firewire: cdev: address handler input validation
[safe/jmp/linux-2.6] / drivers / firewire / fw-transaction.c
1 /*
2  * Core IEEE1394 transaction logic
3  *
4  * Copyright (C) 2004-2006 Kristian Hoegsberg <krh@bitplanet.net>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software Foundation,
18  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19  */
20
21 #include <linux/completion.h>
22 #include <linux/idr.h>
23 #include <linux/kernel.h>
24 #include <linux/kref.h>
25 #include <linux/module.h>
26 #include <linux/mutex.h>
27 #include <linux/init.h>
28 #include <linux/interrupt.h>
29 #include <linux/pci.h>
30 #include <linux/delay.h>
31 #include <linux/poll.h>
32 #include <linux/list.h>
33 #include <linux/kthread.h>
34 #include <asm/uaccess.h>
35
36 #include "fw-transaction.h"
37 #include "fw-topology.h"
38 #include "fw-device.h"
39
40 #define HEADER_PRI(pri)                 ((pri) << 0)
41 #define HEADER_TCODE(tcode)             ((tcode) << 4)
42 #define HEADER_RETRY(retry)             ((retry) << 8)
43 #define HEADER_TLABEL(tlabel)           ((tlabel) << 10)
44 #define HEADER_DESTINATION(destination) ((destination) << 16)
45 #define HEADER_SOURCE(source)           ((source) << 16)
46 #define HEADER_RCODE(rcode)             ((rcode) << 12)
47 #define HEADER_OFFSET_HIGH(offset_high) ((offset_high) << 0)
48 #define HEADER_DATA_LENGTH(length)      ((length) << 16)
49 #define HEADER_EXTENDED_TCODE(tcode)    ((tcode) << 0)
50
51 #define HEADER_GET_TCODE(q)             (((q) >> 4) & 0x0f)
52 #define HEADER_GET_TLABEL(q)            (((q) >> 10) & 0x3f)
53 #define HEADER_GET_RCODE(q)             (((q) >> 12) & 0x0f)
54 #define HEADER_GET_DESTINATION(q)       (((q) >> 16) & 0xffff)
55 #define HEADER_GET_SOURCE(q)            (((q) >> 16) & 0xffff)
56 #define HEADER_GET_OFFSET_HIGH(q)       (((q) >> 0) & 0xffff)
57 #define HEADER_GET_DATA_LENGTH(q)       (((q) >> 16) & 0xffff)
58 #define HEADER_GET_EXTENDED_TCODE(q)    (((q) >> 0) & 0xffff)
59
60 #define HEADER_DESTINATION_IS_BROADCAST(q) \
61         (((q) & HEADER_DESTINATION(0x3f)) == HEADER_DESTINATION(0x3f))
62
63 #define PHY_CONFIG_GAP_COUNT(gap_count) (((gap_count) << 16) | (1 << 22))
64 #define PHY_CONFIG_ROOT_ID(node_id)     ((((node_id) & 0x3f) << 24) | (1 << 23))
65 #define PHY_IDENTIFIER(id)              ((id) << 30)
66
67 static int
68 close_transaction(struct fw_transaction *transaction,
69                   struct fw_card *card, int rcode,
70                   u32 *payload, size_t length)
71 {
72         struct fw_transaction *t;
73         unsigned long flags;
74
75         spin_lock_irqsave(&card->lock, flags);
76         list_for_each_entry(t, &card->transaction_list, link) {
77                 if (t == transaction) {
78                         list_del(&t->link);
79                         card->tlabel_mask &= ~(1 << t->tlabel);
80                         break;
81                 }
82         }
83         spin_unlock_irqrestore(&card->lock, flags);
84
85         if (&t->link != &card->transaction_list) {
86                 t->callback(card, rcode, payload, length, t->callback_data);
87                 return 0;
88         }
89
90         return -ENOENT;
91 }
92
93 /*
94  * Only valid for transactions that are potentially pending (ie have
95  * been sent).
96  */
97 int
98 fw_cancel_transaction(struct fw_card *card,
99                       struct fw_transaction *transaction)
100 {
101         /*
102          * Cancel the packet transmission if it's still queued.  That
103          * will call the packet transmission callback which cancels
104          * the transaction.
105          */
106
107         if (card->driver->cancel_packet(card, &transaction->packet) == 0)
108                 return 0;
109
110         /*
111          * If the request packet has already been sent, we need to see
112          * if the transaction is still pending and remove it in that case.
