1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Device probing and sysfs code.
4  *
5  * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
6  */
7 
8 #include <linux/bug.h>
9 #include <linux/ctype.h>
10 #include <linux/delay.h>
11 #include <linux/device.h>
12 #include <linux/errno.h>
13 #include <linux/firewire.h>
14 #include <linux/firewire-constants.h>
15 #include <linux/idr.h>
16 #include <linux/jiffies.h>
17 #include <linux/kobject.h>
18 #include <linux/list.h>
19 #include <linux/mod_devicetable.h>
20 #include <linux/module.h>
21 #include <linux/mutex.h>
22 #include <linux/random.h>
23 #include <linux/rwsem.h>
24 #include <linux/slab.h>
25 #include <linux/spinlock.h>
26 #include <linux/string.h>
27 #include <linux/workqueue.h>
28 
29 #include <linux/atomic.h>
30 #include <asm/byteorder.h>
31 
32 #include "core.h"
33 
34 void fw_csr_iterator_init(struct fw_csr_iterator *ci, const u32 *p)
35 {
36 	ci->p = p + 1;
37 	ci->end = ci->p + (p[0] >> 16);
38 }
39 EXPORT_SYMBOL(fw_csr_iterator_init);
40 
41 int fw_csr_iterator_next(struct fw_csr_iterator *ci, int *key, int *value)
42 {
43 	*key = *ci->p >> 24;
44 	*value = *ci->p & 0xffffff;
45 
46 	return ci->p++ < ci->end;
47 }
48 EXPORT_SYMBOL(fw_csr_iterator_next);
49 
50 static const u32 *search_leaf(const u32 *directory, int search_key)
51 {
52 	struct fw_csr_iterator ci;
53 	int last_key = 0, key, value;
54 
55 	fw_csr_iterator_init(&ci, directory);
56 	while (fw_csr_iterator_next(&ci, &key, &value)) {
57 		if (last_key == search_key &&
58 		    key == (CSR_DESCRIPTOR | CSR_LEAF))
59 			return ci.p - 1 + value;
60 
61 		last_key = key;
62 	}
63 
64 	return NULL;
65 }
66 
67 static int textual_leaf_to_string(const u32 *block, char *buf, size_t size)
68 {
69 	unsigned int quadlets, i;
70 	char c;
71 
72 	if (!size || !buf)
73 		return -EINVAL;
74 
75 	quadlets = min(block[0] >> 16, 256U);
76 	if (quadlets < 2)
77 		return -ENODATA;
78 
79 	if (block[1] != 0 || block[2] != 0)
80 		/* unknown language/character set */
81 		return -ENODATA;
82 
83 	block += 3;
84 	quadlets -= 2;
85 	for (i = 0; i < quadlets * 4 && i < size - 1; i++) {
86 		c = block[i / 4] >> (24 - 8 * (i % 4));
87 		if (c == '\0')
88 			break;
89 		buf[i] = c;
90 	}
91 	buf[i] = '\0';
92 
93 	return i;
94 }
95 
96 /**
97  * fw_csr_string() - reads a string from the configuration ROM
98  * @directory:	e.g. root directory or unit directory
99  * @key:	the key of the preceding directory entry
100  * @buf:	where to put the string
101  * @size:	size of @buf, in bytes
102  *
103  * The string is taken from a minimal ASCII text descriptor leaf just after the entry with the
104  * @key. The string is zero-terminated. An overlong string is silently truncated such that it
105  * and the zero byte fit into @size.
106  *
107  * Returns strlen(buf) or a negative error code.
108  */
109 int fw_csr_string(const u32 *directory, int key, char *buf, size_t size)
110 {
111 	const u32 *leaf = search_leaf(directory, key);
112 	if (!leaf)
113 		return -ENOENT;
114 
115 	return textual_leaf_to_string(leaf, buf, size);
116 }
117 EXPORT_SYMBOL(fw_csr_string);
118 
119 static void get_ids(const u32 *directory, int *id)
120 {
121 	struct fw_csr_iterator ci;
122 	int key, value;
123 
124 	fw_csr_iterator_init(&ci, directory);
125 	while (fw_csr_iterator_next(&ci, &key, &value)) {
126 		switch (key) {
127 		case CSR_VENDOR:	id[0] = value; break;
128 		case CSR_MODEL:		id[1] = value; break;
129 		case CSR_SPECIFIER_ID:	id[2] = value; break;
130 		case CSR_VERSION:	id[3] = value; break;
131 		}
132 	}
133 }
134 
135 static void get_modalias_ids(const struct fw_unit *unit, int *id)
136 {
137 	get_ids(&fw_parent_device(unit)->config_rom[5], id);
138 	get_ids(unit->directory, id);
139 }
140 
141 static bool match_ids(const struct ieee1394_device_id *id_table, int *id)
142 {
143 	int match = 0;
144 
145 	if (id[0] == id_table->vendor_id)
146 		match |= IEEE1394_MATCH_VENDOR_ID;
147 	if (id[1] == id_table->model_id)
148 		match |= IEEE1394_MATCH_MODEL_ID;
149 	if (id[2] == id_table->specifier_id)
150 		match |= IEEE1394_MATCH_SPECIFIER_ID;
151 	if (id[3] == id_table->version)
152 		match |= IEEE1394_MATCH_VERSION;
153 
154 	return (match & id_table->match_flags) == id_table->match_flags;
155 }
156 
157 static const struct ieee1394_device_id *unit_match(struct device *dev,
158 						   struct device_driver *drv)
159 {
160 	const struct ieee1394_device_id *id_table =
161 			container_of(drv, struct fw_driver, driver)->id_table;
162 	int id[] = {0, 0, 0, 0};
163 
164 	get_modalias_ids(fw_unit(dev), id);
165 
166 	for (; id_table->match_flags != 0; id_table++)
167 		if (match_ids(id_table, id))
168 			return id_table;
