cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

cm4000_cs.c (49037B)


      1 /*
      2  * A driver for the PCMCIA Smartcard Reader "Omnikey CardMan Mobile 4000"
      3  *
      4  * cm4000_cs.c support.linux@omnikey.com
      5  *
      6  * Tue Oct 23 11:32:43 GMT 2001 herp - cleaned up header files
      7  * Sun Jan 20 10:11:15 MET 2002 herp - added modversion header files
      8  * Thu Nov 14 16:34:11 GMT 2002 mh   - added PPS functionality
      9  * Tue Nov 19 16:36:27 GMT 2002 mh   - added SUSPEND/RESUME functionailty
     10  * Wed Jul 28 12:55:01 CEST 2004 mh  - kernel 2.6 adjustments
     11  *
     12  * current version: 2.4.0gm4
     13  *
     14  * (C) 2000,2001,2002,2003,2004 Omnikey AG
     15  *
     16  * (C) 2005-2006 Harald Welte <laforge@gnumonks.org>
     17  * 	- Adhere to Kernel process/coding-style.rst
     18  * 	- Port to 2.6.13 "new" style PCMCIA
     19  * 	- Check for copy_{from,to}_user return values
     20  * 	- Use nonseekable_open()
     21  * 	- add class interface for udev device creation
     22  *
     23  * All rights reserved. Licensed under dual BSD/GPL license.
     24  */
     25
     26#include <linux/kernel.h>
     27#include <linux/module.h>
     28#include <linux/slab.h>
     29#include <linux/init.h>
     30#include <linux/fs.h>
     31#include <linux/delay.h>
     32#include <linux/bitrev.h>
     33#include <linux/mutex.h>
     34#include <linux/uaccess.h>
     35#include <linux/io.h>
     36
     37#include <pcmcia/cistpl.h>
     38#include <pcmcia/cisreg.h>
     39#include <pcmcia/ciscode.h>
     40#include <pcmcia/ds.h>
     41
     42#include <linux/cm4000_cs.h>
     43
     44/* #define ATR_CSUM */
     45
     46#define reader_to_dev(x)	(&x->p_dev->dev)
     47
     48/* n (debug level) is ignored */
     49/* additional debug output may be enabled by re-compiling with
     50 * CM4000_DEBUG set */
     51/* #define CM4000_DEBUG */
     52#define DEBUGP(n, rdr, x, args...) do { 		\
     53		dev_dbg(reader_to_dev(rdr), "%s:" x, 	\
     54			   __func__ , ## args);		\
     55	} while (0)
     56
     57static DEFINE_MUTEX(cmm_mutex);
     58
     59#define	T_1SEC		(HZ)
     60#define	T_10MSEC	msecs_to_jiffies(10)
     61#define	T_20MSEC	msecs_to_jiffies(20)
     62#define	T_40MSEC	msecs_to_jiffies(40)
     63#define	T_50MSEC	msecs_to_jiffies(50)
     64#define	T_100MSEC	msecs_to_jiffies(100)
     65#define	T_500MSEC	msecs_to_jiffies(500)
     66
     67static void cm4000_release(struct pcmcia_device *link);
     68
     69static int major;		/* major number we get from the kernel */
     70
     71/* note: the first state has to have number 0 always */
     72
     73#define	M_FETCH_ATR	0
     74#define	M_TIMEOUT_WAIT	1
     75#define	M_READ_ATR_LEN	2
     76#define	M_READ_ATR	3
     77#define	M_ATR_PRESENT	4
     78#define	M_BAD_CARD	5
     79#define M_CARDOFF	6
     80
     81#define	LOCK_IO			0
     82#define	LOCK_MONITOR		1
     83
     84#define IS_AUTOPPS_ACT		 6
     85#define	IS_PROCBYTE_PRESENT	 7
     86#define	IS_INVREV		 8
     87#define IS_ANY_T0		 9
     88#define	IS_ANY_T1		10
     89#define	IS_ATR_PRESENT		11
     90#define	IS_ATR_VALID		12
     91#define	IS_CMM_ABSENT		13
     92#define	IS_BAD_LENGTH		14
     93#define	IS_BAD_CSUM		15
     94#define	IS_BAD_CARD		16
     95
     96#define REG_FLAGS0(x)		(x + 0)
     97#define REG_FLAGS1(x)		(x + 1)
     98#define REG_NUM_BYTES(x)	(x + 2)
     99#define REG_BUF_ADDR(x)		(x + 3)
    100#define REG_BUF_DATA(x)		(x + 4)
    101#define REG_NUM_SEND(x)		(x + 5)
    102#define REG_BAUDRATE(x)		(x + 6)
    103#define REG_STOPBITS(x)		(x + 7)
    104
    105struct cm4000_dev {
    106	struct pcmcia_device *p_dev;
    107
    108	unsigned char atr[MAX_ATR];
    109	unsigned char rbuf[512];
    110	unsigned char sbuf[512];
    111
    112	wait_queue_head_t devq;		/* when removing cardman must not be
    113					   zeroed! */
    114
    115	wait_queue_head_t ioq;		/* if IO is locked, wait on this Q */
    116	wait_queue_head_t atrq;		/* wait for ATR valid */
    117	wait_queue_head_t readq;	/* used by write to wake blk.read */
    118
    119	/* warning: do not move this struct group.
    120	 * initialising to zero depends on it - see ZERO_DEV below.  */
    121	struct_group(init,
    122	unsigned char atr_csum;
    123	unsigned char atr_len_retry;
    124	unsigned short atr_len;
    125	unsigned short rlen;	/* bytes avail. after write */
    126	unsigned short rpos;	/* latest read pos. write zeroes */
    127	unsigned char procbyte;	/* T=0 procedure byte */
    128	unsigned char mstate;	/* state of card monitor */
    129	unsigned char cwarn;	/* slow down warning */
    130	unsigned char flags0;	/* cardman IO-flags 0 */
    131	unsigned char flags1;	/* cardman IO-flags 1 */
    132	unsigned int mdelay;	/* variable monitor speeds, in jiffies */
    133
    134	unsigned int baudv;	/* baud value for speed */
    135	unsigned char ta1;
    136	unsigned char proto;	/* T=0, T=1, ... */
    137	unsigned long flags;	/* lock+flags (MONITOR,IO,ATR) * for concurrent
    138				   access */
    139
    140	unsigned char pts[4];
    141
    142	struct timer_list timer;	/* used to keep monitor running */
    143	int monitor_running;
    144	);
    145};
    146
    147#define	ZERO_DEV(dev)	memset(&((dev)->init), 0, sizeof((dev)->init))
    148
    149static struct pcmcia_device *dev_table[CM4000_MAX_DEV];
    150static struct class *cmm_class;
    151
    152/* This table doesn't use spaces after the comma between fields and thus
    153 * violates process/coding-style.rst.  However, I don't really think wrapping it around will
    154 * make it any clearer to read -HW */
    155static unsigned char fi_di_table[10][14] = {
    156/*FI     00   01   02   03   04   05   06   07   08   09   10   11   12   13 */
    157/*DI */
    158/* 0 */ {0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11},
    159/* 1 */ {0x01,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x91,0x11,0x11,0x11,0x11},
    160/* 2 */ {0x02,0x12,0x22,0x32,0x11,0x11,0x11,0x11,0x11,0x92,0xA2,0xB2,0x11,0x11},
    161/* 3 */ {0x03,0x13,0x23,0x33,0x43,0x53,0x63,0x11,0x11,0x93,0xA3,0xB3,0xC3,0xD3},
    162/* 4 */ {0x04,0x14,0x24,0x34,0x44,0x54,0x64,0x11,0x11,0x94,0xA4,0xB4,0xC4,0xD4},
    163/* 5 */ {0x00,0x15,0x25,0x35,0x45,0x55,0x65,0x11,0x11,0x95,0xA5,0xB5,0xC5,0xD5},
    164/* 6 */ {0x06,0x16,0x26,0x36,0x46,0x56,0x66,0x11,0x11,0x96,0xA6,0xB6,0xC6,0xD6},
    165/* 7 */ {0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11},
    166/* 8 */ {0x08,0x11,0x28,0x38,0x48,0x58,0x68,0x11,0x11,0x98,0xA8,0xB8,0xC8,0xD8},
    167/* 9 */ {0x09,0x19,0x29,0x39,0x49,0x59,0x69,0x11,0x11,0x99,0xA9,0xB9,0xC9,0xD9}
    168};
    169
    170#ifndef CM4000_DEBUG
    171#define	xoutb	outb
    172#define	xinb	inb
    173#else
    174static inline void xoutb(unsigned char val, unsigned short port)
    175{
    176	pr_debug("outb(val=%.2x,port=%.4x)\n", val, port);
    177	outb(val, port);
    178}
    179static inline unsigned char xinb(unsigned short port)
    180{
    181	unsigned char val;
    182
    183	val = inb(port);
