cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

applicom.c (24668B)


      1// SPDX-License-Identifier: GPL-2.0-only
      2/* Derived from Applicom driver ac.c for SCO Unix                            */
      3/* Ported by David Woodhouse, Axiom (Cambridge) Ltd.                         */
      4/* dwmw2@infradead.org 30/8/98                                               */
      5/* $Id: ac.c,v 1.30 2000/03/22 16:03:57 dwmw2 Exp $			     */
      6/* This module is for Linux 2.1 and 2.2 series kernels.                      */
      7/*****************************************************************************/
      8/* J PAGET 18/02/94 passage V2.4.2 ioctl avec code 2 reset to les interrupt  */
      9/* ceci pour reseter correctement apres une sortie sauvage                   */
     10/* J PAGET 02/05/94 passage V2.4.3 dans le traitement de d'interruption,     */
     11/* LoopCount n'etait pas initialise a 0.                                     */
     12/* F LAFORSE 04/07/95 version V2.6.0 lecture bidon apres acces a une carte   */
     13/*           pour liberer le bus                                             */
     14/* J.PAGET 19/11/95 version V2.6.1 Nombre, addresse,irq n'est plus configure */
     15/* et passe en argument a acinit, mais est scrute sur le bus pour s'adapter  */
     16/* au nombre de cartes presentes sur le bus. IOCL code 6 affichait V2.4.3    */
     17/* F.LAFORSE 28/11/95 creation de fichiers acXX.o avec les differentes       */
     18/* addresses de base des cartes, IOCTL 6 plus complet                         */
     19/* J.PAGET le 19/08/96 copie de la version V2.6 en V2.8.0 sans modification  */
     20/* de code autre que le texte V2.6.1 en V2.8.0                               */
     21/*****************************************************************************/
     22
     23
     24#include <linux/kernel.h>
     25#include <linux/module.h>
     26#include <linux/interrupt.h>
     27#include <linux/sched/signal.h>
     28#include <linux/slab.h>
     29#include <linux/errno.h>
     30#include <linux/mutex.h>
     31#include <linux/miscdevice.h>
     32#include <linux/pci.h>
     33#include <linux/wait.h>
     34#include <linux/init.h>
     35#include <linux/fs.h>
     36#include <linux/nospec.h>
     37
     38#include <asm/io.h>
     39#include <linux/uaccess.h>
     40
     41#include "applicom.h"
     42
     43
     44/* NOTE: We use for loops with {write,read}b() instead of 
     45   memcpy_{from,to}io throughout this driver. This is because
     46   the board doesn't correctly handle word accesses - only
     47   bytes. 
     48*/
     49
     50
     51#undef DEBUG
     52
     53#define MAX_BOARD 8		/* maximum of pc board possible */
     54#define MAX_ISA_BOARD 4
     55#define LEN_RAM_IO 0x800
     56
     57#ifndef PCI_VENDOR_ID_APPLICOM
     58#define PCI_VENDOR_ID_APPLICOM                0x1389
     59#define PCI_DEVICE_ID_APPLICOM_PCIGENERIC     0x0001
     60#define PCI_DEVICE_ID_APPLICOM_PCI2000IBS_CAN 0x0002
     61#define PCI_DEVICE_ID_APPLICOM_PCI2000PFB     0x0003
     62#endif
     63
     64static DEFINE_MUTEX(ac_mutex);
     65static char *applicom_pci_devnames[] = {
     66	"PCI board",
     67	"PCI2000IBS / PCI2000CAN",
     68	"PCI2000PFB"
     69};
     70
     71static const struct pci_device_id applicom_pci_tbl[] = {
     72	{ PCI_VDEVICE(APPLICOM, PCI_DEVICE_ID_APPLICOM_PCIGENERIC) },
     73	{ PCI_VDEVICE(APPLICOM, PCI_DEVICE_ID_APPLICOM_PCI2000IBS_CAN) },
     74	{ PCI_VDEVICE(APPLICOM, PCI_DEVICE_ID_APPLICOM_PCI2000PFB) },
     75	{ 0 }
     76};
     77MODULE_DEVICE_TABLE(pci, applicom_pci_tbl);
     78
     79MODULE_AUTHOR("David Woodhouse & Applicom International");
     80MODULE_DESCRIPTION("Driver for Applicom Profibus card");
     81MODULE_LICENSE("GPL");
     82MODULE_ALIAS_MISCDEV(AC_MINOR);
