Total coverage: 234443 (15%)of 1579262 














   10 



















   15 








    6 


























































   10 

   13 







   13 
















































    7 

    6 




















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
// SPDX-License-Identifier: GPL-2.0 OR MIT
/*
 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 *
 * This is based in part on Andrew Moon's poly1305-donna, which is in the
 * public domain.
 */

#include <linux/kernel.h>
#include <linux/unaligned.h>
#include <crypto/internal/poly1305.h>

void poly1305_core_setkey(struct poly1305_core_key *key,
                          const u8 raw_key[POLY1305_BLOCK_SIZE])
{
        u64 t0, t1;

        /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
        t0 = get_unaligned_le64(&raw_key[0]);
        t1 = get_unaligned_le64(&raw_key[8]);

        key->key.r64[0] = t0 & 0xffc0fffffffULL;
        key->key.r64[1] = ((t0 >> 44) | (t1 << 20)) & 0xfffffc0ffffULL;
        key->key.r64[2] = ((t1 >> 24)) & 0x00ffffffc0fULL;

        /* s = 20*r */
        key->precomputed_s.r64[0] = key->key.r64[1] * 20;
        key->precomputed_s.r64[1] = key->key.r64[2] * 20;
}
EXPORT_SYMBOL(poly1305_core_setkey);

void poly1305_core_blocks(struct poly1305_state *state,
                          const struct poly1305_core_key *key, const void *src,
                          unsigned int nblocks, u32 hibit)
{
        const u8 *input = src;
        u64 hibit64;
        u64 r0, r1, r2;
        u64 s1, s2;
        u64 h0, h1, h2;
        u64 c;
        u128 d0, d1, d2, d;

        if (!nblocks)
                return;

        hibit64 = ((u64)hibit) << 40;

        r0 = key->key.r64[0];
        r1 = key->key.r64[1];
        r2 = key->key.r64[2];

        h0 = state->h64[0];
        h1 = state->h64[1];
        h2 = state->h64[2];

        s1 = key->precomputed_s.r64[0];
        s2 = key->precomputed_s.r64[1];

        do {
                u64 t0, t1;

                /* h += m[i] */
                t0 = get_unaligned_le64(&input[0]);
                t1 = get_unaligned_le64(&input[8]);

                h0 += t0 & 0xfffffffffffULL;
                h1 += ((t0 >> 44) | (t1 << 20)) & 0xfffffffffffULL;
                h2 += (((t1 >> 24)) & 0x3ffffffffffULL) | hibit64;

                /* h *= r */
                d0 = (u128)h0 * r0;
                d = (u128)h1 * s2;
                d0 += d;
                d = (u128)h2 * s1;
                d0 += d;
                d1 = (u128)h0 * r1;
                d = (u128)h1 * r0;
                d1 += d;
                d = (u128)h2 * s2;
                d1 += d;
                d2 = (u128)h0 * r2;
                d = (u128)h1 * r1;
                d2 += d;
                d = (u128)h2 * r0;
                d2 += d;

                /* (partial) h %= p */
                c = (u64)(d0 >> 44);
                h0 = (u64)d0 & 0xfffffffffffULL;
                d1 += c;
                c = (u64)(d1 >> 44);
                h1 = (u64)d1 & 0xfffffffffffULL;
                d2 += c;
                c = (u64)(d2 >> 42);
                h2 = (u64)d2 & 0x3ffffffffffULL;
                h0 += c * 5;
                c = h0 >> 44;
                h0 = h0 & 0xfffffffffffULL;
                h1 += c;

                input += POLY1305_BLOCK_SIZE;
        } while (--nblocks);

        state->h64[0] = h0;
        state->h64[1] = h1;
        state->h64[2] = h2;
}
EXPORT_SYMBOL(poly1305_core_blocks);

void poly1305_core_emit(const struct poly1305_state *state, const u32 nonce[4],
                        void *dst)
{
        u8 *mac = dst;
        u64 h0, h1, h2, c;
        u64 g0, g1, g2;
        u64 t0, t1;

        /* fully carry h */
        h0 = state->h64[0];
        h1 = state->h64[1];
        h2 = state->h64[2];

        c = h1 >> 44;
        h1 &= 0xfffffffffffULL;
        h2 += c;
        c = h2 >> 42;
        h2 &= 0x3ffffffffffULL;
        h0 += c * 5;
        c = h0 >> 44;
        h0 &= 0xfffffffffffULL;
        h1 += c;
        c = h1 >> 44;
        h1 &= 0xfffffffffffULL;
        h2 += c;
        c = h2 >> 42;
        h2 &= 0x3ffffffffffULL;
        h0 += c * 5;
        c = h0 >> 44;
        h0 &= 0xfffffffffffULL;
        h1 += c;

        /* compute h + -p */
        g0 = h0 + 5;
        c  = g0 >> 44;
        g0 &= 0xfffffffffffULL;
        g1 = h1 + c;
        c  = g1 >> 44;
        g1 &= 0xfffffffffffULL;
        g2 = h2 + c - (1ULL << 42);

        /* select h if h < p, or h + -p if h >= p */
        c = (g2 >> ((sizeof(u64) * 8) - 1)) - 1;
        g0 &= c;
        g1 &= c;
        g2 &= c;
        c  = ~c;
        h0 = (h0 & c) | g0;
        h1 = (h1 & c) | g1;
        h2 = (h2 & c) | g2;

        if (likely(nonce)) {
                /* h = (h + nonce) */
                t0 = ((u64)nonce[1] << 32) | nonce[0];
                t1 = ((u64)nonce[3] << 32) | nonce[2];

                h0 += t0 & 0xfffffffffffULL;
                c = h0 >> 44;
                h0 &= 0xfffffffffffULL;
                h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffffULL) + c;
                c = h1 >> 44;
                h1 &= 0xfffffffffffULL;
                h2 += (((t1 >> 24)) & 0x3ffffffffffULL) + c;
                h2 &= 0x3ffffffffffULL;
        }

        /* mac = h % (2^128) */
        h0 = h0 | (h1 << 44);
        h1 = (h1 >> 20) | (h2 << 24);

        put_unaligned_le64(h0, &mac[0]);
        put_unaligned_le64(h1, &mac[8]);
}
EXPORT_SYMBOL(poly1305_core_emit);





























































    3 








    3 












































    3 
















    2 


    1 


    1 

























































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
// SPDX-License-Identifier: GPL-2.0-only

#include "netlink.h"
#include "common.h"
#include "bitset.h"

struct privflags_req_info {
        struct ethnl_req_info                base;
};

struct privflags_reply_data {
        struct ethnl_reply_data                base;
        const char                        (*priv_flag_names)[ETH_GSTRING_LEN];
        unsigned int                        n_priv_flags;
        u32                                priv_flags;
};

#define PRIVFLAGS_REPDATA(__reply_base) \
        container_of(__reply_base, struct privflags_reply_data, base)

const struct nla_policy ethnl_privflags_get_policy[] = {
        [ETHTOOL_A_PRIVFLAGS_HEADER]                =
                NLA_POLICY_NESTED(ethnl_header_policy),
};

static int ethnl_get_priv_flags_info(struct net_device *dev,
                                     unsigned int *count,
                                     const char (**names)[ETH_GSTRING_LEN])
{
        const struct ethtool_ops *ops = dev->ethtool_ops;
        int nflags;

        nflags = ops->get_sset_count(dev, ETH_SS_PRIV_FLAGS);
        if (nflags < 0)
                return nflags;

        if (names) {
                *names = kcalloc(nflags, ETH_GSTRING_LEN, GFP_KERNEL);
                if (!*names)
                        return -ENOMEM;
                ops->get_strings(dev, ETH_SS_PRIV_FLAGS, (u8 *)*names);
        }

        /* We can pass more than 32 private flags to userspace via netlink but
         * we cannot get more with ethtool_ops::get_priv_flags(). Note that we
         * must not adjust nflags before allocating the space for flag names
         * as the buffer must be large enough for all flags.
         */
        if (WARN_ONCE(nflags > 32,
                      "device %s reports more than 32 private flags (%d)\n",
                      netdev_name(dev), nflags))
                nflags = 32;
        *count = nflags;

        return 0;
}

static int privflags_prepare_data(const struct ethnl_req_info *req_base,
                                  struct ethnl_reply_data *reply_base,
                                  const struct genl_info *info)
{
        struct privflags_reply_data *data = PRIVFLAGS_REPDATA(reply_base);
        struct net_device *dev = reply_base->dev;
        const char (*names)[ETH_GSTRING_LEN];
        const struct ethtool_ops *ops;
        unsigned int nflags;
        int ret;

        ops = dev->ethtool_ops;
        if (!ops->get_priv_flags || !ops->get_sset_count || !ops->get_strings)
                return -EOPNOTSUPP;
        ret = ethnl_ops_begin(dev);
        if (ret < 0)
                return ret;

        ret = ethnl_get_priv_flags_info(dev, &nflags, &names);
        if (ret < 0)
                goto out_ops;
        data->priv_flags = ops->get_priv_flags(dev);
        data->priv_flag_names = names;
        data->n_priv_flags = nflags;

out_ops:
        ethnl_ops_complete(dev);
        return ret;
}

static int privflags_reply_size(const struct ethnl_req_info *req_base,
                                const struct ethnl_reply_data *reply_base)
{
        const struct privflags_reply_data *data = PRIVFLAGS_REPDATA(reply_base);
        bool compact = req_base->flags & ETHTOOL_FLAG_COMPACT_BITSETS;
        const u32 all_flags = ~(u32)0 >> (32 - data->n_priv_flags);

        return ethnl_bitset32_size(&data->priv_flags, &all_flags,
                                   data->n_priv_flags,
                                   data->priv_flag_names, compact);
}

static int privflags_fill_reply(struct sk_buff *skb,
                                const struct ethnl_req_info *req_base,
                                const struct ethnl_reply_data *reply_base)
{
        const struct privflags_reply_data *data = PRIVFLAGS_REPDATA(reply_base);
        bool compact = req_base->flags & ETHTOOL_FLAG_COMPACT_BITSETS;
        const u32 all_flags = ~(u32)0 >> (32 - data->n_priv_flags);

        return ethnl_put_bitset32(skb, ETHTOOL_A_PRIVFLAGS_FLAGS,
                                  &data->priv_flags, &all_flags,
                                  data->n_priv_flags, data->priv_flag_names,
                                  compact);
}

static void privflags_cleanup_data(struct ethnl_reply_data *reply_data)
{
        struct privflags_reply_data *data = PRIVFLAGS_REPDATA(reply_data);

        kfree(data->priv_flag_names);
}

/* PRIVFLAGS_SET */

const struct nla_policy ethnl_privflags_set_policy[] = {
        [ETHTOOL_A_PRIVFLAGS_HEADER]                =
                NLA_POLICY_NESTED(ethnl_header_policy),
        [ETHTOOL_A_PRIVFLAGS_FLAGS]                = { .type = NLA_NESTED },
};

static int
ethnl_set_privflags_validate(struct ethnl_req_info *req_info,
                             struct genl_info *info)
{
        const struct ethtool_ops *ops = req_info->dev->ethtool_ops;

        if (!info->attrs[ETHTOOL_A_PRIVFLAGS_FLAGS])
                return -EINVAL;

        if (!ops->get_priv_flags || !ops->set_priv_flags ||
            !ops->get_sset_count || !ops->get_strings)
                return -EOPNOTSUPP;
        return 1;
}

static int
ethnl_set_privflags(struct ethnl_req_info *req_info, struct genl_info *info)
{
        const char (*names)[ETH_GSTRING_LEN] = NULL;
        struct net_device *dev = req_info->dev;
        struct nlattr **tb = info->attrs;
        unsigned int nflags;
        bool mod = false;
        bool compact;
        u32 flags;
        int ret;

        ret = ethnl_bitset_is_compact(tb[ETHTOOL_A_PRIVFLAGS_FLAGS], &compact);
        if (ret < 0)
                return ret;

        ret = ethnl_get_priv_flags_info(dev, &nflags, compact ? NULL : &names);
        if (ret < 0)
                return ret;
        flags = dev->ethtool_ops->get_priv_flags(dev);

        ret = ethnl_update_bitset32(&flags, nflags,
                                    tb[ETHTOOL_A_PRIVFLAGS_FLAGS], names,
                                    info->extack, &mod);
        if (ret < 0 || !mod)
                goto out_free;
        ret = dev->ethtool_ops->set_priv_flags(dev, flags);
        if (ret < 0)
                goto out_free;
        ret = 1;

out_free:
        kfree(names);
        return ret;
}

const struct ethnl_request_ops ethnl_privflags_request_ops = {
        .request_cmd                = ETHTOOL_MSG_PRIVFLAGS_GET,
        .reply_cmd                = ETHTOOL_MSG_PRIVFLAGS_GET_REPLY,
        .hdr_attr                = ETHTOOL_A_PRIVFLAGS_HEADER,
        .req_info_size                = sizeof(struct privflags_req_info),
        .reply_data_size        = sizeof(struct privflags_reply_data),

        .prepare_data                = privflags_prepare_data,
        .reply_size                = privflags_reply_size,
        .fill_reply                = privflags_fill_reply,
        .cleanup_data                = privflags_cleanup_data,

        .set_validate                = ethnl_set_privflags_validate,
        .set                        = ethnl_set_privflags,
        .set_ntf_cmd                = ETHTOOL_MSG_PRIVFLAGS_NTF,
};

























































































































  177 










































  175 



  153 


  174 


    6 


  133 









  178 









  129 

    3 




    1 




   42 







  128 

    2 















  144 
    1 




    7 
















  141 










  141 
  145 











    2 











    2 








    1 
   98 
    1 


















  123 

















   93 



  123 

   85 












  123 





















  103 





  145 
















  142 








  103 




  123 





  138 

  103 









  103 






































  178 

















  130 












  131 

    2 

















  130 









   38 


  127 




    2 


  123 
    1 












   36 























  175 













    1 













    9 


  103 

  130 





  103 






   10 
    1 






    6 



   11 


   17 



   12 


   12 



   13 


    3 


    8 


































  152 





  175 







  176 









  150 
   29 


  175 



    5 

    5 



    3 



    2 


























  178 




















  177 


















  101 







   90 
   10 

   86 
   15 



  101 






  100 






   29 
   73 





  152 



   92 
   57 
    4 




   59 
    2 





   59 




   58 
    4 




  142 


    3 




    7 






  147 
    2 


  145 

    2 




    2 


















  139 
    3 

    3 


    2 










    1 




    9 

    1 














    1 















    5 

    3 




    1 













    4 







  134 























  136 
    1 















    7 

    7 












    7 










    1 
    6 


    6 
    1 
    6 

    1 
    7 

    1 
    6 
    7 


    6 
    1 
    7 


    7 

    6 
    1 
    6 

    1 


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
// SPDX-License-Identifier: GPL-2.0-only

#include <linux/fs.h>
#include <linux/module.h>
#include <linux/namei.h>
#include <linux/fs_context.h>
#include <linux/fs_parser.h>
#include <linux/posix_acl_xattr.h>
#include <linux/seq_file.h>
#include <linux/xattr.h>
#include "overlayfs.h"
#include "params.h"

static bool ovl_redirect_dir_def = IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_DIR);
module_param_named(redirect_dir, ovl_redirect_dir_def, bool, 0644);
MODULE_PARM_DESC(redirect_dir,
                 "Default to on or off for the redirect_dir feature");

static bool ovl_redirect_always_follow =
        IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW);
module_param_named(redirect_always_follow, ovl_redirect_always_follow,
                   bool, 0644);
MODULE_PARM_DESC(redirect_always_follow,
                 "Follow redirects even if redirect_dir feature is turned off");

static bool ovl_xino_auto_def = IS_ENABLED(CONFIG_OVERLAY_FS_XINO_AUTO);
module_param_named(xino_auto, ovl_xino_auto_def, bool, 0644);
MODULE_PARM_DESC(xino_auto,
                 "Auto enable xino feature");

static bool ovl_index_def = IS_ENABLED(CONFIG_OVERLAY_FS_INDEX);
module_param_named(index, ovl_index_def, bool, 0644);
MODULE_PARM_DESC(index,
                 "Default to on or off for the inodes index feature");

static bool ovl_nfs_export_def = IS_ENABLED(CONFIG_OVERLAY_FS_NFS_EXPORT);
module_param_named(nfs_export, ovl_nfs_export_def, bool, 0644);
MODULE_PARM_DESC(nfs_export,
                 "Default to on or off for the NFS export feature");

static bool ovl_metacopy_def = IS_ENABLED(CONFIG_OVERLAY_FS_METACOPY);
module_param_named(metacopy, ovl_metacopy_def, bool, 0644);
MODULE_PARM_DESC(metacopy,
                 "Default to on or off for the metadata only copy up feature");

enum ovl_opt {
        Opt_lowerdir,
        Opt_lowerdir_add,
        Opt_datadir_add,
        Opt_upperdir,
        Opt_workdir,
        Opt_default_permissions,
        Opt_redirect_dir,
        Opt_index,
        Opt_uuid,
        Opt_nfs_export,
        Opt_userxattr,
        Opt_xino,
        Opt_metacopy,
        Opt_verity,
        Opt_volatile,
        Opt_override_creds,
};

static const struct constant_table ovl_parameter_bool[] = {
        { "on",                true  },
        { "off",        false },
        {}
};

static const struct constant_table ovl_parameter_uuid[] = {
        { "off",        OVL_UUID_OFF  },
        { "null",        OVL_UUID_NULL },
        { "auto",        OVL_UUID_AUTO },
        { "on",                OVL_UUID_ON   },
        {}
};

static const char *ovl_uuid_mode(struct ovl_config *config)
{
        return ovl_parameter_uuid[config->uuid].name;
}

static int ovl_uuid_def(void)
{
        return OVL_UUID_AUTO;
}

static const struct constant_table ovl_parameter_xino[] = {
        { "off",        OVL_XINO_OFF  },
        { "auto",        OVL_XINO_AUTO },
        { "on",                OVL_XINO_ON   },
        {}
};

const char *ovl_xino_mode(struct ovl_config *config)
{
        return ovl_parameter_xino[config->xino].name;
}

static int ovl_xino_def(void)
{
        return ovl_xino_auto_def ? OVL_XINO_AUTO : OVL_XINO_OFF;
}

const struct constant_table ovl_parameter_redirect_dir[] = {
        { "off",        OVL_REDIRECT_OFF      },
        { "follow",        OVL_REDIRECT_FOLLOW   },
        { "nofollow",        OVL_REDIRECT_NOFOLLOW },
        { "on",                OVL_REDIRECT_ON       },
        {}
};

static const char *ovl_redirect_mode(struct ovl_config *config)
{
        return ovl_parameter_redirect_dir[config->redirect_mode].name;
}

static int ovl_redirect_mode_def(void)
{
        return ovl_redirect_dir_def          ? OVL_REDIRECT_ON :
               ovl_redirect_always_follow ? OVL_REDIRECT_FOLLOW :
                                            OVL_REDIRECT_NOFOLLOW;
}

static const struct constant_table ovl_parameter_verity[] = {
        { "off",        OVL_VERITY_OFF     },
        { "on",                OVL_VERITY_ON      },
        { "require",        OVL_VERITY_REQUIRE },
        {}
};

static const char *ovl_verity_mode(struct ovl_config *config)
{
        return ovl_parameter_verity[config->verity_mode].name;
}

static int ovl_verity_mode_def(void)
{
        return OVL_VERITY_OFF;
}

const struct fs_parameter_spec ovl_parameter_spec[] = {
        fsparam_string_empty("lowerdir",    Opt_lowerdir),
        fsparam_file_or_string("lowerdir+", Opt_lowerdir_add),
        fsparam_file_or_string("datadir+",  Opt_datadir_add),
        fsparam_file_or_string("upperdir",  Opt_upperdir),
        fsparam_file_or_string("workdir",   Opt_workdir),
        fsparam_flag("default_permissions", Opt_default_permissions),
        fsparam_enum("redirect_dir",        Opt_redirect_dir, ovl_parameter_redirect_dir),
        fsparam_enum("index",               Opt_index, ovl_parameter_bool),
        fsparam_enum("uuid",                Opt_uuid, ovl_parameter_uuid),
        fsparam_enum("nfs_export",          Opt_nfs_export, ovl_parameter_bool),
        fsparam_flag("userxattr",           Opt_userxattr),
        fsparam_enum("xino",                Opt_xino, ovl_parameter_xino),
        fsparam_enum("metacopy",            Opt_metacopy, ovl_parameter_bool),
        fsparam_enum("verity",              Opt_verity, ovl_parameter_verity),
        fsparam_flag("volatile",            Opt_volatile),
        fsparam_flag_no("override_creds",   Opt_override_creds),
        {}
};

static char *ovl_next_opt(char **s)
{
        char *sbegin = *s;
        char *p;

        if (sbegin == NULL)
                return NULL;

        for (p = sbegin; *p; p++) {
                if (*p == '\\') {
                        p++;
                        if (!*p)
                                break;
                } else if (*p == ',') {
                        *p = '\0';
                        *s = p + 1;
                        return sbegin;
                }
        }
        *s = NULL;
        return sbegin;
}

static int ovl_parse_monolithic(struct fs_context *fc, void *data)
{
        return vfs_parse_monolithic_sep(fc, data, ovl_next_opt);
}

static ssize_t ovl_parse_param_split_lowerdirs(char *str)
{
        ssize_t nr_layers = 1, nr_colons = 0;
        char *s, *d;

        for (s = d = str;; s++, d++) {
                if (*s == '\\') {
                        /* keep esc chars in split lowerdir */
                        *d++ = *s++;
                } else if (*s == ':') {
                        bool next_colon = (*(s + 1) == ':');

                        nr_colons++;
                        if (nr_colons == 2 && next_colon) {
                                pr_err("only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed.\n");
                                return -EINVAL;
                        }
                        /* count layers, not colons */
                        if (!next_colon)
                                nr_layers++;

                        *d = '\0';
                        continue;
                }

                *d = *s;
                if (!*s) {
                        /* trailing colons */
                        if (nr_colons) {
                                pr_err("unescaped trailing colons in lowerdir mount option.\n");
                                return -EINVAL;
                        }
                        break;
                }
                nr_colons = 0;
        }

        return nr_layers;
}

static int ovl_mount_dir_noesc(const char *name, struct path *path)
{
        int err = -EINVAL;

        if (!*name) {
                pr_err("empty lowerdir\n");
                goto out;
        }
        err = kern_path(name, LOOKUP_FOLLOW, path);
        if (err) {
                pr_err("failed to resolve '%s': %i\n", name, err);
                goto out;
        }
        return 0;

out:
        return err;
}

static void ovl_unescape(char *s)
{
        char *d = s;

        for (;; s++, d++) {
                if (*s == '\\')
                        s++;
                *d = *s;
                if (!*s)
                        break;
        }
}

static int ovl_mount_dir(const char *name, struct path *path)
{
        int err = -ENOMEM;
        char *tmp = kstrdup(name, GFP_KERNEL);

        if (tmp) {
                ovl_unescape(tmp);
                err = ovl_mount_dir_noesc(tmp, path);
                kfree(tmp);
        }
        return err;
}

static int ovl_mount_dir_check(struct fs_context *fc, const struct path *path,
                               enum ovl_opt layer, const char *name, bool upper)
{
        struct ovl_fs_context *ctx = fc->fs_private;

        if (!d_is_dir(path->dentry))
                return invalfc(fc, "%s is not a directory", name);

        /*
         * Root dentries of case-insensitive capable filesystems might
         * not have the dentry operations set, but still be incompatible
         * with overlayfs.  Check explicitly to prevent post-mount
         * failures.
         */
        if (sb_has_encoding(path->mnt->mnt_sb))
                return invalfc(fc, "case-insensitive capable filesystem on %s not supported", name);

        if (ovl_dentry_weird(path->dentry))
                return invalfc(fc, "filesystem on %s not supported", name);

        /*
         * Check whether upper path is read-only here to report failures
         * early. Don't forget to recheck when the superblock is created
         * as the mount attributes could change.
         */
        if (upper) {
                if (path->dentry->d_flags & DCACHE_OP_REAL)
                        return invalfc(fc, "filesystem on %s not supported as upperdir", name);
                if (__mnt_is_readonly(path->mnt))
                        return invalfc(fc, "filesystem on %s is read-only", name);
        } else {
                if (ctx->lowerdir_all && layer != Opt_lowerdir)
                        return invalfc(fc, "lowerdir+ and datadir+ cannot follow lowerdir");
                if (ctx->nr_data && layer == Opt_lowerdir_add)
                        return invalfc(fc, "regular lower layers cannot follow data layers");
                if (ctx->nr == OVL_MAX_STACK)
                        return invalfc(fc, "too many lower directories, limit is %d",
                                       OVL_MAX_STACK);
        }
        return 0;
}

static int ovl_ctx_realloc_lower(struct fs_context *fc)
{
        struct ovl_fs_context *ctx = fc->fs_private;
        struct ovl_fs_context_layer *l;
        size_t nr;

        if (ctx->nr < ctx->capacity)
                return 0;

        nr = min_t(size_t, max(4096 / sizeof(*l), ctx->capacity * 2),
                   OVL_MAX_STACK);
        l = krealloc_array(ctx->lower, nr, sizeof(*l), GFP_KERNEL_ACCOUNT);
        if (!l)
                return -ENOMEM;

        ctx->lower = l;
        ctx->capacity = nr;
        return 0;
}

static void ovl_add_layer(struct fs_context *fc, enum ovl_opt layer,
                         struct path *path, char **pname)
{
        struct ovl_fs *ofs = fc->s_fs_info;
        struct ovl_config *config = &ofs->config;
        struct ovl_fs_context *ctx = fc->fs_private;
        struct ovl_fs_context_layer *l;

        switch (layer) {
        case Opt_workdir:
                swap(config->workdir, *pname);
                swap(ctx->work, *path);
                break;
        case Opt_upperdir:
                swap(config->upperdir, *pname);
                swap(ctx->upper, *path);
                break;
        case Opt_datadir_add:
                ctx->nr_data++;
                fallthrough;
        case Opt_lowerdir:
                fallthrough;
        case Opt_lowerdir_add:
                WARN_ON(ctx->nr >= ctx->capacity);
                l = &ctx->lower[ctx->nr++];
                memset(l, 0, sizeof(*l));
                swap(l->name, *pname);
                swap(l->path, *path);
                break;
        default:
                WARN_ON(1);
        }
}

static inline bool is_upper_layer(enum ovl_opt layer)
{
        return layer == Opt_upperdir || layer == Opt_workdir;
}

/* Handle non-file descriptor-based layer options that require path lookup. */
static inline int ovl_kern_path(const char *layer_name, struct path *layer_path,
                                enum ovl_opt layer)
{
        int err;

        switch (layer) {
        case Opt_upperdir:
                fallthrough;
        case Opt_workdir:
                fallthrough;
        case Opt_lowerdir:
                err = ovl_mount_dir(layer_name, layer_path);
                break;
        case Opt_lowerdir_add:
                fallthrough;
        case Opt_datadir_add:
                err = ovl_mount_dir_noesc(layer_name, layer_path);
                break;
        default:
                WARN_ON_ONCE(true);
                err = -EINVAL;
        }

        return err;
}

static int ovl_do_parse_layer(struct fs_context *fc, const char *layer_name,
                              struct path *layer_path, enum ovl_opt layer)
{
        char *name __free(kfree) = kstrdup(layer_name, GFP_KERNEL);
        bool upper;
        int err = 0;

        if (!name)
                return -ENOMEM;

        upper = is_upper_layer(layer);
        err = ovl_mount_dir_check(fc, layer_path, layer, name, upper);
        if (err)
                return err;

        if (!upper) {
                err = ovl_ctx_realloc_lower(fc);
                if (err)
                        return err;
        }

        /* Store the user provided path string in ctx to show in mountinfo */
        ovl_add_layer(fc, layer, layer_path, &name);
        return err;
}

static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param,
                           enum ovl_opt layer)
{
        struct path layer_path __free(path_put) = {};
        int err = 0;

        switch (param->type) {
        case fs_value_is_string:
                err = ovl_kern_path(param->string, &layer_path, layer);
                if (err)
                        return err;
                err = ovl_do_parse_layer(fc, param->string, &layer_path, layer);
                break;
        case fs_value_is_file: {
                char *buf __free(kfree);
                char *layer_name;

                buf = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT);
                if (!buf)
                        return -ENOMEM;

                layer_path = param->file->f_path;
                path_get(&layer_path);

                layer_name = d_path(&layer_path, buf, PATH_MAX);
                if (IS_ERR(layer_name))
                        return PTR_ERR(layer_name);

                err = ovl_do_parse_layer(fc, layer_name, &layer_path, layer);
                break;
        }
        default:
                WARN_ON_ONCE(true);
                err = -EINVAL;
        }

        return err;
}

static void ovl_reset_lowerdirs(struct ovl_fs_context *ctx)
{
        struct ovl_fs_context_layer *l = ctx->lower;

        // Reset old user provided lowerdir string
        kfree(ctx->lowerdir_all);
        ctx->lowerdir_all = NULL;

        for (size_t nr = 0; nr < ctx->nr; nr++, l++) {
                path_put(&l->path);
                kfree(l->name);
                l->name = NULL;
        }
        ctx->nr = 0;
        ctx->nr_data = 0;
}

/*
 * Parse lowerdir= mount option:
 *
 * e.g.: lowerdir=/lower1:/lower2:/lower3::/data1::/data2
 *     Set "/lower1", "/lower2", and "/lower3" as lower layers and
 *     "/data1" and "/data2" as data lower layers. Any existing lower
 *     layers are replaced.
 */
static int ovl_parse_param_lowerdir(const char *name, struct fs_context *fc)
{
        int err;
        struct ovl_fs_context *ctx = fc->fs_private;
        char *dup = NULL, *iter;
        ssize_t nr_lower, nr;
        bool data_layer = false;

        /*
         * Ensure we're backwards compatible with mount(2)
         * by allowing relative paths.
         */

        /* drop all existing lower layers */
        ovl_reset_lowerdirs(ctx);

        if (!*name)
                return 0;

        if (*name == ':') {
                pr_err("cannot append lower layer\n");
                return -EINVAL;
        }

        // Store user provided lowerdir string to show in mount options
        ctx->lowerdir_all = kstrdup(name, GFP_KERNEL);
        if (!ctx->lowerdir_all)
                return -ENOMEM;

        dup = kstrdup(name, GFP_KERNEL);
        if (!dup)
                return -ENOMEM;

        err = -EINVAL;
        nr_lower = ovl_parse_param_split_lowerdirs(dup);
        if (nr_lower < 0)
                goto out_err;

        if (nr_lower > OVL_MAX_STACK) {
                pr_err("too many lower directories, limit is %d\n", OVL_MAX_STACK);
                goto out_err;
        }

        iter = dup;
        for (nr = 0; nr < nr_lower; nr++) {
                struct path path __free(path_put) = {};

                err = ovl_kern_path(iter, &path, Opt_lowerdir);
                if (err)
                        goto out_err;

                err = ovl_do_parse_layer(fc, iter, &path, Opt_lowerdir);
                if (err)
                        goto out_err;

                if (data_layer)
                        ctx->nr_data++;

                /* Calling strchr() again would overrun. */
                if (ctx->nr == nr_lower)
                        break;

                err = -EINVAL;
                iter = strchr(iter, '\0') + 1;
                if (*iter) {
                        /*
                         * This is a regular layer so we require that
                         * there are no data layers.
                         */
                        if (ctx->nr_data > 0) {
                                pr_err("regular lower layers cannot follow data lower layers\n");
                                goto out_err;
                        }

                        data_layer = false;
                        continue;
                }

                /* This is a data lower layer. */
                data_layer = true;
                iter++;
        }
        kfree(dup);
        return 0;

out_err:
        kfree(dup);

        /* Intentionally don't realloc to a smaller size. */
        return err;
}

static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param)
{
        int err = 0;
        struct fs_parse_result result;
        struct ovl_fs *ofs = fc->s_fs_info;
        struct ovl_config *config = &ofs->config;
        struct ovl_fs_context *ctx = fc->fs_private;
        int opt;

        if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE) {
                /*
                 * On remount overlayfs has always ignored all mount
                 * options no matter if malformed or not so for
                 * backwards compatibility we do the same here.
                 */
                if (fc->oldapi)
                        return 0;

                /*
                 * Give us the freedom to allow changing mount options
                 * with the new mount api in the future. So instead of
                 * silently ignoring everything we report a proper
                 * error. This is only visible for users of the new
                 * mount api.
                 */
                return invalfc(fc, "No changes allowed in reconfigure");
        }

        opt = fs_parse(fc, ovl_parameter_spec, param, &result);
        if (opt < 0)
                return opt;

        switch (opt) {
        case Opt_lowerdir:
                err = ovl_parse_param_lowerdir(param->string, fc);
                break;
        case Opt_lowerdir_add:
        case Opt_datadir_add:
        case Opt_upperdir:
        case Opt_workdir:
                err = ovl_parse_layer(fc, param, opt);
                break;
        case Opt_default_permissions:
                config->default_permissions = true;
                break;
        case Opt_redirect_dir:
                config->redirect_mode = result.uint_32;
                if (config->redirect_mode == OVL_REDIRECT_OFF) {
                        config->redirect_mode = ovl_redirect_always_follow ?
                                                OVL_REDIRECT_FOLLOW :
                                                OVL_REDIRECT_NOFOLLOW;
                }
                ctx->set.redirect = true;
                break;
        case Opt_index:
                config->index = result.uint_32;
                ctx->set.index = true;
                break;
        case Opt_uuid:
                config->uuid = result.uint_32;
                break;
        case Opt_nfs_export:
                config->nfs_export = result.uint_32;
                ctx->set.nfs_export = true;
                break;
        case Opt_xino:
                config->xino = result.uint_32;
                break;
        case Opt_metacopy:
                config->metacopy = result.uint_32;
                ctx->set.metacopy = true;
                break;
        case Opt_verity:
                config->verity_mode = result.uint_32;
                break;
        case Opt_volatile:
                config->ovl_volatile = true;
                break;
        case Opt_userxattr:
                config->userxattr = true;
                break;
        case Opt_override_creds: {
                const struct cred *cred = NULL;

                if (result.negated) {
                        swap(cred, ofs->creator_cred);
                        put_cred(cred);
                        break;
                }

                if (!current_in_userns(fc->user_ns)) {
                        err = -EINVAL;
                        break;
                }

                cred = prepare_creds();
                if (cred)
                        swap(cred, ofs->creator_cred);
                else
                        err = -ENOMEM;

                put_cred(cred);
                break;
        }
        default:
                pr_err("unrecognized mount option \"%s\" or missing value\n",
                       param->key);
                return -EINVAL;
        }

        return err;
}

static int ovl_get_tree(struct fs_context *fc)
{
        return get_tree_nodev(fc, ovl_fill_super);
}

static inline void ovl_fs_context_free(struct ovl_fs_context *ctx)
{
        ovl_reset_lowerdirs(ctx);
        path_put(&ctx->upper);
        path_put(&ctx->work);
        kfree(ctx->lower);
        kfree(ctx);
}

static void ovl_free(struct fs_context *fc)
{
        struct ovl_fs *ofs = fc->s_fs_info;
        struct ovl_fs_context *ctx = fc->fs_private;

        /*
         * ofs is stored in the fs_context when it is initialized.
         * ofs is transferred to the superblock on a successful mount,
         * but if an error occurs before the transfer we have to free
         * it here.
         */
        if (ofs)
                ovl_free_fs(ofs);

        if (ctx)
                ovl_fs_context_free(ctx);
}

static int ovl_reconfigure(struct fs_context *fc)
{
        struct super_block *sb = fc->root->d_sb;
        struct ovl_fs *ofs = OVL_FS(sb);
        struct super_block *upper_sb;
        int ret = 0;

        if (!(fc->sb_flags & SB_RDONLY) && ovl_force_readonly(ofs))
                return -EROFS;

        if (fc->sb_flags & SB_RDONLY && !sb_rdonly(sb)) {
                upper_sb = ovl_upper_mnt(ofs)->mnt_sb;
                if (ovl_should_sync(ofs)) {
                        down_read(&upper_sb->s_umount);
                        ret = sync_filesystem(upper_sb);
                        up_read(&upper_sb->s_umount);
                }
        }

        return ret;
}

static const struct fs_context_operations ovl_context_ops = {
        .parse_monolithic = ovl_parse_monolithic,
        .parse_param = ovl_parse_param,
        .get_tree    = ovl_get_tree,
        .reconfigure = ovl_reconfigure,
        .free        = ovl_free,
};

/*
 * This is called during fsopen() and will record the user namespace of
 * the caller in fc->user_ns since we've raised FS_USERNS_MOUNT. We'll
 * need it when we actually create the superblock to verify that the
 * process creating the superblock is in the same user namespace as
 * process that called fsopen().
 */
int ovl_init_fs_context(struct fs_context *fc)
{
        struct ovl_fs_context *ctx;
        struct ovl_fs *ofs;

        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL_ACCOUNT);
        if (!ctx)
                return -ENOMEM;

        /*
         * By default we allocate for three lower layers. It's likely
         * that it'll cover most users.
         */
        ctx->lower = kmalloc_array(3, sizeof(*ctx->lower), GFP_KERNEL_ACCOUNT);
        if (!ctx->lower)
                goto out_err;
        ctx->capacity = 3;

        ofs = kzalloc(sizeof(struct ovl_fs), GFP_KERNEL);
        if (!ofs)
                goto out_err;

        ofs->config.redirect_mode        = ovl_redirect_mode_def();
        ofs->config.index                = ovl_index_def;
        ofs->config.uuid                = ovl_uuid_def();
        ofs->config.nfs_export                = ovl_nfs_export_def;
        ofs->config.xino                = ovl_xino_def();
        ofs->config.metacopy                = ovl_metacopy_def;

        fc->s_fs_info                = ofs;
        fc->fs_private                = ctx;
        fc->ops                        = &ovl_context_ops;
        return 0;

out_err:
        ovl_fs_context_free(ctx);
        return -ENOMEM;

}

void ovl_free_fs(struct ovl_fs *ofs)
{
        struct vfsmount **mounts;
        unsigned i;

        iput(ofs->workbasedir_trap);
        iput(ofs->workdir_trap);
        dput(ofs->whiteout);
        dput(ofs->workdir);
        if (ofs->workdir_locked)
                ovl_inuse_unlock(ofs->workbasedir);
        dput(ofs->workbasedir);
        if (ofs->upperdir_locked)
                ovl_inuse_unlock(ovl_upper_mnt(ofs)->mnt_root);

        /* Reuse ofs->config.lowerdirs as a vfsmount array before freeing it */
        mounts = (struct vfsmount **) ofs->config.lowerdirs;
        for (i = 0; i < ofs->numlayer; i++) {
                iput(ofs->layers[i].trap);
                kfree(ofs->config.lowerdirs[i]);
                mounts[i] = ofs->layers[i].mnt;
        }
        kern_unmount_array(mounts, ofs->numlayer);
        kfree(ofs->layers);
        for (i = 0; i < ofs->numfs; i++)
                free_anon_bdev(ofs->fs[i].pseudo_dev);
        kfree(ofs->fs);

        kfree(ofs->config.lowerdirs);
        kfree(ofs->config.upperdir);
        kfree(ofs->config.workdir);
        if (ofs->creator_cred)
                put_cred(ofs->creator_cred);
        kfree(ofs);
}

int ovl_fs_params_verify(const struct ovl_fs_context *ctx,
                         struct ovl_config *config)
{
        struct ovl_opt_set set = ctx->set;

        /* Workdir/index are useless in non-upper mount */
        if (!config->upperdir) {
                if (config->workdir) {
                        pr_info("option \"workdir=%s\" is useless in a non-upper mount, ignore\n",
                                config->workdir);
                        kfree(config->workdir);
                        config->workdir = NULL;
                }
                if (config->index && set.index) {
                        pr_info("option \"index=on\" is useless in a non-upper mount, ignore\n");
                        set.index = false;
                }
                config->index = false;
        }

        if (!config->upperdir && config->ovl_volatile) {
                pr_info("option \"volatile\" is meaningless in a non-upper mount, ignoring it.\n");
                config->ovl_volatile = false;
        }

        if (!config->upperdir && config->uuid == OVL_UUID_ON) {
                pr_info("option \"uuid=on\" requires an upper fs, falling back to uuid=null.\n");
                config->uuid = OVL_UUID_NULL;
        }

        /* Resolve verity -> metacopy dependency */
        if (config->verity_mode && !config->metacopy) {
                /* Don't allow explicit specified conflicting combinations */
                if (set.metacopy) {
                        pr_err("conflicting options: metacopy=off,verity=%s\n",
                               ovl_verity_mode(config));
                        return -EINVAL;
                }
                /* Otherwise automatically enable metacopy. */
                config->metacopy = true;
        }

        /*
         * This is to make the logic below simpler.  It doesn't make any other
         * difference, since redirect_dir=on is only used for upper.
         */
        if (!config->upperdir && config->redirect_mode == OVL_REDIRECT_FOLLOW)
                config->redirect_mode = OVL_REDIRECT_ON;

        /* Resolve verity -> metacopy -> redirect_dir dependency */
        if (config->metacopy && config->redirect_mode != OVL_REDIRECT_ON) {
                if (set.metacopy && set.redirect) {
                        pr_err("conflicting options: metacopy=on,redirect_dir=%s\n",
                               ovl_redirect_mode(config));
                        return -EINVAL;
                }
                if (config->verity_mode && set.redirect) {
                        pr_err("conflicting options: verity=%s,redirect_dir=%s\n",
                               ovl_verity_mode(config), ovl_redirect_mode(config));
                        return -EINVAL;
                }
                if (set.redirect) {
                        /*
                         * There was an explicit redirect_dir=... that resulted
                         * in this conflict.
                         */
                        pr_info("disabling metacopy due to redirect_dir=%s\n",
                                ovl_redirect_mode(config));
                        config->metacopy = false;
                } else {
                        /* Automatically enable redirect otherwise. */
                        config->redirect_mode = OVL_REDIRECT_ON;
                }
        }

        /* Resolve nfs_export -> index dependency */
        if (config->nfs_export && !config->index) {
                if (!config->upperdir &&
                    config->redirect_mode != OVL_REDIRECT_NOFOLLOW) {
                        pr_info("NFS export requires \"redirect_dir=nofollow\" on non-upper mount, falling back to nfs_export=off.\n");
                        config->nfs_export = false;
                } else if (set.nfs_export && set.index) {
                        pr_err("conflicting options: nfs_export=on,index=off\n");
                        return -EINVAL;
                } else if (set.index) {
                        /*
                         * There was an explicit index=off that resulted
                         * in this conflict.
                         */
                        pr_info("disabling nfs_export due to index=off\n");
                        config->nfs_export = false;
                } else {
                        /* Automatically enable index otherwise. */
                        config->index = true;
                }
        }

        /* Resolve nfs_export -> !metacopy && !verity dependency */
        if (config->nfs_export && config->metacopy) {
                if (set.nfs_export && set.metacopy) {
                        pr_err("conflicting options: nfs_export=on,metacopy=on\n");
                        return -EINVAL;
                }
                if (set.metacopy) {
                        /*
                         * There was an explicit metacopy=on that resulted
                         * in this conflict.
                         */
                        pr_info("disabling nfs_export due to metacopy=on\n");
                        config->nfs_export = false;
                } else if (config->verity_mode) {
                        /*
                         * There was an explicit verity=.. that resulted
                         * in this conflict.
                         */
                        pr_info("disabling nfs_export due to verity=%s\n",
                                ovl_verity_mode(config));
                        config->nfs_export = false;
                } else {
                        /*
                         * There was an explicit nfs_export=on that resulted
                         * in this conflict.
                         */
                        pr_info("disabling metacopy due to nfs_export=on\n");
                        config->metacopy = false;
                }
        }


        /* Resolve userxattr -> !redirect && !metacopy && !verity dependency */
        if (config->userxattr) {
                if (set.redirect &&
                    config->redirect_mode != OVL_REDIRECT_NOFOLLOW) {
                        pr_err("conflicting options: userxattr,redirect_dir=%s\n",
                               ovl_redirect_mode(config));
                        return -EINVAL;
                }
                if (config->metacopy && set.metacopy) {
                        pr_err("conflicting options: userxattr,metacopy=on\n");
                        return -EINVAL;
                }
                if (config->verity_mode) {
                        pr_err("conflicting options: userxattr,verity=%s\n",
                               ovl_verity_mode(config));
                        return -EINVAL;
                }
                /*
                 * Silently disable default setting of redirect and metacopy.
                 * This shall be the default in the future as well: these
                 * options must be explicitly enabled if used together with
                 * userxattr.
                 */
                config->redirect_mode = OVL_REDIRECT_NOFOLLOW;
                config->metacopy = false;
        }

        /*
         * Fail if we don't have trusted xattr capability and a feature was
         * explicitly requested that requires them.
         */
        if (!config->userxattr && !capable(CAP_SYS_ADMIN)) {
                if (set.redirect &&
                    config->redirect_mode != OVL_REDIRECT_NOFOLLOW) {
                        pr_err("redirect_dir requires permission to access trusted xattrs\n");
                        return -EPERM;
                }
                if (config->metacopy && set.metacopy) {
                        pr_err("metacopy requires permission to access trusted xattrs\n");
                        return -EPERM;
                }
                if (config->verity_mode) {
                        pr_err("verity requires permission to access trusted xattrs\n");
                        return -EPERM;
                }
                if (ctx->nr_data > 0) {
                        pr_err("lower data-only dirs require permission to access trusted xattrs\n");
                        return -EPERM;
                }
                /*
                 * Other xattr-dependent features should be disabled without
                 * great disturbance to the user in ovl_make_workdir().
                 */
        }

        if (ctx->nr_data > 0 && !config->metacopy) {
                pr_err("lower data-only dirs require metacopy support.\n");
                return -EINVAL;
        }

        return 0;
}

/**
 * ovl_show_options
 * @m: the seq_file handle
 * @dentry: The dentry to query
 *
 * Prints the mount options for a given superblock.
 * Returns zero; does not fail.
 */
int ovl_show_options(struct seq_file *m, struct dentry *dentry)
{
        struct super_block *sb = dentry->d_sb;
        struct ovl_fs *ofs = OVL_FS(sb);
        size_t nr, nr_merged_lower, nr_lower = 0;
        char **lowerdirs = ofs->config.lowerdirs;

        /*
         * lowerdirs[0] holds the colon separated list that user provided
         * with lowerdir mount option.
         * lowerdirs[1..numlayer] hold the lowerdir paths that were added
         * using the lowerdir+ and datadir+ mount options.
         * For now, we do not allow mixing the legacy lowerdir mount option
         * with the new lowerdir+ and datadir+ mount options.
         */
        if (lowerdirs[0]) {
                seq_show_option(m, "lowerdir", lowerdirs[0]);
        } else {
                nr_lower = ofs->numlayer;
                nr_merged_lower = nr_lower - ofs->numdatalayer;
        }
        for (nr = 1; nr < nr_lower; nr++) {
                if (nr < nr_merged_lower)
                        seq_show_option(m, "lowerdir+", lowerdirs[nr]);
                else
                        seq_show_option(m, "datadir+", lowerdirs[nr]);
        }
        if (ofs->config.upperdir) {
                seq_show_option(m, "upperdir", ofs->config.upperdir);
                seq_show_option(m, "workdir", ofs->config.workdir);
        }
        if (ofs->config.default_permissions)
                seq_puts(m, ",default_permissions");
        if (ofs->config.redirect_mode != ovl_redirect_mode_def())
                seq_printf(m, ",redirect_dir=%s",
                           ovl_redirect_mode(&ofs->config));
        if (ofs->config.index != ovl_index_def)
                seq_printf(m, ",index=%s", ofs->config.index ? "on" : "off");
        if (ofs->config.uuid != ovl_uuid_def())
                seq_printf(m, ",uuid=%s", ovl_uuid_mode(&ofs->config));
        if (ofs->config.nfs_export != ovl_nfs_export_def)
                seq_printf(m, ",nfs_export=%s", ofs->config.nfs_export ?
                                                "on" : "off");
        if (ofs->config.xino != ovl_xino_def() && !ovl_same_fs(ofs))
                seq_printf(m, ",xino=%s", ovl_xino_mode(&ofs->config));
        if (ofs->config.metacopy != ovl_metacopy_def)
                seq_printf(m, ",metacopy=%s",
                           ofs->config.metacopy ? "on" : "off");
        if (ofs->config.ovl_volatile)
                seq_puts(m, ",volatile");
        if (ofs->config.userxattr)
                seq_puts(m, ",userxattr");
        if (ofs->config.verity_mode != ovl_verity_mode_def())
                seq_printf(m, ",verity=%s",
                           ovl_verity_mode(&ofs->config));
        return 0;
}






























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    5 








    1 










    3 


    5 







    4 
    3 






    3 



    3 
















    3 


    3 






















































































































































































































































































































































































































































    3 
    3 

    1 
    1 
    1 





































    3 














































    3 


    3 








    3 




    3 

































    3 


















    3 


    3 
    3 

















































    3 














    3 




















    3 








    6 



    6 











    3 


    3 





    6 
































































































































































    6 


























    6 










    2 


    1 


    3 














































































































    6 
    6 




















    6 




























































































































































































































































































































































    6 






















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014
4015
4016
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214
4215
4216
4217
4218
4219
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
4249
4250
4251
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287
4288
4289
4290
4291
4292
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379
4380
4381
4382
4383
4384
4385
4386
4387
4388
4389
4390
4391
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404
4405
4406
4407
4408
4409
4410
4411
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485
4486
4487
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524
4525
4526
4527
4528
4529
4530
4531
4532
4533
4534
4535
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607
4608
4609
4610
4611
4612
4613
4614
4615
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637
4638
4639
4640
4641
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713
4714
4715
4716
4717
4718
4719
4720
4721
4722
4723
4724
4725
4726
4727
4728
4729
4730
4731
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826
4827
4828
4829
4830
4831
4832
4833
4834
4835
4836
4837
4838
4839
4840
4841
4842
4843
4844
4845
4846
4847
4848
4849
4850
4851
4852
4853
4854
4855
4856
4857
4858
4859
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962
4963
4964
4965
4966
4967
4968
4969
4970
4971
4972
4973
4974
4975
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
5080
5081
5082
5083
5084
5085
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139
5140
5141
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170
5171
5172
5173
5174
5175
5176
5177
5178
5179
5180
5181
5182
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
5198
5199
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209
5210
5211
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225
5226
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252
5253
5254
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284
5285
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335
5336
5337
5338
5339
5340
5341
5342
5343
5344
5345
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358
5359
5360
5361
5362
5363
5364
5365
5366
5367
5368
5369
5370
5371
5372
5373
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396
5397
5398
5399
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411
5412
5413
5414
5415
5416
5417
5418
5419
5420
5421
5422
5423
5424
5425
5426
5427
5428
5429
5430
5431
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513
5514
5515
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529
5530
5531
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
5545
5546
5547
5548
5549
5550
5551
5552
5553
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
5585
5586
5587
5588
5589
5590
5591
5592
5593
5594
5595
5596
5597
5598
5599
5600
5601
5602
5603
5604
5605
5606
5607
5608
5609
5610
5611
5612
5613
5614
5615
5616
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629
5630
5631
5632
5633
5634
5635
5636
5637
5638
5639
5640
5641
5642
5643
5644
5645
5646
5647
5648
5649
5650
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662
5663
5664
5665
5666
5667
5668
5669
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679
5680
5681
5682
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699
5700
5701
5702
5703
5704
5705
5706
5707
5708
5709
5710
5711
5712
5713
5714
5715
5716
5717
5718
5719
5720
5721
5722
5723
5724
5725
5726
5727
5728
5729
5730
5731
5732
5733
5734
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751
5752
5753
5754
5755
5756
5757
5758
5759
5760
5761
5762
5763
5764
5765
5766
5767
5768
5769
5770
5771
5772
5773
5774
5775
5776
5777
5778
5779
5780
5781
5782
5783
5784
5785
5786
5787
5788
5789
5790
5791
5792
5793
5794
5795
5796
5797
5798
5799
5800
5801
5802
5803
5804
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
5815
5816
5817
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827
5828
5829
5830
5831
5832
5833
5834
5835
5836
5837
5838
5839
5840
5841
5842
5843
5844
5845
5846
5847
5848
5849
5850
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865
5866
5867
5868
5869
5870
5871
5872
5873
5874
5875
5876
5877
5878
5879
5880
5881
5882
5883
5884
5885
5886
5887
5888
5889
5890
5891
5892
5893
5894
5895
5896
5897
5898
5899
5900
5901
5902
5903
5904
5905
5906
5907
5908
5909
5910
5911
5912
5913
5914
5915
5916
5917
5918
5919
5920
5921
5922
5923
5924
5925
5926
5927
5928
5929
5930
5931
5932
5933
5934
5935
5936
5937
5938
5939
5940
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
5959
5960
5961
5962
5963
5964
5965
5966
5967
5968
5969
5970
5971
5972
5973
5974
5975
5976
5977
5978
5979
5980
5981
5982
5983
5984
5985
5986
5987
5988
5989
5990
5991
5992
5993
5994
5995
5996
5997
5998
5999
6000
6001
6002
6003
6004
6005
6006
6007
6008
6009
6010
6011
6012
6013
6014
6015
6016
6017
6018
6019
6020
6021
6022
6023
6024
6025
6026
6027
6028
6029
6030
6031
6032
6033
6034
6035
6036
6037
6038
6039
6040
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074
6075
6076
6077
6078
6079
6080
6081
6082
6083
6084
6085
6086
6087
6088
6089
6090
6091
6092
6093
6094
6095
6096
6097
6098
6099
6100
6101
6102
6103
6104
6105
6106
6107
6108
6109
6110
6111
6112
6113
6114
6115
6116
6117
6118
6119
6120
6121
6122
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
6135
6136
6137
6138
6139
6140
6141
6142
6143
6144
6145
6146
6147
6148
6149
6150
6151
6152
6153
6154
6155
6156
6157
6158
6159
6160
6161
6162
6163
6164
6165
6166
6167
6168
6169
6170
6171
6172
6173
6174
6175
6176
6177
6178
6179
6180
6181
6182
6183
6184
6185
6186
6187
6188
6189
6190
6191
6192
6193
6194
6195
6196
6197
6198
6199
6200
6201
6202
6203
6204
6205
6206
6207
6208
6209
6210
6211
6212
6213
6214
6215
6216
6217
6218
6219
6220
6221
6222
6223
6224
6225
6226
6227
6228
6229
6230
6231
6232
6233
6234
6235
6236
6237
6238
6239
6240
6241
6242
6243
6244
6245
6246
6247
6248
6249
6250
6251
6252
6253
6254
6255
6256
6257
6258
6259
6260
6261
6262
6263
6264
6265
6266
6267
6268
6269
6270
6271
6272
6273
6274
6275
6276
6277
6278
6279
6280
6281
6282
6283
6284
6285
6286
6287
6288
6289
6290
6291
6292
6293
6294
6295
6296
6297
6298
6299
6300
6301
6302
6303
6304
6305
6306
6307
6308
6309
6310
6311
6312
6313
6314
6315
6316
6317
6318
6319
6320
6321
6322
6323
6324
6325
6326
6327
6328
6329
6330
6331
6332
6333
6334
6335
6336
6337
6338
6339
6340
6341
6342
6343
6344
6345
6346
6347
6348
6349
6350
6351
6352
6353
6354
6355
6356
6357
6358
6359
6360
6361
6362
6363
6364
6365
6366
6367
6368
6369
6370
6371
6372
6373
6374
6375
6376
6377
6378
6379
6380
6381
6382
6383
6384
6385
6386
6387
6388
6389
6390
6391
6392
6393
6394
6395
6396
6397
6398
6399
6400
6401
6402
6403
6404
6405
6406
6407
6408
6409
6410
6411
6412
6413
6414
6415
6416
6417
6418
6419
6420
6421
6422
6423
6424
6425
6426
6427
6428
6429
6430
6431
6432
6433
6434
6435
6436
6437
6438
6439
6440
6441
6442
6443
6444
6445
6446
6447
6448
6449
6450
6451
6452
6453
6454
6455
6456
6457
6458
6459
6460
6461
6462
6463
6464
6465
6466
6467
6468
6469
6470
6471
6472
6473
6474
6475
6476
6477
6478
6479
6480
6481
6482
6483
6484
6485
6486
6487
6488
6489
6490
6491
6492
6493
6494
6495
6496
6497
6498
6499
6500
6501
6502
6503
6504
6505
6506
6507
6508
6509
6510
6511
6512
6513
6514
6515
6516
6517
6518
6519
6520
6521
6522
6523
6524
6525
6526
6527
6528
6529
6530
6531
6532
6533
6534
6535
6536
6537
6538
6539
6540
6541
6542
6543
6544
6545
6546
6547
6548
6549
6550
6551
6552
6553
6554
6555
6556
6557
6558
6559
6560
6561
6562
6563
6564
6565
6566
6567
6568
6569
6570
6571
6572
6573
6574
6575
6576
6577
6578
6579
6580
6581
6582
6583
6584
6585
6586
6587
6588
6589
6590
6591
6592
6593
6594
6595
6596
6597
6598
6599
6600
6601
6602
6603
6604
6605
6606
6607
6608
6609
6610
6611
6612
6613
6614
6615
6616
6617
6618
6619
6620
6621
6622
6623
6624
6625
6626
6627
6628
6629
6630
6631
6632
6633
6634
6635
6636
6637
6638
6639
6640
6641
6642
6643
6644
6645
6646
6647
6648
6649
6650
6651
6652
6653
6654
6655
6656
6657
6658
6659
6660
6661
6662
6663
6664
6665
6666
6667
6668
6669
6670
6671
6672
6673
6674
6675
6676
6677
6678
6679
6680
6681
6682
6683
6684
6685
6686
6687
6688
6689
6690
6691
6692
6693
6694
6695
6696
6697
6698
6699
6700
6701
6702
6703
6704
6705
6706
6707
6708
6709
6710
6711
6712
6713
6714
6715
6716
6717
6718
6719
6720
6721
6722
6723
6724
6725
6726
6727
6728
6729
6730
6731
6732
6733
6734
6735
6736
6737
6738
6739
6740
6741
6742
6743
6744
6745
6746
6747
6748
6749
6750
6751
6752
6753
6754
6755
6756
6757
6758
6759
6760
6761
6762
6763
6764
6765
6766
6767
6768
6769
6770
6771
6772
6773
6774
6775
6776
6777
6778
6779
6780
6781
6782
6783
6784
6785
6786
6787
6788
6789
6790
6791
6792
6793
6794
6795
6796
6797
6798
6799
6800
6801
6802
6803
6804
6805
6806
6807
6808
6809
6810
6811
6812
6813
6814
6815
6816
6817
6818
6819
6820
6821
6822
6823
6824
6825
6826
6827
6828
6829
6830
6831
6832
6833
6834
6835
6836
6837
6838
6839
6840
6841
6842
6843
6844
6845
6846
6847
6848
6849
6850
6851
6852
6853
6854
6855
6856
6857
6858
6859
6860
6861
6862
6863
6864
6865
6866
6867
6868
6869
6870
6871
6872
6873
6874
6875
6876
6877
6878
6879
6880
6881
6882
6883
6884
6885
6886
6887
6888
6889
6890
6891
6892
6893
6894
6895
6896
6897
6898
6899
6900
6901
6902
6903
6904
6905
6906
6907
6908
6909
6910
6911
6912
6913
6914
6915
6916
6917
6918
6919
6920
6921
6922
6923
6924
6925
6926
6927
6928
6929
6930
6931
6932
6933
6934
6935
6936
6937
6938
6939
6940
6941
6942
6943
6944
6945
6946
6947
6948
6949
6950
6951
6952
6953
6954
6955
6956
6957
6958
6959
6960
6961
6962
6963
6964
6965
6966
6967
6968
6969
6970
6971
6972
6973
6974
6975
6976
6977
6978
6979
6980
6981
6982
6983
6984
6985
6986
6987
6988
6989
6990
6991
6992
6993
6994
6995
6996
6997
6998
6999
7000
7001
7002
7003
7004
7005
7006
7007
7008
7009
7010
7011
7012
7013
7014
7015
7016
7017
7018
7019
7020
7021
7022
7023
7024
7025
7026
7027
7028
7029
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Z-Star/Vimicro zc301/zc302p/vc30x driver
 *
 * Copyright (C) 2009-2012 Jean-Francois Moine <http://moinejf.free.fr>
 * Copyright (C) 2004 2005 2006 Michel Xhaard mxhaard@magic.fr
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/input.h>
#include "gspca.h"
#include "jpeg.h"

MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>, Serge A. Suchkov <Serge.A.S@tochka.ru>");
MODULE_DESCRIPTION("GSPCA ZC03xx/VC3xx USB Camera Driver");
MODULE_LICENSE("GPL");

static int force_sensor = -1;

#define REG08_DEF 3                /* default JPEG compression (75%) */
#include "zc3xx-reg.h"

/* specific webcam descriptor */
struct sd {
        struct gspca_dev gspca_dev;        /* !! must be the first item */

        struct { /* gamma/brightness/contrast control cluster */
                struct v4l2_ctrl *gamma;
                struct v4l2_ctrl *brightness;
                struct v4l2_ctrl *contrast;
        };
        struct { /* autogain/exposure control cluster */
                struct v4l2_ctrl *autogain;
                struct v4l2_ctrl *exposure;
        };
        struct v4l2_ctrl *plfreq;
        struct v4l2_ctrl *sharpness;
        struct v4l2_ctrl *jpegqual;

        struct work_struct work;

        u8 reg08;                /* webcam compression quality */

        u8 bridge;
        u8 sensor;                /* Type of image sensor chip */
        u16 chip_revision;

        u8 jpeg_hdr[JPEG_HDR_SZ];
};
enum bridges {
        BRIDGE_ZC301,
        BRIDGE_ZC303,
};
enum sensors {
        SENSOR_ADCM2700,
        SENSOR_CS2102,
        SENSOR_CS2102K,
        SENSOR_GC0303,
        SENSOR_GC0305,
        SENSOR_HDCS2020,
        SENSOR_HV7131B,
        SENSOR_HV7131R,
        SENSOR_ICM105A,
        SENSOR_MC501CB,
        SENSOR_MT9V111_1,        /* (mi360soc) zc301 */
        SENSOR_MT9V111_3,        /* (mi360soc) zc303 */
        SENSOR_OV7620,                /* OV7648 - same values */
        SENSOR_OV7630C,
        SENSOR_PAS106,
        SENSOR_PAS202B,
        SENSOR_PB0330,
        SENSOR_PO2030,
        SENSOR_TAS5130C,
        SENSOR_MAX
};

static const struct v4l2_pix_format vga_mode[] = {
        {320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
                .bytesperline = 320,
                .sizeimage = 320 * 240 * 3 / 8 + 590,
                .colorspace = V4L2_COLORSPACE_JPEG,
                .priv = 1},
        {640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
                .bytesperline = 640,
                .sizeimage = 640 * 480 * 3 / 8 + 590,
                .colorspace = V4L2_COLORSPACE_JPEG,
                .priv = 0},
};

static const struct v4l2_pix_format broken_vga_mode[] = {
        {320, 232, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
                .bytesperline = 320,
                .sizeimage = 320 * 232 * 4 / 8 + 590,
                .colorspace = V4L2_COLORSPACE_JPEG,
                .priv = 1},
        {640, 472, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
                .bytesperline = 640,
                .sizeimage = 640 * 472 * 3 / 8 + 590,
                .colorspace = V4L2_COLORSPACE_JPEG,
                .priv = 0},
};

static const struct v4l2_pix_format sif_mode[] = {
        {176, 144, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
                .bytesperline = 176,
                .sizeimage = 176 * 144 * 3 / 8 + 590,
                .colorspace = V4L2_COLORSPACE_JPEG,
                .priv = 1},
        {352, 288, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
                .bytesperline = 352,
                .sizeimage = 352 * 288 * 3 / 8 + 590,
                .colorspace = V4L2_COLORSPACE_JPEG,
                .priv = 0},
};

/*
 * Bridge reg08 bits 1-2 -> JPEG quality conversion table. Note the highest
 * quality setting is not usable as USB 1 does not have enough bandwidth.
 */
static u8 jpeg_qual[] = {50, 75, 87, /* 94 */};

/* usb exchanges */
struct usb_action {
        u8        req;
        u8        val;
        u16        idx;
};

static const struct usb_action adcm2700_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},                /* 00,00,01,cc */
        {0xa0, 0x04, ZC3XX_R002_CLOCKSELECT},                /* 00,02,04,cc */
        {0xa0, 0x00, ZC3XX_R008_CLOCKSETTING},                /* 00,08,03,cc */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xa0, 0xd3, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,d3,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},                /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc */
        {0xa0, 0xd8, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,d8,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,05,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},                /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},                /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},                /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},                /* 01,1c,00,cc */
        {0xa0, 0xde, ZC3XX_R09C_WINHEIGHTLOW},                /* 00,9c,de,cc */
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},                /* 00,9e,86,cc */
        {0xbb, 0x00, 0x0400},                                /* 04,00,00,bb */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x0f, 0x140f},                                /* 14,0f,0f,bb */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,37,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},                /* 01,89,06,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},                /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},                /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},                /* 03,01,08,cc */
        {0xa0, 0x58, ZC3XX_R116_RGAIN},                        /* 01,16,58,cc */
        {0xa0, 0x5a, ZC3XX_R118_BGAIN},                        /* 01,18,5a,cc */
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,02,cc */
        {0xa0, 0xd3, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,d3,cc */
        {0xbb, 0x00, 0x0408},                                /* 04,00,08,bb */
        {0xdd, 0x00, 0x0200},                                /* 00,02,00,dd */
        {0xbb, 0x00, 0x0400},                                /* 04,00,00,bb */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x0f, 0x140f},                                /* 14,0f,0f,bb */
        {0xbb, 0xe0, 0x0c2e},                                /* 0c,e0,2e,bb */
        {0xbb, 0x01, 0x2000},                                /* 20,01,00,bb */
        {0xbb, 0x96, 0x2400},                                /* 24,96,00,bb */
        {0xbb, 0x06, 0x1006},                                /* 10,06,06,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x5f, 0x2090},                                /* 20,5f,90,bb */
        {0xbb, 0x01, 0x8000},                                /* 80,01,00,bb */
        {0xbb, 0x09, 0x8400},                                /* 84,09,00,bb */
        {0xbb, 0x86, 0x0002},                                /* 00,86,02,bb */
        {0xbb, 0xe6, 0x0401},                                /* 04,e6,01,bb */
        {0xbb, 0x86, 0x0802},                                /* 08,86,02,bb */
        {0xbb, 0xe6, 0x0c01},                                /* 0c,e6,01,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xaa, 0xfe, 0x0000},                                /* 00,fe,00,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0020},                                /* 00,fe,20,aa */
/*mswin+*/
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},
        {0xaa, 0xfe, 0x0002},
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xaa, 0xb4, 0xcd37},
        {0xaa, 0xa4, 0x0004},
        {0xaa, 0xa8, 0x0007},
        {0xaa, 0xac, 0x0004},
/*mswin-*/
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xaa, 0xfe, 0x0000},                                /* 00,fe,00,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x04, 0x0400},                                /* 04,04,00,bb */
        {0xdd, 0x00, 0x0100},                                /* 00,01,00,dd */
        {0xbb, 0x01, 0x0400},                                /* 04,01,00,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xbb, 0x41, 0x2803},                                /* 28,41,03,bb */
        {0xbb, 0x40, 0x2c03},                                /* 2c,40,03,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0010},                                /* 00,fe,10,aa */
        {}
};
static const struct usb_action adcm2700_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},                /* 00,00,01,cc */
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},                /* 00,02,10,cc */
        {0xa0, 0x00, ZC3XX_R008_CLOCKSETTING},                /* 00,08,03,cc */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xa0, 0xd3, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,d3,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},                /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc */
        {0xa0, 0xd0, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,d0,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,05,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},                /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},                /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},                /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},                /* 01,1c,00,cc */
        {0xa0, 0xd8, ZC3XX_R09C_WINHEIGHTLOW},                /* 00,9c,d8,cc */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},                /* 00,9e,88,cc */
        {0xbb, 0x00, 0x0400},                                /* 04,00,00,bb */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x0f, 0x140f},                                /* 14,0f,0f,bb */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,37,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},                /* 01,89,06,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},                /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},                /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},                /* 03,01,08,cc */
        {0xa0, 0x58, ZC3XX_R116_RGAIN},                        /* 01,16,58,cc */
        {0xa0, 0x5a, ZC3XX_R118_BGAIN},                        /* 01,18,5a,cc */
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,02,cc */
        {0xa0, 0xd3, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,d3,cc */
        {0xbb, 0x00, 0x0408},                                /* 04,00,08,bb */
        {0xdd, 0x00, 0x0200},                                /* 00,02,00,dd */
        {0xbb, 0x00, 0x0400},                                /* 04,00,00,bb */
        {0xdd, 0x00, 0x0050},                                /* 00,00,50,dd */
        {0xbb, 0x0f, 0x140f},                                /* 14,0f,0f,bb */
        {0xbb, 0xe0, 0x0c2e},                                /* 0c,e0,2e,bb */
        {0xbb, 0x01, 0x2000},                                /* 20,01,00,bb */
        {0xbb, 0x96, 0x2400},                                /* 24,96,00,bb */
        {0xbb, 0x06, 0x1006},                                /* 10,06,06,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x5f, 0x2090},                                /* 20,5f,90,bb */
        {0xbb, 0x01, 0x8000},                                /* 80,01,00,bb */
        {0xbb, 0x09, 0x8400},                                /* 84,09,00,bb */
        {0xbb, 0x86, 0x0002},                                /* 00,88,02,bb */
        {0xbb, 0xe6, 0x0401},                                /* 04,e6,01,bb */
        {0xbb, 0x86, 0x0802},                                /* 08,88,02,bb */
        {0xbb, 0xe6, 0x0c01},                                /* 0c,e6,01,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xaa, 0xfe, 0x0000},                                /* 00,fe,00,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0020},                                /* 00,fe,20,aa */
        /*******/
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xaa, 0xfe, 0x0000},                                /* 00,fe,00,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xdd, 0x00, 0x0010},                                /* 00,00,10,dd */
        {0xbb, 0x04, 0x0400},                                /* 04,04,00,bb */
        {0xdd, 0x00, 0x0100},                                /* 00,01,00,dd */
        {0xbb, 0x01, 0x0400},                                /* 04,01,00,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xbb, 0x41, 0x2803},                                /* 28,41,03,bb */
        {0xbb, 0x40, 0x2c03},                                /* 2c,40,03,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0010},                                /* 00,fe,10,aa */
        {}
};
static const struct usb_action adcm2700_50HZ[] = {
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xbb, 0x05, 0x8400},                                /* 84,05,00,bb */
        {0xbb, 0xd0, 0xb007},                                /* b0,d0,07,bb */
        {0xbb, 0xa0, 0xb80f},                                /* b8,a0,0f,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0010},                                /* 00,fe,10,aa */
        {0xaa, 0x26, 0x00d0},                                /* 00,26,d0,aa */
        {0xaa, 0x28, 0x0002},                                /* 00,28,02,aa */
        {}
};
static const struct usb_action adcm2700_60HZ[] = {
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xbb, 0x07, 0x8400},                                /* 84,07,00,bb */
        {0xbb, 0x82, 0xb006},                                /* b0,82,06,bb */
        {0xbb, 0x04, 0xb80d},                                /* b8,04,0d,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0010},                                /* 00,fe,10,aa */
        {0xaa, 0x26, 0x0057},                                /* 00,26,57,aa */
        {0xaa, 0x28, 0x0002},                                /* 00,28,02,aa */
        {}
};
static const struct usb_action adcm2700_NoFlicker[] = {
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0002},                                /* 00,fe,02,aa */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0a,cc */
        {0xbb, 0x07, 0x8400},                                /* 84,07,00,bb */
        {0xbb, 0x05, 0xb000},                                /* b0,05,00,bb */
        {0xbb, 0xa0, 0xb801},                                /* b8,a0,01,bb */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xaa, 0xfe, 0x0010},                                /* 00,fe,10,aa */
        {}
};
static const struct usb_action cs2102_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x20, ZC3XX_R080_HBLANKHIGH},
        {0xa0, 0x21, ZC3XX_R081_HBLANKLOW},
        {0xa0, 0x30, ZC3XX_R083_RGAINADDR},
        {0xa0, 0x31, ZC3XX_R084_GGAINADDR},
        {0xa0, 0x32, ZC3XX_R085_BGAINADDR},
        {0xa0, 0x23, ZC3XX_R086_EXPTIMEHIGH},
        {0xa0, 0x24, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x25, ZC3XX_R088_EXPTIMELOW},
        {0xa0, 0xb3, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00 */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xaa, 0x02, 0x0008},
        {0xaa, 0x03, 0x0000},
        {0xaa, 0x11, 0x0000},
        {0xaa, 0x12, 0x0089},
        {0xaa, 0x13, 0x0000},
        {0xaa, 0x14, 0x00e9},
        {0xaa, 0x20, 0x0000},
        {0xaa, 0x22, 0x0000},
        {0xaa, 0x0b, 0x0004},
        {0xaa, 0x30, 0x0030},
        {0xaa, 0x31, 0x0030},
        {0xaa, 0x32, 0x0030},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x10, 0x01ae},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x68, ZC3XX_R18D_YTARGET},
        {0xa0, 0x00, 0x01ad},
        {}
};

static const struct usb_action cs2102_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x20, ZC3XX_R080_HBLANKHIGH},
        {0xa0, 0x21, ZC3XX_R081_HBLANKLOW},
        {0xa0, 0x30, ZC3XX_R083_RGAINADDR},
        {0xa0, 0x31, ZC3XX_R084_GGAINADDR},
        {0xa0, 0x32, ZC3XX_R085_BGAINADDR},
        {0xa0, 0x23, ZC3XX_R086_EXPTIMEHIGH},
        {0xa0, 0x24, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x25, ZC3XX_R088_EXPTIMELOW},
        {0xa0, 0xb3, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00 */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xaa, 0x02, 0x0008},
        {0xaa, 0x03, 0x0000},
        {0xaa, 0x11, 0x0001},
        {0xaa, 0x12, 0x0087},
        {0xaa, 0x13, 0x0001},
        {0xaa, 0x14, 0x00e7},
        {0xaa, 0x20, 0x0000},
        {0xaa, 0x22, 0x0000},
        {0xaa, 0x0b, 0x0004},
        {0xaa, 0x30, 0x0030},
        {0xaa, 0x31, 0x0030},
        {0xaa, 0x32, 0x0030},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x15, 0x01ae},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x68, ZC3XX_R18D_YTARGET},
        {0xa0, 0x00, 0x01ad},
        {}
};
static const struct usb_action cs2102_50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x23, 0x0001},
        {0xaa, 0x24, 0x005f},
        {0xaa, 0x25, 0x0090},
        {0xaa, 0x21, 0x00dd},
        {0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0xbf, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x20, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x3a, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x98, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xdd, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xe4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf0, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action cs2102_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x23, 0x0000},
        {0xaa, 0x24, 0x00af},
        {0xaa, 0x25, 0x00c8},
        {0xaa, 0x21, 0x0068},
        {0xa0, 0x01, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x5f, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x90, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x1d, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x4c, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x68, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xe3, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf0, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action cs2102_60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x23, 0x0001},
        {0xaa, 0x24, 0x0055},
        {0xaa, 0x25, 0x00cc},
        {0xaa, 0x21, 0x003f},
        {0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0xab, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x98, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x30, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0xd4, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x39, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x70, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xb0, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action cs2102_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x23, 0x0000},
        {0xaa, 0x24, 0x00aa},
        {0xaa, 0x25, 0x00e6},
        {0xaa, 0x21, 0x003f},
        {0xa0, 0x01, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x55, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xcc, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x18, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x6a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x3f, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xa5, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf0, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action cs2102_NoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x23, 0x0001},
        {0xaa, 0x24, 0x005f},
        {0xaa, 0x25, 0x0000},
        {0xaa, 0x21, 0x0001},
        {0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0xbf, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x80, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x01, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xa0, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action cs2102_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x23, 0x0000},
        {0xaa, 0x24, 0x00af},
        {0xaa, 0x25, 0x0080},
        {0xaa, 0x21, 0x0001},
        {0xa0, 0x01, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x5f, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x80, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x80, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x01, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xa0, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};

/* CS2102_KOCOM */
static const struct usb_action cs2102K_InitialScale[] = {
        {0xa0, 0x11, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x55, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0a, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0b, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0c, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x7c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0d, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0xa3, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x03, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0xfb, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x05, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x06, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x03, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x09, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x08, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0e, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0f, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x10, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x11, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x12, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x15, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x16, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x0c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x17, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x0c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x01, 0x01b1},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x60, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x4c, ZC3XX_R118_BGAIN},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x13, ZC3XX_R120_GAMMA00},        /* gamma 4 */
        {0xa0, 0x38, ZC3XX_R121_GAMMA01},
        {0xa0, 0x59, ZC3XX_R122_GAMMA02},
        {0xa0, 0x79, ZC3XX_R123_GAMMA03},
        {0xa0, 0x92, ZC3XX_R124_GAMMA04},
        {0xa0, 0xa7, ZC3XX_R125_GAMMA05},
        {0xa0, 0xb9, ZC3XX_R126_GAMMA06},
        {0xa0, 0xc8, ZC3XX_R127_GAMMA07},
        {0xa0, 0xd4, ZC3XX_R128_GAMMA08},
        {0xa0, 0xdf, ZC3XX_R129_GAMMA09},
        {0xa0, 0xe7, ZC3XX_R12A_GAMMA0A},
        {0xa0, 0xee, ZC3XX_R12B_GAMMA0B},
        {0xa0, 0xf4, ZC3XX_R12C_GAMMA0C},
        {0xa0, 0xf9, ZC3XX_R12D_GAMMA0D},
        {0xa0, 0xfc, ZC3XX_R12E_GAMMA0E},
        {0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
        {0xa0, 0x26, ZC3XX_R130_GAMMA10},
        {0xa0, 0x22, ZC3XX_R131_GAMMA11},
        {0xa0, 0x20, ZC3XX_R132_GAMMA12},
        {0xa0, 0x1c, ZC3XX_R133_GAMMA13},
        {0xa0, 0x16, ZC3XX_R134_GAMMA14},
        {0xa0, 0x13, ZC3XX_R135_GAMMA15},
        {0xa0, 0x10, ZC3XX_R136_GAMMA16},
        {0xa0, 0x0d, ZC3XX_R137_GAMMA17},
        {0xa0, 0x0b, ZC3XX_R138_GAMMA18},
        {0xa0, 0x09, ZC3XX_R139_GAMMA19},
        {0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
        {0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
        {0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
        {0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
        {0xa0, 0x03, ZC3XX_R13E_GAMMA1E},
        {0xa0, 0x02, ZC3XX_R13F_GAMMA1F},
        {0xa0, 0x58, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf4, ZC3XX_R10B_RGB01},
        {0xa0, 0xf4, ZC3XX_R10C_RGB02},
        {0xa0, 0xf4, ZC3XX_R10D_RGB10},
        {0xa0, 0x58, ZC3XX_R10E_RGB11},
        {0xa0, 0xf4, ZC3XX_R10F_RGB12},
        {0xa0, 0xf4, ZC3XX_R110_RGB20},
        {0xa0, 0xf4, ZC3XX_R111_RGB21},
        {0xa0, 0x58, ZC3XX_R112_RGB22},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x22, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x22, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH},
        {0xa0, 0x22, ZC3XX_R0A4_EXPOSURETIMELOW},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xee, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x3a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x28, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x04, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x0f, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x19, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x1f, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x60, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x4c, ZC3XX_R118_BGAIN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x5c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x5c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x96, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x96, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {}
};

static const struct usb_action cs2102K_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
/*fixme: next sequence = i2c exchanges*/
        {0xa0, 0x55, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0a, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0b, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0c, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x7b, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0d, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0xa3, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x03, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0xfb, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x05, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x06, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x03, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x09, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x08, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0e, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x0f, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x10, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x11, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x12, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x18, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x15, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x16, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x0c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x17, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x0c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0xf7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x01, 0x01b1},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x60, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x4c, ZC3XX_R118_BGAIN},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x13, ZC3XX_R120_GAMMA00},        /* gamma 4 */
        {0xa0, 0x38, ZC3XX_R121_GAMMA01},
        {0xa0, 0x59, ZC3XX_R122_GAMMA02},
        {0xa0, 0x79, ZC3XX_R123_GAMMA03},
        {0xa0, 0x92, ZC3XX_R124_GAMMA04},
        {0xa0, 0xa7, ZC3XX_R125_GAMMA05},
        {0xa0, 0xb9, ZC3XX_R126_GAMMA06},
        {0xa0, 0xc8, ZC3XX_R127_GAMMA07},
        {0xa0, 0xd4, ZC3XX_R128_GAMMA08},
        {0xa0, 0xdf, ZC3XX_R129_GAMMA09},
        {0xa0, 0xe7, ZC3XX_R12A_GAMMA0A},
        {0xa0, 0xee, ZC3XX_R12B_GAMMA0B},
        {0xa0, 0xf4, ZC3XX_R12C_GAMMA0C},
        {0xa0, 0xf9, ZC3XX_R12D_GAMMA0D},
        {0xa0, 0xfc, ZC3XX_R12E_GAMMA0E},
        {0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
        {0xa0, 0x26, ZC3XX_R130_GAMMA10},
        {0xa0, 0x22, ZC3XX_R131_GAMMA11},
        {0xa0, 0x20, ZC3XX_R132_GAMMA12},
        {0xa0, 0x1c, ZC3XX_R133_GAMMA13},
        {0xa0, 0x16, ZC3XX_R134_GAMMA14},
        {0xa0, 0x13, ZC3XX_R135_GAMMA15},
        {0xa0, 0x10, ZC3XX_R136_GAMMA16},
        {0xa0, 0x0d, ZC3XX_R137_GAMMA17},
        {0xa0, 0x0b, ZC3XX_R138_GAMMA18},
        {0xa0, 0x09, ZC3XX_R139_GAMMA19},
        {0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
        {0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
        {0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
        {0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
        {0xa0, 0x03, ZC3XX_R13E_GAMMA1E},
        {0xa0, 0x02, ZC3XX_R13F_GAMMA1F},
        {0xa0, 0x58, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf4, ZC3XX_R10B_RGB01},
        {0xa0, 0xf4, ZC3XX_R10C_RGB02},
        {0xa0, 0xf4, ZC3XX_R10D_RGB10},
        {0xa0, 0x58, ZC3XX_R10E_RGB11},
        {0xa0, 0xf4, ZC3XX_R10F_RGB12},
        {0xa0, 0xf4, ZC3XX_R110_RGB20},
        {0xa0, 0xf4, ZC3XX_R111_RGB21},
        {0xa0, 0x58, ZC3XX_R112_RGB22},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x22, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x22, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH},
        {0xa0, 0x22, ZC3XX_R0A4_EXPOSURETIMELOW},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xee, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x3a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x28, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x04, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x0f, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x19, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x1f, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x60, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x4c, ZC3XX_R118_BGAIN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x5c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x5c, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x96, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x96, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
/*fixme:what does the next sequence?*/
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0xd0, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0xd0, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x01, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x02, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x0a, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x0a, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x44, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x44, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x20, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x21, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x7e, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x00, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x13, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x7e, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x14, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x02, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x18, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x04, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x00, ZC3XX_R094_I2CWRITEACK},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {}
};

static const struct usb_action gc0305_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},        /* 00,00,01,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00,08,03,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xa0, 0x04, ZC3XX_R002_CLOCKSELECT},        /* 00,02,04,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},        /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,e0,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},        /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},        /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},        /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},        /* 01,1c,00,cc */
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},        /* 00,9c,e6,cc */
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},        /* 00,9e,86,cc */
        {0xa0, 0x98, ZC3XX_R08B_I2CDEVICEADDR},        /* 00,8b,98,cc */
        {0xaa, 0x13, 0x0002},        /* 00,13,02,aa */
        {0xaa, 0x15, 0x0003},        /* 00,15,03,aa */
        {0xaa, 0x01, 0x0000},        /* 00,01,00,aa */
        {0xaa, 0x02, 0x0000},        /* 00,02,00,aa */
        {0xaa, 0x1a, 0x0000},        /* 00,1a,00,aa */
        {0xaa, 0x1c, 0x0017},        /* 00,1c,17,aa */
        {0xaa, 0x1d, 0x0080},        /* 00,1d,80,aa */
        {0xaa, 0x1f, 0x0008},        /* 00,1f,08,aa */
        {0xaa, 0x21, 0x0012},        /* 00,21,12,aa */
        {0xa0, 0x82, ZC3XX_R086_EXPTIMEHIGH},        /* 00,86,82,cc */
        {0xa0, 0x83, ZC3XX_R087_EXPTIMEMID},        /* 00,87,83,cc */
        {0xa0, 0x84, ZC3XX_R088_EXPTIMELOW},        /* 00,88,84,cc */
        {0xaa, 0x05, 0x0000},        /* 00,05,00,aa */
        {0xaa, 0x0a, 0x0000},        /* 00,0a,00,aa */
        {0xaa, 0x0b, 0x00b0},        /* 00,0b,b0,aa */
        {0xaa, 0x0c, 0x0000},        /* 00,0c,00,aa */
        {0xaa, 0x0d, 0x00b0},        /* 00,0d,b0,aa */
        {0xaa, 0x0e, 0x0000},        /* 00,0e,00,aa */
        {0xaa, 0x0f, 0x00b0},        /* 00,0f,b0,aa */
        {0xaa, 0x10, 0x0000},        /* 00,10,00,aa */
        {0xaa, 0x11, 0x00b0},        /* 00,11,b0,aa */
        {0xaa, 0x16, 0x0001},        /* 00,16,01,aa */
        {0xaa, 0x17, 0x00e6},        /* 00,17,e6,aa */
        {0xaa, 0x18, 0x0002},        /* 00,18,02,aa */
        {0xaa, 0x19, 0x0086},        /* 00,19,86,aa */
        {0xaa, 0x20, 0x0000},        /* 00,20,00,aa */
        {0xaa, 0x1b, 0x0020},        /* 00,1b,20,aa */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,b7,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,05,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},        /* 01,00,0d,cc */
        {0xa0, 0x76, ZC3XX_R189_AWBSTATUS},        /* 01,89,76,cc */
        {0xa0, 0x09, 0x01ad},        /* 01,ad,09,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},        /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},        /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},        /* 03,01,08,cc */
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},        /* 01,a8,60,cc */
        {0xa0, 0x85, ZC3XX_R18D_YTARGET},        /* 01,8d,85,cc */
        {0xa0, 0x00, 0x011e},        /* 01,1e,00,cc */
        {0xa0, 0x52, ZC3XX_R116_RGAIN},        /* 01,16,52,cc */
        {0xa0, 0x40, ZC3XX_R117_GGAIN},        /* 01,17,40,cc */
        {0xa0, 0x52, ZC3XX_R118_BGAIN},        /* 01,18,52,cc */
        {0xa0, 0x03, ZC3XX_R113_RGB03},        /* 01,13,03,cc */
        {}
};
static const struct usb_action gc0305_InitialScale[] = { /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},        /* 00,00,01,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00,08,03,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc */
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},        /* 00,02,10,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},        /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,e0,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},        /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},        /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},        /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},        /* 01,1c,00,cc */
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},        /* 00,9c,e8,cc */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},        /* 00,9e,88,cc */
        {0xa0, 0x98, ZC3XX_R08B_I2CDEVICEADDR},        /* 00,8b,98,cc */
        {0xaa, 0x13, 0x0000},        /* 00,13,00,aa */
        {0xaa, 0x15, 0x0001},        /* 00,15,01,aa */
        {0xaa, 0x01, 0x0000},        /* 00,01,00,aa */
        {0xaa, 0x02, 0x0000},        /* 00,02,00,aa */
        {0xaa, 0x1a, 0x0000},        /* 00,1a,00,aa */
        {0xaa, 0x1c, 0x0017},        /* 00,1c,17,aa */
        {0xaa, 0x1d, 0x0080},        /* 00,1d,80,aa */
        {0xaa, 0x1f, 0x0008},        /* 00,1f,08,aa */
        {0xaa, 0x21, 0x0012},        /* 00,21,12,aa */
        {0xa0, 0x82, ZC3XX_R086_EXPTIMEHIGH},        /* 00,86,82,cc */
        {0xa0, 0x83, ZC3XX_R087_EXPTIMEMID},        /* 00,87,83,cc */
        {0xa0, 0x84, ZC3XX_R088_EXPTIMELOW},        /* 00,88,84,cc */
        {0xaa, 0x05, 0x0000},        /* 00,05,00,aa */
        {0xaa, 0x0a, 0x0000},        /* 00,0a,00,aa */
        {0xaa, 0x0b, 0x00b0},        /* 00,0b,b0,aa */
        {0xaa, 0x0c, 0x0000},        /* 00,0c,00,aa */
        {0xaa, 0x0d, 0x00b0},        /* 00,0d,b0,aa */
        {0xaa, 0x0e, 0x0000},        /* 00,0e,00,aa */
        {0xaa, 0x0f, 0x00b0},        /* 00,0f,b0,aa */
        {0xaa, 0x10, 0x0000},        /* 00,10,00,aa */
        {0xaa, 0x11, 0x00b0},        /* 00,11,b0,aa */
        {0xaa, 0x16, 0x0001},        /* 00,16,01,aa */
        {0xaa, 0x17, 0x00e8},        /* 00,17,e8,aa */
        {0xaa, 0x18, 0x0002},        /* 00,18,02,aa */
        {0xaa, 0x19, 0x0088},        /* 00,19,88,aa */
        {0xaa, 0x20, 0x0000},        /* 00,20,00,aa */
        {0xaa, 0x1b, 0x0020},        /* 00,1b,20,aa */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,b7,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,05,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},        /* 01,00,0d,cc */
        {0xa0, 0x76, ZC3XX_R189_AWBSTATUS},        /* 01,89,76,cc */
        {0xa0, 0x09, 0x01ad},        /* 01,ad,09,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},        /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},        /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},        /* 03,01,08,cc */
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},        /* 01,a8,60,cc */
        {0xa0, 0x00, 0x011e},        /* 01,1e,00,cc */
        {0xa0, 0x52, ZC3XX_R116_RGAIN},        /* 01,16,52,cc */
        {0xa0, 0x40, ZC3XX_R117_GGAIN},        /* 01,17,40,cc */
        {0xa0, 0x52, ZC3XX_R118_BGAIN},        /* 01,18,52,cc */
        {0xa0, 0x03, ZC3XX_R113_RGB03},        /* 01,13,03,cc */
        {}
};
static const struct usb_action gc0305_50HZ[] = {
        {0xaa, 0x82, 0x0000},        /* 00,82,00,aa */
        {0xaa, 0x83, 0x0002},        /* 00,83,02,aa */
        {0xaa, 0x84, 0x0038},        /* 00,84,38,aa */        /* win: 00,84,ec */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x0b, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,0b,cc */
        {0xa0, 0x18, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,18,cc */
                                                        /* win: 01,92,10 */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x8e, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,8e,cc */
                                                        /* win: 01,97,ec */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},        /* 01,8c,0e,cc */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,15,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,10,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},        /* 00,1d,62,cc */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},        /* 00,1e,90,cc */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},        /* 00,1f,c8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},        /* 00,20,ff,cc */
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},        /* 01,1d,60,cc */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc */
/*        {0xa0, 0x85, ZC3XX_R18D_YTARGET},         * 01,8d,85,cc *
                                                 * if 640x480 */
        {}
};
static const struct usb_action gc0305_60HZ[] = {
        {0xaa, 0x82, 0x0000},        /* 00,82,00,aa */
        {0xaa, 0x83, 0x0000},        /* 00,83,00,aa */
        {0xaa, 0x84, 0x00ec},        /* 00,84,ec,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x0b, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,0b,cc */
        {0xa0, 0x10, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,10,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0xec, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,ec,cc */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},        /* 01,8c,0e,cc */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,15,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,10,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},        /* 00,1d,62,cc */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},        /* 00,1e,90,cc */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},        /* 00,1f,c8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},        /* 00,20,ff,cc */
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},        /* 01,1d,60,cc */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc */
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},        /* 01,8d,80,cc */
        {}
};

static const struct usb_action gc0305_NoFlicker[] = {
        {0xa0, 0x0c, ZC3XX_R100_OPERATIONMODE},        /* 01,00,0c,cc */
        {0xaa, 0x82, 0x0000},        /* 00,82,00,aa */
        {0xaa, 0x83, 0x0000},        /* 00,83,00,aa */
        {0xaa, 0x84, 0x0020},        /* 00,84,20,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x00, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,00,cc */
        {0xa0, 0x48, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,48,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,10,cc */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},        /* 01,8c,0e,cc */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,15,cc */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},        /* 00,1d,62,cc */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},        /* 00,1e,90,cc */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},        /* 00,1f,c8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},        /* 00,20,ff,cc */
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},        /* 01,1d,60,cc */
        {0xa0, 0x03, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,03,cc */
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},        /* 01,8d,80,cc */
        {}
};

static const struct usb_action hdcs2020_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x11, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* qtable 0x05 */
        {0xa0, 0x08, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xaa, 0x1c, 0x0000},
        {0xaa, 0x0a, 0x0001},
        {0xaa, 0x0b, 0x0006},
        {0xaa, 0x0c, 0x007b},
        {0xaa, 0x0d, 0x00a7},
        {0xaa, 0x03, 0x00fb},
        {0xaa, 0x05, 0x0000},
        {0xaa, 0x06, 0x0003},
        {0xaa, 0x09, 0x0008},