    184	pr_debug("%.2x=inb(%.4x)\n", val, port);
    185
    186	return val;
    187}
    188#endif
    189
    190static inline unsigned char invert_revert(unsigned char ch)
    191{
    192	return bitrev8(~ch);
    193}
    194
    195static void str_invert_revert(unsigned char *b, int len)
    196{
    197	int i;
    198
    199	for (i = 0; i < len; i++)
    200		b[i] = invert_revert(b[i]);
    201}
    202
    203#define	ATRLENCK(dev,pos) \
    204	if (pos>=dev->atr_len || pos>=MAX_ATR) \
    205		goto return_0;
    206
    207static unsigned int calc_baudv(unsigned char fidi)
    208{
    209	unsigned int wcrcf, wbrcf, fi_rfu, di_rfu;
    210
    211	fi_rfu = 372;
    212	di_rfu = 1;
    213
    214	/* FI */
    215	switch ((fidi >> 4) & 0x0F) {
    216	case 0x00:
    217		wcrcf = 372;
    218		break;
    219	case 0x01:
    220		wcrcf = 372;
    221		break;
    222	case 0x02:
    223		wcrcf = 558;
    224		break;
    225	case 0x03:
    226		wcrcf = 744;
    227		break;
    228	case 0x04:
    229		wcrcf = 1116;
    230		break;
    231	case 0x05:
    232		wcrcf = 1488;
    233		break;
    234	case 0x06:
    235		wcrcf = 1860;
    236		break;
    237	case 0x07:
    238		wcrcf = fi_rfu;
    239		break;
    240	case 0x08:
    241		wcrcf = fi_rfu;
    242		break;
    243	case 0x09:
    244		wcrcf = 512;
    245		break;
    246	case 0x0A:
    247		wcrcf = 768;
    248		break;
    249	case 0x0B:
    250		wcrcf = 1024;
    251		break;
    252	case 0x0C:
    253		wcrcf = 1536;
    254		break;
    255	case 0x0D:
    256		wcrcf = 2048;
    257		break;
    258	default:
    259		wcrcf = fi_rfu;
    260		break;
    261	}
    262
    263	/* DI */
    264	switch (fidi & 0x0F) {
    265	case 0x00:
    266		wbrcf = di_rfu;
    267		break;
    268	case 0x01:
    269		wbrcf = 1;
    270		break;
    271	case 0x02:
    272		wbrcf = 2;
    273		break;
    274	case 0x03:
    275		wbrcf = 4;
    276		break;
    277	case 0x04:
    278		wbrcf = 8;
    279		break;
    280	case 0x05:
    281		wbrcf = 16;
    282		break;
    283	case 0x06:
    284		wbrcf = 32;
    285		break;
    286	case 0x07:
    287		wbrcf = di_rfu;
    288		break;
    289	case 0x08:
    290		wbrcf = 12;
    291		break;
    292	case 0x09:
    293		wbrcf = 20;
    294		break;
    295	default:
    296		wbrcf = di_rfu;
    297		break;
    298	}
    299
    300	return (wcrcf / wbrcf);
    301}
    302
    303static unsigned short io_read_num_rec_bytes(unsigned int iobase,
    304					    unsigned short *s)
    305{
    306	unsigned short tmp;
    307
    308	tmp = *s = 0;
    309	do {
    310		*s = tmp;
    311		tmp = inb(REG_NUM_BYTES(iobase)) |
    312				(inb(REG_FLAGS0(iobase)) & 4 ? 0x100 : 0);
    313	} while (tmp != *s);
    314
    315	return *s;
    316}
    317
    318static int parse_atr(struct cm4000_dev *dev)
    319{
    320	unsigned char any_t1, any_t0;
    321	unsigned char ch, ifno;
    322	int ix, done;
    323
    324	DEBUGP(3, dev, "-> parse_atr: dev->atr_len = %i\n", dev->atr_len);
    325
    326	if (dev->atr_len < 3) {
    327		DEBUGP(5, dev, "parse_atr: atr_len < 3\n");
    328		return 0;
    329	}
    330
    331	if (dev->atr[0] == 0x3f)
    332		set_bit(IS_INVREV, &dev->flags);
    333	else
    334		clear_bit(IS_INVREV, &dev->flags);
    335	ix = 1;
    336	ifno = 1;
    337	ch = dev->atr[1];
    338	dev->proto = 0;		/* XXX PROTO */
    339	any_t1 = any_t0 = done = 0;
    340	dev->ta1 = 0x11;	/* defaults to 9600 baud */
    341	do {
    342		if (ifno == 1 && (ch & 0x10)) {
    343			/* read first interface byte and TA1 is present */
    344			dev->ta1 = dev->atr[2];
    345			DEBUGP(5, dev, "Card says FiDi is 0x%.2x\n", dev->ta1);
    346			ifno++;
    347		} else if ((ifno == 2) && (ch & 0x10)) { /* TA(2) */
    348			dev->ta1 = 0x11;
    349			ifno++;
    350		}
    351
    352		DEBUGP(5, dev, "Yi=%.2x\n", ch & 0xf0);
    353		ix += ((ch & 0x10) >> 4)	/* no of int.face chars */
    354		    +((ch & 0x20) >> 5)
    355		    + ((ch & 0x40) >> 6)
    356		    + ((ch & 0x80) >> 7);
    357		/* ATRLENCK(dev,ix); */
    358		if (ch & 0x80) {	/* TDi */
    359			ch = dev->atr[ix];
    360			if ((ch & 0x0f)) {
    361				any_t1 = 1;
    362				DEBUGP(5, dev, "card is capable of T=1\n");
    363			} else {
    364				any_t0 = 1;
    365				DEBUGP(5, dev, "card is capable of T=0\n");
    366			}
    367		} else
    368			done = 1;
    369	} while (!done);
    370
    371	DEBUGP(5, dev, "ix=%d noHist=%d any_t1=%d\n",
    372	      ix, dev->atr[1] & 15, any_t1);
    373	if (ix + 1 + (dev->atr[1] & 0x0f) + any_t1 != dev->atr_len) {
    374		DEBUGP(5, dev, "length error\n");
    375		return 0;
    376	}
    377	if (any_t0)
    378		set_bit(IS_ANY_T0, &dev->flags);
    379
    380	if (any_t1) {		/* compute csum */
    381		dev->atr_csum = 0;
    382#ifdef ATR_CSUM
    383		for (i = 1; i < dev->atr_len; i++)
    384			dev->atr_csum ^= dev->atr[i];
    385		if (dev->atr_csum) {
    386			set_bit(IS_BAD_CSUM, &dev->flags);
    387			DEBUGP(5, dev, "bad checksum\n");
    388			goto return_0;
    389		}
    390#endif
    391		if (any_t0 == 0)
    392			dev->proto = 1;	/* XXX PROTO */
    393		set_bit(IS_ANY_T1, &dev->flags);
    394	}
    395
    396	return 1;
    397}
    398
    399struct card_fixup {
    400	char atr[12];
    401	u_int8_t atr_len;
    402	u_int8_t stopbits;
    403};
    404
    405static struct card_fixup card_fixups[] = {
    406	{	/* ACOS */
    407		.atr = { 0x3b, 0xb3, 0x11, 0x00, 0x00, 0x41, 0x01 },
    408		.atr_len = 7,
    409		.stopbits = 0x03,
    410	},
    411	{	/* Motorola */
    412		.atr = {0x3b, 0x76, 0x13, 0x00, 0x00, 0x80, 0x62, 0x07,
    413			0x41, 0x81, 0x81 },
    414		.atr_len = 11,
    415		.stopbits = 0x04,
    416	},
    417};
    418
    419static void set_cardparameter(struct cm4000_dev *dev)
    420{
    421	int i;
    422	unsigned int iobase = dev->p_dev->resource[0]->start;
    423	u_int8_t stopbits = 0x02; /* ISO default */
    424
    425	DEBUGP(3, dev, "-> set_cardparameter\n");
    426
    427	dev->flags1 = dev->flags1 | (((dev->baudv - 1) & 0x0100) >> 8);
    428	xoutb(dev->flags1, REG_FLAGS1(iobase));
    429	DEBUGP(5, dev, "flags1 = 0x%02x\n", dev->flags1);
    430
    431	/* set baudrate */
    432	xoutb((unsigned char)((dev->baudv - 1) & 0xFF), REG_BAUDRATE(iobase));
    433
    434	DEBUGP(5, dev, "baudv = %i -> write 0x%02x\n", dev->baudv,
    435	      ((dev->baudv - 1) & 0xFF));
    436
    437	/* set stopbits */
    438	for (i = 0; i < ARRAY_SIZE(card_fixups); i++) {
    439		if (!memcmp(dev->atr, card_fixups[i].atr,
    440			    card_fixups[i].atr_len))
    441			stopbits = card_fixups[i].stopbits;
    442	}
    443	xoutb(stopbits, REG_STOPBITS(iobase));
    444
    445	DEBUGP(3, dev, "<- set_cardparameter\n");
    446}
    447
    448static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
    449{
    450
    451	unsigned long tmp, i;
    452	unsigned short num_bytes_read;
    453	unsigned char pts_reply[4];
    454	ssize_t rc;
    455	unsigned int iobase = dev->p_dev->resource[0]->start;
    456
    457	rc = 0;
    458
    459	DEBUGP(3, dev, "-> set_protocol\n");
    460	DEBUGP(5, dev, "ptsreq->Protocol = 0x%.8x, ptsreq->Flags=0x%.8x, "