113          */
114
115         return close_transaction(transaction, card, RCODE_CANCELLED, NULL, 0);
116 }
117 EXPORT_SYMBOL(fw_cancel_transaction);
118
119 static void
120 transmit_complete_callback(struct fw_packet *packet,
121                            struct fw_card *card, int status)
122 {
123         struct fw_transaction *t =
124             container_of(packet, struct fw_transaction, packet);
125
126         switch (status) {
127         case ACK_COMPLETE:
128                 close_transaction(t, card, RCODE_COMPLETE, NULL, 0);
129                 break;
130         case ACK_PENDING:
131                 t->timestamp = packet->timestamp;
132                 break;
133         case ACK_BUSY_X:
134         case ACK_BUSY_A:
135         case ACK_BUSY_B:
136                 close_transaction(t, card, RCODE_BUSY, NULL, 0);
137                 break;
138         case ACK_DATA_ERROR:
139                 close_transaction(t, card, RCODE_DATA_ERROR, NULL, 0);
140                 break;
141         case ACK_TYPE_ERROR:
142                 close_transaction(t, card, RCODE_TYPE_ERROR, NULL, 0);
143                 break;
144         default:
145                 /*
146                  * In this case the ack is really a juju specific
147                  * rcode, so just forward that to the callback.
148                  */
149                 close_transaction(t, card, status, NULL, 0);
150                 break;
151         }
152 }
153
154 static void
155 fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
156                 int destination_id, int source_id, int generation, int speed,
157                 unsigned long long offset, void *payload, size_t length)
158 {
159         int ext_tcode;
160
161         if (tcode > 0x10) {
162                 ext_tcode = tcode & ~0x10;
163                 tcode = TCODE_LOCK_REQUEST;
164         } else
165                 ext_tcode = 0;
166
167         packet->header[0] =
168                 HEADER_RETRY(RETRY_X) |
169                 HEADER_TLABEL(tlabel) |
170                 HEADER_TCODE(tcode) |
171                 HEADER_DESTINATION(destination_id);
172         packet->header[1] =
173                 HEADER_OFFSET_HIGH(offset >> 32) | HEADER_SOURCE(source_id);
174         packet->header[2] =
175                 offset;
176
177         switch (tcode) {
178         case TCODE_WRITE_QUADLET_REQUEST:
179                 packet->header[3] = *(u32 *)payload;
180                 packet->header_length = 16;
181                 packet->payload_length = 0;
182                 break;
183
184         case TCODE_LOCK_REQUEST:
185         case TCODE_WRITE_BLOCK_REQUEST:
186                 packet->header[3] =
187                         HEADER_DATA_LENGTH(length) |
188                         HEADER_EXTENDED_TCODE(ext_tcode);
189                 packet->header_length = 16;
190                 packet->payload = payload;
191                 packet->payload_length = length;
192                 break;
193
194         case TCODE_READ_QUADLET_REQUEST:
195                 packet->header_length = 12;
196                 packet->payload_length = 0;
197                 break;
198
199         case TCODE_READ_BLOCK_REQUEST:
200                 packet->header[3] =
201                         HEADER_DATA_LENGTH(length) |
202                         HEADER_EXTENDED_TCODE(ext_tcode);
203                 packet->header_length = 16;
204                 packet->payload_length = 0;
205                 break;
206         }
207
208         packet->speed = speed;
209         packet->generation = generation;
210         packet->ack = 0;
211         packet->payload_bus = 0;
212 }
213
214 /**
215  * This function provides low-level access to the IEEE1394 transaction
216  * logic.  Most C programs would use either fw_read(), fw_write() or
217  * fw_lock() instead - those function are convenience wrappers for
218  * this function.  The fw_send_request() function is primarily
219  * provided as a flexible, one-stop entry point for languages bindings
220  * and protocol bindings.
221  *
222  * FIXME: Document this function further, in particular the possible
223  * values for rcode in the callback.  In short, we map ACK_COMPLETE to
224  * RCODE_COMPLETE, internal errors set errno and set rcode to
225  * RCODE_SEND_ERROR (which is out of range for standard ieee1394
226  * rcodes).  All other rcodes are forwarded unchanged.  For all
227  * errors, payload is NULL, length is 0.
228  *
229  * Can not expect the callback to be called before the function
230  * returns, though this does happen in some cases (ACK_COMPLETE and
231  * errors).