169 
170 	return NULL;
171 }
172 
173 static bool is_fw_unit(struct device *dev);
174 
175 static int fw_unit_match(struct device *dev, struct device_driver *drv)
176 {
177 	/* We only allow binding to fw_units. */
178 	return is_fw_unit(dev) && unit_match(dev, drv) != NULL;
179 }
180 
181 static int fw_unit_probe(struct device *dev)
182 {
183 	struct fw_driver *driver =
184 			container_of(dev->driver, struct fw_driver, driver);
185 
186 	return driver->probe(fw_unit(dev), unit_match(dev, dev->driver));
187 }
188 
189 static void fw_unit_remove(struct device *dev)
190 {
191 	struct fw_driver *driver =
192 			container_of(dev->driver, struct fw_driver, driver);
193 
194 	driver->remove(fw_unit(dev));
195 }
196 
197 static int get_modalias(const struct fw_unit *unit, char *buffer, size_t buffer_size)
198 {
199 	int id[] = {0, 0, 0, 0};
200 
201 	get_modalias_ids(unit, id);
202 
203 	return snprintf(buffer, buffer_size,
204 			"ieee1394:ven%08Xmo%08Xsp%08Xver%08X",
205 			id[0], id[1], id[2], id[3]);
206 }
207 
208 static int fw_unit_uevent(const struct device *dev, struct kobj_uevent_env *env)
209 {
210 	const struct fw_unit *unit = fw_unit(dev);
211 	char modalias[64];
212 
213 	get_modalias(unit, modalias, sizeof(modalias));
214 
215 	if (add_uevent_var(env, "MODALIAS=%s", modalias))
216 		return -ENOMEM;
217 
218 	return 0;
219 }
220 
221 struct bus_type fw_bus_type = {
222 	.name = "firewire",
223 	.match = fw_unit_match,
224 	.probe = fw_unit_probe,
225 	.remove = fw_unit_remove,
226 };
227 EXPORT_SYMBOL(fw_bus_type);
228 
229 int fw_device_enable_phys_dma(struct fw_device *device)
230 {
231 	int generation = device->generation;
232 
233 	/* device->node_id, accessed below, must not be older than generation */
234 	smp_rmb();
235 
236 	return device->card->driver->enable_phys_dma(device->card,
237 						     device->node_id,
238 						     generation);
239 }
240 EXPORT_SYMBOL(fw_device_enable_phys_dma);
241 
242 struct config_rom_attribute {
243 	struct device_attribute attr;
244 	u32 key;
245 };
246 
247 static ssize_t show_immediate(struct device *dev,
248 			      struct device_attribute *dattr, char *buf)
249 {
250 	struct config_rom_attribute *attr =
251 		container_of(dattr, struct config_rom_attribute, attr);
252 	struct fw_csr_iterator ci;
253 	const u32 *dir;
254 	int key, value, ret = -ENOENT;
255 
256 	down_read(&fw_device_rwsem);
257 
258 	if (is_fw_unit(dev))
259 		dir = fw_unit(dev)->directory;
260 	else
261 		dir = fw_device(dev)->config_rom + 5;
262 
263 	fw_csr_iterator_init(&ci, dir);
264 	while (fw_csr_iterator_next(&ci, &key, &value))
265 		if (attr->key == key) {
266 			ret = snprintf(buf, buf ? PAGE_SIZE : 0,
267 				       "0x%06x\n", value);
268 			break;
269 		}
270 
271 	up_read(&fw_device_rwsem);
272 
273 	return ret;
274 }
275 
276 #define IMMEDIATE_ATTR(name, key)				\
277 	{ __ATTR(name, S_IRUGO, show_immediate, NULL), key }
278 
279 static ssize_t show_text_leaf(struct device *dev,
280 			      struct device_attribute *dattr, char *buf)
281 {
282 	struct config_rom_attribute *attr =
283 		container_of(dattr, struct config_rom_attribute, attr);
284 	const u32 *dir;
285 	size_t bufsize;
286 	char dummy_buf[2];
287 	int ret;
288 
289 	down_read(&fw_device_rwsem);
290 
291 	if (is_fw_unit(dev))
292 		dir = fw_unit(dev)->directory;
293 	else
294 		dir = fw_device(dev)->config_rom + 5;
295 
296 	if (buf) {
297 		bufsize = PAGE_SIZE - 1;
298 	} else {
299 		buf = dummy_buf;
300 		bufsize = 1;
301 	}
302 
303 	ret = fw_csr_string(dir, attr->key, buf, bufsize);
304 
305 	if (ret >= 0) {
306 		/* Strip trailing whitespace and add newline. */
307 		while (ret > 0 && isspace(buf[ret - 1]))
308 			ret--;
309 		strcpy(buf + ret, "\n");
310 		ret++;
311 	}
312 
313 	up_read(&fw_device_rwsem);
314 
315 	return ret;
316 }
317 
318 #define TEXT_LEAF_ATTR(name, key)				\
319 	{ __ATTR(name, S_IRUGO, show_text_leaf, NULL), key }
320 
321 static struct config_rom_attribute config_rom_attributes[] = {
322 	IMMEDIATE_ATTR(vendor, CSR_VENDOR),
323 	IMMEDIATE_ATTR(hardware_version, CSR_HARDWARE_VERSION),
324 	IMMEDIATE_ATTR(specifier_id, CSR_SPECIFIER_ID),
325 	IMMEDIATE_ATTR(version, CSR_VERSION),
326 	IMMEDIATE_ATTR(model, CSR_MODEL),
327 	TEXT_LEAF_ATTR(vendor_name, CSR_VENDOR),
328 	TEXT_LEAF_ATTR(model_name, CSR_MODEL),
329 	TEXT_LEAF_ATTR(hardware_version_name, CSR_HARDWARE_VERSION),
330 };
331 
332 static void init_fw_attribute_group(struct device *dev,
333 				    struct device_attribute *attrs,
334 				    struct fw_attribute_group *group)
335 {
336 	struct device_attribute *attr;
337 	int i, j;
338 
339 	for (j = 0; attrs[j].attr.name != NULL; j++)