     83
     84static struct applicom_board {
     85	unsigned long PhysIO;
     86	void __iomem *RamIO;
     87	wait_queue_head_t FlagSleepSend;
     88	long irq;
     89	spinlock_t mutex;
     90} apbs[MAX_BOARD];
     91
     92static unsigned int irq;	/* interrupt number IRQ       */
     93static unsigned long mem;	/* physical segment of board  */
     94
     95module_param_hw(irq, uint, irq, 0);
     96MODULE_PARM_DESC(irq, "IRQ of the Applicom board");
     97module_param_hw(mem, ulong, iomem, 0);
     98MODULE_PARM_DESC(mem, "Shared Memory Address of Applicom board");
     99
    100static unsigned int numboards;	/* number of installed boards */
    101static volatile unsigned char Dummy;
    102static DECLARE_WAIT_QUEUE_HEAD(FlagSleepRec);
    103static unsigned int WriteErrorCount;	/* number of write error      */
    104static unsigned int ReadErrorCount;	/* number of read error       */
    105static unsigned int DeviceErrorCount;	/* number of device error     */
    106
    107static ssize_t ac_read (struct file *, char __user *, size_t, loff_t *);
    108static ssize_t ac_write (struct file *, const char __user *, size_t, loff_t *);
    109static long ac_ioctl(struct file *, unsigned int, unsigned long);
    110static irqreturn_t ac_interrupt(int, void *);
    111
    112static const struct file_operations ac_fops = {
    113	.owner = THIS_MODULE,
    114	.llseek = no_llseek,
    115	.read = ac_read,
    116	.write = ac_write,
    117	.unlocked_ioctl = ac_ioctl,
    118};
    119
    120static struct miscdevice ac_miscdev = {
    121	AC_MINOR,
    122	"ac",
    123	&ac_fops
    124};
    125
    126static int dummy;	/* dev_id for request_irq() */
    127
    128static int ac_register_board(unsigned long physloc, void __iomem *loc, 
    129		      unsigned char boardno)
    130{
    131	volatile unsigned char byte_reset_it;
    132
    133	if((readb(loc + CONF_END_TEST)     != 0x00) ||
    134	   (readb(loc + CONF_END_TEST + 1) != 0x55) ||
    135	   (readb(loc + CONF_END_TEST + 2) != 0xAA) ||
    136	   (readb(loc + CONF_END_TEST + 3) != 0xFF))
    137		return 0;
    138
    139	if (!boardno)
    140		boardno = readb(loc + NUMCARD_OWNER_TO_PC);
    141
    142	if (!boardno || boardno > MAX_BOARD) {
    143		printk(KERN_WARNING "Board #%d (at 0x%lx) is out of range (1 <= x <= %d).\n",
    144		       boardno, physloc, MAX_BOARD);
    145		return 0;
    146	}
    147
    148	if (apbs[boardno - 1].RamIO) {
    149		printk(KERN_WARNING "Board #%d (at 0x%lx) conflicts with previous board #%d (at 0x%lx)\n", 
    150		       boardno, physloc, boardno, apbs[boardno-1].PhysIO);
    151		return 0;
    152	}
    153
    154	boardno--;
    155
    156	apbs[boardno].PhysIO = physloc;
    157	apbs[boardno].RamIO = loc;
    158	init_waitqueue_head(&apbs[boardno].FlagSleepSend);
    159	spin_lock_init(&apbs[boardno].mutex);
    160	byte_reset_it = readb(loc + RAM_IT_TO_PC);
    161
    162	numboards++;
    163	return boardno + 1;
    164}
    165
    166static void __exit applicom_exit(void)
    167{
    168	unsigned int i;
    169
    170	misc_deregister(&ac_miscdev);
    171
    172	for (i = 0; i < MAX_BOARD; i++) {
    173
    174		if (!apbs[i].RamIO)
    175			continue;
    176
    177		if (apbs[i].irq)
    178			free_irq(apbs[i].irq, &dummy);
    179
    180		iounmap(apbs[i].RamIO);
    181	}
    182}
    183
    184static int __init applicom_init(void)
    185{
    186	int i, numisa = 0;
    187	struct pci_dev *dev = NULL;
    188	void __iomem *RamIO;
    189	int boardno, ret;
    190
    191	printk(KERN_INFO "Applicom driver: $Id: ac.c,v 1.30 2000/03/22 16:03:57 dwmw2 Exp $\n");
    192
    193	/* No mem and irq given - check for a PCI card */
    194
    195	while ( (dev = pci_get_class(PCI_CLASS_OTHERS << 16, dev))) {
    196
    197		if (!pci_match_id(applicom_pci_tbl, dev))
