mt76: avoid rx reorder buffer overflow
[linux/fpc-iii.git] / drivers / firewire / nosy.c
blob6ca2f5ab6c57e8849dda47ad66b7d635341e50bf
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * nosy - Snoop mode driver for TI PCILynx 1394 controllers
4 * Copyright (C) 2002-2007 Kristian Høgsberg
5 */
7 #include <linux/device.h>
8 #include <linux/errno.h>
9 #include <linux/fs.h>
10 #include <linux/init.h>
11 #include <linux/interrupt.h>
12 #include <linux/io.h>
13 #include <linux/kernel.h>
14 #include <linux/kref.h>
15 #include <linux/miscdevice.h>
16 #include <linux/module.h>
17 #include <linux/mutex.h>
18 #include <linux/pci.h>
19 #include <linux/poll.h>
20 #include <linux/sched.h> /* required for linux/wait.h */
21 #include <linux/slab.h>
22 #include <linux/spinlock.h>
23 #include <linux/time64.h>
24 #include <linux/timex.h>
25 #include <linux/uaccess.h>
26 #include <linux/wait.h>
27 #include <linux/dma-mapping.h>
28 #include <linux/atomic.h>
29 #include <asm/byteorder.h>
31 #include "nosy.h"
32 #include "nosy-user.h"
34 #define TCODE_PHY_PACKET 0x10
35 #define PCI_DEVICE_ID_TI_PCILYNX 0x8000
37 static char driver_name[] = KBUILD_MODNAME;
39 /* this is the physical layout of a PCL, its size is 128 bytes */
40 struct pcl {
41 __le32 next;
42 __le32 async_error_next;
43 u32 user_data;
44 __le32 pcl_status;
45 __le32 remaining_transfer_count;
46 __le32 next_data_buffer;
47 struct {
48 __le32 control;
49 __le32 pointer;
50 } buffer[13];
53 struct packet {
54 unsigned int length;
55 char data[0];
58 struct packet_buffer {
59 char *data;
60 size_t capacity;
61 long total_packet_count, lost_packet_count;
62 atomic_t size;
63 struct packet *head, *tail;
64 wait_queue_head_t wait;
67 struct pcilynx {
68 struct pci_dev *pci_device;
69 __iomem char *registers;
71 struct pcl *rcv_start_pcl, *rcv_pcl;
72 __le32 *rcv_buffer;
74 dma_addr_t rcv_start_pcl_bus, rcv_pcl_bus, rcv_buffer_bus;
76 spinlock_t client_list_lock;
77 struct list_head client_list;
79 struct miscdevice misc;
80 struct list_head link;
81 struct kref kref;
84 static inline struct pcilynx *
85 lynx_get(struct pcilynx *lynx)
87 kref_get(&lynx->kref);
89 return lynx;
92 static void
93 lynx_release(struct kref *kref)
95 kfree(container_of(kref, struct pcilynx, kref));
98 static inline void
99 lynx_put(struct pcilynx *lynx)
101 kref_put(&lynx->kref, lynx_release);
104 struct client {
105 struct pcilynx *lynx;
106 u32 tcode_mask;
107 struct packet_buffer buffer;
108 struct list_head link;
111 static DEFINE_MUTEX(card_mutex);
112 static LIST_HEAD(card_list);
114 static int
115 packet_buffer_init(struct packet_buffer *buffer, size_t capacity)
117 buffer->data = kmalloc(capacity, GFP_KERNEL);
118 if (buffer->data == NULL)
119 return -ENOMEM;
120 buffer->head = (struct packet *) buffer->data;
121 buffer->tail = (struct packet *) buffer->data;
122 buffer->capacity = capacity;
123 buffer->lost_packet_count = 0;
124 atomic_set(&buffer->size, 0);
125 init_waitqueue_head(&buffer->wait);
127 return 0;
130 static void
131 packet_buffer_destroy(struct packet_buffer *buffer)
133 kfree(buffer->data);
136 static int
137 packet_buffer_get(struct client *client, char __user *data, size_t user_length)
139 struct packet_buffer *buffer = &client->buffer;
140 size_t length;
141 char *end;
143 if (wait_event_interruptible(buffer->wait,
144 atomic_read(&buffer->size) > 0) ||
145 list_empty(&client->lynx->link))
146 return -ERESTARTSYS;
148 if (atomic_read(&buffer->size) == 0)
149 return -ENODEV;
151 /* FIXME: Check length <= user_length. */
153 end = buffer->data + buffer->capacity;
154 length = buffer->head->length;
156 if (&buffer->head->data[length] < end) {
157 if (copy_to_user(data, buffer->head->data, length))
158 return -EFAULT;
159 buffer->head = (struct packet *) &buffer->head->data[length];
160 } else {
161 size_t split = end - buffer->head->data;
163 if (copy_to_user(data, buffer->head->data, split))
164 return -EFAULT;
165 if (copy_to_user(data + split, buffer->data, length - split))
166 return -EFAULT;
167 buffer->head = (struct packet *) &buffer->data[length - split];
171 * Decrease buffer->size as the last thing, since this is what
172 * keeps the interrupt from overwriting the packet we are
173 * retrieving from the buffer.