    461		 "ptsreq->pts1=0x%.2x, ptsreq->pts2=0x%.2x, "
    462		 "ptsreq->pts3=0x%.2x\n", (unsigned int)ptsreq->protocol,
    463		 (unsigned int)ptsreq->flags, ptsreq->pts1, ptsreq->pts2,
    464		 ptsreq->pts3);
    465
    466	/* Fill PTS structure */
    467	dev->pts[0] = 0xff;
    468	dev->pts[1] = 0x00;
    469	tmp = ptsreq->protocol;
    470	while ((tmp = (tmp >> 1)) > 0)
    471		dev->pts[1]++;
    472	dev->proto = dev->pts[1];	/* Set new protocol */
    473	dev->pts[1] = (0x01 << 4) | (dev->pts[1]);
    474
    475	/* Correct Fi/Di according to CM4000 Fi/Di table */
    476	DEBUGP(5, dev, "Ta(1) from ATR is 0x%.2x\n", dev->ta1);
    477	/* set Fi/Di according to ATR TA(1) */
    478	dev->pts[2] = fi_di_table[dev->ta1 & 0x0F][(dev->ta1 >> 4) & 0x0F];
    479
    480	/* Calculate PCK character */
    481	dev->pts[3] = dev->pts[0] ^ dev->pts[1] ^ dev->pts[2];
    482
    483	DEBUGP(5, dev, "pts0=%.2x, pts1=%.2x, pts2=%.2x, pts3=%.2x\n",
    484	       dev->pts[0], dev->pts[1], dev->pts[2], dev->pts[3]);
    485
    486	/* check card convention */
    487	if (test_bit(IS_INVREV, &dev->flags))
    488		str_invert_revert(dev->pts, 4);
    489
    490	/* reset SM */
    491	xoutb(0x80, REG_FLAGS0(iobase));
    492
    493	/* Enable access to the message buffer */
    494	DEBUGP(5, dev, "Enable access to the messages buffer\n");
    495	dev->flags1 = 0x20	/* T_Active */
    496	    | (test_bit(IS_INVREV, &dev->flags) ? 0x02 : 0x00) /* inv parity */
    497	    | ((dev->baudv >> 8) & 0x01);	/* MSB-baud */
    498	xoutb(dev->flags1, REG_FLAGS1(iobase));
    499
    500	DEBUGP(5, dev, "Enable message buffer -> flags1 = 0x%.2x\n",
    501	       dev->flags1);
    502
    503	/* write challenge to the buffer */
    504	DEBUGP(5, dev, "Write challenge to buffer: ");
    505	for (i = 0; i < 4; i++) {
    506		xoutb(i, REG_BUF_ADDR(iobase));
    507		xoutb(dev->pts[i], REG_BUF_DATA(iobase));	/* buf data */
    508#ifdef CM4000_DEBUG
    509		pr_debug("0x%.2x ", dev->pts[i]);
    510	}
    511	pr_debug("\n");
    512#else
    513	}
    514#endif
    515
    516	/* set number of bytes to write */
    517	DEBUGP(5, dev, "Set number of bytes to write\n");
    518	xoutb(0x04, REG_NUM_SEND(iobase));
    519
    520	/* Trigger CARDMAN CONTROLLER */
    521	xoutb(0x50, REG_FLAGS0(iobase));
    522
    523	/* Monitor progress */
    524	/* wait for xmit done */
    525	DEBUGP(5, dev, "Waiting for NumRecBytes getting valid\n");
    526
    527	for (i = 0; i < 100; i++) {
    528		if (inb(REG_FLAGS0(iobase)) & 0x08) {
    529			DEBUGP(5, dev, "NumRecBytes is valid\n");
    530			break;
    531		}
    532		usleep_range(10000, 11000);
    533	}
    534	if (i == 100) {
    535		DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting "
    536		       "valid\n");
    537		rc = -EIO;
    538		goto exit_setprotocol;
    539	}
    540
    541	DEBUGP(5, dev, "Reading NumRecBytes\n");
    542	for (i = 0; i < 100; i++) {
    543		io_read_num_rec_bytes(iobase, &num_bytes_read);
    544		if (num_bytes_read >= 4) {
    545			DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read);
    546			if (num_bytes_read > 4) {
    547				rc = -EIO;
    548				goto exit_setprotocol;
    549			}
    550			break;
    551		}
    552		usleep_range(10000, 11000);
    553	}
    554
    555	/* check whether it is a short PTS reply? */
    556	if (num_bytes_read == 3)
    557		i = 0;
    558
    559	if (i == 100) {
    560		DEBUGP(5, dev, "Timeout reading num_bytes_read\n");
    561		rc = -EIO;
    562		goto exit_setprotocol;
    563	}
    564
    565	DEBUGP(5, dev, "Reset the CARDMAN CONTROLLER\n");
    566	xoutb(0x80, REG_FLAGS0(iobase));
    567
    568	/* Read PPS reply */
    569	DEBUGP(5, dev, "Read PPS reply\n");
    570	for (i = 0; i < num_bytes_read; i++) {
    571		xoutb(i, REG_BUF_ADDR(iobase));
    572		pts_reply[i] = inb(REG_BUF_DATA(iobase));
    573	}
    574
    575#ifdef CM4000_DEBUG
    576	DEBUGP(2, dev, "PTSreply: ");
    577	for (i = 0; i < num_bytes_read; i++) {
    578		pr_debug("0x%.2x ", pts_reply[i]);
    579	}
    580	pr_debug("\n");
    581#endif	/* CM4000_DEBUG */
    582
    583	DEBUGP(5, dev, "Clear Tactive in Flags1\n");
    584	xoutb(0x20, REG_FLAGS1(iobase));
    585
    586	/* Compare ptsreq and ptsreply */
    587	if ((dev->pts[0] == pts_reply[0]) &&
    588	    (dev->pts[1] == pts_reply[1]) &&
    589	    (dev->pts[2] == pts_reply[2]) && (dev->pts[3] == pts_reply[3])) {
    590		/* setcardparameter according to PPS */
    591		dev->baudv = calc_baudv(dev->pts[2]);
    592		set_cardparameter(dev);
    593	} else if ((dev->pts[0] == pts_reply[0]) &&
    594		   ((dev->pts[1] & 0xef) == pts_reply[1]) &&
    595		   ((pts_reply[0] ^ pts_reply[1]) == pts_reply[2])) {
    596		/* short PTS reply, set card parameter to default values */
    597		dev->baudv = calc_baudv(0x11);
    598		set_cardparameter(dev);
    599	} else
    600		rc = -EIO;
    601
    602exit_setprotocol:
    603	DEBUGP(3, dev, "<- set_protocol\n");
    604	return rc;
    605}
    606
    607static int io_detect_cm4000(unsigned int iobase, struct cm4000_dev *dev)
    608{
    609
    610	/* note: statemachine is assumed to be reset */
    611	if (inb(REG_FLAGS0(iobase)) & 8) {
    612		clear_bit(IS_ATR_VALID, &dev->flags);
    613		set_bit(IS_CMM_ABSENT, &dev->flags);
    614		return 0;	/* detect CMM = 1 -> failure */
    615	}
    616	/* xoutb(0x40, REG_FLAGS1(iobase)); detectCMM */
    617	xoutb(dev->flags1 | 0x40, REG_FLAGS1(iobase));
    618	if ((inb(REG_FLAGS0(iobase)) & 8) == 0) {
    619		clear_bit(IS_ATR_VALID, &dev->flags);
    620		set_bit(IS_CMM_ABSENT, &dev->flags);
    621		return 0;	/* detect CMM=0 -> failure */
    622	}
    623	/* clear detectCMM again by restoring original flags1 */
    624	xoutb(dev->flags1, REG_FLAGS1(iobase));
    625	return 1;
    626}
    627
    628static void terminate_monitor(struct cm4000_dev *dev)
    629{
    630
    631	/* tell the monitor to stop and wait until
    632	 * it terminates.
    633	 */
    634	DEBUGP(3, dev, "-> terminate_monitor\n");
    635	wait_event_interruptible(dev->devq,
    636				 test_and_set_bit(LOCK_MONITOR,
    637						  (void *)&dev->flags));
    638
    639	/* now, LOCK_MONITOR has been set.
    640	 * allow a last cycle in the monitor.
    641	 * the monitor will indicate that it has
    642	 * finished by clearing this bit.
    643	 */
    644	DEBUGP(5, dev, "Now allow last cycle of monitor!\n");
    645	while (test_bit(LOCK_MONITOR, (void *)&dev->flags))
    646		msleep(25);
    647
    648	DEBUGP(5, dev, "Delete timer\n");
    649	del_timer_sync(&dev->timer);
    650#ifdef CM4000_DEBUG
    651	dev->monitor_running = 0;
    652#endif
    653
    654	DEBUGP(3, dev, "<- terminate_monitor\n");
    655}
    656
    657/*
    658 * monitor the card every 50msec. as a side-effect, retrieve the
    659 * atr once a card is inserted. another side-effect of retrieving the
    660 * atr is that the card will be powered on, so there is no need to
    661 * power on the card explicitly from the application: the driver
    662 * is already doing that for you.