    198			continue;
    199		
    200		if (pci_enable_device(dev))
    201			return -EIO;
    202
    203		RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO);
    204
    205		if (!RamIO) {
    206			printk(KERN_INFO "ac.o: Failed to ioremap PCI memory "
    207				"space at 0x%llx\n",
    208				(unsigned long long)pci_resource_start(dev, 0));
    209			pci_disable_device(dev);
    210			return -EIO;
    211		}
    212
    213		printk(KERN_INFO "Applicom %s found at mem 0x%llx, irq %d\n",
    214		       applicom_pci_devnames[dev->device-1],
    215			   (unsigned long long)pci_resource_start(dev, 0),
    216		       dev->irq);
    217
    218		boardno = ac_register_board(pci_resource_start(dev, 0),
    219				RamIO, 0);
    220		if (!boardno) {
    221			printk(KERN_INFO "ac.o: PCI Applicom device doesn't have correct signature.\n");
    222			iounmap(RamIO);
    223			pci_disable_device(dev);
    224			continue;
    225		}
    226
    227		if (request_irq(dev->irq, &ac_interrupt, IRQF_SHARED, "Applicom PCI", &dummy)) {
    228			printk(KERN_INFO "Could not allocate IRQ %d for PCI Applicom device.\n", dev->irq);
    229			iounmap(RamIO);
    230			pci_disable_device(dev);
    231			apbs[boardno - 1].RamIO = NULL;
    232			continue;
    233		}
    234
    235		/* Enable interrupts. */
    236
    237		writeb(0x40, apbs[boardno - 1].RamIO + RAM_IT_FROM_PC);
    238
    239		apbs[boardno - 1].irq = dev->irq;
    240	}
    241
    242	/* Finished with PCI cards. If none registered, 
    243	 * and there was no mem/irq specified, exit */
    244
    245	if (!mem || !irq) {
    246		if (numboards)
    247			goto fin;
    248		else {
    249			printk(KERN_INFO "ac.o: No PCI boards found.\n");
    250			printk(KERN_INFO "ac.o: For an ISA board you must supply memory and irq parameters.\n");
    251			return -ENXIO;
    252		}
    253	}
    254
    255	/* Now try the specified ISA cards */
    256
    257	for (i = 0; i < MAX_ISA_BOARD; i++) {
    258		RamIO = ioremap(mem + (LEN_RAM_IO * i), LEN_RAM_IO);
    259
    260		if (!RamIO) {
    261			printk(KERN_INFO "ac.o: Failed to ioremap the ISA card's memory space (slot #%d)\n", i + 1);
    262			continue;
    263		}
    264
    265		if (!(boardno = ac_register_board((unsigned long)mem+ (LEN_RAM_IO*i),
    266						  RamIO,i+1))) {
    267			iounmap(RamIO);
    268			continue;
    269		}
    270
    271		printk(KERN_NOTICE "Applicom ISA card found at mem 0x%lx, irq %d\n", mem + (LEN_RAM_IO*i), irq);
    272
    273		if (!numisa) {
    274			if (request_irq(irq, &ac_interrupt, IRQF_SHARED, "Applicom ISA", &dummy)) {
    275				printk(KERN_WARNING "Could not allocate IRQ %d for ISA Applicom device.\n", irq);
    276				iounmap(RamIO);
    277				apbs[boardno - 1].RamIO = NULL;
    278			}
    279			else
    280				apbs[boardno - 1].irq = irq;
    281		}
    282		else
    283			apbs[boardno - 1].irq = 0;
    284
    285		numisa++;
    286	}
    287
    288	if (!numisa)
    289		printk(KERN_WARNING "ac.o: No valid ISA Applicom boards found "
    290				"at mem 0x%lx\n", mem);
    291
    292 fin:
    293	init_waitqueue_head(&FlagSleepRec);
    294
    295	WriteErrorCount = 0;
    296	ReadErrorCount = 0;
    297	DeviceErrorCount = 0;
    298
    299	if (numboards) {
    300		ret = misc_register(&ac_miscdev);
    301		if (ret) {
    302			printk(KERN_WARNING "ac.o: Unable to register misc device\n");
    303			goto out;
    304		}
    305		for (i = 0; i < MAX_BOARD; i++) {
    306			int serial;
    307			char boardname[(SERIAL_NUMBER - TYPE_CARD) + 1];
    308
    309			if (!apbs[i].RamIO)
    310				continue;
    311
    312			for (serial = 0; serial < SERIAL_NUMBER - TYPE_CARD; serial++)
    313				boardname[serial] = readb(apbs[i].RamIO + TYPE_CARD + serial);
    314
    315			boardname[serial] = 0;
    316
    317