175 atomic_sub(sizeof(struct packet) + length, &buffer->size);
177 return length;
180 static void
181 packet_buffer_put(struct packet_buffer *buffer, void *data, size_t length)
183 char *end;
185 buffer->total_packet_count++;
187 if (buffer->capacity <
188 atomic_read(&buffer->size) + sizeof(struct packet) + length) {
189 buffer->lost_packet_count++;
190 return;
193 end = buffer->data + buffer->capacity;
194 buffer->tail->length = length;
196 if (&buffer->tail->data[length] < end) {
197 memcpy(buffer->tail->data, data, length);
198 buffer->tail = (struct packet *) &buffer->tail->data[length];
199 } else {
200 size_t split = end - buffer->tail->data;
202 memcpy(buffer->tail->data, data, split);
203 memcpy(buffer->data, data + split, length - split);
204 buffer->tail = (struct packet *) &buffer->data[length - split];
207 /* Finally, adjust buffer size and wake up userspace reader. */
209 atomic_add(sizeof(struct packet) + length, &buffer->size);
210 wake_up_interruptible(&buffer->wait);
213 static inline void
214 reg_write(struct pcilynx *lynx, int offset, u32 data)
216 writel(data, lynx->registers + offset);
219 static inline u32
220 reg_read(struct pcilynx *lynx, int offset)
222 return readl(lynx->registers + offset);
225 static inline void
226 reg_set_bits(struct pcilynx *lynx, int offset, u32 mask)
228 reg_write(lynx, offset, (reg_read(lynx, offset) | mask));
232 * Maybe the pcl programs could be set up to just append data instead
233 * of using a whole packet.
235 static inline void
236 run_pcl(struct pcilynx *lynx, dma_addr_t pcl_bus,
237 int dmachan)
239 reg_write(lynx, DMA0_CURRENT_PCL + dmachan * 0x20, pcl_bus);
240 reg_write(lynx, DMA0_CHAN_CTRL + dmachan * 0x20,
241 DMA_CHAN_CTRL_ENABLE | DMA_CHAN_CTRL_LINK);
244 static int
245 set_phy_reg(struct pcilynx *lynx, int addr, int val)
247 if (addr > 15) {
248 dev_err(&lynx->pci_device->dev,
249 "PHY register address %d out of range\n", addr);
250 return -1;
252 if (val > 0xff) {
253 dev_err(&lynx->pci_device->dev,
254 "PHY register value %d out of range\n", val);
255 return -1;
257 reg_write(lynx, LINK_PHY, LINK_PHY_WRITE |
258 LINK_PHY_ADDR(addr) | LINK_PHY_WDATA(val));
260 return 0;
263 static int
264 nosy_open(struct inode *inode, struct file *file)
266 int minor = iminor(inode);
267 struct client *client;
268 struct pcilynx *tmp, *lynx = NULL;
270 mutex_lock(&card_mutex);
271 list_for_each_entry(tmp, &card_list, link)
272 if (tmp->misc.minor == minor) {
273 lynx = lynx_get(tmp);
274 break;
276 mutex_unlock(&card_mutex);
277 if (lynx == NULL)
278 return -ENODEV;
280 client = kmalloc(sizeof *client, GFP_KERNEL);
281 if (client == NULL)
282 goto fail;
284 client->tcode_mask = ~0;
285 client->lynx = lynx;
286 INIT_LIST_HEAD(&client->link);
288 if (packet_buffer_init(&client->buffer, 128 * 1024) < 0)
289 goto fail;