    663 */
    664
    665static void monitor_card(struct timer_list *t)
    666{
    667	struct cm4000_dev *dev = from_timer(dev, t, timer);
    668	unsigned int iobase = dev->p_dev->resource[0]->start;
    669	unsigned short s;
    670	struct ptsreq ptsreq;
    671	int i, atrc;
    672
    673	DEBUGP(7, dev, "->  monitor_card\n");
    674
    675	/* if someone has set the lock for us: we're done! */
    676	if (test_and_set_bit(LOCK_MONITOR, &dev->flags)) {
    677		DEBUGP(4, dev, "About to stop monitor\n");
    678		/* no */
    679		dev->rlen =
    680		    dev->rpos =
    681		    dev->atr_csum = dev->atr_len_retry = dev->cwarn = 0;
    682		dev->mstate = M_FETCH_ATR;
    683		clear_bit(LOCK_MONITOR, &dev->flags);
    684		/* close et al. are sleeping on devq, so wake it */
    685		wake_up_interruptible(&dev->devq);
    686		DEBUGP(2, dev, "<- monitor_card (we are done now)\n");
    687		return;
    688	}
    689
    690	/* try to lock io: if it is already locked, just add another timer */
    691	if (test_and_set_bit(LOCK_IO, (void *)&dev->flags)) {
    692		DEBUGP(4, dev, "Couldn't get IO lock\n");
    693		goto return_with_timer;
    694	}
    695
    696	/* is a card/a reader inserted at all ? */
    697	dev->flags0 = xinb(REG_FLAGS0(iobase));
    698	DEBUGP(7, dev, "dev->flags0 = 0x%2x\n", dev->flags0);
    699	DEBUGP(7, dev, "smartcard present: %s\n",
    700	       dev->flags0 & 1 ? "yes" : "no");
    701	DEBUGP(7, dev, "cardman present: %s\n",
    702	       dev->flags0 == 0xff ? "no" : "yes");
    703
    704	if ((dev->flags0 & 1) == 0	/* no smartcard inserted */
    705	    || dev->flags0 == 0xff) {	/* no cardman inserted */
    706		/* no */
    707		dev->rlen =
    708		    dev->rpos =
    709		    dev->atr_csum = dev->atr_len_retry = dev->cwarn = 0;
    710		dev->mstate = M_FETCH_ATR;
    711
    712		dev->flags &= 0x000000ff; /* only keep IO and MONITOR locks */
    713
    714		if (dev->flags0 == 0xff) {
    715			DEBUGP(4, dev, "set IS_CMM_ABSENT bit\n");
    716			set_bit(IS_CMM_ABSENT, &dev->flags);
    717		} else if (test_bit(IS_CMM_ABSENT, &dev->flags)) {
    718			DEBUGP(4, dev, "clear IS_CMM_ABSENT bit "
    719			       "(card is removed)\n");
    720			clear_bit(IS_CMM_ABSENT, &dev->flags);
    721		}
    722
    723		goto release_io;
    724	} else if ((dev->flags0 & 1) && test_bit(IS_CMM_ABSENT, &dev->flags)) {
    725		/* cardman and card present but cardman was absent before
    726		 * (after suspend with inserted card) */
    727		DEBUGP(4, dev, "clear IS_CMM_ABSENT bit (card is inserted)\n");
    728		clear_bit(IS_CMM_ABSENT, &dev->flags);
    729	}
    730
    731	if (test_bit(IS_ATR_VALID, &dev->flags) == 1) {
    732		DEBUGP(7, dev, "believe ATR is already valid (do nothing)\n");
    733		goto release_io;
    734	}
    735
    736	switch (dev->mstate) {
    737	case M_CARDOFF: {
    738		unsigned char flags0;
    739
    740		DEBUGP(4, dev, "M_CARDOFF\n");
    741		flags0 = inb(REG_FLAGS0(iobase));
    742		if (flags0 & 0x02) {
    743			/* wait until Flags0 indicate power is off */
    744			dev->mdelay = T_10MSEC;
    745		} else {
    746			/* Flags0 indicate power off and no card inserted now;
    747			 * Reset CARDMAN CONTROLLER */
    748			xoutb(0x80, REG_FLAGS0(iobase));
    749
    750			/* prepare for fetching ATR again: after card off ATR
    751			 * is read again automatically */
    752			dev->rlen =
    753			    dev->rpos =
    754			    dev->atr_csum =
    755			    dev->atr_len_retry = dev->cwarn = 0;
    756			dev->mstate = M_FETCH_ATR;
    757
    758			/* minimal gap between CARDOFF and read ATR is 50msec */
    759			dev->mdelay = T_50MSEC;
    760		}
    761		break;
    762	}
    763	case M_FETCH_ATR:
    764		DEBUGP(4, dev, "M_FETCH_ATR\n");
    765		xoutb(0x80, REG_FLAGS0(iobase));
    766		DEBUGP(4, dev, "Reset BAUDV to 9600\n");
    767		dev->baudv = 0x173;	/* 9600 */
    768		xoutb(0x02, REG_STOPBITS(iobase));	/* stopbits=2 */
    769		xoutb(0x73, REG_BAUDRATE(iobase));	/* baud value */
    770		xoutb(0x21, REG_FLAGS1(iobase));	/* T_Active=1, baud
    771							   value */
    772		/* warm start vs. power on: */
    773		xoutb(dev->flags0 & 2 ? 0x46 : 0x44, REG_FLAGS0(iobase));
    774		dev->mdelay = T_40MSEC;
    775		dev->mstate = M_TIMEOUT_WAIT;
    776		break;
    777	case M_TIMEOUT_WAIT:
    778		DEBUGP(4, dev, "M_TIMEOUT_WAIT\n");
    779		/* numRecBytes */
    780		io_read_num_rec_bytes(iobase, &dev->atr_len);
    781		dev->mdelay = T_10MSEC;
    782		dev->mstate = M_READ_ATR_LEN;
    783		break;
    784	case M_READ_ATR_LEN:
    785		DEBUGP(4, dev, "M_READ_ATR_LEN\n");
    786		/* infinite loop possible, since there is no timeout */
    787
    788#define	MAX_ATR_LEN_RETRY	100
    789
    790		if (dev->atr_len == io_read_num_rec_bytes(iobase, &s)) {
    791			if (dev->atr_len_retry++ >= MAX_ATR_LEN_RETRY) {					/* + XX msec */
    792				dev->mdelay = T_10MSEC;
    793				dev->mstate = M_READ_ATR;
    794			}
    795		} else {
    796			dev->atr_len = s;
    797			dev->atr_len_retry = 0;	/* set new timeout */
    798		}
    799
    800		DEBUGP(4, dev, "Current ATR_LEN = %i\n", dev->atr_len);
    801		break;
    802	case M_READ_ATR:
    803		DEBUGP(4, dev, "M_READ_ATR\n");
    804		xoutb(0x80, REG_FLAGS0(iobase));	/* reset SM */
    805		for (i = 0; i < dev->atr_len; i++) {
    806			xoutb(i, REG_BUF_ADDR(iobase));
    807			dev->atr[i] = inb(REG_BUF_DATA(iobase));
    808		}
    809		/* Deactivate T_Active flags */
    810		DEBUGP(4, dev, "Deactivate T_Active flags\n");
    811		dev->flags1 = 0x01;
    812		xoutb(dev->flags1, REG_FLAGS1(iobase));
    813
    814		/* atr is present (which doesn't mean it's valid) */
    815		set_bit(IS_ATR_PRESENT, &dev->flags);
    816		if (dev->atr[0] == 0x03)
    817			str_invert_revert(dev->atr, dev->atr_len);
    818		atrc = parse_atr(dev);
    819		if (atrc == 0) {	/* atr invalid */
    820			dev->mdelay = 0;
    821			dev->mstate = M_BAD_CARD;
    822		} else {
    823			dev->mdelay = T_50MSEC;
    824			dev->mstate = M_ATR_PRESENT;
    825			set_bit(IS_ATR_VALID, &dev->flags);
    826		}
    827
    828		if (test_bit(IS_ATR_VALID, &dev->flags) == 1) {
    829			DEBUGP(4, dev, "monitor_card: ATR valid\n");
    830 			/* if ta1 == 0x11, no PPS necessary (default values) */
    831			/* do not do PPS with multi protocol cards */
    832			if ((test_bit(IS_AUTOPPS_ACT, &dev->flags) == 0) &&
    833			    (dev->ta1 != 0x11) &&
    834			    !(test_bit(IS_ANY_T0, &dev->flags) &&
    835			    test_bit(IS_ANY_T1, &dev->flags))) {
    836				DEBUGP(4, dev, "Perform AUTOPPS\n");
    837				set_bit(IS_AUTOPPS_ACT, &dev->flags);
    838				ptsreq.protocol = (0x01 << dev->proto);
    839				ptsreq.flags = 0x01;
    840				ptsreq.pts1 = 0x00;
    841				ptsreq.pts2 = 0x00;
    842				ptsreq.pts3 = 0x00;
    843				if (set_protocol(dev, &ptsreq) == 0) {
    844					DEBUGP(4, dev, "AUTOPPS ret SUCC\n");
    845					clear_bit(IS_AUTOPPS_ACT, &dev->flags);
    846					wake_up_interruptible(&dev->atrq);
    847				} else {
    848					DEBUGP(4, dev, "AUTOPPS failed: "
    849					       "repower using defaults\n");
    850					/* prepare for repowering  */
    851					clear_bit(IS_ATR_PRESENT, &dev->flags);
    852					clear_bit(IS_ATR_VALID, &dev->flags);
    853					dev->rlen =
    854					    dev->rpos =
    855					    dev->atr_csum =
    856					    dev->atr_len_retry = dev->cwarn = 0;
    857					dev->mstate = M_FETCH_ATR;
    858
    859					dev->mdelay = T_50MSEC;
    860				}
    861			} else {
    862				/* for cards which use slightly different
    863				 * params (extra guard time) */
    864				set_cardparameter(dev);
    865				if (test_bit(IS_AUTOPPS_ACT, &dev->flags) == 1)
    866					DEBUGP(4, dev, "AUTOPPS already active "
    867					       "2nd try:use default values\n");
    868				if (dev->ta1 == 0x11)
    869					DEBUGP(4, dev, "No AUTOPPS necessary "
    870					       "TA(1)==0x11\n");
    871				if (test_bit(IS_ANY_T0, &dev->flags)
    872				    && test_bit(IS_ANY_T1, &dev->flags))
    873					DEBUGP(4, dev, "Do NOT perform AUTOPPS "
    874					       "with multiprotocol cards\n");
    875				clear_bit(IS_AUTOPPS_ACT, &dev->flags);