    318			printk(KERN_INFO "Applicom board %d: %s, PROM V%d.%d",
    319			       i+1, boardname,
    320			       (int)(readb(apbs[i].RamIO + VERS) >> 4),
    321			       (int)(readb(apbs[i].RamIO + VERS) & 0xF));
    322			
    323			serial = (readb(apbs[i].RamIO + SERIAL_NUMBER) << 16) + 
    324				(readb(apbs[i].RamIO + SERIAL_NUMBER + 1) << 8) + 
    325				(readb(apbs[i].RamIO + SERIAL_NUMBER + 2) );
    326
    327			if (serial != 0)
    328				printk(" S/N %d\n", serial);
    329			else
    330				printk("\n");
    331		}
    332		return 0;
    333	}
    334
    335	else
    336		return -ENXIO;
    337
    338out:
    339	for (i = 0; i < MAX_BOARD; i++) {
    340		if (!apbs[i].RamIO)
    341			continue;
    342		if (apbs[i].irq)
    343			free_irq(apbs[i].irq, &dummy);
    344		iounmap(apbs[i].RamIO);
    345	}
    346	return ret;
    347}
    348
    349module_init(applicom_init);
    350module_exit(applicom_exit);
    351
    352
    353static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, loff_t * ppos)
    354{
    355	unsigned int NumCard;	/* Board number 1 -> 8           */
    356	unsigned int IndexCard;	/* Index board number 0 -> 7     */
    357	unsigned char TicCard;	/* Board TIC to send             */
    358	unsigned long flags;	/* Current priority              */
    359	struct st_ram_io st_loc;
    360	struct mailbox tmpmailbox;
    361#ifdef DEBUG
    362	int c;
    363#endif
    364	DECLARE_WAITQUEUE(wait, current);
    365
    366	if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) {
    367		static int warncount = 5;
    368		if (warncount) {
    369			printk(KERN_INFO "Hmmm. write() of Applicom card, length %zd != expected %zd\n",
    370			       count, sizeof(struct st_ram_io) + sizeof(struct mailbox));
    371			warncount--;
    372		}
    373		return -EINVAL;
    374	}
    375
    376	if(copy_from_user(&st_loc, buf, sizeof(struct st_ram_io))) 
    377		return -EFAULT;
    378	
    379	if(copy_from_user(&tmpmailbox, &buf[sizeof(struct st_ram_io)],
    380			  sizeof(struct mailbox))) 
    381		return -EFAULT;
    382
    383	NumCard = st_loc.num_card;	/* board number to send          */
    384	TicCard = st_loc.tic_des_from_pc;	/* tic number to send            */
    385	IndexCard = NumCard - 1;
    386
    387	if (IndexCard >= MAX_BOARD)
    388		return -EINVAL;
    389	IndexCard = array_index_nospec(IndexCard, MAX_BOARD);
    390
    391	if (!apbs[IndexCard].RamIO)
    392		return -EINVAL;
    393
    394#ifdef DEBUG
    395	printk("Write to applicom card #%d. struct st_ram_io follows:",
    396	       IndexCard+1);
    397
    398		for (c = 0; c < sizeof(struct st_ram_io);) {
    399		
    400			printk("\n%5.5X: %2.2X", c, ((unsigned char *) &st_loc)[c]);
    401
    402			for (c++; c % 8 && c < sizeof(struct st_ram_io); c++) {
    403				printk(" %2.2X", ((unsigned char *) &st_loc)[c]);
    404			}
    405		}
    406
    407		printk("\nstruct mailbox follows:");
    408
    409		for (c = 0; c < sizeof(struct mailbox);) {
    410			printk("\n%5.5X: %2.2X", c, ((unsigned char *) &tmpmailbox)[c]);
    411
    412			for (c++; c % 8 && c < sizeof(struct mailbox); c++) {
    413				printk(" %2.2X", ((unsigned char *) &tmpmailbox)[c]);
    414			}
    415		}
    416
    417		printk("\n");
    418#endif
    419
    420	spin_lock_irqsave(&apbs[IndexCard].mutex, flags);
    421
    422	/* Test octet ready correct */
    423	if(readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY) > 2) { 
    424		Dummy = readb(apbs[IndexCard].RamIO + VERS);
    425		spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
    426		printk(KERN_WARNING "APPLICOM driver write error board %d, DataFromPcReady = %d\n",
    427		       IndexCard,(int)readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY));
    428		DeviceErrorCount++;
    429		return -EIO;
    430	}
    431	