340 		group->attrs[j] = &attrs[j].attr;
341 
342 	for (i = 0; i < ARRAY_SIZE(config_rom_attributes); i++) {
343 		attr = &config_rom_attributes[i].attr;
344 		if (attr->show(dev, attr, NULL) < 0)
345 			continue;
346 		group->attrs[j++] = &attr->attr;
347 	}
348 
349 	group->attrs[j] = NULL;
350 	group->groups[0] = &group->group;
351 	group->groups[1] = NULL;
352 	group->group.attrs = group->attrs;
353 	dev->groups = (const struct attribute_group **) group->groups;
354 }
355 
356 static ssize_t modalias_show(struct device *dev,
357 			     struct device_attribute *attr, char *buf)
358 {
359 	struct fw_unit *unit = fw_unit(dev);
360 	int length;
361 
362 	length = get_modalias(unit, buf, PAGE_SIZE);
363 	strcpy(buf + length, "\n");
364 
365 	return length + 1;
366 }
367 
368 static ssize_t rom_index_show(struct device *dev,
369 			      struct device_attribute *attr, char *buf)
370 {
371 	struct fw_device *device = fw_device(dev->parent);
372 	struct fw_unit *unit = fw_unit(dev);
373 
374 	return sysfs_emit(buf, "%td\n", unit->directory - device->config_rom);
375 }
376 
377 static struct device_attribute fw_unit_attributes[] = {
378 	__ATTR_RO(modalias),
379 	__ATTR_RO(rom_index),
380 	__ATTR_NULL,
381 };
382 
383 static ssize_t config_rom_show(struct device *dev,
384 			       struct device_attribute *attr, char *buf)
385 {
386 	struct fw_device *device = fw_device(dev);
387 	size_t length;
388 
389 	down_read(&fw_device_rwsem);
390 	length = device->config_rom_length * 4;
391 	memcpy(buf, device->config_rom, length);
392 	up_read(&fw_device_rwsem);
393 
394 	return length;
395 }
396 
397 static ssize_t guid_show(struct device *dev,
398 			 struct device_attribute *attr, char *buf)
399 {
400 	struct fw_device *device = fw_device(dev);
401 	int ret;
402 
403 	down_read(&fw_device_rwsem);
404 	ret = sysfs_emit(buf, "0x%08x%08x\n", device->config_rom[3], device->config_rom[4]);
405 	up_read(&fw_device_rwsem);
406 
407 	return ret;
408 }
409 
410 static ssize_t is_local_show(struct device *dev,
411 			     struct device_attribute *attr, char *buf)
412 {
413 	struct fw_device *device = fw_device(dev);
414 
415 	return sprintf(buf, "%u\n", device->is_local);
416 }
417 
418 static int units_sprintf(char *buf, const u32 *directory)
419 {
420 	struct fw_csr_iterator ci;
421 	int key, value;
422 	int specifier_id = 0;
423 	int version = 0;
424 
425 	fw_csr_iterator_init(&ci, directory);
426 	while (fw_csr_iterator_next(&ci, &key, &value)) {
427 		switch (key) {
428 		case CSR_SPECIFIER_ID:
429 			specifier_id = value;
430 			break;
431 		case CSR_VERSION:
432 			version = value;
433 			break;
434 		}
435 	}
436 
437 	return sprintf(buf, "0x%06x:0x%06x ", specifier_id, version);
438 }
439 
440 static ssize_t units_show(struct device *dev,
441 			  struct device_attribute *attr, char *buf)
442 {
443 	struct fw_device *device = fw_device(dev);
444 	struct fw_csr_iterator ci;
445 	int key, value, i = 0;
446 
447 	down_read(&fw_device_rwsem);
448 	fw_csr_iterator_init(&ci, &device->config_rom[5]);
449 	while (fw_csr_iterator_next(&ci, &key, &value)) {
450 		if (key != (CSR_UNIT | CSR_DIRECTORY))
451 			continue;
452 		i += units_sprintf(&buf[i], ci.p + value - 1);
453 		if (i >= PAGE_SIZE - (8 + 1 + 8 + 1))
454 			break;
455 	}
456 	up_read(&fw_device_rwsem);
457 
458 	if (i)
459 		buf[i - 1] = '\n';
460 
461 	return i;
462 }
463 
464 static struct device_attribute fw_device_attributes[] = {
465 	__ATTR_RO(config_rom),
466 	__ATTR_RO(guid),
467 	__ATTR_RO(is_local),
468 	__ATTR_RO(units),
469 	__ATTR_NULL,
470 };
471 
472 static int read_rom(struct fw_device *device,
473 		    int generation, int index, u32 *data)
474 {
475 	u64 offset = (CSR_REGISTER_BASE | CSR_CONFIG_ROM) + index * 4;
476 	int i, rcode;
477 
478 	/* device->node_id, accessed below, must not be older than generation */
479 	smp_rmb();
480 
481 	for (i = 10; i < 100; i += 10) {
482 		rcode = fw_run_transaction(device->card,
483 				TCODE_READ_QUADLET_REQUEST, device->node_id,
484 				generation, device->max_speed, offset, data, 4);
485 		if (rcode != RCODE_BUSY)
486 			break;
487 		msleep(i);
488 	}
489 	be32_to_cpus(data);
490 
491 	return rcode;
492 }
493 
494 #define MAX_CONFIG_ROM_SIZE 256
495 
496 /*
497  * Read the bus info block, perform a speed probe, and read all of the rest of
498  * the config ROM.  We do all this with a cached bus generation.  If the bus
499  * generation changes under us, read_config_rom will fail and get retried.
500  * It's better to start all over in this case because the node from which we
501  * are reading the ROM may have changed the ROM during the reset.
502  * Returns either a result code or a negative error code.