291 file->private_data = client;
293 return stream_open(inode, file);
294 fail:
295 kfree(client);
296 lynx_put(lynx);
298 return -ENOMEM;
301 static int
302 nosy_release(struct inode *inode, struct file *file)
304 struct client *client = file->private_data;
305 struct pcilynx *lynx = client->lynx;
307 spin_lock_irq(&lynx->client_list_lock);
308 list_del_init(&client->link);
309 spin_unlock_irq(&lynx->client_list_lock);
311 packet_buffer_destroy(&client->buffer);
312 kfree(client);
313 lynx_put(lynx);
315 return 0;
318 static __poll_t
319 nosy_poll(struct file *file, poll_table *pt)
321 struct client *client = file->private_data;
322 __poll_t ret = 0;
324 poll_wait(file, &client->buffer.wait, pt);
326 if (atomic_read(&client->buffer.size) > 0)
327 ret = EPOLLIN | EPOLLRDNORM;
329 if (list_empty(&client->lynx->link))
330 ret |= EPOLLHUP;
332 return ret;
335 static ssize_t
336 nosy_read(struct file *file, char __user *buffer, size_t count, loff_t *offset)
338 struct client *client = file->private_data;
340 return packet_buffer_get(client, buffer, count);
343 static long
344 nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
346 struct client *client = file->private_data;
347 spinlock_t *client_list_lock = &client->lynx->client_list_lock;
348 struct nosy_stats stats;
350 switch (cmd) {
351 case NOSY_IOC_GET_STATS:
352 spin_lock_irq(client_list_lock);
353 stats.total_packet_count = client->buffer.total_packet_count;
354 stats.lost_packet_count = client->buffer.lost_packet_count;
355 spin_unlock_irq(client_list_lock);
357 if (copy_to_user((void __user *) arg, &stats, sizeof stats))
358 return -EFAULT;
359 else
360 return 0;
362 case NOSY_IOC_START:
363 spin_lock_irq(client_list_lock);
364 list_add_tail(&client->link, &client->lynx->client_list);
365 spin_unlock_irq(client_list_lock);
367 return 0;
369 case NOSY_IOC_STOP:
370 spin_lock_irq(client_list_lock);
371 list_del_init(&client->link);
372 spin_unlock_irq(client_list_lock);
374 return 0;
376 case NOSY_IOC_FILTER:
377 spin_lock_irq(client_list_lock);
378 client->tcode_mask = arg;
379 spin_unlock_irq(client_list_lock);
381 return 0;
383 default:
384 return -EINVAL;
385 /* Flush buffer, configure filter. */
389 static const struct file_operations nosy_ops = {
390 .owner = THIS_MODULE,
391 .read = nosy_read,
392 .unlocked_ioctl = nosy_ioctl,
393 .poll = nosy_poll,
394 .open = nosy_open,
395 .release = nosy_release,
398 #define PHY_PACKET_SIZE 12 /* 1 payload, 1 inverse, 1 ack = 3 quadlets */
400 static void
401 packet_irq_handler(struct pcilynx *lynx)
403 struct client *client;
404 u32 tcode_mask, tcode, timestamp;
405 size_t length;
406 struct timespec64 ts64;
408 /* FIXME: Also report rcv_speed. */
410 length = __le32_to_cpu(lynx->rcv_pcl->pcl_status) & 0x00001fff;
411 tcode = __le32_to_cpu(lynx->rcv_buffer[1]) >> 4 & 0xf;