232  *
233  * The payload is only used for write requests and must not be freed
234  * until the callback has been called.
235  *
236  * @param card the card from which to send the request
237  * @param tcode the tcode for this transaction.  Do not use
238  *   TCODE_LOCK_REQUEST directly, instead use TCODE_LOCK_MASK_SWAP
239  *   etc. to specify tcode and ext_tcode.
240  * @param node_id the destination node ID (bus ID and PHY ID concatenated)
241  * @param generation the generation for which node_id is valid
242  * @param speed the speed to use for sending the request
243  * @param offset the 48 bit offset on the destination node
244  * @param payload the data payload for the request subaction
245  * @param length the length in bytes of the data to read
246  * @param callback function to be called when the transaction is completed
247  * @param callback_data pointer to arbitrary data, which will be
248  *   passed to the callback
249  */
250 void
251 fw_send_request(struct fw_card *card, struct fw_transaction *t,
252                 int tcode, int destination_id, int generation, int speed,
253                 unsigned long long offset,
254                 void *payload, size_t length,
255                 fw_transaction_callback_t callback, void *callback_data)
256 {
257         unsigned long flags;
258         int tlabel;
259
260         /*
261          * Bump the flush timer up 100ms first of all so we
262          * don't race with a flush timer callback.
263          */
264
265         mod_timer(&card->flush_timer, jiffies + DIV_ROUND_UP(HZ, 10));
266
267         /*
268          * Allocate tlabel from the bitmap and put the transaction on
269          * the list while holding the card spinlock.
270          */
271
272         spin_lock_irqsave(&card->lock, flags);
273
274         tlabel = card->current_tlabel;
275         if (card->tlabel_mask & (1 << tlabel)) {
276                 spin_unlock_irqrestore(&card->lock, flags);
277                 callback(card, RCODE_SEND_ERROR, NULL, 0, callback_data);
278                 return;
279         }
280
281         card->current_tlabel = (card->current_tlabel + 1) & 0x1f;
282         card->tlabel_mask |= (1 << tlabel);
283
284         t->node_id = destination_id;
285         t->tlabel = tlabel;
286         t->callback = callback;
287         t->callback_data = callback_data;
288
289         fw_fill_request(&t->packet, tcode, t->tlabel,
290                         destination_id, card->node_id, generation,
291                         speed, offset, payload, length);
292         t->packet.callback = transmit_complete_callback;
293
294         list_add_tail(&t->link, &card->transaction_list);
295
296         spin_unlock_irqrestore(&card->lock, flags);
297
298         card->driver->send_request(card, &t->packet);
299 }
300 EXPORT_SYMBOL(fw_send_request);
301
302 struct transaction_callback_data {
303         struct completion done;
304         void *payload;
305         int rcode;
306 };
307
308 static void transaction_callback(struct fw_card *card, int rcode,
309                                  void *payload, size_t length, void *data)
310 {
311         struct transaction_callback_data *d = data;
312
313         if (rcode == RCODE_COMPLETE)
314                 memcpy(d->payload, payload, length);
315         d->rcode = rcode;
316         complete(&d->done);
317 }
318
319 /**
320  * fw_run_transaction - send request and sleep until transaction is completed
321  *
322  * Returns the RCODE.