    432	/* Place ourselves on the wait queue */
    433	set_current_state(TASK_INTERRUPTIBLE);
    434	add_wait_queue(&apbs[IndexCard].FlagSleepSend, &wait);
    435
    436	/* Check whether the card is ready for us */
    437	while (readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY) != 0) {
    438		Dummy = readb(apbs[IndexCard].RamIO + VERS);
    439		/* It's busy. Sleep. */
    440
    441		spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
    442		schedule();
    443		if (signal_pending(current)) {
    444			remove_wait_queue(&apbs[IndexCard].FlagSleepSend,
    445					  &wait);
    446			return -EINTR;
    447		}
    448		spin_lock_irqsave(&apbs[IndexCard].mutex, flags);
    449		set_current_state(TASK_INTERRUPTIBLE);
    450	}
    451
    452	/* We may not have actually slept */
    453	set_current_state(TASK_RUNNING);
    454	remove_wait_queue(&apbs[IndexCard].FlagSleepSend, &wait);
    455
    456	writeb(1, apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
    457
    458	/* Which is best - lock down the pages with rawio and then
    459	   copy directly, or use bounce buffers? For now we do the latter 
    460	   because it works with 2.2 still */
    461	{
    462		unsigned char *from = (unsigned char *) &tmpmailbox;
    463		void __iomem *to = apbs[IndexCard].RamIO + RAM_FROM_PC;
    464		int c;
    465
    466		for (c = 0; c < sizeof(struct mailbox); c++)
    467			writeb(*(from++), to++);
    468	}
    469
    470	writeb(0x20, apbs[IndexCard].RamIO + TIC_OWNER_FROM_PC);
    471	writeb(0xff, apbs[IndexCard].RamIO + NUMCARD_OWNER_FROM_PC);
    472	writeb(TicCard, apbs[IndexCard].RamIO + TIC_DES_FROM_PC);
    473	writeb(NumCard, apbs[IndexCard].RamIO + NUMCARD_DES_FROM_PC);
    474	writeb(2, apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
    475	writeb(1, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
    476	Dummy = readb(apbs[IndexCard].RamIO + VERS);
    477	spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
    478	return 0;
    479}
    480
    481static int do_ac_read(int IndexCard, char __user *buf,
    482		struct st_ram_io *st_loc, struct mailbox *mailbox)
    483{
    484	void __iomem *from = apbs[IndexCard].RamIO + RAM_TO_PC;
    485	unsigned char *to = (unsigned char *)mailbox;
    486#ifdef DEBUG
    487	int c;
    488#endif
    489
    490	st_loc->tic_owner_to_pc = readb(apbs[IndexCard].RamIO + TIC_OWNER_TO_PC);
    491	st_loc->numcard_owner_to_pc = readb(apbs[IndexCard].RamIO + NUMCARD_OWNER_TO_PC);
    492
    493
    494	{
    495		int c;
    496
    497		for (c = 0; c < sizeof(struct mailbox); c++)
    498			*(to++) = readb(from++);
    499	}
    500	writeb(1, apbs[IndexCard].RamIO + ACK_FROM_PC_READY);
    501	writeb(1, apbs[IndexCard].RamIO + TYP_ACK_FROM_PC);
    502	writeb(IndexCard+1, apbs[IndexCard].RamIO + NUMCARD_ACK_FROM_PC);
    503	writeb(readb(apbs[IndexCard].RamIO + TIC_OWNER_TO_PC), 
    504	       apbs[IndexCard].RamIO + TIC_ACK_FROM_PC);
    505	writeb(2, apbs[IndexCard].RamIO + ACK_FROM_PC_READY);
    506	writeb(0, apbs[IndexCard].RamIO + DATA_TO_PC_READY);
    507	writeb(2, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
    508	Dummy = readb(apbs[IndexCard].RamIO + VERS);
    509
    510#ifdef DEBUG
    511		printk("Read from applicom card #%d. struct st_ram_io follows:", NumCard);
    512
    513		for (c = 0; c < sizeof(struct st_ram_io);) {
    514			printk("\n%5.5X: %2.2X", c, ((unsigned char *)st_loc)[c]);
    515
    516			for (c++; c % 8 && c < sizeof(struct st_ram_io); c++) {
    517				printk(" %2.2X", ((unsigned char *)st_loc)[c]);
    518			}
    519		}
    520
    521		printk("\nstruct mailbox follows:");
    522
    523		for (c = 0; c < sizeof(struct mailbox);) {
    524			printk("\n%5.5X: %2.2X", c, ((unsigned char *)mailbox)[c]);
    525
    526			for (c++; c % 8 && c < sizeof(struct mailbox); c++) {