503  */
504 static int read_config_rom(struct fw_device *device, int generation)
505 {
506 	struct fw_card *card = device->card;
507 	const u32 *old_rom, *new_rom;
508 	u32 *rom, *stack;
509 	u32 sp, key;
510 	int i, end, length, ret;
511 
512 	rom = kmalloc(sizeof(*rom) * MAX_CONFIG_ROM_SIZE +
513 		      sizeof(*stack) * MAX_CONFIG_ROM_SIZE, GFP_KERNEL);
514 	if (rom == NULL)
515 		return -ENOMEM;
516 
517 	stack = &rom[MAX_CONFIG_ROM_SIZE];
518 	memset(rom, 0, sizeof(*rom) * MAX_CONFIG_ROM_SIZE);
519 
520 	device->max_speed = SCODE_100;
521 
522 	/* First read the bus info block. */
523 	for (i = 0; i < 5; i++) {
524 		ret = read_rom(device, generation, i, &rom[i]);
525 		if (ret != RCODE_COMPLETE)
526 			goto out;
527 		/*
528 		 * As per IEEE1212 7.2, during initialization, devices can
529 		 * reply with a 0 for the first quadlet of the config
530 		 * rom to indicate that they are booting (for example,
531 		 * if the firmware is on the disk of a external
532 		 * harddisk).  In that case we just fail, and the
533 		 * retry mechanism will try again later.
534 		 */
535 		if (i == 0 && rom[i] == 0) {
536 			ret = RCODE_BUSY;
537 			goto out;
538 		}
539 	}
540 
541 	device->max_speed = device->node->max_speed;
542 
543 	/*
544 	 * Determine the speed of
545 	 *   - devices with link speed less than PHY speed,
546 	 *   - devices with 1394b PHY (unless only connected to 1394a PHYs),
547 	 *   - all devices if there are 1394b repeaters.
548 	 * Note, we cannot use the bus info block's link_spd as starting point
549 	 * because some buggy firmwares set it lower than necessary and because
550 	 * 1394-1995 nodes do not have the field.
551 	 */
552 	if ((rom[2] & 0x7) < device->max_speed ||
553 	    device->max_speed == SCODE_BETA ||
554 	    card->beta_repeaters_present) {
555 		u32 dummy;
556 
557 		/* for S1600 and S3200 */
558 		if (device->max_speed == SCODE_BETA)
559 			device->max_speed = card->link_speed;
560 
561 		while (device->max_speed > SCODE_100) {
562 			if (read_rom(device, generation, 0, &dummy) ==
563 			    RCODE_COMPLETE)
564 				break;
565 			device->max_speed--;
566 		}
567 	}
568 
569 	/*
570 	 * Now parse the config rom.  The config rom is a recursive
571 	 * directory structure so we parse it using a stack of
572 	 * references to the blocks that make up the structure.  We
573 	 * push a reference to the root directory on the stack to
574 	 * start things off.
575 	 */
576 	length = i;
577 	sp = 0;
578 	stack[sp++] = 0xc0000005;
579 	while (sp > 0) {
580 		/*
581 		 * Pop the next block reference of the stack.  The
582 		 * lower 24 bits is the offset into the config rom,
583 		 * the upper 8 bits are the type of the reference the
584 		 * block.
585 		 */
586 		key = stack[--sp];
587 		i = key & 0xffffff;
588 		if (WARN_ON(i >= MAX_CONFIG_ROM_SIZE)) {
589 			ret = -ENXIO;
590 			goto out;
591 		}
592 
593 		/* Read header quadlet for the block to get the length. */
594 		ret = read_rom(device, generation, i, &rom[i]);
595 		if (ret != RCODE_COMPLETE)
596 			goto out;
597 		end = i + (rom[i] >> 16) + 1;
598 		if (end > MAX_CONFIG_ROM_SIZE) {
599 			/*
600 			 * This block extends outside the config ROM which is
601 			 * a firmware bug.  Ignore this whole block, i.e.
602 			 * simply set a fake block length of 0.
603 			 */
604 			fw_err(card, "skipped invalid ROM block %x at %llx\n",
605 			       rom[i],
606 			       i * 4 | CSR_REGISTER_BASE | CSR_CONFIG_ROM);
607 			rom[i] = 0;
608 			end = i;
609 		}
610 		i++;
611 
612 		/*
613 		 * Now read in the block.  If this is a directory
614 		 * block, check the entries as we read them to see if
615 		 * it references another block, and push it in that case.
616 		 */
617 		for (; i < end; i++) {
618 			ret = read_rom(device, generation, i, &rom[i]);
619 			if (ret != RCODE_COMPLETE)
620 				goto out;
621 
622 			if ((key >> 30) != 3 || (rom[i] >> 30) < 2)
623 				continue;
624 			/*
625 			 * Offset points outside the ROM.  May be a firmware
626 			 * bug or an Extended ROM entry (IEEE 1212-2001 clause
627 			 * 7.7.18).  Simply overwrite this pointer here by a
628 			 * fake immediate entry so that later iterators over
629 			 * the ROM don't have to check offsets all the time.