323  */
324 int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
325                 int generation, int speed, unsigned long long offset,
326                 void *data, size_t length)
327 {
328         struct transaction_callback_data d;
329         struct fw_transaction t;
330
331         init_completion(&d.done);
332         d.payload = data;
333         fw_send_request(card, &t, tcode, destination_id, generation, speed,
334                         offset, data, length, transaction_callback, &d);
335         wait_for_completion(&d.done);
336
337         return d.rcode;
338 }
339 EXPORT_SYMBOL(fw_run_transaction);
340
341 static DEFINE_MUTEX(phy_config_mutex);
342 static DECLARE_COMPLETION(phy_config_done);
343
344 static void transmit_phy_packet_callback(struct fw_packet *packet,
345                                          struct fw_card *card, int status)
346 {
347         complete(&phy_config_done);
348 }
349
350 static struct fw_packet phy_config_packet = {
351         .header_length  = 8,
352         .payload_length = 0,
353         .speed          = SCODE_100,
354         .callback       = transmit_phy_packet_callback,
355 };
356
357 void fw_send_phy_config(struct fw_card *card,
358                         int node_id, int generation, int gap_count)
359 {
360         long timeout = DIV_ROUND_UP(HZ, 10);
361         u32 data = PHY_IDENTIFIER(PHY_PACKET_CONFIG) |
362                    PHY_CONFIG_ROOT_ID(node_id) |
363                    PHY_CONFIG_GAP_COUNT(gap_count);
364
365         mutex_lock(&phy_config_mutex);
366
367         phy_config_packet.header[0] = data;
368         phy_config_packet.header[1] = ~data;
369         phy_config_packet.generation = generation;
370         INIT_COMPLETION(phy_config_done);
371
372         card->driver->send_request(card, &phy_config_packet);
373         wait_for_completion_timeout(&phy_config_done, timeout);
374
375         mutex_unlock(&phy_config_mutex);
376 }
377
378 void fw_flush_transactions(struct fw_card *card)
379 {
380         struct fw_transaction *t, *next;
381         struct list_head list;
382         unsigned long flags;
383
384         INIT_LIST_HEAD(&list);
385         spin_lock_irqsave(&card->lock, flags);
386         list_splice_init(&card->transaction_list, &list);
387         card->tlabel_mask = 0;
388         spin_unlock_irqrestore(&card->lock, flags);
389
390         list_for_each_entry_safe(t, next, &list, link) {
391                 card->driver->cancel_packet(card, &t->packet);
392
393                 /*
394                  * At this point cancel_packet will never call the
395                  * transaction callback, since we just took all the
396                  * transactions out of the list.  So do it here.
397                  */
398                 t->callback(card, RCODE_CANCELLED, NULL, 0, t->callback_data);
399         }
400 }
401
402 static struct fw_address_handler *
403 lookup_overlapping_address_handler(struct list_head *list,
404                                    unsigned long long offset, size_t length)
405 {
406         struct fw_address_handler *handler;
407
408         list_for_each_entry(handler, list, link) {
409                 if (handler->offset < offset + length &&
410                     offset < handler->offset + handler->length)
411                         return handler;
412         }
413
414         return NULL;
415 }
416
417 static struct fw_address_handler *
418 lookup_enclosing_address_handler(struct list_head *list,
419                                  unsigned long long offset, size_t length)
420 {
421         struct fw_address_handler *handler;
422
423         list_for_each_entry(handler, list, link) {
424                 if (handler->offset <= offset &&
425                     offset + length <= handler->offset + handler->length)
426                         return handler;
427         }
428
429         return NULL;
430 }
431
432 static DEFINE_SPINLOCK(address_handler_lock);
433 static LIST_HEAD(address_handler_list);
434
435 const struct fw_address_region fw_high_memory_region =
436         { .start = 0x000100000000ULL, .end = 0xffffe0000000ULL,  };
437 EXPORT_SYMBOL(fw_high_memory_region);
438
439 #if 0
440 const struct fw_address_region fw_low_memory_region =
441         { .start = 0x000000000000ULL, .end = 0x000100000000ULL,  };
442 const struct fw_address_region fw_private_region =
443         { .start = 0xffffe0000000ULL, .end = 0xfffff0000000ULL,  };
444 const struct fw_address_region fw_csr_region =
445         { .start = CSR_REGISTER_BASE,
446           .end   = CSR_REGISTER_BASE | CSR_CONFIG_ROM_END,  };
447 const struct fw_address_region fw_unit_space_region =
448         { .start = 0xfffff0000900ULL, .end = 0x1000000000000ULL, };
449 #endif  /*  0  */
450
451 /**
452  * fw_core_add_address_handler - register for incoming requests
453  * @handler: callback
454  * @region: region in the IEEE 1212 node space address range
455  *
456  * region->start, ->end, and handler->length have to be quadlet-aligned.
457  *
458  * When a request is received that falls within the specified address range,
459  * the specified callback is invoked.  The parameters passed to the callback
460  * give the details of the particular request.
461  *
462  * Return value:  0 on success, non-zero otherwise.
463  * The start offset of the handler's address region is determined by
464  * fw_core_add_address_handler() and is returned in handler->offset.