    527				printk(" %2.2X", ((unsigned char *)mailbox)[c]);
    528			}
    529		}
    530		printk("\n");
    531#endif
    532	return (sizeof(struct st_ram_io) + sizeof(struct mailbox));
    533}
    534
    535static ssize_t ac_read (struct file *filp, char __user *buf, size_t count, loff_t *ptr)
    536{
    537	unsigned long flags;
    538	unsigned int i;
    539	unsigned char tmp;
    540	int ret = 0;
    541	DECLARE_WAITQUEUE(wait, current);
    542#ifdef DEBUG
    543	int loopcount=0;
    544#endif
    545	/* No need to ratelimit this. Only root can trigger it anyway */
    546	if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) {
    547		printk( KERN_WARNING "Hmmm. read() of Applicom card, length %zd != expected %zd\n",
    548			count,sizeof(struct st_ram_io) + sizeof(struct mailbox));
    549		return -EINVAL;
    550	}
    551	
    552	while(1) {
    553		/* Stick ourself on the wait queue */
    554		set_current_state(TASK_INTERRUPTIBLE);
    555		add_wait_queue(&FlagSleepRec, &wait);
    556		
    557		/* Scan each board, looking for one which has a packet for us */
    558		for (i=0; i < MAX_BOARD; i++) {
    559			if (!apbs[i].RamIO)
    560				continue;
    561			spin_lock_irqsave(&apbs[i].mutex, flags);
    562			
    563			tmp = readb(apbs[i].RamIO + DATA_TO_PC_READY);
    564			
    565			if (tmp == 2) {
    566				struct st_ram_io st_loc;
    567				struct mailbox mailbox;
    568
    569				/* Got a packet for us */
    570				memset(&st_loc, 0, sizeof(st_loc));
    571				ret = do_ac_read(i, buf, &st_loc, &mailbox);
    572				spin_unlock_irqrestore(&apbs[i].mutex, flags);
    573				set_current_state(TASK_RUNNING);
    574				remove_wait_queue(&FlagSleepRec, &wait);
    575
    576				if (copy_to_user(buf, &st_loc, sizeof(st_loc)))
    577					return -EFAULT;
    578				if (copy_to_user(buf + sizeof(st_loc), &mailbox, sizeof(mailbox)))
    579					return -EFAULT;
    580				return tmp;
    581			}
    582			
    583			if (tmp > 2) {
    584				/* Got an error */
    585				Dummy = readb(apbs[i].RamIO + VERS);
    586				
    587				spin_unlock_irqrestore(&apbs[i].mutex, flags);
    588				set_current_state(TASK_RUNNING);
    589				remove_wait_queue(&FlagSleepRec, &wait);
    590				
    591				printk(KERN_WARNING "APPLICOM driver read error board %d, DataToPcReady = %d\n",
    592				       i,(int)readb(apbs[i].RamIO + DATA_TO_PC_READY));
    593				DeviceErrorCount++;
    594				return -EIO;
    595			}
    596			
    597			/* Nothing for us. Try the next board */
    598			Dummy = readb(apbs[i].RamIO + VERS);
    599			spin_unlock_irqrestore(&apbs[i].mutex, flags);
    600			
    601		} /* per board */
    602
    603		/* OK - No boards had data for us. Sleep now */
    604
    605		schedule();
    606		remove_wait_queue(&FlagSleepRec, &wait);
    607
    608		if (signal_pending(current))
    609			return -EINTR;
    610
    611#ifdef DEBUG
    612		if (loopcount++ > 2) {
    613			printk(KERN_DEBUG "Looping in ac_read. loopcount %d\n", loopcount);
    614		}
    615#endif
    616	} 
    617}
    618
    619static irqreturn_t ac_interrupt(int vec, void *dev_instance)
    620{
    621	unsigned int i;
    622	unsigned int FlagInt;
    623	unsigned int LoopCount;
    624	int handled = 0;
    625
    626	//    printk("Applicom interrupt on IRQ %d occurred\n", vec);
    627
    628	LoopCount = 0;
    629
    630	do {
    631		FlagInt = 0;
    632		for (i = 0; i < MAX_BOARD; i++) {
    633			
    634			/* Skip if this board doesn't exist */
    635			if (!apbs[i].RamIO)
    636				continue;
    637
    638			spin_lock(&apbs[i].mutex);
    639
    640			/* Skip if this board doesn't want attention */
    641			if(readb(apbs[i].RamIO + RAM_IT_TO_PC) == 0) {
    642				spin_unlock(&apbs[i].mutex);
    643				continue;
    644			}
    645