630 			 */
631 			if (i + (rom[i] & 0xffffff) >= MAX_CONFIG_ROM_SIZE) {
632 				fw_err(card,
633 				       "skipped unsupported ROM entry %x at %llx\n",
634 				       rom[i],
635 				       i * 4 | CSR_REGISTER_BASE | CSR_CONFIG_ROM);
636 				rom[i] = 0;
637 				continue;
638 			}
639 			stack[sp++] = i + rom[i];
640 		}
641 		if (length < i)
642 			length = i;
643 	}
644 
645 	old_rom = device->config_rom;
646 	new_rom = kmemdup(rom, length * 4, GFP_KERNEL);
647 	if (new_rom == NULL) {
648 		ret = -ENOMEM;
649 		goto out;
650 	}
651 
652 	down_write(&fw_device_rwsem);
653 	device->config_rom = new_rom;
654 	device->config_rom_length = length;
655 	up_write(&fw_device_rwsem);
656 
657 	kfree(old_rom);
658 	ret = RCODE_COMPLETE;
659 	device->max_rec	= rom[2] >> 12 & 0xf;
660 	device->cmc	= rom[2] >> 30 & 1;
661 	device->irmc	= rom[2] >> 31 & 1;
662  out:
663 	kfree(rom);
664 
665 	return ret;
666 }
667 
668 static void fw_unit_release(struct device *dev)
669 {
670 	struct fw_unit *unit = fw_unit(dev);
671 
672 	fw_device_put(fw_parent_device(unit));
673 	kfree(unit);
674 }
675 
676 static struct device_type fw_unit_type = {
677 	.uevent		= fw_unit_uevent,
678 	.release	= fw_unit_release,
679 };
680 
681 static bool is_fw_unit(struct device *dev)
682 {
683 	return dev->type == &fw_unit_type;
684 }
685 
686 static void create_units(struct fw_device *device)
687 {
688 	struct fw_csr_iterator ci;
689 	struct fw_unit *unit;
690 	int key, value, i;
691 
692 	i = 0;
693 	fw_csr_iterator_init(&ci, &device->config_rom[5]);
694 	while (fw_csr_iterator_next(&ci, &key, &value)) {
695 		if (key != (CSR_UNIT | CSR_DIRECTORY))
696 			continue;
697 
698 		/*
699 		 * Get the address of the unit directory and try to
700 		 * match the drivers id_tables against it.
701 		 */
702 		unit = kzalloc(sizeof(*unit), GFP_KERNEL);
703 		if (unit == NULL)
704 			continue;
705 
706 		unit->directory = ci.p + value - 1;
707 		unit->device.bus = &fw_bus_type;
708 		unit->device.type = &fw_unit_type;
709 		unit->device.parent = &device->device;
710 		dev_set_name(&unit->device, "%s.%d", dev_name(&device->device), i++);
711 
712 		BUILD_BUG_ON(ARRAY_SIZE(unit->attribute_group.attrs) <
713 				ARRAY_SIZE(fw_unit_attributes) +
714 				ARRAY_SIZE(config_rom_attributes));
715 		init_fw_attribute_group(&unit->device,
716 					fw_unit_attributes,
717 					&unit->attribute_group);
718 
719 		fw_device_get(device);
720 		if (device_register(&unit->device) < 0) {
721 			put_device(&unit->device);
722 			continue;
723 		}
724 	}
725 }
726 
727 static int shutdown_unit(struct device *device, void *data)
728 {
729 	device_unregister(device);
730 
731 	return 0;
732 }
733 
734 /*
735  * fw_device_rwsem acts as dual purpose mutex:
736  *   - serializes accesses to fw_device_idr,
737  *   - serializes accesses to fw_device.config_rom/.config_rom_length and
738  *     fw_unit.directory, unless those accesses happen at safe occasions
739  */
740 DECLARE_RWSEM(fw_device_rwsem);
741 
742 DEFINE_IDR(fw_device_idr);
743 int fw_cdev_major;
744 
745 struct fw_device *fw_device_get_by_devt(dev_t devt)
746 {
747 	struct fw_device *device;
748 
749 	down_read(&fw_device_rwsem);
750 	device = idr_find(&fw_device_idr, MINOR(devt));
751 	if (device)
752 		fw_device_get(device);
753 	up_read(&fw_device_rwsem);
754 
755 	return device;
756 }
757 
758 struct workqueue_struct *fw_workqueue;
759 EXPORT_SYMBOL(fw_workqueue);
760 
761 static void fw_schedule_device_work(struct fw_device *device,
762 				    unsigned long delay)
763 {
764 	queue_delayed_work(fw_workqueue, &device->work, delay);
765 }
766 
767 /*
768  * These defines control the retry behavior for reading the config
769  * rom.  It shouldn't be necessary to tweak these; if the device
770  * doesn't respond to a config rom read within 10 seconds, it's not
771  * going to respond at all.  As for the initial delay, a lot of
772  * devices will be able to respond within half a second after bus
773  * reset.  On the other hand, it's not really worth being more
774  * aggressive than that, since it scales pretty well; if 10 devices
775  * are plugged in, they're all getting read within one second.
776  */
777 
778 #define MAX_RETRIES	10
779 #define RETRY_DELAY	(3 * HZ)
780 #define INITIAL_DELAY	(HZ / 2)
781 #define SHUTDOWN_DELAY	(2 * HZ)
782 
783 static void fw_device_shutdown(struct work_struct *work)
784 {
785 	struct fw_device *device =
786 		container_of(work, struct fw_device, work.work);
787 	int minor = MINOR(device->device.devt);
788 
789 	if (time_before64(get_jiffies_64(),
790 			  device->card->reset_jiffies + SHUTDOWN_DELAY)
791 	    && !list_empty(&device->card->link)) {
792 		fw_schedule_device_work(device, SHUTDOWN_DELAY);
793 		return;
794 	}
795 
796 	if (atomic_cmpxchg(&device->state,
797 			   FW_DEVICE_GONE,
798 			   FW_DEVICE_SHUTDOWN) != FW_DEVICE_GONE)
799 		return;
800 
801 	fw_device_cdev_remove(device);
802 	device_for_each_child(&device->device, NULL, shutdown_unit);
803 	device_unregister(&device->device);
804 
805 	down_write(&fw_device_rwsem);
806 	idr_remove(&fw_device_idr, minor);
807 	up_write(&fw_device_rwsem);
808 
809 	fw_device_put(device);
810 }
811 
812 static void fw_device_release(struct device *dev)
813 {
814 	struct fw_device *device = fw_device(dev);
815 	struct fw_card *card = device->card;
816 	unsigned long flags;
817 
818 	/*
819 	 * Take the card lock so we don't set this to NULL while a
820 	 * FW_NODE_UPDATED callback is being handled or while the
821 	 * bus manager work looks at this node.