465  */
466 int
467 fw_core_add_address_handler(struct fw_address_handler *handler,
468                             const struct fw_address_region *region)
469 {
470         struct fw_address_handler *other;
471         unsigned long flags;
472         int ret = -EBUSY;
473
474         if (region->start & 0xffff000000000003ULL ||
475             region->end   & 0xffff000000000003ULL ||
476             region->start >= region->end ||
477             handler->length & 3 ||
478             handler->length == 0)
479                 return -EINVAL;
480
481         spin_lock_irqsave(&address_handler_lock, flags);
482
483         handler->offset = region->start;
484         while (handler->offset + handler->length <= region->end) {
485                 other =
486                     lookup_overlapping_address_handler(&address_handler_list,
487                                                        handler->offset,
488                                                        handler->length);
489                 if (other != NULL) {
490                         handler->offset += other->length;
491                 } else {
492                         list_add_tail(&handler->link, &address_handler_list);
493                         ret = 0;
494                         break;
495                 }
496         }
497
498         spin_unlock_irqrestore(&address_handler_lock, flags);
499
500         return ret;
501 }
502 EXPORT_SYMBOL(fw_core_add_address_handler);
503
504 /**
505  * Deallocate a range of addresses allocated with fw_allocate.  This
506  * will call the associated callback one last time with a the special
507  * tcode TCODE_DEALLOCATE, to let the client destroy the registered
508  * callback data.  For convenience, the callback parameters offset and
509  * length are set to the start and the length respectively for the
510  * deallocated region, payload is set to NULL.
511  */
512 void fw_core_remove_address_handler(struct fw_address_handler *handler)
513 {
514         unsigned long flags;
515
516         spin_lock_irqsave(&address_handler_lock, flags);
517         list_del(&handler->link);
518         spin_unlock_irqrestore(&address_handler_lock, flags);
519 }
520 EXPORT_SYMBOL(fw_core_remove_address_handler);
521
522 struct fw_request {
523         struct fw_packet response;
524         u32 request_header[4];
525         int ack;
526         u32 length;
527         u32 data[0];
528 };
529
530 static void
531 free_response_callback(struct fw_packet *packet,
532                        struct fw_card *card, int status)
533 {
534         struct fw_request *request;
535
536         request = container_of(packet, struct fw_request, response);
537         kfree(request);
538 }
539
540 void
541 fw_fill_response(struct fw_packet *response, u32 *request_header,
542                  int rcode, void *payload, size_t length)
543 {
544         int tcode, tlabel, extended_tcode, source, destination;
545
546         tcode          = HEADER_GET_TCODE(request_header[0]);
547         tlabel         = HEADER_GET_TLABEL(request_header[0]);
548         source         = HEADER_GET_DESTINATION(request_header[0]);
549         destination    = HEADER_GET_SOURCE(request_header[1]);
550         extended_tcode = HEADER_GET_EXTENDED_TCODE(request_header[3]);
551
552         response->header[0] =
553                 HEADER_RETRY(RETRY_1) |
554                 HEADER_TLABEL(tlabel) |
555                 HEADER_DESTINATION(destination);
556         response->header[1] =
557                 HEADER_SOURCE(source) |
558                 HEADER_RCODE(rcode);
559         response->header[2] = 0;
560
561         switch (tcode) {
562         case TCODE_WRITE_QUADLET_REQUEST:
563         case TCODE_WRITE_BLOCK_REQUEST:
564                 response->header[0] |= HEADER_TCODE(TCODE_WRITE_RESPONSE);
565                 response->header_length = 12;
566                 response->payload_length = 0;
567                 break;
568
569         case TCODE_READ_QUADLET_REQUEST:
570                 response->header[0] |=
571                         HEADER_TCODE(TCODE_READ_QUADLET_RESPONSE);
572                 if (payload != NULL)
573                         response->header[3] = *(u32 *)payload;
574                 else
575                         response->header[3] = 0;
576                 response->header_length = 16;
577                 response->payload_length = 0;
578                 break;
579
580         case TCODE_READ_BLOCK_REQUEST:
581         case TCODE_LOCK_REQUEST:
582                 response->header[0] |= HEADER_TCODE(tcode + 2);
583                 response->header[3] =
584                         HEADER_DATA_LENGTH(length) |
585                         HEADER_EXTENDED_TCODE(extended_tcode);
586                 response->header_length = 16;