413 ktime_get_real_ts64(&ts64);
414 timestamp = ts64.tv_nsec / NSEC_PER_USEC;
415 lynx->rcv_buffer[0] = (__force __le32)timestamp;
417 if (length == PHY_PACKET_SIZE)
418 tcode_mask = 1 << TCODE_PHY_PACKET;
419 else
420 tcode_mask = 1 << tcode;
422 spin_lock(&lynx->client_list_lock);
424 list_for_each_entry(client, &lynx->client_list, link)
425 if (client->tcode_mask & tcode_mask)
426 packet_buffer_put(&client->buffer,
427 lynx->rcv_buffer, length + 4);
429 spin_unlock(&lynx->client_list_lock);
432 static void
433 bus_reset_irq_handler(struct pcilynx *lynx)
435 struct client *client;
436 struct timespec64 ts64;
437 u32 timestamp;
439 ktime_get_real_ts64(&ts64);
440 timestamp = ts64.tv_nsec / NSEC_PER_USEC;
442 spin_lock(&lynx->client_list_lock);
444 list_for_each_entry(client, &lynx->client_list, link)
445 packet_buffer_put(&client->buffer, &timestamp, 4);
447 spin_unlock(&lynx->client_list_lock);
450 static irqreturn_t
451 irq_handler(int irq, void *device)
453 struct pcilynx *lynx = device;
454 u32 pci_int_status;
456 pci_int_status = reg_read(lynx, PCI_INT_STATUS);
458 if (pci_int_status == ~0)
459 /* Card was ejected. */
460 return IRQ_NONE;
462 if ((pci_int_status & PCI_INT_INT_PEND) == 0)
463 /* Not our interrupt, bail out quickly. */
464 return IRQ_NONE;
466 if ((pci_int_status & PCI_INT_P1394_INT) != 0) {
467 u32 link_int_status;
469 link_int_status = reg_read(lynx, LINK_INT_STATUS);
470 reg_write(lynx, LINK_INT_STATUS, link_int_status);
472 if ((link_int_status & LINK_INT_PHY_BUSRESET) > 0)
473 bus_reset_irq_handler(lynx);
476 /* Clear the PCI_INT_STATUS register only after clearing the
477 * LINK_INT_STATUS register; otherwise the PCI_INT_P1394 will
478 * be set again immediately. */
480 reg_write(lynx, PCI_INT_STATUS, pci_int_status);
482 if ((pci_int_status & PCI_INT_DMA0_HLT) > 0) {
483 packet_irq_handler(lynx);
484 run_pcl(lynx, lynx->rcv_start_pcl_bus, 0);
487 return IRQ_HANDLED;
490 static void
491 remove_card(struct pci_dev *dev)
493 struct pcilynx *lynx = pci_get_drvdata(dev);
494 struct client *client;
496 mutex_lock(&card_mutex);
497 list_del_init(&lynx->link);
498 misc_deregister(&lynx->misc);
499 mutex_unlock(&card_mutex);
501 reg_write(lynx, PCI_INT_ENABLE, 0);
502 free_irq(lynx->pci_device->irq, lynx);
504 spin_lock_irq(&lynx->client_list_lock);
505 list_for_each_entry(client, &lynx->client_list, link)
506 wake_up_interruptible(&client->buffer.wait);
507 spin_unlock_irq(&lynx->client_list_lock);
509 pci_free_consistent(lynx->pci_device, sizeof(struct pcl),
510 lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);
511 pci_free_consistent(lynx->pci_device, sizeof(struct pcl),
512 lynx->rcv_pcl, lynx->rcv_pcl_bus);
513 pci_free_consistent(lynx->pci_device, PAGE_SIZE,
514 lynx->rcv_buffer, lynx->rcv_buffer_bus);
516 iounmap(lynx->registers);