    876				wake_up_interruptible(&dev->atrq);
    877			}
    878		} else {
    879			DEBUGP(4, dev, "ATR invalid\n");
    880			wake_up_interruptible(&dev->atrq);
    881		}
    882		break;
    883	case M_BAD_CARD:
    884		DEBUGP(4, dev, "M_BAD_CARD\n");
    885		/* slow down warning, but prompt immediately after insertion */
    886		if (dev->cwarn == 0 || dev->cwarn == 10) {
    887			set_bit(IS_BAD_CARD, &dev->flags);
    888			dev_warn(&dev->p_dev->dev, MODULE_NAME ": ");
    889			if (test_bit(IS_BAD_CSUM, &dev->flags)) {
    890				DEBUGP(4, dev, "ATR checksum (0x%.2x, should "
    891				       "be zero) failed\n", dev->atr_csum);
    892			}
    893#ifdef CM4000_DEBUG
    894			else if (test_bit(IS_BAD_LENGTH, &dev->flags)) {
    895				DEBUGP(4, dev, "ATR length error\n");
    896			} else {
    897				DEBUGP(4, dev, "card damaged or wrong way "
    898					"inserted\n");
    899			}
    900#endif
    901			dev->cwarn = 0;
    902			wake_up_interruptible(&dev->atrq);	/* wake open */
    903		}
    904		dev->cwarn++;
    905		dev->mdelay = T_100MSEC;
    906		dev->mstate = M_FETCH_ATR;
    907		break;
    908	default:
    909		DEBUGP(7, dev, "Unknown action\n");
    910		break;		/* nothing */
    911	}
    912
    913release_io:
    914	DEBUGP(7, dev, "release_io\n");
    915	clear_bit(LOCK_IO, &dev->flags);
    916	wake_up_interruptible(&dev->ioq);	/* whoever needs IO */
    917
    918return_with_timer:
    919	DEBUGP(7, dev, "<- monitor_card (returns with timer)\n");
    920	mod_timer(&dev->timer, jiffies + dev->mdelay);
    921	clear_bit(LOCK_MONITOR, &dev->flags);
    922}
    923
    924/* Interface to userland (file_operations) */
    925
    926static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
    927			loff_t *ppos)
    928{
    929	struct cm4000_dev *dev = filp->private_data;
    930	unsigned int iobase = dev->p_dev->resource[0]->start;
    931	ssize_t rc;
    932	int i, j, k;
    933
    934	DEBUGP(2, dev, "-> cmm_read(%s,%d)\n", current->comm, current->pid);
    935
    936	if (count == 0)		/* according to manpage */
    937		return 0;
    938
    939	if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
    940	    test_bit(IS_CMM_ABSENT, &dev->flags))
    941		return -ENODEV;
    942
    943	if (test_bit(IS_BAD_CSUM, &dev->flags))
    944		return -EIO;
    945
    946	/* also see the note about this in cmm_write */
    947	if (wait_event_interruptible
    948	    (dev->atrq,
    949	     ((filp->f_flags & O_NONBLOCK)
    950	      || (test_bit(IS_ATR_PRESENT, (void *)&dev->flags) != 0)))) {
    951		if (filp->f_flags & O_NONBLOCK)
    952			return -EAGAIN;
    953		return -ERESTARTSYS;
    954	}
    955
    956	if (test_bit(IS_ATR_VALID, &dev->flags) == 0)
    957		return -EIO;
    958
    959	/* this one implements blocking IO */
    960	if (wait_event_interruptible
    961	    (dev->readq,
    962	     ((filp->f_flags & O_NONBLOCK) || (dev->rpos < dev->rlen)))) {
    963		if (filp->f_flags & O_NONBLOCK)
    964			return -EAGAIN;
    965		return -ERESTARTSYS;
    966	}
    967
    968	/* lock io */
    969	if (wait_event_interruptible
    970	    (dev->ioq,
    971	     ((filp->f_flags & O_NONBLOCK)
    972	      || (test_and_set_bit(LOCK_IO, (void *)&dev->flags) == 0)))) {
    973		if (filp->f_flags & O_NONBLOCK)
    974			return -EAGAIN;
    975		return -ERESTARTSYS;
    976	}
    977
    978	rc = 0;
    979	dev->flags0 = inb(REG_FLAGS0(iobase));
    980	if ((dev->flags0 & 1) == 0	/* no smartcard inserted */
    981	    || dev->flags0 == 0xff) {	/* no cardman inserted */
    982		clear_bit(IS_ATR_VALID, &dev->flags);
    983		if (dev->flags0 & 1) {
    984			set_bit(IS_CMM_ABSENT, &dev->flags);
    985			rc = -ENODEV;
    986		} else {
    987			rc = -EIO;
    988		}
    989		goto release_io;
    990	}
    991
    992	DEBUGP(4, dev, "begin read answer\n");
    993	j = min(count, (size_t)(dev->rlen - dev->rpos));
    994	k = dev->rpos;
    995	if (k + j > 255)
    996		j = 256 - k;
    997	DEBUGP(4, dev, "read1 j=%d\n", j);
    998	for (i = 0; i < j; i++) {
    999		xoutb(k++, REG_BUF_ADDR(iobase));
   1000		dev->rbuf[i] = xinb(REG_BUF_DATA(iobase));
   1001	}
   1002	j = min(count, (size_t)(dev->rlen - dev->rpos));
   1003	if (k + j > 255) {
   1004		DEBUGP(4, dev, "read2 j=%d\n", j);
   1005		dev->flags1 |= 0x10;	/* MSB buf addr set */
   1006		xoutb(dev->flags1, REG_FLAGS1(iobase));
   1007		for (; i < j; i++) {
   1008			xoutb(k++, REG_BUF_ADDR(iobase));
   1009			dev->rbuf[i] = xinb(REG_BUF_DATA(iobase));
   1010		}
   1011	}
   1012
   1013	if (dev->proto == 0 && count > dev->rlen - dev->rpos && i) {
   1014		DEBUGP(4, dev, "T=0 and count > buffer\n");
   1015		dev->rbuf[i] = dev->rbuf[i - 1];
   1016		dev->rbuf[i - 1] = dev->procbyte;
   1017		j++;
   1018	}
   1019	count = j;
   1020
   1021	dev->rpos = dev->rlen + 1;
   1022
   1023	/* Clear T1Active */
   1024	DEBUGP(4, dev, "Clear T1Active\n");
   1025	dev->flags1 &= 0xdf;
   1026	xoutb(dev->flags1, REG_FLAGS1(iobase));
   1027
   1028	xoutb(0, REG_FLAGS1(iobase));	/* clear detectCMM */
   1029	/* last check before exit */
   1030	if (!io_detect_cm4000(iobase, dev)) {
   1031		rc = -ENODEV;
   1032		goto release_io;
   1033	}
   1034
   1035	if (test_bit(IS_INVREV, &dev->flags) && count > 0)
   1036		str_invert_revert(dev->rbuf, count);
   1037
   1038	if (copy_to_user(buf, dev->rbuf, count))
   1039		rc = -EFAULT;
   1040
   1041release_io:
   1042	clear_bit(LOCK_IO, &dev->flags);
   1043	wake_up_interruptible(&dev->ioq);
   1044
   1045	DEBUGP(2, dev, "<- cmm_read returns: rc = %zi\n",
   1046	       (rc < 0 ? rc : count));
   1047	return rc < 0 ? rc : count;
   1048}
   1049
   1050static ssize_t cmm_write(struct file *filp, const char __user *buf,
   1051			 size_t count, loff_t *ppos)
   1052{
   1053	struct cm4000_dev *dev = filp->private_data;
   1054	unsigned int iobase = dev->p_dev->resource[0]->start;
   1055	unsigned short s;
   1056	unsigned char infolen;
   1057	unsigned char sendT0;
   1058	unsigned short nsend;
   1059	unsigned short nr;
   1060	ssize_t rc;
   1061	int i;
   1062
   1063	DEBUGP(2, dev, "-> cmm_write(%s,%d)\n", current->comm, current->pid);
   1064
   1065	if (count == 0)		/* according to manpage */
   1066		return 0;
   1067
   1068	if (dev->proto == 0 && count < 4) {
   1069		/* T0 must have at least 4 bytes */
   1070		DEBUGP(4, dev, "T0 short write\n");
   1071		return -EIO;
   1072	}
   1073
   1074	nr = count & 0x1ff;	/* max bytes to write */
   1075
   1076	sendT0 = dev->proto ? 0 : nr > 5 ? 0x08 : 0;
   1077
   1078	if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
   1079	    test_bit(IS_CMM_ABSENT, &dev->flags))
   1080		return -ENODEV;
   1081
   1082	if (test_bit(IS_BAD_CSUM, &dev->flags)) {
   1083		DEBUGP(4, dev, "bad csum\n");
   1084		return -EIO;
   1085	}
   1086
   1087	/*
   1088	 * wait for atr to become valid.
   1089	 * note: it is important to lock this code. if we dont, the monitor
   1090	 * could be run between test_bit and the call to sleep on the
   1091	 * atr-queue.  if *then* the monitor detects atr valid, it will wake up
   1092	 * any process on the atr-queue, *but* since we have been interrupted,
   1093	 * we do not yet sleep on this queue. this would result in a missed
   1094	 * wake_up and the calling process would sleep forever (until
   1095	 * interrupted).  also, do *not* restore_flags before sleep_on, because
   1096	 * this could result in the same situation!
   1097	 */
   1098	if (wait_event_interruptible
   1099	    (dev->atrq,
   1100	     ((filp->f_flags & O_NONBLOCK)
   1101	      || (test_bit(IS_ATR_PRESENT, (void *)&dev->flags) != 0)))) {
   1102		if (filp->f_flags & O_NONBLOCK)
   1103			return -EAGAIN;
   1104		return -ERESTARTSYS;
   1105	}
   1106
   1107	if (test_bit(IS_ATR_VALID, &dev->flags) == 0) {	/* invalid atr */
   1108		DEBUGP(4, dev, "invalid ATR\n");
   1109		return -EIO;
   1110	}
   1111
   1112	/* lock io */
   1113	if (wait_event_interruptible
   1114	    (dev->ioq,
   1115	     ((filp->f_flags & O_NONBLOCK)
   1116	      || (test_and_set_bit(LOCK_IO, (void *)&dev->flags) == 0)))) {
   1117		if (filp->f_flags & O_NONBLOCK)