        {0xaa, 0x0f, 0x0018},        /* set sensor gain */
        {0xaa, 0x10, 0x0018},
        {0xaa, 0x11, 0x0018},
        {0xaa, 0x12, 0x0018},

        {0xaa, 0x15, 0x004e},
        {0xaa, 0x1c, 0x0004},
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa1, 0x01, 0x0002},
        {0xa1, 0x01, 0x0008},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {0xa1, 0x01, 0x0008},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa1, 0x01, 0x01c8},
        {0xa1, 0x01, 0x01c9},
        {0xa1, 0x01, 0x01ca},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x13, ZC3XX_R120_GAMMA00},        /* gamma 4 */
        {0xa0, 0x38, ZC3XX_R121_GAMMA01},
        {0xa0, 0x59, ZC3XX_R122_GAMMA02},
        {0xa0, 0x79, ZC3XX_R123_GAMMA03},
        {0xa0, 0x92, ZC3XX_R124_GAMMA04},
        {0xa0, 0xa7, ZC3XX_R125_GAMMA05},
        {0xa0, 0xb9, ZC3XX_R126_GAMMA06},
        {0xa0, 0xc8, ZC3XX_R127_GAMMA07},
        {0xa0, 0xd4, ZC3XX_R128_GAMMA08},
        {0xa0, 0xdf, ZC3XX_R129_GAMMA09},
        {0xa0, 0xe7, ZC3XX_R12A_GAMMA0A},
        {0xa0, 0xee, ZC3XX_R12B_GAMMA0B},
        {0xa0, 0xf4, ZC3XX_R12C_GAMMA0C},
        {0xa0, 0xf9, ZC3XX_R12D_GAMMA0D},
        {0xa0, 0xfc, ZC3XX_R12E_GAMMA0E},
        {0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
        {0xa0, 0x26, ZC3XX_R130_GAMMA10},
        {0xa0, 0x22, ZC3XX_R131_GAMMA11},
        {0xa0, 0x20, ZC3XX_R132_GAMMA12},
        {0xa0, 0x1c, ZC3XX_R133_GAMMA13},
        {0xa0, 0x16, ZC3XX_R134_GAMMA14},
        {0xa0, 0x13, ZC3XX_R135_GAMMA15},
        {0xa0, 0x10, ZC3XX_R136_GAMMA16},
        {0xa0, 0x0d, ZC3XX_R137_GAMMA17},
        {0xa0, 0x0b, ZC3XX_R138_GAMMA18},
        {0xa0, 0x09, ZC3XX_R139_GAMMA19},
        {0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
        {0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
        {0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
        {0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
        {0xa0, 0x03, ZC3XX_R13E_GAMMA1E},
        {0xa0, 0x02, ZC3XX_R13F_GAMMA1F},

        {0xa0, 0x66, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xed, ZC3XX_R10B_RGB01},
        {0xa0, 0xed, ZC3XX_R10C_RGB02},
        {0xa0, 0xed, ZC3XX_R10D_RGB10},
        {0xa0, 0x66, ZC3XX_R10E_RGB11},
        {0xa0, 0xed, ZC3XX_R10F_RGB12},
        {0xa0, 0xed, ZC3XX_R110_RGB20},
        {0xa0, 0xed, ZC3XX_R111_RGB21},
        {0xa0, 0x66, ZC3XX_R112_RGB22},

        {0xa1, 0x01, 0x0180},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x13, 0x0031},
        {0xaa, 0x14, 0x0001},
        {0xaa, 0x0e, 0x0004},
        {0xaa, 0x19, 0x00cd},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x62, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x3d, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},

        {0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 0x14 */
        {0xa0, 0x28, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x04, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x18, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x2c, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x41, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action hdcs2020_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xaa, 0x1c, 0x0000},
        {0xaa, 0x0a, 0x0001},
        {0xaa, 0x0b, 0x0006},
        {0xaa, 0x0c, 0x007a},
        {0xaa, 0x0d, 0x00a7},
        {0xaa, 0x03, 0x00fb},
        {0xaa, 0x05, 0x0000},
        {0xaa, 0x06, 0x0003},
        {0xaa, 0x09, 0x0008},
        {0xaa, 0x0f, 0x0018},        /* original setting */
        {0xaa, 0x10, 0x0018},
        {0xaa, 0x11, 0x0018},
        {0xaa, 0x12, 0x0018},
        {0xaa, 0x15, 0x004e},
        {0xaa, 0x1c, 0x0004},
        {0xa0, 0xf7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa1, 0x01, 0x0002},
        {0xa1, 0x01, 0x0008},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {0xa1, 0x01, 0x0008},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa1, 0x01, 0x01c8},
        {0xa1, 0x01, 0x01c9},
        {0xa1, 0x01, 0x01ca},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x13, ZC3XX_R120_GAMMA00},        /* gamma 4 */
        {0xa0, 0x38, ZC3XX_R121_GAMMA01},
        {0xa0, 0x59, ZC3XX_R122_GAMMA02},
        {0xa0, 0x79, ZC3XX_R123_GAMMA03},
        {0xa0, 0x92, ZC3XX_R124_GAMMA04},
        {0xa0, 0xa7, ZC3XX_R125_GAMMA05},
        {0xa0, 0xb9, ZC3XX_R126_GAMMA06},
        {0xa0, 0xc8, ZC3XX_R127_GAMMA07},
        {0xa0, 0xd4, ZC3XX_R128_GAMMA08},
        {0xa0, 0xdf, ZC3XX_R129_GAMMA09},
        {0xa0, 0xe7, ZC3XX_R12A_GAMMA0A},
        {0xa0, 0xee, ZC3XX_R12B_GAMMA0B},
        {0xa0, 0xf4, ZC3XX_R12C_GAMMA0C},
        {0xa0, 0xf9, ZC3XX_R12D_GAMMA0D},
        {0xa0, 0xfc, ZC3XX_R12E_GAMMA0E},
        {0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
        {0xa0, 0x26, ZC3XX_R130_GAMMA10},
        {0xa0, 0x22, ZC3XX_R131_GAMMA11},
        {0xa0, 0x20, ZC3XX_R132_GAMMA12},
        {0xa0, 0x1c, ZC3XX_R133_GAMMA13},
        {0xa0, 0x16, ZC3XX_R134_GAMMA14},
        {0xa0, 0x13, ZC3XX_R135_GAMMA15},
        {0xa0, 0x10, ZC3XX_R136_GAMMA16},
        {0xa0, 0x0d, ZC3XX_R137_GAMMA17},
        {0xa0, 0x0b, ZC3XX_R138_GAMMA18},
        {0xa0, 0x09, ZC3XX_R139_GAMMA19},
        {0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
        {0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
        {0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
        {0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
        {0xa0, 0x03, ZC3XX_R13E_GAMMA1E},
        {0xa0, 0x02, ZC3XX_R13F_GAMMA1F},
        {0xa0, 0x66, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xed, ZC3XX_R10B_RGB01},
        {0xa0, 0xed, ZC3XX_R10C_RGB02},
        {0xa0, 0xed, ZC3XX_R10D_RGB10},
        {0xa0, 0x66, ZC3XX_R10E_RGB11},
        {0xa0, 0xed, ZC3XX_R10F_RGB12},
        {0xa0, 0xed, ZC3XX_R110_RGB20},
        {0xa0, 0xed, ZC3XX_R111_RGB21},
        {0xa0, 0x66, ZC3XX_R112_RGB22},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
 /**** set exposure ***/
        {0xaa, 0x13, 0x0031},
        {0xaa, 0x14, 0x0001},
        {0xaa, 0x0e, 0x0004},
        {0xaa, 0x19, 0x00cd},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x62, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x3d, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x28, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x04, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x18, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x2c, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x41, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action hdcs2020_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x13, 0x0018},                        /* 00,13,18,aa */
        {0xaa, 0x14, 0x0001},                        /* 00,14,01,aa */
        {0xaa, 0x0e, 0x0005},                        /* 00,0e,05,aa */
        {0xaa, 0x19, 0x001f},                        /* 00,19,1f,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,02,cc */
        {0xa0, 0x76, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,76,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x46, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,46,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
        {0xa0, 0x28, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,28,cc */
        {0xa0, 0x05, ZC3XX_R01D_HSYNC_0}, /* 00,1d,05,cc */
        {0xa0, 0x1a, ZC3XX_R01E_HSYNC_1}, /* 00,1e,1a,cc */
        {0xa0, 0x2f, ZC3XX_R01F_HSYNC_2}, /* 00,1f,2f,cc */
        {}
};
static const struct usb_action hdcs2020_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x13, 0x0031},                        /* 00,13,31,aa */
        {0xaa, 0x14, 0x0001},                        /* 00,14,01,aa */
        {0xaa, 0x0e, 0x0004},                        /* 00,0e,04,aa */
        {0xaa, 0x19, 0x00cd},                        /* 00,19,cd,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,02,cc */
        {0xa0, 0x62, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,62,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x3d, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,3d,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
        {0xa0, 0x28, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,28,cc */
        {0xa0, 0x04, ZC3XX_R01D_HSYNC_0}, /* 00,1d,04,cc */
        {0xa0, 0x18, ZC3XX_R01E_HSYNC_1}, /* 00,1e,18,cc */
        {0xa0, 0x2c, ZC3XX_R01F_HSYNC_2}, /* 00,1f,2c,cc */
        {}
};
static const struct usb_action hdcs2020_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x13, 0x0010},                        /* 00,13,10,aa */
        {0xaa, 0x14, 0x0001},                        /* 00,14,01,aa */
        {0xaa, 0x0e, 0x0004},                        /* 00,0e,04,aa */
        {0xaa, 0x19, 0x0000},                        /* 00,19,00,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,02,cc */
        {0xa0, 0x70, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,70,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
        {0xa0, 0x04, ZC3XX_R01D_HSYNC_0}, /* 00,1d,04,cc */
        {0xa0, 0x17, ZC3XX_R01E_HSYNC_1}, /* 00,1e,17,cc */
        {0xa0, 0x2a, ZC3XX_R01F_HSYNC_2}, /* 00,1f,2a,cc */
        {}
};

static const struct usb_action hv7131b_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00 */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xaa, 0x30, 0x002d},
        {0xaa, 0x01, 0x0005},
        {0xaa, 0x11, 0x0000},
        {0xaa, 0x13, 0x0001},        /* {0xaa, 0x13, 0x0000}, */
        {0xaa, 0x14, 0x0001},
        {0xaa, 0x15, 0x00e8},
        {0xaa, 0x16, 0x0002},
        {0xaa, 0x17, 0x0086},                /* 00,17,88,aa */
        {0xaa, 0x31, 0x0038},
        {0xaa, 0x32, 0x0038},
        {0xaa, 0x33, 0x0038},
        {0xaa, 0x5b, 0x0001},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x68, ZC3XX_R18D_YTARGET},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0xc0, 0x019b},
        {0xa0, 0xa0, 0x019c},
        {0xa0, 0x02, ZC3XX_R188_MINGAIN},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xaa, 0x02, 0x0090},                        /* 00,02,80,aa */
        {}
};

static const struct usb_action hv7131b_Initial[] = {        /* 640x480*/
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00 */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xaa, 0x30, 0x002d},
        {0xaa, 0x01, 0x0005},
        {0xaa, 0x11, 0x0001},
        {0xaa, 0x13, 0x0000},        /* {0xaa, 0x13, 0x0001}; */
        {0xaa, 0x14, 0x0001},
        {0xaa, 0x15, 0x00e6},
        {0xaa, 0x16, 0x0002},
        {0xaa, 0x17, 0x0086},
        {0xaa, 0x31, 0x0038},
        {0xaa, 0x32, 0x0038},
        {0xaa, 0x33, 0x0038},
        {0xaa, 0x5b, 0x0001},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0xc0, 0x019b},
        {0xa0, 0xa0, 0x019c},
        {0xa0, 0x02, ZC3XX_R188_MINGAIN},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xaa, 0x02, 0x0090},        /* {0xaa, 0x02, 0x0080}, */
        {}
};
static const struct usb_action hv7131b_50HZ[] = {        /* 640x480*/
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},        /* 00,19,00,cc */
        {0xaa, 0x25, 0x0007},                        /* 00,25,07,aa */
        {0xaa, 0x26, 0x0053},                        /* 00,26,53,aa */
        {0xaa, 0x27, 0x0000},                        /* 00,27,00,aa */
        {0xaa, 0x20, 0x0000},                        /* 00,20,00,aa */
        {0xaa, 0x21, 0x0050},                        /* 00,21,50,aa */
        {0xaa, 0x22, 0x001b},                        /* 00,22,1b,aa */
        {0xaa, 0x23, 0x00fc},                        /* 00,23,fc,aa */
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,2f,cc */
        {0xa0, 0x9b, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,9b,cc */
        {0xa0, 0x80, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,80,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0xea, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,ea,cc */
        {0xa0, 0x60, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,60,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},        /* 01,8c,0c,cc */
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,18,cc */
        {0xa0, 0x18, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,18,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},        /* 00,1d,00,cc */
        {0xa0, 0x50, ZC3XX_R01E_HSYNC_1},        /* 00,1e,50,cc */
        {0xa0, 0x1b, ZC3XX_R01F_HSYNC_2},        /* 00,1f,1b,cc */
        {0xa0, 0xfc, ZC3XX_R020_HSYNC_3},        /* 00,20,fc,cc */
        {}
};
static const struct usb_action hv7131b_50HZScale[] = {        /* 320x240 */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},        /* 00,19,00,cc */
        {0xaa, 0x25, 0x0007},                        /* 00,25,07,aa */
        {0xaa, 0x26, 0x0053},                        /* 00,26,53,aa */
        {0xaa, 0x27, 0x0000},                        /* 00,27,00,aa */
        {0xaa, 0x20, 0x0000},                        /* 00,20,00,aa */
        {0xaa, 0x21, 0x0050},                        /* 00,21,50,aa */
        {0xaa, 0x22, 0x0012},                        /* 00,22,12,aa */
        {0xaa, 0x23, 0x0080},                        /* 00,23,80,aa */
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,2f,cc */
        {0xa0, 0x9b, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,9b,cc */
        {0xa0, 0x80, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,80,cc */
        {0xa0, 0x01, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,01,cc */
        {0xa0, 0xd4, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,d4,cc */
        {0xa0, 0xc0, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,c0,cc */
        {0xa0, 0x07, ZC3XX_R18C_AEFREEZE},        /* 01,8c,07,cc */
        {0xa0, 0x0f, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,0f,cc */
        {0xa0, 0x18, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,18,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},        /* 00,1d,00,cc */
        {0xa0, 0x50, ZC3XX_R01E_HSYNC_1},        /* 00,1e,50,cc */
        {0xa0, 0x12, ZC3XX_R01F_HSYNC_2},        /* 00,1f,12,cc */
        {0xa0, 0x80, ZC3XX_R020_HSYNC_3},        /* 00,20,80,cc */
        {}
};
static const struct usb_action hv7131b_60HZ[] = {        /* 640x480*/
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},        /* 00,19,00,cc */
        {0xaa, 0x25, 0x0007},                        /* 00,25,07,aa */
        {0xaa, 0x26, 0x00a1},                        /* 00,26,a1,aa */
        {0xaa, 0x27, 0x0020},                        /* 00,27,20,aa */
        {0xaa, 0x20, 0x0000},                        /* 00,20,00,aa */
        {0xaa, 0x21, 0x0040},                        /* 00,21,40,aa */
        {0xaa, 0x22, 0x0013},                        /* 00,22,13,aa */
        {0xaa, 0x23, 0x004c},                        /* 00,23,4c,aa */
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,2f,cc */
        {0xa0, 0x4d, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,4d,cc */
        {0xa0, 0x60, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,60,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0xc3, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,c3,cc */
        {0xa0, 0x50, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,50,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},        /* 01,8c,0c,cc */
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,18,cc */
        {0xa0, 0x18, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,18,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},        /* 00,1d,00,cc */
        {0xa0, 0x40, ZC3XX_R01E_HSYNC_1},        /* 00,1e,40,cc */
        {0xa0, 0x13, ZC3XX_R01F_HSYNC_2},        /* 00,1f,13,cc */
        {0xa0, 0x4c, ZC3XX_R020_HSYNC_3},        /* 00,20,4c,cc */
        {}
};
static const struct usb_action hv7131b_60HZScale[] = {        /* 320x240 */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},        /* 00,19,00,cc */
        {0xaa, 0x25, 0x0007},                        /* 00,25,07,aa */
        {0xaa, 0x26, 0x00a1},                        /* 00,26,a1,aa */
        {0xaa, 0x27, 0x0020},                        /* 00,27,20,aa */
        {0xaa, 0x20, 0x0000},                        /* 00,20,00,aa */
        {0xaa, 0x21, 0x00a0},                        /* 00,21,a0,aa */
        {0xaa, 0x22, 0x0016},                        /* 00,22,16,aa */
        {0xaa, 0x23, 0x0040},                        /* 00,23,40,aa */
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,2f,cc */
        {0xa0, 0x4d, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,4d,cc */
        {0xa0, 0x60, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,60,cc */
        {0xa0, 0x01, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,01,cc */
        {0xa0, 0x86, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,86,cc */
        {0xa0, 0xa0, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,a0,cc */
        {0xa0, 0x07, ZC3XX_R18C_AEFREEZE},        /* 01,8c,07,cc */
        {0xa0, 0x0f, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,0f,cc */
        {0xa0, 0x18, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,18,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},        /* 00,1d,00,cc */
        {0xa0, 0xa0, ZC3XX_R01E_HSYNC_1},        /* 00,1e,a0,cc */
        {0xa0, 0x16, ZC3XX_R01F_HSYNC_2},        /* 00,1f,16,cc */
        {0xa0, 0x40, ZC3XX_R020_HSYNC_3},        /* 00,20,40,cc */
        {}
};
static const struct usb_action hv7131b_NoFlicker[] = {        /* 640x480*/
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},        /* 00,19,00,cc */
        {0xaa, 0x25, 0x0003},                        /* 00,25,03,aa */
        {0xaa, 0x26, 0x0000},                        /* 00,26,00,aa */
        {0xaa, 0x27, 0x0000},                        /* 00,27,00,aa */
        {0xaa, 0x20, 0x0000},                        /* 00,20,00,aa */
        {0xaa, 0x21, 0x0010},                        /* 00,21,10,aa */
        {0xaa, 0x22, 0x0000},                        /* 00,22,00,aa */
        {0xaa, 0x23, 0x0003},                        /* 00,23,03,aa */
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,2f,cc */
        {0xa0, 0xf8, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,f8,cc */
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,00,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x02, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,02,cc */
        {0xa0, 0x00, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,00,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},        /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,00,cc */
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},        /* 00,1d,00,cc */
        {0xa0, 0x10, ZC3XX_R01E_HSYNC_1},        /* 00,1e,10,cc */
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},        /* 00,1f,00,cc */
        {0xa0, 0x03, ZC3XX_R020_HSYNC_3},        /* 00,20,03,cc */
        {}
};
static const struct usb_action hv7131b_NoFlickerScale[] = { /* 320x240 */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},        /* 00,19,00,cc */
        {0xaa, 0x25, 0x0003},                        /* 00,25,03,aa */
        {0xaa, 0x26, 0x0000},                        /* 00,26,00,aa */
        {0xaa, 0x27, 0x0000},                        /* 00,27,00,aa */
        {0xaa, 0x20, 0x0000},                        /* 00,20,00,aa */
        {0xaa, 0x21, 0x00a0},                        /* 00,21,a0,aa */
        {0xaa, 0x22, 0x0016},                        /* 00,22,16,aa */
        {0xaa, 0x23, 0x0040},                        /* 00,23,40,aa */
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,2f,cc */
        {0xa0, 0xf8, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,f8,cc */
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,00,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x02, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,02,cc */
        {0xa0, 0x00, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,00,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},        /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,00,cc */
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},        /* 00,1d,00,cc */
        {0xa0, 0xa0, ZC3XX_R01E_HSYNC_1},        /* 00,1e,a0,cc */
        {0xa0, 0x16, ZC3XX_R01F_HSYNC_2},        /* 00,1f,16,cc */
        {0xa0, 0x40, ZC3XX_R020_HSYNC_3},        /* 00,20,40,cc */
        {}
};

/* from lPEPI264v.inf (hv7131b!) */
static const struct usb_action hv7131r_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x000c},
        {0xaa, 0x11, 0x0000},
        {0xaa, 0x13, 0x0000},
        {0xaa, 0x14, 0x0001},
        {0xaa, 0x15, 0x00e8},
        {0xaa, 0x16, 0x0002},
        {0xaa, 0x17, 0x0088},
        {0xaa, 0x30, 0x000b},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},
        {0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0xc0, 0x019b},
        {0xa0, 0xa0, 0x019c},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {}
};
static const struct usb_action hv7131r_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH},
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x000c},
        {0xaa, 0x11, 0x0000},
        {0xaa, 0x13, 0x0000},
        {0xaa, 0x14, 0x0001},
        {0xaa, 0x15, 0x00e6},
        {0xaa, 0x16, 0x0002},
        {0xaa, 0x17, 0x0086},
        {0xaa, 0x30, 0x000b},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},
        {0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0xc0, 0x019b},
        {0xa0, 0xa0, 0x019c},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {}
};
static const struct usb_action hv7131r_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x06, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x68, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xa0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0xea, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x60, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x18, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x08, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action hv7131r_50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x0c, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0xd1, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x40, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x01, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0xd4, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0xc0, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x18, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x08, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action hv7131r_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x06, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x1a, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x80, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0xc3, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x50, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x18, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x08, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action hv7131r_60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x0c, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x35, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x01, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x86, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0xa0, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x18, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x08, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action hv7131r_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0xf8, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x02, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x58, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x08, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action hv7131r_NoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xa0, 0x2f, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0xf8, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x04, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0xb0, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x00, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x00, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0x08, ZC3XX_R020_HSYNC_3},
        {}
};

static const struct usb_action icm105a_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0c, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0xa1, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x00, ZC3XX_R097_WINYSTARTHIGH},
        {0xa0, 0x01, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R099_WINXSTARTHIGH},
        {0xa0, 0x01, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x01, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x01, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xaa, 0x01, 0x0010},
        {0xaa, 0x03, 0x0000},
        {0xaa, 0x04, 0x0001},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0001},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0001},
        {0xaa, 0x04, 0x0011},
        {0xaa, 0x05, 0x00a0},
        {0xaa, 0x06, 0x0001},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0002},
        {0xaa, 0x04, 0x0013},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0001},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0003},
        {0xaa, 0x04, 0x0015},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0004},
        {0xaa, 0x04, 0x0017},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x000d},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0005},
        {0xaa, 0x04, 0x0019},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0006},
        {0xaa, 0x04, 0x0017},
        {0xaa, 0x05, 0x0026},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0007},
        {0xaa, 0x04, 0x0019},
        {0xaa, 0x05, 0x0022},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0008},
        {0xaa, 0x04, 0x0021},
        {0xaa, 0x05, 0x00aa},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0009},
        {0xaa, 0x04, 0x0023},
        {0xaa, 0x05, 0x00aa},
        {0xaa, 0x06, 0x000d},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x000a},
        {0xaa, 0x04, 0x0025},
        {0xaa, 0x05, 0x00aa},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x000b},
        {0xaa, 0x04, 0x00ec},
        {0xaa, 0x05, 0x002e},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x000c},
        {0xaa, 0x04, 0x00fa},
        {0xaa, 0x05, 0x002a},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x07, 0x000d},
        {0xaa, 0x01, 0x0005},
        {0xaa, 0x94, 0x0002},
        {0xaa, 0x90, 0x0000},
        {0xaa, 0x91, 0x001f},
        {0xaa, 0x10, 0x0064},
        {0xaa, 0x9b, 0x00f0},
        {0xaa, 0x9c, 0x0002},
        {0xaa, 0x14, 0x001a},
        {0xaa, 0x20, 0x0080},
        {0xaa, 0x22, 0x0080},
        {0xaa, 0x24, 0x0080},
        {0xaa, 0x26, 0x0080},
        {0xaa, 0x00, 0x0084},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xaa, 0xa8, 0x00c0},
        {0xa1, 0x01, 0x0002},
        {0xa1, 0x01, 0x0008},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {0xa1, 0x01, 0x0008},

        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa1, 0x01, 0x01c8},
        {0xa1, 0x01, 0x01c9},
        {0xa1, 0x01, 0x01ca},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x52, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf7, ZC3XX_R10B_RGB01},
        {0xa0, 0xf7, ZC3XX_R10C_RGB02},
        {0xa0, 0xf7, ZC3XX_R10D_RGB10},
        {0xa0, 0x52, ZC3XX_R10E_RGB11},
        {0xa0, 0xf7, ZC3XX_R10F_RGB12},
        {0xa0, 0xf7, ZC3XX_R110_RGB20},
        {0xa0, 0xf7, ZC3XX_R111_RGB21},
        {0xa0, 0x52, ZC3XX_R112_RGB22},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x0d, 0x0003},
        {0xaa, 0x0c, 0x008c},
        {0xaa, 0x0e, 0x0095},
        {0xaa, 0x0f, 0x0002},
        {0xaa, 0x1c, 0x0094},
        {0xaa, 0x1d, 0x0002},
        {0xaa, 0x20, 0x0080},
        {0xaa, 0x22, 0x0080},
        {0xaa, 0x24, 0x0080},
        {0xaa, 0x26, 0x0080},
        {0xaa, 0x00, 0x0084},
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH},
        {0xa0, 0x94, ZC3XX_R0A4_EXPOSURETIMELOW},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x20, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x84, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x12, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xe3, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xec, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf5, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0xc0, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0xc0, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {}
};

static const struct usb_action icm105a_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0c, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0xa1, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x00, ZC3XX_R097_WINYSTARTHIGH},
        {0xa0, 0x02, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R099_WINXSTARTHIGH},
        {0xa0, 0x02, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x02, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x02, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH},
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xaa, 0x01, 0x0010},
        {0xaa, 0x03, 0x0000},
        {0xaa, 0x04, 0x0001},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0001},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0001},
        {0xaa, 0x04, 0x0011},
        {0xaa, 0x05, 0x00a0},
        {0xaa, 0x06, 0x0001},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0002},
        {0xaa, 0x04, 0x0013},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0001},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0003},
        {0xaa, 0x04, 0x0015},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0004},
        {0xaa, 0x04, 0x0017},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x000d},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0005},
        {0xa0, 0x04, ZC3XX_R092_I2CADDRESSSELECT},
        {0xa0, 0x19, ZC3XX_R093_I2CSETVALUE},
        {0xa0, 0x01, ZC3XX_R090_I2CCOMMAND},
        {0xa1, 0x01, 0x0091},
        {0xaa, 0x05, 0x0020},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0006},
        {0xaa, 0x04, 0x0017},
        {0xaa, 0x05, 0x0026},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0007},
        {0xaa, 0x04, 0x0019},
        {0xaa, 0x05, 0x0022},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0008},
        {0xaa, 0x04, 0x0021},
        {0xaa, 0x05, 0x00aa},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x0009},
        {0xaa, 0x04, 0x0023},
        {0xaa, 0x05, 0x00aa},
        {0xaa, 0x06, 0x000d},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x000a},
        {0xaa, 0x04, 0x0025},
        {0xaa, 0x05, 0x00aa},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x000b},
        {0xaa, 0x04, 0x00ec},
        {0xaa, 0x05, 0x002e},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x03, 0x000c},
        {0xaa, 0x04, 0x00fa},
        {0xaa, 0x05, 0x002a},
        {0xaa, 0x06, 0x0005},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x07, 0x000d},
        {0xaa, 0x01, 0x0005},
        {0xaa, 0x94, 0x0002},
        {0xaa, 0x90, 0x0000},
        {0xaa, 0x91, 0x0010},
        {0xaa, 0x10, 0x0064},
        {0xaa, 0x9b, 0x00f0},
        {0xaa, 0x9c, 0x0002},
        {0xaa, 0x14, 0x001a},
        {0xaa, 0x20, 0x0080},
        {0xaa, 0x22, 0x0080},
        {0xaa, 0x24, 0x0080},
        {0xaa, 0x26, 0x0080},
        {0xaa, 0x00, 0x0084},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xaa, 0xa8, 0x0080},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},
        {0xa1, 0x01, 0x0002},
        {0xa1, 0x01, 0x0008},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {0xa1, 0x01, 0x0008},

        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa1, 0x01, 0x01c8},
        {0xa1, 0x01, 0x01c9},
        {0xa1, 0x01, 0x01ca},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */

        {0xa0, 0x52, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf7, ZC3XX_R10B_RGB01},
        {0xa0, 0xf7, ZC3XX_R10C_RGB02},
        {0xa0, 0xf7, ZC3XX_R10D_RGB10},
        {0xa0, 0x52, ZC3XX_R10E_RGB11},
        {0xa0, 0xf7, ZC3XX_R10F_RGB12},
        {0xa0, 0xf7, ZC3XX_R110_RGB20},
        {0xa0, 0xf7, ZC3XX_R111_RGB21},
        {0xa0, 0x52, ZC3XX_R112_RGB22},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x0d, 0x0003},
        {0xaa, 0x0c, 0x0020},
        {0xaa, 0x0e, 0x000e},
        {0xaa, 0x0f, 0x0002},
        {0xaa, 0x1c, 0x000d},
        {0xaa, 0x1d, 0x0002},
        {0xaa, 0x20, 0x0080},
        {0xaa, 0x22, 0x0080},
        {0xaa, 0x24, 0x0080},
        {0xaa, 0x26, 0x0080},
        {0xaa, 0x00, 0x0084},
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH},
        {0xa0, 0x0d, ZC3XX_R0A4_EXPOSURETIMELOW},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x1a, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x4b, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x12, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xc8, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xd8, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xea, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action icm105a_50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x0d, 0x0003}, /* 00,0d,03,aa */
        {0xaa, 0x0c, 0x0020}, /* 00,0c,20,aa */
        {0xaa, 0x0e, 0x000e}, /* 00,0e,0e,aa */
        {0xaa, 0x0f, 0x0002}, /* 00,0f,02,aa */
        {0xaa, 0x1c, 0x000d}, /* 00,1c,0d,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x20, 0x0080}, /* 00,20,80,aa */
        {0xaa, 0x22, 0x0080}, /* 00,22,80,aa */
        {0xaa, 0x24, 0x0080}, /* 00,24,80,aa */
        {0xaa, 0x26, 0x0080}, /* 00,26,80,aa */
        {0xaa, 0x00, 0x0084}, /* 00,00,84,aa */
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,02,cc */
        {0xa0, 0x0d, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,0d,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x1a, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,1a,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x4b, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,4b,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
        {0xa0, 0x12, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,12,cc */
        {0xa0, 0xc8, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c8,cc */
        {0xa0, 0xd8, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d8,cc */
        {0xa0, 0xea, ZC3XX_R01F_HSYNC_2}, /* 00,1f,ea,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {}
};
static const struct usb_action icm105a_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x0d, 0x0003}, /* 00,0d,03,aa */
        {0xaa, 0x0c, 0x008c}, /* 00,0c,8c,aa */
        {0xaa, 0x0e, 0x0095}, /* 00,0e,95,aa */
        {0xaa, 0x0f, 0x0002}, /* 00,0f,02,aa */
        {0xaa, 0x1c, 0x0094}, /* 00,1c,94,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x20, 0x0080}, /* 00,20,80,aa */
        {0xaa, 0x22, 0x0080}, /* 00,22,80,aa */
        {0xaa, 0x24, 0x0080}, /* 00,24,80,aa */
        {0xaa, 0x26, 0x0080}, /* 00,26,80,aa */
        {0xaa, 0x00, 0x0084}, /* 00,00,84,aa */
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,02,cc */
        {0xa0, 0x94, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,94,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x20, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,20,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x84, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,84,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
        {0xa0, 0x12, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,12,cc */
        {0xa0, 0xe3, ZC3XX_R01D_HSYNC_0}, /* 00,1d,e3,cc */
        {0xa0, 0xec, ZC3XX_R01E_HSYNC_1}, /* 00,1e,ec,cc */
        {0xa0, 0xf5, ZC3XX_R01F_HSYNC_2}, /* 00,1f,f5,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN}, /* 01,a7,00,cc */
        {0xa0, 0xc0, ZC3XX_R1A8_DIGITALGAIN}, /* 01,a8,c0,cc */
        {}
};
static const struct usb_action icm105a_60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x0d, 0x0003}, /* 00,0d,03,aa */
        {0xaa, 0x0c, 0x0004}, /* 00,0c,04,aa */
        {0xaa, 0x0e, 0x000d}, /* 00,0e,0d,aa */
        {0xaa, 0x0f, 0x0002}, /* 00,0f,02,aa */
        {0xaa, 0x1c, 0x0008}, /* 00,1c,08,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x20, 0x0080}, /* 00,20,80,aa */
        {0xaa, 0x22, 0x0080}, /* 00,22,80,aa */
        {0xaa, 0x24, 0x0080}, /* 00,24,80,aa */
        {0xaa, 0x26, 0x0080}, /* 00,26,80,aa */
        {0xaa, 0x00, 0x0084}, /* 00,00,84,aa */
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,02,cc */
        {0xa0, 0x08, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,08,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x10, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,10,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x41, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,41,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
        {0xa0, 0x12, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,12,cc */
        {0xa0, 0xc1, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c1,cc */
        {0xa0, 0xd4, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d4,cc */
        {0xa0, 0xe8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {}
};
static const struct usb_action icm105a_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x0d, 0x0003}, /* 00,0d,03,aa */
        {0xaa, 0x0c, 0x0008}, /* 00,0c,08,aa */
        {0xaa, 0x0e, 0x0086}, /* 00,0e,86,aa */
        {0xaa, 0x0f, 0x0002}, /* 00,0f,02,aa */
        {0xaa, 0x1c, 0x0085}, /* 00,1c,85,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x20, 0x0080}, /* 00,20,80,aa */
        {0xaa, 0x22, 0x0080}, /* 00,22,80,aa */
        {0xaa, 0x24, 0x0080}, /* 00,24,80,aa */
        {0xaa, 0x26, 0x0080}, /* 00,26,80,aa */
        {0xaa, 0x00, 0x0084}, /* 00,00,84,aa */
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,02,cc */
        {0xa0, 0x85, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,85,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x08, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,08,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x81, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,81,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
        {0xa0, 0x12, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,12,cc */
        {0xa0, 0xc2, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c2,cc */
        {0xa0, 0xd6, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d6,cc */
        {0xa0, 0xea, ZC3XX_R01F_HSYNC_2}, /* 00,1f,ea,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN}, /* 01,a7,00,cc */
        {0xa0, 0xc0, ZC3XX_R1A8_DIGITALGAIN}, /* 01,a8,c0,cc */
        {}
};
static const struct usb_action icm105a_NoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x0d, 0x0003}, /* 00,0d,03,aa */
        {0xaa, 0x0c, 0x0004}, /* 00,0c,04,aa */
        {0xaa, 0x0e, 0x000d}, /* 00,0e,0d,aa */
        {0xaa, 0x0f, 0x0002}, /* 00,0f,02,aa */
        {0xaa, 0x1c, 0x0000}, /* 00,1c,00,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x20, 0x0080}, /* 00,20,80,aa */
        {0xaa, 0x22, 0x0080}, /* 00,22,80,aa */
        {0xaa, 0x24, 0x0080}, /* 00,24,80,aa */
        {0xaa, 0x26, 0x0080}, /* 00,26,80,aa */
        {0xaa, 0x00, 0x0084}, /* 00,00,84,aa */
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,02,cc */
        {0xa0, 0x00, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,00,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x20, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,20,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
        {0xa0, 0xc1, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c1,cc */
        {0xa0, 0xd4, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d4,cc */
        {0xa0, 0xe8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {}
};
static const struct usb_action icm105a_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0x0d, 0x0003}, /* 00,0d,03,aa */
        {0xaa, 0x0c, 0x0004}, /* 00,0c,04,aa */
        {0xaa, 0x0e, 0x0081}, /* 00,0e,81,aa */
        {0xaa, 0x0f, 0x0002}, /* 00,0f,02,aa */
        {0xaa, 0x1c, 0x0080}, /* 00,1c,80,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x20, 0x0080}, /* 00,20,80,aa */
        {0xaa, 0x22, 0x0080}, /* 00,22,80,aa */
        {0xaa, 0x24, 0x0080}, /* 00,24,80,aa */
        {0xaa, 0x26, 0x0080}, /* 00,26,80,aa */
        {0xaa, 0x00, 0x0084}, /* 00,00,84,aa */
        {0xa0, 0x02, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,02,cc */
        {0xa0, 0x80, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,80,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x20, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,20,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
        {0xa0, 0xc1, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c1,cc */
        {0xa0, 0xd4, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d4,cc */
        {0xa0, 0xe8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN}, /* 01,a7,00,cc */
        {0xa0, 0xc0, ZC3XX_R1A8_DIGITALGAIN}, /* 01,a8,c0,cc */
        {}
};

static const struct usb_action mc501cb_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, /* 00,00,01,cc */
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT}, /* 00,02,00,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT}, /* 00,10,01,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING}, /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING}, /* 00,08,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,01,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH}, /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW}, /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH}, /* 00,05,01,cc */
        {0xa0, 0xd8, ZC3XX_R006_FRAMEHEIGHTLOW}, /* 00,06,d8,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW}, /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW}, /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW}, /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW}, /* 01,1c,00,cc */
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH}, /* 00,9b,01,cc */
        {0xa0, 0xde, ZC3XX_R09C_WINHEIGHTLOW}, /* 00,9c,de,cc */
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH}, /* 00,9d,02,cc */
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW}, /* 00,9e,86,cc */
        {0xa0, 0x33, ZC3XX_R086_EXPTIMEHIGH}, /* 00,86,33,cc */
        {0xa0, 0x34, ZC3XX_R087_EXPTIMEMID}, /* 00,87,34,cc */
        {0xa0, 0x35, ZC3XX_R088_EXPTIMELOW}, /* 00,88,35,cc */
        {0xa0, 0xb0, ZC3XX_R08B_I2CDEVICEADDR}, /* 00,8b,b0,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xaa, 0x01, 0x0001}, /* 00,01,01,aa */
        {0xaa, 0x01, 0x0003}, /* 00,01,03,aa */
        {0xaa, 0x01, 0x0001}, /* 00,01,01,aa */
        {0xaa, 0x03, 0x0000}, /* 00,03,00,aa */
        {0xaa, 0x10, 0x0000}, /* 00,10,00,aa */
        {0xaa, 0x11, 0x0080}, /* 00,11,80,aa */
        {0xaa, 0x12, 0x0000}, /* 00,12,00,aa */
        {0xaa, 0x13, 0x0000}, /* 00,13,00,aa */
        {0xaa, 0x14, 0x0000}, /* 00,14,00,aa */
        {0xaa, 0x15, 0x0000}, /* 00,15,00,aa */
        {0xaa, 0x16, 0x0000}, /* 00,16,00,aa */
        {0xaa, 0x17, 0x0001}, /* 00,17,01,aa */
        {0xaa, 0x18, 0x00de}, /* 00,18,de,aa */
        {0xaa, 0x19, 0x0002}, /* 00,19,02,aa */
        {0xaa, 0x1a, 0x0086}, /* 00,1a,86,aa */
        {0xaa, 0x20, 0x00a8}, /* 00,20,a8,aa */
        {0xaa, 0x22, 0x0000}, /* 00,22,00,aa */
        {0xaa, 0x23, 0x0000}, /* 00,23,00,aa */
        {0xaa, 0x24, 0x0000}, /* 00,24,00,aa */
        {0xaa, 0x40, 0x0033}, /* 00,40,33,aa */
        {0xaa, 0x41, 0x0077}, /* 00,41,77,aa */
        {0xaa, 0x42, 0x0053}, /* 00,42,53,aa */
        {0xaa, 0x43, 0x00b0}, /* 00,43,b0,aa */
        {0xaa, 0x4b, 0x0001}, /* 00,4b,01,aa */
        {0xaa, 0x72, 0x0020}, /* 00,72,20,aa */
        {0xaa, 0x73, 0x0000}, /* 00,73,00,aa */
        {0xaa, 0x80, 0x0000}, /* 00,80,00,aa */
        {0xaa, 0x85, 0x0050}, /* 00,85,50,aa */
        {0xaa, 0x91, 0x0070}, /* 00,91,70,aa */
        {0xaa, 0x92, 0x0072}, /* 00,92,72,aa */
        {0xaa, 0x03, 0x0001}, /* 00,03,01,aa */
        {0xaa, 0x10, 0x00a0}, /* 00,10,a0,aa */
        {0xaa, 0x11, 0x0001}, /* 00,11,01,aa */
        {0xaa, 0x30, 0x0000}, /* 00,30,00,aa */
        {0xaa, 0x60, 0x0000}, /* 00,60,00,aa */
        {0xaa, 0xa0, 0x001a}, /* 00,a0,1a,aa */
        {0xaa, 0xa1, 0x0000}, /* 00,a1,00,aa */
        {0xaa, 0xa2, 0x003f}, /* 00,a2,3f,aa */
        {0xaa, 0xa3, 0x0028}, /* 00,a3,28,aa */
        {0xaa, 0xa4, 0x0010}, /* 00,a4,10,aa */
        {0xaa, 0xa5, 0x0020}, /* 00,a5,20,aa */
        {0xaa, 0xb1, 0x0044}, /* 00,b1,44,aa */
        {0xaa, 0xd0, 0x0001}, /* 00,d0,01,aa */
        {0xaa, 0xd1, 0x0085}, /* 00,d1,85,aa */
        {0xaa, 0xd2, 0x0080}, /* 00,d2,80,aa */
        {0xaa, 0xd3, 0x0080}, /* 00,d3,80,aa */
        {0xaa, 0xd4, 0x0080}, /* 00,d4,80,aa */
        {0xaa, 0xd5, 0x0080}, /* 00,d5,80,aa */
        {0xaa, 0xc0, 0x00c3}, /* 00,c0,c3,aa */
        {0xaa, 0xc2, 0x0044}, /* 00,c2,44,aa */
        {0xaa, 0xc4, 0x0040}, /* 00,c4,40,aa */
        {0xaa, 0xc5, 0x0020}, /* 00,c5,20,aa */
        {0xaa, 0xc6, 0x0008}, /* 00,c6,08,aa */
        {0xaa, 0x03, 0x0004}, /* 00,03,04,aa */
        {0xaa, 0x10, 0x0000}, /* 00,10,00,aa */
        {0xaa, 0x40, 0x0030}, /* 00,40,30,aa */
        {0xaa, 0x41, 0x0020}, /* 00,41,20,aa */
        {0xaa, 0x42, 0x002d}, /* 00,42,2d,aa */
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x1c, 0x0050}, /* 00,1C,50,aa */
        {0xaa, 0x11, 0x0081}, /* 00,11,81,aa */
        {0xaa, 0x3b, 0x001d}, /* 00,3b,1D,aa */
        {0xaa, 0x3c, 0x004c}, /* 00,3c,4C,aa */
        {0xaa, 0x3d, 0x0018}, /* 00,3d,18,aa */
        {0xaa, 0x3e, 0x006a}, /* 00,3e,6A,aa */
        {0xaa, 0x01, 0x0000}, /* 00,01,00,aa */
        {0xaa, 0x52, 0x00ff}, /* 00,52,FF,aa */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE}, /* 01,00,0d,cc */
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION}, /* 01,01,37,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS}, /* 01,89,06,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE}, /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05}, /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE}, /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS}, /* 03,01,08,cc */
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,02,cc */
        {0xaa, 0x03, 0x0002}, /* 00,03,02,aa */
        {0xaa, 0x51, 0x0027}, /* 00,51,27,aa */
        {0xaa, 0x52, 0x0020}, /* 00,52,20,aa */
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x50, 0x0010}, /* 00,50,10,aa */
        {0xaa, 0x51, 0x0010}, /* 00,51,10,aa */
        {0xaa, 0x54, 0x0010}, /* 00,54,10,aa */
        {0xaa, 0x55, 0x0010}, /* 00,55,10,aa */
        {0xa0, 0xf0, 0x0199}, /* 01,99,F0,cc */
        {0xa0, 0x80, 0x019a}, /* 01,9A,80,cc */

        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x001d}, /* 00,36,1D,aa */
        {0xaa, 0x37, 0x004c}, /* 00,37,4C,aa */
        {0xaa, 0x3b, 0x001d}, /* 00,3B,1D,aa */
        {}
};

static const struct usb_action mc501cb_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, /* 00,00,01,cc */
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT}, /* 00,02,10,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT}, /* 00,10,01,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING}, /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING}, /* 00,08,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,01,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH}, /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW}, /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH}, /* 00,05,01,cc */
        {0xa0, 0xd0, ZC3XX_R006_FRAMEHEIGHTLOW}, /* 00,06,d0,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW}, /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW}, /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW}, /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW}, /* 01,1c,00,cc */
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH}, /* 00,9b,01,cc */
        {0xa0, 0xd8, ZC3XX_R09C_WINHEIGHTLOW}, /* 00,9c,d8,cc */
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH}, /* 00,9d,02,cc */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW}, /* 00,9e,88,cc */
        {0xa0, 0x33, ZC3XX_R086_EXPTIMEHIGH}, /* 00,86,33,cc */
        {0xa0, 0x34, ZC3XX_R087_EXPTIMEMID}, /* 00,87,34,cc */
        {0xa0, 0x35, ZC3XX_R088_EXPTIMELOW}, /* 00,88,35,cc */
        {0xa0, 0xb0, ZC3XX_R08B_I2CDEVICEADDR}, /* 00,8b,b0,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xaa, 0x01, 0x0001}, /* 00,01,01,aa */
        {0xaa, 0x01, 0x0003}, /* 00,01,03,aa */
        {0xaa, 0x01, 0x0001}, /* 00,01,01,aa */
        {0xaa, 0x03, 0x0000}, /* 00,03,00,aa */
        {0xaa, 0x10, 0x0000}, /* 00,10,00,aa */
        {0xaa, 0x11, 0x0080}, /* 00,11,80,aa */
        {0xaa, 0x12, 0x0000}, /* 00,12,00,aa */
        {0xaa, 0x13, 0x0000}, /* 00,13,00,aa */
        {0xaa, 0x14, 0x0000}, /* 00,14,00,aa */
        {0xaa, 0x15, 0x0000}, /* 00,15,00,aa */
        {0xaa, 0x16, 0x0000}, /* 00,16,00,aa */
        {0xaa, 0x17, 0x0001}, /* 00,17,01,aa */
        {0xaa, 0x18, 0x00d8}, /* 00,18,d8,aa */
        {0xaa, 0x19, 0x0002}, /* 00,19,02,aa */
        {0xaa, 0x1a, 0x0088}, /* 00,1a,88,aa */
        {0xaa, 0x20, 0x00a8}, /* 00,20,a8,aa */
        {0xaa, 0x22, 0x0000}, /* 00,22,00,aa */
        {0xaa, 0x23, 0x0000}, /* 00,23,00,aa */
        {0xaa, 0x24, 0x0000}, /* 00,24,00,aa */
        {0xaa, 0x40, 0x0033}, /* 00,40,33,aa */
        {0xaa, 0x41, 0x0077}, /* 00,41,77,aa */
        {0xaa, 0x42, 0x0053}, /* 00,42,53,aa */
        {0xaa, 0x43, 0x00b0}, /* 00,43,b0,aa */
        {0xaa, 0x4b, 0x0001}, /* 00,4b,01,aa */
        {0xaa, 0x72, 0x0020}, /* 00,72,20,aa */
        {0xaa, 0x73, 0x0000}, /* 00,73,00,aa */
        {0xaa, 0x80, 0x0000}, /* 00,80,00,aa */
        {0xaa, 0x85, 0x0050}, /* 00,85,50,aa */
        {0xaa, 0x91, 0x0070}, /* 00,91,70,aa */
        {0xaa, 0x92, 0x0072}, /* 00,92,72,aa */
        {0xaa, 0x03, 0x0001}, /* 00,03,01,aa */
        {0xaa, 0x10, 0x00a0}, /* 00,10,a0,aa */
        {0xaa, 0x11, 0x0001}, /* 00,11,01,aa */
        {0xaa, 0x30, 0x0000}, /* 00,30,00,aa */
        {0xaa, 0x60, 0x0000}, /* 00,60,00,aa */
        {0xaa, 0xa0, 0x001a}, /* 00,a0,1a,aa */
        {0xaa, 0xa1, 0x0000}, /* 00,a1,00,aa */
        {0xaa, 0xa2, 0x003f}, /* 00,a2,3f,aa */
        {0xaa, 0xa3, 0x0028}, /* 00,a3,28,aa */
        {0xaa, 0xa4, 0x0010}, /* 00,a4,10,aa */
        {0xaa, 0xa5, 0x0020}, /* 00,a5,20,aa */
        {0xaa, 0xb1, 0x0044}, /* 00,b1,44,aa */
        {0xaa, 0xd0, 0x0001}, /* 00,d0,01,aa */
        {0xaa, 0xd1, 0x0085}, /* 00,d1,85,aa */
        {0xaa, 0xd2, 0x0080}, /* 00,d2,80,aa */
        {0xaa, 0xd3, 0x0080}, /* 00,d3,80,aa */
        {0xaa, 0xd4, 0x0080}, /* 00,d4,80,aa */
        {0xaa, 0xd5, 0x0080}, /* 00,d5,80,aa */
        {0xaa, 0xc0, 0x00c3}, /* 00,c0,c3,aa */
        {0xaa, 0xc2, 0x0044}, /* 00,c2,44,aa */
        {0xaa, 0xc4, 0x0040}, /* 00,c4,40,aa */
        {0xaa, 0xc5, 0x0020}, /* 00,c5,20,aa */
        {0xaa, 0xc6, 0x0008}, /* 00,c6,08,aa */
        {0xaa, 0x03, 0x0004}, /* 00,03,04,aa */
        {0xaa, 0x10, 0x0000}, /* 00,10,00,aa */
        {0xaa, 0x40, 0x0030}, /* 00,40,30,aa */
        {0xaa, 0x41, 0x0020}, /* 00,41,20,aa */
        {0xaa, 0x42, 0x002d}, /* 00,42,2d,aa */
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x1c, 0x0050}, /* 00,1c,50,aa */
        {0xaa, 0x11, 0x0081}, /* 00,11,81,aa */
        {0xaa, 0x3b, 0x003a}, /* 00,3b,3A,aa */
        {0xaa, 0x3c, 0x0098}, /* 00,3c,98,aa */
        {0xaa, 0x3d, 0x0030}, /* 00,3d,30,aa */
        {0xaa, 0x3e, 0x00d4}, /* 00,3E,D4,aa */
        {0xaa, 0x01, 0x0000}, /* 00,01,00,aa */
        {0xaa, 0x52, 0x00ff}, /* 00,52,FF,aa */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE}, /* 01,00,0d,cc */
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION}, /* 01,01,37,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS}, /* 01,89,06,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE}, /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05}, /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE}, /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS}, /* 03,01,08,cc */
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,02,cc */
        {0xaa, 0x03, 0x0002}, /* 00,03,02,aa */
        {0xaa, 0x51, 0x004e}, /* 00,51,4E,aa */
        {0xaa, 0x52, 0x0041}, /* 00,52,41,aa */
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x50, 0x0010}, /* 00,50,10,aa */
        {0xaa, 0x51, 0x0010}, /* 00,51,10,aa */
        {0xaa, 0x54, 0x0010}, /* 00,54,10,aa */
        {0xaa, 0x55, 0x0010}, /* 00,55,10,aa */
        {0xa0, 0xf0, 0x0199}, /* 01,99,F0,cc */
        {0xa0, 0x80, 0x019a}, /* 01,9A,80,cc */
        {}
};

static const struct usb_action mc501cb_50HZ[] = {
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x001d}, /* 00,36,1D,aa */
        {0xaa, 0x37, 0x004c}, /* 00,37,4C,aa */
        {0xaa, 0x3b, 0x001d}, /* 00,3B,1D,aa */
        {0xaa, 0x3c, 0x004c}, /* 00,3C,4C,aa */
        {0xaa, 0x3d, 0x001d}, /* 00,3D,1D,aa */
        {0xaa, 0x3e, 0x004c}, /* 00,3E,4C,aa */
        {}
};

static const struct usb_action mc501cb_50HZScale[] = {
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x003a}, /* 00,36,3A,aa */
        {0xaa, 0x37, 0x0098}, /* 00,37,98,aa */
        {0xaa, 0x3b, 0x003a}, /* 00,3B,3A,aa */
        {0xaa, 0x3c, 0x0098}, /* 00,3C,98,aa */
        {0xaa, 0x3d, 0x003a}, /* 00,3D,3A,aa */
        {0xaa, 0x3e, 0x0098}, /* 00,3E,98,aa */
        {}
};

static const struct usb_action mc501cb_60HZ[] = {
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x0018}, /* 00,36,18,aa */
        {0xaa, 0x37, 0x006a}, /* 00,37,6A,aa */
        {0xaa, 0x3d, 0x0018}, /* 00,3D,18,aa */
        {0xaa, 0x3e, 0x006a}, /* 00,3E,6A,aa */
        {0xaa, 0x3b, 0x0018}, /* 00,3B,18,aa */
        {0xaa, 0x3c, 0x006a}, /* 00,3C,6A,aa */
        {}
};

static const struct usb_action mc501cb_60HZScale[] = {
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x0030}, /* 00,36,30,aa */
        {0xaa, 0x37, 0x00d4}, /* 00,37,D4,aa */
        {0xaa, 0x3d, 0x0030}, /* 00,3D,30,aa */
        {0xaa, 0x3e, 0x00d4}, /* 00,3E,D4,aa */
        {0xaa, 0x3b, 0x0030}, /* 00,3B,30,aa */
        {0xaa, 0x3c, 0x00d4}, /* 00,3C,D4,aa */
        {}
};

static const struct usb_action mc501cb_NoFlicker[] = {
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x0018}, /* 00,36,18,aa */
        {0xaa, 0x37, 0x006a}, /* 00,37,6A,aa */
        {0xaa, 0x3d, 0x0018}, /* 00,3D,18,aa */
        {0xaa, 0x3e, 0x006a}, /* 00,3E,6A,aa */
        {0xaa, 0x3b, 0x0018}, /* 00,3B,18,aa */
        {0xaa, 0x3c, 0x006a}, /* 00,3C,6A,aa */
        {}
};

static const struct usb_action mc501cb_NoFlickerScale[] = {
        {0xaa, 0x03, 0x0003}, /* 00,03,03,aa */
        {0xaa, 0x10, 0x00fc}, /* 00,10,fc,aa */
        {0xaa, 0x36, 0x0030}, /* 00,36,30,aa */
        {0xaa, 0x37, 0x00d4}, /* 00,37,D4,aa */
        {0xaa, 0x3d, 0x0030}, /* 00,3D,30,aa */
        {0xaa, 0x3e, 0x00d4}, /* 00,3E,D4,aa */
        {0xaa, 0x3b, 0x0030}, /* 00,3B,30,aa */
        {0xaa, 0x3c, 0x00d4}, /* 00,3C,D4,aa */
        {}
};

/* from zs211.inf */
static const struct usb_action ov7620_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, /* 00,00,01,cc */
        {0xa0, 0x40, ZC3XX_R002_CLOCKSELECT}, /* 00,02,40,cc */
        {0xa0, 0x00, ZC3XX_R008_CLOCKSETTING}, /* 00,08,00,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING}, /* 00,01,01,cc */
        {0xa0, 0x06, ZC3XX_R010_CMOSSENSORSELECT}, /* 00,10,06,cc */
        {0xa0, 0x02, ZC3XX_R083_RGAINADDR}, /* 00,83,02,cc */
        {0xa0, 0x01, ZC3XX_R085_BGAINADDR}, /* 00,85,01,cc */
        {0xa0, 0x80, ZC3XX_R086_EXPTIMEHIGH}, /* 00,86,80,cc */
        {0xa0, 0x81, ZC3XX_R087_EXPTIMEMID}, /* 00,87,81,cc */
        {0xa0, 0x10, ZC3XX_R088_EXPTIMELOW}, /* 00,88,10,cc */
        {0xa0, 0xa1, ZC3XX_R08B_I2CDEVICEADDR}, /* 00,8b,a1,cc */
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE}, /* 00,8d,08,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH}, /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW}, /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH}, /* 00,05,01,cc */
        {0xa0, 0xd8, ZC3XX_R006_FRAMEHEIGHTLOW}, /* 00,06,d8,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,01,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW}, /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW}, /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW}, /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW}, /* 01,1c,00,cc */
        {0xa0, 0xde, ZC3XX_R09C_WINHEIGHTLOW}, /* 00,9c,de,cc */
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW}, /* 00,9e,86,cc */
        {0xaa, 0x12, 0x0088}, /* 00,12,88,aa */
        {0xaa, 0x12, 0x0048}, /* 00,12,48,aa */
        {0xaa, 0x75, 0x008a}, /* 00,75,8a,aa */
        {0xaa, 0x13, 0x00a3}, /* 00,13,a3,aa */
        {0xaa, 0x04, 0x0000}, /* 00,04,00,aa */
        {0xaa, 0x05, 0x0000}, /* 00,05,00,aa */
        {0xaa, 0x14, 0x0000}, /* 00,14,00,aa */
        {0xaa, 0x15, 0x0004}, /* 00,15,04,aa */
        {0xaa, 0x17, 0x0018}, /* 00,17,18,aa */
        {0xaa, 0x18, 0x00ba}, /* 00,18,ba,aa */
        {0xaa, 0x19, 0x0002}, /* 00,19,02,aa */
        {0xaa, 0x1a, 0x00f1}, /* 00,1a,f1,aa */
        {0xaa, 0x20, 0x0040}, /* 00,20,40,aa */
        {0xaa, 0x24, 0x0088}, /* 00,24,88,aa */
        {0xaa, 0x25, 0x0078}, /* 00,25,78,aa */
        {0xaa, 0x27, 0x00f6}, /* 00,27,f6,aa */
        {0xaa, 0x28, 0x00a0}, /* 00,28,a0,aa */
        {0xaa, 0x21, 0x0000}, /* 00,21,00,aa */
        {0xaa, 0x2a, 0x0083}, /* 00,2a,83,aa */
        {0xaa, 0x2b, 0x0096}, /* 00,2b,96,aa */
        {0xaa, 0x2d, 0x0005}, /* 00,2d,05,aa */
        {0xaa, 0x74, 0x0020}, /* 00,74,20,aa */
        {0xaa, 0x61, 0x0068}, /* 00,61,68,aa */
        {0xaa, 0x64, 0x0088}, /* 00,64,88,aa */
        {0xaa, 0x00, 0x0000}, /* 00,00,00,aa */
        {0xaa, 0x06, 0x0080}, /* 00,06,80,aa */
        {0xaa, 0x01, 0x0090}, /* 00,01,90,aa */
        {0xaa, 0x02, 0x0030}, /* 00,02,30,aa */
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION}, /* 01,01,77,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE}, /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS}, /* 01,89,06,cc */
        {0xa0, 0x00, 0x01ad}, /* 01,ad,00,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE}, /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05}, /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE}, /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS}, /* 03,01,08,cc */
        {0xa0, 0x68, ZC3XX_R116_RGAIN}, /* 01,16,68,cc */
        {0xa0, 0x52, ZC3XX_R118_BGAIN}, /* 01,18,52,cc */
        {0xa0, 0x40, ZC3XX_R11D_GLOBALGAIN}, /* 01,1d,40,cc */
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,02,cc */
        {0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN}, /* 01,a8,50,cc */
        {}
};
static const struct usb_action ov7620_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, /* 00,00,01,cc */
        {0xa0, 0x50, ZC3XX_R002_CLOCKSELECT},        /* 00,02,50,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00,08,00,cc */
                                                /* mx change? */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING}, /* 00,01,01,cc */
        {0xa0, 0x06, ZC3XX_R010_CMOSSENSORSELECT}, /* 00,10,06,cc */
        {0xa0, 0x02, ZC3XX_R083_RGAINADDR},        /* 00,83,02,cc */
        {0xa0, 0x01, ZC3XX_R085_BGAINADDR},        /* 00,85,01,cc */
        {0xa0, 0x80, ZC3XX_R086_EXPTIMEHIGH},        /* 00,86,80,cc */
        {0xa0, 0x81, ZC3XX_R087_EXPTIMEMID},        /* 00,87,81,cc */
        {0xa0, 0x10, ZC3XX_R088_EXPTIMELOW},        /* 00,88,10,cc */
        {0xa0, 0xa1, ZC3XX_R08B_I2CDEVICEADDR}, /* 00,8b,a1,cc */
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE}, /* 00,8d,08,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH}, /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW}, /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH}, /* 00,05,01,cc */
        {0xa0, 0xd0, ZC3XX_R006_FRAMEHEIGHTLOW}, /* 00,06,d0,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,01,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},        /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},        /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},        /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},        /* 01,1c,00,cc */
        {0xa0, 0xd6, ZC3XX_R09C_WINHEIGHTLOW},        /* 00,9c,d6,cc */
                                                /* OV7648 00,9c,d8,cc */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},        /* 00,9e,88,cc */
        {0xaa, 0x12, 0x0088}, /* 00,12,88,aa */
        {0xaa, 0x12, 0x0048}, /* 00,12,48,aa */
        {0xaa, 0x75, 0x008a}, /* 00,75,8a,aa */
        {0xaa, 0x13, 0x00a3}, /* 00,13,a3,aa */
        {0xaa, 0x04, 0x0000}, /* 00,04,00,aa */
        {0xaa, 0x05, 0x0000}, /* 00,05,00,aa */
        {0xaa, 0x14, 0x0000}, /* 00,14,00,aa */
        {0xaa, 0x15, 0x0004}, /* 00,15,04,aa */
        {0xaa, 0x24, 0x0088}, /* 00,24,88,aa */
        {0xaa, 0x25, 0x0078}, /* 00,25,78,aa */
        {0xaa, 0x17, 0x0018}, /* 00,17,18,aa */
        {0xaa, 0x18, 0x00ba}, /* 00,18,ba,aa */
        {0xaa, 0x19, 0x0002}, /* 00,19,02,aa */
        {0xaa, 0x1a, 0x00f2}, /* 00,1a,f2,aa */
        {0xaa, 0x20, 0x0040}, /* 00,20,40,aa */
        {0xaa, 0x27, 0x00f6}, /* 00,27,f6,aa */
        {0xaa, 0x28, 0x00a0}, /* 00,28,a0,aa */
        {0xaa, 0x21, 0x0000}, /* 00,21,00,aa */
        {0xaa, 0x2a, 0x0083}, /* 00,2a,83,aa */
        {0xaa, 0x2b, 0x0096}, /* 00,2b,96,aa */
        {0xaa, 0x2d, 0x0005}, /* 00,2d,05,aa */
        {0xaa, 0x74, 0x0020}, /* 00,74,20,aa */
        {0xaa, 0x61, 0x0068}, /* 00,61,68,aa */
        {0xaa, 0x64, 0x0088}, /* 00,64,88,aa */
        {0xaa, 0x00, 0x0000}, /* 00,00,00,aa */
        {0xaa, 0x06, 0x0080}, /* 00,06,80,aa */
        {0xaa, 0x01, 0x0090}, /* 00,01,90,aa */
        {0xaa, 0x02, 0x0030}, /* 00,02,30,aa */
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION}, /* 01,01,77,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE}, /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},        /* 01,89,06,cc */
        {0xa0, 0x00, 0x01ad},                        /* 01,ad,00,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE}, /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},        /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE}, /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},        /* 03,01,08,cc */
        {0xa0, 0x68, ZC3XX_R116_RGAIN},                /* 01,16,68,cc */
        {0xa0, 0x52, ZC3XX_R118_BGAIN},                /* 01,18,52,cc */
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},        /* 01,1d,50,cc */
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,02,cc */
        {0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},        /* 01,a8,50,cc */
        {}
};
static const struct usb_action ov7620_50HZ[] = {
        {0xdd, 0x00, 0x0100},        /* 00,01,00,dd */
        {0xaa, 0x2b, 0x0096},        /* 00,2b,96,aa */
        /* enable 1/120s & 1/100s exposures for banding filter */
        {0xaa, 0x75, 0x008e},
        {0xaa, 0x2d, 0x0005},        /* 00,2d,05,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,04,cc */
        {0xa0, 0x18, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,18,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x83, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,83,cc */
        {0xaa, 0x76, 0x0003},                                /* 00,76,03,aa */
/*        {0xa0, 0x40, ZC3XX_R002_CLOCKSELECT},                 * 00,02,40,cc
                                                         * if mode0 (640x480) */
        {}
};
static const struct usb_action ov7620_60HZ[] = {
        {0xdd, 0x00, 0x0100},                        /* 00,01,00,dd */
        {0xaa, 0x2b, 0x0000},                        /* 00,2b,00,aa */
        /* enable 1/120s & 1/100s exposures for banding filter */
        {0xaa, 0x75, 0x008e},
        {0xaa, 0x2d, 0x0005},                        /* 00,2d,05,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x18, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,18,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x83, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,83,cc */
        {0xaa, 0x76, 0x0003},                        /* 00,76,03,aa */
/*        {0xa0, 0x40, ZC3XX_R002_CLOCKSELECT},         * 00,02,40,cc
                                                 * if mode0 (640x480) */
/* ?? in gspca v1, it was
        {0xa0, 0x00, 0x0039},  * 00,00,00,dd *
        {0xa1, 0x01, 0x0037},                */
        {}
};
static const struct usb_action ov7620_NoFlicker[] = {
        {0xdd, 0x00, 0x0100},                        /* 00,01,00,dd */
        {0xaa, 0x2b, 0x0000},                        /* 00,2b,00,aa */
        /* disable 1/120s & 1/100s exposures for banding filter */
        {0xaa, 0x75, 0x008a},
        {0xaa, 0x2d, 0x0001},                        /* 00,2d,01,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,04,cc */
        {0xa0, 0x18, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,18,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x01, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,01,cc */
/*        {0xa0, 0x44, ZC3XX_R002_CLOCKSELECT},         * 00,02,44,cc
                                                 * if mode1 (320x240) */
/* ?? was
        {0xa0, 0x00, 0x0039},  * 00,00,00,dd *
        {0xa1, 0x01, 0x0037},                */
        {}
};

static const struct usb_action ov7630c_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x06, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0xa1, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x12, 0x0080},
        {0xa0, 0x02, ZC3XX_R083_RGAINADDR},
        {0xa0, 0x01, ZC3XX_R085_BGAINADDR},
        {0xa0, 0x90, ZC3XX_R086_EXPTIMEHIGH},
        {0xa0, 0x91, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x10, ZC3XX_R088_EXPTIMELOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xd8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xaa, 0x12, 0x0069},
        {0xaa, 0x04, 0x0020},
        {0xaa, 0x06, 0x0050},
        {0xaa, 0x13, 0x0083},
        {0xaa, 0x14, 0x0000},
        {0xaa, 0x15, 0x0024},
        {0xaa, 0x17, 0x0018},
        {0xaa, 0x18, 0x00ba},
        {0xaa, 0x19, 0x0002},
        {0xaa, 0x1a, 0x00f6},
        {0xaa, 0x1b, 0x0002},
        {0xaa, 0x20, 0x00c2},
        {0xaa, 0x24, 0x0060},
        {0xaa, 0x25, 0x0040},
        {0xaa, 0x26, 0x0030},
        {0xaa, 0x27, 0x00ea},
        {0xaa, 0x28, 0x00a0},
        {0xaa, 0x21, 0x0000},
        {0xaa, 0x2a, 0x0081},
        {0xaa, 0x2b, 0x0096},
        {0xaa, 0x2d, 0x0094},
        {0xaa, 0x2f, 0x003d},
        {0xaa, 0x30, 0x0024},
        {0xaa, 0x60, 0x0000},
        {0xaa, 0x61, 0x0040},
        {0xaa, 0x68, 0x007c},
        {0xaa, 0x6f, 0x0015},
        {0xaa, 0x75, 0x0088},
        {0xaa, 0x77, 0x00b5},
        {0xaa, 0x01, 0x0060},
        {0xaa, 0x02, 0x0060},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R116_RGAIN},
        {0xa0, 0x46, ZC3XX_R118_BGAIN},
        {0xa0, 0x04, ZC3XX_R113_RGB03},
/* 0x10, */
        {0xa1, 0x01, 0x0002},
        {0xa0, 0x50, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf8, ZC3XX_R10B_RGB01},
        {0xa0, 0xf8, ZC3XX_R10C_RGB02},
        {0xa0, 0xf8, ZC3XX_R10D_RGB10},
        {0xa0, 0x50, ZC3XX_R10E_RGB11},
        {0xa0, 0xf8, ZC3XX_R10F_RGB12},
        {0xa0, 0xf8, ZC3XX_R110_RGB20},
        {0xa0, 0xf8, ZC3XX_R111_RGB21},
        {0xa0, 0x50, ZC3XX_R112_RGB22},
        {0xa1, 0x01, 0x0008},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa1, 0x01, 0x01c8},
        {0xa1, 0x01, 0x01c9},
        {0xa1, 0x01, 0x01ca},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x01, ZC3XX_R120_GAMMA00},        /* gamma 2 ?*/
        {0xa0, 0x0c, ZC3XX_R121_GAMMA01},
        {0xa0, 0x1f, ZC3XX_R122_GAMMA02},
        {0xa0, 0x3a, ZC3XX_R123_GAMMA03},
        {0xa0, 0x53, ZC3XX_R124_GAMMA04},
        {0xa0, 0x6d, ZC3XX_R125_GAMMA05},
        {0xa0, 0x85, ZC3XX_R126_GAMMA06},
        {0xa0, 0x9c, ZC3XX_R127_GAMMA07},
        {0xa0, 0xb0, ZC3XX_R128_GAMMA08},
        {0xa0, 0xc2, ZC3XX_R129_GAMMA09},
        {0xa0, 0xd1, ZC3XX_R12A_GAMMA0A},
        {0xa0, 0xde, ZC3XX_R12B_GAMMA0B},
        {0xa0, 0xe9, ZC3XX_R12C_GAMMA0C},
        {0xa0, 0xf2, ZC3XX_R12D_GAMMA0D},
        {0xa0, 0xf9, ZC3XX_R12E_GAMMA0E},
        {0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
        {0xa0, 0x05, ZC3XX_R130_GAMMA10},
        {0xa0, 0x0f, ZC3XX_R131_GAMMA11},
        {0xa0, 0x16, ZC3XX_R132_GAMMA12},
        {0xa0, 0x1a, ZC3XX_R133_GAMMA13},
        {0xa0, 0x19, ZC3XX_R134_GAMMA14},
        {0xa0, 0x19, ZC3XX_R135_GAMMA15},
        {0xa0, 0x17, ZC3XX_R136_GAMMA16},
        {0xa0, 0x15, ZC3XX_R137_GAMMA17},
        {0xa0, 0x12, ZC3XX_R138_GAMMA18},
        {0xa0, 0x10, ZC3XX_R139_GAMMA19},
        {0xa0, 0x0e, ZC3XX_R13A_GAMMA1A},
        {0xa0, 0x0b, ZC3XX_R13B_GAMMA1B},
        {0xa0, 0x09, ZC3XX_R13C_GAMMA1C},
        {0xa0, 0x08, ZC3XX_R13D_GAMMA1D},
        {0xa0, 0x06, ZC3XX_R13E_GAMMA1E},
        {0xa0, 0x03, ZC3XX_R13F_GAMMA1F},
        {0xa0, 0x50, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf8, ZC3XX_R10B_RGB01},
        {0xa0, 0xf8, ZC3XX_R10C_RGB02},
        {0xa0, 0xf8, ZC3XX_R10D_RGB10},
        {0xa0, 0x50, ZC3XX_R10E_RGB11},
        {0xa0, 0xf8, ZC3XX_R10F_RGB12},
        {0xa0, 0xf8, ZC3XX_R110_RGB20},
        {0xa0, 0xf8, ZC3XX_R111_RGB21},
        {0xa0, 0x50, ZC3XX_R112_RGB22},

        {0xa1, 0x01, 0x0180},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xaa, 0x10, 0x001b},
        {0xaa, 0x76, 0x0002},
        {0xaa, 0x2a, 0x0081},
        {0xaa, 0x2b, 0x0000},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x01, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xb8, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x37, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xaa, 0x13, 0x0083},        /* 40 */
        {0xa1, 0x01, 0x0180},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};

static const struct usb_action ov7630c_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x06, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0xa1, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},

        {0xaa, 0x12, 0x0080},
        {0xa0, 0x02, ZC3XX_R083_RGAINADDR},
        {0xa0, 0x01, ZC3XX_R085_BGAINADDR},
        {0xa0, 0x90, ZC3XX_R086_EXPTIMEHIGH},
        {0xa0, 0x91, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x10, ZC3XX_R088_EXPTIMELOW},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},
        {0xaa, 0x12, 0x0069},        /* i2c */
        {0xaa, 0x04, 0x0020},
        {0xaa, 0x06, 0x0050},
        {0xaa, 0x13, 0x00c3},
        {0xaa, 0x14, 0x0000},
        {0xaa, 0x15, 0x0024},
        {0xaa, 0x19, 0x0003},
        {0xaa, 0x1a, 0x00f6},
        {0xaa, 0x1b, 0x0002},
        {0xaa, 0x20, 0x00c2},
        {0xaa, 0x24, 0x0060},
        {0xaa, 0x25, 0x0040},
        {0xaa, 0x26, 0x0030},
        {0xaa, 0x27, 0x00ea},
        {0xaa, 0x28, 0x00a0},
        {0xaa, 0x21, 0x0000},
        {0xaa, 0x2a, 0x0081},
        {0xaa, 0x2b, 0x0096},
        {0xaa, 0x2d, 0x0084},
        {0xaa, 0x2f, 0x003d},
        {0xaa, 0x30, 0x0024},
        {0xaa, 0x60, 0x0000},
        {0xaa, 0x61, 0x0040},
        {0xaa, 0x68, 0x007c},
        {0xaa, 0x6f, 0x0015},
        {0xaa, 0x75, 0x0088},
        {0xaa, 0x77, 0x00b5},
        {0xaa, 0x01, 0x0060},
        {0xaa, 0x02, 0x0060},
        {0xaa, 0x17, 0x0018},
        {0xaa, 0x18, 0x00ba},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x77, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x04, ZC3XX_R1A7_CALCGLOBALMEAN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R116_RGAIN},
        {0xa0, 0x46, ZC3XX_R118_BGAIN},
        {0xa0, 0x04, ZC3XX_R113_RGB03},

        {0xa1, 0x01, 0x0002},
        {0xa0, 0x4e, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xfe, ZC3XX_R10B_RGB01},
        {0xa0, 0xf4, ZC3XX_R10C_RGB02},
        {0xa0, 0xf7, ZC3XX_R10D_RGB10},
        {0xa0, 0x4d, ZC3XX_R10E_RGB11},
        {0xa0, 0xfc, ZC3XX_R10F_RGB12},
        {0xa0, 0x00, ZC3XX_R110_RGB20},
        {0xa0, 0xf6, ZC3XX_R111_RGB21},
        {0xa0, 0x4a, ZC3XX_R112_RGB22},

        {0xa1, 0x01, 0x0008},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* clock ? */
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},        /* sharpness+ */
        {0xa1, 0x01, 0x01c8},
        {0xa1, 0x01, 0x01c9},
        {0xa1, 0x01, 0x01ca},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},        /* sharpness- */
        {0xa0, 0x16, ZC3XX_R120_GAMMA00},        /* gamma ~4 */
        {0xa0, 0x3a, ZC3XX_R121_GAMMA01},
        {0xa0, 0x5b, ZC3XX_R122_GAMMA02},
        {0xa0, 0x7c, ZC3XX_R123_GAMMA03},
        {0xa0, 0x94, ZC3XX_R124_GAMMA04},
        {0xa0, 0xa9, ZC3XX_R125_GAMMA05},
        {0xa0, 0xbb, ZC3XX_R126_GAMMA06},
        {0xa0, 0xca, ZC3XX_R127_GAMMA07},
        {0xa0, 0xd7, ZC3XX_R128_GAMMA08},
        {0xa0, 0xe1, ZC3XX_R129_GAMMA09},
        {0xa0, 0xea, ZC3XX_R12A_GAMMA0A},
        {0xa0, 0xf1, ZC3XX_R12B_GAMMA0B},
        {0xa0, 0xf7, ZC3XX_R12C_GAMMA0C},
        {0xa0, 0xfc, ZC3XX_R12D_GAMMA0D},
        {0xa0, 0xff, ZC3XX_R12E_GAMMA0E},
        {0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
        {0xa0, 0x20, ZC3XX_R130_GAMMA10},
        {0xa0, 0x22, ZC3XX_R131_GAMMA11},
        {0xa0, 0x20, ZC3XX_R132_GAMMA12},
        {0xa0, 0x1c, ZC3XX_R133_GAMMA13},
        {0xa0, 0x16, ZC3XX_R134_GAMMA14},
        {0xa0, 0x13, ZC3XX_R135_GAMMA15},
        {0xa0, 0x10, ZC3XX_R136_GAMMA16},
        {0xa0, 0x0d, ZC3XX_R137_GAMMA17},
        {0xa0, 0x0b, ZC3XX_R138_GAMMA18},
        {0xa0, 0x09, ZC3XX_R139_GAMMA19},
        {0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
        {0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
        {0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
        {0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
        {0xa0, 0x00, ZC3XX_R13E_GAMMA1E},
        {0xa0, 0x01, ZC3XX_R13F_GAMMA1F},
        {0xa0, 0x4e, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xfe, ZC3XX_R10B_RGB01},
        {0xa0, 0xf4, ZC3XX_R10C_RGB02},
        {0xa0, 0xf7, ZC3XX_R10D_RGB10},
        {0xa0, 0x4d, ZC3XX_R10E_RGB11},
        {0xa0, 0xfc, ZC3XX_R10F_RGB12},
        {0xa0, 0x00, ZC3XX_R110_RGB20},
        {0xa0, 0xf6, ZC3XX_R111_RGB21},
        {0xa0, 0x4a, ZC3XX_R112_RGB22},

        {0xa1, 0x01, 0x0180},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xaa, 0x10, 0x000d},
        {0xaa, 0x76, 0x0002},
        {0xaa, 0x2a, 0x0081},
        {0xaa, 0x2b, 0x0000},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x00, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xd8, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x1b, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xaa, 0x13, 0x00c3},

        {0xa1, 0x01, 0x0180},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};

static const struct usb_action pas106b_Initial_com[] = {
/* Sream and Sensor specific */
        {0xa1, 0x01, 0x0010},        /* CMOSSensorSelect */
/* System */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},        /* SystemControl */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},        /* SystemControl */
/* Picture size */
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},        /* ClockSelect */
        {0xa0, 0x03, 0x003a},
        {0xa0, 0x0c, 0x003b},
        {0xa0, 0x04, 0x0038},
        {}
};

static const struct usb_action pas106b_InitialScale[] = {        /* 176x144 */
/* JPEG control */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
/* Sream and Sensor specific */
        {0xa0, 0x0f, ZC3XX_R010_CMOSSENSORSELECT},
/* Picture size */
        {0xa0, 0x00, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0xb0, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x00, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0x90, ZC3XX_R006_FRAMEHEIGHTLOW},
/* System */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
/* Sream and Sensor specific */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
/* Sensor Interface */
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE},
/* Window inside sensor array */
        {0xa0, 0x03, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x03, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0x28, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x68, ZC3XX_R09E_WINWIDTHLOW},
/* Init the sensor */
        {0xaa, 0x02, 0x0004},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x09, 0x0005},
        {0xaa, 0x0a, 0x0002},
        {0xaa, 0x0b, 0x0002},
        {0xaa, 0x0c, 0x0005},
        {0xaa, 0x0d, 0x0000},
        {0xaa, 0x0e, 0x0002},
        {0xaa, 0x14, 0x0081},
/* Other registers */
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
/* Frame retrieving */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
/* Gains */
        {0xa0, 0xa0, ZC3XX_R1A8_DIGITALGAIN},
/* Unknown */
        {0xa0, 0x00, 0x01ad},
/* Sharpness */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
/* Other registers */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
/* Auto exposure and white balance */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
/*Dead pixels */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
/* EEPROM */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
/* JPEG control */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},
/* Other registers */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
/* Auto exposure and white balance */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
/*Dead pixels */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
/* EEPROM */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
/* JPEG control */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},

        {0xa0, 0x58, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf4, ZC3XX_R10B_RGB01},
        {0xa0, 0xf4, ZC3XX_R10C_RGB02},
        {0xa0, 0xf4, ZC3XX_R10D_RGB10},
        {0xa0, 0x58, ZC3XX_R10E_RGB11},
        {0xa0, 0xf4, ZC3XX_R10F_RGB12},
        {0xa0, 0xf4, ZC3XX_R110_RGB20},
        {0xa0, 0xf4, ZC3XX_R111_RGB21},
        {0xa0, 0x58, ZC3XX_R112_RGB22},
/* Auto correction */
        {0xa0, 0x03, ZC3XX_R181_WINXSTART},
        {0xa0, 0x08, ZC3XX_R182_WINXWIDTH},
        {0xa0, 0x16, ZC3XX_R183_WINXCENTER},
        {0xa0, 0x03, ZC3XX_R184_WINYSTART},
        {0xa0, 0x05, ZC3XX_R185_WINYWIDTH},
        {0xa0, 0x14, ZC3XX_R186_WINYCENTER},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
/* Auto exposure and white balance */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xb1, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x87, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
/* sensor on */
        {0xaa, 0x07, 0x00b1},
        {0xaa, 0x05, 0x0003},
        {0xaa, 0x04, 0x0001},
        {0xaa, 0x03, 0x003b},
/* Gains */
        {0xa0, 0x20, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xa0, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
/* Auto correction */
        {0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa1, 0x01, 0x0180},                                /* AutoCorrectEnable */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
/* Gains */
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},
        {}
};

static const struct usb_action pas106b_Initial[] = {        /* 352x288 */
/* JPEG control */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
/* Sream and Sensor specific */
        {0xa0, 0x0f, ZC3XX_R010_CMOSSENSORSELECT},
/* Picture size */
        {0xa0, 0x01, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x60, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0x20, ZC3XX_R006_FRAMEHEIGHTLOW},
/* System */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
/* Sream and Sensor specific */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
/* Sensor Interface */
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE},
/* Window inside sensor array */
        {0xa0, 0x03, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x03, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0x28, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x68, ZC3XX_R09E_WINWIDTHLOW},
/* Init the sensor */
        {0xaa, 0x02, 0x0004},
        {0xaa, 0x08, 0x0000},
        {0xaa, 0x09, 0x0005},
        {0xaa, 0x0a, 0x0002},
        {0xaa, 0x0b, 0x0002},
        {0xaa, 0x0c, 0x0005},
        {0xaa, 0x0d, 0x0000},
        {0xaa, 0x0e, 0x0002},
        {0xaa, 0x14, 0x0081},
/* Other registers */
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
/* Frame retrieving */
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
/* Gains */
        {0xa0, 0xa0, ZC3XX_R1A8_DIGITALGAIN},
/* Unknown */
        {0xa0, 0x00, 0x01ad},
/* Sharpness */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
/* Other registers */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
/* Auto exposure and white balance */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},
/*Dead pixels */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
/* EEPROM */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
/* JPEG control */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},
/* Other registers */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
/* Auto exposure and white balance */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
/*Dead pixels */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
/* EEPROM */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
/* JPEG control */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},
        {0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},

        {0xa0, 0x58, ZC3XX_R10A_RGB00},        /* matrix */
        {0xa0, 0xf4, ZC3XX_R10B_RGB01},
        {0xa0, 0xf4, ZC3XX_R10C_RGB02},
        {0xa0, 0xf4, ZC3XX_R10D_RGB10},
        {0xa0, 0x58, ZC3XX_R10E_RGB11},
        {0xa0, 0xf4, ZC3XX_R10F_RGB12},
        {0xa0, 0xf4, ZC3XX_R110_RGB20},
        {0xa0, 0xf4, ZC3XX_R111_RGB21},
        {0xa0, 0x58, ZC3XX_R112_RGB22},
/* Auto correction */
        {0xa0, 0x03, ZC3XX_R181_WINXSTART},
        {0xa0, 0x08, ZC3XX_R182_WINXWIDTH},
        {0xa0, 0x16, ZC3XX_R183_WINXCENTER},
        {0xa0, 0x03, ZC3XX_R184_WINYSTART},
        {0xa0, 0x05, ZC3XX_R185_WINYWIDTH},
        {0xa0, 0x14, ZC3XX_R186_WINYCENTER},
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},

/* Auto exposure and white balance */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xb1, ZC3XX_R192_EXPOSURELIMITLOW},

        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x87, ZC3XX_R197_ANTIFLICKERLOW},

        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
/* sensor on */
        {0xaa, 0x07, 0x00b1},
        {0xaa, 0x05, 0x0003},
        {0xaa, 0x04, 0x0001},
        {0xaa, 0x03, 0x003b},
/* Gains */
        {0xa0, 0x20, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
/* Auto correction */
        {0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa1, 0x01, 0x0180},                                /* AutoCorrectEnable */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
/* Gains */
        {0xa0, 0x40, ZC3XX_R116_RGAIN},
        {0xa0, 0x40, ZC3XX_R117_GGAIN},
        {0xa0, 0x40, ZC3XX_R118_BGAIN},

        {0xa0, 0x00, 0x0007},                        /* AutoCorrectEnable */
        {0xa0, 0xff, ZC3XX_R018_FRAMELOST},        /* Frame adjust */
        {}
};
static const struct usb_action pas106b_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x06, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,06,cc */
        {0xa0, 0x54, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,54,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x87, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,87,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},        /* 01,8c,10,cc */
        {0xa0, 0x30, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,30,cc */
        {0xaa, 0x03, 0x0021},                        /* 00,03,21,aa */
        {0xaa, 0x04, 0x000c},                        /* 00,04,0c,aa */
        {0xaa, 0x05, 0x0002},                        /* 00,05,02,aa */
        {0xaa, 0x07, 0x001c},                        /* 00,07,1c,aa */
        {0xa0, 0x04, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,04,cc */
        {}
};
static const struct usb_action pas106b_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x06, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,06,cc */
        {0xa0, 0x2e, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,2e,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x71, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,71,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},        /* 01,8c,10,cc */
        {0xa0, 0x30, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,30,cc */
        {0xaa, 0x03, 0x001c},                        /* 00,03,1c,aa */
        {0xaa, 0x04, 0x0004},                        /* 00,04,04,aa */
        {0xaa, 0x05, 0x0001},                        /* 00,05,01,aa */
        {0xaa, 0x07, 0x00c4},                        /* 00,07,c4,aa */
        {0xa0, 0x04, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,04,cc */
        {}
};
static const struct usb_action pas106b_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x06, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,06,cc */
        {0xa0, 0x50, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,50,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},        /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},        /* 01,8f,20,cc */
        {0xaa, 0x03, 0x0013},                        /* 00,03,13,aa */
        {0xaa, 0x04, 0x0000},                        /* 00,04,00,aa */
        {0xaa, 0x05, 0x0001},                        /* 00,05,01,aa */
        {0xaa, 0x07, 0x0030},                        /* 00,07,30,aa */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
        {}
};