822 	 */
823 	spin_lock_irqsave(&card->lock, flags);
824 	device->node->data = NULL;
825 	spin_unlock_irqrestore(&card->lock, flags);
826 
827 	fw_node_put(device->node);
828 	kfree(device->config_rom);
829 	kfree(device);
830 	fw_card_put(card);
831 }
832 
833 static struct device_type fw_device_type = {
834 	.release = fw_device_release,
835 };
836 
837 static bool is_fw_device(struct device *dev)
838 {
839 	return dev->type == &fw_device_type;
840 }
841 
842 static int update_unit(struct device *dev, void *data)
843 {
844 	struct fw_unit *unit = fw_unit(dev);
845 	struct fw_driver *driver = (struct fw_driver *)dev->driver;
846 
847 	if (is_fw_unit(dev) && driver != NULL && driver->update != NULL) {
848 		device_lock(dev);
849 		driver->update(unit);
850 		device_unlock(dev);
851 	}
852 
853 	return 0;
854 }
855 
856 static void fw_device_update(struct work_struct *work)
857 {
858 	struct fw_device *device =
859 		container_of(work, struct fw_device, work.work);
860 
861 	fw_device_cdev_update(device);
862 	device_for_each_child(&device->device, NULL, update_unit);
863 }
864 
865 /*
866  * If a device was pending for deletion because its node went away but its
867  * bus info block and root directory header matches that of a newly discovered
868  * device, revive the existing fw_device.
869  * The newly allocated fw_device becomes obsolete instead.
870  */
871 static int lookup_existing_device(struct device *dev, void *data)
872 {
873 	struct fw_device *old = fw_device(dev);
874 	struct fw_device *new = data;
875 	struct fw_card *card = new->card;
876 	int match = 0;
877 
878 	if (!is_fw_device(dev))
879 		return 0;
880 
881 	down_read(&fw_device_rwsem); /* serialize config_rom access */
882 	spin_lock_irq(&card->lock);  /* serialize node access */
883 
884 	if (memcmp(old->config_rom, new->config_rom, 6 * 4) == 0 &&
885 	    atomic_cmpxchg(&old->state,
886 			   FW_DEVICE_GONE,
887 			   FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
888 		struct fw_node *current_node = new->node;
889 		struct fw_node *obsolete_node = old->node;
890 
891 		new->node = obsolete_node;
892 		new->node->data = new;
893 		old->node = current_node;
894 		old->node->data = old;
895 
896 		old->max_speed = new->max_speed;
897 		old->node_id = current_node->node_id;
898 		smp_wmb();  /* update node_id before generation */
899 		old->generation = card->generation;
900 		old->config_rom_retries = 0;
901 		fw_notice(card, "rediscovered device %s\n", dev_name(dev));
902 
903 		old->workfn = fw_device_update;
904 		fw_schedule_device_work(old, 0);
905 
906 		if (current_node == card->root_node)
907 			fw_schedule_bm_work(card, 0);
908 
909 		match = 1;
910 	}
911 
912 	spin_unlock_irq(&card->lock);
913 	up_read(&fw_device_rwsem);
914 
915 	return match;
916 }
917 
918 enum { BC_UNKNOWN = 0, BC_UNIMPLEMENTED, BC_IMPLEMENTED, };
919 
920 static void set_broadcast_channel(struct fw_device *device, int generation)
921 {
922 	struct fw_card *card = device->card;
923 	__be32 data;
924 	int rcode;
925 
926 	if (!card->broadcast_channel_allocated)
927 		return;
928 
929 	/*
930 	 * The Broadcast_Channel Valid bit is required by nodes which want to
931 	 * transmit on this channel.  Such transmissions are practically
932 	 * exclusive to IP over 1394 (RFC 2734).  IP capable nodes are required
933 	 * to be IRM capable and have a max_rec of 8 or more.  We use this fact
934 	 * to narrow down to which nodes we send Broadcast_Channel updates.
935 	 */
936 	if (!device->irmc || device->max_rec < 8)
937 		return;
938 
939 	/*
940 	 * Some 1394-1995 nodes crash if this 1394a-2000 register is written.
941 	 * Perform a read test first.
942 	 */
943 	if (device->bc_implemented == BC_UNKNOWN) {
944 		rcode = fw_run_transaction(card, TCODE_READ_QUADLET_REQUEST,
945 				device->node_id, generation, device->max_speed,
946 				CSR_REGISTER_BASE + CSR_BROADCAST_CHANNEL,
947 				&data, 4);
948 		switch (rcode) {
949 		case RCODE_COMPLETE:
950 			if (data & cpu_to_be32(1 << 31)) {
951 				device->bc_implemented = BC_IMPLEMENTED;
952 				break;
953 			}
954 			fallthrough;	/* to case address error */
955 		case RCODE_ADDRESS_ERROR:
956 			device->bc_implemented = BC_UNIMPLEMENTED;
957 		}
958 	}
959 
960 	if (device->bc_implemented == BC_IMPLEMENTED) {
961 		data = cpu_to_be32(BROADCAST_CHANNEL_INITIAL |
962 				   BROADCAST_CHANNEL_VALID);
963 		fw_run_transaction(card, TCODE_WRITE_QUADLET_REQUEST,
964 				device->node_id, generation, device->max_speed,
965 				CSR_REGISTER_BASE + CSR_BROADCAST_CHANNEL,
966 				&data, 4);
967 	}
968 }
969 
970 int fw_device_set_broadcast_channel(struct device *dev, void *gen)
971 {
972 	if (is_fw_device(dev))
973 		set_broadcast_channel(fw_device(dev), (long)gen);
974 
975 	return 0;
976 }
977 
978 static void fw_device_init(struct work_struct *work)
979 {
980 	struct fw_device *device =
981 		container_of(work, struct fw_device, work.work);
982 	struct fw_card *card = device->card;
983 	struct device *revived_dev;
984 	int minor, ret;
985 
986 	/*
987 	 * All failure paths here set node->data to NULL, so that we
988 	 * don't try to do device_for_each_child() on a kfree()'d
989 	 * device.
