES_DEALLOC_ONCE;
1152         r->generation = generation;
1153         spin_unlock_irq(&client->lock);
1154
1155         if (skip)
1156                 goto out;
1157
1158         bandwidth = r->bandwidth;
1159
1160         fw_iso_resource_manage(client->device->card, generation,
1161                         r->channels, &channel, &bandwidth,
1162                         todo == ISO_RES_ALLOC ||
1163                         todo == ISO_RES_REALLOC ||
1164                         todo == ISO_RES_ALLOC_ONCE,
1165                         r->transaction_data);
1166         /*
1167          * Is this generation outdated already?  As long as this resource sticks
1168          * in the idr, it will be scheduled again for a newer generation or at
1169          * shutdown.
1170          */
1171         if (channel == -EAGAIN &&
1172             (todo == ISO_RES_ALLOC || todo == ISO_RES_REALLOC))
1173                 goto out;
1174
1175         success = channel >= 0 || bandwidth > 0;
1176
1177         spin_lock_irq(&client->lock);
1178         /*
1179          * Transit from allocation to reallocation, except if the client
1180          * requested deallocation in the meantime.
1181          */
1182         if (r->todo == ISO_RES_ALLOC)
1183                 r->todo = ISO_RES_REALLOC;
1184         /*
1185          * Allocation or reallocation failure?  Pull this resource out of the
1186          * idr and prepare for deletion, unless the client is shutting down.
1187          */
1188         if (r->todo == ISO_RES_REALLOC && !success &&
1189             !client->in_shutdown &&
1190             idr_find(&client->resource_idr, r->resource.handle)) {
1191                 idr_remove(&client->resource_idr, r->resource.handle);
1192                 client_put(client);
1193                 free = true;
1194         }
1195         spin_unlock_irq(&client->lock);
1196
1197         if (todo == ISO_RES_ALLOC && channel >= 0)
1198                 r->channels = 1ULL << channel;
1199
1200         if (todo == ISO_RES_REALLOC && success)
1201                 goto out;
1202
1203         if (todo == ISO_RES_ALLOC || todo == ISO_RES_ALLOC_ONCE) {
1204                 e = r->e_alloc;
1205                 r->e_alloc = NULL;
1206         } else {
1207                 e = r->e_dealloc;
1208                 r->e_dealloc = NULL;
1209         }
1210         e->iso_resource.handle    = r->resource.handle;
1211         e->iso_resource.channel   = channel;
1212         e->iso_resource.bandwidth = bandwidth;
1213
1214         queue_event(client, &e->event,
1215                     &e->iso_resource, sizeof(e->iso_resource), NULL, 0);
1216
1217         if (free) {
1218                 cancel_delayed_work(&r->work);
1219                 kfree(r->e_alloc);
1220                 kfree(r->e_dealloc);
1221                 kfree(r);
1222         }
1223  out:
1224         client_put(client);
1225 }
1226
1227 static void release_iso_resource(struct client *client,
1228                                  struct client_resource *resource)
1229 {
1230         struct iso_resource *r =
1231                 container_of(resource, struct iso_resource, resource);
1232
1233         spin_lock_irq(&client->lock);
1234         r->todo = ISO_RES_DEALLOC;
1235         schedule_iso_resource(r, 0);
1236         spin_unlock_irq(&client->lock);
1237 }
1238
1239 static int init_iso_resource(struct client *client,
1240                 struct fw_cdev_allocate_iso_resource *request, int todo)
1241 {
1242         struct iso_resource_event *e1, *e2;
1243         struct iso_resource *r;
1244         int ret;
1245
1246         if ((request->channels == 0 && request->bandwidth == 0) ||
1247             request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
1248             request->bandwidth < 0)
1249                 return -EINVAL;
1250
1251         r  = kmalloc(sizeof(*r), GFP_KERNEL);
1252         e1 = kmalloc(sizeof(*e1), GFP_KERNEL);
1253         e2 = kmalloc(sizeof(*e2), GFP_KERNEL);
1254         if (r == NULL || e1 == NULL || e2 == NULL) {
1255                 ret = -ENOMEM;
1256                 goto fail;
1257         }
1258
1259         INIT_DELAYED_WORK(&r->work, iso_resource_work);
1260         r->client       = client;
1261         r->todo         = todo;
1262         r->generation   = -1;
1263         r->channels     = request->channels;
1264         r->bandwidth    = request->bandwidth;
1265         r->e_alloc      = e1;
1266         r->e_dealloc    = e2;
1267
1268         e1->iso_resource.closure = request->closure;
1269         e1->iso_resource.type    = FW_CDEV_EVENT_ISO_RESOURCE_ALLOCATED;
1270         e2->iso_resource.closure = request->closure;
1271         e2->iso_resource.type    = FW_CDEV_EVENT_ISO_RESOURCE_DEALLOCATED;
1272
1273         if (todo == ISO_RES_ALLOC) {
1274                 r->resource.release = release_iso_resource;
1275                 ret = add_client_resource(client, &r->resource, GFP_KERNEL);
1276                 if (ret < 0)
1277                         goto fail;