/* from lvWIMv.inf 046d:08a2/:08aa 2007/06/03 */
static const struct usb_action pas202b_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},                /* 00,00,01,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0e, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0e,cc */
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},                /* 00,02,00,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},                /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,e0,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc */
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE},        /* 00,8d,08,cc */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},                /* 00,98,00,cc */
        {0xa0, 0x03, ZC3XX_R09A_WINXSTARTLOW},                /* 00,9a,03,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},                /* 01,1a,00,cc */
        {0xa0, 0x03, ZC3XX_R11C_FIRSTXLOW},                /* 01,1c,03,cc */
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH},                /* 00,9b,01,cc */
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},                /* 00,9c,e6,cc */
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},                /* 00,9d,02,cc */
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},                /* 00,9e,86,cc */
        {0xaa, 0x02, 0x0002},                        /* 00,02,04,aa --> 02 */
        {0xaa, 0x07, 0x0006},                                /* 00,07,06,aa */
        {0xaa, 0x08, 0x0002},                                /* 00,08,02,aa */
        {0xaa, 0x09, 0x0006},                                /* 00,09,06,aa */
        {0xaa, 0x0a, 0x0001},                                /* 00,0a,01,aa */
        {0xaa, 0x0b, 0x0001},                                /* 00,0b,01,aa */
        {0xaa, 0x0c, 0x0006},
        {0xaa, 0x0d, 0x0000},                                /* 00,0d,00,aa */
        {0xaa, 0x10, 0x0000},                                /* 00,10,00,aa */
        {0xaa, 0x12, 0x0005},                                /* 00,12,05,aa */
        {0xaa, 0x13, 0x0063},                                /* 00,13,63,aa */
        {0xaa, 0x15, 0x0070},                                /* 00,15,70,aa */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,b7,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},                /* 01,89,06,cc */
        {0xa0, 0x00, 0x01ad},                                /* 01,ad,00,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},                /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},                /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},                /* 03,01,08,cc */
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},                /* 01,8d,70,cc */
        {}
};
static const struct usb_action pas202b_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},                /* 00,00,01,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0e, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,0e,cc */
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},                /* 00,02,10,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},                /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc */
        {0xa0, 0x08, ZC3XX_R08D_COMPABILITYMODE},        /* 00,8d,08,cc */
        {0xa0, 0x08, ZC3XX_R098_WINYSTARTLOW},                /* 00,98,08,cc */
        {0xa0, 0x02, ZC3XX_R09A_WINXSTARTLOW},                /* 00,9a,02,cc */
        {0xa0, 0x08, ZC3XX_R11A_FIRSTYLOW},                /* 01,1a,08,cc */
        {0xa0, 0x02, ZC3XX_R11C_FIRSTXLOW},                /* 01,1c,02,cc */
        {0xa0, 0x01, ZC3XX_R09B_WINHEIGHTHIGH},                /* 00,9b,01,cc */
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},                /* 00,9d,02,cc */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},                /* 00,9e,88,cc */
        {0xaa, 0x02, 0x0002},                                /* 00,02,02,aa */
        {0xaa, 0x07, 0x0006},                                /* 00,07,06,aa */
        {0xaa, 0x08, 0x0002},                                /* 00,08,02,aa */
        {0xaa, 0x09, 0x0006},                                /* 00,09,06,aa */
        {0xaa, 0x0a, 0x0001},                                /* 00,0a,01,aa */
        {0xaa, 0x0b, 0x0001},                                /* 00,0b,01,aa */
        {0xaa, 0x0c, 0x0006},
        {0xaa, 0x0d, 0x0000},                                /* 00,0d,00,aa */
        {0xaa, 0x10, 0x0000},                                /* 00,10,00,aa */
        {0xaa, 0x12, 0x0005},                                /* 00,12,05,aa */
        {0xaa, 0x13, 0x0063},                                /* 00,13,63,aa */
        {0xaa, 0x15, 0x0070},                                /* 00,15,70,aa */
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,37,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},                /* 01,89,06,cc */
        {0xa0, 0x00, 0x01ad},                                /* 01,ad,00,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},                /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},                /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},                /* 03,01,08,cc */
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},                /* 01,8d,70,cc */
        {0xa0, 0xff, ZC3XX_R097_WINYSTARTHIGH},
        {0xa0, 0xfe, ZC3XX_R098_WINYSTARTLOW},
        {}
};
static const struct usb_action pas202b_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},                /* 00,19,00,cc */
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},                /* 00,87,20,cc */
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},                /* 00,88,21,cc */
        {0xaa, 0x20, 0x0002},                                /* 00,20,02,aa */
        {0xaa, 0x21, 0x001b},
        {0xaa, 0x03, 0x0044},                                /* 00,03,44,aa */
        {0xaa, 0x04, 0x0008},
        {0xaa, 0x05, 0x001b},
        {0xaa, 0x0e, 0x0001},                                /* 00,0e,01,aa */
        {0xaa, 0x0f, 0x0000},                                /* 00,0f,00,aa */
        {0xa0, 0x1c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x1b, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x4d, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,4d,cc */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1b, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x44, ZC3XX_R01D_HSYNC_0},                /* 00,1d,44,cc */
        {0xa0, 0x6f, ZC3XX_R01E_HSYNC_1},                /* 00,1e,6f,cc */
        {0xa0, 0xad, ZC3XX_R01F_HSYNC_2},                /* 00,1f,ad,cc */
        {0xa0, 0xeb, ZC3XX_R020_HSYNC_3},                /* 00,20,eb,cc */
        {0xa0, 0x0f, ZC3XX_R087_EXPTIMEMID},                /* 00,87,0f,cc */
        {0xa0, 0x0e, ZC3XX_R088_EXPTIMELOW},                /* 00,88,0e,cc */
        {}
};
static const struct usb_action pas202b_50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},                /* 00,19,00,cc */
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},                /* 00,87,20,cc */
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},                /* 00,88,21,cc */
        {0xaa, 0x20, 0x0004},
        {0xaa, 0x21, 0x003d},
        {0xaa, 0x03, 0x0041},                                /* 00,03,41,aa */
        {0xaa, 0x04, 0x0010},
        {0xaa, 0x05, 0x003d},
        {0xaa, 0x0e, 0x0001},                                /* 00,0e,01,aa */
        {0xaa, 0x0f, 0x0000},                                /* 00,0f,00,aa */
        {0xa0, 0x1c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x3d, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x9b, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,9b,cc */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1b, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x41, ZC3XX_R01D_HSYNC_0},                /* 00,1d,41,cc */
        {0xa0, 0x6f, ZC3XX_R01E_HSYNC_1},                /* 00,1e,6f,cc */
        {0xa0, 0xad, ZC3XX_R01F_HSYNC_2},                /* 00,1f,ad,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc */
        {0xa0, 0x0f, ZC3XX_R087_EXPTIMEMID},                /* 00,87,0f,cc */
        {0xa0, 0x0e, ZC3XX_R088_EXPTIMELOW},                /* 00,88,0e,cc */
        {}
};
static const struct usb_action pas202b_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},                /* 00,19,00,cc */
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},                /* 00,87,20,cc */
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},                /* 00,88,21,cc */
        {0xaa, 0x20, 0x0002},                                /* 00,20,02,aa */
        {0xaa, 0x21, 0x0000},                                /* 00,21,00,aa */
        {0xaa, 0x03, 0x0045},                                /* 00,03,45,aa */
        {0xaa, 0x04, 0x0008},                                /* 00,04,08,aa */
        {0xaa, 0x05, 0x0000},                                /* 00,05,00,aa */
        {0xaa, 0x0e, 0x0001},                                /* 00,0e,01,aa */
        {0xaa, 0x0f, 0x0000},                                /* 00,0f,00,aa */
        {0xa0, 0x1c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x40, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,40,cc */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1b, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x45, ZC3XX_R01D_HSYNC_0},                /* 00,1d,45,cc */
        {0xa0, 0x8e, ZC3XX_R01E_HSYNC_1},                /* 00,1e,8e,cc */
        {0xa0, 0xc1, ZC3XX_R01F_HSYNC_2},                /* 00,1f,c1,cc */
        {0xa0, 0xf5, ZC3XX_R020_HSYNC_3},                /* 00,20,f5,cc */
        {0xa0, 0x0f, ZC3XX_R087_EXPTIMEMID},                /* 00,87,0f,cc */
        {0xa0, 0x0e, ZC3XX_R088_EXPTIMELOW},                /* 00,88,0e,cc */
        {}
};
static const struct usb_action pas202b_60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},                /* 00,19,00,cc */
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},                /* 00,87,20,cc */
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},                /* 00,88,21,cc */
        {0xaa, 0x20, 0x0004},
        {0xaa, 0x21, 0x0008},
        {0xaa, 0x03, 0x0042},                                /* 00,03,42,aa */
        {0xaa, 0x04, 0x0010},
        {0xaa, 0x05, 0x0008},
        {0xaa, 0x0e, 0x0001},                                /* 00,0e,01,aa */
        {0xaa, 0x0f, 0x0000},                                /* 00,0f,00,aa */
        {0xa0, 0x1c, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x08, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x81, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,81,cc */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1b, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x42, ZC3XX_R01D_HSYNC_0},                /* 00,1d,42,cc */
        {0xa0, 0x6f, ZC3XX_R01E_HSYNC_1},                /* 00,1e,6f,cc */
        {0xa0, 0xaf, ZC3XX_R01F_HSYNC_2},                /* 00,1f,af,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc */
        {0xa0, 0x0f, ZC3XX_R087_EXPTIMEMID},                /* 00,87,0f,cc */
        {0xa0, 0x0e, ZC3XX_R088_EXPTIMELOW},                /* 00,88,0e,cc */
        {}
};
static const struct usb_action pas202b_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},                /* 00,19,00,cc */
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},                /* 00,87,20,cc */
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},                /* 00,88,21,cc */
        {0xaa, 0x20, 0x0002},                                /* 00,20,02,aa */
        {0xaa, 0x21, 0x0006},
        {0xaa, 0x03, 0x0040},                                /* 00,03,40,aa */
        {0xaa, 0x04, 0x0008},                                /* 00,04,08,aa */
        {0xaa, 0x05, 0x0006},
        {0xaa, 0x0e, 0x0001},                                /* 00,0e,01,aa */
        {0xaa, 0x0f, 0x0000},                                /* 00,0f,00,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x06, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x01, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},                /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,00,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x40, ZC3XX_R01D_HSYNC_0},                /* 00,1d,40,cc */
        {0xa0, 0x60, ZC3XX_R01E_HSYNC_1},                /* 00,1e,60,cc */
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},                /* 00,1f,90,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc */
        {0xa0, 0x0f, ZC3XX_R087_EXPTIMEMID},                /* 00,87,0f,cc */
        {0xa0, 0x0e, ZC3XX_R088_EXPTIMELOW},                /* 00,88,0e,cc */
        {}
};
static const struct usb_action pas202b_NoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},                /* 00,19,00,cc */
        {0xa0, 0x20, ZC3XX_R087_EXPTIMEMID},                /* 00,87,20,cc */
        {0xa0, 0x21, ZC3XX_R088_EXPTIMELOW},                /* 00,88,21,cc */
        {0xaa, 0x20, 0x0004},
        {0xaa, 0x21, 0x000c},
        {0xaa, 0x03, 0x0040},                                /* 00,03,40,aa */
        {0xaa, 0x04, 0x0010},
        {0xaa, 0x05, 0x000c},
        {0xaa, 0x0e, 0x0001},                                /* 00,0e,01,aa */
        {0xaa, 0x0f, 0x0000},                                /* 00,0f,00,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x0c, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc */
        {0xa0, 0x02, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,02,cc */
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},                /* 01,8c,10,cc */
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,20,cc */
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,00,cc */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x40, ZC3XX_R01D_HSYNC_0},                /* 00,1d,40,cc */
        {0xa0, 0x60, ZC3XX_R01E_HSYNC_1},                /* 00,1e,60,cc */
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},                /* 00,1f,90,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc */
        {0xa0, 0x0f, ZC3XX_R087_EXPTIMEMID},                /* 00,87,0f,cc */
        {0xa0, 0x0e, ZC3XX_R088_EXPTIMELOW},                /* 00,88,0e,cc */
        {}
};

/* mt9v111 (mi0360soc) and pb0330 from vm30x.inf 0ac8:301b 07/02/13 */
static const struct usb_action mt9v111_1_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x0001},
        {0xaa, 0x06, 0x0000},
        {0xaa, 0x08, 0x0483},
        {0xaa, 0x01, 0x0004},
        {0xaa, 0x08, 0x0006},
        {0xaa, 0x02, 0x0011},
        {0xaa, 0x03, 0x01e5},                        /*jfm: was 01e7*/
        {0xaa, 0x04, 0x0285},                        /*jfm: was 0287*/
        {0xaa, 0x07, 0x3002},
        {0xaa, 0x20, 0x5100},
        {0xaa, 0x35, 0x507f},
        {0xaa, 0x30, 0x0005},
        {0xaa, 0x31, 0x0000},
        {0xaa, 0x58, 0x0078},
        {0xaa, 0x62, 0x0411},
        {0xaa, 0x2b, 0x007f},
        {0xaa, 0x2c, 0x007f},                        /*jfm: was 0030*/
        {0xaa, 0x2d, 0x007f},                        /*jfm: was 0030*/
        {0xaa, 0x2e, 0x007f},                        /*jfm: was 0030*/
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x09, 0x01ad},                        /*jfm: was 00*/
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x6c, ZC3XX_R18D_YTARGET},
        {0xa0, 0x61, ZC3XX_R116_RGAIN},
        {0xa0, 0x65, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action mt9v111_1_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x0001},
        {0xaa, 0x06, 0x0000},
        {0xaa, 0x08, 0x0483},
        {0xaa, 0x01, 0x0004},
        {0xaa, 0x08, 0x0006},
        {0xaa, 0x02, 0x0011},
        {0xaa, 0x03, 0x01e7},
        {0xaa, 0x04, 0x0287},
        {0xaa, 0x07, 0x3002},
        {0xaa, 0x20, 0x5100},
        {0xaa, 0x35, 0x007f},                        /*jfm: was 0050*/
        {0xaa, 0x30, 0x0005},
        {0xaa, 0x31, 0x0000},
        {0xaa, 0x58, 0x0078},
        {0xaa, 0x62, 0x0411},
        {0xaa, 0x2b, 0x007f},                        /*jfm: was 28*/
        {0xaa, 0x2c, 0x007f},                        /*jfm: was 30*/
        {0xaa, 0x2d, 0x007f},                        /*jfm: was 30*/
        {0xaa, 0x2e, 0x007f},                        /*jfm: was 28*/
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x09, 0x01ad},                        /*jfm: was 00*/
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x6c, ZC3XX_R18D_YTARGET},
        {0xa0, 0x61, ZC3XX_R116_RGAIN},
        {0xa0, 0x65, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action mt9v111_1_AE50HZ[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0562},
        {0xbb, 0x01, 0x09aa},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x9b, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_1_AE50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0509},
        {0xbb, 0x01, 0x0934},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xd2, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x9a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_1_AE60HZ[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x003d},
        {0xaa, 0x09, 0x016e},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xdd, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x3d, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_1_AE60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0509},
        {0xbb, 0x01, 0x0983},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x8f, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x81, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_1_AENoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0509},
        {0xbb, 0x01, 0x0960},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x09, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_1_AENoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0534},
        {0xbb, 0x02, 0x0960},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x34, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x60, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
/* from usbvm303.inf 0ac8:303b 07/03/25 (3 - tas5130c) */
static const struct usb_action mt9v111_3_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x0001},                /* select IFP/SOC registers */
        {0xaa, 0x06, 0x0000},                /* operating mode control */
        {0xaa, 0x08, 0x0483},                /* output format control */
                                        /* H red first, V red or blue first,
                                         * raw Bayer, auto flicker */
        {0xaa, 0x01, 0x0004},                /* select sensor core registers */
        {0xaa, 0x08, 0x0006},                /* row start */
        {0xaa, 0x02, 0x0011},                /* column start */
        {0xaa, 0x03, 0x01e5},                /* window height - 1 */
        {0xaa, 0x04, 0x0285},                /* window width - 1 */
        {0xaa, 0x07, 0x3002},                /* output control */
        {0xaa, 0x20, 0x1100},                /* read mode: bits 8 & 12 (?) */
        {0xaa, 0x35, 0x007f},                /* global gain */
        {0xaa, 0x30, 0x0005},
        {0xaa, 0x31, 0x0000},
        {0xaa, 0x58, 0x0078},
        {0xaa, 0x62, 0x0411},
        {0xaa, 0x2b, 0x007f},                /* green1 gain */
        {0xaa, 0x2c, 0x007f},                /* blue gain */
        {0xaa, 0x2d, 0x007f},                /* red gain */
        {0xaa, 0x2e, 0x007f},                /* green2 gain */
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},
        {0xa0, 0x61, ZC3XX_R116_RGAIN},
        {0xa0, 0x65, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action mt9v111_3_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x0001},
        {0xaa, 0x06, 0x0000},
        {0xaa, 0x08, 0x0483},
        {0xaa, 0x01, 0x0004},
        {0xaa, 0x08, 0x0006},
        {0xaa, 0x02, 0x0011},
        {0xaa, 0x03, 0x01e7},
        {0xaa, 0x04, 0x0287},
        {0xaa, 0x07, 0x3002},
        {0xaa, 0x20, 0x1100},
        {0xaa, 0x35, 0x007f},
        {0xaa, 0x30, 0x0005},
        {0xaa, 0x31, 0x0000},
        {0xaa, 0x58, 0x0078},
        {0xaa, 0x62, 0x0411},
        {0xaa, 0x2b, 0x007f},
        {0xaa, 0x2c, 0x007f},
        {0xaa, 0x2d, 0x007f},
        {0xaa, 0x2e, 0x007f},
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},
        {0xa0, 0x61, ZC3XX_R116_RGAIN},
        {0xa0, 0x65, ZC3XX_R118_BGAIN},
        {}
};
static const struct usb_action mt9v111_3_AE50HZ[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x0009},                /* horizontal blanking */
        {0xaa, 0x09, 0x01ce},                /* shutter width */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xd2, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x9a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_3_AE50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x0009},
        {0xaa, 0x09, 0x01ce},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xd2, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x9a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_3_AE60HZ[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x0009},
        {0xaa, 0x09, 0x0083},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x8f, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x81, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_3_AE60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x0009},
        {0xaa, 0x09, 0x0083},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x8f, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x81, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_3_AENoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x0034},
        {0xaa, 0x09, 0x0260},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x34, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x60, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};
static const struct usb_action mt9v111_3_AENoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xaa, 0x05, 0x0034},
        {0xaa, 0x09, 0x0260},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x34, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x60, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
        {}
};

static const struct usb_action pb0330_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00 */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x0006},
        {0xaa, 0x02, 0x0011},
        {0xaa, 0x03, 0x01e5},                        /*jfm: was 1e7*/
        {0xaa, 0x04, 0x0285},                        /*jfm: was 0287*/
        {0xaa, 0x06, 0x0003},
        {0xaa, 0x07, 0x3002},
        {0xaa, 0x20, 0x1100},
        {0xaa, 0x2f, 0xf7b0},
        {0xaa, 0x30, 0x0005},
        {0xaa, 0x31, 0x0000},
        {0xaa, 0x34, 0x0100},
        {0xaa, 0x35, 0x0060},
        {0xaa, 0x3d, 0x068f},
        {0xaa, 0x40, 0x01e0},
        {0xaa, 0x58, 0x0078},
        {0xaa, 0x62, 0x0411},
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x09, 0x01ad},                        /*jfm: was 00 */
        {0xa0, 0x15, 0x01ae},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},        /*jfm: was 6c*/
        {}
};
static const struct usb_action pb0330_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},        /* 00 */
        {0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
        {0xdd, 0x00, 0x0200},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xaa, 0x01, 0x0006},
        {0xaa, 0x02, 0x0011},
        {0xaa, 0x03, 0x01e7},
        {0xaa, 0x04, 0x0287},
        {0xaa, 0x06, 0x0003},
        {0xaa, 0x07, 0x3002},
        {0xaa, 0x20, 0x1100},
        {0xaa, 0x2f, 0xf7b0},
        {0xaa, 0x30, 0x0005},
        {0xaa, 0x31, 0x0000},
        {0xaa, 0x34, 0x0100},
        {0xaa, 0x35, 0x0060},
        {0xaa, 0x3d, 0x068f},
        {0xaa, 0x40, 0x01e0},
        {0xaa, 0x58, 0x0078},
        {0xaa, 0x62, 0x0411},
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x09, 0x01ad},
        {0xa0, 0x15, 0x01ae},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x78, ZC3XX_R18D_YTARGET},        /*jfm: was 6c*/
        {}
};
static const struct usb_action pb0330_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x055c},
        {0xbb, 0x01, 0x09aa},
        {0xbb, 0x00, 0x1001},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xc4, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x5c, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action pb0330_50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0566},
        {0xbb, 0x02, 0x09b2},
        {0xbb, 0x00, 0x1002},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x8c, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x8a, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0xf0, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0xf8, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action pb0330_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0535},
        {0xbb, 0x01, 0x0974},
        {0xbb, 0x00, 0x1001},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xfe, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x3e, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x35, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x50, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xd0, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action pb0330_60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0535},
        {0xbb, 0x02, 0x096c},
        {0xbb, 0x00, 0x1002},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xc0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x7c, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x35, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x50, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xd0, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action pb0330_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0509},
        {0xbb, 0x02, 0x0940},
        {0xbb, 0x00, 0x1002},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x01, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x09, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
        {}
};
static const struct usb_action pb0330_NoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
        {0xbb, 0x00, 0x0535},
        {0xbb, 0x01, 0x0980},
        {0xbb, 0x00, 0x1001},
        {0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x01, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x35, ZC3XX_R01D_HSYNC_0},
        {0xa0, 0x60, ZC3XX_R01E_HSYNC_1},
        {0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
        {0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
        {}
};

/* from oem9.inf */
static const struct usb_action po2030_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, /* 00,00,01,cc */
        {0xa0, 0x04, ZC3XX_R002_CLOCKSELECT},        /* 00,02,04,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT}, /* 00,10,01,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING}, /* 00,01,01,cc */
        {0xa0, 0x04, ZC3XX_R080_HBLANKHIGH}, /* 00,80,04,cc */
        {0xa0, 0x05, ZC3XX_R081_HBLANKLOW}, /* 00,81,05,cc */
        {0xa0, 0x16, ZC3XX_R083_RGAINADDR}, /* 00,83,16,cc */
        {0xa0, 0x18, ZC3XX_R085_BGAINADDR}, /* 00,85,18,cc */
        {0xa0, 0x1a, ZC3XX_R086_EXPTIMEHIGH}, /* 00,86,1a,cc */
        {0xa0, 0x1b, ZC3XX_R087_EXPTIMEMID}, /* 00,87,1b,cc */
        {0xa0, 0x1c, ZC3XX_R088_EXPTIMELOW}, /* 00,88,1c,cc */
        {0xa0, 0xee, ZC3XX_R08B_I2CDEVICEADDR}, /* 00,8b,ee,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING}, /* 00,08,03,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,01,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH}, /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW}, /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH}, /* 00,05,01,cc */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW}, /* 00,06,e0,cc */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,42,cc */
        {0xaa, 0x8d, 0x0008},                        /* 00,8d,08,aa */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},        /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},        /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},        /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},        /* 01,1c,00,cc */
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},        /* 00,9c,e6,cc */
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},        /* 00,9e,86,cc */
        {0xaa, 0x09, 0x00ce}, /* 00,09,ce,aa */
        {0xaa, 0x0b, 0x0005}, /* 00,0b,05,aa */
        {0xaa, 0x0d, 0x0054}, /* 00,0d,54,aa */
        {0xaa, 0x0f, 0x00eb}, /* 00,0f,eb,aa */
        {0xaa, 0x87, 0x0000}, /* 00,87,00,aa */
        {0xaa, 0x88, 0x0004}, /* 00,88,04,aa */
        {0xaa, 0x89, 0x0000}, /* 00,89,00,aa */
        {0xaa, 0x8a, 0x0005}, /* 00,8a,05,aa */
        {0xaa, 0x13, 0x0003}, /* 00,13,03,aa */
        {0xaa, 0x16, 0x0040}, /* 00,16,40,aa */
        {0xaa, 0x18, 0x0040}, /* 00,18,40,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x29, 0x00e8}, /* 00,29,e8,aa */
        {0xaa, 0x45, 0x0045}, /* 00,45,45,aa */
        {0xaa, 0x50, 0x00ed}, /* 00,50,ed,aa */
        {0xaa, 0x51, 0x0025}, /* 00,51,25,aa */
        {0xaa, 0x52, 0x0042}, /* 00,52,42,aa */
        {0xaa, 0x53, 0x002f}, /* 00,53,2f,aa */
        {0xaa, 0x79, 0x0025}, /* 00,79,25,aa */
        {0xaa, 0x7b, 0x0000}, /* 00,7b,00,aa */
        {0xaa, 0x7e, 0x0025}, /* 00,7e,25,aa */
        {0xaa, 0x7f, 0x0025}, /* 00,7f,25,aa */
        {0xaa, 0x21, 0x0000}, /* 00,21,00,aa */
        {0xaa, 0x33, 0x0036}, /* 00,33,36,aa */
        {0xaa, 0x36, 0x0060}, /* 00,36,60,aa */
        {0xaa, 0x37, 0x0008}, /* 00,37,08,aa */
        {0xaa, 0x3b, 0x0031}, /* 00,3b,31,aa */
        {0xaa, 0x44, 0x000f}, /* 00,44,0f,aa */
        {0xaa, 0x58, 0x0002}, /* 00,58,02,aa */
        {0xaa, 0x66, 0x00c0}, /* 00,66,c0,aa */
        {0xaa, 0x67, 0x0044}, /* 00,67,44,aa */
        {0xaa, 0x6b, 0x00a0}, /* 00,6b,a0,aa */
        {0xaa, 0x6c, 0x0054}, /* 00,6c,54,aa */
        {0xaa, 0xd6, 0x0007}, /* 00,d6,07,aa */
        {0xa0, 0xf7, ZC3XX_R101_SENSORCORRECTION}, /* 01,01,f7,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE}, /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS}, /* 01,89,06,cc */
        {0xa0, 0x00, 0x01ad}, /* 01,ad,00,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE}, /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05}, /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE}, /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS}, /* 03,01,08,cc */
        {0xa0, 0x7a, ZC3XX_R116_RGAIN}, /* 01,16,7a,cc */
        {0xa0, 0x4a, ZC3XX_R118_BGAIN}, /* 01,18,4a,cc */
        {}
};

/* from oem9.inf */
static const struct usb_action po2030_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, /* 00,00,01,cc */
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT}, /* 00,02,10,cc */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT}, /* 00,10,01,cc */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING}, /* 00,01,01,cc */
        {0xa0, 0x04, ZC3XX_R080_HBLANKHIGH}, /* 00,80,04,cc */
        {0xa0, 0x05, ZC3XX_R081_HBLANKLOW}, /* 00,81,05,cc */
        {0xa0, 0x16, ZC3XX_R083_RGAINADDR}, /* 00,83,16,cc */
        {0xa0, 0x18, ZC3XX_R085_BGAINADDR}, /* 00,85,18,cc */
        {0xa0, 0x1a, ZC3XX_R086_EXPTIMEHIGH}, /* 00,86,1a,cc */
        {0xa0, 0x1b, ZC3XX_R087_EXPTIMEMID}, /* 00,87,1b,cc */
        {0xa0, 0x1c, ZC3XX_R088_EXPTIMELOW}, /* 00,88,1c,cc */
        {0xa0, 0xee, ZC3XX_R08B_I2CDEVICEADDR}, /* 00,8b,ee,cc */
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING}, /* 00,08,03,cc */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,03,cc */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,01,cc */
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH}, /* 00,03,02,cc */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW}, /* 00,04,80,cc */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH}, /* 00,05,01,cc */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW}, /* 00,06,e0,cc */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,42,cc */
        {0xaa, 0x8d, 0x0008},                        /* 00,8d,08,aa */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW}, /* 00,98,00,cc */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW}, /* 00,9a,00,cc */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW}, /* 01,1a,00,cc */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW}, /* 01,1c,00,cc */
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW}, /* 00,9c,e8,cc */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW}, /* 00,9e,88,cc */
        {0xaa, 0x09, 0x00cc}, /* 00,09,cc,aa */
        {0xaa, 0x0b, 0x0005}, /* 00,0b,05,aa */
        {0xaa, 0x0d, 0x0058}, /* 00,0d,58,aa */
        {0xaa, 0x0f, 0x00ed}, /* 00,0f,ed,aa */
        {0xaa, 0x87, 0x0000}, /* 00,87,00,aa */
        {0xaa, 0x88, 0x0004}, /* 00,88,04,aa */
        {0xaa, 0x89, 0x0000}, /* 00,89,00,aa */
        {0xaa, 0x8a, 0x0005}, /* 00,8a,05,aa */
        {0xaa, 0x13, 0x0003}, /* 00,13,03,aa */
        {0xaa, 0x16, 0x0040}, /* 00,16,40,aa */
        {0xaa, 0x18, 0x0040}, /* 00,18,40,aa */
        {0xaa, 0x1d, 0x0002}, /* 00,1d,02,aa */
        {0xaa, 0x29, 0x00e8}, /* 00,29,e8,aa */
        {0xaa, 0x45, 0x0045}, /* 00,45,45,aa */
        {0xaa, 0x50, 0x00ed}, /* 00,50,ed,aa */
        {0xaa, 0x51, 0x0025}, /* 00,51,25,aa */
        {0xaa, 0x52, 0x0042}, /* 00,52,42,aa */
        {0xaa, 0x53, 0x002f}, /* 00,53,2f,aa */
        {0xaa, 0x79, 0x0025}, /* 00,79,25,aa */
        {0xaa, 0x7b, 0x0000}, /* 00,7b,00,aa */
        {0xaa, 0x7e, 0x0025}, /* 00,7e,25,aa */
        {0xaa, 0x7f, 0x0025}, /* 00,7f,25,aa */
        {0xaa, 0x21, 0x0000}, /* 00,21,00,aa */
        {0xaa, 0x33, 0x0036}, /* 00,33,36,aa */
        {0xaa, 0x36, 0x0060}, /* 00,36,60,aa */
        {0xaa, 0x37, 0x0008}, /* 00,37,08,aa */
        {0xaa, 0x3b, 0x0031}, /* 00,3b,31,aa */
        {0xaa, 0x44, 0x000f}, /* 00,44,0f,aa */
        {0xaa, 0x58, 0x0002}, /* 00,58,02,aa */
        {0xaa, 0x66, 0x00c0}, /* 00,66,c0,aa */
        {0xaa, 0x67, 0x0044}, /* 00,67,44,aa */
        {0xaa, 0x6b, 0x00a0}, /* 00,6b,a0,aa */
        {0xaa, 0x6c, 0x0054}, /* 00,6c,54,aa */
        {0xaa, 0xd6, 0x0007}, /* 00,d6,07,aa */
        {0xa0, 0xf7, ZC3XX_R101_SENSORCORRECTION}, /* 01,01,f7,cc */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC}, /* 00,12,05,cc */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE}, /* 01,00,0d,cc */
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS}, /* 01,89,06,cc */
        {0xa0, 0x00, 0x01ad}, /* 01,ad,00,cc */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE}, /* 01,c5,03,cc */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05}, /* 01,cb,13,cc */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE}, /* 02,50,08,cc */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS}, /* 03,01,08,cc */
        {0xa0, 0x7a, ZC3XX_R116_RGAIN}, /* 01,16,7a,cc */
        {0xa0, 0x4a, ZC3XX_R118_BGAIN}, /* 01,18,4a,cc */
        {}
};

static const struct usb_action po2030_50HZ[] = {
        {0xaa, 0x8d, 0x0008}, /* 00,8d,08,aa */
        {0xaa, 0x1a, 0x0001}, /* 00,1a,01,aa */
        {0xaa, 0x1b, 0x000a}, /* 00,1b,0a,aa */
        {0xaa, 0x1c, 0x00b0}, /* 00,1c,b0,aa */
        {0xa0, 0x05, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,05,cc */
        {0xa0, 0x35, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,35,cc */
        {0xa0, 0x70, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,70,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x85, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,85,cc */
        {0xa0, 0x58, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,58,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE}, /* 01,8c,0c,cc */
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,18,cc */
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN}, /* 01,a8,60,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
        {0xa0, 0x22, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,22,cc */
        {0xa0, 0x88, ZC3XX_R18D_YTARGET}, /* 01,8d,88,cc */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN}, /* 01,1d,58,cc */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,42,cc */
        {}
};

static const struct usb_action po2030_60HZ[] = {
        {0xaa, 0x8d, 0x0008}, /* 00,8d,08,aa */
        {0xaa, 0x1a, 0x0000}, /* 00,1a,00,aa */
        {0xaa, 0x1b, 0x00de}, /* 00,1b,de,aa */
        {0xaa, 0x1c, 0x0040}, /* 00,1c,40,aa */
        {0xa0, 0x08, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,08,cc */
        {0xa0, 0xae, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,ae,cc */
        {0xa0, 0x80, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,80,cc */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x6f, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,6f,cc */
        {0xa0, 0x20, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,20,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE}, /* 01,8c,0c,cc */
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,18,cc */
        {0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN}, /* 01,a8,60,cc */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
        {0xa0, 0x22, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,22,cc */
        {0xa0, 0x88, ZC3XX_R18D_YTARGET},                /* 01,8d,88,cc */
                                                        /* win: 01,8d,80 */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,1d,58,cc */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc */
        {}
};

static const struct usb_action po2030_NoFlicker[] = {
        {0xa0, 0x02, ZC3XX_R180_AUTOCORRECTENABLE}, /* 01,80,02,cc */
        {0xaa, 0x8d, 0x000d}, /* 00,8d,0d,aa */
        {0xaa, 0x1a, 0x0000}, /* 00,1a,00,aa */
        {0xaa, 0x1b, 0x0002}, /* 00,1b,02,aa */
        {0xaa, 0x1c, 0x0078}, /* 00,1c,78,aa */
        {0xaa, 0x46, 0x0000}, /* 00,46,00,aa */
        {0xaa, 0x15, 0x0000}, /* 00,15,00,aa */
        {}
};

static const struct usb_action tas5130c_InitialScale[] = {        /* 320x240 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x50, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x02, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x00, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},

        {0xa0, 0x04, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x0f, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x04, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x0f, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x06, ZC3XX_R08D_COMPABILITYMODE},
        {0xa0, 0xf7, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},
        {0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x07, ZC3XX_R0A5_EXPOSUREGAIN},
        {0xa0, 0x02, ZC3XX_R0A6_EXPOSUREBLACKLVL},
        {}
};
static const struct usb_action tas5130c_Initial[] = {        /* 640x480 */
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
        {0xa0, 0x40, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x00, ZC3XX_R008_CLOCKSETTING},
        {0xa0, 0x02, ZC3XX_R010_CMOSSENSORSELECT},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x00, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
        {0xa0, 0x05, ZC3XX_R098_WINYSTARTLOW},
        {0xa0, 0x0f, ZC3XX_R09A_WINXSTARTLOW},
        {0xa0, 0x05, ZC3XX_R11A_FIRSTYLOW},
        {0xa0, 0x0f, ZC3XX_R11C_FIRSTXLOW},
        {0xa0, 0xe6, ZC3XX_R09C_WINHEIGHTLOW},
        {0xa0, 0x02, ZC3XX_R09D_WINWIDTHHIGH},
        {0xa0, 0x86, ZC3XX_R09E_WINWIDTHLOW},
        {0xa0, 0x06, ZC3XX_R08D_COMPABILITYMODE},
        {0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
        {0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
        {0xa0, 0x70, ZC3XX_R18D_YTARGET},
        {0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x00, 0x01ad},
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
        {0xa0, 0x07, ZC3XX_R0A5_EXPOSUREGAIN},
        {0xa0, 0x02, ZC3XX_R0A6_EXPOSUREBLACKLVL},
        {}
};
static const struct usb_action tas5130c_50HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0xa3, 0x0001}, /* 00,a3,01,aa */
        {0xaa, 0xa4, 0x0063}, /* 00,a4,63,aa */
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
        {0xa0, 0x63, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,63,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xfe, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,47,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xd3, ZC3XX_R01D_HSYNC_0}, /* 00,1d,d3,cc */
        {0xa0, 0xda, ZC3XX_R01E_HSYNC_1}, /* 00,1e,da,cc */
        {0xa0, 0xea, ZC3XX_R01F_HSYNC_2}, /* 00,1f,ea,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
        {0xa0, 0x4c, ZC3XX_R0A0_MAXXLOW},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {}
};
static const struct usb_action tas5130c_50HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0xa3, 0x0001}, /* 00,a3,01,aa */
        {0xaa, 0xa4, 0x0077}, /* 00,a4,77,aa */
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
        {0xa0, 0x77, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,77,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xd0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x7d, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,7d,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xf0, ZC3XX_R01D_HSYNC_0}, /* 00,1d,f0,cc */
        {0xa0, 0xf4, ZC3XX_R01E_HSYNC_1}, /* 00,1e,f4,cc */
        {0xa0, 0xf8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,f8,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
        {0xa0, 0xc0, ZC3XX_R0A0_MAXXLOW},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {}
};
static const struct usb_action tas5130c_60HZ[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0xa3, 0x0001}, /* 00,a3,01,aa */
        {0xaa, 0xa4, 0x0036}, /* 00,a4,36,aa */
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
        {0xa0, 0x36, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,36,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x05, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x54, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x3e, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,3e,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xca, ZC3XX_R01D_HSYNC_0}, /* 00,1d,ca,cc */
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
        {0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
        {0xa0, 0x28, ZC3XX_R0A0_MAXXLOW},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {}
};
static const struct usb_action tas5130c_60HZScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0xa3, 0x0001}, /* 00,a3,01,aa */
        {0xaa, 0xa4, 0x0077}, /* 00,a4,77,aa */
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
        {0xa0, 0x77, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,77,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x09, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x47, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
        {0xa0, 0x7d, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,7d,cc */
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0xc8, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c8,cc */
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
        {0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
        {0xa0, 0x20, ZC3XX_R0A0_MAXXLOW},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {}
};
static const struct usb_action tas5130c_NoFlicker[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0xa3, 0x0001}, /* 00,a3,01,aa */
        {0xaa, 0xa4, 0x0040}, /* 00,a4,40,aa */
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
        {0xa0, 0x40, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,40,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x05, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0xa0, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
        {0xa0, 0xbc, ZC3XX_R01D_HSYNC_0}, /* 00,1d,bc,cc */
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
        {0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x02, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,02,cc */
        {0xa0, 0xf0, ZC3XX_R0A0_MAXXLOW},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {}
};

static const struct usb_action tas5130c_NoFlickerScale[] = {
        {0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
        {0xaa, 0xa3, 0x0001}, /* 00,a3,01,aa */
        {0xaa, 0xa4, 0x0090}, /* 00,a4,90,aa */
        {0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
        {0xa0, 0x90, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,90,cc */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
        {0xa0, 0x0a, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
        {0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
        {0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
        {0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
        {0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
        {0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
        {0xa0, 0xbc, ZC3XX_R01D_HSYNC_0}, /* 00,1d,bc,cc */
        {0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
        {0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
        {0xa0, 0x02, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,02,cc */
        {0xa0, 0xf0, ZC3XX_R0A0_MAXXLOW},
        {0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
        {}
};

/* from usbvm305.inf 0ac8:305b 07/06/15 (3 - tas5130c) */
static const struct usb_action gc0303_Initial[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},                /* 00,00,01,cc, */
        {0xa0, 0x02, ZC3XX_R008_CLOCKSETTING},                /* 00,08,02,cc, */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc, */
        {0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc, */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},                /* 00,04,80,cc, */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc, */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,e0,cc, */
        {0xa0, 0x98, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,98,cc, */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc, */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc, */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc, */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},                /* 00,98,00,cc, */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},                /* 00,9a,00,cc, */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},                /* 01,1a,00,cc, */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},                /* 01,1c,00,cc, */
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},                /* 00,9c,e6,cc,
                                                         * 6<->8 */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},                /* 00,9e,86,cc,
                                                         * 6<->8 */
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},                /* 00,87,10,cc, */
        {0xa0, 0x98, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,98,cc, */
        {0xaa, 0x01, 0x0000},
        {0xaa, 0x1a, 0x0000},                /* 00,1a,00,aa, */
        {0xaa, 0x1c, 0x0017},                /* 00,1c,17,aa, */
        {0xaa, 0x1b, 0x0000},
        {0xa0, 0x82, ZC3XX_R086_EXPTIMEHIGH},                /* 00,86,82,cc, */
        {0xa0, 0x83, ZC3XX_R087_EXPTIMEMID},                /* 00,87,83,cc, */
        {0xa0, 0x84, ZC3XX_R088_EXPTIMELOW},                /* 00,88,84,cc, */
        {0xaa, 0x05, 0x0010},                /* 00,05,10,aa, */
        {0xaa, 0x0a, 0x0002},
        {0xaa, 0x0b, 0x0000},
        {0xaa, 0x0c, 0x0002},
        {0xaa, 0x0d, 0x0000},
        {0xaa, 0x0e, 0x0002},
        {0xaa, 0x0f, 0x0000},
        {0xaa, 0x10, 0x0002},
        {0xaa, 0x11, 0x0000},
        {0xaa, 0x16, 0x0001},                /* 00,16,01,aa, */
        {0xaa, 0x17, 0x00e8},                /* 00,17,e6,aa, (e6 -> e8) */
        {0xaa, 0x18, 0x0002},                /* 00,18,02,aa, */
        {0xaa, 0x19, 0x0088},                /* 00,19,86,aa, */
        {0xaa, 0x20, 0x0020},                /* 00,20,20,aa, */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,b7,cc, */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,05,cc, */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0d,cc, */
        {0xa0, 0x76, ZC3XX_R189_AWBSTATUS},                /* 01,89,76,cc, */
        {0xa0, 0x09, 0x01ad},                                /* 01,ad,09,cc, */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},                /* 01,c5,03,cc, */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},                /* 01,cb,13,cc, */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc, */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},                /* 03,01,08,cc, */
        {0xa0, 0x58, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x61, ZC3XX_R116_RGAIN},                        /* 01,16,61,cc, */
        {0xa0, 0x65, ZC3XX_R118_BGAIN},                        /* 01,18,65,cc */
        {0xaa, 0x1b, 0x0000},
        {}
};

static const struct usb_action gc0303_InitialScale[] = {
        {0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},                /* 00,00,01,cc, */
        {0xa0, 0x02, ZC3XX_R008_CLOCKSETTING},                /* 00,08,02,cc, */
        {0xa0, 0x01, ZC3XX_R010_CMOSSENSORSELECT},        /* 00,10,01,cc, */
        {0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
        {0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},        /* 00,03,02,cc, */
        {0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},                /* 00,04,80,cc, */
        {0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},        /* 00,05,01,cc, */
        {0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},        /* 00,06,e0,cc, */
        {0xa0, 0x98, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,98,cc, */
        {0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},        /* 00,01,01,cc, */
        {0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,03,cc, */
        {0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,01,cc, */
        {0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},                /* 00,98,00,cc, */
        {0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},                /* 00,9a,00,cc, */
        {0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},                /* 01,1a,00,cc, */
        {0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},                /* 01,1c,00,cc, */
        {0xa0, 0xe8, ZC3XX_R09C_WINHEIGHTLOW},                /* 00,9c,e8,cc,
                                                         * 8<->6 */
        {0xa0, 0x88, ZC3XX_R09E_WINWIDTHLOW},                /* 00,9e,88,cc,
                                                         * 8<->6 */
        {0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},                /* 00,87,10,cc, */
        {0xa0, 0x98, ZC3XX_R08B_I2CDEVICEADDR},                /* 00,8b,98,cc, */
        {0xaa, 0x01, 0x0000},
        {0xaa, 0x1a, 0x0000},                /* 00,1a,00,aa, */
        {0xaa, 0x1c, 0x0017},                /* 00,1c,17,aa, */
        {0xaa, 0x1b, 0x0000},
        {0xa0, 0x82, ZC3XX_R086_EXPTIMEHIGH},        /* 00,86,82,cc, */
        {0xa0, 0x83, ZC3XX_R087_EXPTIMEMID},        /* 00,87,83,cc, */
        {0xa0, 0x84, ZC3XX_R088_EXPTIMELOW},        /* 00,88,84,cc, */
        {0xaa, 0x05, 0x0010},                /* 00,05,10,aa, */
        {0xaa, 0x0a, 0x0001},
        {0xaa, 0x0b, 0x0000},
        {0xaa, 0x0c, 0x0001},
        {0xaa, 0x0d, 0x0000},
        {0xaa, 0x0e, 0x0001},
        {0xaa, 0x0f, 0x0000},
        {0xaa, 0x10, 0x0001},
        {0xaa, 0x11, 0x0000},
        {0xaa, 0x16, 0x0001},                /* 00,16,01,aa, */
        {0xaa, 0x17, 0x00e8},                /* 00,17,e6,aa (e6 -> e8) */
        {0xaa, 0x18, 0x0002},                /* 00,18,02,aa, */
        {0xaa, 0x19, 0x0088},                /* 00,19,88,aa, */
        {0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},        /* 01,01,b7,cc, */
        {0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},        /* 00,12,05,cc, */
        {0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0d,cc, */
        {0xa0, 0x76, ZC3XX_R189_AWBSTATUS},                /* 01,89,76,cc, */
        {0xa0, 0x09, 0x01ad},                                /* 01,ad,09,cc, */
        {0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},                /* 01,c5,03,cc, */
        {0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},                /* 01,cb,13,cc, */
        {0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},        /* 02,50,08,cc, */
        {0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},                /* 03,01,08,cc, */
        {0xa0, 0x58, ZC3XX_R1A8_DIGITALGAIN},
        {0xa0, 0x61, ZC3XX_R116_RGAIN},                /* 01,16,61,cc, */
        {0xa0, 0x65, ZC3XX_R118_BGAIN},                /* 01,18,65,cc */
        {0xaa, 0x1b, 0x0000},
        {}
};
static const struct usb_action gc0303_50HZ[] = {
        {0xaa, 0x82, 0x0000},                /* 00,82,00,aa */
        {0xaa, 0x83, 0x0001},                /* 00,83,01,aa */
        {0xaa, 0x84, 0x0063},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc, */
        {0xa0, 0x06, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,0d,cc, */
        {0xa0, 0xa8, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,50,cc, */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc, */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc, */
        {0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,47,cc, */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},                /* 01,8c,0e,cc, */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,15,cc, */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,10,cc, */
        {0xa0, 0x48, ZC3XX_R1AA_DIGITALGAINSTEP},
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},                /* 00,1d,62,cc, */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},                /* 00,1e,90,cc, */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},                /* 00,1f,c8,cc, */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc, */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,1d,58,cc, */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc, */
        {0xa0, 0x7f, ZC3XX_R18D_YTARGET},
        {}
};

static const struct usb_action gc0303_50HZScale[] = {
        {0xaa, 0x82, 0x0000},                /* 00,82,00,aa */
        {0xaa, 0x83, 0x0003},                /* 00,83,03,aa */
        {0xaa, 0x84, 0x0054},                /* 00,84,54,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc, */
        {0xa0, 0x0d, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,0d,cc, */
        {0xa0, 0x50, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,50,cc, */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc, */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc, */
        {0xa0, 0x8e, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,8e,cc, */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},                /* 01,8c,0e,cc, */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,15,cc, */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,10,cc, */
        {0xa0, 0x48, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc, */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},                /* 00,1d,62,cc, */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},                /* 00,1e,90,cc, */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},                /* 00,1f,c8,cc, */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc, */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,1d,58,cc, */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc, */
        {0xa0, 0x7f, ZC3XX_R18D_YTARGET},
        {}
};

static const struct usb_action gc0303_60HZ[] = {
        {0xaa, 0x82, 0x0000},                /* 00,82,00,aa */
        {0xaa, 0x83, 0x0000},
        {0xaa, 0x84, 0x003b},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc, */
        {0xa0, 0x05, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,91,05,cc, */
        {0xa0, 0x88, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,92,88,cc, */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc, */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc, */
        {0xa0, 0x3b, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,3b,cc, */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},                /* 01,8c,0e,cc, */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,15,cc, */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,a9,10,cc, */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,aa,24,cc, */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},                /* 00,1d,62,cc, */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},                /* 00,1e,90,cc, */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},                /* 00,1f,c8,cc, */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc, */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,1d,58,cc, */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc, */
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},
        {}
};

static const struct usb_action gc0303_60HZScale[] = {
        {0xaa, 0x82, 0x0000},                /* 00,82,00,aa */
        {0xaa, 0x83, 0x0000},
        {0xaa, 0x84, 0x0076},
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc, */
        {0xa0, 0x0b, ZC3XX_R191_EXPOSURELIMITMID},        /* 01,1,0b,cc, */
        {0xa0, 0x10, ZC3XX_R192_EXPOSURELIMITLOW},        /* 01,2,10,cc, */
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,5,00,cc, */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,6,00,cc, */
        {0xa0, 0x76, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,7,76,cc, */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},                /* 01,c,0e,cc, */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},                /* 01,f,15,cc, */
        {0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},        /* 01,9,10,cc, */
        {0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},        /* 01,a,24,cc, */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},                /* 00,d,62,cc, */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},                /* 00,e,90,cc, */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},                /* 00,f,c8,cc, */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,0,ff,cc, */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,d,58,cc, */
        {0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,42,cc, */
        {0xa0, 0x80, ZC3XX_R18D_YTARGET},
        {}
};

static const struct usb_action gc0303_NoFlicker[] = {
        {0xa0, 0x0c, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0c,cc, */
        {0xaa, 0x82, 0x0000},                /* 00,82,00,aa */
        {0xaa, 0x83, 0x0000},                /* 00,83,00,aa */
        {0xaa, 0x84, 0x0020},                /* 00,84,20,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,0,00,cc, */
        {0xa0, 0x00, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x48, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc, */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc, */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,10,cc, */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},                /* 01,8c,0e,cc, */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,15,cc, */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},                /* 00,1d,62,cc, */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},                /* 00,1e,90,cc, */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},                /* 00,1f,c8,cc, */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc, */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,1d,58,cc, */
        {0xa0, 0x03, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,03,cc */
        {}
};

static const struct usb_action gc0303_NoFlickerScale[] = {
        {0xa0, 0x0c, ZC3XX_R100_OPERATIONMODE},                /* 01,00,0c,cc, */
        {0xaa, 0x82, 0x0000},                /* 00,82,00,aa */
        {0xaa, 0x83, 0x0000},                /* 00,83,00,aa */
        {0xaa, 0x84, 0x0020},                /* 00,84,20,aa */
        {0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},        /* 01,90,00,cc, */
        {0xa0, 0x00, ZC3XX_R191_EXPOSURELIMITMID},
        {0xa0, 0x48, ZC3XX_R192_EXPOSURELIMITLOW},
        {0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},        /* 01,95,00,cc, */
        {0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},        /* 01,96,00,cc, */
        {0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW},        /* 01,97,10,cc, */
        {0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},                /* 01,8c,0e,cc, */
        {0xa0, 0x15, ZC3XX_R18F_AEUNFREEZE},                /* 01,8f,15,cc, */
        {0xa0, 0x62, ZC3XX_R01D_HSYNC_0},                /* 00,1d,62,cc, */
        {0xa0, 0x90, ZC3XX_R01E_HSYNC_1},                /* 00,1e,90,cc, */
        {0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},                /* 00,1f,c8,cc, */
        {0xa0, 0xff, ZC3XX_R020_HSYNC_3},                /* 00,20,ff,cc, */
        {0xa0, 0x58, ZC3XX_R11D_GLOBALGAIN},                /* 01,1d,58,cc, */
        {0xa0, 0x03, ZC3XX_R180_AUTOCORRECTENABLE},        /* 01,80,03,cc */
        {}
};

static u8 reg_r(struct gspca_dev *gspca_dev,
                u16 index)
{
        int ret;

        if (gspca_dev->usb_err < 0)
                return 0;
        ret = usb_control_msg(gspca_dev->dev,
                        usb_rcvctrlpipe(gspca_dev->dev, 0),
                        0xa1,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                        0x01,                        /* value */
                        index, gspca_dev->usb_buf, 1,
                        500);
        if (ret < 0) {
                pr_err("reg_r err %d\n", ret);
                gspca_dev->usb_err = ret;
                return 0;
        }
        return gspca_dev->usb_buf[0];
}

static void reg_w(struct gspca_dev *gspca_dev,
                        u8 value,
                        u16 index)
{
        int ret;

        if (gspca_dev->usb_err < 0)
                return;
        ret = usb_control_msg(gspca_dev->dev,
                        usb_sndctrlpipe(gspca_dev->dev, 0),
                        0xa0,
                        USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                        value, index, NULL, 0,
                        500);
        if (ret < 0) {
                pr_err("reg_w_i err %d\n", ret);
                gspca_dev->usb_err = ret;
        }
}

static u16 i2c_read(struct gspca_dev *gspca_dev,
                        u8 reg)
{
        u8 retbyte;
        u16 retval;

        if (gspca_dev->usb_err < 0)
                return 0;
        reg_w(gspca_dev, reg, 0x0092);
        reg_w(gspca_dev, 0x02, 0x0090);                        /* <- read command */
        msleep(20);
        retbyte = reg_r(gspca_dev, 0x0091);                /* read status */
        if (retbyte != 0x00)
                pr_err("i2c_r status error %02x\n", retbyte);
        retval = reg_r(gspca_dev, 0x0095);                /* read Lowbyte */
        retval |= reg_r(gspca_dev, 0x0096) << 8;        /* read Hightbyte */
        return retval;
}

static u8 i2c_write(struct gspca_dev *gspca_dev,
                        u8 reg,
                        u8 valL,
                        u8 valH)
{
        u8 retbyte;

        if (gspca_dev->usb_err < 0)
                return 0;
        reg_w(gspca_dev, reg, 0x92);
        reg_w(gspca_dev, valL, 0x93);
        reg_w(gspca_dev, valH, 0x94);
        reg_w(gspca_dev, 0x01, 0x90);                /* <- write command */
        msleep(1);
        retbyte = reg_r(gspca_dev, 0x0091);                /* read status */
        if (retbyte != 0x00)
                pr_err("i2c_w status error %02x\n", retbyte);
        return retbyte;
}

static void usb_exchange(struct gspca_dev *gspca_dev,
                        const struct usb_action *action)
{
        while (action->req) {
                switch (action->req) {
                case 0xa0:        /* write register */
                        reg_w(gspca_dev, action->val, action->idx);
                        break;
                case 0xa1:        /* read status */
                        reg_r(gspca_dev, action->idx);
                        break;
                case 0xaa:
                        i2c_write(gspca_dev,
                                  action->val,                        /* reg */
                                  action->idx & 0xff,                /* valL */
                                  action->idx >> 8);                /* valH */
                        break;
                case 0xbb:
                        i2c_write(gspca_dev,
                                  action->idx >> 8,                /* reg */
                                  action->idx & 0xff,                /* valL */
                                  action->val);                        /* valH */
                        break;
                default:
/*                case 0xdd:         * delay */
                        msleep(action->idx);
                        break;
                }
                action++;
                msleep(1);
        }
}

static void setmatrix(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        int i;
        const u8 *matrix;
        static const u8 adcm2700_matrix[9] =
/*                {0x66, 0xed, 0xed, 0xed, 0x66, 0xed, 0xed, 0xed, 0x66}; */
/*ms-win*/
                {0x74, 0xed, 0xed, 0xed, 0x74, 0xed, 0xed, 0xed, 0x74};
        static const u8 gc0305_matrix[9] =
                {0x50, 0xf8, 0xf8, 0xf8, 0x50, 0xf8, 0xf8, 0xf8, 0x50};
        static const u8 ov7620_matrix[9] =
                {0x58, 0xf4, 0xf4, 0xf4, 0x58, 0xf4, 0xf4, 0xf4, 0x58};
        static const u8 pas202b_matrix[9] =
                {0x4c, 0xf5, 0xff, 0xf9, 0x51, 0xf5, 0xfb, 0xed, 0x5f};
        static const u8 po2030_matrix[9] =
                {0x60, 0xf0, 0xf0, 0xf0, 0x60, 0xf0, 0xf0, 0xf0, 0x60};
        static const u8 tas5130c_matrix[9] =
                {0x68, 0xec, 0xec, 0xec, 0x68, 0xec, 0xec, 0xec, 0x68};
        static const u8 gc0303_matrix[9] =
                {0x6c, 0xea, 0xea, 0xea, 0x6c, 0xea, 0xea, 0xea, 0x6c};
        static const u8 *matrix_tb[SENSOR_MAX] = {
                [SENSOR_ADCM2700] =        adcm2700_matrix,
                [SENSOR_CS2102] =        ov7620_matrix,
                [SENSOR_CS2102K] =        NULL,
                [SENSOR_GC0303] =        gc0303_matrix,
                [SENSOR_GC0305] =        gc0305_matrix,
                [SENSOR_HDCS2020] =        NULL,
                [SENSOR_HV7131B] =        NULL,
                [SENSOR_HV7131R] =        po2030_matrix,
                [SENSOR_ICM105A] =        po2030_matrix,
                [SENSOR_MC501CB] =        NULL,
                [SENSOR_MT9V111_1] =        gc0305_matrix,
                [SENSOR_MT9V111_3] =        gc0305_matrix,
                [SENSOR_OV7620] =        ov7620_matrix,
                [SENSOR_OV7630C] =        NULL,
                [SENSOR_PAS106] =        NULL,
                [SENSOR_PAS202B] =        pas202b_matrix,
                [SENSOR_PB0330] =        gc0305_matrix,
                [SENSOR_PO2030] =        po2030_matrix,
                [SENSOR_TAS5130C] =        tas5130c_matrix,
        };

        matrix = matrix_tb[sd->sensor];
        if (matrix == NULL)
                return;                /* matrix already loaded */
        for (i = 0; i < ARRAY_SIZE(ov7620_matrix); i++)
                reg_w(gspca_dev, matrix[i], 0x010a + i);
}

static void setsharpness(struct gspca_dev *gspca_dev, s32 val)
{
        static const u8 sharpness_tb[][2] = {
                {0x02, 0x03},
                {0x04, 0x07},
                {0x08, 0x0f},
                {0x10, 0x1e}
        };

        reg_w(gspca_dev, sharpness_tb[val][0], 0x01c6);
        reg_r(gspca_dev, 0x01c8);
        reg_r(gspca_dev, 0x01c9);
        reg_r(gspca_dev, 0x01ca);
        reg_w(gspca_dev, sharpness_tb[val][1], 0x01cb);
}

static void setcontrast(struct gspca_dev *gspca_dev,
                s32 gamma, s32 brightness, s32 contrast)
{
        const u8 *Tgamma;
        int g, i, adj, gp1, gp2;
        u8 gr[16];
        static const u8 delta_b[16] =                /* delta for brightness */
                {0x50, 0x38, 0x2d, 0x28, 0x24, 0x21, 0x1e, 0x1d,
                 0x1d, 0x1b, 0x1b, 0x1b, 0x19, 0x18, 0x18, 0x18};
        static const u8 delta_c[16] =                /* delta for contrast */
                {0x2c, 0x1a, 0x12, 0x0c, 0x0a, 0x06, 0x06, 0x06,
                 0x04, 0x06, 0x04, 0x04, 0x03, 0x03, 0x02, 0x02};
        static const u8 gamma_tb[6][16] = {
                {0x00, 0x00, 0x03, 0x0d, 0x1b, 0x2e, 0x45, 0x5f,
                 0x79, 0x93, 0xab, 0xc1, 0xd4, 0xe5, 0xf3, 0xff},
                {0x01, 0x0c, 0x1f, 0x3a, 0x53, 0x6d, 0x85, 0x9c,
                 0xb0, 0xc2, 0xd1, 0xde, 0xe9, 0xf2, 0xf9, 0xff},
                {0x04, 0x16, 0x30, 0x4e, 0x68, 0x81, 0x98, 0xac,
                 0xbe, 0xcd, 0xda, 0xe4, 0xed, 0xf5, 0xfb, 0xff},
                {0x13, 0x38, 0x59, 0x79, 0x92, 0xa7, 0xb9, 0xc8,
                 0xd4, 0xdf, 0xe7, 0xee, 0xf4, 0xf9, 0xfc, 0xff},
                {0x20, 0x4b, 0x6e, 0x8d, 0xa3, 0xb5, 0xc5, 0xd2,
                 0xdc, 0xe5, 0xec, 0xf2, 0xf6, 0xfa, 0xfd, 0xff},
                {0x24, 0x44, 0x64, 0x84, 0x9d, 0xb2, 0xc4, 0xd3,
                 0xe0, 0xeb, 0xf4, 0xff, 0xff, 0xff, 0xff, 0xff},
        };

        Tgamma = gamma_tb[gamma - 1];

        contrast -= 128; /* -128 / 127 */
        brightness -= 128; /* -128 / 92 */
        adj = 0;
        gp1 = gp2 = 0;
        for (i = 0; i < 16; i++) {
                g = Tgamma[i] + delta_b[i] * brightness / 256
                                - delta_c[i] * contrast / 256 - adj / 2;
                if (g > 0xff)
                        g = 0xff;
                else if (g < 0)
                        g = 0;
                reg_w(gspca_dev, g, 0x0120 + i);        /* gamma */
                if (contrast > 0)
                        adj--;
                else if (contrast < 0)
                        adj++;
                if (i > 1)
                        gr[i - 1] = (g - gp2) / 2;
                else if (i != 0)
                        gr[0] = gp1 == 0 ? 0 : (g - gp1);
                gp2 = gp1;
                gp1 = g;
        }
        gr[15] = (0xff - gp2) / 2;
        for (i = 0; i < 16; i++)
                reg_w(gspca_dev, gr[i], 0x0130 + i);        /* gradient */
}

static s32 getexposure(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;

        switch (sd->sensor) {
        case SENSOR_HV7131R:
                return (i2c_read(gspca_dev, 0x25) << 9)
                        | (i2c_read(gspca_dev, 0x26) << 1)
                        | (i2c_read(gspca_dev, 0x27) >> 7);
        case SENSOR_OV7620:
                return i2c_read(gspca_dev, 0x10);
        default:
                return -1;
        }
}

static void setexposure(struct gspca_dev *gspca_dev, s32 val)
{
        struct sd *sd = (struct sd *) gspca_dev;

        switch (sd->sensor) {
        case SENSOR_HV7131R:
                i2c_write(gspca_dev, 0x25, val >> 9, 0x00);
                i2c_write(gspca_dev, 0x26, val >> 1, 0x00);
                i2c_write(gspca_dev, 0x27, val << 7, 0x00);
                break;
        case SENSOR_OV7620:
                i2c_write(gspca_dev, 0x10, val, 0x00);
                break;
        }
}

static void setquality(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        jpeg_set_qual(sd->jpeg_hdr, jpeg_qual[sd->reg08 >> 1]);
        reg_w(gspca_dev, sd->reg08, ZC3XX_R008_CLOCKSETTING);
}

/* Matches the sensor's internal frame rate to the lighting frequency.
 * Valid frequencies are:
 *        50Hz, for European and Asian lighting (default)
 *        60Hz, for American lighting
 *        0 = No Flicker (for outdoor usage)
 */
static void setlightfreq(struct gspca_dev *gspca_dev, s32 val)
{
        struct sd *sd = (struct sd *) gspca_dev;
        int i, mode;
        const struct usb_action *zc3_freq;
        static const struct usb_action *freq_tb[SENSOR_MAX][6] = {
        [SENSOR_ADCM2700] = {
                 adcm2700_NoFlicker, adcm2700_NoFlicker,
                 adcm2700_50HZ, adcm2700_50HZ,
                 adcm2700_60HZ, adcm2700_60HZ},
        [SENSOR_CS2102] = {
                 cs2102_NoFlicker, cs2102_NoFlickerScale,
                 cs2102_50HZ, cs2102_50HZScale,
                 cs2102_60HZ, cs2102_60HZScale},
        [SENSOR_CS2102K] = {
                 cs2102_NoFlicker, cs2102_NoFlickerScale,
                 NULL, NULL, /* currently disabled */
                 NULL, NULL},
        [SENSOR_GC0303] = {
                 gc0303_NoFlicker, gc0303_NoFlickerScale,
                 gc0303_50HZ, gc0303_50HZScale,
                 gc0303_60HZ, gc0303_60HZScale},
        [SENSOR_GC0305] = {
                 gc0305_NoFlicker, gc0305_NoFlicker,
                 gc0305_50HZ, gc0305_50HZ,
                 gc0305_60HZ, gc0305_60HZ},
        [SENSOR_HDCS2020] = {
                 hdcs2020_NoFlicker, hdcs2020_NoFlicker,
                 hdcs2020_50HZ, hdcs2020_50HZ,
                 hdcs2020_60HZ, hdcs2020_60HZ},
        [SENSOR_HV7131B] = {
                 hv7131b_NoFlicker, hv7131b_NoFlickerScale,
                 hv7131b_50HZ, hv7131b_50HZScale,
                 hv7131b_60HZ, hv7131b_60HZScale},
        [SENSOR_HV7131R] = {
                 hv7131r_NoFlicker, hv7131r_NoFlickerScale,
                 hv7131r_50HZ, hv7131r_50HZScale,
                 hv7131r_60HZ, hv7131r_60HZScale},
        [SENSOR_ICM105A] = {
                 icm105a_NoFlicker, icm105a_NoFlickerScale,
                 icm105a_50HZ, icm105a_50HZScale,
                 icm105a_60HZ, icm105a_60HZScale},
        [SENSOR_MC501CB] = {
                 mc501cb_NoFlicker, mc501cb_NoFlickerScale,
                 mc501cb_50HZ, mc501cb_50HZScale,
                 mc501cb_60HZ, mc501cb_60HZScale},
        [SENSOR_MT9V111_1] = {
                 mt9v111_1_AENoFlicker, mt9v111_1_AENoFlickerScale,
                 mt9v111_1_AE50HZ, mt9v111_1_AE50HZScale,
                 mt9v111_1_AE60HZ, mt9v111_1_AE60HZScale},
        [SENSOR_MT9V111_3] = {
                 mt9v111_3_AENoFlicker, mt9v111_3_AENoFlickerScale,
                 mt9v111_3_AE50HZ, mt9v111_3_AE50HZScale,
                 mt9v111_3_AE60HZ, mt9v111_3_AE60HZScale},
        [SENSOR_OV7620] = {
                 ov7620_NoFlicker, ov7620_NoFlicker,
                 ov7620_50HZ, ov7620_50HZ,
                 ov7620_60HZ, ov7620_60HZ},
        [SENSOR_OV7630C] = {
                 NULL, NULL,
                 NULL, NULL,
                 NULL, NULL},
        [SENSOR_PAS106] = {
                 pas106b_NoFlicker, pas106b_NoFlicker,
                 pas106b_50HZ, pas106b_50HZ,
                 pas106b_60HZ, pas106b_60HZ},
        [SENSOR_PAS202B] = {
                 pas202b_NoFlicker, pas202b_NoFlickerScale,
                 pas202b_50HZ, pas202b_50HZScale,
                 pas202b_60HZ, pas202b_60HZScale},
        [SENSOR_PB0330] = {
                 pb0330_NoFlicker, pb0330_NoFlickerScale,
                 pb0330_50HZ, pb0330_50HZScale,
                 pb0330_60HZ, pb0330_60HZScale},
        [SENSOR_PO2030] = {
                 po2030_NoFlicker, po2030_NoFlicker,
                 po2030_50HZ, po2030_50HZ,
                 po2030_60HZ, po2030_60HZ},
        [SENSOR_TAS5130C] = {
                 tas5130c_NoFlicker, tas5130c_NoFlickerScale,
                 tas5130c_50HZ, tas5130c_50HZScale,
                 tas5130c_60HZ, tas5130c_60HZScale},
        };

        i = val * 2;
        mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
        if (mode)
                i++;                        /* 320x240 */
        zc3_freq = freq_tb[sd->sensor][i];
        if (zc3_freq == NULL)
                return;
        usb_exchange(gspca_dev, zc3_freq);
        switch (sd->sensor) {
        case SENSOR_GC0305:
                if (mode                /* if 320x240 */
                    && val == 1)        /* and 50Hz */
                        reg_w(gspca_dev, 0x85, 0x018d);
                                        /* win: 0x80, 0x018d */
                break;
        case SENSOR_OV7620:
                if (!mode) {                /* if 640x480 */
                        if (val != 0)        /* and filter */
                                reg_w(gspca_dev, 0x40, 0x0002);
                        else
                                reg_w(gspca_dev, 0x44, 0x0002);
                }
                break;
        case SENSOR_PAS202B:
                reg_w(gspca_dev, 0x00, 0x01a7);
                break;
        }
}

static void setautogain(struct gspca_dev *gspca_dev, s32 val)
{
        struct sd *sd = (struct sd *) gspca_dev;

        if (sd->sensor == SENSOR_OV7620)
                i2c_write(gspca_dev, 0x13, val ? 0xa3 : 0x80, 0x00);
        else
                reg_w(gspca_dev, val ? 0x42 : 0x02, 0x0180);
}

/*
 * Update the transfer parameters.
 * This function is executed from a work queue.
 */
static void transfer_update(struct work_struct *work)
{
        struct sd *sd = container_of(work, struct sd, work);
        struct gspca_dev *gspca_dev = &sd->gspca_dev;
        int change, good;
        u8 reg07, reg11;

        /* reg07 gets set to 0 by sd_start before starting us */
        reg07 = 0;

        good = 0;
        while (1) {
                msleep(100);

                /* To protect gspca_dev->usb_buf and gspca_dev->usb_err */
                mutex_lock(&gspca_dev->usb_lock);
#ifdef CONFIG_PM
                if (gspca_dev->frozen)
                        break;
#endif
                if (!gspca_dev->present || !gspca_dev->streaming)
                        break;

                /* Bit 0 of register 11 indicates FIFO overflow */
                gspca_dev->usb_err = 0;
                reg11 = reg_r(gspca_dev, 0x0011);
                if (gspca_dev->usb_err)
                        break;

                change = reg11 & 0x01;
                if (change) {                                /* overflow */
                        good = 0;

                        if (reg07 == 0) /* Bit Rate Control not enabled? */
                                reg07 = 0x32; /* Allow 98 bytes / unit */
                        else if (reg07 > 2)
                                reg07 -= 2; /* Decrease allowed bytes / unit */
                        else
                                change = 0;
                } else {                                /* no overflow */
                        good++;
                        if (good >= 10) {
                                good = 0;
                                if (reg07) { /* BRC enabled? */
                                        change = 1;
                                        if (reg07 < 0x32)
                                                reg07 += 2;
                                        else
                                                reg07 = 0;
                                }
                        }
                }
                if (change) {
                        gspca_dev->usb_err = 0;
                        reg_w(gspca_dev, reg07, 0x0007);
                        if (gspca_dev->usb_err)
                                break;
                }
                mutex_unlock(&gspca_dev->usb_lock);
        }

        /* Something went wrong. Unlock and return */
        mutex_unlock(&gspca_dev->usb_lock);
}

static void send_unknown(struct gspca_dev *gspca_dev, int sensor)
{
        reg_w(gspca_dev, 0x01, 0x0000);                /* bridge reset */
        switch (sensor) {
        case SENSOR_PAS106:
                reg_w(gspca_dev, 0x03, 0x003a);
                reg_w(gspca_dev, 0x0c, 0x003b);
                reg_w(gspca_dev, 0x08, 0x0038);
                break;
        case SENSOR_ADCM2700:
        case SENSOR_GC0305:
        case SENSOR_OV7620:
        case SENSOR_MT9V111_1:
        case SENSOR_MT9V111_3:
        case SENSOR_PB0330:
        case SENSOR_PO2030:
                reg_w(gspca_dev, 0x0d, 0x003a);
                reg_w(gspca_dev, 0x02, 0x003b);
                reg_w(gspca_dev, 0x00, 0x0038);
                break;
        case SENSOR_HV7131R:
        case SENSOR_PAS202B:
                reg_w(gspca_dev, 0x03, 0x003b);
                reg_w(gspca_dev, 0x0c, 0x003a);
                reg_w(gspca_dev, 0x0b, 0x0039);
                if (sensor == SENSOR_PAS202B)
                        reg_w(gspca_dev, 0x0b, 0x0038);
                break;
        }
}

/* start probe 2 wires */
static void start_2wr_probe(struct gspca_dev *gspca_dev, int sensor)
{
        reg_w(gspca_dev, 0x01, 0x0000);
        reg_w(gspca_dev, sensor, 0x0010);
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0x03, 0x0012);
        reg_w(gspca_dev, 0x01, 0x0012);
/*        msleep(2); */
}

static int sif_probe(struct gspca_dev *gspca_dev)
{
        u16 checkword;

        start_2wr_probe(gspca_dev, 0x0f);                /* PAS106 */
        reg_w(gspca_dev, 0x08, 0x008d);
        msleep(150);
        checkword = ((i2c_read(gspca_dev, 0x00) & 0x0f) << 4)
                        | ((i2c_read(gspca_dev, 0x01) & 0xf0) >> 4);
        gspca_dbg(gspca_dev, D_PROBE, "probe sif 0x%04x\n", checkword);
        if (checkword == 0x0007) {
                send_unknown(gspca_dev, SENSOR_PAS106);
                return 0x0f;                        /* PAS106 */
        }
        return -1;
}

static int vga_2wr_probe(struct gspca_dev *gspca_dev)
{
        u16 retword;

        start_2wr_probe(gspca_dev, 0x00);        /* HV7131B */
        i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
        retword = i2c_read(gspca_dev, 0x01);
        if (retword != 0)
                return 0x00;                        /* HV7131B */

        start_2wr_probe(gspca_dev, 0x04);        /* CS2102 */
        i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
        retword = i2c_read(gspca_dev, 0x01);
        if (retword != 0)
                return 0x04;                        /* CS2102 */

        start_2wr_probe(gspca_dev, 0x06);        /* OmniVision */
        reg_w(gspca_dev, 0x08, 0x008d);
        i2c_write(gspca_dev, 0x11, 0xaa, 0x00);
        retword = i2c_read(gspca_dev, 0x11);
        if (retword != 0) {
                /* (should have returned 0xaa) --> Omnivision? */
                /* reg_r 0x10 -> 0x06 -->  */
                goto ov_check;
        }

        start_2wr_probe(gspca_dev, 0x08);        /* HDCS2020 */
        i2c_write(gspca_dev, 0x1c, 0x00, 0x00);
        i2c_write(gspca_dev, 0x15, 0xaa, 0x00);
        retword = i2c_read(gspca_dev, 0x15);
        if (retword != 0)
                return 0x08;                        /* HDCS2020 */

        start_2wr_probe(gspca_dev, 0x0a);        /* PB0330 */
        i2c_write(gspca_dev, 0x07, 0xaa, 0xaa);
        retword = i2c_read(gspca_dev, 0x07);
        if (retword != 0)
                return 0x0a;                        /* PB0330 */
        retword = i2c_read(gspca_dev, 0x03);
        if (retword != 0)
                return 0x0a;                        /* PB0330 ?? */
        retword = i2c_read(gspca_dev, 0x04);
        if (retword != 0)
                return 0x0a;                        /* PB0330 ?? */

        start_2wr_probe(gspca_dev, 0x0c);        /* ICM105A */
        i2c_write(gspca_dev, 0x01, 0x11, 0x00);
        retword = i2c_read(gspca_dev, 0x01);
        if (retword != 0)
                return 0x0c;                        /* ICM105A */

        start_2wr_probe(gspca_dev, 0x0e);        /* PAS202BCB */
        reg_w(gspca_dev, 0x08, 0x008d);
        i2c_write(gspca_dev, 0x03, 0xaa, 0x00);
        msleep(50);
        retword = i2c_read(gspca_dev, 0x03);
        if (retword != 0) {
                send_unknown(gspca_dev, SENSOR_PAS202B);
                return 0x0e;                        /* PAS202BCB */
        }

        start_2wr_probe(gspca_dev, 0x02);        /* TAS5130C */
        i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
        retword = i2c_read(gspca_dev, 0x01);
        if (retword != 0)
                return 0x02;                        /* TAS5130C */
ov_check:
        reg_r(gspca_dev, 0x0010);                /* ?? */
        reg_r(gspca_dev, 0x0010);

        reg_w(gspca_dev, 0x01, 0x0000);
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0x06, 0x0010);                /* OmniVision */
        reg_w(gspca_dev, 0xa1, 0x008b);
        reg_w(gspca_dev, 0x08, 0x008d);
        msleep(500);
        reg_w(gspca_dev, 0x01, 0x0012);
        i2c_write(gspca_dev, 0x12, 0x80, 0x00);        /* sensor reset */
        retword = i2c_read(gspca_dev, 0x0a) << 8;
        retword |= i2c_read(gspca_dev, 0x0b);
        gspca_dbg(gspca_dev, D_PROBE, "probe 2wr ov vga 0x%04x\n", retword);
        switch (retword) {
        case 0x7631:                                /* OV7630C */
                reg_w(gspca_dev, 0x06, 0x0010);
                break;
        case 0x7620:                                /* OV7620 */
        case 0x7648:                                /* OV7648 */
                break;
        default:
                return -1;                        /* not OmniVision */
        }
        return retword;
}

struct sensor_by_chipset_revision {
        u16 revision;
        u8 internal_sensor_id;
};
static const struct sensor_by_chipset_revision chipset_revision_sensor[] = {
        {0xc000, 0x12},                /* TAS5130C */
        {0xc001, 0x13},                /* MT9V111 */
        {0xe001, 0x13},
        {0x8001, 0x13},
        {0x8000, 0x14},                /* CS2102K */
        {0x8400, 0x15},                /* MT9V111 */
        {0xe400, 0x15},
};

static int vga_3wr_probe(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        int i;
        u16 retword;

/*fixme: lack of 8b=b3 (11,12)-> 10, 8b=e0 (14,15,16)-> 12 found in gspcav1*/
        reg_w(gspca_dev, 0x02, 0x0010);
        reg_r(gspca_dev, 0x0010);
        reg_w(gspca_dev, 0x01, 0x0000);
        reg_w(gspca_dev, 0x00, 0x0010);
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0x91, 0x008b);
        reg_w(gspca_dev, 0x03, 0x0012);
        reg_w(gspca_dev, 0x01, 0x0012);
        reg_w(gspca_dev, 0x05, 0x0012);
        retword = i2c_read(gspca_dev, 0x14);
        if (retword != 0)
                return 0x11;                        /* HV7131R */
        retword = i2c_read(gspca_dev, 0x15);
        if (retword != 0)
                return 0x11;                        /* HV7131R */
        retword = i2c_read(gspca_dev, 0x16);
        if (retword != 0)
                return 0x11;                        /* HV7131R */

        reg_w(gspca_dev, 0x02, 0x0010);
        retword = reg_r(gspca_dev, 0x000b) << 8;
        retword |= reg_r(gspca_dev, 0x000a);
        gspca_dbg(gspca_dev, D_PROBE, "probe 3wr vga 1 0x%04x\n", retword);
        reg_r(gspca_dev, 0x0010);
        if ((retword & 0xff00) == 0x6400)
                return 0x02;                /* TAS5130C */
        for (i = 0; i < ARRAY_SIZE(chipset_revision_sensor); i++) {
                if (chipset_revision_sensor[i].revision == retword) {
                        sd->chip_revision = retword;
                        send_unknown(gspca_dev, SENSOR_PB0330);
                        return chipset_revision_sensor[i].internal_sensor_id;
                }
        }

        reg_w(gspca_dev, 0x01, 0x0000);        /* check PB0330 */
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0xdd, 0x008b);
        reg_w(gspca_dev, 0x0a, 0x0010);
        reg_w(gspca_dev, 0x03, 0x0012);
        reg_w(gspca_dev, 0x01, 0x0012);
        retword = i2c_read(gspca_dev, 0x00);
        if (retword != 0) {
                gspca_dbg(gspca_dev, D_PROBE, "probe 3wr vga type 0a\n");
                return 0x0a;                        /* PB0330 */
        }

        /* probe gc0303 / gc0305 */
        reg_w(gspca_dev, 0x01, 0x0000);
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0x98, 0x008b);
        reg_w(gspca_dev, 0x01, 0x0010);
        reg_w(gspca_dev, 0x03, 0x0012);
        msleep(2);
        reg_w(gspca_dev, 0x01, 0x0012);
        retword = i2c_read(gspca_dev, 0x00);
        if (retword != 0) {
                gspca_dbg(gspca_dev, D_PROBE, "probe 3wr vga type %02x\n",
                          retword);
                if (retword == 0x0011)                        /* gc0303 */
                        return 0x0303;
                if (retword == 0x0029)                        /* gc0305 */
                        send_unknown(gspca_dev, SENSOR_GC0305);
                return retword;
        }

        reg_w(gspca_dev, 0x01, 0x0000);        /* check OmniVision */
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0xa1, 0x008b);
        reg_w(gspca_dev, 0x08, 0x008d);
        reg_w(gspca_dev, 0x06, 0x0010);
        reg_w(gspca_dev, 0x01, 0x0012);
        reg_w(gspca_dev, 0x05, 0x0012);
        if (i2c_read(gspca_dev, 0x1c) == 0x007f        /* OV7610 - manufacturer ID */
            && i2c_read(gspca_dev, 0x1d) == 0x00a2) {
                send_unknown(gspca_dev, SENSOR_OV7620);
                return 0x06;                /* OmniVision confirm ? */
        }

        reg_w(gspca_dev, 0x01, 0x0000);
        reg_w(gspca_dev, 0x00, 0x0002);
        reg_w(gspca_dev, 0x01, 0x0010);
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0xee, 0x008b);
        reg_w(gspca_dev, 0x03, 0x0012);
        reg_w(gspca_dev, 0x01, 0x0012);
        reg_w(gspca_dev, 0x05, 0x0012);
        retword = i2c_read(gspca_dev, 0x00) << 8;        /* ID 0 */
        retword |= i2c_read(gspca_dev, 0x01);                /* ID 1 */
        gspca_dbg(gspca_dev, D_PROBE, "probe 3wr vga 2 0x%04x\n", retword);
        if (retword == 0x2030) {
                u8 retbyte;

                retbyte = i2c_read(gspca_dev, 0x02);        /* revision number */
                gspca_dbg(gspca_dev, D_PROBE, "sensor PO2030 rev 0x%02x\n",
                          retbyte);

                send_unknown(gspca_dev, SENSOR_PO2030);
                return retword;
        }

        reg_w(gspca_dev, 0x01, 0x0000);
        reg_w(gspca_dev, 0x0a, 0x0010);
        reg_w(gspca_dev, 0xd3, 0x008b);
        reg_w(gspca_dev, 0x01, 0x0001);
        reg_w(gspca_dev, 0x03, 0x0012);
        reg_w(gspca_dev, 0x01, 0x0012);
        reg_w(gspca_dev, 0x05, 0x0012);
        reg_w(gspca_dev, 0xd3, 0x008b);
        retword = i2c_read(gspca_dev, 0x01);
        if (retword != 0) {
                gspca_dbg(gspca_dev, D_PROBE, "probe 3wr vga type 0a ? ret: %04x\n",
                          retword);
                return 0x16;                        /* adcm2700 (6100/6200) */
        }
        return -1;
}

static int zcxx_probeSensor(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        int sensor;

        switch (sd->sensor) {
        case SENSOR_MC501CB:
                return -1;                /* don't probe */
        case SENSOR_GC0303:
                        /* may probe but with no write in reg 0x0010 */
                return -1;                /* don't probe */
        case SENSOR_PAS106:
                sensor =  sif_probe(gspca_dev);
                if (sensor >= 0)
                        return sensor;
                break;
        }
        sensor = vga_2wr_probe(gspca_dev);
        if (sensor >= 0)
                return sensor;
        return vga_3wr_probe(gspca_dev);
}

/* this function is called at probe time */
static int sd_config(struct gspca_dev *gspca_dev,
                        const struct usb_device_id *id)
{
        struct sd *sd = (struct sd *) gspca_dev;

        if (id->idProduct == 0x301b)
                sd->bridge = BRIDGE_ZC301;
        else
                sd->bridge = BRIDGE_ZC303;

        /* define some sensors from the vendor/product */
        sd->sensor = id->driver_info;

        sd->reg08 = REG08_DEF;

        INIT_WORK(&sd->work, transfer_update);

        return 0;
}

static int zcxx_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
{
        struct gspca_dev *gspca_dev =
                container_of(ctrl->handler, struct gspca_dev, ctrl_handler);
        struct sd *sd = (struct sd *)gspca_dev;

        switch (ctrl->id) {
        case V4L2_CID_AUTOGAIN:
                gspca_dev->usb_err = 0;
                if (ctrl->val && sd->exposure && gspca_dev->streaming)
                        sd->exposure->val = getexposure(gspca_dev);
                return gspca_dev->usb_err;
        }
        return -EINVAL;
}

static int zcxx_s_ctrl(struct v4l2_ctrl *ctrl)
{
        struct gspca_dev *gspca_dev =
                container_of(ctrl->handler, struct gspca_dev, ctrl_handler);
        struct sd *sd = (struct sd *)gspca_dev;
        int i, qual;

        gspca_dev->usb_err = 0;

        if (ctrl->id == V4L2_CID_JPEG_COMPRESSION_QUALITY) {
                qual = sd->reg08 >> 1;

                for (i = 0; i < ARRAY_SIZE(jpeg_qual); i++) {
                        if (ctrl->val <= jpeg_qual[i])
                                break;
                }
                if (i == ARRAY_SIZE(jpeg_qual) || (i > 0 && i == qual && ctrl->val < jpeg_qual[i]))
                        i--;

                /* With high quality settings we need max bandwidth */
                if (i >= 2 && gspca_dev->streaming &&
                    !gspca_dev->cam.needs_full_bandwidth)
                        return -EBUSY;

                sd->reg08 = (i << 1) | 1;
                ctrl->val = jpeg_qual[i];
        }

        if (!gspca_dev->streaming)
                return 0;

        switch (ctrl->id) {
        /* gamma/brightness/contrast cluster */
        case V4L2_CID_GAMMA:
                setcontrast(gspca_dev, sd->gamma->val,
                                sd->brightness->val, sd->contrast->val);
                break;
        /* autogain/exposure cluster */
        case V4L2_CID_AUTOGAIN:
                setautogain(gspca_dev, ctrl->val);
                if (!gspca_dev->usb_err && !ctrl->val && sd->exposure)
                        setexposure(gspca_dev, sd->exposure->val);
                break;
        case V4L2_CID_POWER_LINE_FREQUENCY:
                setlightfreq(gspca_dev, ctrl->val);
                break;
        case V4L2_CID_SHARPNESS:
                setsharpness(gspca_dev, ctrl->val);
                break;
        case V4L2_CID_JPEG_COMPRESSION_QUALITY:
                setquality(gspca_dev);
                break;
        }
        return gspca_dev->usb_err;
}

static const struct v4l2_ctrl_ops zcxx_ctrl_ops = {
        .g_volatile_ctrl = zcxx_g_volatile_ctrl,
        .s_ctrl = zcxx_s_ctrl,
};

static int sd_init_controls(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *)gspca_dev;
        struct v4l2_ctrl_handler *hdl = &gspca_dev->ctrl_handler;
        static const u8 gamma[SENSOR_MAX] = {
                [SENSOR_ADCM2700] =        4,
                [SENSOR_CS2102] =        4,
                [SENSOR_CS2102K] =        5,
                [SENSOR_GC0303] =        3,
                [SENSOR_GC0305] =        4,
                [SENSOR_HDCS2020] =        4,
                [SENSOR_HV7131B] =        4,
                [SENSOR_HV7131R] =        4,
                [SENSOR_ICM105A] =        4,
                [SENSOR_MC501CB] =        4,
                [SENSOR_MT9V111_1] =        4,
                [SENSOR_MT9V111_3] =        4,
                [SENSOR_OV7620] =        3,
                [SENSOR_OV7630C] =        4,
                [SENSOR_PAS106] =        4,
                [SENSOR_PAS202B] =        4,
                [SENSOR_PB0330] =        4,
                [SENSOR_PO2030] =        4,
                [SENSOR_TAS5130C] =        3,
        };

        gspca_dev->vdev.ctrl_handler = hdl;
        v4l2_ctrl_handler_init(hdl, 8);
        sd->brightness = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_BRIGHTNESS, 0, 255, 1, 128);
        sd->contrast = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_CONTRAST, 0, 255, 1, 128);
        sd->gamma = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_GAMMA, 1, 6, 1, gamma[sd->sensor]);
        if (sd->sensor == SENSOR_HV7131R)
                sd->exposure = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_EXPOSURE, 0x30d, 0x493e, 1, 0x927);
        else if (sd->sensor == SENSOR_OV7620)
                sd->exposure = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_EXPOSURE, 0, 255, 1, 0x41);
        sd->autogain = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_AUTOGAIN, 0, 1, 1, 1);
        if (sd->sensor != SENSOR_OV7630C)
                sd->plfreq = v4l2_ctrl_new_std_menu(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_POWER_LINE_FREQUENCY,
                        V4L2_CID_POWER_LINE_FREQUENCY_60HZ, 0,
                        V4L2_CID_POWER_LINE_FREQUENCY_DISABLED);
        sd->sharpness = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_SHARPNESS, 0, 3, 1,
                        sd->sensor == SENSOR_PO2030 ? 0 : 2);
        sd->jpegqual = v4l2_ctrl_new_std(hdl, &zcxx_ctrl_ops,
                        V4L2_CID_JPEG_COMPRESSION_QUALITY,
                        jpeg_qual[0], jpeg_qual[ARRAY_SIZE(jpeg_qual) - 1], 1,
                        jpeg_qual[REG08_DEF >> 1]);
        if (hdl->error) {
                pr_err("Could not initialize controls\n");
                return hdl->error;
        }
        v4l2_ctrl_cluster(3, &sd->gamma);
        if (sd->sensor == SENSOR_HV7131R || sd->sensor == SENSOR_OV7620)
                v4l2_ctrl_auto_cluster(2, &sd->autogain, 0, true);
        return 0;
}