990 	 */
991 
992 	ret = read_config_rom(device, device->generation);
993 	if (ret != RCODE_COMPLETE) {
994 		if (device->config_rom_retries < MAX_RETRIES &&
995 		    atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
996 			device->config_rom_retries++;
997 			fw_schedule_device_work(device, RETRY_DELAY);
998 		} else {
999 			if (device->node->link_on)
1000 				fw_notice(card, "giving up on node %x: reading config rom failed: %s\n",
1001 					  device->node_id,
1002 					  fw_rcode_string(ret));
1003 			if (device->node == card->root_node)
1004 				fw_schedule_bm_work(card, 0);
1005 			fw_device_release(&device->device);
1006 		}
1007 		return;
1008 	}
1009 
1010 	revived_dev = device_find_child(card->device,
1011 					device, lookup_existing_device);
1012 	if (revived_dev) {
1013 		put_device(revived_dev);
1014 		fw_device_release(&device->device);
1015 
1016 		return;
1017 	}
1018 
1019 	device_initialize(&device->device);
1020 
1021 	fw_device_get(device);
1022 	down_write(&fw_device_rwsem);
1023 	minor = idr_alloc(&fw_device_idr, device, 0, 1 << MINORBITS,
1024 			GFP_KERNEL);
1025 	up_write(&fw_device_rwsem);
1026 
1027 	if (minor < 0)
1028 		goto error;
1029 
1030 	device->device.bus = &fw_bus_type;
1031 	device->device.type = &fw_device_type;
1032 	device->device.parent = card->device;
1033 	device->device.devt = MKDEV(fw_cdev_major, minor);
1034 	dev_set_name(&device->device, "fw%d", minor);
1035 
1036 	BUILD_BUG_ON(ARRAY_SIZE(device->attribute_group.attrs) <
1037 			ARRAY_SIZE(fw_device_attributes) +
1038 			ARRAY_SIZE(config_rom_attributes));
1039 	init_fw_attribute_group(&device->device,
1040 				fw_device_attributes,
1041 				&device->attribute_group);
1042 
1043 	if (device_add(&device->device)) {
1044 		fw_err(card, "failed to add device\n");
1045 		goto error_with_cdev;
1046 	}
1047 
1048 	create_units(device);
1049 
1050 	/*
1051 	 * Transition the device to running state.  If it got pulled
1052 	 * out from under us while we did the initialization work, we
1053 	 * have to shut down the device again here.  Normally, though,
1054 	 * fw_node_event will be responsible for shutting it down when
1055 	 * necessary.  We have to use the atomic cmpxchg here to avoid
1056 	 * racing with the FW_NODE_DESTROYED case in
1057 	 * fw_node_event().
1058 	 */
1059 	if (atomic_cmpxchg(&device->state,
1060 			   FW_DEVICE_INITIALIZING,
1061 			   FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
1062 		device->workfn = fw_device_shutdown;
1063 		fw_schedule_device_work(device, SHUTDOWN_DELAY);
1064 	} else {
1065 		fw_notice(card, "created device %s: GUID %08x%08x, S%d00\n",
1066 			  dev_name(&device->device),
1067 			  device->config_rom[3], device->config_rom[4],
1068 			  1 << device->max_speed);
1069 		device->config_rom_retries = 0;
1070 
1071 		set_broadcast_channel(device, device->generation);
1072 
1073 		add_device_randomness(&device->config_rom[3], 8);
1074 	}
1075 
1076 	/*
1077 	 * Reschedule the IRM work if we just finished reading the
1078 	 * root node config rom.  If this races with a bus reset we
1079 	 * just end up running the IRM work a couple of extra times -
1080 	 * pretty harmless.
1081 	 */
1082 	if (device->node == card->root_node)
1083 		fw_schedule_bm_work(card, 0);
1084 
1085 	return;
1086 
1087  error_with_cdev:
1088 	down_write(&fw_device_rwsem);
1089 	idr_remove(&fw_device_idr, minor);
1090 	up_write(&fw_device_rwsem);
1091  error:
1092 	fw_device_put(device);		/* fw_device_idr's reference */
1093 
1094 	put_device(&device->device);	/* our reference */
1095 }
1096 
1097 /* Reread and compare bus info block and header of root directory */
1098 static int reread_config_rom(struct fw_device *device, int generation,
1099 			     bool *changed)
1100 {
1101 	u32 q;
1102 	int i, rcode;
1103 
1104 	for (i = 0; i < 6; i++) {
1105 		rcode = read_rom(device, generation, i, &q);
1106 		if (rcode != RCODE_COMPLETE)
1107 			return rcode;
1108 
1109 		if (i == 0 && q == 0)
1110 			/* inaccessible (see read_config_rom); retry later */
1111 			return RCODE_BUSY;
1112 
1113 		if (q != device->config_rom[i]) {
1114 			*changed = true;
1115 			return RCODE_COMPLETE;
1116 		}
1117 	}
1118 
1119 	*changed = false;
1120 	return RCODE_COMPLETE;
1121 }
1122 
1123 static void fw_device_refresh(struct work_struct *work)
1124 {
1125 	struct fw_device *device =
1126 		container_of(work, struct fw_device, work.work);
1127 	struct fw_card *card = device->card;
1128 	int ret, node_id = device->node_id;
1129 	bool changed;
1130 
1131 	ret = reread_config_rom(device, device->generation, &changed);
1132 	if (ret != RCODE_COMPLETE)
1133 		goto failed_config_rom;
1134 
1135 	if (!changed) {
1136 		if (atomic_cmpxchg(&device->state,
1137 				   FW_DEVICE_INITIALIZING,
1138 				   FW_DEVICE_RUNNING) == FW_DEVICE_GONE)
1139 			goto gone;
1140 
1141 		fw_device_update(work);
1142 		device->config_rom_retries = 0;
1143 		goto out;
1144 	}
1145 
1146 	/*
1147 	 * Something changed.  We keep things simple and don't investigate
1148 	 * further.  We just destroy all previous units and create new ones.