1278         } else {
1279                 r->resource.release = NULL;
1280                 r->resource.handle = -1;
1281                 schedule_iso_resource(r, 0);
1282         }
1283         request->handle = r->resource.handle;
1284
1285         return 0;
1286  fail:
1287         kfree(r);
1288         kfree(e1);
1289         kfree(e2);
1290
1291         return ret;
1292 }
1293
1294 static int ioctl_allocate_iso_resource(struct client *client,
1295                                        union ioctl_arg *arg)
1296 {
1297         return init_iso_resource(client,
1298                         &arg->allocate_iso_resource, ISO_RES_ALLOC);
1299 }
1300
1301 static int ioctl_deallocate_iso_resource(struct client *client,
1302                                          union ioctl_arg *arg)
1303 {
1304         return release_client_resource(client,
1305                         arg->deallocate.handle, release_iso_resource, NULL);
1306 }
1307
1308 static int ioctl_allocate_iso_resource_once(struct client *client,
1309                                             union ioctl_arg *arg)
1310 {
1311         return init_iso_resource(client,
1312                         &arg->allocate_iso_resource, ISO_RES_ALLOC_ONCE);
1313 }
1314
1315 static int ioctl_deallocate_iso_resource_once(struct client *client,
1316                                               union ioctl_arg *arg)
1317 {
1318         return init_iso_resource(client,
1319                         &arg->allocate_iso_resource, ISO_RES_DEALLOC_ONCE);
1320 }
1321
1322 /*
1323  * Returns a speed code:  Maximum speed to or from this device,
1324  * limited by the device's link speed, the local node's link speed,
1325  * and all PHY port speeds between the two links.
1326  */
1327 static int ioctl_get_speed(struct client *client, union ioctl_arg *arg)
1328 {
1329         return client->device->max_speed;
1330 }
1331
1332 static int ioctl_send_broadcast_request(struct client *client,
1333                                         union ioctl_arg *arg)
1334 {
1335         struct fw_cdev_send_request *a = &arg->send_request;
1336
1337         switch (a->tcode) {
1338         case TCODE_WRITE_QUADLET_REQUEST:
1339         case TCODE_WRITE_BLOCK_REQUEST:
1340                 break;
1341         default:
1342                 return -EINVAL;
1343         }
1344
1345         /* Security policy: Only allow accesses to Units Space. */
1346         if (a->offset < CSR_REGISTER_BASE + CSR_CONFIG_ROM_END)
1347                 return -EACCES;
1348
1349         return init_request(client, a, LOCAL_BUS | 0x3f, SCODE_100);
1350 }
1351
1352 static int ioctl_send_stream_packet(struct client *client, union ioctl_arg *arg)
1353 {
1354         struct fw_cdev_send_stream_packet *a = &arg->send_stream_packet;
1355         struct fw_cdev_send_request request;
1356         int dest;
1357
1358         if (a->speed > client->device->card->link_speed ||
1359             a->length > 1024 << a->speed)
1360                 return -EIO;
1361
1362         if (a->tag > 3 || a->channel > 63 || a->sy > 15)
1363                 return -EINVAL;
1364
1365         dest = fw_stream_packet_destination_id(a->tag, a->channel, a->sy);
1366         request.tcode           = TCODE_STREAM_DATA;
1367         request.length          = a->length;
1368         request.closure         = a->closure;
1369         request.data            = a->data;
1370         request.generation      = a->generation;
1371
1372         return init_request(client, &request, dest, a->speed);
1373 }
1374
1375 static int (* const ioctl_handlers[])(struct client *, union ioctl_arg *) = {
1376         ioctl_get_info,
1377         ioctl_send_request,
1378         ioctl_allocate,
1379         ioctl_deallocate,
1380         ioctl_send_response,
1381         ioctl_initiate_bus_reset,
1382         ioctl_add_descriptor,
1383         ioctl_remove_descriptor,
1384         ioctl_create_iso_context,
1385         ioctl_queue_iso,
1386         ioctl_start_iso,
1387         ioctl_stop_iso,
1388         ioctl_get_cycle_timer,
1389         ioctl_allocate_iso_resource,
1390         ioctl_deallocate_iso_resource,
1391         ioctl_allocate_iso_resource_once,
1392         ioctl_deallocate_iso_resource_once,
1393         ioctl_get_speed,
1394         ioctl_send_broadcast_request,
1395         ioctl_send_stream_packet,
1396         ioctl_get_cycle_timer2,
1397 };
1398
1399 static int dispatch_ioctl(struct client *client,
1400                           unsigned int cmd, void __user *arg)
1401 {
1402         union ioctl_arg buffer;
1403         int ret;
1404
1405         if (fw_device_is_shutdown(client->device))
1406                 return -ENODEV;
1407
1408         if (_IOC_TYPE(cmd) != '#' ||
1409             _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
1410             _IOC_SIZE(cmd) > sizeof(buffer))
1411                 return -EINVAL;
1412
1413         if (_IOC_DIR(cmd) == _IOC_READ)
1414                 memset(&buffer, 0, _IOC_SIZE(cmd));
1415