517 pci_disable_device(dev);
518 lynx_put(lynx);
521 #define RCV_BUFFER_SIZE (16 * 1024)
523 static int
524 add_card(struct pci_dev *dev, const struct pci_device_id *unused)
526 struct pcilynx *lynx;
527 u32 p, end;
528 int ret, i;
530 if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) {
531 dev_err(&dev->dev,
532 "DMA address limits not supported for PCILynx hardware\n");
533 return -ENXIO;
535 if (pci_enable_device(dev)) {
536 dev_err(&dev->dev, "Failed to enable PCILynx hardware\n");
537 return -ENXIO;
539 pci_set_master(dev);
541 lynx = kzalloc(sizeof *lynx, GFP_KERNEL);
542 if (lynx == NULL) {
543 dev_err(&dev->dev, "Failed to allocate control structure\n");
544 ret = -ENOMEM;
545 goto fail_disable;
547 lynx->pci_device = dev;
548 pci_set_drvdata(dev, lynx);
550 spin_lock_init(&lynx->client_list_lock);
551 INIT_LIST_HEAD(&lynx->client_list);
552 kref_init(&lynx->kref);
554 lynx->registers = ioremap(pci_resource_start(dev, 0),
555 PCILYNX_MAX_REGISTER);
556 if (lynx->registers == NULL) {
557 dev_err(&dev->dev, "Failed to map registers\n");
558 ret = -ENOMEM;
559 goto fail_deallocate_lynx;
562 lynx->rcv_start_pcl = pci_alloc_consistent(lynx->pci_device,
563 sizeof(struct pcl), &lynx->rcv_start_pcl_bus);
564 lynx->rcv_pcl = pci_alloc_consistent(lynx->pci_device,
565 sizeof(struct pcl), &lynx->rcv_pcl_bus);
566 lynx->rcv_buffer = pci_alloc_consistent(lynx->pci_device,
567 RCV_BUFFER_SIZE, &lynx->rcv_buffer_bus);
568 if (lynx->rcv_start_pcl == NULL ||
569 lynx->rcv_pcl == NULL ||
570 lynx->rcv_buffer == NULL) {
571 dev_err(&dev->dev, "Failed to allocate receive buffer\n");
572 ret = -ENOMEM;
573 goto fail_deallocate_buffers;
575 lynx->rcv_start_pcl->next = cpu_to_le32(lynx->rcv_pcl_bus);
576 lynx->rcv_pcl->next = cpu_to_le32(PCL_NEXT_INVALID);
577 lynx->rcv_pcl->async_error_next = cpu_to_le32(PCL_NEXT_INVALID);
579 lynx->rcv_pcl->buffer[0].control =
580 cpu_to_le32(PCL_CMD_RCV | PCL_BIGENDIAN | 2044);
581 lynx->rcv_pcl->buffer[0].pointer =
582 cpu_to_le32(lynx->rcv_buffer_bus + 4);
583 p = lynx->rcv_buffer_bus + 2048;
584 end = lynx->rcv_buffer_bus + RCV_BUFFER_SIZE;
585 for (i = 1; p < end; i++, p += 2048) {
586 lynx->rcv_pcl->buffer[i].control =
587 cpu_to_le32(PCL_CMD_RCV | PCL_BIGENDIAN | 2048);
588 lynx->rcv_pcl->buffer[i].pointer = cpu_to_le32(p);
590 lynx->rcv_pcl->buffer[i - 1].control |= cpu_to_le32(PCL_LAST_BUFF);
592 reg_set_bits(lynx, MISC_CONTROL, MISC_CONTROL_SWRESET);
593 /* Fix buggy cards with autoboot pin not tied low: */
594 reg_write(lynx, DMA0_CHAN_CTRL, 0);
595 reg_write(lynx, DMA_GLOBAL_REGISTER, 0x00 << 24);
597 #if 0
598 /* now, looking for PHY register set */
599 if ((get_phy_reg(lynx, 2) & 0xe0) == 0xe0) {
600 lynx->phyic.reg_1394a = 1;
601 PRINT(KERN_INFO, lynx->id,
602 "found 1394a conform PHY (using extended register set)");
603 lynx->phyic.vendor = get_phy_vendorid(lynx);