    646			handled = 1;
    647			FlagInt = 1;
    648			writeb(0, apbs[i].RamIO + RAM_IT_TO_PC);
    649
    650			if (readb(apbs[i].RamIO + DATA_TO_PC_READY) > 2) {
    651				printk(KERN_WARNING "APPLICOM driver interrupt err board %d, DataToPcReady = %d\n",
    652				       i+1,(int)readb(apbs[i].RamIO + DATA_TO_PC_READY));
    653				DeviceErrorCount++;
    654			}
    655
    656			if((readb(apbs[i].RamIO + DATA_FROM_PC_READY) > 2) && 
    657			   (readb(apbs[i].RamIO + DATA_FROM_PC_READY) != 6)) {
    658				
    659				printk(KERN_WARNING "APPLICOM driver interrupt err board %d, DataFromPcReady = %d\n",
    660				       i+1,(int)readb(apbs[i].RamIO + DATA_FROM_PC_READY));
    661				DeviceErrorCount++;
    662			}
    663
    664			if (readb(apbs[i].RamIO + DATA_TO_PC_READY) == 2) {	/* mailbox sent by the card ?   */
    665				if (waitqueue_active(&FlagSleepRec)) {
    666				wake_up_interruptible(&FlagSleepRec);
    667			}
    668			}
    669
    670			if (readb(apbs[i].RamIO + DATA_FROM_PC_READY) == 0) {	/* ram i/o free for write by pc ? */
    671				if (waitqueue_active(&apbs[i].FlagSleepSend)) {	/* process sleep during read ?    */
    672					wake_up_interruptible(&apbs[i].FlagSleepSend);
    673				}
    674			}
    675			Dummy = readb(apbs[i].RamIO + VERS);
    676
    677			if(readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
    678				/* There's another int waiting on this card */
    679				spin_unlock(&apbs[i].mutex);
    680				i--;
    681			} else {
    682				spin_unlock(&apbs[i].mutex);
    683			}
    684		}
    685		if (FlagInt)
    686			LoopCount = 0;
    687		else
    688			LoopCount++;
    689	} while(LoopCount < 2);
    690	return IRQ_RETVAL(handled);
    691}
    692
    693
    694
    695static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
    696     
    697{				/* @ ADG ou ATO selon le cas */
    698	int i;
    699	unsigned char IndexCard;
    700	void __iomem *pmem;
    701	int ret = 0;
    702	static int warncount = 10;
    703	volatile unsigned char byte_reset_it;
    704	struct st_ram_io *adgl;
    705	void __user *argp = (void __user *)arg;
    706
    707	/* In general, the device is only openable by root anyway, so we're not
    708	   particularly concerned that bogus ioctls can flood the console. */
    709
    710	adgl = memdup_user(argp, sizeof(struct st_ram_io));
    711	if (IS_ERR(adgl))
    712		return PTR_ERR(adgl);
    713
    714	mutex_lock(&ac_mutex);	
    715	IndexCard = adgl->num_card-1;
    716	 
    717	if (cmd != 6 && IndexCard >= MAX_BOARD)
    718		goto err;
    719	IndexCard = array_index_nospec(IndexCard, MAX_BOARD);
    720
    721	if (cmd != 6 && !apbs[IndexCard].RamIO)
    722		goto err;
    723
    724	switch (cmd) {
    725		
    726	case 0:
    727		pmem = apbs[IndexCard].RamIO;
    728		for (i = 0; i < sizeof(struct st_ram_io); i++)
    729			((unsigned char *)adgl)[i]=readb(pmem++);
    730		if (copy_to_user(argp, adgl, sizeof(struct st_ram_io)))
    731			ret = -EFAULT;
    732		break;
    733	case 1:
    734		pmem = apbs[IndexCard].RamIO + CONF_END_TEST;
    735		for (i = 0; i < 4; i++)
    736			adgl->conf_end_test[i] = readb(pmem++);
    737		for (i = 0; i < 2; i++)
    738			adgl->error_code[i] = readb(pmem++);
    739		for (i = 0; i < 4; i++)
    740			adgl->parameter_error[i] = readb(pmem++);
    741		pmem = apbs[IndexCard].RamIO + VERS;
    742		adgl->vers = readb(pmem);
    743		pmem = apbs[IndexCard].RamIO + TYPE_CARD;
    744		for (i = 0; i < 20; i++)
    745			adgl->reserv1[i] = readb(pmem++);
    746		*(int *)&adgl->reserv1[20] =  
    747			(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER) << 16) + 
    748			(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER + 1) << 8) + 
    749			(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER + 2) );
    750