/* this function is called at probe and resume time */
static int sd_init(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        struct cam *cam;
        int sensor;
        static const u8 mode_tb[SENSOR_MAX] = {
                [SENSOR_ADCM2700] =        2,
                [SENSOR_CS2102] =        1,
                [SENSOR_CS2102K] =        1,
                [SENSOR_GC0303] =        1,
                [SENSOR_GC0305] =        1,
                [SENSOR_HDCS2020] =        1,
                [SENSOR_HV7131B] =        1,
                [SENSOR_HV7131R] =        1,
                [SENSOR_ICM105A] =        1,
                [SENSOR_MC501CB] =        2,
                [SENSOR_MT9V111_1] =        1,
                [SENSOR_MT9V111_3] =        1,
                [SENSOR_OV7620] =        2,
                [SENSOR_OV7630C] =        1,
                [SENSOR_PAS106] =        0,
                [SENSOR_PAS202B] =        1,
                [SENSOR_PB0330] =        1,
                [SENSOR_PO2030] =        1,
                [SENSOR_TAS5130C] =        1,
        };

        sensor = zcxx_probeSensor(gspca_dev);
        if (sensor >= 0)
                gspca_dbg(gspca_dev, D_PROBE, "probe sensor -> %04x\n", sensor);
        if ((unsigned) force_sensor < SENSOR_MAX) {
                sd->sensor = force_sensor;
                gspca_dbg(gspca_dev, D_PROBE, "sensor forced to %d\n",
                          force_sensor);
        } else {
                switch (sensor) {
                case -1:
                        switch (sd->sensor) {
                        case SENSOR_MC501CB:
                                gspca_dbg(gspca_dev, D_PROBE, "Sensor MC501CB\n");
                                break;
                        case SENSOR_GC0303:
                                gspca_dbg(gspca_dev, D_PROBE, "Sensor GC0303\n");
                                break;
                        default:
                                pr_warn("Unknown sensor - set to TAS5130C\n");
                                sd->sensor = SENSOR_TAS5130C;
                        }
                        break;
                case 0:
                        /* check the sensor type */
                        sensor = i2c_read(gspca_dev, 0x00);
                        gspca_dbg(gspca_dev, D_PROBE, "Sensor hv7131 type %d\n",
                                  sensor);
                        switch (sensor) {
                        case 0:                        /* hv7131b */
                        case 1:                        /* hv7131e */
                                gspca_dbg(gspca_dev, D_PROBE, "Find Sensor HV7131B\n");
                                sd->sensor = SENSOR_HV7131B;
                                break;
                        default:
/*                        case 2:                         * hv7131r */
                                gspca_dbg(gspca_dev, D_PROBE, "Find Sensor HV7131R\n");
                                sd->sensor = SENSOR_HV7131R;
                                break;
                        }
                        break;
                case 0x02:
                        gspca_dbg(gspca_dev, D_PROBE, "Sensor TAS5130C\n");
                        sd->sensor = SENSOR_TAS5130C;
                        break;
                case 0x04:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor CS2102\n");
                        sd->sensor = SENSOR_CS2102;
                        break;
                case 0x08:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor HDCS2020\n");
                        sd->sensor = SENSOR_HDCS2020;
                        break;
                case 0x0a:
                        gspca_dbg(gspca_dev, D_PROBE,
                                  "Find Sensor PB0330. Chip revision %x\n",
                                  sd->chip_revision);
                        sd->sensor = SENSOR_PB0330;
                        break;
                case 0x0c:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor ICM105A\n");
                        sd->sensor = SENSOR_ICM105A;
                        break;
                case 0x0e:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor PAS202B\n");
                        sd->sensor = SENSOR_PAS202B;
                        break;
                case 0x0f:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor PAS106\n");
                        sd->sensor = SENSOR_PAS106;
                        break;
                case 0x10:
                case 0x12:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor TAS5130C\n");
                        sd->sensor = SENSOR_TAS5130C;
                        break;
                case 0x11:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor HV7131R\n");
                        sd->sensor = SENSOR_HV7131R;
                        break;
                case 0x13:
                case 0x15:
                        gspca_dbg(gspca_dev, D_PROBE,
                                  "Sensor MT9V111. Chip revision %04x\n",
                                  sd->chip_revision);
                        sd->sensor = sd->bridge == BRIDGE_ZC301
                                        ? SENSOR_MT9V111_1
                                        : SENSOR_MT9V111_3;
                        break;
                case 0x14:
                        gspca_dbg(gspca_dev, D_PROBE,
                                  "Find Sensor CS2102K?. Chip revision %x\n",
                                  sd->chip_revision);
                        sd->sensor = SENSOR_CS2102K;
                        break;
                case 0x16:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor ADCM2700\n");
                        sd->sensor = SENSOR_ADCM2700;
                        break;
                case 0x29:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor GC0305\n");
                        sd->sensor = SENSOR_GC0305;
                        break;
                case 0x0303:
                        gspca_dbg(gspca_dev, D_PROBE, "Sensor GC0303\n");
                        sd->sensor =  SENSOR_GC0303;
                        break;
                case 0x2030:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor PO2030\n");
                        sd->sensor = SENSOR_PO2030;
                        break;
                case 0x7620:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor OV7620\n");
                        sd->sensor = SENSOR_OV7620;
                        break;
                case 0x7631:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor OV7630C\n");
                        sd->sensor = SENSOR_OV7630C;
                        break;
                case 0x7648:
                        gspca_dbg(gspca_dev, D_PROBE, "Find Sensor OV7648\n");
                        sd->sensor = SENSOR_OV7620;        /* same sensor (?) */
                        break;
                default:
                        pr_err("Unknown sensor %04x\n", sensor);
                        return -EINVAL;
                }
        }
        if (sensor < 0x20) {
                if (sensor == -1 || sensor == 0x10 || sensor == 0x12)
                        reg_w(gspca_dev, 0x02, 0x0010);
                reg_r(gspca_dev, 0x0010);
        }

        cam = &gspca_dev->cam;
        switch (mode_tb[sd->sensor]) {
        case 0:
                cam->cam_mode = sif_mode;
                cam->nmodes = ARRAY_SIZE(sif_mode);
                break;
        case 1:
                cam->cam_mode = vga_mode;
                cam->nmodes = ARRAY_SIZE(vga_mode);
                break;
        default:
/*        case 2: */
                cam->cam_mode = broken_vga_mode;
                cam->nmodes = ARRAY_SIZE(broken_vga_mode);
                break;
        }

        /* switch off the led */
        reg_w(gspca_dev, 0x01, 0x0000);
        return gspca_dev->usb_err;
}

static int sd_pre_start(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        gspca_dev->cam.needs_full_bandwidth = (sd->reg08 >= 4) ? 1 : 0;
        return 0;
}

static int sd_start(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;
        int mode;
        static const struct usb_action *init_tb[SENSOR_MAX][2] = {
        [SENSOR_ADCM2700] =
                        {adcm2700_Initial, adcm2700_InitialScale},
        [SENSOR_CS2102]        =
                        {cs2102_Initial, cs2102_InitialScale},
        [SENSOR_CS2102K] =
                        {cs2102K_Initial, cs2102K_InitialScale},
        [SENSOR_GC0303] =
                {gc0303_Initial, gc0303_InitialScale},
        [SENSOR_GC0305] =
                        {gc0305_Initial, gc0305_InitialScale},
        [SENSOR_HDCS2020] =
                        {hdcs2020_Initial, hdcs2020_InitialScale},
        [SENSOR_HV7131B] =
                        {hv7131b_Initial, hv7131b_InitialScale},
        [SENSOR_HV7131R] =
                        {hv7131r_Initial, hv7131r_InitialScale},
        [SENSOR_ICM105A] =
                        {icm105a_Initial, icm105a_InitialScale},
        [SENSOR_MC501CB] =
                        {mc501cb_Initial, mc501cb_InitialScale},
        [SENSOR_MT9V111_1] =
                        {mt9v111_1_Initial, mt9v111_1_InitialScale},
        [SENSOR_MT9V111_3] =
                        {mt9v111_3_Initial, mt9v111_3_InitialScale},
        [SENSOR_OV7620] =
                        {ov7620_Initial, ov7620_InitialScale},
        [SENSOR_OV7630C] =
                        {ov7630c_Initial, ov7630c_InitialScale},
        [SENSOR_PAS106] =
                        {pas106b_Initial, pas106b_InitialScale},
        [SENSOR_PAS202B] =
                        {pas202b_Initial, pas202b_InitialScale},
        [SENSOR_PB0330] =
                        {pb0330_Initial, pb0330_InitialScale},
        [SENSOR_PO2030] =
                        {po2030_Initial, po2030_InitialScale},
        [SENSOR_TAS5130C] =
                        {tas5130c_Initial, tas5130c_InitialScale},
        };

        /* create the JPEG header */
        jpeg_define(sd->jpeg_hdr, gspca_dev->pixfmt.height,
                        gspca_dev->pixfmt.width,
                        0x21);                /* JPEG 422 */

        mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
        switch (sd->sensor) {
        case SENSOR_HV7131R:
                zcxx_probeSensor(gspca_dev);
                break;
        case SENSOR_PAS106:
                usb_exchange(gspca_dev, pas106b_Initial_com);
                break;
        }
        usb_exchange(gspca_dev, init_tb[sd->sensor][mode]);

        switch (sd->sensor) {
        case SENSOR_ADCM2700:
        case SENSOR_GC0305:
        case SENSOR_OV7620:
        case SENSOR_PO2030:
        case SENSOR_TAS5130C:
        case SENSOR_GC0303:
/*                msleep(100);                         * ?? */
                reg_r(gspca_dev, 0x0002);        /* --> 0x40 */
                reg_w(gspca_dev, 0x09, 0x01ad);        /* (from win traces) */
                reg_w(gspca_dev, 0x15, 0x01ae);
                if (sd->sensor == SENSOR_TAS5130C)
                        break;
                reg_w(gspca_dev, 0x0d, 0x003a);
                reg_w(gspca_dev, 0x02, 0x003b);
                reg_w(gspca_dev, 0x00, 0x0038);
                break;
        case SENSOR_HV7131R:
        case SENSOR_PAS202B:
                reg_w(gspca_dev, 0x03, 0x003b);
                reg_w(gspca_dev, 0x0c, 0x003a);
                reg_w(gspca_dev, 0x0b, 0x0039);
                if (sd->sensor == SENSOR_HV7131R)
                        reg_w(gspca_dev, 0x50, ZC3XX_R11D_GLOBALGAIN);
                break;
        }

        setmatrix(gspca_dev);
        switch (sd->sensor) {
        case SENSOR_ADCM2700:
        case SENSOR_OV7620:
                reg_r(gspca_dev, 0x0008);
                reg_w(gspca_dev, 0x00, 0x0008);
                break;
        case SENSOR_PAS202B:
        case SENSOR_GC0305:
        case SENSOR_HV7131R:
        case SENSOR_TAS5130C:
                reg_r(gspca_dev, 0x0008);
                fallthrough;
        case SENSOR_PO2030:
                reg_w(gspca_dev, 0x03, 0x0008);
                break;
        }
        setsharpness(gspca_dev, v4l2_ctrl_g_ctrl(sd->sharpness));

        /* set the gamma tables when not set */
        switch (sd->sensor) {
        case SENSOR_CS2102K:                /* gamma set in xxx_Initial */
        case SENSOR_HDCS2020:
        case SENSOR_OV7630C:
                break;
        default:
                setcontrast(gspca_dev, v4l2_ctrl_g_ctrl(sd->gamma),
                                v4l2_ctrl_g_ctrl(sd->brightness),
                                v4l2_ctrl_g_ctrl(sd->contrast));
                break;
        }
        setmatrix(gspca_dev);                        /* one more time? */
        switch (sd->sensor) {
        case SENSOR_OV7620:
        case SENSOR_PAS202B:
                reg_r(gspca_dev, 0x0180);        /* from win */
                reg_w(gspca_dev, 0x00, 0x0180);
                break;
        }
        setquality(gspca_dev);
        /* Start with BRC disabled, transfer_update will enable it if needed */
        reg_w(gspca_dev, 0x00, 0x0007);
        if (sd->plfreq)
                setlightfreq(gspca_dev, v4l2_ctrl_g_ctrl(sd->plfreq));

        switch (sd->sensor) {
        case SENSOR_ADCM2700:
                reg_w(gspca_dev, 0x09, 0x01ad);        /* (from win traces) */
                reg_w(gspca_dev, 0x15, 0x01ae);
                reg_w(gspca_dev, 0x02, 0x0180);
                                                /* ms-win + */
                reg_w(gspca_dev, 0x40, 0x0117);
                break;
        case SENSOR_HV7131R:
                setexposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure));
                reg_w(gspca_dev, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN);
                break;
        case SENSOR_GC0305:
        case SENSOR_TAS5130C:
                reg_w(gspca_dev, 0x09, 0x01ad);        /* (from win traces) */
                reg_w(gspca_dev, 0x15, 0x01ae);
                fallthrough;
        case SENSOR_PAS202B:
        case SENSOR_PO2030:
/*                reg_w(gspca_dev, 0x40, ZC3XX_R117_GGAIN); in win traces */
                reg_r(gspca_dev, 0x0180);
                break;
        case SENSOR_OV7620:
                reg_w(gspca_dev, 0x09, 0x01ad);
                reg_w(gspca_dev, 0x15, 0x01ae);
                i2c_read(gspca_dev, 0x13);        /*fixme: returns 0xa3 */
                i2c_write(gspca_dev, 0x13, 0xa3, 0x00);
                                        /*fixme: returned value to send? */
                reg_w(gspca_dev, 0x40, 0x0117);
                reg_r(gspca_dev, 0x0180);
                break;
        }

        setautogain(gspca_dev, v4l2_ctrl_g_ctrl(sd->autogain));

        if (gspca_dev->usb_err < 0)
                return gspca_dev->usb_err;

        /* Start the transfer parameters update thread */
        schedule_work(&sd->work);

        return 0;
}

/* called on streamoff with alt==0 and on disconnect */
/* the usb_lock is held at entry - restore on exit */
static void sd_stop0(struct gspca_dev *gspca_dev)
{
        struct sd *sd = (struct sd *) gspca_dev;

        mutex_unlock(&gspca_dev->usb_lock);
        flush_work(&sd->work);
        mutex_lock(&gspca_dev->usb_lock);
        if (!gspca_dev->present)
                return;
        send_unknown(gspca_dev, sd->sensor);
}

static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                        u8 *data,
                        int len)
{
        struct sd *sd = (struct sd *) gspca_dev;

        /* check the JPEG end of frame */
        if (len >= 3
         && data[len - 3] == 0xff && data[len - 2] == 0xd9) {
/*fixme: what does the last byte mean?*/
                gspca_frame_add(gspca_dev, LAST_PACKET,
                                        data, len - 1);
                return;
        }

        /* check the JPEG start of a frame */
        if (data[0] == 0xff && data[1] == 0xd8) {
                /* put the JPEG header in the new frame */
                gspca_frame_add(gspca_dev, FIRST_PACKET,
                        sd->jpeg_hdr, JPEG_HDR_SZ);

                /* remove the webcam's header:
                 * ff d8 ff fe 00 0e 00 00 ss ss 00 01 ww ww hh hh pp pp
                 *        - 'ss ss' is the frame sequence number (BE)
                 *        - 'ww ww' and 'hh hh' are the window dimensions (BE)
                 *        - 'pp pp' is the packet sequence number (BE)
                 */
                data += 18;
                len -= 18;
        }
        gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
}

static int sd_set_jcomp(struct gspca_dev *gspca_dev,
                        const struct v4l2_jpegcompression *jcomp)
{
        struct sd *sd = (struct sd *) gspca_dev;

        return v4l2_ctrl_s_ctrl(sd->jpegqual, jcomp->quality);
}

static int sd_get_jcomp(struct gspca_dev *gspca_dev,
                        struct v4l2_jpegcompression *jcomp)
{
        struct sd *sd = (struct sd *) gspca_dev;

        memset(jcomp, 0, sizeof *jcomp);
        jcomp->quality = v4l2_ctrl_g_ctrl(sd->jpegqual);
        jcomp->jpeg_markers = V4L2_JPEG_MARKER_DHT
                        | V4L2_JPEG_MARKER_DQT;
        return 0;
}

#if IS_ENABLED(CONFIG_INPUT)
static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                        u8 *data,                /* interrupt packet data */
                        int len)                /* interrupt packet length */
{
        if (len == 8 && data[4] == 1) {
                input_report_key(gspca_dev->input_dev, KEY_CAMERA, 1);
                input_sync(gspca_dev->input_dev);
                input_report_key(gspca_dev->input_dev, KEY_CAMERA, 0);
                input_sync(gspca_dev->input_dev);
        }

        return 0;
}
#endif

static const struct sd_desc sd_desc = {
        .name = KBUILD_MODNAME,
        .config = sd_config,
        .init = sd_init,
        .init_controls = sd_init_controls,
        .isoc_init = sd_pre_start,
        .start = sd_start,
        .stop0 = sd_stop0,
        .pkt_scan = sd_pkt_scan,
        .get_jcomp = sd_get_jcomp,
        .set_jcomp = sd_set_jcomp,
#if IS_ENABLED(CONFIG_INPUT)
        .int_pkt_scan = sd_int_pkt_scan,
#endif
};

static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x03f0, 0x1b07)},
        {USB_DEVICE(0x041e, 0x041e)},
        {USB_DEVICE(0x041e, 0x4017)},
        {USB_DEVICE(0x041e, 0x401c), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x041e, 0x401e)},
        {USB_DEVICE(0x041e, 0x401f)},
        {USB_DEVICE(0x041e, 0x4022)},
        {USB_DEVICE(0x041e, 0x4029)},
        {USB_DEVICE(0x041e, 0x4034), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x041e, 0x4035), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x041e, 0x4036)},
        {USB_DEVICE(0x041e, 0x403a)},
        {USB_DEVICE(0x041e, 0x4051), .driver_info = SENSOR_GC0303},
        {USB_DEVICE(0x041e, 0x4053), .driver_info = SENSOR_GC0303},
        {USB_DEVICE(0x0458, 0x7007)},
        {USB_DEVICE(0x0458, 0x700c)},
        {USB_DEVICE(0x0458, 0x700f)},
        {USB_DEVICE(0x0461, 0x0a00)},
        {USB_DEVICE(0x046d, 0x089d), .driver_info = SENSOR_MC501CB},
        {USB_DEVICE(0x046d, 0x08a0)},
        {USB_DEVICE(0x046d, 0x08a1)},
        {USB_DEVICE(0x046d, 0x08a2)},
        {USB_DEVICE(0x046d, 0x08a3)},
        {USB_DEVICE(0x046d, 0x08a6)},
        {USB_DEVICE(0x046d, 0x08a7)},
        {USB_DEVICE(0x046d, 0x08a9)},
        {USB_DEVICE(0x046d, 0x08aa)},
        {USB_DEVICE(0x046d, 0x08ac)},
        {USB_DEVICE(0x046d, 0x08ad)},
        {USB_DEVICE(0x046d, 0x08ae)},
        {USB_DEVICE(0x046d, 0x08af)},
        {USB_DEVICE(0x046d, 0x08b9)},
        {USB_DEVICE(0x046d, 0x08d7)},
        {USB_DEVICE(0x046d, 0x08d8)},
        {USB_DEVICE(0x046d, 0x08d9)},
        {USB_DEVICE(0x046d, 0x08da)},
        {USB_DEVICE(0x046d, 0x08dd), .driver_info = SENSOR_MC501CB},
        {USB_DEVICE(0x0471, 0x0325), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x0471, 0x0326), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x0471, 0x032d), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x0471, 0x032e), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x055f, 0xc005)},
        {USB_DEVICE(0x055f, 0xd003)},
        {USB_DEVICE(0x055f, 0xd004)},
        {USB_DEVICE(0x0698, 0x2003)},
        {USB_DEVICE(0x0ac8, 0x0301), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x0ac8, 0x0302), .driver_info = SENSOR_PAS106},
        {USB_DEVICE(0x0ac8, 0x301b)},
        {USB_DEVICE(0x0ac8, 0x303b)},
        {USB_DEVICE(0x0ac8, 0x305b)},
        {USB_DEVICE(0x0ac8, 0x307b)},
        {USB_DEVICE(0x10fd, 0x0128)},
        {USB_DEVICE(0x10fd, 0x804d)},
        {USB_DEVICE(0x10fd, 0x8050)},
        {}                        /* end of entry */
};
MODULE_DEVICE_TABLE(usb, device_table);

/* -- device connect -- */
static int sd_probe(struct usb_interface *intf,
                        const struct usb_device_id *id)
{
        return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
                                THIS_MODULE);
}

/* USB driver */
static struct usb_driver sd_driver = {
        .name = KBUILD_MODNAME,
        .id_table = device_table,
        .probe = sd_probe,
        .disconnect = gspca_disconnect,
#ifdef CONFIG_PM
        .suspend = gspca_suspend,
        .resume = gspca_resume,
        .reset_resume = gspca_resume,
#endif
};

module_usb_driver(sd_driver);

module_param(force_sensor, int, 0644);
MODULE_PARM_DESC(force_sensor,
        "Force sensor. Only for experts!!!");





















































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 * Device memory TCP support
 *
 * Authors:        Mina Almasry <almasrymina@google.com>
 *                Willem de Bruijn <willemb@google.com>
 *                Kaiyuan Zhang <kaiyuanz@google.com>
 *
 */
#ifndef _NET_DEVMEM_H
#define _NET_DEVMEM_H

struct netlink_ext_ack;

struct net_devmem_dmabuf_binding {
        struct dma_buf *dmabuf;
        struct dma_buf_attachment *attachment;
        struct sg_table *sgt;
        struct net_device *dev;
        struct gen_pool *chunk_pool;

        /* The user holds a ref (via the netlink API) for as long as they want
         * the binding to remain alive. Each page pool using this binding holds
         * a ref to keep the binding alive. Each allocated net_iov holds a
         * ref.
         *
         * The binding undos itself and unmaps the underlying dmabuf once all
         * those refs are dropped and the binding is no longer desired or in
         * use.
         */
        refcount_t ref;

        /* The list of bindings currently active. Used for netlink to notify us
         * of the user dropping the bind.
         */
        struct list_head list;

        /* rxq's this binding is active on. */
        struct xarray bound_rxqs;

        /* ID of this binding. Globally unique to all bindings currently
         * active.
         */
        u32 id;
};

#if defined(CONFIG_NET_DEVMEM)
/* Owner of the dma-buf chunks inserted into the gen pool. Each scatterlist
 * entry from the dmabuf is inserted into the genpool as a chunk, and needs
 * this owner struct to keep track of some metadata necessary to create
 * allocations from this chunk.
 */
struct dmabuf_genpool_chunk_owner {
        /* Offset into the dma-buf where this chunk starts.  */
        unsigned long base_virtual;

        /* dma_addr of the start of the chunk.  */
        dma_addr_t base_dma_addr;

        /* Array of net_iovs for this chunk. */
        struct net_iov *niovs;
        size_t num_niovs;

        struct net_devmem_dmabuf_binding *binding;
};

void __net_devmem_dmabuf_binding_free(struct net_devmem_dmabuf_binding *binding);
struct net_devmem_dmabuf_binding *
net_devmem_bind_dmabuf(struct net_device *dev, unsigned int dmabuf_fd,
                       struct netlink_ext_ack *extack);
void net_devmem_unbind_dmabuf(struct net_devmem_dmabuf_binding *binding);
int net_devmem_bind_dmabuf_to_queue(struct net_device *dev, u32 rxq_idx,
                                    struct net_devmem_dmabuf_binding *binding,
                                    struct netlink_ext_ack *extack);
void dev_dmabuf_uninstall(struct net_device *dev);

static inline struct dmabuf_genpool_chunk_owner *
net_iov_owner(const struct net_iov *niov)
{
        return niov->owner;
}

static inline unsigned int net_iov_idx(const struct net_iov *niov)
{
        return niov - net_iov_owner(niov)->niovs;
}

static inline struct net_devmem_dmabuf_binding *
net_iov_binding(const struct net_iov *niov)
{
        return net_iov_owner(niov)->binding;
}

static inline unsigned long net_iov_virtual_addr(const struct net_iov *niov)
{
        struct dmabuf_genpool_chunk_owner *owner = net_iov_owner(niov);

        return owner->base_virtual +
               ((unsigned long)net_iov_idx(niov) << PAGE_SHIFT);
}

static inline u32 net_iov_binding_id(const struct net_iov *niov)
{
        return net_iov_owner(niov)->binding->id;
}

static inline void
net_devmem_dmabuf_binding_get(struct net_devmem_dmabuf_binding *binding)
{
        refcount_inc(&binding->ref);
}

static inline void
net_devmem_dmabuf_binding_put(struct net_devmem_dmabuf_binding *binding)
{
        if (!refcount_dec_and_test(&binding->ref))
                return;

        __net_devmem_dmabuf_binding_free(binding);
}

struct net_iov *
net_devmem_alloc_dmabuf(struct net_devmem_dmabuf_binding *binding);
void net_devmem_free_dmabuf(struct net_iov *ppiov);

#else
struct net_devmem_dmabuf_binding;

static inline void
__net_devmem_dmabuf_binding_free(struct net_devmem_dmabuf_binding *binding)
{
}

static inline struct net_devmem_dmabuf_binding *
net_devmem_bind_dmabuf(struct net_device *dev, unsigned int dmabuf_fd,
                       struct netlink_ext_ack *extack)
{
        return ERR_PTR(-EOPNOTSUPP);
}

static inline void
net_devmem_unbind_dmabuf(struct net_devmem_dmabuf_binding *binding)
{
}

static inline int
net_devmem_bind_dmabuf_to_queue(struct net_device *dev, u32 rxq_idx,
                                struct net_devmem_dmabuf_binding *binding,
                                struct netlink_ext_ack *extack)

{
        return -EOPNOTSUPP;
}

static inline void dev_dmabuf_uninstall(struct net_device *dev)
{
}

static inline struct net_iov *
net_devmem_alloc_dmabuf(struct net_devmem_dmabuf_binding *binding)
{
        return NULL;
}

static inline void net_devmem_free_dmabuf(struct net_iov *ppiov)
{
}

static inline unsigned long net_iov_virtual_addr(const struct net_iov *niov)
{
        return 0;
}

static inline u32 net_iov_binding_id(const struct net_iov *niov)
{
        return 0;
}
#endif

#endif /* _NET_DEVMEM_H */







































   15 











































   17 


























   10 



   10 






    9 








   17 





  100 














 1666 







 1661 





   38 


















   10 




    9 







    3 


























































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/etherdevice.h>
#include <linux/if_macvlan.h>
#include <linux/if_tap.h>
#include <linux/if_vlan.h>
#include <linux/interrupt.h>
#include <linux/nsproxy.h>
#include <linux/compat.h>
#include <linux/if_tun.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/cache.h>
#include <linux/sched/signal.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/wait.h>
#include <linux/cdev.h>
#include <linux/idr.h>
#include <linux/fs.h>
#include <linux/uio.h>

#include <net/net_namespace.h>
#include <net/rtnetlink.h>
#include <net/sock.h>
#include <linux/virtio_net.h>
#include <linux/skb_array.h>

struct macvtap_dev {
        struct macvlan_dev vlan;
        struct tap_dev    tap;
};

/*
 * Variables for dealing with macvtaps device numbers.
 */
static dev_t macvtap_major;

static const void *macvtap_net_namespace(const struct device *d)
{
        const struct net_device *dev = to_net_dev(d->parent);
        return dev_net(dev);
}

static struct class macvtap_class = {
        .name = "macvtap",
        .ns_type = &net_ns_type_operations,
        .namespace = macvtap_net_namespace,
};
static struct cdev macvtap_cdev;

#define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
                      NETIF_F_TSO6)

static void macvtap_count_tx_dropped(struct tap_dev *tap)
{
        struct macvtap_dev *vlantap = container_of(tap, struct macvtap_dev, tap);
        struct macvlan_dev *vlan = &vlantap->vlan;

        this_cpu_inc(vlan->pcpu_stats->tx_dropped);
}

static void macvtap_count_rx_dropped(struct tap_dev *tap)
{
        struct macvtap_dev *vlantap = container_of(tap, struct macvtap_dev, tap);
        struct macvlan_dev *vlan = &vlantap->vlan;

        macvlan_count_rx(vlan, 0, 0, 0);
}

static void macvtap_update_features(struct tap_dev *tap,
                                    netdev_features_t features)
{
        struct macvtap_dev *vlantap = container_of(tap, struct macvtap_dev, tap);
        struct macvlan_dev *vlan = &vlantap->vlan;

        vlan->set_features = features;
        netdev_update_features(vlan->dev);
}

static int macvtap_newlink(struct net *src_net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[],
                           struct netlink_ext_ack *extack)
{
        struct macvtap_dev *vlantap = netdev_priv(dev);
        int err;

        INIT_LIST_HEAD(&vlantap->tap.queue_list);

        /* Since macvlan supports all offloads by default, make
         * tap support all offloads also.
         */
        vlantap->tap.tap_features = TUN_OFFLOADS;

        /* Register callbacks for rx/tx drops accounting and updating
         * net_device features
         */
        vlantap->tap.count_tx_dropped = macvtap_count_tx_dropped;
        vlantap->tap.count_rx_dropped = macvtap_count_rx_dropped;
        vlantap->tap.update_features  = macvtap_update_features;

        err = netdev_rx_handler_register(dev, tap_handle_frame, &vlantap->tap);
        if (err)
                return err;

        /* Don't put anything that may fail after macvlan_common_newlink
         * because we can't undo what it does.
         */
        err = macvlan_common_newlink(src_net, dev, tb, data, extack);
        if (err) {
                netdev_rx_handler_unregister(dev);
                return err;
        }

        vlantap->tap.dev = vlantap->vlan.dev;

        return 0;
}

static void macvtap_dellink(struct net_device *dev,
                            struct list_head *head)
{
        struct macvtap_dev *vlantap = netdev_priv(dev);

        netdev_rx_handler_unregister(dev);
        tap_del_queues(&vlantap->tap);
        macvlan_dellink(dev, head);
}

static void macvtap_setup(struct net_device *dev)
{
        macvlan_common_setup(dev);
        dev->tx_queue_len = TUN_READQ_SIZE;
}

static struct net *macvtap_link_net(const struct net_device *dev)
{
        return dev_net(macvlan_dev_real_dev(dev));
}

static struct rtnl_link_ops macvtap_link_ops __read_mostly = {
        .kind                = "macvtap",
        .setup                = macvtap_setup,
        .newlink        = macvtap_newlink,
        .dellink        = macvtap_dellink,
        .get_link_net        = macvtap_link_net,
        .priv_size      = sizeof(struct macvtap_dev),
};

static int macvtap_device_event(struct notifier_block *unused,
                                unsigned long event, void *ptr)
{
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct macvtap_dev *vlantap;
        struct device *classdev;
        dev_t devt;
        int err;
        char tap_name[IFNAMSIZ];

        if (dev->rtnl_link_ops != &macvtap_link_ops)
                return NOTIFY_DONE;

        snprintf(tap_name, IFNAMSIZ, "tap%d", dev->ifindex);
        vlantap = netdev_priv(dev);

        switch (event) {
        case NETDEV_REGISTER:
                /* Create the device node here after the network device has
                 * been registered but before register_netdevice has
                 * finished running.
                 */
                err = tap_get_minor(macvtap_major, &vlantap->tap);
                if (err)
                        return notifier_from_errno(err);

                devt = MKDEV(MAJOR(macvtap_major), vlantap->tap.minor);
                classdev = device_create(&macvtap_class, &dev->dev, devt,
                                         dev, "%s", tap_name);
                if (IS_ERR(classdev)) {
                        tap_free_minor(macvtap_major, &vlantap->tap);
                        return notifier_from_errno(PTR_ERR(classdev));
                }
                err = sysfs_create_link(&dev->dev.kobj, &classdev->kobj,
                                        tap_name);
                if (err)
                        return notifier_from_errno(err);
                break;
        case NETDEV_UNREGISTER:
                /* vlan->minor == 0 if NETDEV_REGISTER above failed */
                if (vlantap->tap.minor == 0)
                        break;
                sysfs_remove_link(&dev->dev.kobj, tap_name);
                devt = MKDEV(MAJOR(macvtap_major), vlantap->tap.minor);
                device_destroy(&macvtap_class, devt);
                tap_free_minor(macvtap_major, &vlantap->tap);
                break;
        case NETDEV_CHANGE_TX_QUEUE_LEN:
                if (tap_queue_resize(&vlantap->tap))
                        return NOTIFY_BAD;
                break;
        }

        return NOTIFY_DONE;
}

static struct notifier_block macvtap_notifier_block __read_mostly = {
        .notifier_call        = macvtap_device_event,
};

static int __init macvtap_init(void)
{
        int err;

        err = tap_create_cdev(&macvtap_cdev, &macvtap_major, "macvtap",
                              THIS_MODULE);
        if (err)
                goto out1;

        err = class_register(&macvtap_class);
        if (err)
                goto out2;

        err = register_netdevice_notifier(&macvtap_notifier_block);
        if (err)
                goto out3;

        err = macvlan_link_register(&macvtap_link_ops);
        if (err)
                goto out4;

        return 0;

out4:
        unregister_netdevice_notifier(&macvtap_notifier_block);
out3:
        class_unregister(&macvtap_class);
out2:
        tap_destroy_cdev(macvtap_major, &macvtap_cdev);
out1:
        return err;
}
module_init(macvtap_init);

static void __exit macvtap_exit(void)
{
        rtnl_link_unregister(&macvtap_link_ops);
        unregister_netdevice_notifier(&macvtap_notifier_block);
        class_unregister(&macvtap_class);
        tap_destroy_cdev(macvtap_major, &macvtap_cdev);
}
module_exit(macvtap_exit);

MODULE_ALIAS_RTNL_LINK("macvtap");
MODULE_DESCRIPTION("MAC-VLAN based tap driver");
MODULE_AUTHOR("Arnd Bergmann <arnd@arndb.de>");
MODULE_LICENSE("GPL");































































































































































































































   28 
   28 










1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/types.h>
#include <linux/netfilter.h>
#include <net/tcp.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_extend.h>
#include <net/netfilter/nf_conntrack_seqadj.h>

int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                      s32 off)
{
        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
        struct nf_conn_seqadj *seqadj;
        struct nf_ct_seqadj *this_way;

        if (off == 0)
                return 0;

        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);

        seqadj = nfct_seqadj(ct);
        this_way = &seqadj->seq[dir];
        this_way->offset_before         = off;
        this_way->offset_after         = off;
        return 0;
}
EXPORT_SYMBOL_GPL(nf_ct_seqadj_init);

int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                     __be32 seq, s32 off)
{
        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
        struct nf_ct_seqadj *this_way;

        if (off == 0)
                return 0;

        if (unlikely(!seqadj)) {
                WARN_ONCE(1, "Missing nfct_seqadj_ext_add() setup call\n");
                return 0;
        }

        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);

        spin_lock_bh(&ct->lock);
        this_way = &seqadj->seq[dir];
        if (this_way->offset_before == this_way->offset_after ||
            before(this_way->correction_pos, ntohl(seq))) {
                this_way->correction_pos = ntohl(seq);
                this_way->offset_before         = this_way->offset_after;
                this_way->offset_after        += off;
        }
        spin_unlock_bh(&ct->lock);
        return 0;
}
EXPORT_SYMBOL_GPL(nf_ct_seqadj_set);

void nf_ct_tcp_seqadj_set(struct sk_buff *skb,
                          struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                          s32 off)
{
        const struct tcphdr *th;

        if (nf_ct_protonum(ct) != IPPROTO_TCP)
                return;

        th = (struct tcphdr *)(skb_network_header(skb) + ip_hdrlen(skb));
        nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
}
EXPORT_SYMBOL_GPL(nf_ct_tcp_seqadj_set);

/* Adjust one found SACK option including checksum correction */
static void nf_ct_sack_block_adjust(struct sk_buff *skb,
                                    struct tcphdr *tcph,
                                    unsigned int sackoff,
                                    unsigned int sackend,
                                    struct nf_ct_seqadj *seq)
{
        while (sackoff < sackend) {
                struct tcp_sack_block_wire *sack;
                __be32 new_start_seq, new_end_seq;

                sack = (void *)skb->data + sackoff;
                if (after(ntohl(sack->start_seq) - seq->offset_before,
                          seq->correction_pos))
                        new_start_seq = htonl(ntohl(sack->start_seq) -
                                        seq->offset_after);
                else
                        new_start_seq = htonl(ntohl(sack->start_seq) -
                                        seq->offset_before);

                if (after(ntohl(sack->end_seq) - seq->offset_before,
                          seq->correction_pos))
                        new_end_seq = htonl(ntohl(sack->end_seq) -
                                      seq->offset_after);
                else
                        new_end_seq = htonl(ntohl(sack->end_seq) -
                                      seq->offset_before);

                pr_debug("sack_adjust: start_seq: %u->%u, end_seq: %u->%u\n",
                         ntohl(sack->start_seq), ntohl(new_start_seq),
                         ntohl(sack->end_seq), ntohl(new_end_seq));

                inet_proto_csum_replace4(&tcph->check, skb,
                                         sack->start_seq, new_start_seq, false);
                inet_proto_csum_replace4(&tcph->check, skb,
                                         sack->end_seq, new_end_seq, false);
                sack->start_seq = new_start_seq;
                sack->end_seq = new_end_seq;
                sackoff += sizeof(*sack);
        }
}

/* TCP SACK sequence number adjustment */
static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
                                      unsigned int protoff,
                                      struct nf_conn *ct,
                                      enum ip_conntrack_info ctinfo)
{
        struct tcphdr *tcph = (void *)skb->data + protoff;
        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
        unsigned int dir, optoff, optend;

        optoff = protoff + sizeof(struct tcphdr);
        optend = protoff + tcph->doff * 4;

        if (skb_ensure_writable(skb, optend))
                return 0;

        tcph = (void *)skb->data + protoff;
        dir = CTINFO2DIR(ctinfo);

        while (optoff < optend) {
                /* Usually: option, length. */
                unsigned char *op = skb->data + optoff;

                switch (op[0]) {
                case TCPOPT_EOL:
                        return 1;
                case TCPOPT_NOP:
                        optoff++;
                        continue;
                default:
                        /* no partial options */
                        if (optoff + 1 == optend ||
                            optoff + op[1] > optend ||
                            op[1] < 2)
                                return 0;
                        if (op[0] == TCPOPT_SACK &&
                            op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
                            ((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
                                nf_ct_sack_block_adjust(skb, tcph, optoff + 2,
                                                        optoff+op[1],
                                                        &seqadj->seq[!dir]);
                        optoff += op[1];
                }
        }
        return 1;
}

/* TCP sequence number adjustment.  Returns 1 on success, 0 on failure */
int nf_ct_seq_adjust(struct sk_buff *skb,
                     struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                     unsigned int protoff)
{
        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
        struct tcphdr *tcph;
        __be32 newseq, newack;
        s32 seqoff, ackoff;
        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
        struct nf_ct_seqadj *this_way, *other_way;
        int res = 1;

        this_way  = &seqadj->seq[dir];
        other_way = &seqadj->seq[!dir];

        if (skb_ensure_writable(skb, protoff + sizeof(*tcph)))
                return 0;

        tcph = (void *)skb->data + protoff;
        spin_lock_bh(&ct->lock);
        if (after(ntohl(tcph->seq), this_way->correction_pos))
                seqoff = this_way->offset_after;
        else
                seqoff = this_way->offset_before;

        newseq = htonl(ntohl(tcph->seq) + seqoff);
        inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, false);
        pr_debug("Adjusting sequence number from %u->%u\n",
                 ntohl(tcph->seq), ntohl(newseq));
        tcph->seq = newseq;

        if (!tcph->ack)
                goto out;

        if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
                  other_way->correction_pos))
                ackoff = other_way->offset_after;
        else
                ackoff = other_way->offset_before;

        newack = htonl(ntohl(tcph->ack_seq) - ackoff);
        inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack,
                                 false);
        pr_debug("Adjusting ack number from %u->%u, ack from %u->%u\n",
                 ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
                 ntohl(newack));
        tcph->ack_seq = newack;

        res = nf_ct_sack_adjust(skb, protoff, ct, ctinfo);
out:
        spin_unlock_bh(&ct->lock);

        return res;
}
EXPORT_SYMBOL_GPL(nf_ct_seq_adjust);

s32 nf_ct_seq_offset(const struct nf_conn *ct,
                     enum ip_conntrack_dir dir,
                     u32 seq)
{
        struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
        struct nf_ct_seqadj *this_way;

        if (!seqadj)
                return 0;

        this_way = &seqadj->seq[dir];
        return after(seq, this_way->correction_pos) ?
                 this_way->offset_after : this_way->offset_before;
}
EXPORT_SYMBOL_GPL(nf_ct_seq_offset);






























































    2 



























    1 


    1 











    2 


    2 
    2 
















    2 
    2 












    2 
    1 









    2 











































    1 





    1 
























    2 



    2 
    2 

    2 







    2 



    2 


    1 















    3 


    2 










































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
// SPDX-License-Identifier: GPL-2.0-only
/*
 * TCP Westwood+: end-to-end bandwidth estimation for TCP
 *
 *      Angelo Dell'Aera: author of the first version of TCP Westwood+ in Linux 2.4
 *
 * Support at http://c3lab.poliba.it/index.php/Westwood
 * Main references in literature:
 *
 * - Mascolo S, Casetti, M. Gerla et al.
 *   "TCP Westwood: bandwidth estimation for TCP" Proc. ACM Mobicom 2001
 *
 * - A. Grieco, s. Mascolo
 *   "Performance evaluation of New Reno, Vegas, Westwood+ TCP" ACM Computer
 *     Comm. Review, 2004
 *
 * - A. Dell'Aera, L. Grieco, S. Mascolo.
 *   "Linux 2.4 Implementation of Westwood+ TCP with Rate-Halving :
 *    A Performance Evaluation Over the Internet" (ICC 2004), Paris, June 2004
 *
 * Westwood+ employs end-to-end bandwidth measurement to set cwnd and
 * ssthresh after packet loss. The probing phase is as the original Reno.
 */

#include <linux/mm.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/inet_diag.h>
#include <net/tcp.h>

/* TCP Westwood structure */
struct westwood {
        u32    bw_ns_est;        /* first bandwidth estimation..not too smoothed 8) */
        u32    bw_est;           /* bandwidth estimate */
        u32    rtt_win_sx;       /* here starts a new evaluation... */
        u32    bk;
        u32    snd_una;          /* used for evaluating the number of acked bytes */
        u32    cumul_ack;
        u32    accounted;
        u32    rtt;
        u32    rtt_min;          /* minimum observed RTT */
        u8     first_ack;        /* flag which infers that this is the first ack */
        u8     reset_rtt_min;    /* Reset RTT min to next RTT sample*/
};

/* TCP Westwood functions and constants */
#define TCP_WESTWOOD_RTT_MIN   (HZ/20)        /* 50ms */
#define TCP_WESTWOOD_INIT_RTT  (20*HZ)        /* maybe too conservative?! */

/*
 * @tcp_westwood_create
 * This function initializes fields used in TCP Westwood+,
 * it is called after the initial SYN, so the sequence numbers
 * are correct but new passive connections we have no
 * information about RTTmin at this time so we simply set it to
 * TCP_WESTWOOD_INIT_RTT. This value was chosen to be too conservative
 * since in this way we're sure it will be updated in a consistent
 * way as soon as possible. It will reasonably happen within the first
 * RTT period of the connection lifetime.
 */
static void tcp_westwood_init(struct sock *sk)
{
        struct westwood *w = inet_csk_ca(sk);

        w->bk = 0;
        w->bw_ns_est = 0;
        w->bw_est = 0;
        w->accounted = 0;
        w->cumul_ack = 0;
        w->reset_rtt_min = 1;
        w->rtt_min = w->rtt = TCP_WESTWOOD_INIT_RTT;
        w->rtt_win_sx = tcp_jiffies32;
        w->snd_una = tcp_sk(sk)->snd_una;
        w->first_ack = 1;
}

/*
 * @westwood_do_filter
 * Low-pass filter. Implemented using constant coefficients.
 */
static inline u32 westwood_do_filter(u32 a, u32 b)
{
        return ((7 * a) + b) >> 3;
}

static void westwood_filter(struct westwood *w, u32 delta)
{
        /* If the filter is empty fill it with the first sample of bandwidth  */
        if (w->bw_ns_est == 0 && w->bw_est == 0) {
                w->bw_ns_est = w->bk / delta;
                w->bw_est = w->bw_ns_est;
        } else {
                w->bw_ns_est = westwood_do_filter(w->bw_ns_est, w->bk / delta);
                w->bw_est = westwood_do_filter(w->bw_est, w->bw_ns_est);
        }
}

/*
 * @westwood_pkts_acked
 * Called after processing group of packets.
 * but all westwood needs is the last sample of srtt.
 */
static void tcp_westwood_pkts_acked(struct sock *sk,
                                    const struct ack_sample *sample)
{
        struct westwood *w = inet_csk_ca(sk);

        if (sample->rtt_us > 0)
                w->rtt = usecs_to_jiffies(sample->rtt_us);
}

/*
 * @westwood_update_window
 * It updates RTT evaluation window if it is the right moment to do
 * it. If so it calls filter for evaluating bandwidth.
 */
static void westwood_update_window(struct sock *sk)
{
        struct westwood *w = inet_csk_ca(sk);
        s32 delta = tcp_jiffies32 - w->rtt_win_sx;

        /* Initialize w->snd_una with the first acked sequence number in order
         * to fix mismatch between tp->snd_una and w->snd_una for the first
         * bandwidth sample
         */
        if (w->first_ack) {
                w->snd_una = tcp_sk(sk)->snd_una;
                w->first_ack = 0;
        }

        /*
         * See if a RTT-window has passed.
         * Be careful since if RTT is less than
         * 50ms we don't filter but we continue 'building the sample'.
         * This minimum limit was chosen since an estimation on small
         * time intervals is better to avoid...
         * Obviously on a LAN we reasonably will always have
         * right_bound = left_bound + WESTWOOD_RTT_MIN
         */
        if (w->rtt && delta > max_t(u32, w->rtt, TCP_WESTWOOD_RTT_MIN)) {
                westwood_filter(w, delta);

                w->bk = 0;
                w->rtt_win_sx = tcp_jiffies32;
        }
}

static inline void update_rtt_min(struct westwood *w)
{
        if (w->reset_rtt_min) {
                w->rtt_min = w->rtt;
                w->reset_rtt_min = 0;
        } else
                w->rtt_min = min(w->rtt, w->rtt_min);
}

/*
 * @westwood_fast_bw
 * It is called when we are in fast path. In particular it is called when
 * header prediction is successful. In such case in fact update is
 * straight forward and doesn't need any particular care.
 */
static inline void westwood_fast_bw(struct sock *sk)
{
        const struct tcp_sock *tp = tcp_sk(sk);
        struct westwood *w = inet_csk_ca(sk);

        westwood_update_window(sk);

        w->bk += tp->snd_una - w->snd_una;
        w->snd_una = tp->snd_una;
        update_rtt_min(w);
}

/*
 * @westwood_acked_count
 * This function evaluates cumul_ack for evaluating bk in case of
 * delayed or partial acks.
 */
static inline u32 westwood_acked_count(struct sock *sk)
{
        const struct tcp_sock *tp = tcp_sk(sk);
        struct westwood *w = inet_csk_ca(sk);

        w->cumul_ack = tp->snd_una - w->snd_una;

        /* If cumul_ack is 0 this is a dupack since it's not moving
         * tp->snd_una.
         */
        if (!w->cumul_ack) {
                w->accounted += tp->mss_cache;
                w->cumul_ack = tp->mss_cache;
        }

        if (w->cumul_ack > tp->mss_cache) {
                /* Partial or delayed ack */
                if (w->accounted >= w->cumul_ack) {
                        w->accounted -= w->cumul_ack;
                        w->cumul_ack = tp->mss_cache;
                } else {
                        w->cumul_ack -= w->accounted;
                        w->accounted = 0;
                }
        }

        w->snd_una = tp->snd_una;

        return w->cumul_ack;
}

/*
 * TCP Westwood
 * Here limit is evaluated as Bw estimation*RTTmin (for obtaining it
 * in packets we use mss_cache). Rttmin is guaranteed to be >= 2
 * so avoids ever returning 0.
 */
static u32 tcp_westwood_bw_rttmin(const struct sock *sk)
{
        const struct tcp_sock *tp = tcp_sk(sk);
        const struct westwood *w = inet_csk_ca(sk);

        return max_t(u32, (w->bw_est * w->rtt_min) / tp->mss_cache, 2);
}

static void tcp_westwood_ack(struct sock *sk, u32 ack_flags)
{
        if (ack_flags & CA_ACK_SLOWPATH) {
                struct westwood *w = inet_csk_ca(sk);

                westwood_update_window(sk);
                w->bk += westwood_acked_count(sk);

                update_rtt_min(w);
                return;
        }

        westwood_fast_bw(sk);
}

static void tcp_westwood_event(struct sock *sk, enum tcp_ca_event event)
{
        struct tcp_sock *tp = tcp_sk(sk);
        struct westwood *w = inet_csk_ca(sk);

        switch (event) {
        case CA_EVENT_COMPLETE_CWR:
                tp->snd_ssthresh = tcp_westwood_bw_rttmin(sk);
                tcp_snd_cwnd_set(tp, tp->snd_ssthresh);
                break;
        case CA_EVENT_LOSS:
                tp->snd_ssthresh = tcp_westwood_bw_rttmin(sk);
                /* Update RTT_min when next ack arrives */
                w->reset_rtt_min = 1;
                break;
        default:
                /* don't care */
                break;
        }
}

/* Extract info for Tcp socket info provided via netlink. */
static size_t tcp_westwood_info(struct sock *sk, u32 ext, int *attr,
                                union tcp_cc_info *info)
{
        const struct westwood *ca = inet_csk_ca(sk);

        if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
                info->vegas.tcpv_enabled = 1;
                info->vegas.tcpv_rttcnt        = 0;
                info->vegas.tcpv_rtt        = jiffies_to_usecs(ca->rtt);
                info->vegas.tcpv_minrtt        = jiffies_to_usecs(ca->rtt_min);

                *attr = INET_DIAG_VEGASINFO;
                return sizeof(struct tcpvegas_info);
        }
        return 0;
}

static struct tcp_congestion_ops tcp_westwood __read_mostly = {
        .init                = tcp_westwood_init,
        .ssthresh        = tcp_reno_ssthresh,
        .cong_avoid        = tcp_reno_cong_avoid,
        .undo_cwnd      = tcp_reno_undo_cwnd,
        .cwnd_event        = tcp_westwood_event,
        .in_ack_event        = tcp_westwood_ack,
        .get_info        = tcp_westwood_info,
        .pkts_acked        = tcp_westwood_pkts_acked,

        .owner                = THIS_MODULE,
        .name                = "westwood"
};

static int __init tcp_westwood_register(void)
{
        BUILD_BUG_ON(sizeof(struct westwood) > ICSK_CA_PRIV_SIZE);
        return tcp_register_congestion_control(&tcp_westwood);
}

static void __exit tcp_westwood_unregister(void)
{
        tcp_unregister_congestion_control(&tcp_westwood);
}

module_init(tcp_westwood_register);
module_exit(tcp_westwood_unregister);

MODULE_AUTHOR("Stephen Hemminger, Angelo Dell'Aera");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("TCP Westwood+");













































































































































   23 






   23 








    4 





































    4 



















    3 






    2 









    3 
















    2 










    1 










    5 





   20 
   20 























    2 
    2 











   12 



   20 







    2 
    2 





    2 


    2 
    2 





    1 
    1 





    1 
    1 


































    1 















































    1 









































































































































































































































    2 










    2 

    2 


    2 








    2 









    2 

























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * PPP synchronous tty channel driver for Linux.
 *
 * This is a ppp channel driver that can be used with tty device drivers
 * that are frame oriented, such as synchronous HDLC devices.
 *
 * Complete PPP frames without encoding/decoding are exchanged between
 * the channel driver and the device driver.
 *
 * The async map IOCTL codes are implemented to keep the user mode
 * applications happy if they call them. Synchronous PPP does not use
 * the async maps.
 *
 * Copyright 1999 Paul Mackerras.
 *
 * Also touched by the grubby hands of Paul Fulghum paulkf@microgate.com
 *
 * This driver provides the encapsulation and framing for sending
 * and receiving PPP frames over sync serial lines.  It relies on
 * the generic PPP layer to give it frames to send and to process
 * received frames.  It implements the PPP line discipline.
 *
 * Part of the code in this driver was inspired by the old async-only
 * PPP driver, written by Michael Callahan and Al Longyear, and
 * subsequently hacked by Paul Mackerras.
 *
 * ==FILEVERSION 20040616==
 */

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/tty.h>
#include <linux/netdevice.h>
#include <linux/poll.h>
#include <linux/ppp_defs.h>
#include <linux/ppp-ioctl.h>
#include <linux/ppp_channel.h>
#include <linux/spinlock.h>
#include <linux/completion.h>
#include <linux/init.h>
#include <linux/interrupt.h>
#include <linux/slab.h>
#include <linux/refcount.h>
#include <linux/unaligned.h>
#include <linux/uaccess.h>

#define PPP_VERSION        "2.4.2"

/* Structure for storing local state. */
struct syncppp {
        struct tty_struct *tty;
        unsigned int        flags;
        unsigned int        rbits;
        int                mru;
        spinlock_t        xmit_lock;
        spinlock_t        recv_lock;
        unsigned long        xmit_flags;
        u32                xaccm[8];
        u32                raccm;
        unsigned int        bytes_sent;
        unsigned int        bytes_rcvd;

        struct sk_buff        *tpkt;
        unsigned long        last_xmit;

        struct sk_buff_head rqueue;

        struct tasklet_struct tsk;

        refcount_t        refcnt;
        struct completion dead_cmp;
        struct ppp_channel chan;        /* interface to generic ppp layer */
};

/* Bit numbers in xmit_flags */
#define XMIT_WAKEUP        0
#define XMIT_FULL        1

/* Bits in rbits */
#define SC_RCV_BITS        (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP)

#define PPPSYNC_MAX_RQLEN        32        /* arbitrary */

/*
 * Prototypes.
 */
static struct sk_buff* ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *);
static int ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb);
static int ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd,
                          unsigned long arg);
static void ppp_sync_process(struct tasklet_struct *t);
static int ppp_sync_push(struct syncppp *ap);
static void ppp_sync_flush_output(struct syncppp *ap);
static void ppp_sync_input(struct syncppp *ap, const u8 *buf, const u8 *flags,
                           int count);

static const struct ppp_channel_ops sync_ops = {
        .start_xmit = ppp_sync_send,
        .ioctl      = ppp_sync_ioctl,
};

/*
 * Utility procedure to print a buffer in hex/ascii
 */
static void
ppp_print_buffer (const char *name, const __u8 *buf, int count)
{
        if (name != NULL)
                printk(KERN_DEBUG "ppp_synctty: %s, count = %d\n", name, count);

        print_hex_dump_bytes("", DUMP_PREFIX_NONE, buf, count);
}


/*
 * Routines implementing the synchronous PPP line discipline.
 */

/*
 * We have a potential race on dereferencing tty->disc_data,
 * because the tty layer provides no locking at all - thus one
 * cpu could be running ppp_synctty_receive while another
 * calls ppp_synctty_close, which zeroes tty->disc_data and
 * frees the memory that ppp_synctty_receive is using.  The best
 * way to fix this is to use a rwlock in the tty struct, but for now
 * we use a single global rwlock for all ttys in ppp line discipline.
 *
 * FIXME: Fixed in tty_io nowadays.
 */
static DEFINE_RWLOCK(disc_data_lock);

static struct syncppp *sp_get(struct tty_struct *tty)
{
        struct syncppp *ap;

        read_lock(&disc_data_lock);
        ap = tty->disc_data;
        if (ap != NULL)
                refcount_inc(&ap->refcnt);
        read_unlock(&disc_data_lock);
        return ap;
}

static void sp_put(struct syncppp *ap)
{
        if (refcount_dec_and_test(&ap->refcnt))
                complete(&ap->dead_cmp);
}

/*
 * Called when a tty is put into sync-PPP line discipline.
 */
static int
ppp_sync_open(struct tty_struct *tty)
{
        struct syncppp *ap;
        int err;
        int speed;

        if (tty->ops->write == NULL)
                return -EOPNOTSUPP;

        ap = kzalloc(sizeof(*ap), GFP_KERNEL);
        err = -ENOMEM;
        if (!ap)
                goto out;

        /* initialize the syncppp structure */
        ap->tty = tty;
        ap->mru = PPP_MRU;
        spin_lock_init(&ap->xmit_lock);
        spin_lock_init(&ap->recv_lock);
        ap->xaccm[0] = ~0U;
        ap->xaccm[3] = 0x60000000U;
        ap->raccm = ~0U;

        skb_queue_head_init(&ap->rqueue);
        tasklet_setup(&ap->tsk, ppp_sync_process);

        refcount_set(&ap->refcnt, 1);
        init_completion(&ap->dead_cmp);

        ap->chan.private = ap;
        ap->chan.ops = &sync_ops;
        ap->chan.mtu = PPP_MRU;
        ap->chan.hdrlen = 2;        /* for A/C bytes */
        speed = tty_get_baud_rate(tty);
        ap->chan.speed = speed;
        err = ppp_register_channel(&ap->chan);
        if (err)
                goto out_free;

        tty->disc_data = ap;
        tty->receive_room = 65536;
        return 0;

 out_free:
        kfree(ap);
 out:
        return err;
}

/*
 * Called when the tty is put into another line discipline
 * or it hangs up.  We have to wait for any cpu currently
 * executing in any of the other ppp_synctty_* routines to
 * finish before we can call ppp_unregister_channel and free
 * the syncppp struct.  This routine must be called from
 * process context, not interrupt or softirq context.
 */
static void
ppp_sync_close(struct tty_struct *tty)
{
        struct syncppp *ap;

        write_lock_irq(&disc_data_lock);
        ap = tty->disc_data;
        tty->disc_data = NULL;
        write_unlock_irq(&disc_data_lock);
        if (!ap)
                return;

        /*
         * We have now ensured that nobody can start using ap from now
         * on, but we have to wait for all existing users to finish.
         * Note that ppp_unregister_channel ensures that no calls to
         * our channel ops (i.e. ppp_sync_send/ioctl) are in progress
         * by the time it returns.
         */
        if (!refcount_dec_and_test(&ap->refcnt))
                wait_for_completion(&ap->dead_cmp);
        tasklet_kill(&ap->tsk);

        ppp_unregister_channel(&ap->chan);
        skb_queue_purge(&ap->rqueue);
        kfree_skb(ap->tpkt);
        kfree(ap);
}

/*
 * Called on tty hangup in process context.
 *
 * Wait for I/O to driver to complete and unregister PPP channel.
 * This is already done by the close routine, so just call that.
 */
static void ppp_sync_hangup(struct tty_struct *tty)
{
        ppp_sync_close(tty);
}

/*
 * Read does nothing - no data is ever available this way.
 * Pppd reads and writes packets via /dev/ppp instead.
 */
static ssize_t
ppp_sync_read(struct tty_struct *tty, struct file *file, u8 *buf, size_t count,
              void **cookie, unsigned long offset)
{
        return -EAGAIN;
}

/*
 * Write on the tty does nothing, the packets all come in
 * from the ppp generic stuff.
 */
static ssize_t
ppp_sync_write(struct tty_struct *tty, struct file *file, const u8 *buf,
               size_t count)
{
        return -EAGAIN;
}

static int
ppp_synctty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
{
        struct syncppp *ap = sp_get(tty);
        int __user *p = (int __user *)arg;
        int err, val;

        if (!ap)
                return -ENXIO;
        err = -EFAULT;
        switch (cmd) {
        case PPPIOCGCHAN:
                err = -EFAULT;
                if (put_user(ppp_channel_index(&ap->chan), p))
                        break;
                err = 0;
                break;

        case PPPIOCGUNIT:
                err = -EFAULT;
                if (put_user(ppp_unit_number(&ap->chan), p))
                        break;
                err = 0;
                break;

        case TCFLSH:
                /* flush our buffers and the serial port's buffer */
                if (arg == TCIOFLUSH || arg == TCOFLUSH)
                        ppp_sync_flush_output(ap);
                err = n_tty_ioctl_helper(tty, cmd, arg);
                break;

        case FIONREAD:
                val = 0;
                if (put_user(val, p))
                        break;
                err = 0;
                break;

        default:
                err = tty_mode_ioctl(tty, cmd, arg);
                break;
        }

        sp_put(ap);
        return err;
}

/* May sleep, don't call from interrupt level or with interrupts disabled */
static void
ppp_sync_receive(struct tty_struct *tty, const u8 *buf, const u8 *cflags,
                 size_t count)
{
        struct syncppp *ap = sp_get(tty);
        unsigned long flags;

        if (!ap)
                return;
        spin_lock_irqsave(&ap->recv_lock, flags);
        ppp_sync_input(ap, buf, cflags, count);
        spin_unlock_irqrestore(&ap->recv_lock, flags);
        if (!skb_queue_empty(&ap->rqueue))
                tasklet_schedule(&ap->tsk);
        sp_put(ap);
        tty_unthrottle(tty);
}

static void
ppp_sync_wakeup(struct tty_struct *tty)
{
        struct syncppp *ap = sp_get(tty);

        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
        if (!ap)
                return;
        set_bit(XMIT_WAKEUP, &ap->xmit_flags);
        tasklet_schedule(&ap->tsk);
        sp_put(ap);
}


static struct tty_ldisc_ops ppp_sync_ldisc = {
        .owner        = THIS_MODULE,
        .num        = N_SYNC_PPP,
        .name        = "pppsync",
        .open        = ppp_sync_open,
        .close        = ppp_sync_close,
        .hangup        = ppp_sync_hangup,
        .read        = ppp_sync_read,
        .write        = ppp_sync_write,
        .ioctl        = ppp_synctty_ioctl,
        .receive_buf = ppp_sync_receive,
        .write_wakeup = ppp_sync_wakeup,
};

static int __init
ppp_sync_init(void)
{
        int err;

        err = tty_register_ldisc(&ppp_sync_ldisc);
        if (err != 0)
                printk(KERN_ERR "PPP_sync: error %d registering line disc.\n",
                       err);
        return err;
}

/*
 * The following routines provide the PPP channel interface.
 */
static int
ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
{
        struct syncppp *ap = chan->private;
        int err, val;
        u32 accm[8];
        void __user *argp = (void __user *)arg;
        u32 __user *p = argp;

        err = -EFAULT;
        switch (cmd) {
        case PPPIOCGFLAGS:
                val = ap->flags | ap->rbits;
                if (put_user(val, (int __user *) argp))
                        break;
                err = 0;
                break;
        case PPPIOCSFLAGS:
                if (get_user(val, (int __user *) argp))
                        break;
                ap->flags = val & ~SC_RCV_BITS;
                spin_lock_irq(&ap->recv_lock);
                ap->rbits = val & SC_RCV_BITS;
                spin_unlock_irq(&ap->recv_lock);
                err = 0;
                break;

        case PPPIOCGASYNCMAP:
                if (put_user(ap->xaccm[0], p))
                        break;
                err = 0;
                break;
        case PPPIOCSASYNCMAP:
                if (get_user(ap->xaccm[0], p))
                        break;
                err = 0;
                break;

        case PPPIOCGRASYNCMAP:
                if (put_user(ap->raccm, p))
                        break;
                err = 0;
                break;
        case PPPIOCSRASYNCMAP:
                if (get_user(ap->raccm, p))
                        break;
                err = 0;
                break;

        case PPPIOCGXASYNCMAP:
                if (copy_to_user(argp, ap->xaccm, sizeof(ap->xaccm)))
                        break;
                err = 0;
                break;
        case PPPIOCSXASYNCMAP:
                if (copy_from_user(accm, argp, sizeof(accm)))
                        break;
                accm[2] &= ~0x40000000U;        /* can't escape 0x5e */
                accm[3] |= 0x60000000U;                /* must escape 0x7d, 0x7e */
                memcpy(ap->xaccm, accm, sizeof(ap->xaccm));
                err = 0;
                break;

        case PPPIOCGMRU:
                if (put_user(ap->mru, (int __user *) argp))
                        break;
                err = 0;
                break;
        case PPPIOCSMRU:
                if (get_user(val, (int __user *) argp))
                        break;
                if (val > U16_MAX) {
                        err = -EINVAL;
                        break;
                }
                if (val < PPP_MRU)
                        val = PPP_MRU;
                ap->mru = val;
                err = 0;
                break;

        default:
                err = -ENOTTY;
        }
        return err;
}

/*
 * This is called at softirq level to deliver received packets
 * to the ppp_generic code, and to tell the ppp_generic code
 * if we can accept more output now.
 */
static void ppp_sync_process(struct tasklet_struct *t)
{
        struct syncppp *ap = from_tasklet(ap, t, tsk);
        struct sk_buff *skb;

        /* process received packets */
        while ((skb = skb_dequeue(&ap->rqueue)) != NULL) {
                if (skb->len == 0) {
                        /* zero length buffers indicate error */
                        ppp_input_error(&ap->chan, 0);
                        kfree_skb(skb);
                }
                else
                        ppp_input(&ap->chan, skb);
        }

        /* try to push more stuff out */
        if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_sync_push(ap))
                ppp_output_wakeup(&ap->chan);
}

/*
 * Procedures for encapsulation and framing.
 */

static struct sk_buff*
ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
{
        int proto;
        unsigned char *data;
        int islcp;

        data  = skb->data;
        proto = get_unaligned_be16(data);

        /* LCP packets with codes between 1 (configure-request)
         * and 7 (code-reject) must be sent as though no options
         * have been negotiated.
         */
        islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7;

        /* compress protocol field if option enabled */
        if (data[0] == 0 && (ap->flags & SC_COMP_PROT) && !islcp)
                skb_pull(skb,1);

        /* prepend address/control fields if necessary */
        if ((ap->flags & SC_COMP_AC) == 0 || islcp) {
                if (skb_headroom(skb) < 2) {
                        struct sk_buff *npkt = dev_alloc_skb(skb->len + 2);
                        if (npkt == NULL) {
                                kfree_skb(skb);
                                return NULL;
                        }
                        skb_reserve(npkt,2);
                        skb_copy_from_linear_data(skb,
                                      skb_put(npkt, skb->len), skb->len);
                        consume_skb(skb);
                        skb = npkt;
                }
                skb_push(skb,2);
                skb->data[0] = PPP_ALLSTATIONS;
                skb->data[1] = PPP_UI;
        }

        ap->last_xmit = jiffies;

        if (skb && ap->flags & SC_LOG_OUTPKT)
                ppp_print_buffer ("send buffer", skb->data, skb->len);

        return skb;
}

/*
 * Transmit-side routines.
 */

/*
 * Send a packet to the peer over an sync tty line.
 * Returns 1 iff the packet was accepted.
 * If the packet was not accepted, we will call ppp_output_wakeup
 * at some later time.
 */
static int
ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb)
{
        struct syncppp *ap = chan->private;

        ppp_sync_push(ap);

        if (test_and_set_bit(XMIT_FULL, &ap->xmit_flags))
                return 0;        /* already full */
        skb = ppp_sync_txmunge(ap, skb);
        if (skb != NULL)
                ap->tpkt = skb;
        else
                clear_bit(XMIT_FULL, &ap->xmit_flags);

        ppp_sync_push(ap);
        return 1;
}

/*
 * Push as much data as possible out to the tty.
 */
static int
ppp_sync_push(struct syncppp *ap)
{
        int sent, done = 0;
        struct tty_struct *tty = ap->tty;
        int tty_stuffed = 0;

        if (!spin_trylock_bh(&ap->xmit_lock))
                return 0;
        for (;;) {
                if (test_and_clear_bit(XMIT_WAKEUP, &ap->xmit_flags))
                        tty_stuffed = 0;
                if (!tty_stuffed && ap->tpkt) {
                        set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
                        sent = tty->ops->write(tty, ap->tpkt->data, ap->tpkt->len);
                        if (sent < 0)
                                goto flush;        /* error, e.g. loss of CD */
                        if (sent < ap->tpkt->len) {
                                tty_stuffed = 1;
                        } else {
                                consume_skb(ap->tpkt);
                                ap->tpkt = NULL;
                                clear_bit(XMIT_FULL, &ap->xmit_flags);
                                done = 1;
                        }
                        continue;
                }
                /* haven't made any progress */
                spin_unlock_bh(&ap->xmit_lock);
                if (!(test_bit(XMIT_WAKEUP, &ap->xmit_flags) ||
                      (!tty_stuffed && ap->tpkt)))
                        break;
                if (!spin_trylock_bh(&ap->xmit_lock))
                        break;
        }
        return done;

flush:
        if (ap->tpkt) {
                kfree_skb(ap->tpkt);
                ap->tpkt = NULL;
                clear_bit(XMIT_FULL, &ap->xmit_flags);
                done = 1;
        }
        spin_unlock_bh(&ap->xmit_lock);
        return done;
}

/*
 * Flush output from our internal buffers.
 * Called for the TCFLSH ioctl.
 */
static void
ppp_sync_flush_output(struct syncppp *ap)
{
        int done = 0;

        spin_lock_bh(&ap->xmit_lock);
        if (ap->tpkt != NULL) {
                kfree_skb(ap->tpkt);
                ap->tpkt = NULL;
                clear_bit(XMIT_FULL, &ap->xmit_flags);
                done = 1;
        }
        spin_unlock_bh(&ap->xmit_lock);
        if (done)
                ppp_output_wakeup(&ap->chan);
}

/*
 * Receive-side routines.
 */

/* called when the tty driver has data for us.
 *
 * Data is frame oriented: each call to ppp_sync_input is considered
 * a whole frame. If the 1st flag byte is non-zero then the whole
 * frame is considered to be in error and is tossed.
 */
static void
ppp_sync_input(struct syncppp *ap, const u8 *buf, const u8 *flags, int count)
{
        struct sk_buff *skb;
        unsigned char *p;

        if (count == 0)
                return;

        if (ap->flags & SC_LOG_INPKT)
                ppp_print_buffer ("receive buffer", buf, count);

        /* stuff the chars in the skb */
        skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2);
        if (!skb) {
                printk(KERN_ERR "PPPsync: no memory (input pkt)\n");
                goto err;
        }
        /* Try to get the payload 4-byte aligned */
        if (buf[0] != PPP_ALLSTATIONS)
                skb_reserve(skb, 2 + (buf[0] & 1));

        if (flags && *flags) {
                /* error flag set, ignore frame */
                goto err;
        } else if (count > skb_tailroom(skb)) {
                /* packet overflowed MRU */
                goto err;
        }

        skb_put_data(skb, buf, count);

        /* strip address/control field if present */
        p = skb->data;
        if (skb->len >= 2 && p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) {
                /* chop off address/control */
                if (skb->len < 3)
                        goto err;
                p = skb_pull(skb, 2);
        }

        /* PPP packet length should be >= 2 bytes when protocol field is not
         * compressed.
         */
        if (!(p[0] & 0x01) && skb->len < 2)
                goto err;

        /* queue the frame to be processed */
        skb_queue_tail(&ap->rqueue, skb);
        return;

err:
        /* queue zero length packet as error indication */
        if (skb || (skb = dev_alloc_skb(0))) {
                skb_trim(skb, 0);
                skb_queue_tail(&ap->rqueue, skb);
        }
}

static void __exit
ppp_sync_cleanup(void)
{
        tty_unregister_ldisc(&ppp_sync_ldisc);
}

module_init(ppp_sync_init);
module_exit(ppp_sync_cleanup);
MODULE_DESCRIPTION("PPP synchronous TTY channel module");
MODULE_LICENSE("GPL");
MODULE_ALIAS_LDISC(N_SYNC_PPP);








































  240 








  211 




























































































  212 

   10 














    7 

  216 




  203 

  201 


































  204 

  204 






  203 



















  142 
  239 









  207 
   17 






































  224 





















  202 









  208 










  201 















































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
/* SPDX-License-Identifier: GPL-2.0-or-later */
#ifndef __SOUND_PCM_PARAMS_H
#define __SOUND_PCM_PARAMS_H

/*
 *  PCM params helpers
 *  Copyright (c) by Abramo Bagnara <abramo@alsa-project.org>
 */

#include <sound/pcm.h>

int snd_pcm_hw_param_first(struct snd_pcm_substream *pcm, 
                           struct snd_pcm_hw_params *params,
                           snd_pcm_hw_param_t var, int *dir);
int snd_pcm_hw_param_last(struct snd_pcm_substream *pcm, 
                          struct snd_pcm_hw_params *params,
                          snd_pcm_hw_param_t var, int *dir);
int snd_pcm_hw_param_value(const struct snd_pcm_hw_params *params,
                           snd_pcm_hw_param_t var, int *dir);

#define SNDRV_MASK_BITS        64        /* we use so far 64bits only */
#define SNDRV_MASK_SIZE        (SNDRV_MASK_BITS / 32)
#define MASK_OFS(i)        ((i) >> 5)
#define MASK_BIT(i)        (1U << ((i) & 31))

static inline void snd_mask_none(struct snd_mask *mask)
{
        memset(mask, 0, sizeof(*mask));
}

static inline void snd_mask_any(struct snd_mask *mask)
{
        memset(mask, 0xff, SNDRV_MASK_SIZE * sizeof(u_int32_t));
}

static inline int snd_mask_empty(const struct snd_mask *mask)
{
        int i;
        for (i = 0; i < SNDRV_MASK_SIZE; i++)
                if (mask->bits[i])
                        return 0;
        return 1;
}

static inline unsigned int snd_mask_min(const struct snd_mask *mask)
{
        int i;
        for (i = 0; i < SNDRV_MASK_SIZE; i++) {
                if (mask->bits[i])
                        return __ffs(mask->bits[i]) + (i << 5);
        }
        return 0;
}

static inline unsigned int snd_mask_max(const struct snd_mask *mask)
{
        int i;
        for (i = SNDRV_MASK_SIZE - 1; i >= 0; i--) {
                if (mask->bits[i])
                        return __fls(mask->bits[i]) + (i << 5);
        }
        return 0;
}

static inline void snd_mask_set(struct snd_mask *mask, unsigned int val)
{
        mask->bits[MASK_OFS(val)] |= MASK_BIT(val);
}

/* Most of drivers need only this one */
static inline void snd_mask_set_format(struct snd_mask *mask,
                                       snd_pcm_format_t format)
{
        snd_mask_set(mask, (__force unsigned int)format);
}

static inline void snd_mask_reset(struct snd_mask *mask, unsigned int val)
{
        mask->bits[MASK_OFS(val)] &= ~MASK_BIT(val);
}

static inline void snd_mask_set_range(struct snd_mask *mask,
                                      unsigned int from, unsigned int to)
{
        unsigned int i;
        for (i = from; i <= to; i++)
                mask->bits[MASK_OFS(i)] |= MASK_BIT(i);
}

static inline void snd_mask_reset_range(struct snd_mask *mask,
                                        unsigned int from, unsigned int to)
{
        unsigned int i;
        for (i = from; i <= to; i++)
                mask->bits[MASK_OFS(i)] &= ~MASK_BIT(i);
}

static inline void snd_mask_leave(struct snd_mask *mask, unsigned int val)
{
        unsigned int v;
        v = mask->bits[MASK_OFS(val)] & MASK_BIT(val);
        snd_mask_none(mask);
        mask->bits[MASK_OFS(val)] = v;
}

static inline void snd_mask_intersect(struct snd_mask *mask,
                                      const struct snd_mask *v)
{
        int i;
        for (i = 0; i < SNDRV_MASK_SIZE; i++)
                mask->bits[i] &= v->bits[i];
}

static inline int snd_mask_eq(const struct snd_mask *mask,
                              const struct snd_mask *v)
{
        return ! memcmp(mask, v, SNDRV_MASK_SIZE * sizeof(u_int32_t));
}

static inline void snd_mask_copy(struct snd_mask *mask,
                                 const struct snd_mask *v)
{
        *mask = *v;
}

static inline int snd_mask_test(const struct snd_mask *mask, unsigned int val)
{
        return mask->bits[MASK_OFS(val)] & MASK_BIT(val);
}

/* Most of drivers need only this one */
static inline int snd_mask_test_format(const struct snd_mask *mask,
                                       snd_pcm_format_t format)
{
        return snd_mask_test(mask, (__force unsigned int)format);
}

static inline int snd_mask_single(const struct snd_mask *mask)
{
        int i, c = 0;
        for (i = 0; i < SNDRV_MASK_SIZE; i++) {
                if (! mask->bits[i])
                        continue;
                if (mask->bits[i] & (mask->bits[i] - 1))
                        return 0;
                if (c)
                        return 0;
                c++;
        }
        return 1;
}

static inline int snd_mask_refine(struct snd_mask *mask,
                                  const struct snd_mask *v)
{
        struct snd_mask old;
        snd_mask_copy(&old, mask);
        snd_mask_intersect(mask, v);
        if (snd_mask_empty(mask))
                return -EINVAL;
        return !snd_mask_eq(mask, &old);
}

static inline int snd_mask_refine_first(struct snd_mask *mask)
{
        if (snd_mask_single(mask))
                return 0;
        snd_mask_leave(mask, snd_mask_min(mask));
        return 1;
}

static inline int snd_mask_refine_last(struct snd_mask *mask)
{
        if (snd_mask_single(mask))
                return 0;
        snd_mask_leave(mask, snd_mask_max(mask));
        return 1;
}

static inline int snd_mask_refine_min(struct snd_mask *mask, unsigned int val)
{
        if (snd_mask_min(mask) >= val)
                return 0;
        snd_mask_reset_range(mask, 0, val - 1);
        if (snd_mask_empty(mask))
                return -EINVAL;
        return 1;
}

static inline int snd_mask_refine_max(struct snd_mask *mask, unsigned int val)
{
        if (snd_mask_max(mask) <= val)
                return 0;
        snd_mask_reset_range(mask, val + 1, SNDRV_MASK_BITS);
        if (snd_mask_empty(mask))
                return -EINVAL;
        return 1;
}

static inline int snd_mask_refine_set(struct snd_mask *mask, unsigned int val)
{
        int changed;
        changed = !snd_mask_single(mask);
        snd_mask_leave(mask, val);
        if (snd_mask_empty(mask))
                return -EINVAL;
        return changed;
}

static inline int snd_mask_value(const struct snd_mask *mask)
{
        return snd_mask_min(mask);
}

static inline void snd_interval_any(struct snd_interval *i)
{
        i->min = 0;
        i->openmin = 0;
        i->max = UINT_MAX;
        i->openmax = 0;
        i->integer = 0;
        i->empty = 0;
}

static inline void snd_interval_none(struct snd_interval *i)
{
        i->empty = 1;
}

static inline int snd_interval_checkempty(const struct snd_interval *i)
{
        return (i->min > i->max ||
                (i->min == i->max && (i->openmin || i->openmax)));
}

static inline int snd_interval_empty(const struct snd_interval *i)
{
        return i->empty;
}

static inline int snd_interval_single(const struct snd_interval *i)
{
        return (i->min == i->max || 
                (i->min + 1 == i->max && (i->openmin || i->openmax)));
}

static inline int snd_interval_value(const struct snd_interval *i)
{
        if (i->openmin && !i->openmax)
                return i->max;
        return i->min;
}

static inline int snd_interval_min(const struct snd_interval *i)
{
        return i->min;
}

static inline int snd_interval_max(const struct snd_interval *i)
{
        unsigned int v;
        v = i->max;
        if (i->openmax)
                v--;
        return v;
}

static inline int snd_interval_test(const struct snd_interval *i, unsigned int val)
{
        return !((i->min > val || (i->min == val && i->openmin) ||
                  i->max < val || (i->max == val && i->openmax)));
}

static inline void snd_interval_copy(struct snd_interval *d, const struct snd_interval *s)
{
        *d = *s;
}

static inline int snd_interval_setinteger(struct snd_interval *i)
{
        if (i->integer)
                return 0;
        if (i->openmin && i->openmax && i->min == i->max)
                return -EINVAL;
        i->integer = 1;
        return 1;
}

static inline int snd_interval_eq(const struct snd_interval *i1, const struct snd_interval *i2)
{
        if (i1->empty)
                return i2->empty;
        if (i2->empty)
                return i1->empty;
        return i1->min == i2->min && i1->openmin == i2->openmin &&
                i1->max == i2->max && i1->openmax == i2->openmax;
}

/**
 * params_access - get the access type from the hw params
 * @p: hw params
 */
static inline snd_pcm_access_t params_access(const struct snd_pcm_hw_params *p)
{
        return (__force snd_pcm_access_t)snd_mask_min(hw_param_mask_c(p,
                SNDRV_PCM_HW_PARAM_ACCESS));
}

/**
 * params_format - get the sample format from the hw params
 * @p: hw params
 */
static inline snd_pcm_format_t params_format(const struct snd_pcm_hw_params *p)
{
        return (__force snd_pcm_format_t)snd_mask_min(hw_param_mask_c(p,
                SNDRV_PCM_HW_PARAM_FORMAT));
}

/**
 * params_subformat - get the sample subformat from the hw params
 * @p: hw params
 */
static inline snd_pcm_subformat_t
params_subformat(const struct snd_pcm_hw_params *p)
{
        return (__force snd_pcm_subformat_t)snd_mask_min(hw_param_mask_c(p,
                SNDRV_PCM_HW_PARAM_SUBFORMAT));
}

/**
 * params_period_bytes - get the period size (in bytes) from the hw params
 * @p: hw params
 */
static inline unsigned int
params_period_bytes(const struct snd_pcm_hw_params *p)
{
        return hw_param_interval_c(p, SNDRV_PCM_HW_PARAM_PERIOD_BYTES)->min;
}

/**
 * params_width - get the number of bits of the sample format from the hw params
 * @p: hw params
 *
 * This function returns the number of bits per sample that the selected sample
 * format of the hw params has.
 */
static inline int params_width(const struct snd_pcm_hw_params *p)
{
        return snd_pcm_format_width(params_format(p));
}

/*
 * params_physical_width - get the storage size of the sample format from the hw params
 * @p: hw params
 *
 * This functions returns the number of bits per sample that the selected sample
 * format of the hw params takes up in memory. This will be equal or larger than
 * params_width().
 */
static inline int params_physical_width(const struct snd_pcm_hw_params *p)
{
        return snd_pcm_format_physical_width(params_format(p));
}

int snd_pcm_hw_params_bits(const struct snd_pcm_hw_params *p);

static inline void
params_set_format(struct snd_pcm_hw_params *p, snd_pcm_format_t fmt)
{
        snd_mask_set_format(hw_param_mask(p, SNDRV_PCM_HW_PARAM_FORMAT), fmt);
}

#endif /* __SOUND_PCM_PARAMS_H */

































































































































































































































   55 










   39 






  156 






















  155 























    1 

































  156 











































  754 






    2 








   26 
  183 












    9 
    2 

















































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _NDISC_H
#define _NDISC_H

#include <net/ipv6_stubs.h>

/*
 *        ICMP codes for neighbour discovery messages
 */

#define NDISC_ROUTER_SOLICITATION        133
#define NDISC_ROUTER_ADVERTISEMENT        134
#define NDISC_NEIGHBOUR_SOLICITATION        135
#define NDISC_NEIGHBOUR_ADVERTISEMENT        136
#define NDISC_REDIRECT                        137

/*
 * Router type: cross-layer information from link-layer to
 * IPv6 layer reported by certain link types (e.g., RFC4214).
 */
#define NDISC_NODETYPE_UNSPEC                0        /* unspecified (default) */
#define NDISC_NODETYPE_HOST                1        /* host or unauthorized router */
#define NDISC_NODETYPE_NODEFAULT        2        /* non-default router */
#define NDISC_NODETYPE_DEFAULT                3        /* default router */

/*
 *        ndisc options
 */

enum {
        __ND_OPT_PREFIX_INFO_END = 0,
        ND_OPT_SOURCE_LL_ADDR = 1,        /* RFC2461 */
        ND_OPT_TARGET_LL_ADDR = 2,        /* RFC2461 */
        ND_OPT_PREFIX_INFO = 3,                /* RFC2461 */
        ND_OPT_REDIRECT_HDR = 4,        /* RFC2461 */
        ND_OPT_MTU = 5,                        /* RFC2461 */
        ND_OPT_NONCE = 14,              /* RFC7527 */
        __ND_OPT_ARRAY_MAX,
        ND_OPT_ROUTE_INFO = 24,                /* RFC4191 */
        ND_OPT_RDNSS = 25,                /* RFC5006 */
        ND_OPT_DNSSL = 31,                /* RFC6106 */
        ND_OPT_6CO = 34,                /* RFC6775 */
        ND_OPT_CAPTIVE_PORTAL = 37,        /* RFC7710 */
        ND_OPT_PREF64 = 38,                /* RFC8781 */
        __ND_OPT_MAX
};

#define MAX_RTR_SOLICITATION_DELAY        HZ

#define ND_REACHABLE_TIME                (30*HZ)
#define ND_RETRANS_TIMER                HZ

#include <linux/compiler.h>
#include <linux/icmpv6.h>
#include <linux/in6.h>
#include <linux/types.h>
#include <linux/if_arp.h>
#include <linux/netdevice.h>
#include <linux/hash.h>

#include <net/neighbour.h>

/* Set to 3 to get tracing... */
#define ND_DEBUG 1

#define ND_PRINTK(val, level, fmt, ...)                                \
do {                                                                \
        if (val <= ND_DEBUG)                                        \
                net_##level##_ratelimited(fmt, ##__VA_ARGS__);        \
} while (0)

struct ctl_table;
struct inet6_dev;
struct net_device;
struct net_proto_family;
struct sk_buff;
struct prefix_info;

extern struct neigh_table nd_tbl;

struct nd_msg {
        struct icmp6hdr        icmph;
        struct in6_addr        target;
        __u8                opt[];
};

struct rs_msg {
        struct icmp6hdr        icmph;
        __u8                opt[];
};

struct ra_msg {
        struct icmp6hdr                icmph;
        __be32                        reachable_time;
        __be32                        retrans_timer;
};

struct rd_msg {
        struct icmp6hdr icmph;
        struct in6_addr        target;
        struct in6_addr        dest;
        __u8                opt[];
};

struct nd_opt_hdr {
        __u8                nd_opt_type;
        __u8                nd_opt_len;
} __packed;

/* ND options */
struct ndisc_options {
        struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
#ifdef CONFIG_IPV6_ROUTE_INFO
        struct nd_opt_hdr *nd_opts_ri;
        struct nd_opt_hdr *nd_opts_ri_end;
#endif
        struct nd_opt_hdr *nd_useropts;
        struct nd_opt_hdr *nd_useropts_end;
#if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
        struct nd_opt_hdr *nd_802154_opt_array[ND_OPT_TARGET_LL_ADDR + 1];
#endif
};

#define nd_opts_src_lladdr                nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
#define nd_opts_tgt_lladdr                nd_opt_array[ND_OPT_TARGET_LL_ADDR]
#define nd_opts_pi                        nd_opt_array[ND_OPT_PREFIX_INFO]
#define nd_opts_pi_end                        nd_opt_array[__ND_OPT_PREFIX_INFO_END]
#define nd_opts_rh                        nd_opt_array[ND_OPT_REDIRECT_HDR]
#define nd_opts_mtu                        nd_opt_array[ND_OPT_MTU]
#define nd_opts_nonce                        nd_opt_array[ND_OPT_NONCE]
#define nd_802154_opts_src_lladdr        nd_802154_opt_array[ND_OPT_SOURCE_LL_ADDR]
#define nd_802154_opts_tgt_lladdr        nd_802154_opt_array[ND_OPT_TARGET_LL_ADDR]

#define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)

struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
                                          u8 *opt, int opt_len,
                                          struct ndisc_options *ndopts);

void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
                              int data_len, int pad);

#define NDISC_OPS_REDIRECT_DATA_SPACE        2

/*
 * This structure defines the hooks for IPv6 neighbour discovery.
 * The following hooks can be defined; unless noted otherwise, they are
 * optional and can be filled with a null pointer.
 *
 * int (*parse_options)(const struct net_device *dev,
 *                        struct nd_opt_hdr *nd_opt,
 *                        struct ndisc_options *ndopts):
 *     This function is called while parsing ndisc ops and put each position
 *     as pointer into ndopts. If this function return unequal 0, then this
 *     function took care about the ndisc option, if 0 then the IPv6 ndisc
 *     option parser will take care about that option.
 *
 * void (*update)(const struct net_device *dev, struct neighbour *n,
 *                  u32 flags, u8 icmp6_type,
 *                  const struct ndisc_options *ndopts):
 *     This function is called when IPv6 ndisc updates the neighbour cache
 *     entry. Additional options which can be updated may be previously
 *     parsed by parse_opts callback and accessible over ndopts parameter.
 *
 * int (*opt_addr_space)(const struct net_device *dev, u8 icmp6_type,
 *                         struct neighbour *neigh, u8 *ha_buf,
 *                         u8 **ha):
 *     This function is called when the necessary option space will be
 *     calculated before allocating a skb. The parameters neigh, ha_buf
 *     abd ha are available on NDISC_REDIRECT messages only.
 *
 * void (*fill_addr_option)(const struct net_device *dev,
 *                            struct sk_buff *skb, u8 icmp6_type,
 *                            const u8 *ha):
 *     This function is called when the skb will finally fill the option
 *     fields inside skb. NOTE: this callback should fill the option
 *     fields to the skb which are previously indicated by opt_space
 *     parameter. That means the decision to add such option should
 *     not lost between these two callbacks, e.g. protected by interface
 *     up state.
 *
 * void (*prefix_rcv_add_addr)(struct net *net, struct net_device *dev,
 *                               const struct prefix_info *pinfo,
 *                               struct inet6_dev *in6_dev,
 *                               struct in6_addr *addr,
 *                               int addr_type, u32 addr_flags,
 *                               bool sllao, bool tokenized,
 *                               __u32 valid_lft, u32 prefered_lft,
 *                               bool dev_addr_generated):
 *     This function is called when a RA messages is received with valid
 *     PIO option fields and an IPv6 address will be added to the interface
 *     for autoconfiguration. The parameter dev_addr_generated reports about
 *     if the address was based on dev->dev_addr or not. This can be used
 *     to add a second address if link-layer operates with two link layer
 *     addresses. E.g. 802.15.4 6LoWPAN.
 */
struct ndisc_ops {
        int        (*parse_options)(const struct net_device *dev,
                                 struct nd_opt_hdr *nd_opt,
                                 struct ndisc_options *ndopts);
        void        (*update)(const struct net_device *dev, struct neighbour *n,
                          u32 flags, u8 icmp6_type,
                          const struct ndisc_options *ndopts);
        int        (*opt_addr_space)(const struct net_device *dev, u8 icmp6_type,
                                  struct neighbour *neigh, u8 *ha_buf,
                                  u8 **ha);
        void        (*fill_addr_option)(const struct net_device *dev,
                                    struct sk_buff *skb, u8 icmp6_type,
                                    const u8 *ha);
        void        (*prefix_rcv_add_addr)(struct net *net, struct net_device *dev,
                                       const struct prefix_info *pinfo,
                                       struct inet6_dev *in6_dev,
                                       struct in6_addr *addr,
                                       int addr_type, u32 addr_flags,
                                       bool sllao, bool tokenized,
                                       __u32 valid_lft, u32 prefered_lft,
                                       bool dev_addr_generated);
};