   1118			return -EAGAIN;
   1119		return -ERESTARTSYS;
   1120	}
   1121
   1122	if (copy_from_user(dev->sbuf, buf, ((count > 512) ? 512 : count)))
   1123		return -EFAULT;
   1124
   1125	rc = 0;
   1126	dev->flags0 = inb(REG_FLAGS0(iobase));
   1127	if ((dev->flags0 & 1) == 0	/* no smartcard inserted */
   1128	    || dev->flags0 == 0xff) {	/* no cardman inserted */
   1129		clear_bit(IS_ATR_VALID, &dev->flags);
   1130		if (dev->flags0 & 1) {
   1131			set_bit(IS_CMM_ABSENT, &dev->flags);
   1132			rc = -ENODEV;
   1133		} else {
   1134			DEBUGP(4, dev, "IO error\n");
   1135			rc = -EIO;
   1136		}
   1137		goto release_io;
   1138	}
   1139
   1140	xoutb(0x80, REG_FLAGS0(iobase));	/* reset SM  */
   1141
   1142	if (!io_detect_cm4000(iobase, dev)) {
   1143		rc = -ENODEV;
   1144		goto release_io;
   1145	}
   1146
   1147	/* reflect T=0 send/read mode in flags1 */
   1148	dev->flags1 |= (sendT0);
   1149
   1150	set_cardparameter(dev);
   1151
   1152	/* dummy read, reset flag procedure received */
   1153	inb(REG_FLAGS1(iobase));
   1154
   1155	dev->flags1 = 0x20	/* T_Active */
   1156	    | (sendT0)
   1157	    | (test_bit(IS_INVREV, &dev->flags) ? 2 : 0)/* inverse parity  */
   1158	    | (((dev->baudv - 1) & 0x0100) >> 8);	/* MSB-Baud */
   1159	DEBUGP(1, dev, "set dev->flags1 = 0x%.2x\n", dev->flags1);
   1160	xoutb(dev->flags1, REG_FLAGS1(iobase));
   1161
   1162	/* xmit data */
   1163	DEBUGP(4, dev, "Xmit data\n");
   1164	for (i = 0; i < nr; i++) {
   1165		if (i >= 256) {
   1166			dev->flags1 = 0x20	/* T_Active */
   1167			    | (sendT0)	/* SendT0 */
   1168				/* inverse parity: */
   1169			    | (test_bit(IS_INVREV, &dev->flags) ? 2 : 0)
   1170			    | (((dev->baudv - 1) & 0x0100) >> 8) /* MSB-Baud */
   1171			    | 0x10;	/* set address high */
   1172			DEBUGP(4, dev, "dev->flags = 0x%.2x - set address "
   1173			       "high\n", dev->flags1);
   1174			xoutb(dev->flags1, REG_FLAGS1(iobase));
   1175		}
   1176		if (test_bit(IS_INVREV, &dev->flags)) {
   1177			DEBUGP(4, dev, "Apply inverse convention for 0x%.2x "
   1178				"-> 0x%.2x\n", (unsigned char)dev->sbuf[i],
   1179			      invert_revert(dev->sbuf[i]));
   1180			xoutb(i, REG_BUF_ADDR(iobase));
   1181			xoutb(invert_revert(dev->sbuf[i]),
   1182			      REG_BUF_DATA(iobase));
   1183		} else {
   1184			xoutb(i, REG_BUF_ADDR(iobase));
   1185			xoutb(dev->sbuf[i], REG_BUF_DATA(iobase));
   1186		}
   1187	}
   1188	DEBUGP(4, dev, "Xmit done\n");
   1189
   1190	if (dev->proto == 0) {
   1191		/* T=0 proto: 0 byte reply  */
   1192		if (nr == 4) {
   1193			DEBUGP(4, dev, "T=0 assumes 0 byte reply\n");
   1194			xoutb(i, REG_BUF_ADDR(iobase));
   1195			if (test_bit(IS_INVREV, &dev->flags))
   1196				xoutb(0xff, REG_BUF_DATA(iobase));
   1197			else
   1198				xoutb(0x00, REG_BUF_DATA(iobase));
   1199		}
   1200
   1201		/* numSendBytes */
   1202		if (sendT0)
   1203			nsend = nr;
   1204		else {
   1205			if (nr == 4)
   1206				nsend = 5;
   1207			else {
   1208				nsend = 5 + (unsigned char)dev->sbuf[4];
   1209				if (dev->sbuf[4] == 0)
   1210					nsend += 0x100;
   1211			}
   1212		}
   1213	} else
   1214		nsend = nr;
   1215
   1216	/* T0: output procedure byte */
   1217	if (test_bit(IS_INVREV, &dev->flags)) {
   1218		DEBUGP(4, dev, "T=0 set Procedure byte (inverse-reverse) "
   1219		       "0x%.2x\n", invert_revert(dev->sbuf[1]));
   1220		xoutb(invert_revert(dev->sbuf[1]), REG_NUM_BYTES(iobase));
   1221	} else {
   1222		DEBUGP(4, dev, "T=0 set Procedure byte 0x%.2x\n", dev->sbuf[1]);
   1223		xoutb(dev->sbuf[1], REG_NUM_BYTES(iobase));
   1224	}
   1225
   1226	DEBUGP(1, dev, "set NumSendBytes = 0x%.2x\n",
   1227	       (unsigned char)(nsend & 0xff));
   1228	xoutb((unsigned char)(nsend & 0xff), REG_NUM_SEND(iobase));
   1229
   1230	DEBUGP(1, dev, "Trigger CARDMAN CONTROLLER (0x%.2x)\n",
   1231	       0x40	/* SM_Active */
   1232	      | (dev->flags0 & 2 ? 0 : 4)	/* power on if needed */
   1233	      |(dev->proto ? 0x10 : 0x08)	/* T=1/T=0 */
   1234	      |(nsend & 0x100) >> 8 /* MSB numSendBytes */ );
   1235	xoutb(0x40		/* SM_Active */
   1236	      | (dev->flags0 & 2 ? 0 : 4)	/* power on if needed */
   1237	      |(dev->proto ? 0x10 : 0x08)	/* T=1/T=0 */
   1238	      |(nsend & 0x100) >> 8,	/* MSB numSendBytes */
   1239	      REG_FLAGS0(iobase));
   1240
   1241	/* wait for xmit done */
   1242	if (dev->proto == 1) {
   1243		DEBUGP(4, dev, "Wait for xmit done\n");
   1244		for (i = 0; i < 1000; i++) {
   1245			if (inb(REG_FLAGS0(iobase)) & 0x08)
   1246				break;
   1247			msleep_interruptible(10);
   1248		}
   1249		if (i == 1000) {
   1250			DEBUGP(4, dev, "timeout waiting for xmit done\n");
   1251			rc = -EIO;
   1252			goto release_io;
   1253		}
   1254	}
   1255
   1256	/* T=1: wait for infoLen */
   1257
   1258	infolen = 0;
   1259	if (dev->proto) {
   1260		/* wait until infoLen is valid */
   1261		for (i = 0; i < 6000; i++) {	/* max waiting time of 1 min */
   1262			io_read_num_rec_bytes(iobase, &s);
   1263			if (s >= 3) {
   1264				infolen = inb(REG_FLAGS1(iobase));
   1265				DEBUGP(4, dev, "infolen=%d\n", infolen);
   1266				break;
   1267			}
   1268			msleep_interruptible(10);
   1269		}
   1270		if (i == 6000) {
   1271			DEBUGP(4, dev, "timeout waiting for infoLen\n");
   1272			rc = -EIO;
   1273			goto release_io;
   1274		}
   1275	} else
   1276		clear_bit(IS_PROCBYTE_PRESENT, &dev->flags);
   1277
   1278	/* numRecBytes | bit9 of numRecytes */
   1279	io_read_num_rec_bytes(iobase, &dev->rlen);
   1280	for (i = 0; i < 600; i++) {	/* max waiting time of 2 sec */
   1281		if (dev->proto) {
   1282			if (dev->rlen >= infolen + 4)
   1283				break;
   1284		}
   1285		msleep_interruptible(10);
   1286		/* numRecBytes | bit9 of numRecytes */
   1287		io_read_num_rec_bytes(iobase, &s);
   1288		if (s > dev->rlen) {
   1289			DEBUGP(1, dev, "NumRecBytes inc (reset timeout)\n");
   1290			i = 0;	/* reset timeout */
   1291			dev->rlen = s;
   1292		}
   1293		/* T=0: we are done when numRecBytes doesn't
   1294		 *      increment any more and NoProcedureByte
   1295		 *      is set and numRecBytes == bytes sent + 6
   1296		 *      (header bytes + data + 1 for sw2)
   1297		 *      except when the card replies an error
   1298		 *      which means, no data will be sent back.
   1299		 */
   1300		else if (dev->proto == 0) {
   1301			if ((inb(REG_BUF_ADDR(iobase)) & 0x80)) {
   1302				/* no procedure byte received since last read */
   1303				DEBUGP(1, dev, "NoProcedure byte set\n");
   1304				/* i=0; */
   1305			} else {
   1306				/* procedure byte received since last read */
   1307				DEBUGP(1, dev, "NoProcedure byte unset "
   1308					"(reset timeout)\n");
   1309				dev->procbyte = inb(REG_FLAGS1(iobase));
   1310				DEBUGP(1, dev, "Read procedure byte 0x%.2x\n",
   1311				      dev->procbyte);
   1312				i = 0;	/* resettimeout */
   1313			}
   1314			if (inb(REG_FLAGS0(iobase)) & 0x08) {
   1315				DEBUGP(1, dev, "T0Done flag (read reply)\n");
   1316				break;
   1317			}
   1318		}
   1319		if (dev->proto)
   1320			infolen = inb(REG_FLAGS1(iobase));
   1321	}
   1322	if (i == 600) {
   1323		DEBUGP(1, dev, "timeout waiting for numRecBytes\n");
   1324		rc = -EIO;
   1325		goto release_io;
   1326	} else {
   1327		if (dev->proto == 0) {
   1328			DEBUGP(1, dev, "Wait for T0Done bit to be  set\n");
   1329			for (i = 0; i < 1000; i++) {
   1330				if (inb(REG_FLAGS0(iobase)) & 0x08)
   1331					break;
   1332				msleep_interruptible(10);
   1333			}
   1334			if (i == 1000) {
   1335				DEBUGP(1, dev, "timeout waiting for T0Done\n");
   1336				rc = -EIO;
   1337				goto release_io;
   1338			}
   1339
   1340			dev->procbyte = inb(REG_FLAGS1(iobase));
   1341			DEBUGP(4, dev, "Read procedure byte 0x%.2x\n",
   1342			      dev->procbyte);
   1343
   1344			io_read_num_rec_bytes(iobase, &dev->rlen);
   1345			DEBUGP(4, dev, "Read NumRecBytes = %i\n", dev->rlen);
   1346
   1347		}
   1348	}
   1349	/* T=1: read offset=zero, T=0: read offset=after challenge */
   1350	dev->rpos = dev->proto ? 0 : nr == 4 ? 5 : nr > dev->rlen ? 5 : nr;
   1351	DEBUGP(4, dev, "dev->rlen = %i,  dev->rpos = %i, nr = %i\n",