    751		if (copy_to_user(argp, adgl, sizeof(struct st_ram_io)))
    752			ret = -EFAULT;
    753		break;
    754	case 2:
    755		pmem = apbs[IndexCard].RamIO + CONF_END_TEST;
    756		for (i = 0; i < 10; i++)
    757			writeb(0xff, pmem++);
    758		writeb(adgl->data_from_pc_ready, 
    759		       apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
    760
    761		writeb(1, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
    762		
    763		for (i = 0; i < MAX_BOARD; i++) {
    764			if (apbs[i].RamIO) {
    765				byte_reset_it = readb(apbs[i].RamIO + RAM_IT_TO_PC);
    766			}
    767		}
    768		break;
    769	case 3:
    770		pmem = apbs[IndexCard].RamIO + TIC_DES_FROM_PC;
    771		writeb(adgl->tic_des_from_pc, pmem);
    772		break;
    773	case 4:
    774		pmem = apbs[IndexCard].RamIO + TIC_OWNER_TO_PC;
    775		adgl->tic_owner_to_pc     = readb(pmem++);
    776		adgl->numcard_owner_to_pc = readb(pmem);
    777		if (copy_to_user(argp, adgl,sizeof(struct st_ram_io)))
    778			ret = -EFAULT;
    779		break;
    780	case 5:
    781		writeb(adgl->num_card, apbs[IndexCard].RamIO + NUMCARD_OWNER_TO_PC);
    782		writeb(adgl->num_card, apbs[IndexCard].RamIO + NUMCARD_DES_FROM_PC);
    783		writeb(adgl->num_card, apbs[IndexCard].RamIO + NUMCARD_ACK_FROM_PC);
    784		writeb(4, apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
    785		writeb(1, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
    786		break;
    787	case 6:
    788		printk(KERN_INFO "APPLICOM driver release .... V2.8.0 ($Revision: 1.30 $)\n");
    789		printk(KERN_INFO "Number of installed boards . %d\n", (int) numboards);
    790		printk(KERN_INFO "Segment of board ........... %X\n", (int) mem);
    791		printk(KERN_INFO "Interrupt IRQ number ....... %d\n", (int) irq);
    792		for (i = 0; i < MAX_BOARD; i++) {
    793			int serial;
    794			char boardname[(SERIAL_NUMBER - TYPE_CARD) + 1];
    795
    796			if (!apbs[i].RamIO)
    797				continue;
    798
    799			for (serial = 0; serial < SERIAL_NUMBER - TYPE_CARD; serial++)
    800				boardname[serial] = readb(apbs[i].RamIO + TYPE_CARD + serial);
    801			boardname[serial] = 0;
    802
    803			printk(KERN_INFO "Prom version board %d ....... V%d.%d %s",
    804			       i+1,
    805			       (int)(readb(apbs[i].RamIO + VERS) >> 4),
    806			       (int)(readb(apbs[i].RamIO + VERS) & 0xF),
    807			       boardname);
    808
    809
    810			serial = (readb(apbs[i].RamIO + SERIAL_NUMBER) << 16) + 
    811				(readb(apbs[i].RamIO + SERIAL_NUMBER + 1) << 8) + 
    812				(readb(apbs[i].RamIO + SERIAL_NUMBER + 2) );
    813
    814			if (serial != 0)
    815				printk(" S/N %d\n", serial);
    816			else
    817				printk("\n");
    818		}
    819		if (DeviceErrorCount != 0)
    820			printk(KERN_INFO "DeviceErrorCount ........... %d\n", DeviceErrorCount);
    821		if (ReadErrorCount != 0)
    822			printk(KERN_INFO "ReadErrorCount ............. %d\n", ReadErrorCount);
    823		if (WriteErrorCount != 0)
    824			printk(KERN_INFO "WriteErrorCount ............ %d\n", WriteErrorCount);
    825		if (waitqueue_active(&FlagSleepRec))
    826			printk(KERN_INFO "Process in read pending\n");
    827		for (i = 0; i < MAX_BOARD; i++) {
    828			if (apbs[i].RamIO && waitqueue_active(&apbs[i].FlagSleepSend))
    829				printk(KERN_INFO "Process in write pending board %d\n",i+1);
    830		}
    831		break;
    832	default:
    833		ret = -ENOTTY;
    834		break;
    835	}
    836	Dummy = readb(apbs[IndexCard].RamIO + VERS);
    837	kfree(adgl);
    838	mutex_unlock(&ac_mutex);
    839	return ret;
    840
    841err:
    842	if (warncount) {
    843		pr_warn("APPLICOM driver IOCTL, bad board number %d\n",
    844			(int)IndexCard + 1);
    845		warncount--;
    846	}
    847	kfree(adgl);
    848	mutex_unlock(&ac_mutex);
    849	return -EINVAL;
    850
    851}
    852