#if IS_ENABLED(CONFIG_IPV6)
static inline int ndisc_ops_parse_options(const struct net_device *dev,
                                          struct nd_opt_hdr *nd_opt,
                                          struct ndisc_options *ndopts)
{
        if (dev->ndisc_ops && dev->ndisc_ops->parse_options)
                return dev->ndisc_ops->parse_options(dev, nd_opt, ndopts);
        else
                return 0;
}

static inline void ndisc_ops_update(const struct net_device *dev,
                                          struct neighbour *n, u32 flags,
                                          u8 icmp6_type,
                                          const struct ndisc_options *ndopts)
{
        if (dev->ndisc_ops && dev->ndisc_ops->update)
                dev->ndisc_ops->update(dev, n, flags, icmp6_type, ndopts);
}

static inline int ndisc_ops_opt_addr_space(const struct net_device *dev,
                                           u8 icmp6_type)
{
        if (dev->ndisc_ops && dev->ndisc_ops->opt_addr_space &&
            icmp6_type != NDISC_REDIRECT)
                return dev->ndisc_ops->opt_addr_space(dev, icmp6_type, NULL,
                                                      NULL, NULL);
        else
                return 0;
}

static inline int ndisc_ops_redirect_opt_addr_space(const struct net_device *dev,
                                                    struct neighbour *neigh,
                                                    u8 *ha_buf, u8 **ha)
{
        if (dev->ndisc_ops && dev->ndisc_ops->opt_addr_space)
                return dev->ndisc_ops->opt_addr_space(dev, NDISC_REDIRECT,
                                                      neigh, ha_buf, ha);
        else
                return 0;
}

static inline void ndisc_ops_fill_addr_option(const struct net_device *dev,
                                              struct sk_buff *skb,
                                              u8 icmp6_type)
{
        if (dev->ndisc_ops && dev->ndisc_ops->fill_addr_option &&
            icmp6_type != NDISC_REDIRECT)
                dev->ndisc_ops->fill_addr_option(dev, skb, icmp6_type, NULL);
}

static inline void ndisc_ops_fill_redirect_addr_option(const struct net_device *dev,
                                                       struct sk_buff *skb,
                                                       const u8 *ha)
{
        if (dev->ndisc_ops && dev->ndisc_ops->fill_addr_option)
                dev->ndisc_ops->fill_addr_option(dev, skb, NDISC_REDIRECT, ha);
}

static inline void ndisc_ops_prefix_rcv_add_addr(struct net *net,
                                                 struct net_device *dev,
                                                 const struct prefix_info *pinfo,
                                                 struct inet6_dev *in6_dev,
                                                 struct in6_addr *addr,
                                                 int addr_type, u32 addr_flags,
                                                 bool sllao, bool tokenized,
                                                 __u32 valid_lft,
                                                 u32 prefered_lft,
                                                 bool dev_addr_generated)
{
        if (dev->ndisc_ops && dev->ndisc_ops->prefix_rcv_add_addr)
                dev->ndisc_ops->prefix_rcv_add_addr(net, dev, pinfo, in6_dev,
                                                    addr, addr_type,
                                                    addr_flags, sllao,
                                                    tokenized, valid_lft,
                                                    prefered_lft,
                                                    dev_addr_generated);
}
#endif

/*
 * Return the padding between the option length and the start of the
 * link addr.  Currently only IP-over-InfiniBand needs this, although
 * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
 * also need a pad of 2.
 */
static inline int ndisc_addr_option_pad(unsigned short type)
{
        switch (type) {
        case ARPHRD_INFINIBAND: return 2;
        default:                return 0;
        }
}

static inline int __ndisc_opt_addr_space(unsigned char addr_len, int pad)
{
        return NDISC_OPT_SPACE(addr_len + pad);
}

#if IS_ENABLED(CONFIG_IPV6)
static inline int ndisc_opt_addr_space(struct net_device *dev, u8 icmp6_type)
{
        return __ndisc_opt_addr_space(dev->addr_len,
                                      ndisc_addr_option_pad(dev->type)) +
                ndisc_ops_opt_addr_space(dev, icmp6_type);
}

static inline int ndisc_redirect_opt_addr_space(struct net_device *dev,
                                                struct neighbour *neigh,
                                                u8 *ops_data_buf,
                                                u8 **ops_data)
{
        return __ndisc_opt_addr_space(dev->addr_len,
                                      ndisc_addr_option_pad(dev->type)) +
                ndisc_ops_redirect_opt_addr_space(dev, neigh, ops_data_buf,
                                                  ops_data);
}
#endif

static inline u8 *__ndisc_opt_addr_data(struct nd_opt_hdr *p,
                                        unsigned char addr_len, int prepad)
{
        u8 *lladdr = (u8 *)(p + 1);
        int lladdrlen = p->nd_opt_len << 3;
        if (lladdrlen != __ndisc_opt_addr_space(addr_len, prepad))
                return NULL;
        return lladdr + prepad;
}

static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
                                      struct net_device *dev)
{
        return __ndisc_opt_addr_data(p, dev->addr_len,
                                     ndisc_addr_option_pad(dev->type));
}

static inline u32 ndisc_hashfn(const void *pkey, const struct net_device *dev, __u32 *hash_rnd)
{
        const u32 *p32 = pkey;

        return (((p32[0] ^ hash32_ptr(dev)) * hash_rnd[0]) +
                (p32[1] * hash_rnd[1]) +
                (p32[2] * hash_rnd[2]) +
                (p32[3] * hash_rnd[3]));
}

static inline struct neighbour *__ipv6_neigh_lookup_noref(struct net_device *dev, const void *pkey)
{
        return ___neigh_lookup_noref(&nd_tbl, neigh_key_eq128, ndisc_hashfn, pkey, dev);
}

static inline
struct neighbour *__ipv6_neigh_lookup_noref_stub(struct net_device *dev,
                                                 const void *pkey)
{
        return ___neigh_lookup_noref(ipv6_stub->nd_tbl, neigh_key_eq128,
                                     ndisc_hashfn, pkey, dev);
}

static inline struct neighbour *__ipv6_neigh_lookup(struct net_device *dev, const void *pkey)
{
        struct neighbour *n;

        rcu_read_lock();
        n = __ipv6_neigh_lookup_noref(dev, pkey);
        if (n && !refcount_inc_not_zero(&n->refcnt))
                n = NULL;
        rcu_read_unlock();

        return n;
}

static inline void __ipv6_confirm_neigh(struct net_device *dev,
                                        const void *pkey)
{
        struct neighbour *n;

        rcu_read_lock();
        n = __ipv6_neigh_lookup_noref(dev, pkey);
        neigh_confirm(n);
        rcu_read_unlock();
}

static inline void __ipv6_confirm_neigh_stub(struct net_device *dev,
                                             const void *pkey)
{
        struct neighbour *n;

        rcu_read_lock();
        n = __ipv6_neigh_lookup_noref_stub(dev, pkey);
        neigh_confirm(n);
        rcu_read_unlock();
}

/* uses ipv6_stub and is meant for use outside of IPv6 core */
static inline struct neighbour *ip_neigh_gw6(struct net_device *dev,
                                             const void *addr)
{
        struct neighbour *neigh;

        neigh = __ipv6_neigh_lookup_noref_stub(dev, addr);
        if (unlikely(!neigh))
                neigh = __neigh_create(ipv6_stub->nd_tbl, addr, dev, false);

        return neigh;
}

int ndisc_init(void);
int ndisc_late_init(void);

void ndisc_late_cleanup(void);
void ndisc_cleanup(void);

enum skb_drop_reason ndisc_rcv(struct sk_buff *skb);

struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
                                const struct in6_addr *saddr, u64 nonce);
void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
                   const struct in6_addr *daddr, const struct in6_addr *saddr,
                   u64 nonce);

void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
                    const struct in6_addr *saddr);

void ndisc_send_rs(struct net_device *dev,
                   const struct in6_addr *saddr, const struct in6_addr *daddr);
void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
                   const struct in6_addr *solicited_addr,
                   bool router, bool solicited, bool override, bool inc_opt);

void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target);

int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev,
                 int dir);

void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
                  const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
                  struct ndisc_options *ndopts);

/*
 *        IGMP
 */
int igmp6_init(void);
int igmp6_late_init(void);

void igmp6_cleanup(void);
void igmp6_late_cleanup(void);

void igmp6_event_query(struct sk_buff *skb);

void igmp6_event_report(struct sk_buff *skb);


#ifdef CONFIG_SYSCTL
int ndisc_ifinfo_sysctl_change(const struct ctl_table *ctl, int write,
                               void *buffer, size_t *lenp, loff_t *ppos);
#endif

void inet6_ifinfo_notify(int event, struct inet6_dev *idev);

#endif





































































































    6 

    7 







    5 
















    4 


    4 


    4 




    2 








    4 
























    6 



    1 


    1 


    1 




    4 












    7 



    3 

    5 




    5 







    3 


    3 

    2 

    5 
    5 















   20 







   21 
























   22 








    6 
   16 





    5 
    1 




   15 












   18 




























   13 








    1 




   12 






    1 
    2 


    4 










    7 




    3 


    3 






    3 
















    1 


    2 



    5 










    6 

    6 
















    1 




    1 






























   12 









    1 

    1 


    1 


    1 


    9 



















    9 



    1 












    1 













    3 







    1 


    1 





    1 
    1 




































    9 


    7 







    4 







    4 






    2 


    2 














    1 












































    4 








    1 


    2 




    1 













































    7 














    7 


    6 


    4 
    2 



    5 










    2 


    2 












    6 




















    5 
    1 









    5 











    1 








































    3 































   23 














   15 


   11 




   12 


   12 




   17 













   18 







    2 

    6 






    3 





    5 







    4 




















    3 







    1 



    1 












    1 






















    1 















   19 






    1 

   18 



    1 

    1 

    1 


    1 

    1 


    1 

    1 


    1 

    1 


    1 

    1 


    1 




    1 

    1 


    1 

    1 



    1 

    1 























   13 





    1 


    1 


    1 

    1 



    1 

    1 

    1 

    1 

    1 

    2 

    1 

    1 






    9 
































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
/*
 * af_llc.c - LLC User Interface SAPs
 * Description:
 *   Functions in this module are implementation of socket based llc
 *   communications for the Linux operating system. Support of llc class
 *   one and class two is provided via SOCK_DGRAM and SOCK_STREAM
 *   respectively.
 *
 *   An llc2 connection is (mac + sap), only one llc2 sap connection
 *   is allowed per mac. Though one sap may have multiple mac + sap
 *   connections.
 *
 * Copyright (c) 2001 by Jay Schulist <jschlst@samba.org>
 *                 2002-2003 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
 *
 * This program can be redistributed or modified under the terms of the
 * GNU General Public License as published by the Free Software Foundation.
 * This program is distributed without any warranty or implied warranty
 * of merchantability or fitness for a particular purpose.
 *
 * See the GNU General Public License for more details.
 */
#include <linux/compiler.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/rtnetlink.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/sched/signal.h>

#include <net/llc.h>
#include <net/llc_sap.h>
#include <net/llc_pdu.h>
#include <net/llc_conn.h>
#include <net/tcp_states.h>

/* remember: uninitialized global data is zeroed because its in .bss */
static u16 llc_ui_sap_last_autoport = LLC_SAP_DYN_START;
static u16 llc_ui_sap_link_no_max[256];
static struct sockaddr_llc llc_ui_addrnull;
static const struct proto_ops llc_ui_ops;

static bool llc_ui_wait_for_conn(struct sock *sk, long timeout);
static int llc_ui_wait_for_disc(struct sock *sk, long timeout);
static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout);

#if 0
#define dprintk(args...) printk(KERN_DEBUG args)
#else
#define dprintk(args...) do {} while (0)
#endif

/* Maybe we'll add some more in the future. */
#define LLC_CMSG_PKTINFO        1


/**
 *        llc_ui_next_link_no - return the next unused link number for a sap
 *        @sap: Address of sap to get link number from.
 *
 *        Return the next unused link number for a given sap.
 */
static inline u16 llc_ui_next_link_no(int sap)
{
        return llc_ui_sap_link_no_max[sap]++;
}

/**
 *        llc_proto_type - return eth protocol for ARP header type
 *        @arphrd: ARP header type.
 *
 *        Given an ARP header type return the corresponding ethernet protocol.
 */
static inline __be16 llc_proto_type(u16 arphrd)
{
        return htons(ETH_P_802_2);
}

/**
 *        llc_ui_addr_null - determines if a address structure is null
 *        @addr: Address to test if null.
 */
static inline u8 llc_ui_addr_null(struct sockaddr_llc *addr)
{
        return !memcmp(addr, &llc_ui_addrnull, sizeof(*addr));
}

/**
 *        llc_ui_header_len - return length of llc header based on operation
 *        @sk: Socket which contains a valid llc socket type.
 *        @addr: Complete sockaddr_llc structure received from the user.
 *
 *        Provide the length of the llc header depending on what kind of
 *        operation the user would like to perform and the type of socket.
 *        Returns the correct llc header length.
 */
static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
{
        u8 rc = LLC_PDU_LEN_U;

        if (addr->sllc_test)
                rc = LLC_PDU_LEN_U;
        else if (addr->sllc_xid)
                /* We need to expand header to sizeof(struct llc_xid_info)
                 * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header
                 * as XID PDU. In llc_ui_sendmsg() we reserved header size and then
                 * filled all other space with user data. If we won't reserve this
                 * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data
                 */
                rc = LLC_PDU_LEN_U_XID;
        else if (sk->sk_type == SOCK_STREAM)
                rc = LLC_PDU_LEN_I;
        return rc;
}

/**
 *        llc_ui_send_data - send data via reliable llc2 connection
 *        @sk: Connection the socket is using.
 *        @skb: Data the user wishes to send.
 *        @noblock: can we block waiting for data?
 *
 *        Send data via reliable llc2 connection.
 *        Returns 0 upon success, non-zero if action did not succeed.
 *
 *        This function always consumes a reference to the skb.
 */
static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
{
        struct llc_sock* llc = llc_sk(sk);

        if (unlikely(llc_data_accept_state(llc->state) ||
                     llc->remote_busy_flag ||
                     llc->p_flag)) {
                long timeout = sock_sndtimeo(sk, noblock);
                int rc;

                rc = llc_ui_wait_for_busy_core(sk, timeout);
                if (rc) {
                        kfree_skb(skb);
                        return rc;
                }
        }
        return llc_build_and_send_pkt(sk, skb);
}

static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
{
        sock_graft(sk, sock);
        sk->sk_type        = sock->type;
        sock->ops        = &llc_ui_ops;
}

static struct proto llc_proto = {
        .name          = "LLC",
        .owner          = THIS_MODULE,
        .obj_size = sizeof(struct llc_sock),
        .slab_flags = SLAB_TYPESAFE_BY_RCU,
};

/**
 *        llc_ui_create - alloc and init a new llc_ui socket
 *        @net: network namespace (must be default network)
 *        @sock: Socket to initialize and attach allocated sk to.
 *        @protocol: Unused.
 *        @kern: on behalf of kernel or userspace
 *
 *        Allocate and initialize a new llc_ui socket, validate the user wants a
 *        socket type we have available.
 *        Returns 0 upon success, negative upon failure.
 */
static int llc_ui_create(struct net *net, struct socket *sock, int protocol,
                         int kern)
{
        struct sock *sk;
        int rc = -ESOCKTNOSUPPORT;

        if (!ns_capable(net->user_ns, CAP_NET_RAW))
                return -EPERM;

        if (!net_eq(net, &init_net))
                return -EAFNOSUPPORT;

        if (likely(sock->type == SOCK_DGRAM || sock->type == SOCK_STREAM)) {
                rc = -ENOMEM;
                sk = llc_sk_alloc(net, PF_LLC, GFP_KERNEL, &llc_proto, kern);
                if (sk) {
                        rc = 0;
                        llc_ui_sk_init(sock, sk);
                }
        }
        return rc;
}

/**
 *        llc_ui_release - shutdown socket
 *        @sock: Socket to release.
 *
 *        Shutdown and deallocate an existing socket.
 */
static int llc_ui_release(struct socket *sock)
{
        struct sock *sk = sock->sk;
        struct llc_sock *llc;

        if (unlikely(sk == NULL))
                goto out;
        sock_hold(sk);
        lock_sock(sk);
        llc = llc_sk(sk);
        dprintk("%s: closing local(%02X) remote(%02X)\n", __func__,
                llc->laddr.lsap, llc->daddr.lsap);
        if (!llc_send_disc(sk))
                llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
        if (!sock_flag(sk, SOCK_ZAPPED)) {
                struct llc_sap *sap = llc->sap;

                /* Hold this for release_sock(), so that llc_backlog_rcv()
                 * could still use it.
                 */
                llc_sap_hold(sap);
                llc_sap_remove_socket(llc->sap, sk);
                release_sock(sk);
                llc_sap_put(sap);
        } else {
                release_sock(sk);
        }
        netdev_put(llc->dev, &llc->dev_tracker);
        sock_put(sk);
        sock_orphan(sk);
        sock->sk = NULL;
        llc_sk_free(sk);
out:
        return 0;
}

/**
 *        llc_ui_autoport - provide dynamically allocate SAP number
 *
 *        Provide the caller with a dynamically allocated SAP number according
 *        to the rules that are set in this function. Returns: 0, upon failure,
 *        SAP number otherwise.
 */
static int llc_ui_autoport(void)
{
        struct llc_sap *sap;
        int i, tries = 0;

        while (tries < LLC_SAP_DYN_TRIES) {
                for (i = llc_ui_sap_last_autoport;
                     i < LLC_SAP_DYN_STOP; i += 2) {
                        sap = llc_sap_find(i);
                        if (!sap) {
                                llc_ui_sap_last_autoport = i + 2;
                                goto out;
                        }
                        llc_sap_put(sap);
                }
                llc_ui_sap_last_autoport = LLC_SAP_DYN_START;
                tries++;
        }
        i = 0;
out:
        return i;
}

/**
 *        llc_ui_autobind - automatically bind a socket to a sap
 *        @sock: socket to bind
 *        @addr: address to connect to
 *
 *         Used by llc_ui_connect and llc_ui_sendmsg when the user hasn't
 *         specifically used llc_ui_bind to bind to an specific address/sap
 *
 *        Returns: 0 upon success, negative otherwise.
 */
static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
{
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        struct net_device *dev = NULL;
        struct llc_sap *sap;
        int rc = -EINVAL;

        if (!sock_flag(sk, SOCK_ZAPPED))
                goto out;
        if (!addr->sllc_arphrd)
                addr->sllc_arphrd = ARPHRD_ETHER;
        if (addr->sllc_arphrd != ARPHRD_ETHER)
                goto out;
        rc = -ENODEV;
        if (sk->sk_bound_dev_if) {
                dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
                if (dev && addr->sllc_arphrd != dev->type) {
                        dev_put(dev);
                        dev = NULL;
                }
        } else
                dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
        if (!dev)
                goto out;
        rc = -EUSERS;
        llc->laddr.lsap = llc_ui_autoport();
        if (!llc->laddr.lsap)
                goto out;
        rc = -EBUSY; /* some other network layer is using the sap */
        sap = llc_sap_open(llc->laddr.lsap, NULL);
        if (!sap)
                goto out;

        /* Note: We do not expect errors from this point. */
        llc->dev = dev;
        netdev_tracker_alloc(llc->dev, &llc->dev_tracker, GFP_KERNEL);
        dev = NULL;

        memcpy(llc->laddr.mac, llc->dev->dev_addr, IFHWADDRLEN);
        memcpy(&llc->addr, addr, sizeof(llc->addr));
        /* assign new connection to its SAP */
        llc_sap_add_socket(sap, sk);
        sock_reset_flag(sk, SOCK_ZAPPED);
        rc = 0;
out:
        dev_put(dev);
        return rc;
}

/**
 *        llc_ui_bind - bind a socket to a specific address.
 *        @sock: Socket to bind an address to.
 *        @uaddr: Address the user wants the socket bound to.
 *        @addrlen: Length of the uaddr structure.
 *
 *        Bind a socket to a specific address. For llc a user is able to bind to
 *        a specific sap only or mac + sap.
 *        If the user desires to bind to a specific mac + sap, it is possible to
 *        have multiple sap connections via multiple macs.
 *        Bind and autobind for that matter must enforce the correct sap usage
 *        otherwise all hell will break loose.
 *        Returns: 0 upon success, negative otherwise.
 */
static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
{
        struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr;
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        struct net_device *dev = NULL;
        struct llc_sap *sap;
        int rc = -EINVAL;

        lock_sock(sk);
        if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                goto out;
        rc = -EAFNOSUPPORT;
        if (!addr->sllc_arphrd)
                addr->sllc_arphrd = ARPHRD_ETHER;
        if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != ARPHRD_ETHER))
                goto out;
        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
        rc = -ENODEV;
        rcu_read_lock();
        if (sk->sk_bound_dev_if) {
                dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
                if (dev) {
                        if (is_zero_ether_addr(addr->sllc_mac))
                                memcpy(addr->sllc_mac, dev->dev_addr,
                                       IFHWADDRLEN);
                        if (addr->sllc_arphrd != dev->type ||
                            !ether_addr_equal(addr->sllc_mac,
                                              dev->dev_addr)) {
                                rc = -EINVAL;
                                dev = NULL;
                        }
                }
        } else {
                dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd,
                                           addr->sllc_mac);
        }
        dev_hold(dev);
        rcu_read_unlock();
        if (!dev)
                goto out;

        if (!addr->sllc_sap) {
                rc = -EUSERS;
                addr->sllc_sap = llc_ui_autoport();
                if (!addr->sllc_sap)
                        goto out;
        }
        sap = llc_sap_find(addr->sllc_sap);
        if (!sap) {
                sap = llc_sap_open(addr->sllc_sap, NULL);
                rc = -EBUSY; /* some other network layer is using the sap */
                if (!sap)
                        goto out;
        } else {
                struct llc_addr laddr, daddr;
                struct sock *ask;

                memset(&laddr, 0, sizeof(laddr));
                memset(&daddr, 0, sizeof(daddr));
                /*
                 * FIXME: check if the address is multicast,
                 *           only SOCK_DGRAM can do this.
                 */
                memcpy(laddr.mac, addr->sllc_mac, IFHWADDRLEN);
                laddr.lsap = addr->sllc_sap;
                rc = -EADDRINUSE; /* mac + sap clash. */
                ask = llc_lookup_established(sap, &daddr, &laddr, &init_net);
                if (ask) {
                        sock_put(ask);
                        goto out_put;
                }
        }

        /* Note: We do not expect errors from this point. */
        llc->dev = dev;
        netdev_tracker_alloc(llc->dev, &llc->dev_tracker, GFP_KERNEL);
        dev = NULL;

        llc->laddr.lsap = addr->sllc_sap;
        memcpy(llc->laddr.mac, addr->sllc_mac, IFHWADDRLEN);
        memcpy(&llc->addr, addr, sizeof(llc->addr));
        /* assign new connection to its SAP */
        llc_sap_add_socket(sap, sk);
        sock_reset_flag(sk, SOCK_ZAPPED);
        rc = 0;
out_put:
        llc_sap_put(sap);
out:
        dev_put(dev);
        release_sock(sk);
        return rc;
}

/**
 *        llc_ui_shutdown - shutdown a connect llc2 socket.
 *        @sock: Socket to shutdown.
 *        @how: What part of the socket to shutdown.
 *
 *        Shutdown a connected llc2 socket. Currently this function only supports
 *        shutting down both sends and receives (2), we could probably make this
 *        function such that a user can shutdown only half the connection but not
 *        right now.
 *        Returns: 0 upon success, negative otherwise.
 */
static int llc_ui_shutdown(struct socket *sock, int how)
{
        struct sock *sk = sock->sk;
        int rc = -ENOTCONN;

        lock_sock(sk);
        if (unlikely(sk->sk_state != TCP_ESTABLISHED))
                goto out;
        rc = -EINVAL;
        if (how != 2)
                goto out;
        rc = llc_send_disc(sk);
        if (!rc)
                rc = llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
        /* Wake up anyone sleeping in poll */
        sk->sk_state_change(sk);
out:
        release_sock(sk);
        return rc;
}

/**
 *        llc_ui_connect - Connect to a remote llc2 mac + sap.
 *        @sock: Socket which will be connected to the remote destination.
 *        @uaddr: Remote and possibly the local address of the new connection.
 *        @addrlen: Size of uaddr structure.
 *        @flags: Operational flags specified by the user.
 *
 *        Connect to a remote llc2 mac + sap. The caller must specify the
 *        destination mac and address to connect to. If the user hasn't previously
 *        called bind(2) with a smac the address of the first interface of the
 *        specified arp type will be used.
 *        This function will autobind if user did not previously call bind.
 *        Returns: 0 upon success, negative otherwise.
 */
static int llc_ui_connect(struct socket *sock, struct sockaddr *uaddr,
                          int addrlen, int flags)
{
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr;
        int rc = -EINVAL;

        lock_sock(sk);
        if (unlikely(addrlen != sizeof(*addr)))
                goto out;
        rc = -EAFNOSUPPORT;
        if (unlikely(addr->sllc_family != AF_LLC))
                goto out;
        if (unlikely(sk->sk_type != SOCK_STREAM))
                goto out;
        rc = -EALREADY;
        if (unlikely(sock->state == SS_CONNECTING))
                goto out;
        /* bind connection to sap if user hasn't done it. */
        if (sock_flag(sk, SOCK_ZAPPED)) {
                /* bind to sap with null dev, exclusive */
                rc = llc_ui_autobind(sock, addr);
                if (rc)
                        goto out;
        }
        llc->daddr.lsap = addr->sllc_sap;
        memcpy(llc->daddr.mac, addr->sllc_mac, IFHWADDRLEN);
        sock->state = SS_CONNECTING;
        sk->sk_state   = TCP_SYN_SENT;
        llc->link   = llc_ui_next_link_no(llc->sap->laddr.lsap);
        rc = llc_establish_connection(sk, llc->dev->dev_addr,
                                      addr->sllc_mac, addr->sllc_sap);
        if (rc) {
                dprintk("%s: llc_ui_send_conn failed :-(\n", __func__);
                sock->state  = SS_UNCONNECTED;
                sk->sk_state = TCP_CLOSE;
                goto out;
        }

        if (sk->sk_state == TCP_SYN_SENT) {
                const long timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);

                if (!timeo || !llc_ui_wait_for_conn(sk, timeo))
                        goto out;

                rc = sock_intr_errno(timeo);
                if (signal_pending(current))
                        goto out;
        }

        if (sk->sk_state == TCP_CLOSE)
                goto sock_error;

        sock->state = SS_CONNECTED;
        rc = 0;
out:
        release_sock(sk);
        return rc;
sock_error:
        rc = sock_error(sk) ? : -ECONNABORTED;
        sock->state = SS_UNCONNECTED;
        goto out;
}

/**
 *        llc_ui_listen - allow a normal socket to accept incoming connections
 *        @sock: Socket to allow incoming connections on.
 *        @backlog: Number of connections to queue.
 *
 *        Allow a normal socket to accept incoming connections.
 *        Returns 0 upon success, negative otherwise.
 */
static int llc_ui_listen(struct socket *sock, int backlog)
{
        struct sock *sk = sock->sk;
        int rc = -EINVAL;

        lock_sock(sk);
        if (unlikely(sock->state != SS_UNCONNECTED))
                goto out;
        rc = -EOPNOTSUPP;
        if (unlikely(sk->sk_type != SOCK_STREAM))
                goto out;
        rc = -EAGAIN;
        if (sock_flag(sk, SOCK_ZAPPED))
                goto out;
        rc = 0;
        if (!(unsigned int)backlog)        /* BSDism */
                backlog = 1;
        sk->sk_max_ack_backlog = backlog;
        if (sk->sk_state != TCP_LISTEN) {
                sk->sk_ack_backlog = 0;
                sk->sk_state           = TCP_LISTEN;
        }
        sk->sk_socket->flags |= __SO_ACCEPTCON;
out:
        release_sock(sk);
        return rc;
}

static int llc_ui_wait_for_disc(struct sock *sk, long timeout)
{
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        int rc = 0;

        add_wait_queue(sk_sleep(sk), &wait);
        while (1) {
                if (sk_wait_event(sk, &timeout,
                                  READ_ONCE(sk->sk_state) == TCP_CLOSE, &wait))
                        break;
                rc = -ERESTARTSYS;
                if (signal_pending(current))
                        break;
                rc = -EAGAIN;
                if (!timeout)
                        break;
                rc = 0;
        }
        remove_wait_queue(sk_sleep(sk), &wait);
        return rc;
}

static bool llc_ui_wait_for_conn(struct sock *sk, long timeout)
{
        DEFINE_WAIT_FUNC(wait, woken_wake_function);

        add_wait_queue(sk_sleep(sk), &wait);
        while (1) {
                if (sk_wait_event(sk, &timeout,
                                  READ_ONCE(sk->sk_state) != TCP_SYN_SENT, &wait))
                        break;
                if (signal_pending(current) || !timeout)
                        break;
        }
        remove_wait_queue(sk_sleep(sk), &wait);
        return timeout;
}

static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout)
{
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        struct llc_sock *llc = llc_sk(sk);
        int rc;

        add_wait_queue(sk_sleep(sk), &wait);
        while (1) {
                rc = 0;
                if (sk_wait_event(sk, &timeout,
                                  (READ_ONCE(sk->sk_shutdown) & RCV_SHUTDOWN) ||
                                  (!llc_data_accept_state(llc->state) &&
                                   !llc->remote_busy_flag &&
                                   !llc->p_flag), &wait))
                        break;
                rc = -ERESTARTSYS;
                if (signal_pending(current))
                        break;
                rc = -EAGAIN;
                if (!timeout)
                        break;
        }
        remove_wait_queue(sk_sleep(sk), &wait);
        return rc;
}

static int llc_wait_data(struct sock *sk, long timeo)
{
        int rc;

        while (1) {
                /*
                 * POSIX 1003.1g mandates this order.
                 */
                rc = sock_error(sk);
                if (rc)
                        break;
                rc = 0;
                if (sk->sk_shutdown & RCV_SHUTDOWN)
                        break;
                rc = -EAGAIN;
                if (!timeo)
                        break;
                rc = sock_intr_errno(timeo);
                if (signal_pending(current))
                        break;
                rc = 0;
                if (sk_wait_data(sk, &timeo, NULL))
                        break;
        }
        return rc;
}

static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
{
        struct llc_sock *llc = llc_sk(skb->sk);

        if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
                struct llc_pktinfo info;

                memset(&info, 0, sizeof(info));
                info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
                llc_pdu_decode_dsap(skb, &info.lpi_sap);
                llc_pdu_decode_da(skb, info.lpi_mac);
                put_cmsg(msg, SOL_LLC, LLC_OPT_PKTINFO, sizeof(info), &info);
        }
}

/**
 *        llc_ui_accept - accept a new incoming connection.
 *        @sock: Socket which connections arrive on.
 *        @newsock: Socket to move incoming connection to.
 *        @arg: User specified arguments
 *
 *        Accept a new incoming connection.
 *        Returns 0 upon success, negative otherwise.
 */
static int llc_ui_accept(struct socket *sock, struct socket *newsock,
                         struct proto_accept_arg *arg)
{
        struct sock *sk = sock->sk, *newsk;
        struct llc_sock *llc, *newllc;
        struct sk_buff *skb;
        int rc = -EOPNOTSUPP;

        dprintk("%s: accepting on %02X\n", __func__,
                llc_sk(sk)->laddr.lsap);
        lock_sock(sk);
        if (unlikely(sk->sk_type != SOCK_STREAM))
                goto out;
        rc = -EINVAL;
        if (unlikely(sock->state != SS_UNCONNECTED ||
                     sk->sk_state != TCP_LISTEN))
                goto out;
        /* wait for a connection to arrive. */
        if (skb_queue_empty(&sk->sk_receive_queue)) {
                rc = llc_wait_data(sk, sk->sk_rcvtimeo);
                if (rc)
                        goto out;
        }
        dprintk("%s: got a new connection on %02X\n", __func__,
                llc_sk(sk)->laddr.lsap);
        skb = skb_dequeue(&sk->sk_receive_queue);
        rc = -EINVAL;
        if (!skb->sk)
                goto frees;
        rc = 0;
        newsk = skb->sk;
        /* attach connection to a new socket. */
        llc_ui_sk_init(newsock, newsk);
        sock_reset_flag(newsk, SOCK_ZAPPED);
        newsk->sk_state                = TCP_ESTABLISHED;
        newsock->state                = SS_CONNECTED;
        llc                        = llc_sk(sk);
        newllc                        = llc_sk(newsk);
        memcpy(&newllc->addr, &llc->addr, sizeof(newllc->addr));
        newllc->link = llc_ui_next_link_no(newllc->laddr.lsap);

        /* put original socket back into a clean listen state. */
        sk->sk_state = TCP_LISTEN;
        sk_acceptq_removed(sk);
        dprintk("%s: ok success on %02X, client on %02X\n", __func__,
                llc_sk(sk)->addr.sllc_sap, newllc->daddr.lsap);
frees:
        kfree_skb(skb);
out:
        release_sock(sk);
        return rc;
}

/**
 *        llc_ui_recvmsg - copy received data to the socket user.
 *        @sock: Socket to copy data from.
 *        @msg: Various user space related information.
 *        @len: Size of user buffer.
 *        @flags: User specified flags.
 *
 *        Copy received data to the socket user.
 *        Returns non-negative upon success, negative otherwise.
 */
static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                          int flags)
{
        DECLARE_SOCKADDR(struct sockaddr_llc *, uaddr, msg->msg_name);
        const int nonblock = flags & MSG_DONTWAIT;
        struct sk_buff *skb = NULL;
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        size_t copied = 0;
        u32 peek_seq = 0;
        u32 *seq, skb_len;
        unsigned long used;
        int target;        /* Read at least this many bytes */
        long timeo;

        lock_sock(sk);
        copied = -ENOTCONN;
        if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
                goto out;

        timeo = sock_rcvtimeo(sk, nonblock);

        seq = &llc->copied_seq;
        if (flags & MSG_PEEK) {
                peek_seq = llc->copied_seq;
                seq = &peek_seq;
        }

        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
        copied = 0;

        do {
                u32 offset;

                /*
                 * We need to check signals first, to get correct SIGURG
                 * handling. FIXME: Need to check this doesn't impact 1003.1g
                 * and move it down to the bottom of the loop
                 */
                if (signal_pending(current)) {
                        if (copied)
                                break;
                        copied = timeo ? sock_intr_errno(timeo) : -EAGAIN;
                        break;
                }

                /* Next get a buffer. */

                skb = skb_peek(&sk->sk_receive_queue);
                if (skb) {
                        offset = *seq;
                        goto found_ok_skb;
                }
                /* Well, if we have backlog, try to process it now yet. */

                if (copied >= target && !READ_ONCE(sk->sk_backlog.tail))
                        break;

                if (copied) {
                        if (sk->sk_err ||
                            sk->sk_state == TCP_CLOSE ||
                            (sk->sk_shutdown & RCV_SHUTDOWN) ||
                            !timeo ||
                            (flags & MSG_PEEK))
                                break;
                } else {
                        if (sock_flag(sk, SOCK_DONE))
                                break;

                        if (sk->sk_err) {
                                copied = sock_error(sk);
                                break;
                        }
                        if (sk->sk_shutdown & RCV_SHUTDOWN)
                                break;

                        if (sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_CLOSE) {
                                if (!sock_flag(sk, SOCK_DONE)) {
                                        /*
                                         * This occurs when user tries to read
                                         * from never connected socket.
                                         */
                                        copied = -ENOTCONN;
                                        break;
                                }
                                break;
                        }
                        if (!timeo) {
                                copied = -EAGAIN;
                                break;
                        }
                }

                if (copied >= target) { /* Do not sleep, just process backlog. */
                        release_sock(sk);
                        lock_sock(sk);
                } else
                        sk_wait_data(sk, &timeo, NULL);

                if ((flags & MSG_PEEK) && peek_seq != llc->copied_seq) {
                        net_dbg_ratelimited("LLC(%s:%d): Application bug, race in MSG_PEEK\n",
                                            current->comm,
                                            task_pid_nr(current));
                        peek_seq = llc->copied_seq;
                }
                continue;
        found_ok_skb:
                skb_len = skb->len;
                /* Ok so how much can we use? */
                used = skb->len - offset;
                if (len < used)
                        used = len;

                if (!(flags & MSG_TRUNC)) {
                        int rc = skb_copy_datagram_msg(skb, offset, msg, used);
                        if (rc) {
                                /* Exception. Bailout! */
                                if (!copied)
                                        copied = -EFAULT;
                                break;
                        }
                }

                *seq += used;
                copied += used;
                len -= used;

                /* For non stream protcols we get one packet per recvmsg call */
                if (sk->sk_type != SOCK_STREAM)
                        goto copy_uaddr;

                if (!(flags & MSG_PEEK)) {
                        skb_unlink(skb, &sk->sk_receive_queue);
                        kfree_skb(skb);
                        *seq = 0;
                }

                /* Partial read */
                if (used + offset < skb_len)
                        continue;
        } while (len > 0);

out:
        release_sock(sk);
        return copied;
copy_uaddr:
        if (uaddr != NULL && skb != NULL) {
                memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
                msg->msg_namelen = sizeof(*uaddr);
        }
        if (llc_sk(sk)->cmsg_flags)
                llc_cmsg_rcv(msg, skb);

        if (!(flags & MSG_PEEK)) {
                skb_unlink(skb, &sk->sk_receive_queue);
                kfree_skb(skb);
                *seq = 0;
        }

        goto out;
}

/**
 *        llc_ui_sendmsg - Transmit data provided by the socket user.
 *        @sock: Socket to transmit data from.
 *        @msg: Various user related information.
 *        @len: Length of data to transmit.
 *
 *        Transmit data provided by the socket user.
 *        Returns non-negative upon success, negative otherwise.
 */
static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
{
        DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        int flags = msg->msg_flags;
        int noblock = flags & MSG_DONTWAIT;
        int rc = -EINVAL, copied = 0, hdrlen, hh_len;
        struct sk_buff *skb = NULL;
        struct net_device *dev;
        size_t size = 0;

        dprintk("%s: sending from %02X to %02X\n", __func__,
                llc->laddr.lsap, llc->daddr.lsap);
        lock_sock(sk);
        if (addr) {
                if (msg->msg_namelen < sizeof(*addr))
                        goto out;
        } else {
                if (llc_ui_addr_null(&llc->addr))
                        goto out;
                addr = &llc->addr;
        }
        /* must bind connection to sap if user hasn't done it. */
        if (sock_flag(sk, SOCK_ZAPPED)) {
                /* bind to sap with null dev, exclusive. */
                rc = llc_ui_autobind(sock, addr);
                if (rc)
                        goto out;
        }
        dev = llc->dev;
        hh_len = LL_RESERVED_SPACE(dev);
        hdrlen = llc_ui_header_len(sk, addr);
        size = hdrlen + len;
        size = min_t(size_t, size, READ_ONCE(dev->mtu));
        copied = size - hdrlen;
        rc = -EINVAL;
        if (copied < 0)
                goto out;
        release_sock(sk);
        skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc);
        lock_sock(sk);
        if (!skb)
                goto out;
        if (sock_flag(sk, SOCK_ZAPPED) ||
            llc->dev != dev ||
            hdrlen != llc_ui_header_len(sk, addr) ||
            hh_len != LL_RESERVED_SPACE(dev) ||
            size > READ_ONCE(dev->mtu))
                goto out;
        skb->dev      = dev;
        skb->protocol = llc_proto_type(addr->sllc_arphrd);
        skb_reserve(skb, hh_len + hdrlen);
        rc = memcpy_from_msg(skb_put(skb, copied), msg, copied);
        if (rc)
                goto out;
        if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
                llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
                                          addr->sllc_sap);
                skb = NULL;
                goto out;
        }
        if (addr->sllc_test) {
                llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
                                            addr->sllc_sap);
                skb = NULL;
                goto out;
        }
        if (addr->sllc_xid) {
                llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
                                           addr->sllc_sap);
                skb = NULL;
                goto out;
        }
        rc = -ENOPROTOOPT;
        if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
                goto out;
        rc = llc_ui_send_data(sk, skb, noblock);
        skb = NULL;
out:
        kfree_skb(skb);
        if (rc)
                dprintk("%s: failed sending from %02X to %02X: %d\n",
                        __func__, llc->laddr.lsap, llc->daddr.lsap, rc);
        release_sock(sk);
        return rc ? : copied;
}

/**
 *        llc_ui_getname - return the address info of a socket
 *        @sock: Socket to get address of.
 *        @uaddr: Address structure to return information.
 *        @peer: Does user want local or remote address information.
 *
 *        Return the address information of a socket.
 */
static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
                          int peer)
{
        struct sockaddr_llc sllc;
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        int rc = -EBADF;

        memset(&sllc, 0, sizeof(sllc));
        lock_sock(sk);
        if (sock_flag(sk, SOCK_ZAPPED))
                goto out;
        if (peer) {
                rc = -ENOTCONN;
                if (sk->sk_state != TCP_ESTABLISHED)
                        goto out;
                if(llc->dev)
                        sllc.sllc_arphrd = llc->dev->type;
                sllc.sllc_sap = llc->daddr.lsap;
                memcpy(&sllc.sllc_mac, &llc->daddr.mac, IFHWADDRLEN);
        } else {
                rc = -EINVAL;
                if (!llc->sap)
                        goto out;
                sllc.sllc_sap = llc->sap->laddr.lsap;

                if (llc->dev) {
                        sllc.sllc_arphrd = llc->dev->type;
                        memcpy(&sllc.sllc_mac, llc->dev->dev_addr,
                               IFHWADDRLEN);
                }
        }
        sllc.sllc_family = AF_LLC;
        memcpy(uaddr, &sllc, sizeof(sllc));
        rc = sizeof(sllc);
out:
        release_sock(sk);
        return rc;
}

/**
 *        llc_ui_ioctl - io controls for PF_LLC
 *        @sock: Socket to get/set info
 *        @cmd: command
 *        @arg: optional argument for cmd
 *
 *        get/set info on llc sockets
 */
static int llc_ui_ioctl(struct socket *sock, unsigned int cmd,
                        unsigned long arg)
{
        return -ENOIOCTLCMD;
}

/**
 *        llc_ui_setsockopt - set various connection specific parameters.
 *        @sock: Socket to set options on.
 *        @level: Socket level user is requesting operations on.
 *        @optname: Operation name.
 *        @optval: User provided operation data.
 *        @optlen: Length of optval.
 *
 *        Set various connection specific parameters.
 */
static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
                             sockptr_t optval, unsigned int optlen)
{
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        unsigned int opt;
        int rc = -EINVAL;

        lock_sock(sk);
        if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
                goto out;
        rc = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
        if (rc)
                goto out;
        rc = -EINVAL;
        switch (optname) {
        case LLC_OPT_RETRY:
                if (opt > LLC_OPT_MAX_RETRY)
                        goto out;
                llc->n2 = opt;
                break;
        case LLC_OPT_SIZE:
                if (opt > LLC_OPT_MAX_SIZE)
                        goto out;
                llc->n1 = opt;
                break;
        case LLC_OPT_ACK_TMR_EXP:
                if (opt > LLC_OPT_MAX_ACK_TMR_EXP)
                        goto out;
                llc->ack_timer.expire = opt * HZ;
                break;
        case LLC_OPT_P_TMR_EXP:
                if (opt > LLC_OPT_MAX_P_TMR_EXP)
                        goto out;
                llc->pf_cycle_timer.expire = opt * HZ;
                break;
        case LLC_OPT_REJ_TMR_EXP:
                if (opt > LLC_OPT_MAX_REJ_TMR_EXP)
                        goto out;
                llc->rej_sent_timer.expire = opt * HZ;
                break;
        case LLC_OPT_BUSY_TMR_EXP:
                if (opt > LLC_OPT_MAX_BUSY_TMR_EXP)
                        goto out;
                llc->busy_state_timer.expire = opt * HZ;
                break;
        case LLC_OPT_TX_WIN:
                if (opt > LLC_OPT_MAX_WIN)
                        goto out;
                llc->k = opt;
                break;
        case LLC_OPT_RX_WIN:
                if (opt > LLC_OPT_MAX_WIN)
                        goto out;
                llc->rw = opt;
                break;
        case LLC_OPT_PKTINFO:
                if (opt)
                        llc->cmsg_flags |= LLC_CMSG_PKTINFO;
                else
                        llc->cmsg_flags &= ~LLC_CMSG_PKTINFO;
                break;
        default:
                rc = -ENOPROTOOPT;
                goto out;
        }
        rc = 0;
out:
        release_sock(sk);
        return rc;
}

/**
 *        llc_ui_getsockopt - get connection specific socket info
 *        @sock: Socket to get information from.
 *        @level: Socket level user is requesting operations on.
 *        @optname: Operation name.
 *        @optval: Variable to return operation data in.
 *        @optlen: Length of optval.
 *
 *        Get connection specific socket information.
 */
static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
                             char __user *optval, int __user *optlen)
{
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
        int val = 0, len = 0, rc = -EINVAL;

        lock_sock(sk);
        if (unlikely(level != SOL_LLC))
                goto out;
        rc = get_user(len, optlen);
        if (rc)
                goto out;
        rc = -EINVAL;
        if (len != sizeof(int))
                goto out;
        switch (optname) {
        case LLC_OPT_RETRY:
                val = llc->n2;                                        break;
        case LLC_OPT_SIZE:
                val = llc->n1;                                        break;
        case LLC_OPT_ACK_TMR_EXP:
                val = llc->ack_timer.expire / HZ;                break;
        case LLC_OPT_P_TMR_EXP:
                val = llc->pf_cycle_timer.expire / HZ;                break;
        case LLC_OPT_REJ_TMR_EXP:
                val = llc->rej_sent_timer.expire / HZ;                break;
        case LLC_OPT_BUSY_TMR_EXP:
                val = llc->busy_state_timer.expire / HZ;        break;
        case LLC_OPT_TX_WIN:
                val = llc->k;                                break;
        case LLC_OPT_RX_WIN:
                val = llc->rw;                                break;
        case LLC_OPT_PKTINFO:
                val = (llc->cmsg_flags & LLC_CMSG_PKTINFO) != 0;
                break;
        default:
                rc = -ENOPROTOOPT;
                goto out;
        }
        rc = 0;
        if (put_user(len, optlen) || copy_to_user(optval, &val, len))
                rc = -EFAULT;
out:
        release_sock(sk);
        return rc;
}

static const struct net_proto_family llc_ui_family_ops = {
        .family = PF_LLC,
        .create = llc_ui_create,
        .owner        = THIS_MODULE,
};

static const struct proto_ops llc_ui_ops = {
        .family             = PF_LLC,
        .owner       = THIS_MODULE,
        .release     = llc_ui_release,
        .bind             = llc_ui_bind,
        .connect     = llc_ui_connect,
        .socketpair  = sock_no_socketpair,
        .accept      = llc_ui_accept,
        .getname     = llc_ui_getname,
        .poll             = datagram_poll,
        .ioctl       = llc_ui_ioctl,
        .listen      = llc_ui_listen,
        .shutdown    = llc_ui_shutdown,
        .setsockopt  = llc_ui_setsockopt,
        .getsockopt  = llc_ui_getsockopt,
        .sendmsg     = llc_ui_sendmsg,
        .recvmsg     = llc_ui_recvmsg,
        .mmap             = sock_no_mmap,
};

static const char llc_proc_err_msg[] __initconst =
        KERN_CRIT "LLC: Unable to register the proc_fs entries\n";
static const char llc_sysctl_err_msg[] __initconst =
        KERN_CRIT "LLC: Unable to register the sysctl entries\n";
static const char llc_sock_err_msg[] __initconst =
        KERN_CRIT "LLC: Unable to register the network family\n";

static int __init llc2_init(void)
{
        int rc = proto_register(&llc_proto, 0);

        if (rc != 0)
                goto out;

        llc_build_offset_table();
        llc_station_init();
        llc_ui_sap_last_autoport = LLC_SAP_DYN_START;
        rc = llc_proc_init();
        if (rc != 0) {
                printk(llc_proc_err_msg);
                goto out_station;
        }
        rc = llc_sysctl_init();
        if (rc) {
                printk(llc_sysctl_err_msg);
                goto out_proc;
        }
        rc = sock_register(&llc_ui_family_ops);
        if (rc) {
                printk(llc_sock_err_msg);
                goto out_sysctl;
        }
        llc_add_pack(LLC_DEST_SAP, llc_sap_handler);
        llc_add_pack(LLC_DEST_CONN, llc_conn_handler);
out:
        return rc;
out_sysctl:
        llc_sysctl_exit();
out_proc:
        llc_proc_exit();
out_station:
        llc_station_exit();
        proto_unregister(&llc_proto);
        goto out;
}

static void __exit llc2_exit(void)
{
        llc_station_exit();
        llc_remove_pack(LLC_DEST_SAP);
        llc_remove_pack(LLC_DEST_CONN);
        sock_unregister(PF_LLC);
        llc_proc_exit();
        llc_sysctl_exit();
        proto_unregister(&llc_proto);
}

module_init(llc2_init);
module_exit(llc2_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Procom 1997, Jay Schullist 2001, Arnaldo C. Melo 2001-2003");
MODULE_DESCRIPTION("IEEE 802.2 PF_LLC support");
MODULE_ALIAS_NETPROTO(PF_LLC);




















































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    3 





































    3 









    2 
















    1 

















































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
// SPDX-License-Identifier: GPL-2.0-only
/*
 *  HID driver for Logitech receivers
 *
 *  Copyright (c) 2011 Logitech
 */



#include <linux/device.h>
#include <linux/hid.h>
#include <linux/module.h>
#include <linux/kfifo.h>
#include <linux/delay.h>
#include <linux/usb.h> /* For to_usb_interface for kvm extra intf check */
#include <linux/unaligned.h>
#include "hid-ids.h"

#define DJ_MAX_PAIRED_DEVICES                        7
#define DJ_MAX_NUMBER_NOTIFS                        8
#define DJ_RECEIVER_INDEX                        0
#define DJ_DEVICE_INDEX_MIN                        1
#define DJ_DEVICE_INDEX_MAX                        7

#define DJREPORT_SHORT_LENGTH                        15
#define DJREPORT_LONG_LENGTH                        32

#define REPORT_ID_DJ_SHORT                        0x20
#define REPORT_ID_DJ_LONG                        0x21

#define REPORT_ID_HIDPP_SHORT                        0x10
#define REPORT_ID_HIDPP_LONG                        0x11
#define REPORT_ID_HIDPP_VERY_LONG                0x12

#define HIDPP_REPORT_SHORT_LENGTH                7
#define HIDPP_REPORT_LONG_LENGTH                20

#define HIDPP_RECEIVER_INDEX                        0xff

#define REPORT_TYPE_RFREPORT_FIRST                0x01
#define REPORT_TYPE_RFREPORT_LAST                0x1F

/* Command Switch to DJ mode */
#define REPORT_TYPE_CMD_SWITCH                        0x80
#define CMD_SWITCH_PARAM_DEVBITFIELD                0x00
#define CMD_SWITCH_PARAM_TIMEOUT_SECONDS        0x01
#define TIMEOUT_NO_KEEPALIVE                        0x00

/* Command to Get the list of Paired devices */
#define REPORT_TYPE_CMD_GET_PAIRED_DEVICES        0x81

/* Device Paired Notification */
#define REPORT_TYPE_NOTIF_DEVICE_PAIRED                0x41
#define SPFUNCTION_MORE_NOTIF_EXPECTED                0x01
#define SPFUNCTION_DEVICE_LIST_EMPTY                0x02
#define DEVICE_PAIRED_PARAM_SPFUNCTION                0x00
#define DEVICE_PAIRED_PARAM_EQUAD_ID_LSB        0x01
#define DEVICE_PAIRED_PARAM_EQUAD_ID_MSB        0x02
#define DEVICE_PAIRED_RF_REPORT_TYPE                0x03

/* Device Un-Paired Notification */
#define REPORT_TYPE_NOTIF_DEVICE_UNPAIRED        0x40

/* Connection Status Notification */
#define REPORT_TYPE_NOTIF_CONNECTION_STATUS        0x42
#define CONNECTION_STATUS_PARAM_STATUS                0x00
#define STATUS_LINKLOSS                                0x01

/* Error Notification */
#define REPORT_TYPE_NOTIF_ERROR                        0x7F
#define NOTIF_ERROR_PARAM_ETYPE                        0x00
#define ETYPE_KEEPALIVE_TIMEOUT                        0x01

/* supported DJ HID && RF report types */
#define REPORT_TYPE_KEYBOARD                        0x01
#define REPORT_TYPE_MOUSE                        0x02
#define REPORT_TYPE_CONSUMER_CONTROL                0x03
#define REPORT_TYPE_SYSTEM_CONTROL                0x04
#define REPORT_TYPE_MEDIA_CENTER                0x08
#define REPORT_TYPE_LEDS                        0x0E

/* RF Report types bitfield */
#define STD_KEYBOARD                                BIT(1)
#define STD_MOUSE                                BIT(2)
#define MULTIMEDIA                                BIT(3)
#define POWER_KEYS                                BIT(4)
#define KBD_MOUSE                                BIT(5)
#define MEDIA_CENTER                                BIT(8)
#define KBD_LEDS                                BIT(14)
/* Fake (bitnr > NUMBER_OF_HID_REPORTS) bit to track HID++ capability */
#define HIDPP                                        BIT_ULL(63)

/* HID++ Device Connected Notification */
#define REPORT_TYPE_NOTIF_DEVICE_CONNECTED        0x41
#define HIDPP_PARAM_PROTO_TYPE                        0x00
#define HIDPP_PARAM_DEVICE_INFO                        0x01
#define HIDPP_PARAM_EQUAD_LSB                        0x02
#define HIDPP_PARAM_EQUAD_MSB                        0x03
#define HIDPP_PARAM_27MHZ_DEVID                        0x03
#define HIDPP_DEVICE_TYPE_MASK                        GENMASK(3, 0)
#define HIDPP_LINK_STATUS_MASK                        BIT(6)
#define HIDPP_MANUFACTURER_MASK                        BIT(7)
#define HIDPP_27MHZ_SECURE_MASK                        BIT(7)

#define HIDPP_DEVICE_TYPE_KEYBOARD                1
#define HIDPP_DEVICE_TYPE_MOUSE                        2

#define HIDPP_SET_REGISTER                        0x80
#define HIDPP_GET_LONG_REGISTER                        0x83
#define HIDPP_REG_CONNECTION_STATE                0x02
#define HIDPP_REG_PAIRING_INFORMATION                0xB5
#define HIDPP_PAIRING_INFORMATION                0x20
#define HIDPP_FAKE_DEVICE_ARRIVAL                0x02

enum recvr_type {
        recvr_type_dj,
        recvr_type_hidpp,
        recvr_type_gaming_hidpp,
        recvr_type_mouse_only,
        recvr_type_27mhz,
        recvr_type_bluetooth,
        recvr_type_dinovo,
};

struct dj_report {
        u8 report_id;
        u8 device_index;
        u8 report_type;
        u8 report_params[DJREPORT_SHORT_LENGTH - 3];
};

struct hidpp_event {
        u8 report_id;
        u8 device_index;
        u8 sub_id;
        u8 params[HIDPP_REPORT_LONG_LENGTH - 3U];
} __packed;

struct dj_receiver_dev {
        struct hid_device *mouse;
        struct hid_device *keyboard;
        struct hid_device *hidpp;
        struct dj_device *paired_dj_devices[DJ_MAX_PAIRED_DEVICES +
                                            DJ_DEVICE_INDEX_MIN];
        struct list_head list;
        struct kref kref;
        struct work_struct work;
        struct kfifo notif_fifo;
        unsigned long last_query; /* in jiffies */
        bool ready;
        enum recvr_type type;
        unsigned int unnumbered_application;
        spinlock_t lock;
};

struct dj_device {
        struct hid_device *hdev;
        struct dj_receiver_dev *dj_receiver_dev;
        u64 reports_supported;
        u8 device_index;
};

#define WORKITEM_TYPE_EMPTY        0
#define WORKITEM_TYPE_PAIRED        1
#define WORKITEM_TYPE_UNPAIRED        2
#define WORKITEM_TYPE_UNKNOWN        255

struct dj_workitem {
        u8 type;                /* WORKITEM_TYPE_* */
        u8 device_index;
        u8 device_type;
        u8 quad_id_msb;
        u8 quad_id_lsb;
        u64 reports_supported;
};

/* Keyboard descriptor (1) */
static const char kbd_descriptor[] = {
        0x05, 0x01,                /* USAGE_PAGE (generic Desktop)     */
        0x09, 0x06,                /* USAGE (Keyboard)         */
        0xA1, 0x01,                /* COLLECTION (Application)     */
        0x85, 0x01,                /* REPORT_ID (1)            */
        0x95, 0x08,                /*   REPORT_COUNT (8)           */
        0x75, 0x01,                /*   REPORT_SIZE (1)            */
        0x15, 0x00,                /*   LOGICAL_MINIMUM (0)        */
        0x25, 0x01,                /*   LOGICAL_MAXIMUM (1)        */
        0x05, 0x07,                /*   USAGE_PAGE (Keyboard)      */
        0x19, 0xE0,                /*   USAGE_MINIMUM (Left Control)   */
        0x29, 0xE7,                /*   USAGE_MAXIMUM (Right GUI)      */
        0x81, 0x02,                /*   INPUT (Data,Var,Abs)       */
        0x95, 0x06,                /*   REPORT_COUNT (6)           */
        0x75, 0x08,                /*   REPORT_SIZE (8)            */
        0x15, 0x00,                /*   LOGICAL_MINIMUM (0)        */
        0x26, 0xFF, 0x00,        /*   LOGICAL_MAXIMUM (255)      */
        0x05, 0x07,                /*   USAGE_PAGE (Keyboard)      */
        0x19, 0x00,                /*   USAGE_MINIMUM (no event)       */
        0x2A, 0xFF, 0x00,        /*   USAGE_MAXIMUM (reserved)       */
        0x81, 0x00,                /*   INPUT (Data,Ary,Abs)       */
        0x85, 0x0e,                /* REPORT_ID (14)               */
        0x05, 0x08,                /*   USAGE PAGE (LED page)      */
        0x95, 0x05,                /*   REPORT COUNT (5)           */
        0x75, 0x01,                /*   REPORT SIZE (1)            */
        0x15, 0x00,                /*   LOGICAL_MINIMUM (0)        */
        0x25, 0x01,                /*   LOGICAL_MAXIMUM (1)        */
        0x19, 0x01,                /*   USAGE MINIMUM (1)          */
        0x29, 0x05,                /*   USAGE MAXIMUM (5)          */
        0x91, 0x02,                /*   OUTPUT (Data, Variable, Absolute)  */
        0x95, 0x01,                /*   REPORT COUNT (1)           */
        0x75, 0x03,                /*   REPORT SIZE (3)            */
        0x91, 0x01,                /*   OUTPUT (Constant)          */
        0xC0
};

/* Mouse descriptor (2)     */
static const char mse_descriptor[] = {
        0x05, 0x01,                /*  USAGE_PAGE (Generic Desktop)        */
        0x09, 0x02,                /*  USAGE (Mouse)                       */
        0xA1, 0x01,                /*  COLLECTION (Application)            */
        0x85, 0x02,                /*    REPORT_ID = 2                     */
        0x09, 0x01,                /*    USAGE (pointer)                   */
        0xA1, 0x00,                /*    COLLECTION (physical)             */
        0x05, 0x09,                /*      USAGE_PAGE (buttons)            */
        0x19, 0x01,                /*      USAGE_MIN (1)                   */
        0x29, 0x10,                /*      USAGE_MAX (16)                  */
        0x15, 0x00,                /*      LOGICAL_MIN (0)                 */
        0x25, 0x01,                /*      LOGICAL_MAX (1)                 */
        0x95, 0x10,                /*      REPORT_COUNT (16)               */
        0x75, 0x01,                /*      REPORT_SIZE (1)                 */
        0x81, 0x02,                /*      INPUT (data var abs)            */
        0x05, 0x01,                /*      USAGE_PAGE (generic desktop)    */
        0x16, 0x01, 0xF8,        /*      LOGICAL_MIN (-2047)             */
        0x26, 0xFF, 0x07,        /*      LOGICAL_MAX (2047)              */
        0x75, 0x0C,                /*      REPORT_SIZE (12)                */
        0x95, 0x02,                /*      REPORT_COUNT (2)                */
        0x09, 0x30,                /*      USAGE (X)                       */
        0x09, 0x31,                /*      USAGE (Y)                       */
        0x81, 0x06,                /*      INPUT                           */
        0x15, 0x81,                /*      LOGICAL_MIN (-127)              */
        0x25, 0x7F,                /*      LOGICAL_MAX (127)               */
        0x75, 0x08,                /*      REPORT_SIZE (8)                 */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x09, 0x38,                /*      USAGE (wheel)                   */
        0x81, 0x06,                /*      INPUT                           */
        0x05, 0x0C,                /*      USAGE_PAGE(consumer)            */
        0x0A, 0x38, 0x02,        /*      USAGE(AC Pan)                   */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x81, 0x06,                /*      INPUT                           */
        0xC0,                        /*    END_COLLECTION                    */
        0xC0,                        /*  END_COLLECTION                      */
};

/* Mouse descriptor (2) for 27 MHz receiver, only 8 buttons */
static const char mse_27mhz_descriptor[] = {
        0x05, 0x01,                /*  USAGE_PAGE (Generic Desktop)        */
        0x09, 0x02,                /*  USAGE (Mouse)                       */
        0xA1, 0x01,                /*  COLLECTION (Application)            */
        0x85, 0x02,                /*    REPORT_ID = 2                     */
        0x09, 0x01,                /*    USAGE (pointer)                   */
        0xA1, 0x00,                /*    COLLECTION (physical)             */
        0x05, 0x09,                /*      USAGE_PAGE (buttons)            */
        0x19, 0x01,                /*      USAGE_MIN (1)                   */
        0x29, 0x08,                /*      USAGE_MAX (8)                   */
        0x15, 0x00,                /*      LOGICAL_MIN (0)                 */
        0x25, 0x01,                /*      LOGICAL_MAX (1)                 */
        0x95, 0x08,                /*      REPORT_COUNT (8)                */
        0x75, 0x01,                /*      REPORT_SIZE (1)                 */
        0x81, 0x02,                /*      INPUT (data var abs)            */
        0x05, 0x01,                /*      USAGE_PAGE (generic desktop)    */
        0x16, 0x01, 0xF8,        /*      LOGICAL_MIN (-2047)             */
        0x26, 0xFF, 0x07,        /*      LOGICAL_MAX (2047)              */
        0x75, 0x0C,                /*      REPORT_SIZE (12)                */
        0x95, 0x02,                /*      REPORT_COUNT (2)                */
        0x09, 0x30,                /*      USAGE (X)                       */
        0x09, 0x31,                /*      USAGE (Y)                       */
        0x81, 0x06,                /*      INPUT                           */
        0x15, 0x81,                /*      LOGICAL_MIN (-127)              */
        0x25, 0x7F,                /*      LOGICAL_MAX (127)               */
        0x75, 0x08,                /*      REPORT_SIZE (8)                 */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x09, 0x38,                /*      USAGE (wheel)                   */
        0x81, 0x06,                /*      INPUT                           */
        0x05, 0x0C,                /*      USAGE_PAGE(consumer)            */
        0x0A, 0x38, 0x02,        /*      USAGE(AC Pan)                   */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x81, 0x06,                /*      INPUT                           */
        0xC0,                        /*    END_COLLECTION                    */
        0xC0,                        /*  END_COLLECTION                      */
};

/* Mouse descriptor (2) for Bluetooth receiver, low-res hwheel, 12 buttons */
static const char mse_bluetooth_descriptor[] = {
        0x05, 0x01,                /*  USAGE_PAGE (Generic Desktop)        */
        0x09, 0x02,                /*  USAGE (Mouse)                       */
        0xA1, 0x01,                /*  COLLECTION (Application)            */
        0x85, 0x02,                /*    REPORT_ID = 2                     */
        0x09, 0x01,                /*    USAGE (pointer)                   */
        0xA1, 0x00,                /*    COLLECTION (physical)             */
        0x05, 0x09,                /*      USAGE_PAGE (buttons)            */
        0x19, 0x01,                /*      USAGE_MIN (1)                   */
        0x29, 0x08,                /*      USAGE_MAX (8)                   */
        0x15, 0x00,                /*      LOGICAL_MIN (0)                 */
        0x25, 0x01,                /*      LOGICAL_MAX (1)                 */
        0x95, 0x08,                /*      REPORT_COUNT (8)                */
        0x75, 0x01,                /*      REPORT_SIZE (1)                 */
        0x81, 0x02,                /*      INPUT (data var abs)            */
        0x05, 0x01,                /*      USAGE_PAGE (generic desktop)    */
        0x16, 0x01, 0xF8,        /*      LOGICAL_MIN (-2047)             */
        0x26, 0xFF, 0x07,        /*      LOGICAL_MAX (2047)              */
        0x75, 0x0C,                /*      REPORT_SIZE (12)                */
        0x95, 0x02,                /*      REPORT_COUNT (2)                */
        0x09, 0x30,                /*      USAGE (X)                       */
        0x09, 0x31,                /*      USAGE (Y)                       */
        0x81, 0x06,                /*      INPUT                           */
        0x15, 0x81,                /*      LOGICAL_MIN (-127)              */
        0x25, 0x7F,                /*      LOGICAL_MAX (127)               */
        0x75, 0x08,                /*      REPORT_SIZE (8)                 */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x09, 0x38,                /*      USAGE (wheel)                   */
        0x81, 0x06,                /*      INPUT                           */
        0x05, 0x0C,                /*      USAGE_PAGE(consumer)            */
        0x0A, 0x38, 0x02,        /*      USAGE(AC Pan)                   */
        0x15, 0xF9,                /*      LOGICAL_MIN (-7)                */
        0x25, 0x07,                /*      LOGICAL_MAX (7)                 */
        0x75, 0x04,                /*      REPORT_SIZE (4)                 */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x81, 0x06,                /*      INPUT                           */
        0x05, 0x09,                /*      USAGE_PAGE (buttons)            */
        0x19, 0x09,                /*      USAGE_MIN (9)                   */
        0x29, 0x0C,                /*      USAGE_MAX (12)                  */
        0x15, 0x00,                /*      LOGICAL_MIN (0)                 */
        0x25, 0x01,                /*      LOGICAL_MAX (1)                 */
        0x75, 0x01,                /*      REPORT_SIZE (1)                 */
        0x95, 0x04,                /*      REPORT_COUNT (4)                */
        0x81, 0x02,                /*      INPUT (Data,Var,Abs)            */
        0xC0,                        /*    END_COLLECTION                    */
        0xC0,                        /*  END_COLLECTION                      */
};

/* Mouse descriptor (5) for Bluetooth receiver, normal-res hwheel, 8 buttons */
static const char mse5_bluetooth_descriptor[] = {
        0x05, 0x01,                /*  USAGE_PAGE (Generic Desktop)        */
        0x09, 0x02,                /*  Usage (Mouse)                       */
        0xa1, 0x01,                /*  Collection (Application)            */
        0x85, 0x05,                /*   Report ID (5)                      */
        0x09, 0x01,                /*   Usage (Pointer)                    */
        0xa1, 0x00,                /*   Collection (Physical)              */
        0x05, 0x09,                /*    Usage Page (Button)               */
        0x19, 0x01,                /*    Usage Minimum (1)                 */
        0x29, 0x08,                /*    Usage Maximum (8)                 */
        0x15, 0x00,                /*    Logical Minimum (0)               */
        0x25, 0x01,                /*    Logical Maximum (1)               */
        0x95, 0x08,                /*    Report Count (8)                  */
        0x75, 0x01,                /*    Report Size (1)                   */
        0x81, 0x02,                /*    Input (Data,Var,Abs)              */
        0x05, 0x01,                /*    Usage Page (Generic Desktop)      */
        0x16, 0x01, 0xf8,        /*    Logical Minimum (-2047)           */
        0x26, 0xff, 0x07,        /*    Logical Maximum (2047)            */
        0x75, 0x0c,                /*    Report Size (12)                  */
        0x95, 0x02,                /*    Report Count (2)                  */
        0x09, 0x30,                /*    Usage (X)                         */
        0x09, 0x31,                /*    Usage (Y)                         */
        0x81, 0x06,                /*    Input (Data,Var,Rel)              */
        0x15, 0x81,                /*    Logical Minimum (-127)            */
        0x25, 0x7f,                /*    Logical Maximum (127)             */
        0x75, 0x08,                /*    Report Size (8)                   */
        0x95, 0x01,                /*    Report Count (1)                  */
        0x09, 0x38,                /*    Usage (Wheel)                     */
        0x81, 0x06,                /*    Input (Data,Var,Rel)              */
        0x05, 0x0c,                /*    Usage Page (Consumer Devices)     */
        0x0a, 0x38, 0x02,        /*    Usage (AC Pan)                    */
        0x15, 0x81,                /*    Logical Minimum (-127)            */
        0x25, 0x7f,                /*    Logical Maximum (127)             */
        0x75, 0x08,                /*    Report Size (8)                   */
        0x95, 0x01,                /*    Report Count (1)                  */
        0x81, 0x06,                /*    Input (Data,Var,Rel)              */
        0xc0,                        /*   End Collection                     */
        0xc0,                        /*  End Collection                      */
};

/* Gaming Mouse descriptor (2) */
static const char mse_high_res_descriptor[] = {
        0x05, 0x01,                /*  USAGE_PAGE (Generic Desktop)        */
        0x09, 0x02,                /*  USAGE (Mouse)                       */
        0xA1, 0x01,                /*  COLLECTION (Application)            */
        0x85, 0x02,                /*    REPORT_ID = 2                     */
        0x09, 0x01,                /*    USAGE (pointer)                   */
        0xA1, 0x00,                /*    COLLECTION (physical)             */
        0x05, 0x09,                /*      USAGE_PAGE (buttons)            */
        0x19, 0x01,                /*      USAGE_MIN (1)                   */
        0x29, 0x10,                /*      USAGE_MAX (16)                  */
        0x15, 0x00,                /*      LOGICAL_MIN (0)                 */
        0x25, 0x01,                /*      LOGICAL_MAX (1)                 */
        0x95, 0x10,                /*      REPORT_COUNT (16)               */
        0x75, 0x01,                /*      REPORT_SIZE (1)                 */
        0x81, 0x02,                /*      INPUT (data var abs)            */
        0x05, 0x01,                /*      USAGE_PAGE (generic desktop)    */
        0x16, 0x01, 0x80,        /*      LOGICAL_MIN (-32767)            */
        0x26, 0xFF, 0x7F,        /*      LOGICAL_MAX (32767)             */
        0x75, 0x10,                /*      REPORT_SIZE (16)                */
        0x95, 0x02,                /*      REPORT_COUNT (2)                */
        0x09, 0x30,                /*      USAGE (X)                       */
        0x09, 0x31,                /*      USAGE (Y)                       */
        0x81, 0x06,                /*      INPUT                           */
        0x15, 0x81,                /*      LOGICAL_MIN (-127)              */
        0x25, 0x7F,                /*      LOGICAL_MAX (127)               */
        0x75, 0x08,                /*      REPORT_SIZE (8)                 */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x09, 0x38,                /*      USAGE (wheel)                   */
        0x81, 0x06,                /*      INPUT                           */
        0x05, 0x0C,                /*      USAGE_PAGE(consumer)            */
        0x0A, 0x38, 0x02,        /*      USAGE(AC Pan)                   */
        0x95, 0x01,                /*      REPORT_COUNT (1)                */
        0x81, 0x06,                /*      INPUT                           */
        0xC0,                        /*    END_COLLECTION                    */
        0xC0,                        /*  END_COLLECTION                      */
};

/* Consumer Control descriptor (3) */
static const char consumer_descriptor[] = {
        0x05, 0x0C,                /* USAGE_PAGE (Consumer Devices)       */
        0x09, 0x01,                /* USAGE (Consumer Control)            */
        0xA1, 0x01,                /* COLLECTION (Application)            */
        0x85, 0x03,                /* REPORT_ID = 3                       */
        0x75, 0x10,                /* REPORT_SIZE (16)                    */
        0x95, 0x02,                /* REPORT_COUNT (2)                    */
        0x15, 0x01,                /* LOGICAL_MIN (1)                     */
        0x26, 0xFF, 0x02,        /* LOGICAL_MAX (767)                   */
        0x19, 0x01,                /* USAGE_MIN (1)                       */
        0x2A, 0xFF, 0x02,        /* USAGE_MAX (767)                     */
        0x81, 0x00,                /* INPUT (Data Ary Abs)                */
        0xC0,                        /* END_COLLECTION                      */
};                                /*                                     */

/* System control descriptor (4) */
static const char syscontrol_descriptor[] = {
        0x05, 0x01,                /*   USAGE_PAGE (Generic Desktop)      */
        0x09, 0x80,                /*   USAGE (System Control)            */
        0xA1, 0x01,                /*   COLLECTION (Application)          */
        0x85, 0x04,                /*   REPORT_ID = 4                     */
        0x75, 0x02,                /*   REPORT_SIZE (2)                   */
        0x95, 0x01,                /*   REPORT_COUNT (1)                  */
        0x15, 0x01,                /*   LOGICAL_MIN (1)                   */
        0x25, 0x03,                /*   LOGICAL_MAX (3)                   */
        0x09, 0x82,                /*   USAGE (System Sleep)              */
        0x09, 0x81,                /*   USAGE (System Power Down)         */
        0x09, 0x83,                /*   USAGE (System Wake Up)            */
        0x81, 0x60,                /*   INPUT (Data Ary Abs NPrf Null)    */
        0x75, 0x06,                /*   REPORT_SIZE (6)                   */
        0x81, 0x03,                /*   INPUT (Cnst Var Abs)              */
        0xC0,                        /*   END_COLLECTION                    */
};

/* Media descriptor (8) */
static const char media_descriptor[] = {
        0x06, 0xbc, 0xff,        /* Usage Page 0xffbc                   */
        0x09, 0x88,                /* Usage 0x0088                        */
        0xa1, 0x01,                /* BeginCollection                     */
        0x85, 0x08,                /*   Report ID 8                       */
        0x19, 0x01,                /*   Usage Min 0x0001                  */
        0x29, 0xff,                /*   Usage Max 0x00ff                  */
        0x15, 0x01,                /*   Logical Min 1                     */
        0x26, 0xff, 0x00,        /*   Logical Max 255                   */
        0x75, 0x08,                /*   Report Size 8                     */
        0x95, 0x01,                /*   Report Count 1                    */
        0x81, 0x00,                /*   Input                             */
        0xc0,                        /* EndCollection                       */
};                                /*                                     */

/* HIDPP descriptor */
static const char hidpp_descriptor[] = {
        0x06, 0x00, 0xff,        /* Usage Page (Vendor Defined Page 1)  */
        0x09, 0x01,                /* Usage (Vendor Usage 1)              */
        0xa1, 0x01,                /* Collection (Application)            */
        0x85, 0x10,                /*   Report ID (16)                    */
        0x75, 0x08,                /*   Report Size (8)                   */
        0x95, 0x06,                /*   Report Count (6)                  */
        0x15, 0x00,                /*   Logical Minimum (0)               */
        0x26, 0xff, 0x00,        /*   Logical Maximum (255)             */
        0x09, 0x01,                /*   Usage (Vendor Usage 1)            */
        0x81, 0x00,                /*   Input (Data,Arr,Abs)              */
        0x09, 0x01,                /*   Usage (Vendor Usage 1)            */
        0x91, 0x00,                /*   Output (Data,Arr,Abs)             */
        0xc0,                        /* End Collection                      */
        0x06, 0x00, 0xff,        /* Usage Page (Vendor Defined Page 1)  */
        0x09, 0x02,                /* Usage (Vendor Usage 2)              */
        0xa1, 0x01,                /* Collection (Application)            */
        0x85, 0x11,                /*   Report ID (17)                    */
        0x75, 0x08,                /*   Report Size (8)                   */
        0x95, 0x13,                /*   Report Count (19)                 */
        0x15, 0x00,                /*   Logical Minimum (0)               */
        0x26, 0xff, 0x00,        /*   Logical Maximum (255)             */
        0x09, 0x02,                /*   Usage (Vendor Usage 2)            */
        0x81, 0x00,                /*   Input (Data,Arr,Abs)              */
        0x09, 0x02,                /*   Usage (Vendor Usage 2)            */
        0x91, 0x00,                /*   Output (Data,Arr,Abs)             */
        0xc0,                        /* End Collection                      */
        0x06, 0x00, 0xff,        /* Usage Page (Vendor Defined Page 1)  */
        0x09, 0x04,                /* Usage (Vendor Usage 0x04)           */
        0xa1, 0x01,                /* Collection (Application)            */
        0x85, 0x20,                /*   Report ID (32)                    */
        0x75, 0x08,                /*   Report Size (8)                   */
        0x95, 0x0e,                /*   Report Count (14)                 */
        0x15, 0x00,                /*   Logical Minimum (0)               */
        0x26, 0xff, 0x00,        /*   Logical Maximum (255)             */
        0x09, 0x41,                /*   Usage (Vendor Usage 0x41)         */
        0x81, 0x00,                /*   Input (Data,Arr,Abs)              */
        0x09, 0x41,                /*   Usage (Vendor Usage 0x41)         */
        0x91, 0x00,                /*   Output (Data,Arr,Abs)             */
        0x85, 0x21,                /*   Report ID (33)                    */
        0x95, 0x1f,                /*   Report Count (31)                 */
        0x15, 0x00,                /*   Logical Minimum (0)               */
        0x26, 0xff, 0x00,        /*   Logical Maximum (255)             */
        0x09, 0x42,                /*   Usage (Vendor Usage 0x42)         */
        0x81, 0x00,                /*   Input (Data,Arr,Abs)              */
        0x09, 0x42,                /*   Usage (Vendor Usage 0x42)         */
        0x91, 0x00,                /*   Output (Data,Arr,Abs)             */
        0xc0,                        /* End Collection                      */
};

/* Maximum size of all defined hid reports in bytes (including report id) */
#define MAX_REPORT_SIZE 8

/* Make sure all descriptors are present here */
#define MAX_RDESC_SIZE                                \
        (sizeof(kbd_descriptor) +                \
         sizeof(mse_bluetooth_descriptor) +        \
         sizeof(mse5_bluetooth_descriptor) +        \
         sizeof(consumer_descriptor) +                \
         sizeof(syscontrol_descriptor) +        \
         sizeof(media_descriptor) +        \
         sizeof(hidpp_descriptor))

/* Number of possible hid report types that can be created by this driver.
 *
 * Right now, RF report types have the same report types (or report id's)
 * than the hid report created from those RF reports. In the future
 * this doesnt have to be true.
 *
 * For instance, RF report type 0x01 which has a size of 8 bytes, corresponds
 * to hid report id 0x01, this is standard keyboard. Same thing applies to mice
 * reports and consumer control, etc. If a new RF report is created, it doesn't
 * has to have the same report id as its corresponding hid report, so an
 * translation may have to take place for future report types.
 */
#define NUMBER_OF_HID_REPORTS 32
static const u8 hid_reportid_size_map[NUMBER_OF_HID_REPORTS] = {
        [1] = 8,                /* Standard keyboard */
        [2] = 8,                /* Standard mouse */
        [3] = 5,                /* Consumer control */
        [4] = 2,                /* System control */
        [8] = 2,                /* Media Center */
};


#define LOGITECH_DJ_INTERFACE_NUMBER 0x02

static const struct hid_ll_driver logi_dj_ll_driver;

static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
static void delayedwork_callback(struct work_struct *work);

static LIST_HEAD(dj_hdev_list);
static DEFINE_MUTEX(dj_hdev_list_lock);

static bool recvr_type_is_bluetooth(enum recvr_type type)
{
        return type == recvr_type_bluetooth || type == recvr_type_dinovo;
}

/*
 * dj/HID++ receivers are really a single logical entity, but for BIOS/Windows
 * compatibility they have multiple USB interfaces. On HID++ receivers we need
 * to listen for input reports on both interfaces. The functions below are used
 * to create a single struct dj_receiver_dev for all interfaces belonging to
 * a single USB-device / receiver.
 */
static struct dj_receiver_dev *dj_find_receiver_dev(struct hid_device *hdev,
                                                    enum recvr_type type)
{
        struct dj_receiver_dev *djrcv_dev;
        char sep;

        /*
         * The bluetooth receiver contains a built-in hub and has separate
         * USB-devices for the keyboard and mouse interfaces.
         */
        sep = recvr_type_is_bluetooth(type) ? '.' : '/';

        /* Try to find an already-probed interface from the same device */
        list_for_each_entry(djrcv_dev, &dj_hdev_list, list) {
                if (djrcv_dev->mouse &&
                    hid_compare_device_paths(hdev, djrcv_dev->mouse, sep)) {
                        kref_get(&djrcv_dev->kref);
                        return djrcv_dev;
                }
                if (djrcv_dev->keyboard &&
                    hid_compare_device_paths(hdev, djrcv_dev->keyboard, sep)) {
                        kref_get(&djrcv_dev->kref);
                        return djrcv_dev;
                }
                if (djrcv_dev->hidpp &&
                    hid_compare_device_paths(hdev, djrcv_dev->hidpp, sep)) {
                        kref_get(&djrcv_dev->kref);
                        return djrcv_dev;
                }
        }

        return NULL;
}

static void dj_release_receiver_dev(struct kref *kref)
{
        struct dj_receiver_dev *djrcv_dev = container_of(kref, struct dj_receiver_dev, kref);

        list_del(&djrcv_dev->list);
        kfifo_free(&djrcv_dev->notif_fifo);
        kfree(djrcv_dev);
}

static void dj_put_receiver_dev(struct hid_device *hdev)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);

        mutex_lock(&dj_hdev_list_lock);

        if (djrcv_dev->mouse == hdev)
                djrcv_dev->mouse = NULL;
        if (djrcv_dev->keyboard == hdev)
                djrcv_dev->keyboard = NULL;
        if (djrcv_dev->hidpp == hdev)
                djrcv_dev->hidpp = NULL;

        kref_put(&djrcv_dev->kref, dj_release_receiver_dev);

        mutex_unlock(&dj_hdev_list_lock);
}

static struct dj_receiver_dev *dj_get_receiver_dev(struct hid_device *hdev,
                                                   enum recvr_type type,
                                                   unsigned int application,
                                                   bool is_hidpp)
{
        struct dj_receiver_dev *djrcv_dev;

        mutex_lock(&dj_hdev_list_lock);

        djrcv_dev = dj_find_receiver_dev(hdev, type);
        if (!djrcv_dev) {
                djrcv_dev = kzalloc(sizeof(*djrcv_dev), GFP_KERNEL);
                if (!djrcv_dev)
                        goto out;

                INIT_WORK(&djrcv_dev->work, delayedwork_callback);
                spin_lock_init(&djrcv_dev->lock);
                if (kfifo_alloc(&djrcv_dev->notif_fifo,
                            DJ_MAX_NUMBER_NOTIFS * sizeof(struct dj_workitem),
                            GFP_KERNEL)) {
                        kfree(djrcv_dev);
                        djrcv_dev = NULL;
                        goto out;
                }
                kref_init(&djrcv_dev->kref);
                list_add_tail(&djrcv_dev->list, &dj_hdev_list);
                djrcv_dev->last_query = jiffies;
                djrcv_dev->type = type;
        }

        if (application == HID_GD_KEYBOARD)
                djrcv_dev->keyboard = hdev;
        if (application == HID_GD_MOUSE)
                djrcv_dev->mouse = hdev;
        if (is_hidpp)
                djrcv_dev->hidpp = hdev;

        hid_set_drvdata(hdev, djrcv_dev);
out:
        mutex_unlock(&dj_hdev_list_lock);
        return djrcv_dev;
}

static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                              struct dj_workitem *workitem)
{
        /* Called in delayed work context */
        struct dj_device *dj_dev;
        unsigned long flags;

        spin_lock_irqsave(&djrcv_dev->lock, flags);
        dj_dev = djrcv_dev->paired_dj_devices[workitem->device_index];
        djrcv_dev->paired_dj_devices[workitem->device_index] = NULL;
        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        if (dj_dev != NULL) {
                hid_destroy_device(dj_dev->hdev);
                kfree(dj_dev);
        } else {
                hid_err(djrcv_dev->hidpp, "%s: can't destroy a NULL device\n",
                        __func__);
        }
}

static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                          struct dj_workitem *workitem)
{
        /* Called in delayed work context */
        struct hid_device *djrcv_hdev = djrcv_dev->hidpp;
        struct hid_device *dj_hiddev;
        struct dj_device *dj_dev;
        u8 device_index = workitem->device_index;
        unsigned long flags;

        /* Device index goes from 1 to 6, we need 3 bytes to store the
         * semicolon, the index, and a null terminator
         */
        unsigned char tmpstr[3];

        /* We are the only one ever adding a device, no need to lock */
        if (djrcv_dev->paired_dj_devices[device_index]) {
                /* The device is already known. No need to reallocate it. */
                dbg_hid("%s: device is already known\n", __func__);
                return;
        }

        dj_hiddev = hid_allocate_device();
        if (IS_ERR(dj_hiddev)) {
                hid_err(djrcv_hdev, "%s: hid_allocate_dev failed\n", __func__);
                return;
        }

        dj_hiddev->ll_driver = &logi_dj_ll_driver;

        dj_hiddev->dev.parent = &djrcv_hdev->dev;
        dj_hiddev->bus = BUS_USB;
        dj_hiddev->vendor = djrcv_hdev->vendor;
        dj_hiddev->product = (workitem->quad_id_msb << 8) |
                              workitem->quad_id_lsb;
        if (workitem->device_type) {
                const char *type_str = "Device";

                switch (workitem->device_type) {
                case 0x01: type_str = "Keyboard";        break;
                case 0x02: type_str = "Mouse";                break;
                case 0x03: type_str = "Numpad";                break;
                case 0x04: type_str = "Presenter";        break;
                case 0x07: type_str = "Remote Control";        break;
                case 0x08: type_str = "Trackball";        break;
                case 0x09: type_str = "Touchpad";        break;
                }
                snprintf(dj_hiddev->name, sizeof(dj_hiddev->name),
                        "Logitech Wireless %s PID:%04x",
                        type_str, dj_hiddev->product);
        } else {
                snprintf(dj_hiddev->name, sizeof(dj_hiddev->name),
                        "Logitech Wireless Device PID:%04x",
                        dj_hiddev->product);
        }

        if (djrcv_dev->type == recvr_type_27mhz)
                dj_hiddev->group = HID_GROUP_LOGITECH_27MHZ_DEVICE;
        else
                dj_hiddev->group = HID_GROUP_LOGITECH_DJ_DEVICE;

        memcpy(dj_hiddev->phys, djrcv_hdev->phys, sizeof(djrcv_hdev->phys));
        snprintf(tmpstr, sizeof(tmpstr), ":%d", device_index);
        strlcat(dj_hiddev->phys, tmpstr, sizeof(dj_hiddev->phys));

        dj_dev = kzalloc(sizeof(struct dj_device), GFP_KERNEL);

        if (!dj_dev) {
                hid_err(djrcv_hdev, "%s: failed allocating dj_dev\n", __func__);
                goto dj_device_allocate_fail;
        }

        dj_dev->reports_supported = workitem->reports_supported;
        dj_dev->hdev = dj_hiddev;
        dj_dev->dj_receiver_dev = djrcv_dev;
        dj_dev->device_index = device_index;
        dj_hiddev->driver_data = dj_dev;

        spin_lock_irqsave(&djrcv_dev->lock, flags);
        djrcv_dev->paired_dj_devices[device_index] = dj_dev;
        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        if (hid_add_device(dj_hiddev)) {
                hid_err(djrcv_hdev, "%s: failed adding dj_device\n", __func__);
                goto hid_add_device_fail;
        }

        return;

hid_add_device_fail:
        spin_lock_irqsave(&djrcv_dev->lock, flags);
        djrcv_dev->paired_dj_devices[device_index] = NULL;
        spin_unlock_irqrestore(&djrcv_dev->lock, flags);
        kfree(dj_dev);
dj_device_allocate_fail:
        hid_destroy_device(dj_hiddev);
}

static void delayedwork_callback(struct work_struct *work)
{
        struct dj_receiver_dev *djrcv_dev =
                container_of(work, struct dj_receiver_dev, work);

        struct dj_workitem workitem;
        unsigned long flags;
        int count;
        int retval;

        dbg_hid("%s\n", __func__);

        spin_lock_irqsave(&djrcv_dev->lock, flags);

        /*
         * Since we attach to multiple interfaces, we may get scheduled before
         * we are bound to the HID++ interface, catch this.
         */
        if (!djrcv_dev->ready) {
                pr_warn("%s: delayedwork queued before hidpp interface was enumerated\n",
                        __func__);
                spin_unlock_irqrestore(&djrcv_dev->lock, flags);
                return;
        }

        count = kfifo_out(&djrcv_dev->notif_fifo, &workitem, sizeof(workitem));

        if (count != sizeof(workitem)) {
                spin_unlock_irqrestore(&djrcv_dev->lock, flags);
                return;
        }

        if (!kfifo_is_empty(&djrcv_dev->notif_fifo))
                schedule_work(&djrcv_dev->work);