1416         if (_IOC_DIR(cmd) & _IOC_WRITE)
1417                 if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
1418                         return -EFAULT;
1419
1420         ret = ioctl_handlers[_IOC_NR(cmd)](client, &buffer);
1421         if (ret < 0)
1422                 return ret;
1423
1424         if (_IOC_DIR(cmd) & _IOC_READ)
1425                 if (copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
1426                         return -EFAULT;
1427
1428         return ret;
1429 }
1430
1431 static long fw_device_op_ioctl(struct file *file,
1432                                unsigned int cmd, unsigned long arg)
1433 {
1434         return dispatch_ioctl(file->private_data, cmd, (void __user *)arg);
1435 }
1436
1437 #ifdef CONFIG_COMPAT
1438 static long fw_device_op_compat_ioctl(struct file *file,
1439                                       unsigned int cmd, unsigned long arg)
1440 {
1441         return dispatch_ioctl(file->private_data, cmd, compat_ptr(arg));
1442 }
1443 #endif
1444
1445 static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
1446 {
1447         struct client *client = file->private_data;
1448         enum dma_data_direction direction;
1449         unsigned long size;
1450         int page_count, ret;
1451
1452         if (fw_device_is_shutdown(client->device))
1453                 return -ENODEV;
1454
1455         /* FIXME: We could support multiple buffers, but we don't. */
1456         if (client->buffer.pages != NULL)
1457                 return -EBUSY;
1458
1459         if (!(vma->vm_flags & VM_SHARED))
1460                 return -EINVAL;
1461
1462         if (vma->vm_start & ~PAGE_MASK)
1463                 return -EINVAL;
1464
1465         client->vm_start = vma->vm_start;
1466         size = vma->vm_end - vma->vm_start;
1467         page_count = size >> PAGE_SHIFT;
1468         if (size & ~PAGE_MASK)
1469                 return -EINVAL;
1470
1471         if (vma->vm_flags & VM_WRITE)
1472                 direction = DMA_TO_DEVICE;
1473         else
1474                 direction = DMA_FROM_DEVICE;
1475
1476         ret = fw_iso_buffer_init(&client->buffer, client->device->card,
1477                                  page_count, direction);
1478         if (ret < 0)
1479                 return ret;
1480
1481         ret = fw_iso_buffer_map(&client->buffer, vma);
1482         if (ret < 0)
1483                 fw_iso_buffer_destroy(&client->buffer, client->device->card);
1484
1485         return ret;
1486 }
1487
1488 static int shutdown_resource(int id, void *p, void *data)
1489 {
1490         struct client_resource *resource = p;
1491         struct client *client = data;
1492
1493         resource->release(client, resource);
1494         client_put(client);
1495
1496         return 0;
1497 }
1498
1499 static int fw_device_op_release(struct inode *inode, struct file *file)
1500 {
1501         struct client *client = file->private_data;
1502         struct event *event, *next_event;
1503
1504         mutex_lock(&client->device->client_list_mutex);
1505         list_del(&client->link);
1506         mutex_unlock(&client->device->client_list_mutex);
1507
1508         if (client->iso_context)
1509                 fw_iso_context_destroy(client->iso_context);
1510
1511         if (client->buffer.pages)
1512                 fw_iso_buffer_destroy(&client->buffer, client->device->card);
1513
1514         /* Freeze client->resource_idr and client->event_list */
1515         spin_lock_irq(&client->lock);
1516         client->in_shutdown = true;
1517         spin_unlock_irq(&client->lock);
1518
1519         idr_for_each(&client->resource_idr, shutdown_resource, client);
1520         idr_remove_all(&client->resource_idr);
1521         idr_destroy(&client->resource_idr);
1522
1523         list_for_each_entry_safe(event, next_event, &client->event_list, link)
1524                 kfree(event);
1525
1526         client_put(client);
1527
1528         return 0;
1529 }
1530
1531 static unsigned int fw_device_op_poll(struct file *file, poll_table * pt)
1532 {
1533         struct client *client = file->private_data;
1534         unsigned int mask = 0;
1535
1536         poll_wait(file, &client->wait, pt);
1537
1538         if (fw_device_is_shutdown(client->device))
1539                 mask |= POLLHUP | POLLERR;
1540         if (!list_empty(&client->event_list))
1541                 mask |= POLLIN | POLLRDNORM;
1542
1543         return mask;
1544 }
1545
1546 const struct file_operations fw_device_ops = {
1547         .owner          = THIS_MODULE,
1548         .llseek         = no_llseek,
1549         .open           = fw_device_op_open,
1550         .read           = fw_device_op_read,
1551         .unlocked_ioctl = fw_device_op_ioctl,
1552         .mmap           = fw_device_op_mmap,
1553         .release        = fw_device_op_release,
1554         .poll           = fw_device_op_poll,
1555 #ifdef CONFIG_COMPAT
1556         .compat_ioctl   = fw_device_op_compat_ioctl,
1557 #endif
1558 };