604 lynx->phyic.product = get_phy_productid(lynx);
605 } else {
606 lynx->phyic.reg_1394a = 0;
607 PRINT(KERN_INFO, lynx->id, "found old 1394 PHY");
609 #endif
611 /* Setup the general receive FIFO max size. */
612 reg_write(lynx, FIFO_SIZES, 255);
614 reg_set_bits(lynx, PCI_INT_ENABLE, PCI_INT_DMA_ALL);
616 reg_write(lynx, LINK_INT_ENABLE,
617 LINK_INT_PHY_TIME_OUT | LINK_INT_PHY_REG_RCVD |
618 LINK_INT_PHY_BUSRESET | LINK_INT_IT_STUCK |
619 LINK_INT_AT_STUCK | LINK_INT_SNTRJ |
620 LINK_INT_TC_ERR | LINK_INT_GRF_OVER_FLOW |
621 LINK_INT_ITF_UNDER_FLOW | LINK_INT_ATF_UNDER_FLOW);
623 /* Disable the L flag in self ID packets. */
624 set_phy_reg(lynx, 4, 0);
626 /* Put this baby into snoop mode */
627 reg_set_bits(lynx, LINK_CONTROL, LINK_CONTROL_SNOOP_ENABLE);
629 run_pcl(lynx, lynx->rcv_start_pcl_bus, 0);
631 if (request_irq(dev->irq, irq_handler, IRQF_SHARED,
632 driver_name, lynx)) {
633 dev_err(&dev->dev,
634 "Failed to allocate shared interrupt %d\n", dev->irq);
635 ret = -EIO;
636 goto fail_deallocate_buffers;
639 lynx->misc.parent = &dev->dev;
640 lynx->misc.minor = MISC_DYNAMIC_MINOR;
641 lynx->misc.name = "nosy";
642 lynx->misc.fops = &nosy_ops;
644 mutex_lock(&card_mutex);
645 ret = misc_register(&lynx->misc);
646 if (ret) {
647 dev_err(&dev->dev, "Failed to register misc char device\n");
648 mutex_unlock(&card_mutex);
649 goto fail_free_irq;
651 list_add_tail(&lynx->link, &card_list);
652 mutex_unlock(&card_mutex);
654 dev_info(&dev->dev,
655 "Initialized PCILynx IEEE1394 card, irq=%d\n", dev->irq);
657 return 0;
659 fail_free_irq:
660 reg_write(lynx, PCI_INT_ENABLE, 0);
661 free_irq(lynx->pci_device->irq, lynx);
663 fail_deallocate_buffers:
664 if (lynx->rcv_start_pcl)
665 pci_free_consistent(lynx->pci_device, sizeof(struct pcl),
666 lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);
667 if (lynx->rcv_pcl)
668 pci_free_consistent(lynx->pci_device, sizeof(struct pcl),
669 lynx->rcv_pcl, lynx->rcv_pcl_bus);
670 if (lynx->rcv_buffer)
671 pci_free_consistent(lynx->pci_device, PAGE_SIZE,
672 lynx->rcv_buffer, lynx->rcv_buffer_bus);
673 iounmap(lynx->registers);
675 fail_deallocate_lynx:
676 kfree(lynx);
678 fail_disable:
679 pci_disable_device(dev);
681 return ret;
684 static struct pci_device_id pci_table[] = {
686 .vendor = PCI_VENDOR_ID_TI,
687 .device = PCI_DEVICE_ID_TI_PCILYNX,
688 .subvendor = PCI_ANY_ID,
689 .subdevice = PCI_ANY_ID,
691 { } /* Terminating entry */
694 MODULE_DEVICE_TABLE(pci, pci_table);
696 static struct pci_driver lynx_pci_driver = {
697 .name = driver_name,
698 .id_table = pci_table,
699 .probe = add_card,
700 .remove = remove_card,
703 module_pci_driver(lynx_pci_driver);
705 MODULE_AUTHOR("Kristian Hoegsberg");
706 MODULE_DESCRIPTION("Snoop mode driver for TI pcilynx 1394 controllers");
707 MODULE_LICENSE("GPL");