        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        switch (workitem.type) {
        case WORKITEM_TYPE_PAIRED:
                logi_dj_recv_add_djhid_device(djrcv_dev, &workitem);
                break;
        case WORKITEM_TYPE_UNPAIRED:
                logi_dj_recv_destroy_djhid_device(djrcv_dev, &workitem);
                break;
        case WORKITEM_TYPE_UNKNOWN:
                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
                if (retval) {
                        hid_err(djrcv_dev->hidpp, "%s: logi_dj_recv_query_paired_devices error: %d\n",
                                __func__, retval);
                }
                break;
        case WORKITEM_TYPE_EMPTY:
                dbg_hid("%s: device list is empty\n", __func__);
                break;
        }
}

/*
 * Sometimes we receive reports for which we do not have a paired dj_device
 * associated with the device_index or report-type to forward the report to.
 * This means that the original "device paired" notification corresponding
 * to the dj_device never arrived to this driver. Possible reasons for this are:
 * 1) hid-core discards all packets coming from a device during probe().
 * 2) if the receiver is plugged into a KVM switch then the pairing reports
 * are only forwarded to it if the focus is on this PC.
 * This function deals with this by re-asking the receiver for the list of
 * connected devices in the delayed work callback.
 * This function MUST be called with djrcv->lock held.
 */
static void logi_dj_recv_queue_unknown_work(struct dj_receiver_dev *djrcv_dev)
{
        struct dj_workitem workitem = { .type = WORKITEM_TYPE_UNKNOWN };

        /* Rate limit queries done because of unhandled reports to 2/sec */
        if (time_before(jiffies, djrcv_dev->last_query + HZ / 2))
                return;

        kfifo_in(&djrcv_dev->notif_fifo, &workitem, sizeof(workitem));
        schedule_work(&djrcv_dev->work);
}

static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
                                           struct dj_report *dj_report)
{
        /* We are called from atomic context (tasklet && djrcv->lock held) */
        struct dj_workitem workitem = {
                .device_index = dj_report->device_index,
        };

        switch (dj_report->report_type) {
        case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
                workitem.type = WORKITEM_TYPE_PAIRED;
                if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
                    SPFUNCTION_DEVICE_LIST_EMPTY) {
                        workitem.type = WORKITEM_TYPE_EMPTY;
                        break;
                }
                fallthrough;
        case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
                workitem.quad_id_msb =
                        dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_MSB];
                workitem.quad_id_lsb =
                        dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_LSB];
                workitem.reports_supported = get_unaligned_le32(
                                                dj_report->report_params +
                                                DEVICE_PAIRED_RF_REPORT_TYPE);
                workitem.reports_supported |= HIDPP;
                if (dj_report->report_type == REPORT_TYPE_NOTIF_DEVICE_UNPAIRED)
                        workitem.type = WORKITEM_TYPE_UNPAIRED;
                break;
        default:
                logi_dj_recv_queue_unknown_work(djrcv_dev);
                return;
        }

        kfifo_in(&djrcv_dev->notif_fifo, &workitem, sizeof(workitem));
        schedule_work(&djrcv_dev->work);
}

/*
 * Some quad/bluetooth keyboards have a builtin touchpad in this case we see
 * only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD. For the
 * touchpad to work we must also forward mouse input reports to the dj_hiddev
 * created for the keyboard (instead of forwarding them to a second paired
 * device with a device_type of REPORT_TYPE_MOUSE as we normally would).
 *
 * On Dinovo receivers the keyboard's touchpad and an optional paired actual
 * mouse send separate input reports, INPUT(2) aka STD_MOUSE for the mouse
 * and INPUT(5) aka KBD_MOUSE for the keyboard's touchpad.
 *
 * On MX5x00 receivers (which can also be paired with a Dinovo keyboard)
 * INPUT(2) is used for both an optional paired actual mouse and for the
 * keyboard's touchpad.
 */
static const u16 kbd_builtin_touchpad_ids[] = {
        0xb309, /* Dinovo Edge */
        0xb30c, /* Dinovo Mini */
};

static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
                                            struct hidpp_event *hidpp_report,
                                            struct dj_workitem *workitem)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        int i, id;

        workitem->type = WORKITEM_TYPE_PAIRED;
        workitem->device_type = hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] &
                                HIDPP_DEVICE_TYPE_MASK;
        workitem->quad_id_msb = hidpp_report->params[HIDPP_PARAM_EQUAD_MSB];
        workitem->quad_id_lsb = hidpp_report->params[HIDPP_PARAM_EQUAD_LSB];
        switch (workitem->device_type) {
        case REPORT_TYPE_KEYBOARD:
                workitem->reports_supported |= STD_KEYBOARD | MULTIMEDIA |
                                               POWER_KEYS | MEDIA_CENTER |
                                               HIDPP;
                id = (workitem->quad_id_msb << 8) | workitem->quad_id_lsb;
                for (i = 0; i < ARRAY_SIZE(kbd_builtin_touchpad_ids); i++) {
                        if (id == kbd_builtin_touchpad_ids[i]) {
                                if (djrcv_dev->type == recvr_type_dinovo)
                                        workitem->reports_supported |= KBD_MOUSE;
                                else
                                        workitem->reports_supported |= STD_MOUSE;
                                break;
                        }
                }
                break;
        case REPORT_TYPE_MOUSE:
                workitem->reports_supported |= STD_MOUSE | HIDPP | MULTIMEDIA;
                break;
        }
}

static void logi_hidpp_dev_conn_notif_27mhz(struct hid_device *hdev,
                                            struct hidpp_event *hidpp_report,
                                            struct dj_workitem *workitem)
{
        workitem->type = WORKITEM_TYPE_PAIRED;
        workitem->quad_id_lsb = hidpp_report->params[HIDPP_PARAM_27MHZ_DEVID];
        switch (hidpp_report->device_index) {
        case 1: /* Index 1 is always a mouse */
        case 2: /* Index 2 is always a mouse */
                workitem->device_type = HIDPP_DEVICE_TYPE_MOUSE;
                workitem->reports_supported |= STD_MOUSE | HIDPP;
                break;
        case 3: /* Index 3 is always the keyboard */
                if (hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] & HIDPP_27MHZ_SECURE_MASK) {
                        hid_info(hdev, "Keyboard connection is encrypted\n");
                } else {
                        hid_warn(hdev, "Keyboard events are send over the air in plain-text / unencrypted\n");
                        hid_warn(hdev, "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n");
                }
                fallthrough;
        case 4: /* Index 4 is used for an optional separate numpad */
                workitem->device_type = HIDPP_DEVICE_TYPE_KEYBOARD;
                workitem->reports_supported |= STD_KEYBOARD | MULTIMEDIA |
                                               POWER_KEYS | HIDPP;
                break;
        default:
                hid_warn(hdev, "%s: unexpected device-index %d", __func__,
                         hidpp_report->device_index);
        }
}

static void logi_hidpp_recv_queue_notif(struct hid_device *hdev,
                                        struct hidpp_event *hidpp_report)
{
        /* We are called from atomic context (tasklet && djrcv->lock held) */
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        const char *device_type = "UNKNOWN";
        struct dj_workitem workitem = {
                .type = WORKITEM_TYPE_EMPTY,
                .device_index = hidpp_report->device_index,
        };

        switch (hidpp_report->params[HIDPP_PARAM_PROTO_TYPE]) {
        case 0x01:
                device_type = "Bluetooth";
                /* Bluetooth connect packet contents is the same as (e)QUAD */
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                if (!(hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] &
                                                HIDPP_MANUFACTURER_MASK)) {
                        hid_info(hdev, "Non Logitech device connected on slot %d\n",
                                 hidpp_report->device_index);
                        workitem.reports_supported &= ~HIDPP;
                }
                break;
        case 0x02:
                device_type = "27 Mhz";
                logi_hidpp_dev_conn_notif_27mhz(hdev, hidpp_report, &workitem);
                break;
        case 0x03:
                device_type = "QUAD or eQUAD";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                break;
        case 0x04:
                device_type = "eQUAD step 4 DJ";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                break;
        case 0x05:
                device_type = "DFU Lite";
                break;
        case 0x06:
                device_type = "eQUAD step 4 Lite";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                break;
        case 0x07:
                device_type = "eQUAD step 4 Gaming";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                workitem.reports_supported |= STD_KEYBOARD;
                break;
        case 0x08:
                device_type = "eQUAD step 4 for gamepads";
                break;
        case 0x0a:
                device_type = "eQUAD nano Lite";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                break;
        case 0x0c:
                device_type = "eQUAD Lightspeed 1";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                workitem.reports_supported |= STD_KEYBOARD;
                break;
        case 0x0d:
                device_type = "eQUAD Lightspeed 1.1";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                workitem.reports_supported |= STD_KEYBOARD;
                break;
        case 0x0f:
        case 0x11:
                device_type = "eQUAD Lightspeed 1.2";
                logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
                workitem.reports_supported |= STD_KEYBOARD;
                break;
        }

        /* custom receiver device (eg. powerplay) */
        if (hidpp_report->device_index == 7) {
                workitem.reports_supported |= HIDPP;
        }

        if (workitem.type == WORKITEM_TYPE_EMPTY) {
                hid_warn(hdev,
                         "unusable device of type %s (0x%02x) connected on slot %d",
                         device_type,
                         hidpp_report->params[HIDPP_PARAM_PROTO_TYPE],
                         hidpp_report->device_index);
                return;
        }

        hid_info(hdev, "device of type %s (0x%02x) connected on slot %d",
                 device_type, hidpp_report->params[HIDPP_PARAM_PROTO_TYPE],
                 hidpp_report->device_index);

        kfifo_in(&djrcv_dev->notif_fifo, &workitem, sizeof(workitem));
        schedule_work(&djrcv_dev->work);
}

static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
                                             struct dj_report *dj_report)
{
        /* We are called from atomic context (tasklet && djrcv->lock held) */
        unsigned int i;
        u8 reportbuffer[MAX_REPORT_SIZE];
        struct dj_device *djdev;

        djdev = djrcv_dev->paired_dj_devices[dj_report->device_index];

        memset(reportbuffer, 0, sizeof(reportbuffer));

        for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
                if (djdev->reports_supported & (1 << i)) {
                        reportbuffer[0] = i;
                        if (hid_input_report(djdev->hdev,
                                             HID_INPUT_REPORT,
                                             reportbuffer,
                                             hid_reportid_size_map[i], 1)) {
                                dbg_hid("hid_input_report error sending null "
                                        "report\n");
                        }
                }
        }
}

static void logi_dj_recv_forward_dj(struct dj_receiver_dev *djrcv_dev,
                                    struct dj_report *dj_report)
{
        /* We are called from atomic context (tasklet && djrcv->lock held) */
        struct dj_device *dj_device;

        dj_device = djrcv_dev->paired_dj_devices[dj_report->device_index];

        if ((dj_report->report_type > ARRAY_SIZE(hid_reportid_size_map) - 1) ||
            (hid_reportid_size_map[dj_report->report_type] == 0)) {
                dbg_hid("invalid report type:%x\n", dj_report->report_type);
                return;
        }

        if (hid_input_report(dj_device->hdev,
                        HID_INPUT_REPORT, &dj_report->report_type,
                        hid_reportid_size_map[dj_report->report_type], 1)) {
                dbg_hid("hid_input_report error\n");
        }
}

static void logi_dj_recv_forward_report(struct dj_device *dj_dev, u8 *data,
                                        int size)
{
        /* We are called from atomic context (tasklet && djrcv->lock held) */
        if (hid_input_report(dj_dev->hdev, HID_INPUT_REPORT, data, size, 1))
                dbg_hid("hid_input_report error\n");
}

static void logi_dj_recv_forward_input_report(struct hid_device *hdev,
                                              u8 *data, int size)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        struct dj_device *dj_dev;
        unsigned long flags;
        u8 report = data[0];
        int i;

        if (report > REPORT_TYPE_RFREPORT_LAST) {
                hid_err(hdev, "Unexpected input report number %d\n", report);
                return;
        }

        spin_lock_irqsave(&djrcv_dev->lock, flags);
        for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {
                dj_dev = djrcv_dev->paired_dj_devices[i];
                if (dj_dev && (dj_dev->reports_supported & BIT(report))) {
                        logi_dj_recv_forward_report(dj_dev, data, size);
                        spin_unlock_irqrestore(&djrcv_dev->lock, flags);
                        return;
                }
        }

        logi_dj_recv_queue_unknown_work(djrcv_dev);
        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        dbg_hid("No dj-devs handling input report number %d\n", report);
}

static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
                                    struct dj_report *dj_report)
{
        struct hid_device *hdev = djrcv_dev->hidpp;
        struct hid_report *report;
        struct hid_report_enum *output_report_enum;
        u8 *data = (u8 *)(&dj_report->device_index);
        unsigned int i;

        output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
        report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];

        if (!report) {
                hid_err(hdev, "%s: unable to find dj report\n", __func__);
                return -ENODEV;
        }

        for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++)
                report->field[0]->value[i] = data[i];

        hid_hw_request(hdev, report, HID_REQ_SET_REPORT);

        return 0;
}

static int logi_dj_recv_query_hidpp_devices(struct dj_receiver_dev *djrcv_dev)
{
        static const u8 template[] = {
                REPORT_ID_HIDPP_SHORT,
                HIDPP_RECEIVER_INDEX,
                HIDPP_SET_REGISTER,
                HIDPP_REG_CONNECTION_STATE,
                HIDPP_FAKE_DEVICE_ARRIVAL,
                0x00, 0x00
        };
        u8 *hidpp_report;
        int retval;

        hidpp_report = kmemdup(template, sizeof(template), GFP_KERNEL);
        if (!hidpp_report)
                return -ENOMEM;

        retval = hid_hw_raw_request(djrcv_dev->hidpp,
                                    REPORT_ID_HIDPP_SHORT,
                                    hidpp_report, sizeof(template),
                                    HID_OUTPUT_REPORT,
                                    HID_REQ_SET_REPORT);

        kfree(hidpp_report);
        return (retval < 0) ? retval : 0;
}

static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
{
        struct dj_report *dj_report;
        int retval;

        djrcv_dev->last_query = jiffies;

        if (djrcv_dev->type != recvr_type_dj)
                return logi_dj_recv_query_hidpp_devices(djrcv_dev);

        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;
        dj_report->report_id = REPORT_ID_DJ_SHORT;
        dj_report->device_index = HIDPP_RECEIVER_INDEX;
        dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
        retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
        kfree(dj_report);
        return retval;
}


static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                          unsigned timeout)
{
        struct hid_device *hdev = djrcv_dev->hidpp;
        struct dj_report *dj_report;
        u8 *buf;
        int retval = 0;

        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;

        if (djrcv_dev->type == recvr_type_dj) {
                dj_report->report_id = REPORT_ID_DJ_SHORT;
                dj_report->device_index = HIDPP_RECEIVER_INDEX;
                dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
                dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
                dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] =
                                                                (u8)timeout;

                retval = logi_dj_recv_send_report(djrcv_dev, dj_report);

                /*
                 * Ugly sleep to work around a USB 3.0 bug when the receiver is
                 * still processing the "switch-to-dj" command while we send an
                 * other command.
                 * 50 msec should gives enough time to the receiver to be ready.
                 */
                msleep(50);

                if (retval) {
                        kfree(dj_report);
                        return retval;
                }
        }

        /*
         * Magical bits to set up hidpp notifications when the dj devices
         * are connected/disconnected.
         *
         * We can reuse dj_report because HIDPP_REPORT_SHORT_LENGTH is smaller
         * than DJREPORT_SHORT_LENGTH.
         */
        buf = (u8 *)dj_report;

        memset(buf, 0, HIDPP_REPORT_SHORT_LENGTH);

        buf[0] = REPORT_ID_HIDPP_SHORT;
        buf[1] = HIDPP_RECEIVER_INDEX;
        buf[2] = 0x80;
        buf[3] = 0x00;
        buf[4] = 0x00;
        buf[5] = 0x09;
        buf[6] = 0x00;

        retval = hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf,
                        HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT,
                        HID_REQ_SET_REPORT);

        kfree(dj_report);
        return retval;
}


static int logi_dj_ll_open(struct hid_device *hid)
{
        dbg_hid("%s: %s\n", __func__, hid->phys);
        return 0;

}

static void logi_dj_ll_close(struct hid_device *hid)
{
        dbg_hid("%s: %s\n", __func__, hid->phys);
}

/*
 * Register 0xB5 is "pairing information". It is solely intended for the
 * receiver, so do not overwrite the device index.
 */
static u8 unifying_pairing_query[]  = { REPORT_ID_HIDPP_SHORT,
                                        HIDPP_RECEIVER_INDEX,
                                        HIDPP_GET_LONG_REGISTER,
                                        HIDPP_REG_PAIRING_INFORMATION };
static u8 unifying_pairing_answer[] = { REPORT_ID_HIDPP_LONG,
                                        HIDPP_RECEIVER_INDEX,
                                        HIDPP_GET_LONG_REGISTER,
                                        HIDPP_REG_PAIRING_INFORMATION };

static int logi_dj_ll_raw_request(struct hid_device *hid,
                                  unsigned char reportnum, __u8 *buf,
                                  size_t count, unsigned char report_type,
                                  int reqtype)
{
        struct dj_device *djdev = hid->driver_data;
        struct dj_receiver_dev *djrcv_dev = djdev->dj_receiver_dev;
        u8 *out_buf;
        int ret;

        if ((buf[0] == REPORT_ID_HIDPP_SHORT) ||
            (buf[0] == REPORT_ID_HIDPP_LONG) ||
            (buf[0] == REPORT_ID_HIDPP_VERY_LONG)) {
                if (count < 2)
                        return -EINVAL;

                /* special case where we should not overwrite
                 * the device_index */
                if (count == 7 && !memcmp(buf, unifying_pairing_query,
                                          sizeof(unifying_pairing_query)))
                        buf[4] = (buf[4] & 0xf0) | (djdev->device_index - 1);
                else
                        buf[1] = djdev->device_index;
                return hid_hw_raw_request(djrcv_dev->hidpp, reportnum, buf,
                                count, report_type, reqtype);
        }

        if (buf[0] != REPORT_TYPE_LEDS)
                return -EINVAL;

        if (djrcv_dev->type != recvr_type_dj && count >= 2) {
                if (!djrcv_dev->keyboard) {
                        hid_warn(hid, "Received REPORT_TYPE_LEDS request before the keyboard interface was enumerated\n");
                        return 0;
                }
                /* usbhid overrides the report ID and ignores the first byte */
                return hid_hw_raw_request(djrcv_dev->keyboard, 0, buf, count,
                                          report_type, reqtype);
        }

        out_buf = kzalloc(DJREPORT_SHORT_LENGTH, GFP_ATOMIC);
        if (!out_buf)
                return -ENOMEM;

        if (count > DJREPORT_SHORT_LENGTH - 2)
                count = DJREPORT_SHORT_LENGTH - 2;

        out_buf[0] = REPORT_ID_DJ_SHORT;
        out_buf[1] = djdev->device_index;
        memcpy(out_buf + 2, buf, count);

        ret = hid_hw_raw_request(djrcv_dev->hidpp, out_buf[0], out_buf,
                DJREPORT_SHORT_LENGTH, report_type, reqtype);

        kfree(out_buf);
        return ret;
}

static void rdcat(char *rdesc, unsigned int *rsize, const char *data, unsigned int size)
{
        memcpy(rdesc + *rsize, data, size);
        *rsize += size;
}

static int logi_dj_ll_parse(struct hid_device *hid)
{
        struct dj_device *djdev = hid->driver_data;
        unsigned int rsize = 0;
        char *rdesc;
        int retval;

        dbg_hid("%s\n", __func__);

        djdev->hdev->version = 0x0111;
        djdev->hdev->country = 0x00;

        rdesc = kmalloc(MAX_RDESC_SIZE, GFP_KERNEL);
        if (!rdesc)
                return -ENOMEM;

        if (djdev->reports_supported & STD_KEYBOARD) {
                dbg_hid("%s: sending a kbd descriptor, reports_supported: %llx\n",
                        __func__, djdev->reports_supported);
                rdcat(rdesc, &rsize, kbd_descriptor, sizeof(kbd_descriptor));
        }

        if (djdev->reports_supported & STD_MOUSE) {
                dbg_hid("%s: sending a mouse descriptor, reports_supported: %llx\n",
                        __func__, djdev->reports_supported);
                if (djdev->dj_receiver_dev->type == recvr_type_gaming_hidpp ||
                    djdev->dj_receiver_dev->type == recvr_type_mouse_only)
                        rdcat(rdesc, &rsize, mse_high_res_descriptor,
                              sizeof(mse_high_res_descriptor));
                else if (djdev->dj_receiver_dev->type == recvr_type_27mhz)
                        rdcat(rdesc, &rsize, mse_27mhz_descriptor,
                              sizeof(mse_27mhz_descriptor));
                else if (recvr_type_is_bluetooth(djdev->dj_receiver_dev->type))
                        rdcat(rdesc, &rsize, mse_bluetooth_descriptor,
                              sizeof(mse_bluetooth_descriptor));
                else
                        rdcat(rdesc, &rsize, mse_descriptor,
                              sizeof(mse_descriptor));
        }

        if (djdev->reports_supported & KBD_MOUSE) {
                dbg_hid("%s: sending a kbd-mouse descriptor, reports_supported: %llx\n",
                        __func__, djdev->reports_supported);
                rdcat(rdesc, &rsize, mse5_bluetooth_descriptor,
                      sizeof(mse5_bluetooth_descriptor));
        }

        if (djdev->reports_supported & MULTIMEDIA) {
                dbg_hid("%s: sending a multimedia report descriptor: %llx\n",
                        __func__, djdev->reports_supported);
                rdcat(rdesc, &rsize, consumer_descriptor, sizeof(consumer_descriptor));
        }

        if (djdev->reports_supported & POWER_KEYS) {
                dbg_hid("%s: sending a power keys report descriptor: %llx\n",
                        __func__, djdev->reports_supported);
                rdcat(rdesc, &rsize, syscontrol_descriptor, sizeof(syscontrol_descriptor));
        }

        if (djdev->reports_supported & MEDIA_CENTER) {
                dbg_hid("%s: sending a media center report descriptor: %llx\n",
                        __func__, djdev->reports_supported);
                rdcat(rdesc, &rsize, media_descriptor, sizeof(media_descriptor));
        }

        if (djdev->reports_supported & KBD_LEDS) {
                dbg_hid("%s: need to send kbd leds report descriptor: %llx\n",
                        __func__, djdev->reports_supported);
        }

        if (djdev->reports_supported & HIDPP) {
                dbg_hid("%s: sending a HID++ descriptor, reports_supported: %llx\n",
                        __func__, djdev->reports_supported);
                rdcat(rdesc, &rsize, hidpp_descriptor,
                      sizeof(hidpp_descriptor));
        }

        retval = hid_parse_report(hid, rdesc, rsize);
        kfree(rdesc);

        return retval;
}

static int logi_dj_ll_start(struct hid_device *hid)
{
        dbg_hid("%s\n", __func__);
        return 0;
}

static void logi_dj_ll_stop(struct hid_device *hid)
{
        dbg_hid("%s\n", __func__);
}

static bool logi_dj_ll_may_wakeup(struct hid_device *hid)
{
        struct dj_device *djdev = hid->driver_data;
        struct dj_receiver_dev *djrcv_dev = djdev->dj_receiver_dev;

        return hid_hw_may_wakeup(djrcv_dev->hidpp);
}

static const struct hid_ll_driver logi_dj_ll_driver = {
        .parse = logi_dj_ll_parse,
        .start = logi_dj_ll_start,
        .stop = logi_dj_ll_stop,
        .open = logi_dj_ll_open,
        .close = logi_dj_ll_close,
        .raw_request = logi_dj_ll_raw_request,
        .may_wakeup = logi_dj_ll_may_wakeup,
};

static int logi_dj_dj_event(struct hid_device *hdev,
                             struct hid_report *report, u8 *data,
                             int size)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        struct dj_report *dj_report = (struct dj_report *) data;
        unsigned long flags;

        /*
         * Here we receive all data coming from iface 2, there are 3 cases:
         *
         * 1) Data is intended for this driver i. e. data contains arrival,
         * departure, etc notifications, in which case we queue them for delayed
         * processing by the work queue. We return 1 to hid-core as no further
         * processing is required from it.
         *
         * 2) Data informs a connection change, if the change means rf link
         * loss, then we must send a null report to the upper layer to discard
         * potentially pressed keys that may be repeated forever by the input
         * layer. Return 1 to hid-core as no further processing is required.
         *
         * 3) Data is an actual input event from a paired DJ device in which
         * case we forward it to the correct hid device (via hid_input_report()
         * ) and return 1 so hid-core does not anything else with it.
         */

        if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
            (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
                /*
                 * Device index is wrong, bail out.
                 * This driver can ignore safely the receiver notifications,
                 * so ignore those reports too.
                 */
                if (dj_report->device_index != DJ_RECEIVER_INDEX)
                        hid_err(hdev, "%s: invalid device index:%d\n",
                                __func__, dj_report->device_index);
                return false;
        }

        spin_lock_irqsave(&djrcv_dev->lock, flags);

        if (!djrcv_dev->paired_dj_devices[dj_report->device_index]) {
                /* received an event for an unknown device, bail out */
                logi_dj_recv_queue_notification(djrcv_dev, dj_report);
                goto out;
        }

        switch (dj_report->report_type) {
        case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
                /* pairing notifications are handled above the switch */
                break;
        case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
                logi_dj_recv_queue_notification(djrcv_dev, dj_report);
                break;
        case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
                if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
                    STATUS_LINKLOSS) {
                        logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
                }
                break;
        default:
                logi_dj_recv_forward_dj(djrcv_dev, dj_report);
        }

out:
        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        return true;
}

static int logi_dj_hidpp_event(struct hid_device *hdev,
                             struct hid_report *report, u8 *data,
                             int size)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        struct hidpp_event *hidpp_report = (struct hidpp_event *) data;
        struct dj_device *dj_dev;
        unsigned long flags;
        u8 device_index = hidpp_report->device_index;

        if (device_index == HIDPP_RECEIVER_INDEX) {
                /* special case were the device wants to know its unifying
                 * name */
                if (size == HIDPP_REPORT_LONG_LENGTH &&
                    !memcmp(data, unifying_pairing_answer,
                            sizeof(unifying_pairing_answer)))
                        device_index = (data[4] & 0x0F) + 1;
                else
                        return false;
        }

        /*
         * Data is from the HID++ collection, in this case, we forward the
         * data to the corresponding child dj device and return 0 to hid-core
         * so he data also goes to the hidraw device of the receiver. This
         * allows a user space application to implement the full HID++ routing
         * via the receiver.
         */

        if ((device_index < DJ_DEVICE_INDEX_MIN) ||
            (device_index > DJ_DEVICE_INDEX_MAX)) {
                /*
                 * Device index is wrong, bail out.
                 * This driver can ignore safely the receiver notifications,
                 * so ignore those reports too.
                 */
                hid_err(hdev, "%s: invalid device index:%d\n", __func__,
                        hidpp_report->device_index);
                return false;
        }

        spin_lock_irqsave(&djrcv_dev->lock, flags);

        dj_dev = djrcv_dev->paired_dj_devices[device_index];

        /*
         * With 27 MHz receivers, we do not get an explicit unpair event,
         * remove the old device if the user has paired a *different* device.
         */
        if (djrcv_dev->type == recvr_type_27mhz && dj_dev &&
            hidpp_report->sub_id == REPORT_TYPE_NOTIF_DEVICE_CONNECTED &&
            hidpp_report->params[HIDPP_PARAM_PROTO_TYPE] == 0x02 &&
            hidpp_report->params[HIDPP_PARAM_27MHZ_DEVID] !=
                                                dj_dev->hdev->product) {
                struct dj_workitem workitem = {
                        .device_index = hidpp_report->device_index,
                        .type = WORKITEM_TYPE_UNPAIRED,
                };
                kfifo_in(&djrcv_dev->notif_fifo, &workitem, sizeof(workitem));
                /* logi_hidpp_recv_queue_notif will queue the work */
                dj_dev = NULL;
        }

        if (dj_dev) {
                logi_dj_recv_forward_report(dj_dev, data, size);
        } else {
                if (hidpp_report->sub_id == REPORT_TYPE_NOTIF_DEVICE_CONNECTED)
                        logi_hidpp_recv_queue_notif(hdev, hidpp_report);
                else
                        logi_dj_recv_queue_unknown_work(djrcv_dev);
        }

        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        return false;
}

static int logi_dj_raw_event(struct hid_device *hdev,
                             struct hid_report *report, u8 *data,
                             int size)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        dbg_hid("%s, size:%d\n", __func__, size);

        if (!djrcv_dev)
                return 0;

        if (!hdev->report_enum[HID_INPUT_REPORT].numbered) {

                if (djrcv_dev->unnumbered_application == HID_GD_KEYBOARD) {
                        /*
                         * For the keyboard, we can reuse the same report by
                         * using the second byte which is constant in the USB
                         * HID report descriptor.
                         */
                        data[1] = data[0];
                        data[0] = REPORT_TYPE_KEYBOARD;

                        logi_dj_recv_forward_input_report(hdev, data, size);

                        /* restore previous state */
                        data[0] = data[1];
                        data[1] = 0;
                }
                /*
                 * Mouse-only receivers send unnumbered mouse data. The 27 MHz
                 * receiver uses 6 byte packets, the nano receiver 8 bytes.
                 */
                if (djrcv_dev->unnumbered_application == HID_GD_MOUSE &&
                    size <= 8) {
                        u8 mouse_report[9];

                        /* Prepend report id */
                        mouse_report[0] = REPORT_TYPE_MOUSE;
                        memcpy(mouse_report + 1, data, size);
                        logi_dj_recv_forward_input_report(hdev, mouse_report,
                                                          size + 1);
                }

                return false;
        }

        switch (data[0]) {
        case REPORT_ID_DJ_SHORT:
                if (size != DJREPORT_SHORT_LENGTH) {
                        hid_err(hdev, "Short DJ report bad size (%d)", size);
                        return false;
                }
                return logi_dj_dj_event(hdev, report, data, size);
        case REPORT_ID_DJ_LONG:
                if (size != DJREPORT_LONG_LENGTH) {
                        hid_err(hdev, "Long DJ report bad size (%d)", size);
                        return false;
                }
                return logi_dj_dj_event(hdev, report, data, size);
        case REPORT_ID_HIDPP_SHORT:
                if (size != HIDPP_REPORT_SHORT_LENGTH) {
                        hid_err(hdev, "Short HID++ report bad size (%d)", size);
                        return false;
                }
                return logi_dj_hidpp_event(hdev, report, data, size);
        case REPORT_ID_HIDPP_LONG:
                if (size != HIDPP_REPORT_LONG_LENGTH) {
                        hid_err(hdev, "Long HID++ report bad size (%d)", size);
                        return false;
                }
                return logi_dj_hidpp_event(hdev, report, data, size);
        }

        logi_dj_recv_forward_input_report(hdev, data, size);

        return false;
}

static int logi_dj_probe(struct hid_device *hdev,
                         const struct hid_device_id *id)
{
        struct hid_report_enum *rep_enum;
        struct hid_report *rep;
        struct dj_receiver_dev *djrcv_dev;
        struct usb_interface *intf;
        unsigned int no_dj_interfaces = 0;
        bool has_hidpp = false;
        unsigned long flags;
        int retval;

        /*
         * Call to usbhid to fetch the HID descriptors of the current
         * interface subsequently call to the hid/hid-core to parse the
         * fetched descriptors.
         */
        retval = hid_parse(hdev);
        if (retval) {
                hid_err(hdev, "%s: parse failed\n", __func__);
                return retval;
        }

        /*
         * Some KVMs add an extra interface for e.g. mouse emulation. If we
         * treat these as logitech-dj interfaces then this causes input events
         * reported through this extra interface to not be reported correctly.
         * To avoid this, we treat these as generic-hid devices.
         */
        switch (id->driver_data) {
        case recvr_type_dj:                no_dj_interfaces = 3; break;
        case recvr_type_hidpp:                no_dj_interfaces = 2; break;
        case recvr_type_gaming_hidpp:        no_dj_interfaces = 3; break;
        case recvr_type_mouse_only:        no_dj_interfaces = 2; break;
        case recvr_type_27mhz:                no_dj_interfaces = 2; break;
        case recvr_type_bluetooth:        no_dj_interfaces = 2; break;
        case recvr_type_dinovo:                no_dj_interfaces = 2; break;
        }
        if (hid_is_usb(hdev)) {
                intf = to_usb_interface(hdev->dev.parent);
                if (intf && intf->altsetting->desc.bInterfaceNumber >=
                                                        no_dj_interfaces) {
                        hdev->quirks |= HID_QUIRK_INPUT_PER_APP;
                        return hid_hw_start(hdev, HID_CONNECT_DEFAULT);
                }
        }

        rep_enum = &hdev->report_enum[HID_INPUT_REPORT];

        /* no input reports, bail out */
        if (list_empty(&rep_enum->report_list))
                return -ENODEV;

        /*
         * Check for the HID++ application.
         * Note: we should theoretically check for HID++ and DJ
         * collections, but this will do.
         */
        list_for_each_entry(rep, &rep_enum->report_list, list) {
                if (rep->application == 0xff000001)
                        has_hidpp = true;
        }

        /*
         * Ignore interfaces without DJ/HID++ collection, they will not carry
         * any data, dont create any hid_device for them.
         */
        if (!has_hidpp && id->driver_data == recvr_type_dj)
                return -ENODEV;

        /* get the current application attached to the node */
        rep = list_first_entry(&rep_enum->report_list, struct hid_report, list);
        djrcv_dev = dj_get_receiver_dev(hdev, id->driver_data,
                                        rep->application, has_hidpp);
        if (!djrcv_dev) {
                hid_err(hdev, "%s: dj_get_receiver_dev failed\n", __func__);
                return -ENOMEM;
        }

        if (!rep_enum->numbered)
                djrcv_dev->unnumbered_application = rep->application;

        /* Starts the usb device and connects to upper interfaces hiddev and
         * hidraw */
        retval = hid_hw_start(hdev, HID_CONNECT_HIDRAW|HID_CONNECT_HIDDEV);
        if (retval) {
                hid_err(hdev, "%s: hid_hw_start returned error\n", __func__);
                goto hid_hw_start_fail;
        }

        if (has_hidpp) {
                retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
                if (retval < 0) {
                        hid_err(hdev, "%s: logi_dj_recv_switch_to_dj_mode returned error:%d\n",
                                __func__, retval);
                        goto switch_to_dj_mode_fail;
                }
        }

        /* This is enabling the polling urb on the IN endpoint */
        retval = hid_hw_open(hdev);
        if (retval < 0) {
                hid_err(hdev, "%s: hid_hw_open returned error:%d\n",
                        __func__, retval);
                goto llopen_failed;
        }

        /* Allow incoming packets to arrive: */
        hid_device_io_start(hdev);

        if (has_hidpp) {
                spin_lock_irqsave(&djrcv_dev->lock, flags);
                djrcv_dev->ready = true;
                spin_unlock_irqrestore(&djrcv_dev->lock, flags);
                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
                if (retval < 0) {
                        hid_err(hdev, "%s: logi_dj_recv_query_paired_devices error:%d\n",
                                __func__, retval);
                        /*
                         * This can happen with a KVM, let the probe succeed,
                         * logi_dj_recv_queue_unknown_work will retry later.
                         */
                }
        }

        return 0;

llopen_failed:
switch_to_dj_mode_fail:
        hid_hw_stop(hdev);

hid_hw_start_fail:
        dj_put_receiver_dev(hdev);
        return retval;
}

#ifdef CONFIG_PM
static int logi_dj_reset_resume(struct hid_device *hdev)
{
        int retval;
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);

        if (!djrcv_dev || djrcv_dev->hidpp != hdev)
                return 0;

        retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
        if (retval < 0) {
                hid_err(hdev, "%s: logi_dj_recv_switch_to_dj_mode returned error:%d\n",
                        __func__, retval);
        }

        return 0;
}
#endif

static void logi_dj_remove(struct hid_device *hdev)
{
        struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
        struct dj_device *dj_dev;
        unsigned long flags;
        int i;

        dbg_hid("%s\n", __func__);

        if (!djrcv_dev)
                return hid_hw_stop(hdev);

        /*
         * This ensures that if the work gets requeued from another
         * interface of the same receiver it will be a no-op.
         */
        spin_lock_irqsave(&djrcv_dev->lock, flags);
        djrcv_dev->ready = false;
        spin_unlock_irqrestore(&djrcv_dev->lock, flags);

        cancel_work_sync(&djrcv_dev->work);

        hid_hw_close(hdev);
        hid_hw_stop(hdev);

        /*
         * For proper operation we need access to all interfaces, so we destroy
         * the paired devices when we're unbound from any interface.
         *
         * Note we may still be bound to other interfaces, sharing the same
         * djrcv_dev, so we need locking here.
         */
        for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {
                spin_lock_irqsave(&djrcv_dev->lock, flags);
                dj_dev = djrcv_dev->paired_dj_devices[i];
                djrcv_dev->paired_dj_devices[i] = NULL;
                spin_unlock_irqrestore(&djrcv_dev->lock, flags);
                if (dj_dev != NULL) {
                        hid_destroy_device(dj_dev->hdev);
                        kfree(dj_dev);
                }
        }

        dj_put_receiver_dev(hdev);
}

static const struct hid_device_id logi_dj_receivers[] = {
        { /* Logitech unifying receiver (0xc52b) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER),
         .driver_data = recvr_type_dj},
        { /* Logitech unifying receiver (0xc532) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2),
         .driver_data = recvr_type_dj},

        { /* Logitech Nano mouse only receiver (0xc52f) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                         USB_DEVICE_ID_LOGITECH_NANO_RECEIVER),
         .driver_data = recvr_type_mouse_only},
        { /* Logitech Nano (non DJ) receiver (0xc534) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                         USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2),
         .driver_data = recvr_type_hidpp},

        { /* Logitech G700(s) receiver (0xc531) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                         USB_DEVICE_ID_LOGITECH_G700_RECEIVER),
         .driver_data = recvr_type_gaming_hidpp},
        { /* Logitech G602 receiver (0xc537) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                0xc537),
         .driver_data = recvr_type_gaming_hidpp},
        { /* Logitech lightspeed receiver (0xc539) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1),
         .driver_data = recvr_type_gaming_hidpp},
        { /* Logitech powerplay receiver (0xc53a) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY),
         .driver_data = recvr_type_gaming_hidpp},
        { /* Logitech lightspeed receiver (0xc53f) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1),
         .driver_data = recvr_type_gaming_hidpp},

        { /* Logitech 27 MHz HID++ 1.0 receiver (0xc513) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER),
         .driver_data = recvr_type_27mhz},
        { /* Logitech 27 MHz HID++ 1.0 receiver (0xc517) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_S510_RECEIVER_2),
         .driver_data = recvr_type_27mhz},
        { /* Logitech 27 MHz HID++ 1.0 mouse-only receiver (0xc51b) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_LOGITECH_27MHZ_MOUSE_RECEIVER),
         .driver_data = recvr_type_27mhz},

        { /* Logitech MX5000 HID++ / bluetooth receiver keyboard intf. (0xc70e) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_MX5000_RECEIVER_KBD_DEV),
         .driver_data = recvr_type_bluetooth},
        { /* Logitech MX5000 HID++ / bluetooth receiver mouse intf. (0xc70a) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_MX5000_RECEIVER_MOUSE_DEV),
         .driver_data = recvr_type_bluetooth},
        { /* Logitech MX5500 HID++ / bluetooth receiver keyboard intf. (0xc71b) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_MX5500_RECEIVER_KBD_DEV),
         .driver_data = recvr_type_bluetooth},
        { /* Logitech MX5500 HID++ / bluetooth receiver mouse intf. (0xc71c) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_MX5500_RECEIVER_MOUSE_DEV),
         .driver_data = recvr_type_bluetooth},

        { /* Logitech Dinovo Edge HID++ / bluetooth receiver keyboard intf. (0xc713) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_DINOVO_EDGE_RECEIVER_KBD_DEV),
         .driver_data = recvr_type_dinovo},
        { /* Logitech Dinovo Edge HID++ / bluetooth receiver mouse intf. (0xc714) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_DINOVO_EDGE_RECEIVER_MOUSE_DEV),
         .driver_data = recvr_type_dinovo},
        { /* Logitech DiNovo Mini HID++ / bluetooth receiver mouse intf. (0xc71e) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_DINOVO_MINI_RECEIVER_KBD_DEV),
         .driver_data = recvr_type_dinovo},
        { /* Logitech DiNovo Mini HID++ / bluetooth receiver keyboard intf. (0xc71f) */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
                USB_DEVICE_ID_DINOVO_MINI_RECEIVER_MOUSE_DEV),
         .driver_data = recvr_type_dinovo},
        {}
};

MODULE_DEVICE_TABLE(hid, logi_dj_receivers);

static struct hid_driver logi_djreceiver_driver = {
        .name = "logitech-djreceiver",
        .id_table = logi_dj_receivers,
        .probe = logi_dj_probe,
        .remove = logi_dj_remove,
        .raw_event = logi_dj_raw_event,
#ifdef CONFIG_PM
        .reset_resume = logi_dj_reset_resume,
#endif
};

module_hid_driver(logi_djreceiver_driver);

MODULE_DESCRIPTION("HID driver for Logitech receivers");
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Logitech");
MODULE_AUTHOR("Nestor Lopez Casado");
MODULE_AUTHOR("nlopezcasad@logitech.com");






































































































































































































































































































































































































































































































































































































































































    1 

















    1 






































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
// SPDX-License-Identifier: GPL-2.0-or-later
/*
   cx231xx-pcb-config.c - driver for Conexant
                Cx23100/101/102 USB video capture devices

   Copyright (C) 2008 <srinivasa.deevi at conexant dot com>

 */

#include "cx231xx.h"
#include "cx231xx-conf-reg.h"

static unsigned int pcb_debug;
module_param(pcb_debug, int, 0644);
MODULE_PARM_DESC(pcb_debug, "enable pcb config debug messages [video]");

/******************************************************************************/

static struct pcb_config cx231xx_Scenario[] = {
        {
         INDEX_SELFPOWER_DIGITAL_ONLY,        /* index */
         USB_SELF_POWER,        /* power_type */
         0,                        /* speed , not decide yet */
         MOD_DIGITAL,                /* mode */
         SOURCE_TS_BDA,                /* ts1_source, digital tv only */
         NOT_SUPPORTED,                /* ts2_source  */
         NOT_SUPPORTED,                /* analog source */

         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index   */
         0,                        /* external_index */

         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            NOT_SUPPORTED,        /* AUDIO */
            NOT_SUPPORTED,        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           ,
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed config */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            NOT_SUPPORTED,        /* AUDIO */
            NOT_SUPPORTED,        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

        {
         INDEX_SELFPOWER_DUAL_DIGITAL,        /* index */
         USB_SELF_POWER,        /* power_type */
         0,                        /* speed , not decide yet */
         MOD_DIGITAL,                /* mode */
         SOURCE_TS_BDA,                /* ts1_source, digital tv only */
         0,                        /* ts2_source,need update from register */
         NOT_SUPPORTED,                /* analog source */
         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */

         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            2,                        /* TS2 index */
            NOT_SUPPORTED,        /* AUDIO */
            NOT_SUPPORTED,        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            2,                        /* TS2 index */
            NOT_SUPPORTED,        /* AUDIO */
            NOT_SUPPORTED,        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

        {
         INDEX_SELFPOWER_ANALOG_ONLY,        /* index */
         USB_SELF_POWER,        /* power_type */
         0,                        /* speed , not decide yet */
         MOD_ANALOG | MOD_DIF | MOD_EXTERNAL,        /* mode ,analog tv only */
         NOT_SUPPORTED,                /* ts1_source, NOT SUPPORT */
         NOT_SUPPORTED,                /* ts2_source,NOT SUPPORT */
         0,                        /* analog source, need update */

         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */

         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            NOT_SUPPORTED,        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            1,                        /* AUDIO */
            2,                        /* VIDEO */
            3,                        /* VANC */
            4,                        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            NOT_SUPPORTED,        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            1,                        /* AUDIO */
            2,                        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

        {
         INDEX_SELFPOWER_DUAL,        /* index */
         USB_SELF_POWER,        /* power_type */
         0,                        /* speed , not decide yet */
         /* mode ,analog tv and digital path */
         MOD_ANALOG | MOD_DIF | MOD_DIGITAL | MOD_EXTERNAL,
         0,                        /* ts1_source,will update in register */
         NOT_SUPPORTED,                /* ts2_source,NOT SUPPORT */
         0,                        /* analog source need update */
         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */
         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            2,                        /* AUDIO */
            3,                        /* VIDEO */
            4,                        /* VANC */
            5,                        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            2,                        /* AUDIO */
            3,                        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

        {
         INDEX_SELFPOWER_TRIPLE,        /* index */
         USB_SELF_POWER,        /* power_type */
         0,                        /* speed , not decide yet */
         /* mode ,analog tv and digital path */
         MOD_ANALOG | MOD_DIF | MOD_DIGITAL | MOD_EXTERNAL,
         0,                        /* ts1_source, update in register */
         0,                        /* ts2_source,update in register */
         0,                        /* analog source, need update */

         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */
         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            2,                        /* TS2 index */
            3,                        /* AUDIO */
            4,                        /* VIDEO */
            5,                        /* VANC */
            6,                        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            2,                        /* TS2 index */
            3,                        /* AUDIO */
            4,                        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

        {
         INDEX_SELFPOWER_COMPRESSOR,        /* index */
         USB_SELF_POWER,        /* power_type */
         0,                        /* speed , not decide yet */
         /* mode ,analog tv AND DIGITAL path */
         MOD_ANALOG | MOD_DIF | MOD_DIGITAL | MOD_EXTERNAL,
         NOT_SUPPORTED,                /* ts1_source, disable */
         SOURCE_TS_BDA,                /* ts2_source */
         0,                        /* analog source,need update */
         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */
         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            NOT_SUPPORTED,        /* ts1 index */
            1,                        /* TS2 index */
            2,                        /* AUDIO */
            3,                        /* VIDEO */
            4,                        /* VANC */
            5,                        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed  */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            NOT_SUPPORTED,        /* ts1 index */
            1,                        /* TS2 index */
            2,                        /* AUDIO */
            3,                        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

        {
         INDEX_BUSPOWER_DIGITAL_ONLY,        /* index */
         USB_BUS_POWER,                /* power_type */
         0,                        /* speed , not decide yet */
         MOD_DIGITAL,                /* mode ,analog tv AND DIGITAL path */
         SOURCE_TS_BDA,                /* ts1_source, disable */
         NOT_SUPPORTED,                /* ts2_source */
         NOT_SUPPORTED,                /* analog source */

         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */

         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index  = 2 */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            NOT_SUPPORTED,        /* AUDIO */
            NOT_SUPPORTED,        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         /* full-speed */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index  = 2 */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            NOT_SUPPORTED,        /* AUDIO */
            NOT_SUPPORTED,        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,
        {
         INDEX_BUSPOWER_ANALOG_ONLY,        /* index */
         USB_BUS_POWER,                /* power_type */
         0,                        /* speed , not decide yet */
         MOD_ANALOG,                /* mode ,analog tv AND DIGITAL path */
         NOT_SUPPORTED,                /* ts1_source, disable */
         NOT_SUPPORTED,                /* ts2_source */
         SOURCE_ANALOG,                /* analog source--analog */
         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */
         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            NOT_SUPPORTED,        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            1,                        /* AUDIO */
            2,                        /* VIDEO */
            3,                        /* VANC */
            4,                        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         {                        /* full-speed */
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            NOT_SUPPORTED,        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            1,                        /* AUDIO */
            2,                        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,
        {
         INDEX_BUSPOWER_DIF_ONLY,        /* index */
         USB_BUS_POWER,                /* power_type */
         0,                        /* speed , not decide yet */
         /* mode ,analog tv AND DIGITAL path */
         MOD_DIF | MOD_ANALOG | MOD_DIGITAL | MOD_EXTERNAL,
         SOURCE_TS_BDA,                /* ts1_source, disable */
         NOT_SUPPORTED,                /* ts2_source */
         SOURCE_DIF | SOURCE_ANALOG | SOURCE_EXTERNAL,        /* analog source, dif */
         0,                        /* digital_index  */
         0,                        /* analog index */
         0,                        /* dif_index */
         0,                        /* external_index */
         1,                        /* only one configuration */
         {
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            2,                        /* AUDIO */
            3,                        /* VIDEO */
            4,                        /* VANC */
            5,                        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         ,
         {                        /* full speed */
          {
           0,                        /* config index */
           {
            0,                        /* interrupt ep index */
            1,                        /* ts1 index */
            NOT_SUPPORTED,        /* TS2 index */
            2,                        /* AUDIO */
            3,                        /* VIDEO */
            NOT_SUPPORTED,        /* VANC */
            NOT_SUPPORTED,        /* HANC */
            NOT_SUPPORTED        /* ir_index */
            }
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          ,
          {NOT_SUPPORTED, {NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED, NOT_SUPPORTED, NOT_SUPPORTED,
                           NOT_SUPPORTED}
           }
          }
         }
        ,

};

/*****************************************************************/

int initialize_cx231xx(struct cx231xx *dev)
{
        int retval;
        u32 config_info = 0;
        struct pcb_config *p_pcb_info;
        u8 usb_speed = 1;        /* from register,1--HS, 0--FS  */
        u8 data[4] = { 0, 0, 0, 0 };
        u32 ts1_source = 0;
        u32 ts2_source = 0;
        u32 analog_source = 0;
        u8 _current_scenario_idx = 0xff;

        ts1_source = SOURCE_TS_BDA;
        ts2_source = SOURCE_TS_BDA;

        /* read board config register to find out which
        pcb config it is related to */
        retval = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER, BOARD_CFG_STAT,
                                       data, 4);
        if (retval < 0)
                return retval;

        config_info = le32_to_cpu(*((__le32 *)data));
        usb_speed = (u8) (config_info & 0x1);

        /* Verify this device belongs to Bus power or Self power device */
        if (config_info & BUS_POWER) {        /* bus-power */
                switch (config_info & BUSPOWER_MASK) {
                case TS1_PORT | BUS_POWER:
                        cx231xx_Scenario[INDEX_BUSPOWER_DIGITAL_ONLY].speed =
                            usb_speed;
                        p_pcb_info =
                            &cx231xx_Scenario[INDEX_BUSPOWER_DIGITAL_ONLY];
                        _current_scenario_idx = INDEX_BUSPOWER_DIGITAL_ONLY;
                        break;
                case AVDEC_ENABLE | BUS_POWER:
                        cx231xx_Scenario[INDEX_BUSPOWER_ANALOG_ONLY].speed =
                            usb_speed;
                        p_pcb_info =
                            &cx231xx_Scenario[INDEX_BUSPOWER_ANALOG_ONLY];
                        _current_scenario_idx = INDEX_BUSPOWER_ANALOG_ONLY;
                        break;
                case AVDEC_ENABLE | BUS_POWER | TS1_PORT:
                        cx231xx_Scenario[INDEX_BUSPOWER_DIF_ONLY].speed =
                            usb_speed;
                        p_pcb_info = &cx231xx_Scenario[INDEX_BUSPOWER_DIF_ONLY];
                        _current_scenario_idx = INDEX_BUSPOWER_DIF_ONLY;
                        break;
                default:
                        dev_err(dev->dev,
                                "bad config in buspower!!!!\nconfig_info=%x\n",
                                config_info & BUSPOWER_MASK);
                        return 1;
                }
        } else {                /* self-power */

                switch (config_info & SELFPOWER_MASK) {
                case TS1_PORT | SELF_POWER:
                        cx231xx_Scenario[INDEX_SELFPOWER_DIGITAL_ONLY].speed =
                            usb_speed;
                        p_pcb_info =
                            &cx231xx_Scenario[INDEX_SELFPOWER_DIGITAL_ONLY];
                        _current_scenario_idx = INDEX_SELFPOWER_DIGITAL_ONLY;
                        break;
                case TS1_TS2_PORT | SELF_POWER:
                        cx231xx_Scenario[INDEX_SELFPOWER_DUAL_DIGITAL].speed =
                            usb_speed;
                        cx231xx_Scenario[INDEX_SELFPOWER_DUAL_DIGITAL].
                            ts2_source = ts2_source;
                        p_pcb_info =
                            &cx231xx_Scenario[INDEX_SELFPOWER_DUAL_DIGITAL];
                        _current_scenario_idx = INDEX_SELFPOWER_DUAL_DIGITAL;
                        break;
                case AVDEC_ENABLE | SELF_POWER:
                        cx231xx_Scenario[INDEX_SELFPOWER_ANALOG_ONLY].speed =
                            usb_speed;
                        cx231xx_Scenario[INDEX_SELFPOWER_ANALOG_ONLY].
                            analog_source = analog_source;
                        p_pcb_info =
                            &cx231xx_Scenario[INDEX_SELFPOWER_ANALOG_ONLY];
                        _current_scenario_idx = INDEX_SELFPOWER_ANALOG_ONLY;
                        break;
                case AVDEC_ENABLE | TS1_PORT | SELF_POWER:
                        cx231xx_Scenario[INDEX_SELFPOWER_DUAL].speed =
                            usb_speed;
                        cx231xx_Scenario[INDEX_SELFPOWER_DUAL].ts1_source =
                            ts1_source;
                        cx231xx_Scenario[INDEX_SELFPOWER_DUAL].analog_source =
                            analog_source;
                        p_pcb_info = &cx231xx_Scenario[INDEX_SELFPOWER_DUAL];
                        _current_scenario_idx = INDEX_SELFPOWER_DUAL;
                        break;
                case AVDEC_ENABLE | TS1_TS2_PORT | SELF_POWER:
                        cx231xx_Scenario[INDEX_SELFPOWER_TRIPLE].speed =
                            usb_speed;
                        cx231xx_Scenario[INDEX_SELFPOWER_TRIPLE].ts1_source =
                            ts1_source;
                        cx231xx_Scenario[INDEX_SELFPOWER_TRIPLE].ts2_source =
                            ts2_source;
                        cx231xx_Scenario[INDEX_SELFPOWER_TRIPLE].analog_source =
                            analog_source;
                        p_pcb_info = &cx231xx_Scenario[INDEX_SELFPOWER_TRIPLE];
                        _current_scenario_idx = INDEX_SELFPOWER_TRIPLE;
                        break;
                case AVDEC_ENABLE | TS1VIP_TS2_PORT | SELF_POWER:
                        cx231xx_Scenario[INDEX_SELFPOWER_COMPRESSOR].speed =
                            usb_speed;
                        cx231xx_Scenario[INDEX_SELFPOWER_COMPRESSOR].
                            analog_source = analog_source;
                        p_pcb_info =
                            &cx231xx_Scenario[INDEX_SELFPOWER_COMPRESSOR];
                        _current_scenario_idx = INDEX_SELFPOWER_COMPRESSOR;
                        break;
                default:
                        dev_err(dev->dev,
                                "bad scenario!!!!!\nconfig_info=%x\n",
                                config_info & SELFPOWER_MASK);
                        return -ENODEV;
                }
        }

        dev->current_scenario_idx = _current_scenario_idx;

        memcpy(&dev->current_pcb_config, p_pcb_info,
                   sizeof(struct pcb_config));

        if (pcb_debug) {
                dev_info(dev->dev,
                         "SC(0x00) register = 0x%x\n", config_info);
                dev_info(dev->dev,
                         "scenario %d\n",
                         (dev->current_pcb_config.index) + 1);
                dev_info(dev->dev,
                        "type=%x\n",
                         dev->current_pcb_config.type);
                dev_info(dev->dev,
                         "mode=%x\n",
                         dev->current_pcb_config.mode);
                dev_info(dev->dev,
                         "speed=%x\n",
                         dev->current_pcb_config.speed);
                dev_info(dev->dev,
                         "ts1_source=%x\n",
                         dev->current_pcb_config.ts1_source);
                dev_info(dev->dev,
                         "ts2_source=%x\n",
                         dev->current_pcb_config.ts2_source);
                dev_info(dev->dev,
                         "analog_source=%x\n",
                         dev->current_pcb_config.analog_source);
        }

        return 0;
}










































































































































































































































































































































































































































































    2 













    2 
















    2 



    2 



































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
// SPDX-License-Identifier: GPL-2.0
/*
 *  thermal.c - sysfs interface of thermal devices
 *
 *  Copyright (C) 2016 Eduardo Valentin <edubezval@gmail.com>
 *
 *  Highly based on original thermal_core.c
 *  Copyright (C) 2008 Intel Corp
 *  Copyright (C) 2008 Zhang Rui <rui.zhang@intel.com>
 *  Copyright (C) 2008 Sujith Thomas <sujith.thomas@intel.com>
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/container_of.h>
#include <linux/sysfs.h>
#include <linux/device.h>
#include <linux/err.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/jiffies.h>

#include "thermal_core.h"

/* sys I/F for thermal zone */

static ssize_t
type_show(struct device *dev, struct device_attribute *attr, char *buf)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);

        return sprintf(buf, "%s\n", tz->type);
}

static ssize_t
temp_show(struct device *dev, struct device_attribute *attr, char *buf)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        int temperature, ret;

        ret = thermal_zone_get_temp(tz, &temperature);

        if (ret)
                return ret;

        return sprintf(buf, "%d\n", temperature);
}

static ssize_t
mode_show(struct device *dev, struct device_attribute *attr, char *buf)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);

        guard(thermal_zone)(tz);

        if (tz->mode == THERMAL_DEVICE_ENABLED)
                return sprintf(buf, "enabled\n");

        return sprintf(buf, "disabled\n");
}

static ssize_t
mode_store(struct device *dev, struct device_attribute *attr,
           const char *buf, size_t count)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        int result;

        if (!strncmp(buf, "enabled", sizeof("enabled") - 1))
                result = thermal_zone_device_enable(tz);
        else if (!strncmp(buf, "disabled", sizeof("disabled") - 1))
                result = thermal_zone_device_disable(tz);
        else
                result = -EINVAL;

        if (result)
                return result;

        return count;
}

#define thermal_trip_of_attr(_ptr_, _attr_)                                \
        ({                                                                 \
                struct thermal_trip_desc *td;                                \
                                                                        \
                td = container_of(_ptr_, struct thermal_trip_desc,        \
                                  trip_attrs._attr_.attr);                \
                &td->trip;                                                \
        })

static ssize_t
trip_point_type_show(struct device *dev, struct device_attribute *attr,
                     char *buf)
{
        struct thermal_trip *trip = thermal_trip_of_attr(attr, type);

        return sprintf(buf, "%s\n", thermal_trip_type_name(trip->type));
}

static ssize_t
trip_point_temp_store(struct device *dev, struct device_attribute *attr,
                      const char *buf, size_t count)
{
        struct thermal_trip *trip = thermal_trip_of_attr(attr, temp);
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        int temp;

        if (kstrtoint(buf, 10, &temp))
                return -EINVAL;

        guard(thermal_zone)(tz);

        if (temp == trip->temperature)
                return count;

        /* Arrange the condition to avoid integer overflows. */
        if (temp != THERMAL_TEMP_INVALID &&
            temp <= trip->hysteresis + THERMAL_TEMP_INVALID)
                return -EINVAL;

        if (tz->ops.set_trip_temp) {
                int ret;

                ret = tz->ops.set_trip_temp(tz, trip, temp);
                if (ret)
                        return ret;
        }

        thermal_zone_set_trip_temp(tz, trip, temp);

        __thermal_zone_device_update(tz, THERMAL_TRIP_CHANGED);

        return count;
}

static ssize_t
trip_point_temp_show(struct device *dev, struct device_attribute *attr,
                     char *buf)
{
        struct thermal_trip *trip = thermal_trip_of_attr(attr, temp);

        return sprintf(buf, "%d\n", READ_ONCE(trip->temperature));
}

static ssize_t
trip_point_hyst_store(struct device *dev, struct device_attribute *attr,
                      const char *buf, size_t count)
{
        struct thermal_trip *trip = thermal_trip_of_attr(attr, hyst);
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        int hyst;

        if (kstrtoint(buf, 10, &hyst) || hyst < 0)
                return -EINVAL;

        guard(thermal_zone)(tz);

        if (hyst == trip->hysteresis)
                return count;

        /*
         * Allow the hysteresis to be updated when the temperature is invalid
         * to allow user space to avoid having to adjust hysteresis after a
         * valid temperature has been set, but in that case just change the
         * value and do nothing else.
         */
        if (trip->temperature == THERMAL_TEMP_INVALID) {
                WRITE_ONCE(trip->hysteresis, hyst);
                return count;
        }

        if (trip->temperature - hyst <= THERMAL_TEMP_INVALID)
                return -EINVAL;

        thermal_zone_set_trip_hyst(tz, trip, hyst);

        __thermal_zone_device_update(tz, THERMAL_TRIP_CHANGED);

        return count;
}

static ssize_t
trip_point_hyst_show(struct device *dev, struct device_attribute *attr,
                     char *buf)
{
        struct thermal_trip *trip = thermal_trip_of_attr(attr, hyst);

        return sprintf(buf, "%d\n", READ_ONCE(trip->hysteresis));
}

static ssize_t
policy_store(struct device *dev, struct device_attribute *attr,
             const char *buf, size_t count)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        char name[THERMAL_NAME_LENGTH];
        int ret;

        snprintf(name, sizeof(name), "%s", buf);

        ret = thermal_zone_device_set_policy(tz, name);
        if (!ret)
                ret = count;

        return ret;
}

static ssize_t
policy_show(struct device *dev, struct device_attribute *devattr, char *buf)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);

        return sprintf(buf, "%s\n", tz->governor->name);
}

static ssize_t
available_policies_show(struct device *dev, struct device_attribute *devattr,
                        char *buf)
{
        return thermal_build_list_of_policies(buf);
}

#if (IS_ENABLED(CONFIG_THERMAL_EMULATION))
static ssize_t
emul_temp_store(struct device *dev, struct device_attribute *attr,
                const char *buf, size_t count)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        int temperature;

        if (kstrtoint(buf, 10, &temperature))
                return -EINVAL;

        guard(thermal_zone)(tz);

        if (tz->ops.set_emul_temp) {
                int ret;

                ret = tz->ops.set_emul_temp(tz, temperature);
                if (ret)
                        return ret;
        } else {
                tz->emul_temperature = temperature;
        }

        __thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED);

        return count;
}
static DEVICE_ATTR_WO(emul_temp);
#endif

static ssize_t
sustainable_power_show(struct device *dev, struct device_attribute *devattr,
                       char *buf)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);

        if (tz->tzp)
                return sprintf(buf, "%u\n", tz->tzp->sustainable_power);
        else
                return -EIO;
}

static ssize_t
sustainable_power_store(struct device *dev, struct device_attribute *devattr,
                        const char *buf, size_t count)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        u32 sustainable_power;

        if (!tz->tzp)
                return -EIO;

        if (kstrtou32(buf, 10, &sustainable_power))
                return -EINVAL;

        tz->tzp->sustainable_power = sustainable_power;

        return count;
}

#define create_s32_tzp_attr(name)                                        \
        static ssize_t                                                        \
        name##_show(struct device *dev, struct device_attribute *devattr, \
                char *buf)                                                \
        {                                                                \
        struct thermal_zone_device *tz = to_thermal_zone(dev);                \
                                                                        \
        if (tz->tzp)                                                        \
                return sprintf(buf, "%d\n", tz->tzp->name);                \
        else                                                                \
                return -EIO;                                                \
        }                                                                \
                                                                        \
        static ssize_t                                                        \
        name##_store(struct device *dev, struct device_attribute *devattr, \
                const char *buf, size_t count)                                \
        {                                                                \
                struct thermal_zone_device *tz = to_thermal_zone(dev);        \
                s32 value;                                                \
                                                                        \
                if (!tz->tzp)                                                \
                        return -EIO;                                        \
                                                                        \
                if (kstrtos32(buf, 10, &value))                                \
                        return -EINVAL;                                        \
                                                                        \
                tz->tzp->name = value;                                        \
                                                                        \
                return count;                                                \
        }                                                                \
        static DEVICE_ATTR_RW(name)

create_s32_tzp_attr(k_po);
create_s32_tzp_attr(k_pu);
create_s32_tzp_attr(k_i);
create_s32_tzp_attr(k_d);
create_s32_tzp_attr(integral_cutoff);
create_s32_tzp_attr(slope);
create_s32_tzp_attr(offset);
#undef create_s32_tzp_attr

/*
 * These are thermal zone device attributes that will always be present.
 * All the attributes created for tzp (create_s32_tzp_attr) also are always
 * present on the sysfs interface.
 */
static DEVICE_ATTR_RO(type);
static DEVICE_ATTR_RO(temp);
static DEVICE_ATTR_RW(policy);
static DEVICE_ATTR_RO(available_policies);
static DEVICE_ATTR_RW(sustainable_power);

/* These thermal zone device attributes are created based on conditions */
static DEVICE_ATTR_RW(mode);

/* These attributes are unconditionally added to a thermal zone */
static struct attribute *thermal_zone_dev_attrs[] = {
        &dev_attr_type.attr,
        &dev_attr_temp.attr,
#if (IS_ENABLED(CONFIG_THERMAL_EMULATION))
        &dev_attr_emul_temp.attr,
#endif
        &dev_attr_policy.attr,
        &dev_attr_available_policies.attr,
        &dev_attr_sustainable_power.attr,
        &dev_attr_k_po.attr,
        &dev_attr_k_pu.attr,
        &dev_attr_k_i.attr,
        &dev_attr_k_d.attr,
        &dev_attr_integral_cutoff.attr,
        &dev_attr_slope.attr,
        &dev_attr_offset.attr,
        NULL,
};

static const struct attribute_group thermal_zone_attribute_group = {
        .attrs = thermal_zone_dev_attrs,
};

static struct attribute *thermal_zone_mode_attrs[] = {
        &dev_attr_mode.attr,
        NULL,
};

static const struct attribute_group thermal_zone_mode_attribute_group = {
        .attrs = thermal_zone_mode_attrs,
};

static const struct attribute_group *thermal_zone_attribute_groups[] = {
        &thermal_zone_attribute_group,
        &thermal_zone_mode_attribute_group,
        /* This is not NULL terminated as we create the group dynamically */
};

/**
 * create_trip_attrs() - create attributes for trip points
 * @tz:                the thermal zone device
 *
 * helper function to instantiate sysfs entries for every trip
 * point and its properties of a struct thermal_zone_device.
 *
 * Return: 0 on success, the proper error value otherwise.
 */
static int create_trip_attrs(struct thermal_zone_device *tz)
{
        struct thermal_trip_desc *td;
        struct attribute **attrs;
        int i;

        attrs = kcalloc(tz->num_trips * 3 + 1, sizeof(*attrs), GFP_KERNEL);
        if (!attrs)
                return -ENOMEM;

        i = 0;
        for_each_trip_desc(tz, td) {
                struct thermal_trip_attrs *trip_attrs = &td->trip_attrs;

                /* create trip type attribute */
                snprintf(trip_attrs->type.name, THERMAL_NAME_LENGTH,
                         "trip_point_%d_type", i);

                sysfs_attr_init(&trip_attrs->type.attr.attr);
                trip_attrs->type.attr.attr.name = trip_attrs->type.name;
                trip_attrs->type.attr.attr.mode = S_IRUGO;
                trip_attrs->type.attr.show = trip_point_type_show;
                attrs[i] = &trip_attrs->type.attr.attr;

                /* create trip temp attribute */
                snprintf(trip_attrs->temp.name, THERMAL_NAME_LENGTH,
                         "trip_point_%d_temp", i);

                sysfs_attr_init(&trip_attrs->temp.attr.attr);
                trip_attrs->temp.attr.attr.name = trip_attrs->temp.name;
                trip_attrs->temp.attr.attr.mode = S_IRUGO;
                trip_attrs->temp.attr.show = trip_point_temp_show;
                if (td->trip.flags & THERMAL_TRIP_FLAG_RW_TEMP) {
                        trip_attrs->temp.attr.attr.mode |= S_IWUSR;
                        trip_attrs->temp.attr.store = trip_point_temp_store;
                }
                attrs[i + tz->num_trips] = &trip_attrs->temp.attr.attr;

                snprintf(trip_attrs->hyst.name, THERMAL_NAME_LENGTH,
                         "trip_point_%d_hyst", i);

                sysfs_attr_init(&trip_attrs->hyst.attr.attr);
                trip_attrs->hyst.attr.attr.name = trip_attrs->hyst.name;
                trip_attrs->hyst.attr.attr.mode = S_IRUGO;
                trip_attrs->hyst.attr.show = trip_point_hyst_show;
                if (td->trip.flags & THERMAL_TRIP_FLAG_RW_HYST) {
                        trip_attrs->hyst.attr.attr.mode |= S_IWUSR;
                        trip_attrs->hyst.attr.store = trip_point_hyst_store;
                }
                attrs[i + 2 * tz->num_trips] = &trip_attrs->hyst.attr.attr;
                i++;
        }
        attrs[tz->num_trips * 3] = NULL;

        tz->trips_attribute_group.attrs = attrs;

        return 0;
}

/**
 * destroy_trip_attrs() - destroy attributes for trip points
 * @tz:                the thermal zone device
 *
 * helper function to free resources allocated by create_trip_attrs()
 */
static void destroy_trip_attrs(struct thermal_zone_device *tz)
{
        if (tz)
                kfree(tz->trips_attribute_group.attrs);
}

int thermal_zone_create_device_groups(struct thermal_zone_device *tz)
{
        const struct attribute_group **groups;
        int i, size, result;

        /* we need one extra for trips and the NULL to terminate the array */
        size = ARRAY_SIZE(thermal_zone_attribute_groups) + 2;
        /* This also takes care of API requirement to be NULL terminated */
        groups = kcalloc(size, sizeof(*groups), GFP_KERNEL);
        if (!groups)
                return -ENOMEM;

        for (i = 0; i < size - 2; i++)
                groups[i] = thermal_zone_attribute_groups[i];

        if (tz->num_trips) {
                result = create_trip_attrs(tz);
                if (result) {
                        kfree(groups);

                        return result;
                }

                groups[size - 2] = &tz->trips_attribute_group;
        }

        tz->device.groups = groups;

        return 0;
}

void thermal_zone_destroy_device_groups(struct thermal_zone_device *tz)
{
        if (!tz)
                return;

        if (tz->num_trips)
                destroy_trip_attrs(tz);

        kfree(tz->device.groups);
}

/* sys I/F for cooling device */
static ssize_t
cdev_type_show(struct device *dev, struct device_attribute *attr, char *buf)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);

        return sprintf(buf, "%s\n", cdev->type);
}

static ssize_t max_state_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);

        return sprintf(buf, "%ld\n", cdev->max_state);
}

static ssize_t cur_state_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
        unsigned long state;
        int ret;

        ret = cdev->ops->get_cur_state(cdev, &state);
        if (ret)
                return ret;
        return sprintf(buf, "%ld\n", state);
}

static ssize_t
cur_state_store(struct device *dev, struct device_attribute *attr,
                const char *buf, size_t count)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
        unsigned long state;
        int result;

        if (sscanf(buf, "%ld\n", &state) != 1)
                return -EINVAL;

        if ((long)state < 0)
                return -EINVAL;

        /* Requested state should be less than max_state + 1 */
        if (state > cdev->max_state)
                return -EINVAL;

        guard(cooling_dev)(cdev);

        result = cdev->ops->set_cur_state(cdev, state);
        if (result)
                return result;

        thermal_cooling_device_stats_update(cdev, state);

        return count;
}

static struct device_attribute
dev_attr_cdev_type = __ATTR(type, 0444, cdev_type_show, NULL);
static DEVICE_ATTR_RO(max_state);
static DEVICE_ATTR_RW(cur_state);

static struct attribute *cooling_device_attrs[] = {
        &dev_attr_cdev_type.attr,
        &dev_attr_max_state.attr,
        &dev_attr_cur_state.attr,
        NULL,
};

static const struct attribute_group cooling_device_attr_group = {
        .attrs = cooling_device_attrs,
};

static const struct attribute_group *cooling_device_attr_groups[] = {
        &cooling_device_attr_group,
        NULL, /* Space allocated for cooling_device_stats_attr_group */
        NULL,
};

#ifdef CONFIG_THERMAL_STATISTICS
struct cooling_dev_stats {
        spinlock_t lock;
        unsigned int total_trans;
        unsigned long state;
        ktime_t last_time;
        ktime_t *time_in_state;
        unsigned int *trans_table;
};

static void update_time_in_state(struct cooling_dev_stats *stats)
{
        ktime_t now = ktime_get(), delta;

        delta = ktime_sub(now, stats->last_time);
        stats->time_in_state[stats->state] =
                ktime_add(stats->time_in_state[stats->state], delta);
        stats->last_time = now;
}

void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev,
                                         unsigned long new_state)
{
        struct cooling_dev_stats *stats = cdev->stats;

        lockdep_assert_held(&cdev->lock);

        if (!stats)
                return;

        spin_lock(&stats->lock);

        if (stats->state == new_state)
                goto unlock;

        update_time_in_state(stats);
        stats->trans_table[stats->state * (cdev->max_state + 1) + new_state]++;
        stats->state = new_state;
        stats->total_trans++;

unlock:
        spin_unlock(&stats->lock);
}

static ssize_t total_trans_show(struct device *dev,
                                struct device_attribute *attr, char *buf)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
        struct cooling_dev_stats *stats;
        int ret;

        guard(cooling_dev)(cdev);

        stats = cdev->stats;
        if (!stats)
                return 0;

        spin_lock(&stats->lock);
        ret = sprintf(buf, "%u\n", stats->total_trans);
        spin_unlock(&stats->lock);

        return ret;
}

static ssize_t
time_in_state_ms_show(struct device *dev, struct device_attribute *attr,
                      char *buf)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
        struct cooling_dev_stats *stats;
        ssize_t len = 0;
        int i;

        guard(cooling_dev)(cdev);

        stats = cdev->stats;
        if (!stats)
                return 0;

        spin_lock(&stats->lock);

        update_time_in_state(stats);

        for (i = 0; i <= cdev->max_state; i++) {
                len += sprintf(buf + len, "state%u\t%llu\n", i,
                               ktime_to_ms(stats->time_in_state[i]));
        }
        spin_unlock(&stats->lock);

        return len;
}

static ssize_t
reset_store(struct device *dev, struct device_attribute *attr, const char *buf,
            size_t count)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
        struct cooling_dev_stats *stats;
        int i, states;

        guard(cooling_dev)(cdev);

        stats = cdev->stats;
        if (!stats)
                return count;

        states = cdev->max_state + 1;

        spin_lock(&stats->lock);

        stats->total_trans = 0;
        stats->last_time = ktime_get();
        memset(stats->trans_table, 0,
               states * states * sizeof(*stats->trans_table));

        for (i = 0; i < states; i++)
                stats->time_in_state[i] = ktime_set(0, 0);

        spin_unlock(&stats->lock);

        return count;
}

static ssize_t trans_table_show(struct device *dev,
                                struct device_attribute *attr, char *buf)
{
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
        struct cooling_dev_stats *stats;
        ssize_t len = 0;
        int i, j;

        guard(cooling_dev)(cdev);

        stats = cdev->stats;
        if (!stats)
                return -ENODATA;

        len += snprintf(buf + len, PAGE_SIZE - len, " From  :    To\n");
        len += snprintf(buf + len, PAGE_SIZE - len, "       : ");
        for (i = 0; i <= cdev->max_state; i++) {
                if (len >= PAGE_SIZE)
                        break;
                len += snprintf(buf + len, PAGE_SIZE - len, "state%2u  ", i);
        }
        if (len >= PAGE_SIZE)
                return PAGE_SIZE;

        len += snprintf(buf + len, PAGE_SIZE - len, "\n");

        for (i = 0; i <= cdev->max_state; i++) {
                if (len >= PAGE_SIZE)
                        break;

                len += snprintf(buf + len, PAGE_SIZE - len, "state%2u:", i);

                for (j = 0; j <= cdev->max_state; j++) {
                        if (len >= PAGE_SIZE)
                                break;
                        len += snprintf(buf + len, PAGE_SIZE - len, "%8u ",
                                stats->trans_table[i * (cdev->max_state + 1) + j]);
                }
                if (len >= PAGE_SIZE)
                        break;
                len += snprintf(buf + len, PAGE_SIZE - len, "\n");
        }

        if (len >= PAGE_SIZE) {
                pr_warn_once("Thermal transition table exceeds PAGE_SIZE. Disabling\n");
                len = -EFBIG;
        }

        return len;
}

static DEVICE_ATTR_RO(total_trans);
static DEVICE_ATTR_RO(time_in_state_ms);
static DEVICE_ATTR_WO(reset);
static DEVICE_ATTR_RO(trans_table);

static struct attribute *cooling_device_stats_attrs[] = {
        &dev_attr_total_trans.attr,
        &dev_attr_time_in_state_ms.attr,
        &dev_attr_reset.attr,
        &dev_attr_trans_table.attr,
        NULL
};

static const struct attribute_group cooling_device_stats_attr_group = {
        .attrs = cooling_device_stats_attrs,
        .name = "stats"
};

static void cooling_device_stats_setup(struct thermal_cooling_device *cdev)
{
        const struct attribute_group *stats_attr_group = NULL;
        struct cooling_dev_stats *stats;
        /* Total number of states is highest state + 1 */
        unsigned long states = cdev->max_state + 1;
        int var;

        var = sizeof(*stats);
        var += sizeof(*stats->time_in_state) * states;
        var += sizeof(*stats->trans_table) * states * states;

        stats = kzalloc(var, GFP_KERNEL);
        if (!stats)
                goto out;

        stats->time_in_state = (ktime_t *)(stats + 1);
        stats->trans_table = (unsigned int *)(stats->time_in_state + states);
        cdev->stats = stats;
        stats->last_time = ktime_get();

        spin_lock_init(&stats->lock);

        stats_attr_group = &cooling_device_stats_attr_group;

out:
        /* Fill the empty slot left in cooling_device_attr_groups */
        var = ARRAY_SIZE(cooling_device_attr_groups) - 2;
        cooling_device_attr_groups[var] = stats_attr_group;
}

static void cooling_device_stats_destroy(struct thermal_cooling_device *cdev)
{
        kfree(cdev->stats);
        cdev->stats = NULL;
}

#else

static inline void
cooling_device_stats_setup(struct thermal_cooling_device *cdev) {}
static inline void
cooling_device_stats_destroy(struct thermal_cooling_device *cdev) {}

#endif /* CONFIG_THERMAL_STATISTICS */

void thermal_cooling_device_setup_sysfs(struct thermal_cooling_device *cdev)
{
        cooling_device_stats_setup(cdev);
        cdev->device.groups = cooling_device_attr_groups;
}

void thermal_cooling_device_destroy_sysfs(struct thermal_cooling_device *cdev)
{
        cooling_device_stats_destroy(cdev);
}

void thermal_cooling_device_stats_reinit(struct thermal_cooling_device *cdev)
{
        lockdep_assert_held(&cdev->lock);

        cooling_device_stats_destroy(cdev);
        cooling_device_stats_setup(cdev);
}

/* these helper will be used only at the time of bindig */
ssize_t
trip_point_show(struct device *dev, struct device_attribute *attr, char *buf)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        struct thermal_instance *instance;

        instance = container_of(attr, struct thermal_instance, attr);

        return sprintf(buf, "%d\n", thermal_zone_trip_id(tz, instance->trip));
}

ssize_t
weight_show(struct device *dev, struct device_attribute *attr, char *buf)
{
        struct thermal_instance *instance;

        instance = container_of(attr, struct thermal_instance, weight_attr);

        return sprintf(buf, "%d\n", instance->weight);
}

ssize_t weight_store(struct device *dev, struct device_attribute *attr,
                     const char *buf, size_t count)
{
        struct thermal_zone_device *tz = to_thermal_zone(dev);
        struct thermal_instance *instance;
        int ret, weight;

        ret = kstrtoint(buf, 0, &weight);
        if (ret)
                return ret;

        instance = container_of(attr, struct thermal_instance, weight_attr);

        /* Don't race with governors using the 'weight' value */
        guard(thermal_zone)(tz);

        instance->weight = weight;

        thermal_governor_update_tz(tz, THERMAL_INSTANCE_WEIGHT_CHANGED);

        return count;
}































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































   48 
















































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * NetLabel Kernel API
 *
 * This file defines the kernel API for the NetLabel system.  The NetLabel
 * system manages static and dynamic label mappings for network protocols such
 * as CIPSO and RIPSO.
 *
 * Author: Paul Moore <paul@paul-moore.com>
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
 */

#include <linux/init.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/audit.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/netlabel.h>
#include <net/cipso_ipv4.h>
#include <net/calipso.h>
#include <asm/bug.h>
#include <linux/atomic.h>

#include "netlabel_domainhash.h"
#include "netlabel_unlabeled.h"
#include "netlabel_cipso_v4.h"
#include "netlabel_calipso.h"
#include "netlabel_user.h"
#include "netlabel_mgmt.h"
#include "netlabel_addrlist.h"

/*
 * Configuration Functions
 */

/**
 * netlbl_cfg_map_del - Remove a NetLabel/LSM domain mapping
 * @domain: the domain mapping to remove
 * @family: address family
 * @addr: IP address
 * @mask: IP address mask
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Removes a NetLabel/LSM domain mapping.  A @domain value of NULL causes the
 * default domain mapping to be removed.  Returns zero on success, negative
 * values on failure.
 *
 */
int netlbl_cfg_map_del(const char *domain,
                       u16 family,
                       const void *addr,
                       const void *mask,
                       struct netlbl_audit *audit_info)
{
        if (addr == NULL && mask == NULL) {
                return netlbl_domhsh_remove(domain, family, audit_info);
        } else if (addr != NULL && mask != NULL) {
                switch (family) {
                case AF_INET:
                        return netlbl_domhsh_remove_af4(domain, addr, mask,
                                                        audit_info);
#if IS_ENABLED(CONFIG_IPV6)
                case AF_INET6:
                        return netlbl_domhsh_remove_af6(domain, addr, mask,
                                                        audit_info);
#endif /* IPv6 */
                default:
                        return -EPFNOSUPPORT;
                }
        } else
                return -EINVAL;
}

/**
 * netlbl_cfg_unlbl_map_add - Add a new unlabeled mapping
 * @domain: the domain mapping to add
 * @family: address family
 * @addr: IP address
 * @mask: IP address mask
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Adds a new unlabeled NetLabel/LSM domain mapping.  A @domain value of NULL
 * causes a new default domain mapping to be added.  Returns zero on success,
 * negative values on failure.
 *
 */
int netlbl_cfg_unlbl_map_add(const char *domain,
                             u16 family,
                             const void *addr,
                             const void *mask,
                             struct netlbl_audit *audit_info)
{
        int ret_val = -ENOMEM;
        struct netlbl_dom_map *entry;
        struct netlbl_domaddr_map *addrmap = NULL;
        struct netlbl_domaddr4_map *map4 = NULL;
        struct netlbl_domaddr6_map *map6 = NULL;

        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
        if (entry == NULL)
                return -ENOMEM;
        if (domain != NULL) {
                entry->domain = kstrdup(domain, GFP_ATOMIC);
                if (entry->domain == NULL)
                        goto cfg_unlbl_map_add_failure;
        }
        entry->family = family;

        if (addr == NULL && mask == NULL)
                entry->def.type = NETLBL_NLTYPE_UNLABELED;
        else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
                        goto cfg_unlbl_map_add_failure;
                INIT_LIST_HEAD(&addrmap->list4);
                INIT_LIST_HEAD(&addrmap->list6);

                switch (family) {
                case AF_INET: {
                        const struct in_addr *addr4 = addr;
                        const struct in_addr *mask4 = mask;
                        map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
                        if (map4 == NULL)
                                goto cfg_unlbl_map_add_failure;
                        map4->def.type = NETLBL_NLTYPE_UNLABELED;
                        map4->list.addr = addr4->s_addr & mask4->s_addr;
                        map4->list.mask = mask4->s_addr;
                        map4->list.valid = 1;
                        ret_val = netlbl_af4list_add(&map4->list,
                                                     &addrmap->list4);
                        if (ret_val != 0)
                                goto cfg_unlbl_map_add_failure;
                        break;
                        }
#if IS_ENABLED(CONFIG_IPV6)
                case AF_INET6: {
                        const struct in6_addr *addr6 = addr;
                        const struct in6_addr *mask6 = mask;
                        map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
                        if (map6 == NULL)
                                goto cfg_unlbl_map_add_failure;
                        map6->def.type = NETLBL_NLTYPE_UNLABELED;
                        map6->list.addr = *addr6;
                        map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
                        map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
                        map6->list.addr.s6_addr32[2] &= mask6->s6_addr32[2];
                        map6->list.addr.s6_addr32[3] &= mask6->s6_addr32[3];
                        map6->list.mask = *mask6;
                        map6->list.valid = 1;
                        ret_val = netlbl_af6list_add(&map6->list,
                                                     &addrmap->list6);
                        if (ret_val != 0)
                                goto cfg_unlbl_map_add_failure;
                        break;
                        }
#endif /* IPv6 */
                default:
                        goto cfg_unlbl_map_add_failure;
                }

                entry->def.addrsel = addrmap;
                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
                goto cfg_unlbl_map_add_failure;
        }

        ret_val = netlbl_domhsh_add(entry, audit_info);
        if (ret_val != 0)
                goto cfg_unlbl_map_add_failure;

        return 0;

cfg_unlbl_map_add_failure:
        kfree(entry->domain);
        kfree(entry);
        kfree(addrmap);
        kfree(map4);
        kfree(map6);
        return ret_val;
}


/**
 * netlbl_cfg_unlbl_static_add - Adds a new static label
 * @net: network namespace
 * @dev_name: interface name
 * @addr: IP address in network byte order (struct in[6]_addr)
 * @mask: address mask in network byte order (struct in[6]_addr)
 * @family: address family
 * @secid: LSM secid value for the entry
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Adds a new NetLabel static label to be used when protocol provided labels
 * are not present on incoming traffic.  If @dev_name is NULL then the default
 * interface will be used.  Returns zero on success, negative values on failure.
 *
 */
int netlbl_cfg_unlbl_static_add(struct net *net,
                                const char *dev_name,
                                const void *addr,
                                const void *mask,
                                u16 family,
                                u32 secid,
                                struct netlbl_audit *audit_info)
{
        u32 addr_len;

        switch (family) {
        case AF_INET:
                addr_len = sizeof(struct in_addr);
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                addr_len = sizeof(struct in6_addr);
                break;
#endif /* IPv6 */
        default:
                return -EPFNOSUPPORT;
        }

        return netlbl_unlhsh_add(net,
                                 dev_name, addr, mask, addr_len,
                                 secid, audit_info);
}

/**
 * netlbl_cfg_unlbl_static_del - Removes an existing static label
 * @net: network namespace
 * @dev_name: interface name
 * @addr: IP address in network byte order (struct in[6]_addr)
 * @mask: address mask in network byte order (struct in[6]_addr)
 * @family: address family
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Removes an existing NetLabel static label used when protocol provided labels
 * are not present on incoming traffic.  If @dev_name is NULL then the default
 * interface will be used.  Returns zero on success, negative values on failure.
 *
 */
int netlbl_cfg_unlbl_static_del(struct net *net,
                                const char *dev_name,
                                const void *addr,
                                const void *mask,
                                u16 family,
                                struct netlbl_audit *audit_info)
{
        u32 addr_len;

        switch (family) {
        case AF_INET:
                addr_len = sizeof(struct in_addr);
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                addr_len = sizeof(struct in6_addr);
                break;
#endif /* IPv6 */
        default:
                return -EPFNOSUPPORT;
        }

        return netlbl_unlhsh_remove(net,
                                    dev_name, addr, mask, addr_len,
                                    audit_info);
}

/**
 * netlbl_cfg_cipsov4_add - Add a new CIPSOv4 DOI definition
 * @doi_def: CIPSO DOI definition
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Add a new CIPSO DOI definition as defined by @doi_def.  Returns zero on
 * success and negative values on failure.
 *
 */
int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
                           struct netlbl_audit *audit_info)
{
        return cipso_v4_doi_add(doi_def, audit_info);
}

/**
 * netlbl_cfg_cipsov4_del - Remove an existing CIPSOv4 DOI definition
 * @doi: CIPSO DOI
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Remove an existing CIPSO DOI definition matching @doi.  Returns zero on
 * success and negative values on failure.
 *
 */
void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info)
{
        cipso_v4_doi_remove(doi, audit_info);
}

/**
 * netlbl_cfg_cipsov4_map_add - Add a new CIPSOv4 DOI mapping
 * @doi: the CIPSO DOI
 * @domain: the domain mapping to add
 * @addr: IP address
 * @mask: IP address mask
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Add a new NetLabel/LSM domain mapping for the given CIPSO DOI to the NetLabel
 * subsystem.  A @domain value of NULL adds a new default domain mapping.
 * Returns zero on success, negative values on failure.
 *
 */
int netlbl_cfg_cipsov4_map_add(u32 doi,
                               const char *domain,
                               const struct in_addr *addr,
                               const struct in_addr *mask,
                               struct netlbl_audit *audit_info)
{
        int ret_val = -ENOMEM;
        struct cipso_v4_doi *doi_def;
        struct netlbl_dom_map *entry;
        struct netlbl_domaddr_map *addrmap = NULL;
        struct netlbl_domaddr4_map *addrinfo = NULL;

        doi_def = cipso_v4_doi_getdef(doi);
        if (doi_def == NULL)
                return -ENOENT;

        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
        if (entry == NULL)
                goto out_entry;
        entry->family = AF_INET;
        if (domain != NULL) {
                entry->domain = kstrdup(domain, GFP_ATOMIC);
                if (entry->domain == NULL)
                        goto out_domain;
        }

        if (addr == NULL && mask == NULL) {
                entry->def.cipso = doi_def;
                entry->def.type = NETLBL_NLTYPE_CIPSOV4;
        } else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
                        goto out_addrmap;
                INIT_LIST_HEAD(&addrmap->list4);
                INIT_LIST_HEAD(&addrmap->list6);

                addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                if (addrinfo == NULL)
                        goto out_addrinfo;
                addrinfo->def.cipso = doi_def;
                addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
                addrinfo->list.addr = addr->s_addr & mask->s_addr;
                addrinfo->list.mask = mask->s_addr;
                addrinfo->list.valid = 1;
                ret_val = netlbl_af4list_add(&addrinfo->list, &addrmap->list4);
                if (ret_val != 0)
                        goto cfg_cipsov4_map_add_failure;

                entry->def.addrsel = addrmap;
                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
                goto out_addrmap;
        }

        ret_val = netlbl_domhsh_add(entry, audit_info);
        if (ret_val != 0)
                goto cfg_cipsov4_map_add_failure;

        return 0;

cfg_cipsov4_map_add_failure:
        kfree(addrinfo);
out_addrinfo:
        kfree(addrmap);
out_addrmap:
        kfree(entry->domain);
out_domain:
        kfree(entry);
out_entry:
        cipso_v4_doi_putdef(doi_def);
        return ret_val;
}