   1352	      dev->rlen, dev->rpos, nr);
   1353
   1354release_io:
   1355	DEBUGP(4, dev, "Reset SM\n");
   1356	xoutb(0x80, REG_FLAGS0(iobase));	/* reset SM */
   1357
   1358	if (rc < 0) {
   1359		DEBUGP(4, dev, "Write failed but clear T_Active\n");
   1360		dev->flags1 &= 0xdf;
   1361		xoutb(dev->flags1, REG_FLAGS1(iobase));
   1362	}
   1363
   1364	clear_bit(LOCK_IO, &dev->flags);
   1365	wake_up_interruptible(&dev->ioq);
   1366	wake_up_interruptible(&dev->readq);	/* tell read we have data */
   1367
   1368	/* ITSEC E2: clear write buffer */
   1369	memset((char *)dev->sbuf, 0, 512);
   1370
   1371	/* return error or actually written bytes */
   1372	DEBUGP(2, dev, "<- cmm_write\n");
   1373	return rc < 0 ? rc : nr;
   1374}
   1375
   1376static void start_monitor(struct cm4000_dev *dev)
   1377{
   1378	DEBUGP(3, dev, "-> start_monitor\n");
   1379	if (!dev->monitor_running) {
   1380		DEBUGP(5, dev, "create, init and add timer\n");
   1381		timer_setup(&dev->timer, monitor_card, 0);
   1382		dev->monitor_running = 1;
   1383		mod_timer(&dev->timer, jiffies);
   1384	} else
   1385		DEBUGP(5, dev, "monitor already running\n");
   1386	DEBUGP(3, dev, "<- start_monitor\n");
   1387}
   1388
   1389static void stop_monitor(struct cm4000_dev *dev)
   1390{
   1391	DEBUGP(3, dev, "-> stop_monitor\n");
   1392	if (dev->monitor_running) {
   1393		DEBUGP(5, dev, "stopping monitor\n");
   1394		terminate_monitor(dev);
   1395		/* reset monitor SM */
   1396		clear_bit(IS_ATR_VALID, &dev->flags);
   1397		clear_bit(IS_ATR_PRESENT, &dev->flags);
   1398	} else
   1399		DEBUGP(5, dev, "monitor already stopped\n");
   1400	DEBUGP(3, dev, "<- stop_monitor\n");
   1401}
   1402
   1403static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
   1404{
   1405	struct cm4000_dev *dev = filp->private_data;
   1406	unsigned int iobase = dev->p_dev->resource[0]->start;
   1407	struct inode *inode = file_inode(filp);
   1408	struct pcmcia_device *link;
   1409	int rc;
   1410	void __user *argp = (void __user *)arg;
   1411#ifdef CM4000_DEBUG
   1412	char *ioctl_names[CM_IOC_MAXNR + 1] = {
   1413		[_IOC_NR(CM_IOCGSTATUS)] "CM_IOCGSTATUS",
   1414		[_IOC_NR(CM_IOCGATR)] "CM_IOCGATR",
   1415		[_IOC_NR(CM_IOCARDOFF)] "CM_IOCARDOFF",
   1416		[_IOC_NR(CM_IOCSPTS)] "CM_IOCSPTS",
   1417		[_IOC_NR(CM_IOSDBGLVL)] "CM4000_DBGLVL",
   1418	};
   1419	DEBUGP(3, dev, "cmm_ioctl(device=%d.%d) %s\n", imajor(inode),
   1420	       iminor(inode), ioctl_names[_IOC_NR(cmd)]);
   1421#endif
   1422
   1423	mutex_lock(&cmm_mutex);
   1424	rc = -ENODEV;
   1425	link = dev_table[iminor(inode)];
   1426	if (!pcmcia_dev_present(link)) {
   1427		DEBUGP(4, dev, "DEV_OK false\n");
   1428		goto out;
   1429	}
   1430
   1431	if (test_bit(IS_CMM_ABSENT, &dev->flags)) {
   1432		DEBUGP(4, dev, "CMM_ABSENT flag set\n");
   1433		goto out;
   1434	}
   1435	rc = -EINVAL;
   1436
   1437	if (_IOC_TYPE(cmd) != CM_IOC_MAGIC) {
   1438		DEBUGP(4, dev, "ioctype mismatch\n");
   1439		goto out;
   1440	}
   1441	if (_IOC_NR(cmd) > CM_IOC_MAXNR) {
   1442		DEBUGP(4, dev, "iocnr mismatch\n");
   1443		goto out;
   1444	}
   1445	rc = 0;
   1446
   1447	switch (cmd) {
   1448	case CM_IOCGSTATUS:
   1449		DEBUGP(4, dev, " ... in CM_IOCGSTATUS\n");
   1450		{
   1451			int status;
   1452
   1453			/* clear other bits, but leave inserted & powered as
   1454			 * they are */
   1455			status = dev->flags0 & 3;
   1456			if (test_bit(IS_ATR_PRESENT, &dev->flags))
   1457				status |= CM_ATR_PRESENT;
   1458			if (test_bit(IS_ATR_VALID, &dev->flags))
   1459				status |= CM_ATR_VALID;
   1460			if (test_bit(IS_CMM_ABSENT, &dev->flags))
   1461				status |= CM_NO_READER;
   1462			if (test_bit(IS_BAD_CARD, &dev->flags))
   1463				status |= CM_BAD_CARD;
   1464			if (copy_to_user(argp, &status, sizeof(int)))
   1465				rc = -EFAULT;
   1466		}
   1467		break;
   1468	case CM_IOCGATR:
   1469		DEBUGP(4, dev, "... in CM_IOCGATR\n");
   1470		{
   1471			struct atreq __user *atreq = argp;
   1472			int tmp;
   1473			/* allow nonblocking io and being interrupted */
   1474			if (wait_event_interruptible
   1475			    (dev->atrq,
   1476			     ((filp->f_flags & O_NONBLOCK)
   1477			      || (test_bit(IS_ATR_PRESENT, (void *)&dev->flags)
   1478				  != 0)))) {
   1479				if (filp->f_flags & O_NONBLOCK)
   1480					rc = -EAGAIN;
   1481				else
   1482					rc = -ERESTARTSYS;
   1483				break;
   1484			}
   1485
   1486			rc = -EFAULT;
   1487			if (test_bit(IS_ATR_VALID, &dev->flags) == 0) {
   1488				tmp = -1;
   1489				if (copy_to_user(&(atreq->atr_len), &tmp,
   1490						 sizeof(int)))
   1491					break;
   1492			} else {
   1493				if (copy_to_user(atreq->atr, dev->atr,
   1494						 dev->atr_len))
   1495					break;
   1496
   1497				tmp = dev->atr_len;
   1498				if (copy_to_user(&(atreq->atr_len), &tmp, sizeof(int)))
   1499					break;
   1500			}
   1501			rc = 0;
   1502			break;
   1503		}
   1504	case CM_IOCARDOFF:
   1505
   1506#ifdef CM4000_DEBUG
   1507		DEBUGP(4, dev, "... in CM_IOCARDOFF\n");
   1508		if (dev->flags0 & 0x01) {
   1509			DEBUGP(4, dev, "    Card inserted\n");
   1510		} else {
   1511			DEBUGP(2, dev, "    No card inserted\n");
   1512		}
   1513		if (dev->flags0 & 0x02) {
   1514			DEBUGP(4, dev, "    Card powered\n");
   1515		} else {
   1516			DEBUGP(2, dev, "    Card not powered\n");
   1517		}
   1518#endif
   1519
   1520		/* is a card inserted and powered? */
   1521		if ((dev->flags0 & 0x01) && (dev->flags0 & 0x02)) {
   1522
   1523			/* get IO lock */
   1524			if (wait_event_interruptible
   1525			    (dev->ioq,
   1526			     ((filp->f_flags & O_NONBLOCK)
   1527			      || (test_and_set_bit(LOCK_IO, (void *)&dev->flags)
   1528				  == 0)))) {
   1529				if (filp->f_flags & O_NONBLOCK)
   1530					rc = -EAGAIN;
   1531				else
   1532					rc = -ERESTARTSYS;
   1533				break;
   1534			}
   1535			/* Set Flags0 = 0x42 */
   1536			DEBUGP(4, dev, "Set Flags0=0x42 \n");
   1537			xoutb(0x42, REG_FLAGS0(iobase));
   1538			clear_bit(IS_ATR_PRESENT, &dev->flags);
   1539			clear_bit(IS_ATR_VALID, &dev->flags);
   1540			dev->mstate = M_CARDOFF;
   1541			clear_bit(LOCK_IO, &dev->flags);
   1542			if (wait_event_interruptible
   1543			    (dev->atrq,
   1544			     ((filp->f_flags & O_NONBLOCK)
   1545			      || (test_bit(IS_ATR_VALID, (void *)&dev->flags) !=
   1546				  0)))) {
   1547				if (filp->f_flags & O_NONBLOCK)
   1548					rc = -EAGAIN;
   1549				else
   1550					rc = -ERESTARTSYS;
   1551				break;
   1552			}
   1553		}
   1554		/* release lock */
   1555		clear_bit(LOCK_IO, &dev->flags);
   1556		wake_up_interruptible(&dev->ioq);
   1557
   1558		rc = 0;
   1559		break;
   1560	case CM_IOCSPTS:
   1561		{
   1562			struct ptsreq krnptsreq;
   1563
   1564			if (copy_from_user(&krnptsreq, argp,
   1565					   sizeof(struct ptsreq))) {
   1566				rc = -EFAULT;
   1567				break;
   1568			}
   1569
   1570			rc = 0;
   1571			DEBUGP(4, dev, "... in CM_IOCSPTS\n");
   1572			/* wait for ATR to get valid */
   1573			if (wait_event_interruptible
   1574			    (dev->atrq,
   1575			     ((filp->f_flags & O_NONBLOCK)
   1576			      || (test_bit(IS_ATR_PRESENT, (void *)&dev->flags)
   1577				  != 0)))) {
   1578				if (filp->f_flags & O_NONBLOCK)
   1579					rc = -EAGAIN;
   1580				else
   1581					rc = -ERESTARTSYS;
   1582				break;
   1583			}
   1584			/* get IO lock */
   1585			if (wait_event_interruptible
   1586			    (dev->ioq,
   1587			     ((filp->f_flags & O_NONBLOCK)
   1588			      || (test_and_set_bit(LOCK_IO, (void *)&dev->flags)
   1589				  == 0)))) {
   1590				if (filp->f_flags & O_NONBLOCK)
   1591					rc = -EAGAIN;
   1592				else
   1593					rc = -ERESTARTSYS;
   1594				break;
   1595			}
   1596
   1597			if ((rc = set_protocol(dev, &krnptsreq)) != 0) {
   1598				/* auto power_on again */
   1599				dev->mstate = M_FETCH_ATR;
   1600				clear_bit(IS_ATR_VALID, &dev->flags);
   1601			}
   1602			/* release lock */
   1603			clear_bit(LOCK_IO, &dev->flags);
   1604			wake_up_interruptible(&dev->ioq);
   1605
   1606		}
   1607		break;
   1608#ifdef CM4000_DEBUG
   1609	case CM_IOSDBGLVL:
   1610		rc = -ENOTTY;