587                 response->payload = payload;
588                 response->payload_length = length;
589                 break;
590
591         default:
592                 BUG();
593                 return;
594         }
595
596         response->payload_bus = 0;
597 }
598 EXPORT_SYMBOL(fw_fill_response);
599
600 static struct fw_request *
601 allocate_request(struct fw_packet *p)
602 {
603         struct fw_request *request;
604         u32 *data, length;
605         int request_tcode, t;
606
607         request_tcode = HEADER_GET_TCODE(p->header[0]);
608         switch (request_tcode) {
609         case TCODE_WRITE_QUADLET_REQUEST:
610                 data = &p->header[3];
611                 length = 4;
612                 break;
613
614         case TCODE_WRITE_BLOCK_REQUEST:
615         case TCODE_LOCK_REQUEST:
616                 data = p->payload;
617                 length = HEADER_GET_DATA_LENGTH(p->header[3]);
618                 break;
619
620         case TCODE_READ_QUADLET_REQUEST:
621                 data = NULL;
622                 length = 4;
623                 break;
624
625         case TCODE_READ_BLOCK_REQUEST:
626                 data = NULL;
627                 length = HEADER_GET_DATA_LENGTH(p->header[3]);
628                 break;
629
630         default:
631                 fw_error("ERROR - corrupt request received - %08x %08x %08x\n",
632                          p->header[0], p->header[1], p->header[2]);
633                 return NULL;
634         }
635
636         request = kmalloc(sizeof(*request) + length, GFP_ATOMIC);
637         if (request == NULL)
638                 return NULL;
639
640         t = (p->timestamp & 0x1fff) + 4000;
641         if (t >= 8000)
642                 t = (p->timestamp & ~0x1fff) + 0x2000 + t - 8000;
643         else
644                 t = (p->timestamp & ~0x1fff) + t;
645
646         request->response.speed = p->speed;
647         request->response.timestamp = t;
648         request->response.generation = p->generation;
649         request->response.ack = 0;
650         request->response.callback = free_response_callback;
651         request->ack = p->ack;
652         request->length = length;
653         if (data)
654                 memcpy(request->data, data, length);
655
656         memcpy(request->request_header, p->header, sizeof(p->header));
657
658         return request;
659 }
660
661 void
662 fw_send_response(struct fw_card *card, struct fw_request *request, int rcode)
663 {
664         /* unified transaction or broadcast transaction: don't respond */
665         if (request->ack != ACK_PENDING ||
666             HEADER_DESTINATION_IS_BROADCAST(request->request_header[0])) {
667                 kfree(request);
668                 return;
669         }
670
671         if (rcode == RCODE_COMPLETE)
672                 fw_fill_response(&request->response, request->request_header,
673                                  rcode, request->data, request->length);
674         else
675                 fw_fill_response(&request->response, request->request_header,
676                                  rcode, NULL, 0);
677
678         card->driver->send_response(card, &request->response);
679 }
680 EXPORT_SYMBOL(fw_send_response);
681
682 void
683 fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
684 {
685         struct fw_address_handler *handler;
686         struct fw_request *request;
687         unsigned long long offset;
688         unsigned long flags;
689         int tcode, destination, source;
690
691         if (p->ack != ACK_PENDING && p->ack != ACK_COMPLETE)
692                 return;
693
694         request = allocate_request(p);
695         if (request == NULL) {
696                 /* FIXME: send statically allocated busy packet. */
697                 return;
698         }
699
700         offset      =
701                 ((unsigned long long)
702                  HEADER_GET_OFFSET_HIGH(p->header[1]) << 32) | p->header[2];
703         tcode       = HEADER_GET_TCODE(p->header[0]);
704         destination = HEADER_GET_DESTINATION(p->header[0]);
705         source      = HEADER_GET_SOURCE(p->header[1]);
706
707         spin_lock_irqsave(&address_handler_lock, flags);
708         handler = lookup_enclosing_address_handler(&address_handler_list,
709                                                    offset, request->length);
710         spin_unlock_irqrestore(&address_handler_lock, flags);
711
712         /*
713          * FIXME: lookup the fw_node corresponding to the sender of
714          * this request and pass that to the address handler instead
715          * of the node ID.  We may also want to move the address
716          * allocations to fw_node so we only do this callback if the
717          * upper layers registered it for this node.