/**
 * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
 * @doi_def: CALIPSO DOI definition
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Add a new CALIPSO DOI definition as defined by @doi_def.  Returns zero on
 * success and negative values on failure.
 *
 */
int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
                           struct netlbl_audit *audit_info)
{
#if IS_ENABLED(CONFIG_IPV6)
        return calipso_doi_add(doi_def, audit_info);
#else /* IPv6 */
        return -ENOSYS;
#endif /* IPv6 */
}

/**
 * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
 * @doi: CALIPSO DOI
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Remove an existing CALIPSO DOI definition matching @doi.  Returns zero on
 * success and negative values on failure.
 *
 */
void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
{
#if IS_ENABLED(CONFIG_IPV6)
        calipso_doi_remove(doi, audit_info);
#endif /* IPv6 */
}

/**
 * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
 * @doi: the CALIPSO DOI
 * @domain: the domain mapping to add
 * @addr: IP address
 * @mask: IP address mask
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
 * NetLabel subsystem.  A @domain value of NULL adds a new default domain
 * mapping.  Returns zero on success, negative values on failure.
 *
 */
int netlbl_cfg_calipso_map_add(u32 doi,
                               const char *domain,
                               const struct in6_addr *addr,
                               const struct in6_addr *mask,
                               struct netlbl_audit *audit_info)
{
#if IS_ENABLED(CONFIG_IPV6)
        int ret_val = -ENOMEM;
        struct calipso_doi *doi_def;
        struct netlbl_dom_map *entry;
        struct netlbl_domaddr_map *addrmap = NULL;
        struct netlbl_domaddr6_map *addrinfo = NULL;

        doi_def = calipso_doi_getdef(doi);
        if (doi_def == NULL)
                return -ENOENT;

        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
        if (entry == NULL)
                goto out_entry;
        entry->family = AF_INET6;
        if (domain != NULL) {
                entry->domain = kstrdup(domain, GFP_ATOMIC);
                if (entry->domain == NULL)
                        goto out_domain;
        }

        if (addr == NULL && mask == NULL) {
                entry->def.calipso = doi_def;
                entry->def.type = NETLBL_NLTYPE_CALIPSO;
        } else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
                        goto out_addrmap;
                INIT_LIST_HEAD(&addrmap->list4);
                INIT_LIST_HEAD(&addrmap->list6);

                addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                if (addrinfo == NULL)
                        goto out_addrinfo;
                addrinfo->def.calipso = doi_def;
                addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
                addrinfo->list.addr = *addr;
                addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
                addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
                addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
                addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
                addrinfo->list.mask = *mask;
                addrinfo->list.valid = 1;
                ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
                if (ret_val != 0)
                        goto cfg_calipso_map_add_failure;

                entry->def.addrsel = addrmap;
                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
                goto out_addrmap;
        }

        ret_val = netlbl_domhsh_add(entry, audit_info);
        if (ret_val != 0)
                goto cfg_calipso_map_add_failure;

        return 0;

cfg_calipso_map_add_failure:
        kfree(addrinfo);
out_addrinfo:
        kfree(addrmap);
out_addrmap:
        kfree(entry->domain);
out_domain:
        kfree(entry);
out_entry:
        calipso_doi_putdef(doi_def);
        return ret_val;
#else /* IPv6 */
        return -ENOSYS;
#endif /* IPv6 */
}

/*
 * Security Attribute Functions
 */

#define _CM_F_NONE        0x00000000
#define _CM_F_ALLOC        0x00000001
#define _CM_F_WALK        0x00000002

/**
 * _netlbl_catmap_getnode - Get a individual node from a catmap
 * @catmap: pointer to the category bitmap
 * @offset: the requested offset
 * @cm_flags: catmap flags, see _CM_F_*
 * @gfp_flags: memory allocation flags
 *
 * Description:
 * Iterate through the catmap looking for the node associated with @offset.
 * If the _CM_F_ALLOC flag is set in @cm_flags and there is no associated node,
 * one will be created and inserted into the catmap.  If the _CM_F_WALK flag is
 * set in @cm_flags and there is no associated node, the next highest node will
 * be returned.  Returns a pointer to the node on success, NULL on failure.
 *
 */
static struct netlbl_lsm_catmap *_netlbl_catmap_getnode(
                                             struct netlbl_lsm_catmap **catmap,
                                             u32 offset,
                                             unsigned int cm_flags,
                                             gfp_t gfp_flags)
{
        struct netlbl_lsm_catmap *iter = *catmap;
        struct netlbl_lsm_catmap *prev = NULL;

        if (iter == NULL)
                goto catmap_getnode_alloc;
        if (offset < iter->startbit)
                goto catmap_getnode_walk;
        while (iter && offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
                prev = iter;
                iter = iter->next;
        }
        if (iter == NULL || offset < iter->startbit)
                goto catmap_getnode_walk;

        return iter;

catmap_getnode_walk:
        if (cm_flags & _CM_F_WALK)
                return iter;
catmap_getnode_alloc:
        if (!(cm_flags & _CM_F_ALLOC))
                return NULL;

        iter = netlbl_catmap_alloc(gfp_flags);
        if (iter == NULL)
                return NULL;
        iter->startbit = offset & ~(NETLBL_CATMAP_SIZE - 1);

        if (prev == NULL) {
                iter->next = *catmap;
                *catmap = iter;
        } else {
                iter->next = prev->next;
                prev->next = iter;
        }

        return iter;
}

/**
 * netlbl_catmap_walk - Walk a LSM secattr catmap looking for a bit
 * @catmap: the category bitmap
 * @offset: the offset to start searching at, in bits
 *
 * Description:
 * This function walks a LSM secattr category bitmap starting at @offset and
 * returns the spot of the first set bit or -ENOENT if no bits are set.
 *
 */
int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset)
{
        struct netlbl_lsm_catmap *iter;
        u32 idx;
        u32 bit;
        u64 bitmap;

        iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0);
        if (iter == NULL)
                return -ENOENT;
        if (offset > iter->startbit) {
                offset -= iter->startbit;
                idx = offset / NETLBL_CATMAP_MAPSIZE;
                bit = offset % NETLBL_CATMAP_MAPSIZE;
        } else {
                idx = 0;
                bit = 0;
        }
        bitmap = iter->bitmap[idx] >> bit;

        for (;;) {
                if (bitmap != 0) {
                        while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
                                bitmap >>= 1;
                                bit++;
                        }
                        return iter->startbit +
                               (NETLBL_CATMAP_MAPSIZE * idx) + bit;
                }
                if (++idx >= NETLBL_CATMAP_MAPCNT) {
                        if (iter->next != NULL) {
                                iter = iter->next;
                                idx = 0;
                        } else
                                return -ENOENT;
                }
                bitmap = iter->bitmap[idx];
                bit = 0;
        }

        return -ENOENT;
}
EXPORT_SYMBOL(netlbl_catmap_walk);

/**
 * netlbl_catmap_walkrng - Find the end of a string of set bits
 * @catmap: the category bitmap
 * @offset: the offset to start searching at, in bits
 *
 * Description:
 * This function walks a LSM secattr category bitmap starting at @offset and
 * returns the spot of the first cleared bit or -ENOENT if the offset is past
 * the end of the bitmap.
 *
 */
int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset)
{
        struct netlbl_lsm_catmap *iter;
        struct netlbl_lsm_catmap *prev = NULL;
        u32 idx;
        u32 bit;
        u64 bitmask;
        u64 bitmap;

        iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0);
        if (iter == NULL)
                return -ENOENT;
        if (offset > iter->startbit) {
                offset -= iter->startbit;
                idx = offset / NETLBL_CATMAP_MAPSIZE;
                bit = offset % NETLBL_CATMAP_MAPSIZE;
        } else {
                idx = 0;
                bit = 0;
        }
        bitmask = NETLBL_CATMAP_BIT << bit;

        for (;;) {
                bitmap = iter->bitmap[idx];
                while (bitmask != 0 && (bitmap & bitmask) != 0) {
                        bitmask <<= 1;
                        bit++;
                }

                if (prev && idx == 0 && bit == 0)
                        return prev->startbit + NETLBL_CATMAP_SIZE - 1;
                else if (bitmask != 0)
                        return iter->startbit +
                                (NETLBL_CATMAP_MAPSIZE * idx) + bit - 1;
                else if (++idx >= NETLBL_CATMAP_MAPCNT) {
                        if (iter->next == NULL)
                                return iter->startbit + NETLBL_CATMAP_SIZE - 1;
                        prev = iter;
                        iter = iter->next;
                        idx = 0;
                }
                bitmask = NETLBL_CATMAP_BIT;
                bit = 0;
        }

        return -ENOENT;
}

/**
 * netlbl_catmap_getlong - Export an unsigned long bitmap
 * @catmap: pointer to the category bitmap
 * @offset: pointer to the requested offset
 * @bitmap: the exported bitmap
 *
 * Description:
 * Export a bitmap with an offset greater than or equal to @offset and return
 * it in @bitmap.  The @offset must be aligned to an unsigned long and will be
 * updated on return if different from what was requested; if the catmap is
 * empty at the requested offset and beyond, the @offset is set to (u32)-1.
 * Returns zero on success, negative values on failure.
 *
 */
int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
                          u32 *offset,
                          unsigned long *bitmap)
{
        struct netlbl_lsm_catmap *iter;
        u32 off = *offset;
        u32 idx;

        /* only allow aligned offsets */
        if ((off & (BITS_PER_LONG - 1)) != 0)
                return -EINVAL;

        /* a null catmap is equivalent to an empty one */
        if (!catmap) {
                *offset = (u32)-1;
                return 0;
        }

        if (off < catmap->startbit) {
                off = catmap->startbit;
                *offset = off;
        }
        iter = _netlbl_catmap_getnode(&catmap, off, _CM_F_WALK, 0);
        if (iter == NULL) {
                *offset = (u32)-1;
                return 0;
        }

        if (off < iter->startbit) {
                *offset = iter->startbit;
                off = 0;
        } else
                off -= iter->startbit;
        idx = off / NETLBL_CATMAP_MAPSIZE;
        *bitmap = iter->bitmap[idx] >> (off % NETLBL_CATMAP_MAPSIZE);

        return 0;
}

/**
 * netlbl_catmap_setbit - Set a bit in a LSM secattr catmap
 * @catmap: pointer to the category bitmap
 * @bit: the bit to set
 * @flags: memory allocation flags
 *
 * Description:
 * Set the bit specified by @bit in @catmap.  Returns zero on success,
 * negative values on failure.
 *
 */
int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
                         u32 bit,
                         gfp_t flags)
{
        struct netlbl_lsm_catmap *iter;
        u32 idx;

        iter = _netlbl_catmap_getnode(catmap, bit, _CM_F_ALLOC, flags);
        if (iter == NULL)
                return -ENOMEM;

        bit -= iter->startbit;
        idx = bit / NETLBL_CATMAP_MAPSIZE;
        iter->bitmap[idx] |= NETLBL_CATMAP_BIT << (bit % NETLBL_CATMAP_MAPSIZE);

        return 0;
}
EXPORT_SYMBOL(netlbl_catmap_setbit);

/**
 * netlbl_catmap_setrng - Set a range of bits in a LSM secattr catmap
 * @catmap: pointer to the category bitmap
 * @start: the starting bit
 * @end: the last bit in the string
 * @flags: memory allocation flags
 *
 * Description:
 * Set a range of bits, starting at @start and ending with @end.  Returns zero
 * on success, negative values on failure.
 *
 */
int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
                         u32 start,
                         u32 end,
                         gfp_t flags)
{
        int rc = 0;
        u32 spot = start;

        while (rc == 0 && spot <= end) {
                if (((spot & (BITS_PER_LONG - 1)) == 0) &&
                    ((end - spot) > BITS_PER_LONG)) {
                        rc = netlbl_catmap_setlong(catmap,
                                                   spot,
                                                   (unsigned long)-1,
                                                   flags);
                        spot += BITS_PER_LONG;
                } else
                        rc = netlbl_catmap_setbit(catmap, spot++, flags);
        }

        return rc;
}

/**
 * netlbl_catmap_setlong - Import an unsigned long bitmap
 * @catmap: pointer to the category bitmap
 * @offset: offset to the start of the imported bitmap
 * @bitmap: the bitmap to import
 * @flags: memory allocation flags
 *
 * Description:
 * Import the bitmap specified in @bitmap into @catmap, using the offset
 * in @offset.  The offset must be aligned to an unsigned long.  Returns zero
 * on success, negative values on failure.
 *
 */
int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
                          u32 offset,
                          unsigned long bitmap,
                          gfp_t flags)
{
        struct netlbl_lsm_catmap *iter;
        u32 idx;

        /* only allow aligned offsets */
        if ((offset & (BITS_PER_LONG - 1)) != 0)
                return -EINVAL;

        iter = _netlbl_catmap_getnode(catmap, offset, _CM_F_ALLOC, flags);
        if (iter == NULL)
                return -ENOMEM;

        offset -= iter->startbit;
        idx = offset / NETLBL_CATMAP_MAPSIZE;
        iter->bitmap[idx] |= (u64)bitmap
                             << (offset % NETLBL_CATMAP_MAPSIZE);

        return 0;
}

/* Bitmap functions
 */

/**
 * netlbl_bitmap_walk - Walk a bitmap looking for a bit
 * @bitmap: the bitmap
 * @bitmap_len: length in bits
 * @offset: starting offset
 * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
 *
 * Description:
 * Starting at @offset, walk the bitmap from left to right until either the
 * desired bit is found or we reach the end.  Return the bit offset, -1 if
 * not found.
 */
int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len,
                       u32 offset, u8 state)
{
        u32 bit_spot;
        u32 byte_offset;
        unsigned char bitmask;
        unsigned char byte;

        if (offset >= bitmap_len)
                return -1;
        byte_offset = offset / 8;
        byte = bitmap[byte_offset];
        bit_spot = offset;
        bitmask = 0x80 >> (offset % 8);

        while (bit_spot < bitmap_len) {
                if ((state && (byte & bitmask) == bitmask) ||
                    (state == 0 && (byte & bitmask) == 0))
                        return bit_spot;

                if (++bit_spot >= bitmap_len)
                        return -1;
                bitmask >>= 1;
                if (bitmask == 0) {
                        byte = bitmap[++byte_offset];
                        bitmask = 0x80;
                }
        }

        return -1;
}
EXPORT_SYMBOL(netlbl_bitmap_walk);

/**
 * netlbl_bitmap_setbit - Sets a single bit in a bitmap
 * @bitmap: the bitmap
 * @bit: the bit
 * @state: if non-zero, set the bit (1) else clear the bit (0)
 *
 * Description:
 * Set a single bit in the bitmask.  Returns zero on success, negative values
 * on error.
 */
void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state)
{
        u32 byte_spot;
        u8 bitmask;

        /* gcc always rounds to zero when doing integer division */
        byte_spot = bit / 8;
        bitmask = 0x80 >> (bit % 8);
        if (state)
                bitmap[byte_spot] |= bitmask;
        else
                bitmap[byte_spot] &= ~bitmask;
}
EXPORT_SYMBOL(netlbl_bitmap_setbit);

/*
 * LSM Functions
 */

/**
 * netlbl_enabled - Determine if the NetLabel subsystem is enabled
 *
 * Description:
 * The LSM can use this function to determine if it should use NetLabel
 * security attributes in it's enforcement mechanism.  Currently, NetLabel is
 * considered to be enabled when it's configuration contains a valid setup for
 * at least one labeled protocol (i.e. NetLabel can understand incoming
 * labeled packets of at least one type); otherwise NetLabel is considered to
 * be disabled.
 *
 */
int netlbl_enabled(void)
{
        /* At some point we probably want to expose this mechanism to the user
         * as well so that admins can toggle NetLabel regardless of the
         * configuration */
        return (atomic_read(&netlabel_mgmt_protocount) > 0);
}

/**
 * netlbl_sock_setattr - Label a socket using the correct protocol
 * @sk: the socket to label
 * @family: protocol family
 * @secattr: the security attributes
 * @sk_locked: true if caller holds the socket lock
 *
 * Description:
 * Attach the correct label to the given socket using the security attributes
 * specified in @secattr.  This function requires exclusive access to @sk,
 * which means it either needs to be in the process of being created or locked.
 * Returns zero on success, -EDESTADDRREQ if the domain is configured to use
 * network address selectors (can't blindly label the socket), and negative
 * values on all other failures.
 *
 */
int netlbl_sock_setattr(struct sock *sk,
                        u16 family,
                        const struct netlbl_lsm_secattr *secattr,
                        bool sk_locked)
{
        int ret_val;
        struct netlbl_dom_map *dom_entry;

        rcu_read_lock();
        dom_entry = netlbl_domhsh_getentry(secattr->domain, family);
        if (dom_entry == NULL) {
                ret_val = -ENOENT;
                goto socket_setattr_return;
        }
        switch (family) {
        case AF_INET:
                switch (dom_entry->def.type) {
                case NETLBL_NLTYPE_ADDRSELECT:
                        ret_val = -EDESTADDRREQ;
                        break;
                case NETLBL_NLTYPE_CIPSOV4:
                        ret_val = cipso_v4_sock_setattr(sk,
                                                        dom_entry->def.cipso,
                                                        secattr, sk_locked);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        ret_val = 0;
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                switch (dom_entry->def.type) {
                case NETLBL_NLTYPE_ADDRSELECT:
                        ret_val = -EDESTADDRREQ;
                        break;
                case NETLBL_NLTYPE_CALIPSO:
                        ret_val = calipso_sock_setattr(sk,
                                                       dom_entry->def.calipso,
                                                       secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        ret_val = 0;
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#endif /* IPv6 */
        default:
                ret_val = -EPROTONOSUPPORT;
        }

socket_setattr_return:
        rcu_read_unlock();
        return ret_val;
}

/**
 * netlbl_sock_delattr - Delete all the NetLabel labels on a socket
 * @sk: the socket
 *
 * Description:
 * Remove all the NetLabel labeling from @sk.  The caller is responsible for
 * ensuring that @sk is locked.
 *
 */
void netlbl_sock_delattr(struct sock *sk)
{
        switch (sk->sk_family) {
        case AF_INET:
                cipso_v4_sock_delattr(sk);
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                calipso_sock_delattr(sk);
                break;
#endif /* IPv6 */
        }
}

/**
 * netlbl_sock_getattr - Determine the security attributes of a sock
 * @sk: the sock
 * @secattr: the security attributes
 *
 * Description:
 * Examines the given sock to see if any NetLabel style labeling has been
 * applied to the sock, if so it parses the socket label and returns the
 * security attributes in @secattr.  Returns zero on success, negative values
 * on failure.
 *
 */
int netlbl_sock_getattr(struct sock *sk,
                        struct netlbl_lsm_secattr *secattr)
{
        int ret_val;

        switch (sk->sk_family) {
        case AF_INET:
                ret_val = cipso_v4_sock_getattr(sk, secattr);
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                ret_val = calipso_sock_getattr(sk, secattr);
                break;
#endif /* IPv6 */
        default:
                ret_val = -EPROTONOSUPPORT;
        }

        return ret_val;
}

/**
 * netlbl_sk_lock_check - Check if the socket lock has been acquired.
 * @sk: the socket to be checked
 *
 * Return: true if socket @sk is locked or if lock debugging is disabled at
 * runtime or compile-time; false otherwise
 *
 */
#ifdef CONFIG_LOCKDEP
bool netlbl_sk_lock_check(struct sock *sk)
{
        if (debug_locks)
                return lockdep_sock_is_held(sk);
        return true;
}
#else
bool netlbl_sk_lock_check(struct sock *sk)
{
        return true;
}
#endif

/**
 * netlbl_conn_setattr - Label a connected socket using the correct protocol
 * @sk: the socket to label
 * @addr: the destination address
 * @secattr: the security attributes
 *
 * Description:
 * Attach the correct label to the given connected socket using the security
 * attributes specified in @secattr.  The caller is responsible for ensuring
 * that @sk is locked.  Returns zero on success, negative values on failure.
 *
 */
int netlbl_conn_setattr(struct sock *sk,
                        struct sockaddr *addr,
                        const struct netlbl_lsm_secattr *secattr)
{
        int ret_val;
        struct sockaddr_in *addr4;
#if IS_ENABLED(CONFIG_IPV6)
        struct sockaddr_in6 *addr6;
#endif
        struct netlbl_dommap_def *entry;

        rcu_read_lock();
        switch (addr->sa_family) {
        case AF_INET:
                addr4 = (struct sockaddr_in *)addr;
                entry = netlbl_domhsh_getentry_af4(secattr->domain,
                                                   addr4->sin_addr.s_addr);
                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto conn_setattr_return;
                }
                switch (entry->type) {
                case NETLBL_NLTYPE_CIPSOV4:
                        ret_val = cipso_v4_sock_setattr(sk,
                                                        entry->cipso, secattr,
                                                        netlbl_sk_lock_check(sk));
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
                         * but we could remove other protocols if needed */
                        netlbl_sock_delattr(sk);
                        ret_val = 0;
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                addr6 = (struct sockaddr_in6 *)addr;
                entry = netlbl_domhsh_getentry_af6(secattr->domain,
                                                   &addr6->sin6_addr);
                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto conn_setattr_return;
                }
                switch (entry->type) {
                case NETLBL_NLTYPE_CALIPSO:
                        ret_val = calipso_sock_setattr(sk,
                                                       entry->calipso, secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
                         * but we could remove other protocols if needed */
                        netlbl_sock_delattr(sk);
                        ret_val = 0;
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#endif /* IPv6 */
        default:
                ret_val = -EPROTONOSUPPORT;
        }

conn_setattr_return:
        rcu_read_unlock();
        return ret_val;
}

/**
 * netlbl_req_setattr - Label a request socket using the correct protocol
 * @req: the request socket to label
 * @secattr: the security attributes
 *
 * Description:
 * Attach the correct label to the given socket using the security attributes
 * specified in @secattr.  Returns zero on success, negative values on failure.
 *
 */
int netlbl_req_setattr(struct request_sock *req,
                       const struct netlbl_lsm_secattr *secattr)
{
        int ret_val;
        struct netlbl_dommap_def *entry;
        struct inet_request_sock *ireq = inet_rsk(req);

        rcu_read_lock();
        switch (req->rsk_ops->family) {
        case AF_INET:
                entry = netlbl_domhsh_getentry_af4(secattr->domain,
                                                   ireq->ir_rmt_addr);
                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto req_setattr_return;
                }
                switch (entry->type) {
                case NETLBL_NLTYPE_CIPSOV4:
                        ret_val = cipso_v4_req_setattr(req,
                                                       entry->cipso, secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        netlbl_req_delattr(req);
                        ret_val = 0;
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                entry = netlbl_domhsh_getentry_af6(secattr->domain,
                                                   &ireq->ir_v6_rmt_addr);
                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto req_setattr_return;
                }
                switch (entry->type) {
                case NETLBL_NLTYPE_CALIPSO:
                        ret_val = calipso_req_setattr(req,
                                                      entry->calipso, secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        netlbl_req_delattr(req);
                        ret_val = 0;
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#endif /* IPv6 */
        default:
                ret_val = -EPROTONOSUPPORT;
        }

req_setattr_return:
        rcu_read_unlock();
        return ret_val;
}

/**
* netlbl_req_delattr - Delete all the NetLabel labels on a socket
* @req: the socket
*
* Description:
* Remove all the NetLabel labeling from @req.
*
*/
void netlbl_req_delattr(struct request_sock *req)
{
        switch (req->rsk_ops->family) {
        case AF_INET:
                cipso_v4_req_delattr(req);
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                calipso_req_delattr(req);
                break;
#endif /* IPv6 */
        }
}

/**
 * netlbl_skbuff_setattr - Label a packet using the correct protocol
 * @skb: the packet
 * @family: protocol family
 * @secattr: the security attributes
 *
 * Description:
 * Attach the correct label to the given packet using the security attributes
 * specified in @secattr.  Returns zero on success, negative values on failure.
 *
 */
int netlbl_skbuff_setattr(struct sk_buff *skb,
                          u16 family,
                          const struct netlbl_lsm_secattr *secattr)
{
        int ret_val;
        struct iphdr *hdr4;
#if IS_ENABLED(CONFIG_IPV6)
        struct ipv6hdr *hdr6;
#endif
        struct netlbl_dommap_def *entry;

        rcu_read_lock();
        switch (family) {
        case AF_INET:
                hdr4 = ip_hdr(skb);
                entry = netlbl_domhsh_getentry_af4(secattr->domain,
                                                   hdr4->daddr);
                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto skbuff_setattr_return;
                }
                switch (entry->type) {
                case NETLBL_NLTYPE_CIPSOV4:
                        ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
                                                          secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
                         * but we could remove other protocols if needed */
                        ret_val = cipso_v4_skbuff_delattr(skb);
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                hdr6 = ipv6_hdr(skb);
                entry = netlbl_domhsh_getentry_af6(secattr->domain,
                                                   &hdr6->daddr);
                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto skbuff_setattr_return;
                }
                switch (entry->type) {
                case NETLBL_NLTYPE_CALIPSO:
                        ret_val = calipso_skbuff_setattr(skb, entry->calipso,
                                                         secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
                         * but we could remove other protocols if needed */
                        ret_val = calipso_skbuff_delattr(skb);
                        break;
                default:
                        ret_val = -ENOENT;
                }
                break;
#endif /* IPv6 */
        default:
                ret_val = -EPROTONOSUPPORT;
        }

skbuff_setattr_return:
        rcu_read_unlock();
        return ret_val;
}

/**
 * netlbl_skbuff_getattr - Determine the security attributes of a packet
 * @skb: the packet
 * @family: protocol family
 * @secattr: the security attributes
 *
 * Description:
 * Examines the given packet to see if a recognized form of packet labeling
 * is present, if so it parses the packet label and returns the security
 * attributes in @secattr.  Returns zero on success, negative values on
 * failure.
 *
 */
int netlbl_skbuff_getattr(const struct sk_buff *skb,
                          u16 family,
                          struct netlbl_lsm_secattr *secattr)
{
        unsigned char *ptr;

        switch (family) {
        case AF_INET:
                ptr = cipso_v4_optptr(skb);
                if (ptr && cipso_v4_getattr(ptr, secattr) == 0)
                        return 0;
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                ptr = calipso_optptr(skb);
                if (ptr && calipso_getattr(ptr, secattr) == 0)
                        return 0;
                break;
#endif /* IPv6 */
        }

        return netlbl_unlabel_getattr(skb, family, secattr);
}

/**
 * netlbl_skbuff_err - Handle a LSM error on a sk_buff
 * @skb: the packet
 * @family: the family
 * @error: the error code
 * @gateway: true if host is acting as a gateway, false otherwise
 *
 * Description:
 * Deal with a LSM problem when handling the packet in @skb, typically this is
 * a permission denied problem (-EACCES).  The correct action is determined
 * according to the packet's labeling protocol.
 *
 */
void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway)
{
        switch (family) {
        case AF_INET:
                if (cipso_v4_optptr(skb))
                        cipso_v4_error(skb, error, gateway);
                break;
        }
}

/**
 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
 *
 * Description:
 * For all of the NetLabel protocols that support some form of label mapping
 * cache, invalidate the cache.  Returns zero on success, negative values on
 * error.
 *
 */
void netlbl_cache_invalidate(void)
{
        cipso_v4_cache_invalidate();
#if IS_ENABLED(CONFIG_IPV6)
        calipso_cache_invalidate();
#endif /* IPv6 */
}

/**
 * netlbl_cache_add - Add an entry to a NetLabel protocol cache
 * @skb: the packet
 * @family: the family
 * @secattr: the packet's security attributes
 *
 * Description:
 * Add the LSM security attributes for the given packet to the underlying
 * NetLabel protocol's label mapping cache.  Returns zero on success, negative
 * values on error.
 *
 */
int netlbl_cache_add(const struct sk_buff *skb, u16 family,
                     const struct netlbl_lsm_secattr *secattr)
{
        unsigned char *ptr;

        if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
                return -ENOMSG;

        switch (family) {
        case AF_INET:
                ptr = cipso_v4_optptr(skb);
                if (ptr)
                        return cipso_v4_cache_add(ptr, secattr);
                break;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                ptr = calipso_optptr(skb);
                if (ptr)
                        return calipso_cache_add(ptr, secattr);
                break;
#endif /* IPv6 */
        }
        return -ENOMSG;
}

/*
 * Protocol Engine Functions
 */

/**
 * netlbl_audit_start - Start an audit message
 * @type: audit message type
 * @audit_info: NetLabel audit information
 *
 * Description:
 * Start an audit message using the type specified in @type and fill the audit
 * message with some fields common to all NetLabel audit messages.  This
 * function should only be used by protocol engines, not LSMs.  Returns a
 * pointer to the audit buffer on success, NULL on failure.
 *
 */
struct audit_buffer *netlbl_audit_start(int type,
                                        struct netlbl_audit *audit_info)
{
        return netlbl_audit_start_common(type, audit_info);
}
EXPORT_SYMBOL(netlbl_audit_start);

/*
 * Setup Functions
 */

/**
 * netlbl_init - Initialize NetLabel
 *
 * Description:
 * Perform the required NetLabel initialization before first use.
 *
 */
static int __init netlbl_init(void)
{
        int ret_val;

        printk(KERN_INFO "NetLabel: Initializing\n");
        printk(KERN_INFO "NetLabel:  domain hash size = %u\n",
               (1 << NETLBL_DOMHSH_BITSIZE));
        printk(KERN_INFO "NetLabel:  protocols = UNLABELED CIPSOv4 CALIPSO\n");

        ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
        if (ret_val != 0)
                goto init_failure;

        ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE);
        if (ret_val != 0)
                goto init_failure;

        ret_val = netlbl_netlink_init();
        if (ret_val != 0)
                goto init_failure;

        ret_val = netlbl_unlabel_defconf();
        if (ret_val != 0)
                goto init_failure;
        printk(KERN_INFO "NetLabel:  unlabeled traffic allowed by default\n");

        return 0;

init_failure:
        panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
}

subsys_initcall(netlbl_init);















































































































































































































































































































































































































































































































































































































    2 












1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
/*
 *
 * Author        Karsten Keil <kkeil@novell.com>
 *
 * Copyright 2008  by Karsten Keil <kkeil@novell.com>
 *
 * This code is free software; you can redistribute it and/or modify
 * it under the terms of the GNU LESSER GENERAL PUBLIC LICENSE
 * version 2.1 as published by the Free Software Foundation.
 *
 * This code is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU LESSER GENERAL PUBLIC LICENSE for more details.
 *
 */

#ifndef mISDNIF_H
#define mISDNIF_H

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/socket.h>

/*
 * ABI Version 32 bit
 *
 * <8 bit> Major version
 *                - changed if any interface become backwards incompatible
 *
 * <8 bit> Minor version
 *              - changed if any interface is extended but backwards compatible
 *
 * <16 bit> Release number
 *              - should be incremented on every checkin
 */
#define        MISDN_MAJOR_VERSION        1
#define        MISDN_MINOR_VERSION        1
#define MISDN_RELEASE                29

/* primitives for information exchange
 * generell format
 * <16  bit  0 >
 * <8  bit command>
 *    BIT 8 = 1 LAYER private
 *    BIT 7 = 1 answer
 *    BIT 6 = 1 DATA
 * <8  bit target layer mask>
 *
 * Layer = 00 is reserved for general commands
   Layer = 01  L2 -> HW
   Layer = 02  HW -> L2
   Layer = 04  L3 -> L2
   Layer = 08  L2 -> L3
 * Layer = FF is reserved for broadcast commands
 */

#define MISDN_CMDMASK                0xff00
#define MISDN_LAYERMASK                0x00ff

/* generell commands */
#define OPEN_CHANNEL                0x0100
#define CLOSE_CHANNEL                0x0200
#define CONTROL_CHANNEL                0x0300
#define CHECK_DATA                0x0400

/* layer 2 -> layer 1 */
#define PH_ACTIVATE_REQ                0x0101
#define PH_DEACTIVATE_REQ        0x0201
#define PH_DATA_REQ                0x2001
#define MPH_ACTIVATE_REQ        0x0501
#define MPH_DEACTIVATE_REQ        0x0601
#define MPH_INFORMATION_REQ        0x0701
#define PH_CONTROL_REQ                0x0801

/* layer 1 -> layer 2 */
#define PH_ACTIVATE_IND                0x0102
#define PH_ACTIVATE_CNF                0x4102
#define PH_DEACTIVATE_IND        0x0202
#define PH_DEACTIVATE_CNF        0x4202
#define PH_DATA_IND                0x2002
#define PH_DATA_E_IND                0x3002
#define MPH_ACTIVATE_IND        0x0502
#define MPH_DEACTIVATE_IND        0x0602
#define MPH_INFORMATION_IND        0x0702
#define PH_DATA_CNF                0x6002
#define PH_CONTROL_IND                0x0802
#define PH_CONTROL_CNF                0x4802

/* layer 3 -> layer 2 */
#define DL_ESTABLISH_REQ        0x1004
#define DL_RELEASE_REQ                0x1104
#define DL_DATA_REQ                0x3004
#define DL_UNITDATA_REQ                0x3104
#define DL_INFORMATION_REQ        0x0004

/* layer 2 -> layer 3 */
#define DL_ESTABLISH_IND        0x1008
#define DL_ESTABLISH_CNF        0x5008
#define DL_RELEASE_IND                0x1108
#define DL_RELEASE_CNF                0x5108
#define DL_DATA_IND                0x3008
#define DL_UNITDATA_IND                0x3108
#define DL_INFORMATION_IND        0x0008

/* intern layer 2 management */
#define MDL_ASSIGN_REQ                0x1804
#define MDL_ASSIGN_IND                0x1904
#define MDL_REMOVE_REQ                0x1A04
#define MDL_REMOVE_IND                0x1B04
#define MDL_STATUS_UP_IND        0x1C04
#define MDL_STATUS_DOWN_IND        0x1D04
#define MDL_STATUS_UI_IND        0x1E04
#define MDL_ERROR_IND                0x1F04
#define MDL_ERROR_RSP                0x5F04

/* intern layer 2 */
#define DL_TIMER200_IND                0x7004
#define DL_TIMER203_IND                0x7304
#define DL_INTERN_MSG                0x7804

/* DL_INFORMATION_IND types */
#define DL_INFO_L2_CONNECT        0x0001
#define DL_INFO_L2_REMOVED        0x0002

/* PH_CONTROL types */
/* TOUCH TONE IS 0x20XX  XX "0"..."9", "A","B","C","D","*","#" */
#define DTMF_TONE_VAL                0x2000
#define DTMF_TONE_MASK                0x007F
#define DTMF_TONE_START                0x2100
#define DTMF_TONE_STOP                0x2200
#define DTMF_HFC_COEF                0x4000
#define DSP_CONF_JOIN                0x2403
#define DSP_CONF_SPLIT                0x2404
#define DSP_RECEIVE_OFF                0x2405
#define DSP_RECEIVE_ON                0x2406
#define DSP_ECHO_ON                0x2407
#define DSP_ECHO_OFF                0x2408
#define DSP_MIX_ON                0x2409
#define DSP_MIX_OFF                0x240a
#define DSP_DELAY                0x240b
#define DSP_JITTER                0x240c
#define DSP_TXDATA_ON                0x240d
#define DSP_TXDATA_OFF                0x240e
#define DSP_TX_DEJITTER                0x240f
#define DSP_TX_DEJ_OFF                0x2410
#define DSP_TONE_PATT_ON        0x2411
#define DSP_TONE_PATT_OFF        0x2412
#define DSP_VOL_CHANGE_TX        0x2413
#define DSP_VOL_CHANGE_RX        0x2414
#define DSP_BF_ENABLE_KEY        0x2415
#define DSP_BF_DISABLE                0x2416
#define DSP_BF_ACCEPT                0x2416
#define DSP_BF_REJECT                0x2417
#define DSP_PIPELINE_CFG        0x2418
#define HFC_VOL_CHANGE_TX        0x2601
#define HFC_VOL_CHANGE_RX        0x2602
#define HFC_SPL_LOOP_ON                0x2603
#define HFC_SPL_LOOP_OFF        0x2604
/* for T30 FAX and analog modem */
#define HW_MOD_FRM                0x4000
#define HW_MOD_FRH                0x4001
#define HW_MOD_FTM                0x4002
#define HW_MOD_FTH                0x4003
#define HW_MOD_FTS                0x4004
#define HW_MOD_CONNECT                0x4010
#define HW_MOD_OK                0x4011
#define HW_MOD_NOCARR                0x4012
#define HW_MOD_FCERROR                0x4013
#define HW_MOD_READY                0x4014
#define HW_MOD_LASTDATA                0x4015

/* DSP_TONE_PATT_ON parameter */
#define TONE_OFF                        0x0000
#define TONE_GERMAN_DIALTONE                0x0001
#define TONE_GERMAN_OLDDIALTONE                0x0002
#define TONE_AMERICAN_DIALTONE                0x0003
#define TONE_GERMAN_DIALPBX                0x0004
#define TONE_GERMAN_OLDDIALPBX                0x0005
#define TONE_AMERICAN_DIALPBX                0x0006
#define TONE_GERMAN_RINGING                0x0007
#define TONE_GERMAN_OLDRINGING                0x0008
#define TONE_AMERICAN_RINGPBX                0x000b
#define TONE_GERMAN_RINGPBX                0x000c
#define TONE_GERMAN_OLDRINGPBX                0x000d
#define TONE_AMERICAN_RINGING                0x000e
#define TONE_GERMAN_BUSY                0x000f
#define TONE_GERMAN_OLDBUSY                0x0010
#define TONE_AMERICAN_BUSY                0x0011
#define TONE_GERMAN_HANGUP                0x0012
#define TONE_GERMAN_OLDHANGUP                0x0013
#define TONE_AMERICAN_HANGUP                0x0014
#define TONE_SPECIAL_INFO                0x0015
#define TONE_GERMAN_GASSENBESETZT        0x0016
#define TONE_GERMAN_AUFSCHALTTON        0x0016

/* MPH_INFORMATION_IND */
#define L1_SIGNAL_LOS_OFF        0x0010
#define L1_SIGNAL_LOS_ON        0x0011
#define L1_SIGNAL_AIS_OFF        0x0012
#define L1_SIGNAL_AIS_ON        0x0013
#define L1_SIGNAL_RDI_OFF        0x0014
#define L1_SIGNAL_RDI_ON        0x0015
#define L1_SIGNAL_SLIP_RX        0x0020
#define L1_SIGNAL_SLIP_TX        0x0021

/*
 * protocol ids
 * D channel 1-31
 * B channel 33 - 63
 */

#define ISDN_P_NONE                0
#define ISDN_P_BASE                0
#define ISDN_P_TE_S0                0x01
#define ISDN_P_NT_S0                  0x02
#define ISDN_P_TE_E1                0x03
#define ISDN_P_NT_E1                  0x04
#define ISDN_P_TE_UP0                0x05
#define ISDN_P_NT_UP0                0x06

#define IS_ISDN_P_TE(p) ((p == ISDN_P_TE_S0) || (p == ISDN_P_TE_E1) || \
                                (p == ISDN_P_TE_UP0) || (p == ISDN_P_LAPD_TE))
#define IS_ISDN_P_NT(p) ((p == ISDN_P_NT_S0) || (p == ISDN_P_NT_E1) || \
                                (p == ISDN_P_NT_UP0) || (p == ISDN_P_LAPD_NT))
#define IS_ISDN_P_S0(p) ((p == ISDN_P_TE_S0) || (p == ISDN_P_NT_S0))
#define IS_ISDN_P_E1(p) ((p == ISDN_P_TE_E1) || (p == ISDN_P_NT_E1))
#define IS_ISDN_P_UP0(p) ((p == ISDN_P_TE_UP0) || (p == ISDN_P_NT_UP0))


#define ISDN_P_LAPD_TE                0x10
#define        ISDN_P_LAPD_NT                0x11

#define ISDN_P_B_MASK                0x1f
#define ISDN_P_B_START                0x20

#define ISDN_P_B_RAW                0x21
#define ISDN_P_B_HDLC                0x22
#define ISDN_P_B_X75SLP                0x23
#define ISDN_P_B_L2DTMF                0x24
#define ISDN_P_B_L2DSP                0x25
#define ISDN_P_B_L2DSPHDLC        0x26
#define ISDN_P_B_T30_FAX        0x27
#define ISDN_P_B_MODEM_ASYNC        0x28

#define OPTION_L2_PMX                1
#define OPTION_L2_PTP                2
#define OPTION_L2_FIXEDTEI        3
#define OPTION_L2_CLEANUP        4
#define OPTION_L1_HOLD                5

/* should be in sync with linux/kobject.h:KOBJ_NAME_LEN */
#define MISDN_MAX_IDLEN                20

struct mISDNhead {
        unsigned int        prim;
        unsigned int        id;
}  __packed;

#define MISDN_HEADER_LEN        sizeof(struct mISDNhead)
#define MAX_DATA_SIZE                2048
#define MAX_DATA_MEM                (MAX_DATA_SIZE + MISDN_HEADER_LEN)
#define MAX_DFRAME_LEN                260

#define MISDN_ID_ADDR_MASK        0xFFFF
#define MISDN_ID_TEI_MASK        0xFF00
#define MISDN_ID_SAPI_MASK        0x00FF
#define MISDN_ID_TEI_ANY        0x7F00

#define MISDN_ID_ANY                0xFFFF
#define MISDN_ID_NONE                0xFFFE

#define GROUP_TEI                127
#define TEI_SAPI                63
#define CTRL_SAPI                0

#define MISDN_MAX_CHANNEL        127
#define MISDN_CHMAP_SIZE        ((MISDN_MAX_CHANNEL + 1) >> 3)

#define SOL_MISDN        0

struct sockaddr_mISDN {
        sa_family_t    family;
        unsigned char        dev;
        unsigned char        channel;
        unsigned char        sapi;
        unsigned char        tei;
};

struct mISDNversion {
        unsigned char        major;
        unsigned char        minor;
        unsigned short        release;
};

struct mISDN_devinfo {
        u_int                        id;
        u_int                        Dprotocols;
        u_int                        Bprotocols;
        u_int                        protocol;
        u_char                        channelmap[MISDN_CHMAP_SIZE];
        u_int                        nrbchan;
        char                        name[MISDN_MAX_IDLEN];
};

struct mISDN_devrename {
        u_int                        id;
        char                        name[MISDN_MAX_IDLEN]; /* new name */
};

/* MPH_INFORMATION_REQ payload */
struct ph_info_ch {
        __u32 protocol;
        __u64 Flags;
};

struct ph_info_dch {
        struct ph_info_ch ch;
        __u16 state;
        __u16 num_bch;
};

struct ph_info {
        struct ph_info_dch dch;
        struct ph_info_ch  bch[];
};

/* timer device ioctl */
#define IMADDTIMER        _IOR('I', 64, int)
#define IMDELTIMER        _IOR('I', 65, int)

/* socket ioctls */
#define        IMGETVERSION        _IOR('I', 66, int)
#define        IMGETCOUNT        _IOR('I', 67, int)
#define IMGETDEVINFO        _IOR('I', 68, int)
#define IMCTRLREQ        _IOR('I', 69, int)
#define IMCLEAR_L2        _IOR('I', 70, int)
#define IMSETDEVNAME        _IOR('I', 71, struct mISDN_devrename)
#define IMHOLD_L1        _IOR('I', 72, int)

static inline int
test_channelmap(u_int nr, u_char *map)
{
        if (nr <= MISDN_MAX_CHANNEL)
                return map[nr >> 3] & (1 << (nr & 7));
        else
                return 0;
}

static inline void
set_channelmap(u_int nr, u_char *map)
{
        map[nr >> 3] |= (1 << (nr & 7));
}

static inline void
clear_channelmap(u_int nr, u_char *map)
{
        map[nr >> 3] &= ~(1 << (nr & 7));
}

/* CONTROL_CHANNEL parameters */
#define MISDN_CTRL_GETOP                0x0000
#define MISDN_CTRL_LOOP                        0x0001
#define MISDN_CTRL_CONNECT                0x0002
#define MISDN_CTRL_DISCONNECT                0x0004
#define MISDN_CTRL_RX_BUFFER                0x0008
#define MISDN_CTRL_PCMCONNECT                0x0010
#define MISDN_CTRL_PCMDISCONNECT        0x0020
#define MISDN_CTRL_SETPEER                0x0040
#define MISDN_CTRL_UNSETPEER                0x0080
#define MISDN_CTRL_RX_OFF                0x0100
#define MISDN_CTRL_FILL_EMPTY                0x0200
#define MISDN_CTRL_GETPEER                0x0400
#define MISDN_CTRL_L1_TIMER3                0x0800
#define MISDN_CTRL_HW_FEATURES_OP        0x2000
#define MISDN_CTRL_HW_FEATURES                0x2001
#define MISDN_CTRL_HFC_OP                0x4000
#define MISDN_CTRL_HFC_PCM_CONN                0x4001
#define MISDN_CTRL_HFC_PCM_DISC                0x4002
#define MISDN_CTRL_HFC_CONF_JOIN        0x4003
#define MISDN_CTRL_HFC_CONF_SPLIT        0x4004
#define MISDN_CTRL_HFC_RECEIVE_OFF        0x4005
#define MISDN_CTRL_HFC_RECEIVE_ON        0x4006
#define MISDN_CTRL_HFC_ECHOCAN_ON         0x4007
#define MISDN_CTRL_HFC_ECHOCAN_OFF         0x4008
#define MISDN_CTRL_HFC_WD_INIT                0x4009
#define MISDN_CTRL_HFC_WD_RESET                0x400A

/* special RX buffer value for MISDN_CTRL_RX_BUFFER request.p1 is the minimum
 * buffer size request.p2 the maximum. Using  MISDN_CTRL_RX_SIZE_IGNORE will
 * not change the value, but still read back the actual stetting.
 */
#define MISDN_CTRL_RX_SIZE_IGNORE        -1

/* socket options */
#define MISDN_TIME_STAMP                0x0001

struct mISDN_ctrl_req {
        int                op;
        int                channel;
        int                p1;
        int                p2;
};

/* muxer options */
#define MISDN_OPT_ALL                1
#define MISDN_OPT_TEIMGR        2

#ifdef __KERNEL__
#include <linux/list.h>
#include <linux/skbuff.h>
#include <linux/net.h>
#include <net/sock.h>
#include <linux/completion.h>

#define DEBUG_CORE                0x000000ff
#define DEBUG_CORE_FUNC                0x00000002
#define DEBUG_SOCKET                0x00000004
#define DEBUG_MANAGER                0x00000008
#define DEBUG_SEND_ERR                0x00000010
#define DEBUG_MSG_THREAD        0x00000020
#define DEBUG_QUEUE_FUNC        0x00000040
#define DEBUG_L1                0x0000ff00
#define DEBUG_L1_FSM                0x00000200
#define DEBUG_L2                0x00ff0000
#define DEBUG_L2_FSM                0x00020000
#define DEBUG_L2_CTRL                0x00040000
#define DEBUG_L2_RECV                0x00080000
#define DEBUG_L2_TEI                0x00100000
#define DEBUG_L2_TEIFSM                0x00200000
#define DEBUG_TIMER                0x01000000
#define DEBUG_CLOCK                0x02000000

#define mISDN_HEAD_P(s)                ((struct mISDNhead *)&s->cb[0])
#define mISDN_HEAD_PRIM(s)        (((struct mISDNhead *)&s->cb[0])->prim)
#define mISDN_HEAD_ID(s)        (((struct mISDNhead *)&s->cb[0])->id)

/* socket states */
#define MISDN_OPEN        1
#define MISDN_BOUND        2
#define MISDN_CLOSED        3

struct mISDNchannel;
struct mISDNdevice;
struct mISDNstack;
struct mISDNclock;

struct channel_req {
        u_int                        protocol;
        struct sockaddr_mISDN        adr;
        struct mISDNchannel        *ch;
};

typedef        int        (ctrl_func_t)(struct mISDNchannel *, u_int, void *);
typedef        int        (send_func_t)(struct mISDNchannel *, struct sk_buff *);
typedef int        (create_func_t)(struct channel_req *);

struct Bprotocol {
        struct list_head        list;
        char                        *name;
        u_int                        Bprotocols;
        create_func_t                *create;
};

struct mISDNchannel {
        struct list_head        list;
        u_int                        protocol;
        u_int                        nr;
        u_long                        opt;
        u_int                        addr;
        struct mISDNstack        *st;
        struct mISDNchannel        *peer;
        send_func_t                *send;
        send_func_t                *recv;
        ctrl_func_t                *ctrl;
};

struct mISDN_sock_list {
        struct hlist_head        head;
        rwlock_t                lock;
};

struct mISDN_sock {
        struct sock                sk;
        struct mISDNchannel        ch;
        u_int                        cmask;
        struct mISDNdevice        *dev;
};



struct mISDNdevice {
        struct mISDNchannel        D;
        u_int                        id;
        u_int                        Dprotocols;
        u_int                        Bprotocols;
        u_int                        nrbchan;
        u_char                        channelmap[MISDN_CHMAP_SIZE];
        struct list_head        bchannels;
        struct mISDNchannel        *teimgr;
        struct device                dev;
};

struct mISDNstack {
        u_long                        status;
        struct mISDNdevice        *dev;
        struct task_struct        *thread;
        struct completion        *notify;
        wait_queue_head_t        workq;
        struct sk_buff_head        msgq;
        struct list_head        layer2;
        struct mISDNchannel        *layer1;
        struct mISDNchannel        own;
        struct mutex                lmutex; /* protect lists */
        struct mISDN_sock_list        l1sock;
#ifdef MISDN_MSG_STATS
        u_int                        msg_cnt;
        u_int                        sleep_cnt;
        u_int                        stopped_cnt;
#endif
};

typedef        int        (clockctl_func_t)(void *, int);

struct        mISDNclock {
        struct list_head        list;
        char                        name[64];
        int                        pri;
        clockctl_func_t                *ctl;
        void                        *priv;
};

/* global alloc/queue functions */

static inline struct sk_buff *
mI_alloc_skb(unsigned int len, gfp_t gfp_mask)
{
        struct sk_buff        *skb;

        skb = alloc_skb(len + MISDN_HEADER_LEN, gfp_mask);
        if (likely(skb))
                skb_reserve(skb, MISDN_HEADER_LEN);
        return skb;
}

static inline struct sk_buff *
_alloc_mISDN_skb(u_int prim, u_int id, u_int len, void *dp, gfp_t gfp_mask)
{
        struct sk_buff        *skb = mI_alloc_skb(len, gfp_mask);
        struct mISDNhead *hh;

        if (!skb)
                return NULL;
        if (len)
                skb_put_data(skb, dp, len);
        hh = mISDN_HEAD_P(skb);
        hh->prim = prim;
        hh->id = id;
        return skb;
}

static inline void
_queue_data(struct mISDNchannel *ch, u_int prim,
    u_int id, u_int len, void *dp, gfp_t gfp_mask)
{
        struct sk_buff                *skb;

        if (!ch->peer)
                return;
        skb = _alloc_mISDN_skb(prim, id, len, dp, gfp_mask);
        if (!skb)
                return;
        if (ch->recv(ch->peer, skb))
                dev_kfree_skb(skb);
}

/* global register/unregister functions */

extern int        mISDN_register_device(struct mISDNdevice *,
                                        struct device *parent, char *name);
extern void        mISDN_unregister_device(struct mISDNdevice *);
extern int        mISDN_register_Bprotocol(struct Bprotocol *);
extern void        mISDN_unregister_Bprotocol(struct Bprotocol *);
extern struct mISDNclock *mISDN_register_clock(char *, int, clockctl_func_t *,
                                                void *);
extern void        mISDN_unregister_clock(struct mISDNclock *);

static inline struct mISDNdevice *dev_to_mISDN(const struct device *dev)
{
        if (dev)
                return dev_get_drvdata(dev);
        else
                return NULL;
}

extern void        set_channel_address(struct mISDNchannel *, u_int, u_int);
extern void        mISDN_clock_update(struct mISDNclock *, int, ktime_t *);
extern unsigned short mISDN_clock_get(void);
extern const char *mISDNDevName4ch(struct mISDNchannel *);

#endif /* __KERNEL__ */
#endif /* mISDNIF_H */












































































































   66 
    1 













































   67 



    1 



   66 


   66 














   66 















   66 


    1 



    1 


   65 











    9 





    1 









    8 














    8 




    1 






    7 


























































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
// SPDX-License-Identifier: GPL-2.0
/*
 * linux/drivers/scsi/scsi_proc.c
 *
 * The functions in this file provide an interface between
 * the PROC file system and the SCSI device drivers
 * It is mainly used for debugging, statistics and to pass 
 * information directly to the lowlevel driver.
 *
 * (c) 1995 Michael Neuffer neuffer@goofy.zdv.uni-mainz.de 
 * Version: 0.99.8   last change: 95/09/13
 * 
 * generic command parser provided by: 
 * Andreas Heilwagen <crashcar@informatik.uni-koblenz.de>
 *
 * generic_proc_info() support of xxxx_info() by:
 * Michael A. Griffith <grif@acm.org>
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/proc_fs.h>
#include <linux/errno.h>
#include <linux/blkdev.h>
#include <linux/seq_file.h>
#include <linux/mutex.h>
#include <linux/gfp.h>
#include <linux/uaccess.h>

#include <scsi/scsi.h>
#include <scsi/scsi_device.h>
#include <scsi/scsi_host.h>
#include <scsi/scsi_transport.h>

#include "scsi_priv.h"
#include "scsi_logging.h"


/* 4K page size, but our output routines, use some slack for overruns */
#define PROC_BLOCK_SIZE (3*1024)

static struct proc_dir_entry *proc_scsi;

/* Protects scsi_proc_list */
static DEFINE_MUTEX(global_host_template_mutex);
static LIST_HEAD(scsi_proc_list);

/**
 * struct scsi_proc_entry - (host template, SCSI proc dir) association
 * @entry: entry in scsi_proc_list.
 * @sht: SCSI host template associated with the procfs directory.
 * @proc_dir: procfs directory associated with the SCSI host template.
 * @present: Number of SCSI hosts instantiated for @sht.
 */
struct scsi_proc_entry {
        struct list_head        entry;
        const struct scsi_host_template *sht;
        struct proc_dir_entry        *proc_dir;
        unsigned int                present;
};

static ssize_t proc_scsi_host_write(struct file *file, const char __user *buf,
                           size_t count, loff_t *ppos)
{
        struct Scsi_Host *shost = pde_data(file_inode(file));
        ssize_t ret = -ENOMEM;
        char *page;
    
        if (count > PROC_BLOCK_SIZE)
                return -EOVERFLOW;

        if (!shost->hostt->write_info)
                return -EINVAL;

        page = (char *)__get_free_page(GFP_KERNEL);
        if (page) {
                ret = -EFAULT;
                if (copy_from_user(page, buf, count))
                        goto out;
                ret = shost->hostt->write_info(shost, page, count);
        }
out:
        free_page((unsigned long)page);
        return ret;
}

static int proc_scsi_show(struct seq_file *m, void *v)
{
        struct Scsi_Host *shost = m->private;
        return shost->hostt->show_info(m, shost);
}

static int proc_scsi_host_open(struct inode *inode, struct file *file)
{
        return single_open_size(file, proc_scsi_show, pde_data(inode),
                                4 * PAGE_SIZE);
}

static struct scsi_proc_entry *
__scsi_lookup_proc_entry(const struct scsi_host_template *sht)
{
        struct scsi_proc_entry *e;

        lockdep_assert_held(&global_host_template_mutex);

        list_for_each_entry(e, &scsi_proc_list, entry)
                if (e->sht == sht)
                        return e;

        return NULL;
}

static struct scsi_proc_entry *
scsi_lookup_proc_entry(const struct scsi_host_template *sht)
{
        struct scsi_proc_entry *e;

        mutex_lock(&global_host_template_mutex);
        e = __scsi_lookup_proc_entry(sht);
        mutex_unlock(&global_host_template_mutex);

        return e;
}

/**
 * scsi_template_proc_dir() - returns the procfs dir for a SCSI host template
 * @sht: SCSI host template pointer.
 */
struct proc_dir_entry *
scsi_template_proc_dir(const struct scsi_host_template *sht)
{
        struct scsi_proc_entry *e = scsi_lookup_proc_entry(sht);

        return e ? e->proc_dir : NULL;
}
EXPORT_SYMBOL_GPL(scsi_template_proc_dir);

static const struct proc_ops proc_scsi_ops = {
        .proc_open        = proc_scsi_host_open,
        .proc_release        = single_release,
        .proc_read        = seq_read,
        .proc_lseek        = seq_lseek,
        .proc_write        = proc_scsi_host_write
};

/**
 * scsi_proc_hostdir_add - Create directory in /proc for a scsi host
 * @sht: owner of this directory
 *
 * Sets sht->proc_dir to the new directory.
 */
int scsi_proc_hostdir_add(const struct scsi_host_template *sht)
{
        struct scsi_proc_entry *e;
        int ret;

        if (!sht->show_info)
                return 0;

        mutex_lock(&global_host_template_mutex);
        e = __scsi_lookup_proc_entry(sht);
        if (!e) {
                e = kzalloc(sizeof(*e), GFP_KERNEL);
                if (!e) {
                        ret = -ENOMEM;
                        goto unlock;
                }
        }
        if (e->present++)
                goto success;
        e->proc_dir = proc_mkdir(sht->proc_name, proc_scsi);
        if (!e->proc_dir) {
                printk(KERN_ERR "%s: proc_mkdir failed for %s\n", __func__,
                       sht->proc_name);
                ret = -ENOMEM;
                goto unlock;
        }
        e->sht = sht;
        list_add_tail(&e->entry, &scsi_proc_list);
success:
        e = NULL;
        ret = 0;
unlock:
        mutex_unlock(&global_host_template_mutex);

        kfree(e);
        return ret;
}

/**
 * scsi_proc_hostdir_rm - remove directory in /proc for a scsi host
 * @sht: owner of directory
 */
void scsi_proc_hostdir_rm(const struct scsi_host_template *sht)
{
        struct scsi_proc_entry *e;

        if (!sht->show_info)
                return;

        mutex_lock(&global_host_template_mutex);
        e = __scsi_lookup_proc_entry(sht);
        if (e && !--e->present) {
                remove_proc_entry(sht->proc_name, proc_scsi);
                list_del(&e->entry);
                kfree(e);
        }
        mutex_unlock(&global_host_template_mutex);
}


/**
 * scsi_proc_host_add - Add entry for this host to appropriate /proc dir
 * @shost: host to add
 */
void scsi_proc_host_add(struct Scsi_Host *shost)
{
        const struct scsi_host_template *sht = shost->hostt;
        struct scsi_proc_entry *e;
        struct proc_dir_entry *p;
        char name[10];

        if (!sht->show_info)
                return;

        e = scsi_lookup_proc_entry(sht);
        if (!e)
                goto err;

        sprintf(name,"%d", shost->host_no);
        p = proc_create_data(name, S_IRUGO | S_IWUSR, e->proc_dir,
                             &proc_scsi_ops, shost);
        if (!p)
                goto err;
        return;

err:
        shost_printk(KERN_ERR, shost,
                     "%s: Failed to register host (%s failed)\n", __func__,
                     e ? "proc_create_data()" : "scsi_proc_hostdir_add()");
}

/**
 * scsi_proc_host_rm - remove this host's entry from /proc
 * @shost: which host
 */
void scsi_proc_host_rm(struct Scsi_Host *shost)
{
        const struct scsi_host_template *sht = shost->hostt;
        struct scsi_proc_entry *e;
        char name[10];

        if (!sht->show_info)
                return;

        e = scsi_lookup_proc_entry(sht);
        if (!e)
                return;

        sprintf(name,"%d", shost->host_no);
        remove_proc_entry(name, e->proc_dir);
}
/**
 * proc_print_scsidevice - return data about this host
 * @dev: A scsi device
 * @data: &struct seq_file to output to.
 *
 * Description: prints Host, Channel, Id, Lun, Vendor, Model, Rev, Type,
 * and revision.
 */
static int proc_print_scsidevice(struct device *dev, void *data)
{
        struct scsi_device *sdev;
        struct seq_file *s = data;
        int i;

        if (!scsi_is_sdev_device(dev))
                goto out;

        sdev = to_scsi_device(dev);
        seq_printf(s,
                "Host: scsi%d Channel: %02d Id: %02d Lun: %02llu\n  Vendor: ",
                sdev->host->host_no, sdev->channel, sdev->id, sdev->lun);
        for (i = 0; i < 8; i++) {
                if (sdev->vendor[i] >= 0x20)
                        seq_putc(s, sdev->vendor[i]);
                else
                        seq_putc(s, ' ');
        }

        seq_puts(s, " Model: ");
        for (i = 0; i < 16; i++) {
                if (sdev->model[i] >= 0x20)
                        seq_putc(s, sdev->model[i]);
                else
                        seq_putc(s, ' ');
        }

        seq_puts(s, " Rev: ");
        for (i = 0; i < 4; i++) {
                if (sdev->rev[i] >= 0x20)
                        seq_putc(s, sdev->rev[i]);
                else
                        seq_putc(s, ' ');
        }

        seq_putc(s, '\n');

        seq_printf(s, "  Type:   %s ", scsi_device_type(sdev->type));
        seq_printf(s, "               ANSI  SCSI revision: %02x",
                        sdev->scsi_level - (sdev->scsi_level > 1));
        if (sdev->scsi_level == 2)
                seq_puts(s, " CCS\n");
        else
                seq_putc(s, '\n');

out:
        return 0;
}

/**
 * scsi_add_single_device - Respond to user request to probe for/add device
 * @host: user-supplied decimal integer
 * @channel: user-supplied decimal integer
 * @id: user-supplied decimal integer
 * @lun: user-supplied decimal integer
 *
 * Description: called by writing "scsi add-single-device" to /proc/scsi/scsi.
 *
 * does scsi_host_lookup() and either user_scan() if that transport
 * type supports it, or else scsi_scan_host_selected()
 *
 * Note: this seems to be aimed exclusively at SCSI parallel busses.
 */

static int scsi_add_single_device(uint host, uint channel, uint id, uint lun)
{
        struct Scsi_Host *shost;
        int error = -ENXIO;

        shost = scsi_host_lookup(host);
        if (!shost)
                return error;

        if (shost->transportt->user_scan)
                error = shost->transportt->user_scan(shost, channel, id, lun);
        else
                error = scsi_scan_host_selected(shost, channel, id, lun,
                                                SCSI_SCAN_MANUAL);
        scsi_host_put(shost);
        return error;
}

/**
 * scsi_remove_single_device - Respond to user request to remove a device
 * @host: user-supplied decimal integer
 * @channel: user-supplied decimal integer
 * @id: user-supplied decimal integer
 * @lun: user-supplied decimal integer
 *
 * Description: called by writing "scsi remove-single-device" to
 * /proc/scsi/scsi.  Does a scsi_device_lookup() and scsi_remove_device()
 */
static int scsi_remove_single_device(uint host, uint channel, uint id, uint lun)
{
        struct scsi_device *sdev;
        struct Scsi_Host *shost;
        int error = -ENXIO;

        shost = scsi_host_lookup(host);
        if (!shost)
                return error;
        sdev = scsi_device_lookup(shost, channel, id, lun);
        if (sdev) {
                scsi_remove_device(sdev);
                scsi_device_put(sdev);
                error = 0;
        }

        scsi_host_put(shost);
        return error;
}

/**
 * proc_scsi_write - handle writes to /proc/scsi/scsi
 * @file: not used
 * @buf: buffer to write
 * @length: length of buf, at most PAGE_SIZE
 * @ppos: not used
 *
 * Description: this provides a legacy mechanism to add or remove devices by
 * Host, Channel, ID, and Lun.  To use,
 * "echo 'scsi add-single-device 0 1 2 3' > /proc/scsi/scsi" or
 * "echo 'scsi remove-single-device 0 1 2 3' > /proc/scsi/scsi" with
 * "0 1 2 3" replaced by the Host, Channel, Id, and Lun.
 *
 * Note: this seems to be aimed at parallel SCSI. Most modern busses (USB,
 * SATA, Firewire, Fibre Channel, etc) dynamically assign these values to
 * provide a unique identifier and nothing more.
 */


static ssize_t proc_scsi_write(struct file *file, const char __user *buf,
                               size_t length, loff_t *ppos)
{
        int host, channel, id, lun;
        char *buffer, *end, *p;
        int err;

        if (!buf || length > PAGE_SIZE)
                return -EINVAL;

        buffer = (char *)__get_free_page(GFP_KERNEL);
        if (!buffer)
                return -ENOMEM;

        err = -EFAULT;
        if (copy_from_user(buffer, buf, length))
                goto out;

        err = -EINVAL;
        if (length < PAGE_SIZE) {
                end = buffer + length;
                *end = '\0';
        } else {
                end = buffer + PAGE_SIZE - 1;
                if (*end)
                        goto out;
        }

        /*
         * Usage: echo "scsi add-single-device 0 1 2 3" >/proc/scsi/scsi
         * with  "0 1 2 3" replaced by your "Host Channel Id Lun".
         */
        if (!strncmp("scsi add-single-device", buffer, 22)) {
                p = buffer + 23;

                host    = (p     < end) ? simple_strtoul(p, &p, 0) : 0;
                channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
                id      = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
                lun     = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;

                err = scsi_add_single_device(host, channel, id, lun);

        /*
         * Usage: echo "scsi remove-single-device 0 1 2 3" >/proc/scsi/scsi
         * with  "0 1 2 3" replaced by your "Host Channel Id Lun".
         */
        } else if (!strncmp("scsi remove-single-device", buffer, 25)) {
                p = buffer + 26;

                host    = (p     < end) ? simple_strtoul(p, &p, 0) : 0;
                channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
                id      = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
                lun     = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;

                err = scsi_remove_single_device(host, channel, id, lun);
        }

        /*
         * convert success returns so that we return the 
         * number of bytes consumed.
         */
        if (!err)
                err = length;

 out:
        free_page((unsigned long)buffer);
        return err;
}

static inline struct device *next_scsi_device(struct device *start)
{
        struct device *next = bus_find_next_device(&scsi_bus_type, start);

        put_device(start);
        return next;
}

static void *scsi_seq_start(struct seq_file *sfile, loff_t *pos)
{
        struct device *dev = NULL;
        loff_t n = *pos;

        while ((dev = next_scsi_device(dev))) {
                if (!n--)
                        break;
                sfile->private++;
        }
        return dev;
}

static void *scsi_seq_next(struct seq_file *sfile, void *v, loff_t *pos)
{
        (*pos)++;
        sfile->private++;
        return next_scsi_device(v);
}

static void scsi_seq_stop(struct seq_file *sfile, void *v)
{
        put_device(v);
}

static int scsi_seq_show(struct seq_file *sfile, void *dev)
{
        if (!sfile->private)
                seq_puts(sfile, "Attached devices:\n");

        return proc_print_scsidevice(dev, sfile);
}

static const struct seq_operations scsi_seq_ops = {
        .start        = scsi_seq_start,
        .next        = scsi_seq_next,
        .stop        = scsi_seq_stop,
        .show        = scsi_seq_show
};

/**
 * proc_scsi_open - glue function
 * @inode: not used
 * @file: passed to single_open()
 *
 * Associates proc_scsi_show with this file
 */
static int proc_scsi_open(struct inode *inode, struct file *file)
{
        /*
         * We don't really need this for the write case but it doesn't
         * harm either.
         */
        return seq_open(file, &scsi_seq_ops);
}

static const struct proc_ops scsi_scsi_proc_ops = {
        .proc_open        = proc_scsi_open,
        .proc_read        = seq_read,
        .proc_write        = proc_scsi_write,
        .proc_lseek        = seq_lseek,
        .proc_release        = seq_release,
};

/**
 * scsi_init_procfs - create scsi and scsi/scsi in procfs
 */
int __init scsi_init_procfs(void)
{
        struct proc_dir_entry *pde;

        proc_scsi = proc_mkdir("scsi", NULL);
        if (!proc_scsi)
                goto err1;

        pde = proc_create("scsi/scsi", 0, NULL, &scsi_scsi_proc_ops);
        if (!pde)
                goto err2;

        return 0;

err2:
        remove_proc_entry("scsi", NULL);
err1:
        return -ENOMEM;
}

/**
 * scsi_exit_procfs - Remove scsi/scsi and scsi from procfs
 */
void scsi_exit_procfs(void)
{
        remove_proc_entry("scsi/scsi", NULL);
        remove_proc_entry("scsi", NULL);
}
































































































































































































































































    3 

















































































































































































































































































































































































































































































































































































































































   13 




















   10 











    1 




    2 





































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
// SPDX-License-Identifier: GPL-2.0
/* Parts of this driver are based on the following:
 *  - Kvaser linux leaf driver (version 4.78)
 *  - CAN driver for esd CAN-USB/2
 *  - Kvaser linux usbcanII driver (version 5.3)
 *  - Kvaser linux mhydra driver (version 5.24)
 *
 * Copyright (C) 2002-2018 KVASER AB, Sweden. All rights reserved.
 * Copyright (C) 2010 Matthias Fuchs <matthias.fuchs@esd.eu>, esd gmbh
 * Copyright (C) 2012 Olivier Sobrie <olivier@sobrie.be>
 * Copyright (C) 2015 Valeo S.A.
 */

#include <linux/completion.h>
#include <linux/device.h>
#include <linux/ethtool.h>
#include <linux/gfp.h>
#include <linux/if.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netdevice.h>
#include <linux/spinlock.h>
#include <linux/types.h>
#include <linux/usb.h>

#include <linux/can.h>
#include <linux/can/dev.h>
#include <linux/can/error.h>
#include <linux/can/netlink.h>

#include "kvaser_usb.h"

/* Kvaser USB vendor id. */
#define KVASER_VENDOR_ID 0x0bfd

/* Kvaser Leaf USB devices product ids */
#define USB_LEAF_DEVEL_PRODUCT_ID 0x000a
#define USB_LEAF_LITE_PRODUCT_ID 0x000b
#define USB_LEAF_PRO_PRODUCT_ID 0x000c
#define USB_LEAF_SPRO_PRODUCT_ID 0x000e
#define USB_LEAF_PRO_LS_PRODUCT_ID 0x000f
#define USB_LEAF_PRO_SWC_PRODUCT_ID 0x0010
#define USB_LEAF_PRO_LIN_PRODUCT_ID 0x0011
#define USB_LEAF_SPRO_LS_PRODUCT_ID 0x0012
#define USB_LEAF_SPRO_SWC_PRODUCT_ID 0x0013
#define USB_MEMO2_DEVEL_PRODUCT_ID 0x0016
#define USB_MEMO2_HSHS_PRODUCT_ID 0x0017
#define USB_UPRO_HSHS_PRODUCT_ID 0x0018
#define USB_LEAF_LITE_GI_PRODUCT_ID 0x0019
#define USB_LEAF_PRO_OBDII_PRODUCT_ID 0x001a
#define USB_MEMO2_HSLS_PRODUCT_ID 0x001b
#define USB_LEAF_LITE_CH_PRODUCT_ID 0x001c
#define USB_BLACKBIRD_SPRO_PRODUCT_ID 0x001d
#define USB_OEM_MERCURY_PRODUCT_ID 0x0022
#define USB_OEM_LEAF_PRODUCT_ID 0x0023
#define USB_CAN_R_PRODUCT_ID 0x0027
#define USB_LEAF_LITE_V2_PRODUCT_ID 0x0120
#define USB_MINI_PCIE_HS_PRODUCT_ID 0x0121
#define USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID 0x0122
#define USB_USBCAN_LIGHT_2HS_PRODUCT_ID 0x0123
#define USB_MINI_PCIE_2HS_PRODUCT_ID 0x0124
#define USB_USBCAN_R_V2_PRODUCT_ID 0x0126
#define USB_LEAF_LIGHT_R_V2_PRODUCT_ID 0x0127
#define USB_LEAF_LIGHT_HS_V2_OEM2_PRODUCT_ID 0x0128

/* Kvaser USBCan-II devices product ids */
#define USB_USBCAN_REVB_PRODUCT_ID 0x0002
#define USB_VCI2_PRODUCT_ID 0x0003
#define USB_USBCAN2_PRODUCT_ID 0x0004
#define USB_MEMORATOR_PRODUCT_ID 0x0005

/* Kvaser Minihydra USB devices product ids */
#define USB_BLACKBIRD_V2_PRODUCT_ID 0x0102
#define USB_MEMO_PRO_5HS_PRODUCT_ID 0x0104
#define USB_USBCAN_PRO_5HS_PRODUCT_ID 0x0105
#define USB_USBCAN_LIGHT_4HS_PRODUCT_ID 0x0106
#define USB_LEAF_PRO_HS_V2_PRODUCT_ID 0x0107
#define USB_USBCAN_PRO_2HS_V2_PRODUCT_ID 0x0108
#define USB_MEMO_2HS_PRODUCT_ID 0x0109
#define USB_MEMO_PRO_2HS_V2_PRODUCT_ID 0x010a
#define USB_HYBRID_2CANLIN_PRODUCT_ID 0x010b
#define USB_ATI_USBCAN_PRO_2HS_V2_PRODUCT_ID 0x010c
#define USB_ATI_MEMO_PRO_2HS_V2_PRODUCT_ID 0x010d
#define USB_HYBRID_PRO_2CANLIN_PRODUCT_ID 0x010e
#define USB_U100_PRODUCT_ID 0x0111
#define USB_U100P_PRODUCT_ID 0x0112
#define USB_U100S_PRODUCT_ID 0x0113
#define USB_USBCAN_PRO_4HS_PRODUCT_ID 0x0114
#define USB_HYBRID_CANLIN_PRODUCT_ID 0x0115
#define USB_HYBRID_PRO_CANLIN_PRODUCT_ID 0x0116
#define USB_LEAF_V3_PRODUCT_ID 0x0117
#define USB_VINING_800_PRODUCT_ID 0x0119
#define USB_USBCAN_PRO_5XCAN_PRODUCT_ID 0x011A
#define USB_MINI_PCIE_1XCAN_PRODUCT_ID 0x011B

static const struct kvaser_usb_driver_info kvaser_usb_driver_info_hydra = {
        .quirks = 0,
        .ops = &kvaser_usb_hydra_dev_ops,
};

static const struct kvaser_usb_driver_info kvaser_usb_driver_info_usbcan = {
        .quirks = KVASER_USB_QUIRK_HAS_TXRX_ERRORS |
                  KVASER_USB_QUIRK_HAS_SILENT_MODE,
        .family = KVASER_USBCAN,
        .ops = &kvaser_usb_leaf_dev_ops,
};

static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leaf = {
        .quirks = KVASER_USB_QUIRK_IGNORE_CLK_FREQ,
        .family = KVASER_LEAF,
        .ops = &kvaser_usb_leaf_dev_ops,
};

static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leaf_err = {
        .quirks = KVASER_USB_QUIRK_HAS_TXRX_ERRORS |
                  KVASER_USB_QUIRK_IGNORE_CLK_FREQ,
        .family = KVASER_LEAF,
        .ops = &kvaser_usb_leaf_dev_ops,
};

static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leaf_err_listen = {
        .quirks = KVASER_USB_QUIRK_HAS_TXRX_ERRORS |
                  KVASER_USB_QUIRK_HAS_SILENT_MODE |
                  KVASER_USB_QUIRK_IGNORE_CLK_FREQ,
        .family = KVASER_LEAF,
        .ops = &kvaser_usb_leaf_dev_ops,
};

static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leafimx = {
        .quirks = 0,
        .family = KVASER_LEAF,
        .ops = &kvaser_usb_leaf_dev_ops,
};

static const struct usb_device_id kvaser_usb_table[] = {
        /* Leaf M32C USB product IDs */
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_DEVEL_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_SPRO_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_LS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_SWC_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_LIN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_SPRO_LS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_SPRO_SWC_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO2_DEVEL_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO2_HSHS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_UPRO_HSHS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_GI_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_OBDII_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO2_HSLS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_CH_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_BLACKBIRD_SPRO_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_OEM_MERCURY_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_OEM_LEAF_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_CAN_R_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },

        /* Leaf i.MX28 USB product IDs */
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_2HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_2HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_R_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_R_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_HS_V2_OEM2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },

        /* USBCANII USB product IDs */
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_REVB_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMORATOR_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_VCI2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },

        /* Minihydra USB product IDs */
        { USB_DEVICE(KVASER_VENDOR_ID, USB_BLACKBIRD_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_PRO_5HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_5HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_4HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_HS_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_2HS_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_2HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_PRO_2HS_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_2CANLIN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_ATI_USBCAN_PRO_2HS_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_ATI_MEMO_PRO_2HS_V2_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_PRO_2CANLIN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_U100_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_U100P_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_U100S_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_4HS_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_CANLIN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_PRO_CANLIN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_V3_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_VINING_800_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_5XCAN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_1XCAN_PRODUCT_ID),
                .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
        { }
};
MODULE_DEVICE_TABLE(usb, kvaser_usb_table);

int kvaser_usb_send_cmd(const struct kvaser_usb *dev, void *cmd, int len)
{
        return usb_bulk_msg(dev->udev,
                            usb_sndbulkpipe(dev->udev,
                                            dev->bulk_out->bEndpointAddress),
                            cmd, len, NULL, KVASER_USB_TIMEOUT);
}

int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len,
                        int *actual_len)
{
        return usb_bulk_msg(dev->udev,
                            usb_rcvbulkpipe(dev->udev,
                                            dev->bulk_in->bEndpointAddress),
                            cmd, len, actual_len, KVASER_USB_TIMEOUT);
}

static void kvaser_usb_send_cmd_callback(struct urb *urb)
{
        struct net_device *netdev = urb->context;

        kfree(urb->transfer_buffer);

        if (urb->status)
                netdev_warn(netdev, "urb status received: %d\n", urb->status);
}

int kvaser_usb_send_cmd_async(struct kvaser_usb_net_priv *priv, void *cmd,
                              int len)
{
        struct kvaser_usb *dev = priv->dev;
        struct net_device *netdev = priv->netdev;
        struct urb *urb;
        int err;

        urb = usb_alloc_urb(0, GFP_ATOMIC);
        if (!urb)
                return -ENOMEM;

        usb_fill_bulk_urb(urb, dev->udev,
                          usb_sndbulkpipe(dev->udev,
                                          dev->bulk_out->bEndpointAddress),
                          cmd, len, kvaser_usb_send_cmd_callback, netdev);
        usb_anchor_urb(urb, &priv->tx_submitted);

        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err) {
                netdev_err(netdev, "Error transmitting URB\n");
                usb_unanchor_urb(urb);
        }
        usb_free_urb(urb);

        return err;
}

int kvaser_usb_can_rx_over_error(struct net_device *netdev)
{
        struct net_device_stats *stats = &netdev->stats;
        struct can_frame *cf;
        struct sk_buff *skb;

        stats->rx_over_errors++;
        stats->rx_errors++;

        skb = alloc_can_err_skb(netdev, &cf);
        if (!skb) {
                stats->rx_dropped++;
                netdev_warn(netdev, "No memory left for err_skb\n");
                return -ENOMEM;
        }

        cf->can_id |= CAN_ERR_CRTL;
        cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;

        netif_rx(skb);

        return 0;
}

static void kvaser_usb_read_bulk_callback(struct urb *urb)
{
        struct kvaser_usb *dev = urb->context;
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        int err;
        unsigned int i;

        switch (urb->status) {
        case 0:
                break;
        case -ENOENT:
        case -EPIPE:
        case -EPROTO:
        case -ESHUTDOWN:
                return;
        default:
                dev_info(&dev->intf->dev, "Rx URB aborted (%d)\n", urb->status);
                goto resubmit_urb;
        }

        ops->dev_read_bulk_callback(dev, urb->transfer_buffer,
                                    urb->actual_length);

resubmit_urb:
        usb_fill_bulk_urb(urb, dev->udev,
                          usb_rcvbulkpipe(dev->udev,
                                          dev->bulk_in->bEndpointAddress),
                          urb->transfer_buffer, KVASER_USB_RX_BUFFER_SIZE,
                          kvaser_usb_read_bulk_callback, dev);

        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err == -ENODEV) {
                for (i = 0; i < dev->nchannels; i++) {
                        if (!dev->nets[i])
                                continue;

                        netif_device_detach(dev->nets[i]->netdev);
                }
        } else if (err) {
                dev_err(&dev->intf->dev,
                        "Failed resubmitting read bulk urb: %d\n", err);
        }
}

static int kvaser_usb_setup_rx_urbs(struct kvaser_usb *dev)
{
        int i, err = 0;

        if (dev->rxinitdone)
                return 0;

        for (i = 0; i < KVASER_USB_MAX_RX_URBS; i++) {
                struct urb *urb = NULL;
                u8 *buf = NULL;
                dma_addr_t buf_dma;

                urb = usb_alloc_urb(0, GFP_KERNEL);
                if (!urb) {
                        err = -ENOMEM;
                        break;
                }

                buf = usb_alloc_coherent(dev->udev, KVASER_USB_RX_BUFFER_SIZE,
                                         GFP_KERNEL, &buf_dma);
                if (!buf) {
                        dev_warn(&dev->intf->dev,
                                 "No memory left for USB buffer\n");
                        usb_free_urb(urb);
                        err = -ENOMEM;
                        break;
                }

                usb_fill_bulk_urb(urb, dev->udev,
                                  usb_rcvbulkpipe
                                        (dev->udev,
                                         dev->bulk_in->bEndpointAddress),
                                  buf, KVASER_USB_RX_BUFFER_SIZE,
                                  kvaser_usb_read_bulk_callback, dev);
                urb->transfer_dma = buf_dma;
                urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
                usb_anchor_urb(urb, &dev->rx_submitted);

                err = usb_submit_urb(urb, GFP_KERNEL);
                if (err) {
                        usb_unanchor_urb(urb);
                        usb_free_coherent(dev->udev,
                                          KVASER_USB_RX_BUFFER_SIZE, buf,
                                          buf_dma);
                        usb_free_urb(urb);
                        break;
                }

                dev->rxbuf[i] = buf;
                dev->rxbuf_dma[i] = buf_dma;

                usb_free_urb(urb);
        }

        if (i == 0) {
                dev_warn(&dev->intf->dev, "Cannot setup read URBs, error %d\n",
                         err);
                return err;
        } else if (i < KVASER_USB_MAX_RX_URBS) {
                dev_warn(&dev->intf->dev, "RX performances may be slow\n");
        }

        dev->rxinitdone = true;

        return 0;
}

static int kvaser_usb_open(struct net_device *netdev)
{
        struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
        struct kvaser_usb *dev = priv->dev;
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        int err;

        err = open_candev(netdev);
        if (err)
                return err;

        err = ops->dev_set_opt_mode(priv);
        if (err)
                goto error;

        err = ops->dev_start_chip(priv);
        if (err) {
                netdev_warn(netdev, "Cannot start device, error %d\n", err);
                goto error;
        }

        priv->can.state = CAN_STATE_ERROR_ACTIVE;

        return 0;

error:
        close_candev(netdev);
        return err;
}

static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
{
        int i, max_tx_urbs;

        max_tx_urbs = priv->dev->max_tx_urbs;

        priv->active_tx_contexts = 0;
        for (i = 0; i < max_tx_urbs; i++)
                priv->tx_contexts[i].echo_index = max_tx_urbs;
}

/* This method might sleep. Do not call it in the atomic context
 * of URB completions.
 */
void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
{
        usb_kill_anchored_urbs(&priv->tx_submitted);
        kvaser_usb_reset_tx_urb_contexts(priv);
}

static void kvaser_usb_unlink_all_urbs(struct kvaser_usb *dev)
{
        int i;

        usb_kill_anchored_urbs(&dev->rx_submitted);

        for (i = 0; i < KVASER_USB_MAX_RX_URBS; i++)
                usb_free_coherent(dev->udev, KVASER_USB_RX_BUFFER_SIZE,
                                  dev->rxbuf[i], dev->rxbuf_dma[i]);

        for (i = 0; i < dev->nchannels; i++) {
                struct kvaser_usb_net_priv *priv = dev->nets[i];

                if (priv)
                        kvaser_usb_unlink_tx_urbs(priv);
        }
}

static int kvaser_usb_close(struct net_device *netdev)
{
        struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
        struct kvaser_usb *dev = priv->dev;
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        int err;

        netif_stop_queue(netdev);

        err = ops->dev_flush_queue(priv);
        if (err)
                netdev_warn(netdev, "Cannot flush queue, error %d\n", err);

        if (ops->dev_reset_chip) {
                err = ops->dev_reset_chip(dev, priv->channel);
                if (err)
                        netdev_warn(netdev, "Cannot reset card, error %d\n",
                                    err);
        }

        err = ops->dev_stop_chip(priv);
        if (err)
                netdev_warn(netdev, "Cannot stop device, error %d\n", err);

        /* reset tx contexts */
        kvaser_usb_unlink_tx_urbs(priv);

        priv->can.state = CAN_STATE_STOPPED;
        close_candev(priv->netdev);

        return 0;
}

static int kvaser_usb_set_bittiming(struct net_device *netdev)
{
        struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
        struct kvaser_usb *dev = priv->dev;
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        struct can_bittiming *bt = &priv->can.bittiming;
        struct kvaser_usb_busparams busparams;
        int tseg1 = bt->prop_seg + bt->phase_seg1;
        int tseg2 = bt->phase_seg2;
        int sjw = bt->sjw;
        int err;

        busparams.bitrate = cpu_to_le32(bt->bitrate);
        busparams.sjw = (u8)sjw;
        busparams.tseg1 = (u8)tseg1;
        busparams.tseg2 = (u8)tseg2;
        if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
                busparams.nsamples = 3;
        else
                busparams.nsamples = 1;

        err = ops->dev_set_bittiming(netdev, &busparams);
        if (err)
                return err;

        err = kvaser_usb_setup_rx_urbs(priv->dev);
        if (err)
                return err;

        err = ops->dev_get_busparams(priv);
        if (err) {
                /* Treat EOPNOTSUPP as success */
                if (err == -EOPNOTSUPP)
                        err = 0;
                return err;
        }

        if (memcmp(&busparams, &priv->busparams_nominal,
                   sizeof(priv->busparams_nominal)) != 0)
                err = -EINVAL;

        return err;
}

static int kvaser_usb_set_data_bittiming(struct net_device *netdev)
{
        struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
        struct kvaser_usb *dev = priv->dev;
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        struct can_bittiming *dbt = &priv->can.data_bittiming;
        struct kvaser_usb_busparams busparams;
        int tseg1 = dbt->prop_seg + dbt->phase_seg1;
        int tseg2 = dbt->phase_seg2;
        int sjw = dbt->sjw;
        int err;

        if (!ops->dev_set_data_bittiming ||
            !ops->dev_get_data_busparams)
                return -EOPNOTSUPP;

        busparams.bitrate = cpu_to_le32(dbt->bitrate);
        busparams.sjw = (u8)sjw;
        busparams.tseg1 = (u8)tseg1;
        busparams.tseg2 = (u8)tseg2;
        busparams.nsamples = 1;

        err = ops->dev_set_data_bittiming(netdev, &busparams);
        if (err)
                return err;

        err = kvaser_usb_setup_rx_urbs(priv->dev);
        if (err)
                return err;

        err = ops->dev_get_data_busparams(priv);
        if (err)
                return err;

        if (memcmp(&busparams, &priv->busparams_data,
                   sizeof(priv->busparams_data)) != 0)
                err = -EINVAL;

        return err;
}

static void kvaser_usb_write_bulk_callback(struct urb *urb)
{
        struct kvaser_usb_tx_urb_context *context = urb->context;
        struct kvaser_usb_net_priv *priv;
        struct net_device *netdev;

        if (WARN_ON(!context))
                return;

        priv = context->priv;
        netdev = priv->netdev;

        kfree(urb->transfer_buffer);

        if (!netif_device_present(netdev))
                return;

        if (urb->status)
                netdev_info(netdev, "Tx URB aborted (%d)\n", urb->status);
}

static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                                         struct net_device *netdev)
{
        struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
        struct kvaser_usb *dev = priv->dev;
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        struct net_device_stats *stats = &netdev->stats;
        struct kvaser_usb_tx_urb_context *context = NULL;
        struct urb *urb;
        void *buf;
        int cmd_len = 0;
        int err, ret = NETDEV_TX_OK;
        unsigned int i;
        unsigned long flags;

        if (can_dev_dropped_skb(netdev, skb))
                return NETDEV_TX_OK;

        urb = usb_alloc_urb(0, GFP_ATOMIC);
        if (!urb) {
                stats->tx_dropped++;
                dev_kfree_skb(skb);
                return NETDEV_TX_OK;
        }

        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
        for (i = 0; i < dev->max_tx_urbs; i++) {
                if (priv->tx_contexts[i].echo_index == dev->max_tx_urbs) {
                        context = &priv->tx_contexts[i];

                        context->echo_index = i;
                        ++priv->active_tx_contexts;
                        if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)
                                netif_stop_queue(netdev);

                        break;
                }
        }
        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);

        /* This should never happen; it implies a flow control bug */
        if (!context) {
                netdev_warn(netdev, "cannot find free context\n");

                ret = NETDEV_TX_BUSY;
                goto freeurb;
        }

        buf = ops->dev_frame_to_cmd(priv, skb, &cmd_len, context->echo_index);
        if (!buf) {
                stats->tx_dropped++;
                dev_kfree_skb(skb);
                spin_lock_irqsave(&priv->tx_contexts_lock, flags);

                context->echo_index = dev->max_tx_urbs;
                --priv->active_tx_contexts;
                netif_wake_queue(netdev);

                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
                goto freeurb;
        }

        context->priv = priv;

        can_put_echo_skb(skb, netdev, context->echo_index, 0);

        usb_fill_bulk_urb(urb, dev->udev,
                          usb_sndbulkpipe(dev->udev,
                                          dev->bulk_out->bEndpointAddress),
                          buf, cmd_len, kvaser_usb_write_bulk_callback,
                          context);
        usb_anchor_urb(urb, &priv->tx_submitted);