   1611		break;
   1612#endif
   1613	default:
   1614		DEBUGP(4, dev, "... in default (unknown IOCTL code)\n");
   1615		rc = -ENOTTY;
   1616	}
   1617out:
   1618	mutex_unlock(&cmm_mutex);
   1619	return rc;
   1620}
   1621
   1622static int cmm_open(struct inode *inode, struct file *filp)
   1623{
   1624	struct cm4000_dev *dev;
   1625	struct pcmcia_device *link;
   1626	int minor = iminor(inode);
   1627	int ret;
   1628
   1629	if (minor >= CM4000_MAX_DEV)
   1630		return -ENODEV;
   1631
   1632	mutex_lock(&cmm_mutex);
   1633	link = dev_table[minor];
   1634	if (link == NULL || !pcmcia_dev_present(link)) {
   1635		ret = -ENODEV;
   1636		goto out;
   1637	}
   1638
   1639	if (link->open) {
   1640		ret = -EBUSY;
   1641		goto out;
   1642	}
   1643
   1644	dev = link->priv;
   1645	filp->private_data = dev;
   1646
   1647	DEBUGP(2, dev, "-> cmm_open(device=%d.%d process=%s,%d)\n",
   1648	      imajor(inode), minor, current->comm, current->pid);
   1649
   1650	/* init device variables, they may be "polluted" after close
   1651	 * or, the device may never have been closed (i.e. open failed)
   1652	 */
   1653
   1654	ZERO_DEV(dev);
   1655
   1656	/* opening will always block since the
   1657	 * monitor will be started by open, which
   1658	 * means we have to wait for ATR becoming
   1659	 * valid = block until valid (or card
   1660	 * inserted)
   1661	 */
   1662	if (filp->f_flags & O_NONBLOCK) {
   1663		ret = -EAGAIN;
   1664		goto out;
   1665	}
   1666
   1667	dev->mdelay = T_50MSEC;
   1668
   1669	/* start monitoring the cardstatus */
   1670	start_monitor(dev);
   1671
   1672	link->open = 1;		/* only one open per device */
   1673
   1674	DEBUGP(2, dev, "<- cmm_open\n");
   1675	ret = stream_open(inode, filp);
   1676out:
   1677	mutex_unlock(&cmm_mutex);
   1678	return ret;
   1679}
   1680
   1681static int cmm_close(struct inode *inode, struct file *filp)
   1682{
   1683	struct cm4000_dev *dev;
   1684	struct pcmcia_device *link;
   1685	int minor = iminor(inode);
   1686
   1687	if (minor >= CM4000_MAX_DEV)
   1688		return -ENODEV;
   1689
   1690	link = dev_table[minor];
   1691	if (link == NULL)
   1692		return -ENODEV;
   1693
   1694	dev = link->priv;
   1695
   1696	DEBUGP(2, dev, "-> cmm_close(maj/min=%d.%d)\n",
   1697	       imajor(inode), minor);
   1698
   1699	stop_monitor(dev);
   1700
   1701	ZERO_DEV(dev);
   1702
   1703	link->open = 0;		/* only one open per device */
   1704	wake_up(&dev->devq);	/* socket removed? */
   1705
   1706	DEBUGP(2, dev, "cmm_close\n");
   1707	return 0;
   1708}
   1709
   1710static void cmm_cm4000_release(struct pcmcia_device * link)
   1711{
   1712	struct cm4000_dev *dev = link->priv;
   1713
   1714	/* dont terminate the monitor, rather rely on
   1715	 * close doing that for us.
   1716	 */
   1717	DEBUGP(3, dev, "-> cmm_cm4000_release\n");
   1718	while (link->open) {
   1719		printk(KERN_INFO MODULE_NAME ": delaying release until "
   1720		       "process has terminated\n");
   1721		/* note: don't interrupt us:
   1722		 * close the applications which own
   1723		 * the devices _first_ !
   1724		 */
   1725		wait_event(dev->devq, (link->open == 0));
   1726	}
   1727	/* dev->devq=NULL;	this cannot be zeroed earlier */
   1728	DEBUGP(3, dev, "<- cmm_cm4000_release\n");
   1729	return;
   1730}
   1731
   1732/*==== Interface to PCMCIA Layer =======================================*/
   1733
   1734static int cm4000_config_check(struct pcmcia_device *p_dev, void *priv_data)
   1735{
   1736	return pcmcia_request_io(p_dev);
   1737}
   1738
   1739static int cm4000_config(struct pcmcia_device * link, int devno)
   1740{
   1741	link->config_flags |= CONF_AUTO_SET_IO;
   1742
   1743	/* read the config-tuples */
   1744	if (pcmcia_loop_config(link, cm4000_config_check, NULL))
   1745		goto cs_release;
   1746
   1747	if (pcmcia_enable_device(link))
   1748		goto cs_release;
   1749
   1750	return 0;
   1751
   1752cs_release:
   1753	cm4000_release(link);
   1754	return -ENODEV;
   1755}
   1756
   1757static int cm4000_suspend(struct pcmcia_device *link)
   1758{
   1759	struct cm4000_dev *dev;
   1760
   1761	dev = link->priv;
   1762	stop_monitor(dev);
   1763
   1764	return 0;
   1765}
   1766
   1767static int cm4000_resume(struct pcmcia_device *link)
   1768{
   1769	struct cm4000_dev *dev;
   1770
   1771	dev = link->priv;
   1772	if (link->open)
   1773		start_monitor(dev);
   1774
   1775	return 0;
   1776}
   1777
   1778static void cm4000_release(struct pcmcia_device *link)
   1779{
   1780	cmm_cm4000_release(link);	/* delay release until device closed */
   1781	pcmcia_disable_device(link);
   1782}
   1783
   1784static int cm4000_probe(struct pcmcia_device *link)
   1785{
   1786	struct cm4000_dev *dev;
   1787	int i, ret;
   1788
   1789	for (i = 0; i < CM4000_MAX_DEV; i++)
   1790		if (dev_table[i] == NULL)
   1791			break;
   1792
   1793	if (i == CM4000_MAX_DEV) {
   1794		printk(KERN_NOTICE MODULE_NAME ": all devices in use\n");
   1795		return -ENODEV;
   1796	}
   1797
   1798	/* create a new cm4000_cs device */
   1799	dev = kzalloc(sizeof(struct cm4000_dev), GFP_KERNEL);
   1800	if (dev == NULL)
   1801		return -ENOMEM;
   1802
   1803	dev->p_dev = link;
   1804	link->priv = dev;
   1805	dev_table[i] = link;
   1806
   1807	init_waitqueue_head(&dev->devq);
   1808	init_waitqueue_head(&dev->ioq);
   1809	init_waitqueue_head(&dev->atrq);
   1810	init_waitqueue_head(&dev->readq);
   1811
   1812	ret = cm4000_config(link, i);
   1813	if (ret) {
   1814		dev_table[i] = NULL;
   1815		kfree(dev);
   1816		return ret;
   1817	}
   1818
   1819	device_create(cmm_class, NULL, MKDEV(major, i), NULL, "cmm%d", i);
   1820
   1821	return 0;
   1822}
   1823
   1824static void cm4000_detach(struct pcmcia_device *link)
   1825{
   1826	struct cm4000_dev *dev = link->priv;
   1827	int devno;
   1828
   1829	/* find device */
   1830	for (devno = 0; devno < CM4000_MAX_DEV; devno++)
   1831		if (dev_table[devno] == link)
   1832			break;
   1833	if (devno == CM4000_MAX_DEV)
   1834		return;
   1835
   1836	stop_monitor(dev);
   1837
   1838	cm4000_release(link);
   1839
   1840	dev_table[devno] = NULL;
   1841	kfree(dev);
   1842
   1843	device_destroy(cmm_class, MKDEV(major, devno));
   1844
   1845	return;
   1846}
   1847
   1848static const struct file_operations cm4000_fops = {
   1849	.owner	= THIS_MODULE,
   1850	.read	= cmm_read,
   1851	.write	= cmm_write,
   1852	.unlocked_ioctl	= cmm_ioctl,
   1853	.open	= cmm_open,
   1854	.release= cmm_close,
   1855	.llseek = no_llseek,
   1856};
   1857
   1858static const struct pcmcia_device_id cm4000_ids[] = {
   1859	PCMCIA_DEVICE_MANF_CARD(0x0223, 0x0002),
   1860	PCMCIA_DEVICE_PROD_ID12("CardMan", "4000", 0x2FB368CA, 0xA2BD8C39),
   1861	PCMCIA_DEVICE_NULL,
   1862};
   1863MODULE_DEVICE_TABLE(pcmcia, cm4000_ids);
   1864
   1865static struct pcmcia_driver cm4000_driver = {
   1866	.owner	  = THIS_MODULE,
   1867	.name	  = "cm4000_cs",
   1868	.probe    = cm4000_probe,
   1869	.remove   = cm4000_detach,
   1870	.suspend  = cm4000_suspend,
   1871	.resume   = cm4000_resume,
   1872	.id_table = cm4000_ids,
   1873};
   1874
   1875static int __init cmm_init(void)
   1876{
   1877	int rc;
   1878
   1879	cmm_class = class_create(THIS_MODULE, "cardman_4000");
   1880	if (IS_ERR(cmm_class))
   1881		return PTR_ERR(cmm_class);
   1882
   1883	major = register_chrdev(0, DEVICE_NAME, &cm4000_fops);
   1884	if (major < 0) {
   1885		printk(KERN_WARNING MODULE_NAME
   1886			": could not get major number\n");
   1887		class_destroy(cmm_class);
   1888		return major;
   1889	}
   1890
   1891	rc = pcmcia_register_driver(&cm4000_driver);
   1892	if (rc < 0) {
   1893		unregister_chrdev(major, DEVICE_NAME);
   1894		class_destroy(cmm_class);
   1895		return rc;
   1896	}
   1897
   1898	return 0;
   1899}
   1900
   1901static void __exit cmm_exit(void)
   1902{
   1903	pcmcia_unregister_driver(&cm4000_driver);
   1904	unregister_chrdev(major, DEVICE_NAME);
   1905	class_destroy(cmm_class);
   1906};
   1907
   1908module_init(cmm_init);
   1909module_exit(cmm_exit);
   1910MODULE_LICENSE("Dual BSD/GPL");