718          */
719
720         if (handler == NULL)
721                 fw_send_response(card, request, RCODE_ADDRESS_ERROR);
722         else
723                 handler->address_callback(card, request,
724                                           tcode, destination, source,
725                                           p->generation, p->speed, offset,
726                                           request->data, request->length,
727                                           handler->callback_data);
728 }
729 EXPORT_SYMBOL(fw_core_handle_request);
730
731 void
732 fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
733 {
734         struct fw_transaction *t;
735         unsigned long flags;
736         u32 *data;
737         size_t data_length;
738         int tcode, tlabel, destination, source, rcode;
739
740         tcode       = HEADER_GET_TCODE(p->header[0]);
741         tlabel      = HEADER_GET_TLABEL(p->header[0]);
742         destination = HEADER_GET_DESTINATION(p->header[0]);
743         source      = HEADER_GET_SOURCE(p->header[1]);
744         rcode       = HEADER_GET_RCODE(p->header[1]);
745
746         spin_lock_irqsave(&card->lock, flags);
747         list_for_each_entry(t, &card->transaction_list, link) {
748                 if (t->node_id == source && t->tlabel == tlabel) {
749                         list_del(&t->link);
750                         card->tlabel_mask &= ~(1 << t->tlabel);
751                         break;
752                 }
753         }
754         spin_unlock_irqrestore(&card->lock, flags);
755
756         if (&t->link == &card->transaction_list) {
757                 fw_notify("Unsolicited response (source %x, tlabel %x)\n",
758                           source, tlabel);
759                 return;
760         }
761
762         /*
763          * FIXME: sanity check packet, is length correct, does tcodes
764          * and addresses match.
765          */
766
767         switch (tcode) {
768         case TCODE_READ_QUADLET_RESPONSE:
769                 data = (u32 *) &p->header[3];
770                 data_length = 4;
771                 break;
772
773         case TCODE_WRITE_RESPONSE:
774                 data = NULL;
775                 data_length = 0;
776                 break;
777
778         case TCODE_READ_BLOCK_RESPONSE:
779         case TCODE_LOCK_RESPONSE:
780                 data = p->payload;
781                 data_length = HEADER_GET_DATA_LENGTH(p->header[3]);
782                 break;
783
784         default:
785                 /* Should never happen, this is just to shut up gcc. */
786                 data = NULL;
787                 data_length = 0;
788                 break;
789         }
790
791         /*
792          * The response handler may be executed while the request handler
793          * is still pending.  Cancel the request handler.
794          */
795         card->driver->cancel_packet(card, &t->packet);
796
797         t->callback(card, rcode, data, data_length, t->callback_data);
798 }
799 EXPORT_SYMBOL(fw_core_handle_response);
800
801 static const struct fw_address_region topology_map_region =
802         { .start = CSR_REGISTER_BASE | CSR_TOPOLOGY_MAP,
803           .end   = CSR_REGISTER_BASE | CSR_TOPOLOGY_MAP_END, };
804
805 static void
806 handle_topology_map(struct fw_card *card, struct fw_request *request,
807                     int tcode, int destination, int source,
808                     int generation, int speed,
809                     unsigned long long offset,
810                     void *payload, size_t length, void *callback_data)
811 {
812         int i, start, end;
813         __be32 *map;
814
815         if (!TCODE_IS_READ_REQUEST(tcode)) {
816                 fw_send_response(card, request, RCODE_TYPE_ERROR);
817                 return;
818         }
819
820         if ((offset & 3) > 0 || (length & 3) > 0) {
821                 fw_send_response(card, request, RCODE_ADDRESS_ERROR);
822                 return;
823         }
824
825         start = (offset - topology_map_region.start) / 4;
826         end = start + length / 4;
827         map = payload;
828
829         for (i = 0; i < length / 4; i++)
830                 map[i] = cpu_to_be32(card->topology_map[start + i]);
831
832         fw_send_response(card, request, RCODE_COMPLETE);
833 }
834
835 static struct fw_address_handler topology_map = {
836         .length                 = 0x200,
837         .address_callback       = handle_topology_map,
838 };
839
840 static const struct fw_address_region registers_region =
841         { .start = CSR_REGISTER_BASE,
842           .end   = CSR_REGISTER_BASE | CSR_CONFIG_ROM, };
843
844 static void
845 handle_registers(struct fw_card *card, struct fw_request *request,
846                  int tcode, int destination, int source,
847                  int generation, int speed,
848                  unsigned long long offset,