1149 	 */
1150 	device_for_each_child(&device->device, NULL, shutdown_unit);
1151 
1152 	ret = read_config_rom(device, device->generation);
1153 	if (ret != RCODE_COMPLETE)
1154 		goto failed_config_rom;
1155 
1156 	fw_device_cdev_update(device);
1157 	create_units(device);
1158 
1159 	/* Userspace may want to re-read attributes. */
1160 	kobject_uevent(&device->device.kobj, KOBJ_CHANGE);
1161 
1162 	if (atomic_cmpxchg(&device->state,
1163 			   FW_DEVICE_INITIALIZING,
1164 			   FW_DEVICE_RUNNING) == FW_DEVICE_GONE)
1165 		goto gone;
1166 
1167 	fw_notice(card, "refreshed device %s\n", dev_name(&device->device));
1168 	device->config_rom_retries = 0;
1169 	goto out;
1170 
1171  failed_config_rom:
1172 	if (device->config_rom_retries < MAX_RETRIES &&
1173 	    atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
1174 		device->config_rom_retries++;
1175 		fw_schedule_device_work(device, RETRY_DELAY);
1176 		return;
1177 	}
1178 
1179 	fw_notice(card, "giving up on refresh of device %s: %s\n",
1180 		  dev_name(&device->device), fw_rcode_string(ret));
1181  gone:
1182 	atomic_set(&device->state, FW_DEVICE_GONE);
1183 	device->workfn = fw_device_shutdown;
1184 	fw_schedule_device_work(device, SHUTDOWN_DELAY);
1185  out:
1186 	if (node_id == card->root_node->node_id)
1187 		fw_schedule_bm_work(card, 0);
1188 }
1189 
1190 static void fw_device_workfn(struct work_struct *work)
1191 {
1192 	struct fw_device *device = container_of(to_delayed_work(work),
1193 						struct fw_device, work);
1194 	device->workfn(work);
1195 }
1196 
1197 void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
1198 {
1199 	struct fw_device *device;
1200 
1201 	switch (event) {
1202 	case FW_NODE_CREATED:
1203 		/*
1204 		 * Attempt to scan the node, regardless whether its self ID has
1205 		 * the L (link active) flag set or not.  Some broken devices
1206 		 * send L=0 but have an up-and-running link; others send L=1
1207 		 * without actually having a link.
1208 		 */
1209  create:
1210 		device = kzalloc(sizeof(*device), GFP_ATOMIC);
1211 		if (device == NULL)
1212 			break;
1213 
1214 		/*
1215 		 * Do minimal initialization of the device here, the
1216 		 * rest will happen in fw_device_init().
1217 		 *
1218 		 * Attention:  A lot of things, even fw_device_get(),
1219 		 * cannot be done before fw_device_init() finished!
1220 		 * You can basically just check device->state and
1221 		 * schedule work until then, but only while holding
1222 		 * card->lock.
1223 		 */
1224 		atomic_set(&device->state, FW_DEVICE_INITIALIZING);
1225 		device->card = fw_card_get(card);
1226 		device->node = fw_node_get(node);
1227 		device->node_id = node->node_id;
1228 		device->generation = card->generation;
1229 		device->is_local = node == card->local_node;
1230 		mutex_init(&device->client_list_mutex);
1231 		INIT_LIST_HEAD(&device->client_list);
1232 
1233 		/*
1234 		 * Set the node data to point back to this device so
1235 		 * FW_NODE_UPDATED callbacks can update the node_id
1236 		 * and generation for the device.
1237 		 */
1238 		node->data = device;
1239 
1240 		/*
1241 		 * Many devices are slow to respond after bus resets,
1242 		 * especially if they are bus powered and go through
1243 		 * power-up after getting plugged in.  We schedule the
1244 		 * first config rom scan half a second after bus reset.
1245 		 */
1246 		device->workfn = fw_device_init;
1247 		INIT_DELAYED_WORK(&device->work, fw_device_workfn);
1248 		fw_schedule_device_work(device, INITIAL_DELAY);
1249 		break;
1250 
1251 	case FW_NODE_INITIATED_RESET:
1252 	case FW_NODE_LINK_ON:
1253 		device = node->data;
1254 		if (device == NULL)
1255 			goto create;
1256 
1257 		device->node_id = node->node_id;
1258 		smp_wmb();  /* update node_id before generation */
1259 		device->generation = card->generation;
1260 		if (atomic_cmpxchg(&device->state,
1261 			    FW_DEVICE_RUNNING,
1262 			    FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
1263 			device->workfn = fw_device_refresh;
1264 			fw_schedule_device_work(device,
1265 				device->is_local ? 0 : INITIAL_DELAY);
1266 		}
1267 		break;
1268 
1269 	case FW_NODE_UPDATED:
1270 		device = node->data;
1271 		if (device == NULL)
1272 			break;
1273 
1274 		device->node_id = node->node_id;
1275 		smp_wmb();  /* update node_id before generation */
1276 		device->generation = card->generation;
1277 		if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
1278 			device->workfn = fw_device_update;
1279 			fw_schedule_device_work(device, 0);
1280 		}
1281 		break;
1282 
1283 	case FW_NODE_DESTROYED:
1284 	case FW_NODE_LINK_OFF:
1285 		if (!node->data)
1286 			break;
1287 
1288 		/*
1289 		 * Destroy the device associated with the node.  There
1290 		 * are two cases here: either the device is fully
1291 		 * initialized (FW_DEVICE_RUNNING) or we're in the
1292 		 * process of reading its config rom
1293 		 * (FW_DEVICE_INITIALIZING).  If it is fully
1294 		 * initialized we can reuse device->work to schedule a
1295 		 * full fw_device_shutdown().  If not, there's work
1296 		 * scheduled to read it's config rom, and we just put
1297 		 * the device in shutdown state to have that code fail
1298 		 * to create the device.
1299 		 */
1300 		device = node->data;
1301 		if (atomic_xchg(&device->state,
1302 				FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
1303 			device->workfn = fw_device_shutdown;
1304 			fw_schedule_device_work(device,
1305 				list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
1306 		}
1307 		break;
1308 	}
1309 }
1310