849                  void *payload, size_t length, void *callback_data)
850 {
851         int reg = offset & ~CSR_REGISTER_BASE;
852         unsigned long long bus_time;
853         __be32 *data = payload;
854         int rcode = RCODE_COMPLETE;
855
856         switch (reg) {
857         case CSR_CYCLE_TIME:
858         case CSR_BUS_TIME:
859                 if (!TCODE_IS_READ_REQUEST(tcode) || length != 4) {
860                         rcode = RCODE_TYPE_ERROR;
861                         break;
862                 }
863
864                 bus_time = card->driver->get_bus_time(card);
865                 if (reg == CSR_CYCLE_TIME)
866                         *data = cpu_to_be32(bus_time);
867                 else
868                         *data = cpu_to_be32(bus_time >> 25);
869                 break;
870
871         case CSR_BROADCAST_CHANNEL:
872                 if (tcode == TCODE_READ_QUADLET_REQUEST)
873                         *data = cpu_to_be32(card->broadcast_channel);
874                 else if (tcode == TCODE_WRITE_QUADLET_REQUEST)
875                         card->broadcast_channel =
876                             (be32_to_cpu(*data) & BROADCAST_CHANNEL_VALID) |
877                             BROADCAST_CHANNEL_INITIAL;
878                 else
879                         rcode = RCODE_TYPE_ERROR;
880                 break;
881
882         case CSR_BUS_MANAGER_ID:
883         case CSR_BANDWIDTH_AVAILABLE:
884         case CSR_CHANNELS_AVAILABLE_HI:
885         case CSR_CHANNELS_AVAILABLE_LO:
886                 /*
887                  * FIXME: these are handled by the OHCI hardware and
888                  * the stack never sees these request. If we add
889                  * support for a new type of controller that doesn't
890                  * handle this in hardware we need to deal with these
891                  * transactions.
892                  */
893                 BUG();
894                 break;
895
896         case CSR_BUSY_TIMEOUT:
897                 /* FIXME: Implement this. */
898
899         default:
900                 rcode = RCODE_ADDRESS_ERROR;
901                 break;
902         }
903
904         fw_send_response(card, request, rcode);
905 }
906
907 static struct fw_address_handler registers = {
908         .length                 = 0x400,
909         .address_callback       = handle_registers,
910 };
911
912 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
913 MODULE_DESCRIPTION("Core IEEE1394 transaction logic");
914 MODULE_LICENSE("GPL");
915
916 static const u32 vendor_textual_descriptor[] = {
917         /* textual descriptor leaf () */
918         0x00060000,
919         0x00000000,
920         0x00000000,
921         0x4c696e75,             /* L i n u */
922         0x78204669,             /* x   F i */
923         0x72657769,             /* r e w i */
924         0x72650000,             /* r e     */
925 };
926
927 static const u32 model_textual_descriptor[] = {
928         /* model descriptor leaf () */
929         0x00030000,
930         0x00000000,
931         0x00000000,
932         0x4a756a75,             /* J u j u */
933 };
934
935 static struct fw_descriptor vendor_id_descriptor = {
936         .length = ARRAY_SIZE(vendor_textual_descriptor),
937         .immediate = 0x03d00d1e,
938         .key = 0x81000000,
939         .data = vendor_textual_descriptor,
940 };
941
942 static struct fw_descriptor model_id_descriptor = {
943         .length = ARRAY_SIZE(model_textual_descriptor),
944         .immediate = 0x17000001,
945         .key = 0x81000000,
946         .data = model_textual_descriptor,
947 };
948
949 static int __init fw_core_init(void)
950 {
951         int retval;
952
953         retval = bus_register(&fw_bus_type);
954         if (retval < 0)
955                 return retval;
956
957         fw_cdev_major = register_chrdev(0, "firewire", &fw_device_ops);
958         if (fw_cdev_major < 0) {
959                 bus_unregister(&fw_bus_type);
960                 return fw_cdev_major;
961         }
962
963         retval = fw_core_add_address_handler(&topology_map,
964                                              &topology_map_region);
965         BUG_ON(retval < 0);
966
967         retval = fw_core_add_address_handler(&registers,
968                                              &registers_region);
969         BUG_ON(retval < 0);
970
971         /* Add the vendor textual descriptor. */
972         retval = fw_core_add_descriptor(&vendor_id_descriptor);
973         BUG_ON(retval < 0);
974         retval = fw_core_add_descriptor(&model_id_descriptor);
975         BUG_ON(retval < 0);
976
977         return 0;
978 }
979
980 static void __exit fw_core_cleanup(void)
981 {
982         unregister_chrdev(fw_cdev_major, "firewire");
983         bus_unregister(&fw_bus_type);
984         idr_destroy(&fw_device_idr);
985 }
986
987 module_init(fw_core_init);
988 module_exit(fw_core_cleanup);