        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (unlikely(err)) {
                spin_lock_irqsave(&priv->tx_contexts_lock, flags);

                can_free_echo_skb(netdev, context->echo_index, NULL);
                context->echo_index = dev->max_tx_urbs;
                --priv->active_tx_contexts;
                netif_wake_queue(netdev);

                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);

                usb_unanchor_urb(urb);
                kfree(buf);

                stats->tx_dropped++;

                if (err == -ENODEV)
                        netif_device_detach(netdev);
                else
                        netdev_warn(netdev, "Failed tx_urb %d\n", err);

                goto freeurb;
        }

        ret = NETDEV_TX_OK;

freeurb:
        usb_free_urb(urb);
        return ret;
}

static const struct net_device_ops kvaser_usb_netdev_ops = {
        .ndo_open = kvaser_usb_open,
        .ndo_stop = kvaser_usb_close,
        .ndo_eth_ioctl = can_eth_ioctl_hwts,
        .ndo_start_xmit = kvaser_usb_start_xmit,
        .ndo_change_mtu = can_change_mtu,
};

static const struct ethtool_ops kvaser_usb_ethtool_ops = {
        .get_ts_info = can_ethtool_op_get_ts_info_hwts,
};

static void kvaser_usb_remove_interfaces(struct kvaser_usb *dev)
{
        const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
        int i;

        for (i = 0; i < dev->nchannels; i++) {
                if (!dev->nets[i])
                        continue;

                unregister_candev(dev->nets[i]->netdev);
        }

        kvaser_usb_unlink_all_urbs(dev);

        for (i = 0; i < dev->nchannels; i++) {
                if (!dev->nets[i])
                        continue;

                if (ops->dev_remove_channel)
                        ops->dev_remove_channel(dev->nets[i]);

                free_candev(dev->nets[i]->netdev);
        }
}

static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
{
        struct net_device *netdev;
        struct kvaser_usb_net_priv *priv;
        const struct kvaser_usb_driver_info *driver_info = dev->driver_info;
        const struct kvaser_usb_dev_ops *ops = driver_info->ops;
        int err;

        if (ops->dev_reset_chip) {
                err = ops->dev_reset_chip(dev, channel);
                if (err)
                        return err;
        }

        netdev = alloc_candev(struct_size(priv, tx_contexts, dev->max_tx_urbs),
                              dev->max_tx_urbs);
        if (!netdev) {
                dev_err(&dev->intf->dev, "Cannot alloc candev\n");
                return -ENOMEM;
        }

        priv = netdev_priv(netdev);

        init_usb_anchor(&priv->tx_submitted);
        init_completion(&priv->start_comp);
        init_completion(&priv->stop_comp);
        init_completion(&priv->flush_comp);
        init_completion(&priv->get_busparams_comp);
        priv->can.ctrlmode_supported = CAN_CTRLMODE_CC_LEN8_DLC |
                                       CAN_CTRLMODE_BERR_REPORTING;

        priv->dev = dev;
        priv->netdev = netdev;
        priv->channel = channel;

        spin_lock_init(&priv->tx_contexts_lock);
        kvaser_usb_reset_tx_urb_contexts(priv);

        priv->can.state = CAN_STATE_STOPPED;
        priv->can.clock.freq = dev->cfg->clock.freq;
        priv->can.bittiming_const = dev->cfg->bittiming_const;
        priv->can.do_set_bittiming = kvaser_usb_set_bittiming;
        priv->can.do_set_mode = ops->dev_set_mode;
        if ((driver_info->quirks & KVASER_USB_QUIRK_HAS_TXRX_ERRORS) ||
            (priv->dev->card_data.capabilities & KVASER_USB_CAP_BERR_CAP))
                priv->can.do_get_berr_counter = ops->dev_get_berr_counter;
        if (driver_info->quirks & KVASER_USB_QUIRK_HAS_SILENT_MODE)
                priv->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY;

        priv->can.ctrlmode_supported |= dev->card_data.ctrlmode_supported;

        if (priv->can.ctrlmode_supported & CAN_CTRLMODE_FD) {
                priv->can.data_bittiming_const = dev->cfg->data_bittiming_const;
                priv->can.do_set_data_bittiming = kvaser_usb_set_data_bittiming;
        }

        netdev->flags |= IFF_ECHO;

        netdev->netdev_ops = &kvaser_usb_netdev_ops;
        netdev->ethtool_ops = &kvaser_usb_ethtool_ops;
        SET_NETDEV_DEV(netdev, &dev->intf->dev);
        netdev->dev_id = channel;

        dev->nets[channel] = priv;

        if (ops->dev_init_channel) {
                err = ops->dev_init_channel(priv);
                if (err)
                        goto err;
        }

        err = register_candev(netdev);
        if (err) {
                dev_err(&dev->intf->dev, "Failed to register CAN device\n");
                goto err;
        }

        netdev_dbg(netdev, "device registered\n");

        return 0;

err:
        free_candev(netdev);
        dev->nets[channel] = NULL;
        return err;
}

static int kvaser_usb_probe(struct usb_interface *intf,
                            const struct usb_device_id *id)
{
        struct kvaser_usb *dev;
        int err;
        int i;
        const struct kvaser_usb_driver_info *driver_info;
        const struct kvaser_usb_dev_ops *ops;

        driver_info = (const struct kvaser_usb_driver_info *)id->driver_info;
        if (!driver_info)
                return -ENODEV;

        dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
        if (!dev)
                return -ENOMEM;

        dev->intf = intf;
        dev->driver_info = driver_info;
        ops = driver_info->ops;

        err = ops->dev_setup_endpoints(dev);
        if (err)
                return dev_err_probe(&intf->dev, err, "Cannot get usb endpoint(s)");

        dev->udev = interface_to_usbdev(intf);

        init_usb_anchor(&dev->rx_submitted);

        usb_set_intfdata(intf, dev);

        dev->card_data.ctrlmode_supported = 0;
        dev->card_data.capabilities = 0;
        err = ops->dev_init_card(dev);
        if (err)
                return dev_err_probe(&intf->dev, err,
                                     "Failed to initialize card\n");

        err = ops->dev_get_software_info(dev);
        if (err)
                return dev_err_probe(&intf->dev, err,
                                     "Cannot get software info\n");

        if (ops->dev_get_software_details) {
                err = ops->dev_get_software_details(dev);
                if (err)
                        return dev_err_probe(&intf->dev, err,
                                             "Cannot get software details\n");
        }

        if (WARN_ON(!dev->cfg))
                return -ENODEV;

        dev_dbg(&intf->dev, "Firmware version: %d.%d.%d\n",
                ((dev->fw_version >> 24) & 0xff),
                ((dev->fw_version >> 16) & 0xff),
                (dev->fw_version & 0xffff));

        dev_dbg(&intf->dev, "Max outstanding tx = %d URBs\n", dev->max_tx_urbs);

        err = ops->dev_get_card_info(dev);
        if (err)
                return dev_err_probe(&intf->dev, err,
                                     "Cannot get card info\n");

        if (ops->dev_get_capabilities) {
                err = ops->dev_get_capabilities(dev);
                if (err) {
                        kvaser_usb_remove_interfaces(dev);
                        return dev_err_probe(&intf->dev, err,
                                             "Cannot get capabilities\n");
                }
        }

        for (i = 0; i < dev->nchannels; i++) {
                err = kvaser_usb_init_one(dev, i);
                if (err) {
                        kvaser_usb_remove_interfaces(dev);
                        return err;
                }
        }

        return 0;
}

static void kvaser_usb_disconnect(struct usb_interface *intf)
{
        struct kvaser_usb *dev = usb_get_intfdata(intf);

        usb_set_intfdata(intf, NULL);

        if (!dev)
                return;

        kvaser_usb_remove_interfaces(dev);
}

static struct usb_driver kvaser_usb_driver = {
        .name = KBUILD_MODNAME,
        .probe = kvaser_usb_probe,
        .disconnect = kvaser_usb_disconnect,
        .id_table = kvaser_usb_table,
};

module_usb_driver(kvaser_usb_driver);

MODULE_AUTHOR("Olivier Sobrie <olivier@sobrie.be>");
MODULE_AUTHOR("Kvaser AB <support@kvaser.com>");
MODULE_DESCRIPTION("CAN driver for Kvaser CAN/USB devices");
MODULE_LICENSE("GPL v2");
















































































































































































































































































































































































































































































































































































































































































































































































































































































































    1 








































































































    1 


































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
// SPDX-License-Identifier: GPL-2.0-or-later
/****************************************************************
 *
 *     kaweth.c - driver for KL5KUSB101 based USB->Ethernet
 *
 *     (c) 2000 Interlan Communications
 *     (c) 2000 Stephane Alnet
 *     (C) 2001 Brad Hards
 *     (C) 2002 Oliver Neukum
 *
 *     Original author: The Zapman <zapman@interlan.net>
 *     Inspired by, and much credit goes to Michael Rothwell
 *     <rothwell@interlan.net> for the test equipment, help, and patience
 *     Based off of (and with thanks to) Petko Manolov's pegaus.c driver.
 *     Also many thanks to Joel Silverman and Ed Surprenant at Kawasaki
 *     for providing the firmware and driver resources.
 *
 ****************************************************************/

/* TODO:
 * Develop test procedures for USB net interfaces
 * Run test procedures
 * Fix bugs from previous two steps
 * Snoop other OSs for any tricks we're not doing
 * Reduce arbitrary timeouts
 * Smart multicast support
 * Temporary MAC change support
 * Tunable SOFs parameter - ioctl()?
 * Ethernet stats collection
 * Code formatting improvements
 */

#include <linux/module.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/delay.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/usb.h>
#include <linux/types.h>
#include <linux/ethtool.h>
#include <linux/dma-mapping.h>
#include <linux/wait.h>
#include <linux/firmware.h>
#include <linux/uaccess.h>
#include <asm/byteorder.h>

#undef DEBUG

#define KAWETH_MTU                        1514
#define KAWETH_BUF_SIZE                        1664
#define KAWETH_TX_TIMEOUT                (5 * HZ)
#define KAWETH_SCRATCH_SIZE                32
#define KAWETH_FIRMWARE_BUF_SIZE        4096
#define KAWETH_CONTROL_TIMEOUT                (30000)

#define KAWETH_STATUS_BROKEN                0x0000001
#define KAWETH_STATUS_CLOSING                0x0000002
#define KAWETH_STATUS_SUSPENDING        0x0000004

#define KAWETH_STATUS_BLOCKED (KAWETH_STATUS_CLOSING | KAWETH_STATUS_SUSPENDING)

#define KAWETH_PACKET_FILTER_PROMISCUOUS        0x01
#define KAWETH_PACKET_FILTER_ALL_MULTICAST        0x02
#define KAWETH_PACKET_FILTER_DIRECTED                0x04
#define KAWETH_PACKET_FILTER_BROADCAST                0x08
#define KAWETH_PACKET_FILTER_MULTICAST                0x10

/* Table 7 */
#define KAWETH_COMMAND_GET_ETHERNET_DESC        0x00
#define KAWETH_COMMAND_MULTICAST_FILTERS        0x01
#define KAWETH_COMMAND_SET_PACKET_FILTER        0x02
#define KAWETH_COMMAND_STATISTICS               0x03
#define KAWETH_COMMAND_SET_TEMP_MAC             0x06
#define KAWETH_COMMAND_GET_TEMP_MAC             0x07
#define KAWETH_COMMAND_SET_URB_SIZE                0x08
#define KAWETH_COMMAND_SET_SOFS_WAIT                0x09
#define KAWETH_COMMAND_SCAN                        0xFF

#define KAWETH_SOFS_TO_WAIT                        0x05

#define INTBUFFERSIZE                                4

#define STATE_OFFSET                                0
#define STATE_MASK                                0x40
#define        STATE_SHIFT                                5

#define IS_BLOCKED(s) (s & KAWETH_STATUS_BLOCKED)


MODULE_AUTHOR("Michael Zappe <zapman@interlan.net>, Stephane Alnet <stephane@u-picardie.fr>, Brad Hards <bhards@bigpond.net.au> and Oliver Neukum <oliver@neukum.org>");
MODULE_DESCRIPTION("KL5USB101 USB Ethernet driver");
MODULE_LICENSE("GPL");
MODULE_FIRMWARE("kaweth/new_code.bin");
MODULE_FIRMWARE("kaweth/new_code_fix.bin");
MODULE_FIRMWARE("kaweth/trigger_code.bin");
MODULE_FIRMWARE("kaweth/trigger_code_fix.bin");

static const char driver_name[] = "kaweth";

static int kaweth_probe(
                struct usb_interface *intf,
                const struct usb_device_id *id        /* from id_table */
        );
static void kaweth_disconnect(struct usb_interface *intf);
static int kaweth_suspend(struct usb_interface *intf, pm_message_t message);
static int kaweth_resume(struct usb_interface *intf);

/****************************************************************
 *     usb_device_id
 ****************************************************************/
static const struct usb_device_id usb_klsi_table[] = {
        { USB_DEVICE(0x03e8, 0x0008) }, /* AOX Endpoints USB Ethernet */
        { USB_DEVICE(0x04bb, 0x0901) }, /* I-O DATA USB-ET/T */
        { USB_DEVICE(0x0506, 0x03e8) }, /* 3Com 3C19250 */
        { USB_DEVICE(0x0506, 0x11f8) }, /* 3Com 3C460 */
        { USB_DEVICE(0x0557, 0x2002) }, /* ATEN USB Ethernet */
        { USB_DEVICE(0x0557, 0x4000) }, /* D-Link DSB-650C */
        { USB_DEVICE(0x0565, 0x0002) }, /* Peracom Enet */
        { USB_DEVICE(0x0565, 0x0003) }, /* Optus@Home UEP1045A */
        { USB_DEVICE(0x0565, 0x0005) }, /* Peracom Enet2 */
        { USB_DEVICE(0x05e9, 0x0008) }, /* KLSI KL5KUSB101B */
        { USB_DEVICE(0x05e9, 0x0009) }, /* KLSI KL5KUSB101B (Board change) */
        { USB_DEVICE(0x066b, 0x2202) }, /* Linksys USB10T */
        { USB_DEVICE(0x06e1, 0x0008) }, /* ADS USB-10BT */
        { USB_DEVICE(0x06e1, 0x0009) }, /* ADS USB-10BT */
        { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
        { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
        { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
        { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
        { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
        { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
        { USB_DEVICE(0x085a, 0x0009) }, /* PortGear Ethernet Adapter */
        { USB_DEVICE(0x087d, 0x5704) }, /* Jaton USB Ethernet Device Adapter */
        { USB_DEVICE(0x0951, 0x0008) }, /* Kingston Technology USB Ethernet Adapter */
        { USB_DEVICE(0x095a, 0x3003) }, /* Portsmith Express Ethernet Adapter */
        { USB_DEVICE(0x10bd, 0x1427) }, /* ASANTE USB To Ethernet Adapter */
        { USB_DEVICE(0x1342, 0x0204) }, /* Mobility USB-Ethernet Adapter */
        { USB_DEVICE(0x13d2, 0x0400) }, /* Shark Pocket Adapter */
        { USB_DEVICE(0x1485, 0x0001) },        /* Silicom U2E */
        { USB_DEVICE(0x1485, 0x0002) }, /* Psion Dacom Gold Port Ethernet */
        { USB_DEVICE(0x1645, 0x0005) }, /* Entrega E45 */
        { USB_DEVICE(0x1645, 0x0008) }, /* Entrega USB Ethernet Adapter */
        { USB_DEVICE(0x1645, 0x8005) }, /* PortGear Ethernet Adapter */
        { USB_DEVICE(0x1668, 0x0323) }, /* Actiontec USB Ethernet */
        { USB_DEVICE(0x2001, 0x4000) }, /* D-link DSB-650C */
        {} /* Null terminator */
};

MODULE_DEVICE_TABLE (usb, usb_klsi_table);

/****************************************************************
 *     kaweth_driver
 ****************************************************************/
static struct usb_driver kaweth_driver = {
        .name =                driver_name,
        .probe =        kaweth_probe,
        .disconnect =        kaweth_disconnect,
        .suspend =        kaweth_suspend,
        .resume =        kaweth_resume,
        .id_table =     usb_klsi_table,
        .supports_autosuspend =        1,
        .disable_hub_initiated_lpm = 1,
};

typedef __u8 eth_addr_t[6];

/****************************************************************
 *     usb_eth_dev
 ****************************************************************/
struct usb_eth_dev {
        char *name;
        __u16 vendor;
        __u16 device;
        void *pdata;
};

/****************************************************************
 *     kaweth_ethernet_configuration
 *     Refer Table 8
 ****************************************************************/
struct kaweth_ethernet_configuration
{
        __u8 size;
        __u8 reserved1;
        __u8 reserved2;
        eth_addr_t hw_addr;
        __u32 statistics_mask;
        __le16 segment_size;
        __u16 max_multicast_filters;
        __u8 reserved3;
} __packed;

/****************************************************************
 *     kaweth_device
 ****************************************************************/
struct kaweth_device
{
        spinlock_t device_lock;

        __u32 status;
        int end;
        int suspend_lowmem_rx;
        int suspend_lowmem_ctrl;
        int linkstate;
        int opened;
        struct delayed_work lowmem_work;

        struct usb_device *dev;
        struct usb_interface *intf;
        struct net_device *net;
        wait_queue_head_t term_wait;

        struct urb *rx_urb;
        struct urb *tx_urb;
        struct urb *irq_urb;

        dma_addr_t intbufferhandle;
        __u8 *intbuffer;
        dma_addr_t rxbufferhandle;
        __u8 *rx_buf;


        struct sk_buff *tx_skb;

        __u8 *firmware_buf;
        __u8 scratch[KAWETH_SCRATCH_SIZE];
        __u16 packet_filter_bitmap;

        struct kaweth_ethernet_configuration configuration;
};

/****************************************************************
 *     kaweth_read_configuration
 ****************************************************************/
static int kaweth_read_configuration(struct kaweth_device *kaweth)
{
        return usb_control_msg(kaweth->dev, usb_rcvctrlpipe(kaweth->dev, 0),
                                KAWETH_COMMAND_GET_ETHERNET_DESC,
                                USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
                                0, 0,
                                &kaweth->configuration,
                                sizeof(kaweth->configuration),
                                KAWETH_CONTROL_TIMEOUT);
}

/****************************************************************
 *     kaweth_set_urb_size
 ****************************************************************/
static int kaweth_set_urb_size(struct kaweth_device *kaweth, __u16 urb_size)
{
        netdev_dbg(kaweth->net, "Setting URB size to %d\n", (unsigned)urb_size);

        return usb_control_msg(kaweth->dev, usb_sndctrlpipe(kaweth->dev, 0),
                               KAWETH_COMMAND_SET_URB_SIZE,
                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                               urb_size, 0,
                               &kaweth->scratch, 0,
                               KAWETH_CONTROL_TIMEOUT);
}

/****************************************************************
 *     kaweth_set_sofs_wait
 ****************************************************************/
static int kaweth_set_sofs_wait(struct kaweth_device *kaweth, __u16 sofs_wait)
{
        netdev_dbg(kaweth->net, "Set SOFS wait to %d\n", (unsigned)sofs_wait);

        return usb_control_msg(kaweth->dev, usb_sndctrlpipe(kaweth->dev, 0),
                               KAWETH_COMMAND_SET_SOFS_WAIT,
                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                               sofs_wait, 0,
                               &kaweth->scratch, 0,
                               KAWETH_CONTROL_TIMEOUT);
}

/****************************************************************
 *     kaweth_set_receive_filter
 ****************************************************************/
static int kaweth_set_receive_filter(struct kaweth_device *kaweth,
                                     __u16 receive_filter)
{
        netdev_dbg(kaweth->net, "Set receive filter to %d\n",
                   (unsigned)receive_filter);

        return usb_control_msg(kaweth->dev, usb_sndctrlpipe(kaweth->dev, 0),
                               KAWETH_COMMAND_SET_PACKET_FILTER,
                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                               receive_filter, 0,
                               &kaweth->scratch, 0,
                               KAWETH_CONTROL_TIMEOUT);
}

/****************************************************************
 *     kaweth_download_firmware
 ****************************************************************/
static int kaweth_download_firmware(struct kaweth_device *kaweth,
                                    const char *fwname,
                                    __u8 interrupt,
                                    __u8 type)
{
        const struct firmware *fw;
        int data_len;
        int ret;

        ret = request_firmware(&fw, fwname, &kaweth->dev->dev);
        if (ret) {
                dev_err(&kaweth->intf->dev, "Firmware request failed\n");
                return ret;
        }

        if (fw->size > KAWETH_FIRMWARE_BUF_SIZE) {
                dev_err(&kaweth->intf->dev, "Firmware too big: %zu\n",
                        fw->size);
                release_firmware(fw);
                return -ENOSPC;
        }
        data_len = fw->size;
        memcpy(kaweth->firmware_buf, fw->data, fw->size);

        release_firmware(fw);

        kaweth->firmware_buf[2] = (data_len & 0xFF) - 7;
        kaweth->firmware_buf[3] = data_len >> 8;
        kaweth->firmware_buf[4] = type;
        kaweth->firmware_buf[5] = interrupt;

        netdev_dbg(kaweth->net, "High: %i, Low:%i\n", kaweth->firmware_buf[3],
                   kaweth->firmware_buf[2]);

        netdev_dbg(kaweth->net,
                   "Downloading firmware at %p to kaweth device at %p\n",
                   kaweth->firmware_buf, kaweth);
        netdev_dbg(kaweth->net, "Firmware length: %d\n", data_len);

        return usb_control_msg(kaweth->dev, usb_sndctrlpipe(kaweth->dev, 0),
                              KAWETH_COMMAND_SCAN,
                              USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                              0, 0,
                              kaweth->firmware_buf, data_len,
                              KAWETH_CONTROL_TIMEOUT);
}

/****************************************************************
 *     kaweth_trigger_firmware
 ****************************************************************/
static int kaweth_trigger_firmware(struct kaweth_device *kaweth,
                                   __u8 interrupt)
{
        kaweth->firmware_buf[0] = 0xB6;
        kaweth->firmware_buf[1] = 0xC3;
        kaweth->firmware_buf[2] = 0x01;
        kaweth->firmware_buf[3] = 0x00;
        kaweth->firmware_buf[4] = 0x06;
        kaweth->firmware_buf[5] = interrupt;
        kaweth->firmware_buf[6] = 0x00;
        kaweth->firmware_buf[7] = 0x00;

        return usb_control_msg(kaweth->dev, usb_sndctrlpipe(kaweth->dev, 0),
                               KAWETH_COMMAND_SCAN,
                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                               0, 0,
                               (void *)kaweth->firmware_buf, 8,
                               KAWETH_CONTROL_TIMEOUT);
}

/****************************************************************
 *     kaweth_reset
 ****************************************************************/
static int kaweth_reset(struct kaweth_device *kaweth)
{
        int result;

        result = usb_reset_configuration(kaweth->dev);
        mdelay(10);

        netdev_dbg(kaweth->net, "kaweth_reset() returns %d.\n", result);

        return result;
}

static void kaweth_usb_receive(struct urb *);
static int kaweth_resubmit_rx_urb(struct kaweth_device *, gfp_t);

/****************************************************************
        int_callback
*****************************************************************/

static void kaweth_resubmit_int_urb(struct kaweth_device *kaweth, gfp_t mf)
{
        int status;

        status = usb_submit_urb (kaweth->irq_urb, mf);
        if (unlikely(status == -ENOMEM)) {
                kaweth->suspend_lowmem_ctrl = 1;
                schedule_delayed_work(&kaweth->lowmem_work, HZ/4);
        } else {
                kaweth->suspend_lowmem_ctrl = 0;
        }

        if (status)
                dev_err(&kaweth->intf->dev,
                        "can't resubmit intr, %s-%s, status %d\n",
                        kaweth->dev->bus->bus_name,
                        kaweth->dev->devpath, status);
}

static void int_callback(struct urb *u)
{
        struct kaweth_device *kaweth = u->context;
        int act_state;
        int status = u->status;

        switch (status) {
        case 0:                        /* success */
                break;
        case -ECONNRESET:        /* unlink */
        case -ENOENT:
        case -ESHUTDOWN:
                return;
        /* -EPIPE:  should clear the halt */
        default:                /* error */
                goto resubmit;
        }

        /* we check the link state to report changes */
        if (kaweth->linkstate != (act_state = ( kaweth->intbuffer[STATE_OFFSET] | STATE_MASK) >> STATE_SHIFT)) {
                if (act_state)
                        netif_carrier_on(kaweth->net);
                else
                        netif_carrier_off(kaweth->net);

                kaweth->linkstate = act_state;
        }
resubmit:
        kaweth_resubmit_int_urb(kaweth, GFP_ATOMIC);
}

static void kaweth_resubmit_tl(struct work_struct *work)
{
        struct kaweth_device *kaweth =
                container_of(work, struct kaweth_device, lowmem_work.work);

        if (IS_BLOCKED(kaweth->status))
                return;

        if (kaweth->suspend_lowmem_rx)
                kaweth_resubmit_rx_urb(kaweth, GFP_NOIO);

        if (kaweth->suspend_lowmem_ctrl)
                kaweth_resubmit_int_urb(kaweth, GFP_NOIO);
}


/****************************************************************
 *     kaweth_resubmit_rx_urb
 ****************************************************************/
static int kaweth_resubmit_rx_urb(struct kaweth_device *kaweth,
                                                gfp_t mem_flags)
{
        int result;

        usb_fill_bulk_urb(kaweth->rx_urb,
                      kaweth->dev,
                      usb_rcvbulkpipe(kaweth->dev, 1),
                      kaweth->rx_buf,
                      KAWETH_BUF_SIZE,
                      kaweth_usb_receive,
                      kaweth);
        kaweth->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
        kaweth->rx_urb->transfer_dma = kaweth->rxbufferhandle;

        if((result = usb_submit_urb(kaweth->rx_urb, mem_flags))) {
                if (result == -ENOMEM) {
                        kaweth->suspend_lowmem_rx = 1;
                        schedule_delayed_work(&kaweth->lowmem_work, HZ/4);
                }
                dev_err(&kaweth->intf->dev, "resubmitting rx_urb %d failed\n",
                        result);
        } else {
                kaweth->suspend_lowmem_rx = 0;
        }

        return result;
}

static void kaweth_async_set_rx_mode(struct kaweth_device *kaweth,
                                     bool may_sleep);

/****************************************************************
 *     kaweth_usb_receive
 ****************************************************************/
static void kaweth_usb_receive(struct urb *urb)
{
        struct device *dev = &urb->dev->dev;
        struct kaweth_device *kaweth = urb->context;
        struct net_device *net = kaweth->net;
        int status = urb->status;
        unsigned long flags;
        int count = urb->actual_length;
        int count2 = urb->transfer_buffer_length;

        __u16 pkt_len = le16_to_cpup((__le16 *)kaweth->rx_buf);

        struct sk_buff *skb;

        if (unlikely(status == -EPIPE)) {
                net->stats.rx_errors++;
                kaweth->end = 1;
                wake_up(&kaweth->term_wait);
                dev_dbg(dev, "Status was -EPIPE.\n");
                return;
        }
        if (unlikely(status == -ECONNRESET || status == -ESHUTDOWN)) {
                /* we are killed - set a flag and wake the disconnect handler */
                kaweth->end = 1;
                wake_up(&kaweth->term_wait);
                dev_dbg(dev, "Status was -ECONNRESET or -ESHUTDOWN.\n");
                return;
        }
        if (unlikely(status == -EPROTO || status == -ETIME ||
                     status == -EILSEQ)) {
                net->stats.rx_errors++;
                dev_dbg(dev, "Status was -EPROTO, -ETIME, or -EILSEQ.\n");
                return;
        }
        if (unlikely(status == -EOVERFLOW)) {
                net->stats.rx_errors++;
                dev_dbg(dev, "Status was -EOVERFLOW.\n");
        }
        spin_lock_irqsave(&kaweth->device_lock, flags);
        if (IS_BLOCKED(kaweth->status)) {
                spin_unlock_irqrestore(&kaweth->device_lock, flags);
                return;
        }
        spin_unlock_irqrestore(&kaweth->device_lock, flags);

        if(status && status != -EREMOTEIO && count != 1) {
                dev_err(&kaweth->intf->dev,
                        "%s RX status: %d count: %d packet_len: %d\n",
                        net->name, status, count, (int)pkt_len);
                kaweth_resubmit_rx_urb(kaweth, GFP_ATOMIC);
                return;
        }

        if(kaweth->net && (count > 2)) {
                if(pkt_len > (count - 2)) {
                        dev_err(&kaweth->intf->dev,
                                "Packet length too long for USB frame (pkt_len: %x, count: %x)\n",
                                pkt_len, count);
                        dev_err(&kaweth->intf->dev, "Packet len & 2047: %x\n",
                                pkt_len & 2047);
                        dev_err(&kaweth->intf->dev, "Count 2: %x\n", count2);
                        kaweth_resubmit_rx_urb(kaweth, GFP_ATOMIC);
                        return;
                }

                if(!(skb = dev_alloc_skb(pkt_len+2))) {
                        kaweth_resubmit_rx_urb(kaweth, GFP_ATOMIC);
                        return;
                }

                skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */

                skb_copy_to_linear_data(skb, kaweth->rx_buf + 2, pkt_len);

                skb_put(skb, pkt_len);

                skb->protocol = eth_type_trans(skb, net);

                netif_rx(skb);

                net->stats.rx_packets++;
                net->stats.rx_bytes += pkt_len;
        }

        kaweth_resubmit_rx_urb(kaweth, GFP_ATOMIC);
}

/****************************************************************
 *     kaweth_open
 ****************************************************************/
static int kaweth_open(struct net_device *net)
{
        struct kaweth_device *kaweth = netdev_priv(net);
        int res;

        res = usb_autopm_get_interface(kaweth->intf);
        if (res) {
                dev_err(&kaweth->intf->dev, "Interface cannot be resumed.\n");
                return -EIO;
        }
        res = kaweth_resubmit_rx_urb(kaweth, GFP_KERNEL);
        if (res)
                goto err_out;

        usb_fill_int_urb(
                kaweth->irq_urb,
                kaweth->dev,
                usb_rcvintpipe(kaweth->dev, 3),
                kaweth->intbuffer,
                INTBUFFERSIZE,
                int_callback,
                kaweth,
                250); /* overriding the descriptor */
        kaweth->irq_urb->transfer_dma = kaweth->intbufferhandle;
        kaweth->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;

        res = usb_submit_urb(kaweth->irq_urb, GFP_KERNEL);
        if (res) {
                usb_kill_urb(kaweth->rx_urb);
                goto err_out;
        }
        kaweth->opened = 1;

        netif_start_queue(net);

        kaweth_async_set_rx_mode(kaweth, true);
        return 0;

err_out:
        usb_autopm_put_interface(kaweth->intf);
        return -EIO;
}

/****************************************************************
 *     kaweth_kill_urbs
 ****************************************************************/
static void kaweth_kill_urbs(struct kaweth_device *kaweth)
{
        usb_kill_urb(kaweth->irq_urb);
        usb_kill_urb(kaweth->rx_urb);
        usb_kill_urb(kaweth->tx_urb);

        cancel_delayed_work_sync(&kaweth->lowmem_work);

        /* a scheduled work may have resubmitted,
           we hit them again */
        usb_kill_urb(kaweth->irq_urb);
        usb_kill_urb(kaweth->rx_urb);
}

/****************************************************************
 *     kaweth_close
 ****************************************************************/
static int kaweth_close(struct net_device *net)
{
        struct kaweth_device *kaweth = netdev_priv(net);

        netif_stop_queue(net);
        kaweth->opened = 0;

        kaweth->status |= KAWETH_STATUS_CLOSING;

        kaweth_kill_urbs(kaweth);

        kaweth->status &= ~KAWETH_STATUS_CLOSING;

        usb_autopm_put_interface(kaweth->intf);

        return 0;
}

static u32 kaweth_get_link(struct net_device *dev)
{
        struct kaweth_device *kaweth = netdev_priv(dev);

        return kaweth->linkstate;
}

static const struct ethtool_ops ops = {
        .get_link        = kaweth_get_link
};

/****************************************************************
 *     kaweth_usb_transmit_complete
 ****************************************************************/
static void kaweth_usb_transmit_complete(struct urb *urb)
{
        struct kaweth_device *kaweth = urb->context;
        struct sk_buff *skb = kaweth->tx_skb;
        int status = urb->status;

        if (unlikely(status != 0))
                if (status != -ENOENT)
                        dev_dbg(&urb->dev->dev, "%s: TX status %d.\n",
                                kaweth->net->name, status);

        netif_wake_queue(kaweth->net);
        dev_kfree_skb_irq(skb);
}

/****************************************************************
 *     kaweth_start_xmit
 ****************************************************************/
static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb,
                                           struct net_device *net)
{
        struct kaweth_device *kaweth = netdev_priv(net);
        __le16 *private_header;

        int res;

        spin_lock_irq(&kaweth->device_lock);

        kaweth_async_set_rx_mode(kaweth, false);
        netif_stop_queue(net);
        if (IS_BLOCKED(kaweth->status)) {
                goto skip;
        }

        /* We now decide whether we can put our special header into the sk_buff */
        if (skb_cow_head(skb, 2)) {
                net->stats.tx_errors++;
                netif_start_queue(net);
                spin_unlock_irq(&kaweth->device_lock);
                dev_kfree_skb_any(skb);
                return NETDEV_TX_OK;
        }

        private_header = __skb_push(skb, 2);
        *private_header = cpu_to_le16(skb->len-2);
        kaweth->tx_skb = skb;

        usb_fill_bulk_urb(kaweth->tx_urb,
                      kaweth->dev,
                      usb_sndbulkpipe(kaweth->dev, 2),
                      private_header,
                      skb->len,
                      kaweth_usb_transmit_complete,
                      kaweth);
        kaweth->end = 0;

        if((res = usb_submit_urb(kaweth->tx_urb, GFP_ATOMIC)))
        {
                dev_warn(&net->dev, "kaweth failed tx_urb %d\n", res);
skip:
                net->stats.tx_errors++;

                netif_start_queue(net);
                dev_kfree_skb_irq(skb);
        }
        else
        {
                net->stats.tx_packets++;
                net->stats.tx_bytes += skb->len;
        }

        spin_unlock_irq(&kaweth->device_lock);

        return NETDEV_TX_OK;
}

/****************************************************************
 *     kaweth_set_rx_mode
 ****************************************************************/
static void kaweth_set_rx_mode(struct net_device *net)
{
        struct kaweth_device *kaweth = netdev_priv(net);

        __u16 packet_filter_bitmap = KAWETH_PACKET_FILTER_DIRECTED |
                                     KAWETH_PACKET_FILTER_BROADCAST |
                                     KAWETH_PACKET_FILTER_MULTICAST;

        netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap);

        netif_stop_queue(net);

        if (net->flags & IFF_PROMISC) {
                packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS;
        }
        else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) {
                packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST;
        }

        kaweth->packet_filter_bitmap = packet_filter_bitmap;
        netif_wake_queue(net);
}

/****************************************************************
 *     kaweth_async_set_rx_mode
 ****************************************************************/
static void kaweth_async_set_rx_mode(struct kaweth_device *kaweth,
                                     bool may_sleep)
{
        int ret;
        __u16 packet_filter_bitmap = kaweth->packet_filter_bitmap;

        kaweth->packet_filter_bitmap = 0;
        if (packet_filter_bitmap == 0)
                return;

        if (!may_sleep)
                return;

        ret = usb_control_msg(kaweth->dev, usb_sndctrlpipe(kaweth->dev, 0),
                              KAWETH_COMMAND_SET_PACKET_FILTER,
                              USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                              packet_filter_bitmap, 0,
                              &kaweth->scratch, 0,
                              KAWETH_CONTROL_TIMEOUT);
        if (ret < 0)
                dev_err(&kaweth->intf->dev, "Failed to set Rx mode: %d\n",
                        ret);
        else
                netdev_dbg(kaweth->net, "Set Rx mode to %d\n",
                           packet_filter_bitmap);
}

/****************************************************************
 *     kaweth_tx_timeout
 ****************************************************************/
static void kaweth_tx_timeout(struct net_device *net, unsigned int txqueue)
{
        struct kaweth_device *kaweth = netdev_priv(net);

        dev_warn(&net->dev, "%s: Tx timed out. Resetting.\n", net->name);
        net->stats.tx_errors++;
        netif_trans_update(net);

        usb_unlink_urb(kaweth->tx_urb);
}

/****************************************************************
 *     kaweth_suspend
 ****************************************************************/
static int kaweth_suspend(struct usb_interface *intf, pm_message_t message)
{
        struct kaweth_device *kaweth = usb_get_intfdata(intf);
        unsigned long flags;

        spin_lock_irqsave(&kaweth->device_lock, flags);
        kaweth->status |= KAWETH_STATUS_SUSPENDING;
        spin_unlock_irqrestore(&kaweth->device_lock, flags);

        kaweth_kill_urbs(kaweth);
        return 0;
}

/****************************************************************
 *     kaweth_resume
 ****************************************************************/
static int kaweth_resume(struct usb_interface *intf)
{
        struct kaweth_device *kaweth = usb_get_intfdata(intf);
        unsigned long flags;

        spin_lock_irqsave(&kaweth->device_lock, flags);
        kaweth->status &= ~KAWETH_STATUS_SUSPENDING;
        spin_unlock_irqrestore(&kaweth->device_lock, flags);

        if (!kaweth->opened)
                return 0;
        kaweth_resubmit_rx_urb(kaweth, GFP_NOIO);
        kaweth_resubmit_int_urb(kaweth, GFP_NOIO);

        return 0;
}

/****************************************************************
 *     kaweth_probe
 ****************************************************************/


static const struct net_device_ops kaweth_netdev_ops = {
        .ndo_open =                        kaweth_open,
        .ndo_stop =                        kaweth_close,
        .ndo_start_xmit =                kaweth_start_xmit,
        .ndo_tx_timeout =                kaweth_tx_timeout,
        .ndo_set_rx_mode =                kaweth_set_rx_mode,
        .ndo_set_mac_address =                eth_mac_addr,
        .ndo_validate_addr =                eth_validate_addr,
};

static int kaweth_probe(
                struct usb_interface *intf,
                const struct usb_device_id *id      /* from id_table */
        )
{
        struct device *dev = &intf->dev;
        struct usb_device *udev = interface_to_usbdev(intf);
        struct kaweth_device *kaweth;
        struct net_device *netdev;
        const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
        int result = 0;
        int rv = -EIO;

        dev_dbg(dev,
                "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
                udev->devnum, le16_to_cpu(udev->descriptor.idVendor),
                le16_to_cpu(udev->descriptor.idProduct),
                le16_to_cpu(udev->descriptor.bcdDevice));

        dev_dbg(dev, "Device at %p\n", udev);

        dev_dbg(dev, "Descriptor length: %x type: %x\n",
                (int)udev->descriptor.bLength,
                (int)udev->descriptor.bDescriptorType);

        netdev = alloc_etherdev(sizeof(*kaweth));
        if (!netdev)
                return -ENOMEM;

        kaweth = netdev_priv(netdev);
        kaweth->dev = udev;
        kaweth->net = netdev;
        kaweth->intf = intf;

        spin_lock_init(&kaweth->device_lock);
        init_waitqueue_head(&kaweth->term_wait);

        dev_dbg(dev, "Resetting.\n");

        kaweth_reset(kaweth);

        /*
         * If high byte of bcdDevice is nonzero, firmware is already
         * downloaded. Don't try to do it again, or we'll hang the device.
         */

        if (le16_to_cpu(udev->descriptor.bcdDevice) >> 8) {
                dev_info(dev, "Firmware present in device.\n");
        } else {
                /* Download the firmware */
                dev_info(dev, "Downloading firmware...\n");
                kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
                if (!kaweth->firmware_buf) {
                        rv = -ENOMEM;
                        goto err_free_netdev;
                }
                if ((result = kaweth_download_firmware(kaweth,
                                                      "kaweth/new_code.bin",
                                                      100,
                                                      2)) < 0) {
                        dev_err(dev, "Error downloading firmware (%d)\n",
                                result);
                        goto err_fw;
                }

                if ((result = kaweth_download_firmware(kaweth,
                                                      "kaweth/new_code_fix.bin",
                                                      100,
                                                      3)) < 0) {
                        dev_err(dev, "Error downloading firmware fix (%d)\n",
                                result);
                        goto err_fw;
                }

                if ((result = kaweth_download_firmware(kaweth,
                                                      "kaweth/trigger_code.bin",
                                                      126,
                                                      2)) < 0) {
                        dev_err(dev, "Error downloading trigger code (%d)\n",
                                result);
                        goto err_fw;

                }

                if ((result = kaweth_download_firmware(kaweth,
                                                      "kaweth/trigger_code_fix.bin",
                                                      126,
                                                      3)) < 0) {
                        dev_err(dev, "Error downloading trigger code fix (%d)\n", result);
                        goto err_fw;
                }


                if ((result = kaweth_trigger_firmware(kaweth, 126)) < 0) {
                        dev_err(dev, "Error triggering firmware (%d)\n", result);
                        goto err_fw;
                }

                /* Device will now disappear for a moment...  */
                dev_info(dev, "Firmware loaded.  I'll be back...\n");
err_fw:
                free_page((unsigned long)kaweth->firmware_buf);
                free_netdev(netdev);
                return -EIO;
        }

        result = kaweth_read_configuration(kaweth);

        if(result < 0) {
                dev_err(dev, "Error reading configuration (%d), no net device created\n", result);
                goto err_free_netdev;
        }

        dev_info(dev, "Statistics collection: %x\n", kaweth->configuration.statistics_mask);
        dev_info(dev, "Multicast filter limit: %x\n", kaweth->configuration.max_multicast_filters & ((1 << 15) - 1));
        dev_info(dev, "MTU: %d\n", le16_to_cpu(kaweth->configuration.segment_size));
        dev_info(dev, "Read MAC address %pM\n", kaweth->configuration.hw_addr);

        if(!memcmp(&kaweth->configuration.hw_addr,
                   &bcast_addr,
                   sizeof(bcast_addr))) {
                dev_err(dev, "Firmware not functioning properly, no net device created\n");
                goto err_free_netdev;
        }

        if(kaweth_set_urb_size(kaweth, KAWETH_BUF_SIZE) < 0) {
                dev_dbg(dev, "Error setting URB size\n");
                goto err_free_netdev;
        }

        if(kaweth_set_sofs_wait(kaweth, KAWETH_SOFS_TO_WAIT) < 0) {
                dev_err(dev, "Error setting SOFS wait\n");
                goto err_free_netdev;
        }

        result = kaweth_set_receive_filter(kaweth,
                                           KAWETH_PACKET_FILTER_DIRECTED |
                                           KAWETH_PACKET_FILTER_BROADCAST |
                                           KAWETH_PACKET_FILTER_MULTICAST);

        if(result < 0) {
                dev_err(dev, "Error setting receive filter\n");
                goto err_free_netdev;
        }

        dev_dbg(dev, "Initializing net device.\n");

        kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!kaweth->tx_urb)
                goto err_free_netdev;
        kaweth->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!kaweth->rx_urb)
                goto err_only_tx;
        kaweth->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!kaweth->irq_urb)
                goto err_tx_and_rx;

        kaweth->intbuffer = usb_alloc_coherent(        kaweth->dev,
                                                INTBUFFERSIZE,
                                                GFP_KERNEL,
                                                &kaweth->intbufferhandle);
        if (!kaweth->intbuffer)
                goto err_tx_and_rx_and_irq;
        kaweth->rx_buf = usb_alloc_coherent(        kaweth->dev,
                                                KAWETH_BUF_SIZE,
                                                GFP_KERNEL,
                                                &kaweth->rxbufferhandle);
        if (!kaweth->rx_buf)
                goto err_all_but_rxbuf;

        memcpy(netdev->broadcast, &bcast_addr, sizeof(bcast_addr));
        eth_hw_addr_set(netdev, (u8 *)&kaweth->configuration.hw_addr);

        netdev->netdev_ops = &kaweth_netdev_ops;
        netdev->watchdog_timeo = KAWETH_TX_TIMEOUT;
        netdev->mtu = le16_to_cpu(kaweth->configuration.segment_size);
        netdev->ethtool_ops = &ops;

        /* kaweth is zeroed as part of alloc_netdev */
        INIT_DELAYED_WORK(&kaweth->lowmem_work, kaweth_resubmit_tl);
        usb_set_intfdata(intf, kaweth);

        SET_NETDEV_DEV(netdev, dev);
        if (register_netdev(netdev) != 0) {
                dev_err(dev, "Error registering netdev.\n");
                goto err_intfdata;
        }

        dev_info(dev, "kaweth interface created at %s\n",
                 kaweth->net->name);

        return 0;

err_intfdata:
        usb_set_intfdata(intf, NULL);
        usb_free_coherent(kaweth->dev, KAWETH_BUF_SIZE, (void *)kaweth->rx_buf, kaweth->rxbufferhandle);
err_all_but_rxbuf:
        usb_free_coherent(kaweth->dev, INTBUFFERSIZE, (void *)kaweth->intbuffer, kaweth->intbufferhandle);
err_tx_and_rx_and_irq:
        usb_free_urb(kaweth->irq_urb);
err_tx_and_rx:
        usb_free_urb(kaweth->rx_urb);
err_only_tx:
        usb_free_urb(kaweth->tx_urb);
err_free_netdev:
        free_netdev(netdev);

        return rv;
}

/****************************************************************
 *     kaweth_disconnect
 ****************************************************************/
static void kaweth_disconnect(struct usb_interface *intf)
{
        struct kaweth_device *kaweth = usb_get_intfdata(intf);
        struct net_device *netdev;

        usb_set_intfdata(intf, NULL);
        if (!kaweth) {
                dev_warn(&intf->dev, "unregistering non-existent device\n");
                return;
        }
        netdev = kaweth->net;

        netdev_dbg(kaweth->net, "Unregistering net device\n");
        unregister_netdev(netdev);

        usb_free_urb(kaweth->rx_urb);
        usb_free_urb(kaweth->tx_urb);
        usb_free_urb(kaweth->irq_urb);

        usb_free_coherent(kaweth->dev, KAWETH_BUF_SIZE, (void *)kaweth->rx_buf, kaweth->rxbufferhandle);
        usb_free_coherent(kaweth->dev, INTBUFFERSIZE, (void *)kaweth->intbuffer, kaweth->intbufferhandle);

        free_netdev(netdev);
}


module_usb_driver(kaweth_driver);
















































































































   36 

    1 




    6 
   30 
   30 
    6 




    6 









    6 

















































    3 













    3 





    3 






    3 











   16 





    2 






    1 



    5 


    8 



    2 


    3 


    3 



    2 

    6 



    7 


    1 






    1 




   12 
























    1 

















    1 













    1 







1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
/*
 * net/tipc/net.c: TIPC network routing code
 *
 * Copyright (c) 1995-2006, 2014, Ericsson AB
 * Copyright (c) 2005, 2010-2011, Wind River Systems
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the names of the copyright holders nor the names of its
 *    contributors may be used to endorse or promote products derived from
 *    this software without specific prior written permission.
 *
 * Alternatively, this software may be distributed under the terms of the
 * GNU General Public License ("GPL") version 2 as published by the Free
 * Software Foundation.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include "core.h"
#include "net.h"
#include "name_distr.h"
#include "subscr.h"
#include "socket.h"
#include "node.h"
#include "bcast.h"
#include "link.h"
#include "netlink.h"
#include "monitor.h"

/*
 * The TIPC locking policy is designed to ensure a very fine locking
 * granularity, permitting complete parallel access to individual
 * port and node/link instances. The code consists of four major
 * locking domains, each protected with their own disjunct set of locks.
 *
 * 1: The bearer level.
 *    RTNL lock is used to serialize the process of configuring bearer
 *    on update side, and RCU lock is applied on read side to make
 *    bearer instance valid on both paths of message transmission and
 *    reception.
 *
 * 2: The node and link level.
 *    All node instances are saved into two tipc_node_list and node_htable
 *    lists. The two lists are protected by node_list_lock on write side,
 *    and they are guarded with RCU lock on read side. Especially node
 *    instance is destroyed only when TIPC module is removed, and we can
 *    confirm that there has no any user who is accessing the node at the
 *    moment. Therefore, Except for iterating the two lists within RCU
 *    protection, it's no needed to hold RCU that we access node instance
 *    in other places.
 *
 *    In addition, all members in node structure including link instances
 *    are protected by node spin lock.
 *
 * 3: The transport level of the protocol.
 *    This consists of the structures port, (and its user level
 *    representations, such as user_port and tipc_sock), reference and
 *    tipc_user (port.c, reg.c, socket.c).
 *
 *    This layer has four different locks:
 *     - The tipc_port spin_lock. This is protecting each port instance
 *       from parallel data access and removal. Since we can not place
 *       this lock in the port itself, it has been placed in the
 *       corresponding reference table entry, which has the same life
 *       cycle as the module. This entry is difficult to access from
 *       outside the TIPC core, however, so a pointer to the lock has
 *       been added in the port instance, -to be used for unlocking
 *       only.
 *     - A read/write lock to protect the reference table itself (teg.c).
 *       (Nobody is using read-only access to this, so it can just as
 *       well be changed to a spin_lock)
 *     - A spin lock to protect the registry of kernel/driver users (reg.c)
 *     - A global spin_lock (tipc_port_lock), which only task is to ensure
 *       consistency where more than one port is involved in an operation,
 *       i.e., when a port is part of a linked list of ports.
 *       There are two such lists; 'port_list', which is used for management,
 *       and 'wait_list', which is used to queue ports during congestion.
 *
 *  4: The name table (name_table.c, name_distr.c, subscription.c)
 *     - There is one big read/write-lock (tipc_nametbl_lock) protecting the
 *       overall name table structure. Nothing must be added/removed to
 *       this structure without holding write access to it.
 *     - There is one local spin_lock per sub_sequence, which can be seen
 *       as a sub-domain to the tipc_nametbl_lock domain. It is used only
 *       for translation operations, and is needed because a translation
 *       steps the root of the 'publication' linked list between each lookup.
 *       This is always used within the scope of a tipc_nametbl_lock(read).
 *     - A local spin_lock protecting the queue of subscriber events.
*/

static void tipc_net_finalize(struct net *net, u32 addr);

int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
{
        if (tipc_own_id(net)) {
                pr_info("Cannot configure node identity twice\n");
                return -1;
        }
        pr_info("Started in network mode\n");

        if (node_id)
                tipc_set_node_id(net, node_id);
        if (addr)
                tipc_net_finalize(net, addr);
        return 0;
}

static void tipc_net_finalize(struct net *net, u32 addr)
{
        struct tipc_net *tn = tipc_net(net);
        struct tipc_socket_addr sk = {0, addr};
        struct tipc_uaddr ua;

        tipc_uaddr(&ua, TIPC_SERVICE_RANGE, TIPC_CLUSTER_SCOPE,
                   TIPC_NODE_STATE, addr, addr);

        if (cmpxchg(&tn->node_addr, 0, addr))
                return;
        tipc_set_node_addr(net, addr);
        tipc_named_reinit(net);
        tipc_sk_reinit(net);
        tipc_mon_reinit_self(net);
        tipc_nametbl_publish(net, &ua, &sk, addr);
}

void tipc_net_finalize_work(struct work_struct *work)
{
        struct tipc_net *tn = container_of(work, struct tipc_net, work);

        tipc_net_finalize(tipc_link_net(tn->bcl), tn->trial_addr);
}

void tipc_net_stop(struct net *net)
{
        if (!tipc_own_id(net))
                return;

        rtnl_lock();
        tipc_bearer_stop(net);
        tipc_node_stop(net);
        rtnl_unlock();

        pr_info("Left network mode\n");
}

static int __tipc_nl_add_net(struct net *net, struct tipc_nl_msg *msg)
{
        struct tipc_net *tn = net_generic(net, tipc_net_id);
        u64 *w0 = (u64 *)&tn->node_id[0];
        u64 *w1 = (u64 *)&tn->node_id[8];
        struct nlattr *attrs;
        void *hdr;

        hdr = genlmsg_put(msg->skb, msg->portid, msg->seq, &tipc_genl_family,
                          NLM_F_MULTI, TIPC_NL_NET_GET);
        if (!hdr)
                return -EMSGSIZE;

        attrs = nla_nest_start_noflag(msg->skb, TIPC_NLA_NET);
        if (!attrs)
                goto msg_full;

        if (nla_put_u32(msg->skb, TIPC_NLA_NET_ID, tn->net_id))
                goto attr_msg_full;
        if (nla_put_u64_64bit(msg->skb, TIPC_NLA_NET_NODEID, *w0, 0))
                goto attr_msg_full;
        if (nla_put_u64_64bit(msg->skb, TIPC_NLA_NET_NODEID_W1, *w1, 0))
                goto attr_msg_full;
        nla_nest_end(msg->skb, attrs);
        genlmsg_end(msg->skb, hdr);

        return 0;

attr_msg_full:
        nla_nest_cancel(msg->skb, attrs);
msg_full:
        genlmsg_cancel(msg->skb, hdr);

        return -EMSGSIZE;
}

int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb)
{
        struct net *net = sock_net(skb->sk);
        int err;
        int done = cb->args[0];
        struct tipc_nl_msg msg;

        if (done)
                return 0;

        msg.skb = skb;
        msg.portid = NETLINK_CB(cb->skb).portid;
        msg.seq = cb->nlh->nlmsg_seq;

        err = __tipc_nl_add_net(net, &msg);
        if (err)
                goto out;

        done = 1;
out:
        cb->args[0] = done;

        return skb->len;
}

int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
{
        struct nlattr *attrs[TIPC_NLA_NET_MAX + 1];
        struct net *net = sock_net(skb->sk);
        struct tipc_net *tn = tipc_net(net);
        int err;

        if (!info->attrs[TIPC_NLA_NET])
                return -EINVAL;

        err = nla_parse_nested_deprecated(attrs, TIPC_NLA_NET_MAX,
                                          info->attrs[TIPC_NLA_NET],
                                          tipc_nl_net_policy, info->extack);

        if (err)
                return err;

        /* Can't change net id once TIPC has joined a network */
        if (tipc_own_addr(net))
                return -EPERM;

        if (attrs[TIPC_NLA_NET_ID]) {
                u32 val;

                val = nla_get_u32(attrs[TIPC_NLA_NET_ID]);
                if (val < 1 || val > 9999)
                        return -EINVAL;

                tn->net_id = val;
        }

        if (attrs[TIPC_NLA_NET_ADDR]) {
                u32 addr;

                addr = nla_get_u32(attrs[TIPC_NLA_NET_ADDR]);
                if (!addr)
                        return -EINVAL;
                tn->legacy_addr_format = true;
                tipc_net_init(net, NULL, addr);
        }

        if (attrs[TIPC_NLA_NET_NODEID]) {
                u8 node_id[NODE_ID_LEN];
                u64 *w0 = (u64 *)&node_id[0];
                u64 *w1 = (u64 *)&node_id[8];

                if (!attrs[TIPC_NLA_NET_NODEID_W1])
                        return -EINVAL;
                *w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
                *w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
                tipc_net_init(net, node_id, 0);
        }
        return 0;
}

int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
{
        int err;

        rtnl_lock();
        err = __tipc_nl_net_set(skb, info);
        rtnl_unlock();

        return err;
}

static int __tipc_nl_addr_legacy_get(struct net *net, struct tipc_nl_msg *msg)
{
        struct tipc_net *tn = tipc_net(net);
        struct nlattr *attrs;
        void *hdr;

        hdr = genlmsg_put(msg->skb, msg->portid, msg->seq, &tipc_genl_family,
                          0, TIPC_NL_ADDR_LEGACY_GET);
        if (!hdr)
                return -EMSGSIZE;

        attrs = nla_nest_start(msg->skb, TIPC_NLA_NET);
        if (!attrs)
                goto msg_full;

        if (tn->legacy_addr_format)
                if (nla_put_flag(msg->skb, TIPC_NLA_NET_ADDR_LEGACY))
                        goto attr_msg_full;

        nla_nest_end(msg->skb, attrs);
        genlmsg_end(msg->skb, hdr);

        return 0;

attr_msg_full:
        nla_nest_cancel(msg->skb, attrs);
msg_full:
        genlmsg_cancel(msg->skb, hdr);

        return -EMSGSIZE;
}

int tipc_nl_net_addr_legacy_get(struct sk_buff *skb, struct genl_info *info)
{
        struct net *net = sock_net(skb->sk);
        struct tipc_nl_msg msg;
        struct sk_buff *rep;
        int err;

        rep = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
        if (!rep)
                return -ENOMEM;

        msg.skb = rep;
        msg.portid = info->snd_portid;
        msg.seq = info->snd_seq;

        err = __tipc_nl_addr_legacy_get(net, &msg);
        if (err) {
                nlmsg_free(msg.skb);
                return err;
        }

        return genlmsg_reply(msg.skb, info);
}
















































































































































































































































































































































































































































































































































































































































































































































































    1 

    1 









    3 












    1 






    1 





    1 


    1 

































    1 





    1 



















    1 

    1 
















































    1 

































    3 








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
// SPDX-License-Identifier: GPL-2.0+
/******************************************************************************
 *  speedtch.c  -  Alcatel SpeedTouch USB xDSL modem driver
 *
 *  Copyright (C) 2001, Alcatel
 *  Copyright (C) 2003, Duncan Sands
 *  Copyright (C) 2004, David Woodhouse
 *
 *  Based on "modem_run.c", copyright (C) 2001, Benoit Papillault
 ******************************************************************************/

#include <asm/page.h>
#include <linux/device.h>
#include <linux/errno.h>
#include <linux/firmware.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/slab.h>
#include <linux/stat.h>
#include <linux/timer.h>
#include <linux/types.h>
#include <linux/usb/ch9.h>
#include <linux/workqueue.h>

#include "usbatm.h"

#define DRIVER_AUTHOR        "Johan Verrept, Duncan Sands <duncan.sands@free.fr>"
#define DRIVER_DESC        "Alcatel SpeedTouch USB driver"

static const char speedtch_driver_name[] = "speedtch";

#define CTRL_TIMEOUT 2000        /* milliseconds */
#define DATA_TIMEOUT 2000        /* milliseconds */

#define OFFSET_7        0                /* size 1 */
#define OFFSET_b        1                /* size 8 */
#define OFFSET_d        9                /* size 4 */
#define OFFSET_e        13                /* size 1 */
#define OFFSET_f        14                /* size 1 */

#define SIZE_7                1
#define SIZE_b                8
#define SIZE_d                4
#define SIZE_e                1
#define SIZE_f                1

#define MIN_POLL_DELAY                5000        /* milliseconds */
#define MAX_POLL_DELAY                60000        /* milliseconds */

#define RESUBMIT_DELAY                1000        /* milliseconds */

#define DEFAULT_BULK_ALTSETTING        1
#define DEFAULT_ISOC_ALTSETTING        3
#define DEFAULT_DL_512_FIRST        0
#define DEFAULT_ENABLE_ISOC        0
#define DEFAULT_SW_BUFFERING        0

static unsigned int altsetting = 0; /* zero means: use the default */
static bool dl_512_first = DEFAULT_DL_512_FIRST;
static bool enable_isoc = DEFAULT_ENABLE_ISOC;
static bool sw_buffering = DEFAULT_SW_BUFFERING;

#define DEFAULT_B_MAX_DSL        8128
#define DEFAULT_MODEM_MODE        11
#define MODEM_OPTION_LENGTH        16
static const unsigned char DEFAULT_MODEM_OPTION[MODEM_OPTION_LENGTH] = {
        0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};

static unsigned int BMaxDSL = DEFAULT_B_MAX_DSL;
static unsigned char ModemMode = DEFAULT_MODEM_MODE;
static unsigned char ModemOption[MODEM_OPTION_LENGTH];
static unsigned int num_ModemOption;

module_param(altsetting, uint, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(altsetting,
                "Alternative setting for data interface (bulk_default: "
                __MODULE_STRING(DEFAULT_BULK_ALTSETTING) "; isoc_default: "
                __MODULE_STRING(DEFAULT_ISOC_ALTSETTING) ")");

module_param(dl_512_first, bool, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(dl_512_first,
                 "Read 512 bytes before sending firmware (default: "
                 __MODULE_STRING(DEFAULT_DL_512_FIRST) ")");

module_param(enable_isoc, bool, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(enable_isoc,
                "Use isochronous transfers if available (default: "
                __MODULE_STRING(DEFAULT_ENABLE_ISOC) ")");

module_param(sw_buffering, bool, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(sw_buffering,
                 "Enable software buffering (default: "
                 __MODULE_STRING(DEFAULT_SW_BUFFERING) ")");

module_param(BMaxDSL, uint, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(BMaxDSL,
                "default: " __MODULE_STRING(DEFAULT_B_MAX_DSL));

module_param(ModemMode, byte, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(ModemMode,
                "default: " __MODULE_STRING(DEFAULT_MODEM_MODE));

module_param_array(ModemOption, byte, &num_ModemOption, S_IRUGO);
MODULE_PARM_DESC(ModemOption, "default: 0x10,0x00,0x00,0x00,0x20");

#define INTERFACE_DATA                1
#define ENDPOINT_INT                0x81
#define ENDPOINT_BULK_DATA        0x07
#define ENDPOINT_ISOC_DATA        0x07
#define ENDPOINT_FIRMWARE        0x05

struct speedtch_params {
        unsigned int altsetting;
        unsigned int BMaxDSL;
        unsigned char ModemMode;
        unsigned char ModemOption[MODEM_OPTION_LENGTH];
};

struct speedtch_instance_data {
        struct usbatm_data *usbatm;

        struct speedtch_params params; /* set in probe, constant afterwards */

        struct timer_list status_check_timer;
        struct work_struct status_check_work;

        unsigned char last_status;

        int poll_delay; /* milliseconds */

        struct timer_list resubmit_timer;
        struct urb *int_urb;
        unsigned char int_data[16];

        unsigned char scratch_buffer[16];
};

/***************
**  firmware  **
***************/

static void speedtch_set_swbuff(struct speedtch_instance_data *instance, int state)
{
        struct usbatm_data *usbatm = instance->usbatm;
        struct usb_device *usb_dev = usbatm->usb_dev;
        int ret;

        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x32, 0x40, state ? 0x01 : 0x00, 0x00, NULL, 0, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm,
                         "%sabling SW buffering: usb_control_msg returned %d\n",
                         state ? "En" : "Dis", ret);
        else
                usb_dbg(usbatm, "speedtch_set_swbuff: %sbled SW buffering\n", state ? "En" : "Dis");
}

static void speedtch_test_sequence(struct speedtch_instance_data *instance)
{
        struct usbatm_data *usbatm = instance->usbatm;
        struct usb_device *usb_dev = usbatm->usb_dev;
        unsigned char *buf = instance->scratch_buffer;
        int ret;

        /* URB 147 */
        buf[0] = 0x1c;
        buf[1] = 0x50;
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x0b, 0x00, buf, 2, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URB147: %d\n", __func__, ret);

        /* URB 148 */
        buf[0] = 0x32;
        buf[1] = 0x00;
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x02, 0x00, buf, 2, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URB148: %d\n", __func__, ret);

        /* URB 149 */
        buf[0] = 0x01;
        buf[1] = 0x00;
        buf[2] = 0x01;
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x03, 0x00, buf, 3, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URB149: %d\n", __func__, ret);

        /* URB 150 */
        buf[0] = 0x01;
        buf[1] = 0x00;
        buf[2] = 0x01;
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x04, 0x00, buf, 3, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URB150: %d\n", __func__, ret);

        /* Extra initialisation in recent drivers - gives higher speeds */

        /* URBext1 */
        buf[0] = instance->params.ModemMode;
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x11, 0x00, buf, 1, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URBext1: %d\n", __func__, ret);

        /* URBext2 */
        /* This seems to be the one which actually triggers the higher sync
           rate -- it does require the new firmware too, although it works OK
           with older firmware */
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x14, 0x00,
                              instance->params.ModemOption,
                              MODEM_OPTION_LENGTH, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URBext2: %d\n", __func__, ret);

        /* URBext3 */
        buf[0] = instance->params.BMaxDSL & 0xff;
        buf[1] = instance->params.BMaxDSL >> 8;
        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                              0x01, 0x40, 0x12, 0x00, buf, 2, CTRL_TIMEOUT);
        if (ret < 0)
                usb_warn(usbatm, "%s failed on URBext3: %d\n", __func__, ret);
}

static int speedtch_upload_firmware(struct speedtch_instance_data *instance,
                                     const struct firmware *fw1,
                                     const struct firmware *fw2)
{
        unsigned char *buffer;
        struct usbatm_data *usbatm = instance->usbatm;
        struct usb_device *usb_dev = usbatm->usb_dev;
        int actual_length;
        int ret = 0;
        int offset;

        usb_dbg(usbatm, "%s entered\n", __func__);

        buffer = (unsigned char *)__get_free_page(GFP_KERNEL);
        if (!buffer) {
                ret = -ENOMEM;
                usb_dbg(usbatm, "%s: no memory for buffer!\n", __func__);
                goto out;
        }

        if (!usb_ifnum_to_if(usb_dev, 2)) {
                ret = -ENODEV;
                usb_dbg(usbatm, "%s: interface not found!\n", __func__);
                goto out_free;
        }

        /* URB 7 */
        if (dl_512_first) {        /* some modems need a read before writing the firmware */
                ret = usb_bulk_msg(usb_dev, usb_rcvbulkpipe(usb_dev, ENDPOINT_FIRMWARE),
                                   buffer, 0x200, &actual_length, 2000);

                if (ret < 0 && ret != -ETIMEDOUT)
                        usb_warn(usbatm, "%s: read BLOCK0 from modem failed (%d)!\n", __func__, ret);
                else
                        usb_dbg(usbatm, "%s: BLOCK0 downloaded (%d bytes)\n", __func__, ret);
        }

        /* URB 8 : both leds are static green */
        for (offset = 0; offset < fw1->size; offset += PAGE_SIZE) {
                int thislen = min_t(int, PAGE_SIZE, fw1->size - offset);
                memcpy(buffer, fw1->data + offset, thislen);

                ret = usb_bulk_msg(usb_dev, usb_sndbulkpipe(usb_dev, ENDPOINT_FIRMWARE),
                                   buffer, thislen, &actual_length, DATA_TIMEOUT);

                if (ret < 0) {
                        usb_err(usbatm, "%s: write BLOCK1 to modem failed (%d)!\n", __func__, ret);
                        goto out_free;
                }
                usb_dbg(usbatm, "%s: BLOCK1 uploaded (%zu bytes)\n", __func__, fw1->size);
        }

        /* USB led blinking green, ADSL led off */

        /* URB 11 */
        ret = usb_bulk_msg(usb_dev, usb_rcvbulkpipe(usb_dev, ENDPOINT_FIRMWARE),
                           buffer, 0x200, &actual_length, DATA_TIMEOUT);

        if (ret < 0) {
                usb_err(usbatm, "%s: read BLOCK2 from modem failed (%d)!\n", __func__, ret);
                goto out_free;
        }
        usb_dbg(usbatm, "%s: BLOCK2 downloaded (%d bytes)\n", __func__, actual_length);

        /* URBs 12 to 139 - USB led blinking green, ADSL led off */
        for (offset = 0; offset < fw2->size; offset += PAGE_SIZE) {
                int thislen = min_t(int, PAGE_SIZE, fw2->size - offset);
                memcpy(buffer, fw2->data + offset, thislen);

                ret = usb_bulk_msg(usb_dev, usb_sndbulkpipe(usb_dev, ENDPOINT_FIRMWARE),
                                   buffer, thislen, &actual_length, DATA_TIMEOUT);

                if (ret < 0) {
                        usb_err(usbatm, "%s: write BLOCK3 to modem failed (%d)!\n", __func__, ret);
                        goto out_free;
                }
        }
        usb_dbg(usbatm, "%s: BLOCK3 uploaded (%zu bytes)\n", __func__, fw2->size);

        /* USB led static green, ADSL led static red */

        /* URB 142 */
        ret = usb_bulk_msg(usb_dev, usb_rcvbulkpipe(usb_dev, ENDPOINT_FIRMWARE),
                           buffer, 0x200, &actual_length, DATA_TIMEOUT);

        if (ret < 0) {
                usb_err(usbatm, "%s: read BLOCK4 from modem failed (%d)!\n", __func__, ret);
                goto out_free;
        }

        /* success */
        usb_dbg(usbatm, "%s: BLOCK4 downloaded (%d bytes)\n", __func__, actual_length);

        /* Delay to allow firmware to start up. We can do this here
           because we're in our own kernel thread anyway. */
        msleep_interruptible(1000);

        if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, instance->params.altsetting)) < 0) {
                usb_err(usbatm, "%s: setting interface to %d failed (%d)!\n", __func__, instance->params.altsetting, ret);
                goto out_free;
        }

        /* Enable software buffering, if requested */
        if (sw_buffering)
                speedtch_set_swbuff(instance, 1);

        /* Magic spell; don't ask us what this does */
        speedtch_test_sequence(instance);

        ret = 0;

out_free:
        free_page((unsigned long)buffer);
out:
        return ret;
}

static int speedtch_find_firmware(struct usbatm_data *usbatm, struct usb_interface *intf,
                                  int phase, const struct firmware **fw_p)
{
        struct device *dev = &intf->dev;
        const u16 bcdDevice = le16_to_cpu(interface_to_usbdev(intf)->descriptor.bcdDevice);
        const u8 major_revision = bcdDevice >> 8;
        const u8 minor_revision = bcdDevice & 0xff;
        char buf[24];

        sprintf(buf, "speedtch-%d.bin.%x.%02x", phase, major_revision, minor_revision);
        usb_dbg(usbatm, "%s: looking for %s\n", __func__, buf);

        if (request_firmware(fw_p, buf, dev)) {
                sprintf(buf, "speedtch-%d.bin.%x", phase, major_revision);
                usb_dbg(usbatm, "%s: looking for %s\n", __func__, buf);

                if (request_firmware(fw_p, buf, dev)) {
                        sprintf(buf, "speedtch-%d.bin", phase);
                        usb_dbg(usbatm, "%s: looking for %s\n", __func__, buf);

                        if (request_firmware(fw_p, buf, dev)) {
                                usb_err(usbatm, "%s: no stage %d firmware found!\n", __func__, phase);
                                return -ENOENT;
                        }
                }
        }

        usb_info(usbatm, "found stage %d firmware %s\n", phase, buf);

        return 0;
}

static int speedtch_heavy_init(struct usbatm_data *usbatm, struct usb_interface *intf)
{
        const struct firmware *fw1, *fw2;
        struct speedtch_instance_data *instance = usbatm->driver_data;
        int ret;

        if ((ret = speedtch_find_firmware(usbatm, intf, 1, &fw1)) < 0)
                return ret;

        if ((ret = speedtch_find_firmware(usbatm, intf, 2, &fw2)) < 0) {
                release_firmware(fw1);
                return ret;
        }

        if ((ret = speedtch_upload_firmware(instance, fw1, fw2)) < 0)
                usb_err(usbatm, "%s: firmware upload failed (%d)!\n", __func__, ret);

        release_firmware(fw2);
        release_firmware(fw1);

        return ret;
}


/**********
**  ATM  **
**********/

static int speedtch_read_status(struct speedtch_instance_data *instance)
{
        struct usbatm_data *usbatm = instance->usbatm;
        struct usb_device *usb_dev = usbatm->usb_dev;
        unsigned char *buf = instance->scratch_buffer;
        int ret;

        memset(buf, 0, 16);

        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x12, 0xc0, 0x07, 0x00, buf + OFFSET_7, SIZE_7,
                              CTRL_TIMEOUT);
        if (ret < 0) {
                atm_dbg(usbatm, "%s: MSG 7 failed\n", __func__);
                return ret;
        }

        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x12, 0xc0, 0x0b, 0x00, buf + OFFSET_b, SIZE_b,
                              CTRL_TIMEOUT);
        if (ret < 0) {
                atm_dbg(usbatm, "%s: MSG B failed\n", __func__);
                return ret;
        }

        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x12, 0xc0, 0x0d, 0x00, buf + OFFSET_d, SIZE_d,
                              CTRL_TIMEOUT);
        if (ret < 0) {
                atm_dbg(usbatm, "%s: MSG D failed\n", __func__);
                return ret;
        }

        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x01, 0xc0, 0x0e, 0x00, buf + OFFSET_e, SIZE_e,
                              CTRL_TIMEOUT);
        if (ret < 0) {
                atm_dbg(usbatm, "%s: MSG E failed\n", __func__);
                return ret;
        }

        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x01, 0xc0, 0x0f, 0x00, buf + OFFSET_f, SIZE_f,
                              CTRL_TIMEOUT);
        if (ret < 0) {
                atm_dbg(usbatm, "%s: MSG F failed\n", __func__);
                return ret;
        }

        return 0;
}

static int speedtch_start_synchro(struct speedtch_instance_data *instance)
{
        struct usbatm_data *usbatm = instance->usbatm;
        struct usb_device *usb_dev = usbatm->usb_dev;
        unsigned char *buf = instance->scratch_buffer;
        int ret;

        atm_dbg(usbatm, "%s entered\n", __func__);

        memset(buf, 0, 2);

        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x12, 0xc0, 0x04, 0x00,
                              buf, 2, CTRL_TIMEOUT);

        if (ret < 0)
                atm_warn(usbatm, "failed to start ADSL synchronisation: %d\n", ret);
        else
                atm_dbg(usbatm, "%s: modem prodded. %d bytes returned: %02x %02x\n",
                        __func__, ret, buf[0], buf[1]);

        return ret;
}

static void speedtch_check_status(struct work_struct *work)
{
        struct speedtch_instance_data *instance =
                container_of(work, struct speedtch_instance_data,
                             status_check_work);
        struct usbatm_data *usbatm = instance->usbatm;
        struct atm_dev *atm_dev = usbatm->atm_dev;
        unsigned char *buf = instance->scratch_buffer;
        int down_speed, up_speed, ret;
        unsigned char status;

#ifdef VERBOSE_DEBUG
        atm_dbg(usbatm, "%s entered\n", __func__);
#endif

        ret = speedtch_read_status(instance);
        if (ret < 0) {
                atm_warn(usbatm, "error %d fetching device status\n", ret);
                instance->poll_delay = min(2 * instance->poll_delay, MAX_POLL_DELAY);
                return;
        }

        instance->poll_delay = max(instance->poll_delay / 2, MIN_POLL_DELAY);

        status = buf[OFFSET_7];

        if ((status != instance->last_status) || !status) {
                atm_dbg(usbatm, "%s: line state 0x%02x\n", __func__, status);

                switch (status) {
                case 0:
                        atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
                        if (instance->last_status)
                                atm_info(usbatm, "ADSL line is down\n");
                        /* It may never resync again unless we ask it to... */
                        ret = speedtch_start_synchro(instance);
                        break;

                case 0x08:
                        atm_dev_signal_change(atm_dev, ATM_PHY_SIG_UNKNOWN);
                        atm_info(usbatm, "ADSL line is blocked?\n");
                        break;

                case 0x10:
                        atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
                        atm_info(usbatm, "ADSL line is synchronising\n");
                        break;

                case 0x20:
                        down_speed = buf[OFFSET_b] | (buf[OFFSET_b + 1] << 8)
                                | (buf[OFFSET_b + 2] << 16) | (buf[OFFSET_b + 3] << 24);
                        up_speed = buf[OFFSET_b + 4] | (buf[OFFSET_b + 5] << 8)
                                | (buf[OFFSET_b + 6] << 16) | (buf[OFFSET_b + 7] << 24);

                        if (!(down_speed & 0x0000ffff) && !(up_speed & 0x0000ffff)) {
                                down_speed >>= 16;
                                up_speed >>= 16;
                        }

                        atm_dev->link_rate = down_speed * 1000 / 424;
                        atm_dev_signal_change(atm_dev, ATM_PHY_SIG_FOUND);

                        atm_info(usbatm,
                                 "ADSL line is up (%d kb/s down | %d kb/s up)\n",
                                 down_speed, up_speed);
                        break;

                default:
                        atm_dev_signal_change(atm_dev, ATM_PHY_SIG_UNKNOWN);
                        atm_info(usbatm, "unknown line state %02x\n", status);
                        break;
                }

                instance->last_status = status;
        }
}

static void speedtch_status_poll(struct timer_list *t)
{
        struct speedtch_instance_data *instance = from_timer(instance, t,
                                                             status_check_timer);

        schedule_work(&instance->status_check_work);

        /* The following check is racy, but the race is harmless */
        if (instance->poll_delay < MAX_POLL_DELAY)
                mod_timer(&instance->status_check_timer, jiffies + msecs_to_jiffies(instance->poll_delay));
        else
                atm_warn(instance->usbatm, "Too many failures - disabling line status polling\n");
}

static void speedtch_resubmit_int(struct timer_list *t)
{
        struct speedtch_instance_data *instance = from_timer(instance, t,
                                                             resubmit_timer);
        struct urb *int_urb = instance->int_urb;
        int ret;

        atm_dbg(instance->usbatm, "%s entered\n", __func__);

        if (int_urb) {
                ret = usb_submit_urb(int_urb, GFP_ATOMIC);
                if (!ret)
                        schedule_work(&instance->status_check_work);
                else {
                        atm_dbg(instance->usbatm, "%s: usb_submit_urb failed with result %d\n", __func__, ret);
                        mod_timer(&instance->resubmit_timer, jiffies + msecs_to_jiffies(RESUBMIT_DELAY));
                }
        }
}

static void speedtch_handle_int(struct urb *int_urb)
{
        struct speedtch_instance_data *instance = int_urb->context;
        struct usbatm_data *usbatm = instance->usbatm;
        unsigned int count = int_urb->actual_length;
        int status = int_urb->status;
        int ret;

        /* The magic interrupt for "up state" */
        static const unsigned char up_int[6]   = { 0xa1, 0x00, 0x01, 0x00, 0x00, 0x00 };
        /* The magic interrupt for "down state" */
        static const unsigned char down_int[6] = { 0xa1, 0x00, 0x00, 0x00, 0x00, 0x00 };

        atm_dbg(usbatm, "%s entered\n", __func__);

        if (status < 0) {
                atm_dbg(usbatm, "%s: nonzero urb status %d!\n", __func__, status);
                goto fail;
        }

        if ((count == 6) && !memcmp(up_int, instance->int_data, 6)) {
                del_timer(&instance->status_check_timer);
                atm_info(usbatm, "DSL line goes up\n");
        } else if ((count == 6) && !memcmp(down_int, instance->int_data, 6)) {
                atm_info(usbatm, "DSL line goes down\n");
        } else {
                int i;

                atm_dbg(usbatm, "%s: unknown interrupt packet of length %d:", __func__, count);
                for (i = 0; i < count; i++)
                        printk(" %02x", instance->int_data[i]);
                printk("\n");
                goto fail;
        }

        int_urb = instance->int_urb;
        if (int_urb) {
                ret = usb_submit_urb(int_urb, GFP_ATOMIC);
                schedule_work(&instance->status_check_work);
                if (ret < 0) {
                        atm_dbg(usbatm, "%s: usb_submit_urb failed with result %d\n", __func__, ret);
                        goto fail;
                }
        }

        return;

fail:
        int_urb = instance->int_urb;
        if (int_urb)
                mod_timer(&instance->resubmit_timer, jiffies + msecs_to_jiffies(RESUBMIT_DELAY));
}

static int speedtch_atm_start(struct usbatm_data *usbatm, struct atm_dev *atm_dev)
{
        struct usb_device *usb_dev = usbatm->usb_dev;
        struct speedtch_instance_data *instance = usbatm->driver_data;
        int i, ret;
        unsigned char mac_str[13];

        atm_dbg(usbatm, "%s entered\n", __func__);

        /* Set MAC address, it is stored in the serial number */
        memset(atm_dev->esi, 0, sizeof(atm_dev->esi));
        if (usb_string(usb_dev, usb_dev->descriptor.iSerialNumber, mac_str, sizeof(mac_str)) == 12) {
                for (i = 0; i < 6; i++)
                        atm_dev->esi[i] = (hex_to_bin(mac_str[i * 2]) << 4) +
                                hex_to_bin(mac_str[i * 2 + 1]);
        }

        /* Start modem synchronisation */
        ret = speedtch_start_synchro(instance);

        /* Set up interrupt endpoint */
        if (instance->int_urb) {
                ret = usb_submit_urb(instance->int_urb, GFP_KERNEL);
                if (ret < 0) {
                        /* Doesn't matter; we'll poll anyway */
                        atm_dbg(usbatm, "%s: submission of interrupt URB failed (%d)!\n", __func__, ret);
                        usb_free_urb(instance->int_urb);
                        instance->int_urb = NULL;
                }
        }

        /* Start status polling */
        mod_timer(&instance->status_check_timer, jiffies + msecs_to_jiffies(1000));

        return 0;
}

static void speedtch_atm_stop(struct usbatm_data *usbatm, struct atm_dev *atm_dev)
{
        struct speedtch_instance_data *instance = usbatm->driver_data;
        struct urb *int_urb = instance->int_urb;

        atm_dbg(usbatm, "%s entered\n", __func__);

        del_timer_sync(&instance->status_check_timer);

        /*
         * Since resubmit_timer and int_urb can schedule themselves and
         * each other, shutting them down correctly takes some care
         */
        instance->int_urb = NULL; /* signal shutdown */
        mb();
        usb_kill_urb(int_urb);
        del_timer_sync(&instance->resubmit_timer);
        /*
         * At this point, speedtch_handle_int and speedtch_resubmit_int
         * can run or be running, but instance->int_urb == NULL means that
         * they will not reschedule
         */
        usb_kill_urb(int_urb);
        del_timer_sync(&instance->resubmit_timer);
        usb_free_urb(int_urb);

        flush_work(&instance->status_check_work);
}

static int speedtch_pre_reset(struct usb_interface *intf)
{
        return 0;
}

static int speedtch_post_reset(struct usb_interface *intf)
{
        return 0;
}


/**********
**  USB  **
**********/

static const struct usb_device_id speedtch_usb_ids[] = {
        {USB_DEVICE(0x06b9, 0x4061)},
        {}
};

MODULE_DEVICE_TABLE(usb, speedtch_usb_ids);

static int speedtch_usb_probe(struct usb_interface *, const struct usb_device_id *);

static struct usb_driver speedtch_usb_driver = {
        .name                = speedtch_driver_name,
        .probe                = speedtch_usb_probe,
        .disconnect        = usbatm_usb_disconnect,
        .pre_reset        = speedtch_pre_reset,
        .post_reset        = speedtch_post_reset,
        .id_table        = speedtch_usb_ids
};

static void speedtch_release_interfaces(struct usb_device *usb_dev,
                                        int num_interfaces)
{
        struct usb_interface *cur_intf;
        int i;

        for (i = 0; i < num_interfaces; i++) {
                cur_intf = usb_ifnum_to_if(usb_dev, i);
                if (cur_intf) {
                        usb_set_intfdata(cur_intf, NULL);
                        usb_driver_release_interface(&speedtch_usb_driver, cur_intf);
                }
        }
}

static int speedtch_bind(struct usbatm_data *usbatm,
                         struct usb_interface *intf,
                         const struct usb_device_id *id)
{
        struct usb_device *usb_dev = interface_to_usbdev(intf);
        struct usb_interface *cur_intf, *data_intf;
        struct speedtch_instance_data *instance;
        int ifnum = intf->altsetting->desc.bInterfaceNumber;
        int num_interfaces = usb_dev->actconfig->desc.bNumInterfaces;
        int i, ret;
        int use_isoc;

        usb_dbg(usbatm, "%s entered\n", __func__);

        /* sanity checks */

        if (usb_dev->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
                usb_err(usbatm, "%s: wrong device class %d\n", __func__, usb_dev->descriptor.bDeviceClass);
                return -ENODEV;
        }

        data_intf = usb_ifnum_to_if(usb_dev, INTERFACE_DATA);
        if (!data_intf) {
                usb_err(usbatm, "%s: data interface not found!\n", __func__);
                return -ENODEV;
        }

        /* claim all interfaces */

        for (i = 0; i < num_interfaces; i++) {
                cur_intf = usb_ifnum_to_if(usb_dev, i);

                if ((i != ifnum) && cur_intf) {
                        ret = usb_driver_claim_interface(&speedtch_usb_driver, cur_intf, usbatm);

                        if (ret < 0) {
                                usb_err(usbatm, "%s: failed to claim interface %2d (%d)!\n", __func__, i, ret);
                                speedtch_release_interfaces(usb_dev, i);
                                return ret;
                        }
                }
        }

        instance = kzalloc(sizeof(*instance), GFP_KERNEL);

        if (!instance) {
                ret = -ENOMEM;
                goto fail_release;
        }

        instance->usbatm = usbatm;

        /* module parameters may change at any moment, so take a snapshot */
        instance->params.altsetting = altsetting;
        instance->params.BMaxDSL = BMaxDSL;
        instance->params.ModemMode = ModemMode;
        memcpy(instance->params.ModemOption, DEFAULT_MODEM_OPTION, MODEM_OPTION_LENGTH);
        memcpy(instance->params.ModemOption, ModemOption, num_ModemOption);
        use_isoc = enable_isoc;

        if (instance->params.altsetting)
                if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, instance->params.altsetting)) < 0) {
                        usb_err(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, instance->params.altsetting, ret);
                        instance->params.altsetting = 0; /* fall back to default */
                }

        if (!instance->params.altsetting && use_isoc)
                if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, DEFAULT_ISOC_ALTSETTING)) < 0) {
                        usb_dbg(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, DEFAULT_ISOC_ALTSETTING, ret);
                        use_isoc = 0; /* fall back to bulk */
                }

        if (use_isoc) {
                const struct usb_host_interface *desc = data_intf->cur_altsetting;
                const __u8 target_address = USB_DIR_IN | usbatm->driver->isoc_in;

                use_isoc = 0; /* fall back to bulk if endpoint not found */

                for (i = 0; i < desc->desc.bNumEndpoints; i++) {
                        const struct usb_endpoint_descriptor *endpoint_desc = &desc->endpoint[i].desc;

                        if ((endpoint_desc->bEndpointAddress == target_address)) {
                                use_isoc =
                                        usb_endpoint_xfer_isoc(endpoint_desc);
                                break;
                        }
                }

                if (!use_isoc)
                        usb_info(usbatm, "isochronous transfer not supported - using bulk\n");
        }

        if (!use_isoc && !instance->params.altsetting)
                if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, DEFAULT_BULK_ALTSETTING)) < 0) {
                        usb_err(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, DEFAULT_BULK_ALTSETTING, ret);
                        goto fail_free;
                }

        if (!instance->params.altsetting)
                instance->params.altsetting = use_isoc ? DEFAULT_ISOC_ALTSETTING : DEFAULT_BULK_ALTSETTING;

        usbatm->flags |= (use_isoc ? UDSL_USE_ISOC : 0);

        INIT_WORK(&instance->status_check_work, speedtch_check_status);
        timer_setup(&instance->status_check_timer, speedtch_status_poll, 0);
        instance->last_status = 0xff;
        instance->poll_delay = MIN_POLL_DELAY;

        timer_setup(&instance->resubmit_timer, speedtch_resubmit_int, 0);

        instance->int_urb = usb_alloc_urb(0, GFP_KERNEL);

        if (instance->int_urb)
                usb_fill_int_urb(instance->int_urb, usb_dev,
                                 usb_rcvintpipe(usb_dev, ENDPOINT_INT),
                                 instance->int_data, sizeof(instance->int_data),
                                 speedtch_handle_int, instance, 16);
        else
                usb_dbg(usbatm, "%s: no memory for interrupt urb!\n", __func__);

        /* check whether the modem already seems to be alive */
        ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                              0x12, 0xc0, 0x07, 0x00,
                              instance->scratch_buffer + OFFSET_7, SIZE_7, 500);

        usbatm->flags |= (ret == SIZE_7 ? UDSL_SKIP_HEAVY_INIT : 0);

        usb_dbg(usbatm, "%s: firmware %s loaded\n", __func__, usbatm->flags & UDSL_SKIP_HEAVY_INIT ? "already" : "not");

        if (!(usbatm->flags & UDSL_SKIP_HEAVY_INIT))
                if ((ret = usb_reset_device(usb_dev)) < 0) {
                        usb_err(usbatm, "%s: device reset failed (%d)!\n", __func__, ret);
                        goto fail_free;
                }

        usbatm->driver_data = instance;

        return 0;

fail_free:
        usb_free_urb(instance->int_urb);
        kfree(instance);
fail_release:
        speedtch_release_interfaces(usb_dev, num_interfaces);
        return ret;
}

static void speedtch_unbind(struct usbatm_data *usbatm, struct usb_interface *intf)
{
        struct usb_device *usb_dev = interface_to_usbdev(intf);
        struct speedtch_instance_data *instance = usbatm->driver_data;

        usb_dbg(usbatm, "%s entered\n", __func__);

        speedtch_release_interfaces(usb_dev, usb_dev->actconfig->desc.bNumInterfaces);
        usb_free_urb(instance->int_urb);
        kfree(instance);
}


/***********
**  init  **
***********/

static struct usbatm_driver speedtch_usbatm_driver = {
        .driver_name        = speedtch_driver_name,
        .bind                = speedtch_bind,
        .heavy_init        = speedtch_heavy_init,
        .unbind                = speedtch_unbind,
        .atm_start        = speedtch_atm_start,
        .atm_stop        = speedtch_atm_stop,
        .bulk_in        = ENDPOINT_BULK_DATA,
        .bulk_out        = ENDPOINT_BULK_DATA,
        .isoc_in        = ENDPOINT_ISOC_DATA
};

static int speedtch_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
{
        return usbatm_usb_probe(intf, id, &speedtch_usbatm_driver);
}

module_usb_driver(speedtch_usb_driver);

MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL");











































































































































































































  185 



  185 













1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
// SPDX-License-Identifier: GPL-2.0-only
/*
 * Support for polling mode for input devices.
 */

#include <linux/device.h>
#include <linux/input.h>
#include <linux/jiffies.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/types.h>
#include <linux/workqueue.h>
#include "input-poller.h"

struct input_dev_poller {
        void (*poll)(struct input_dev *dev);

        unsigned int poll_interval; /* msec */
        unsigned int poll_interval_max; /* msec */
        unsigned int poll_interval_min; /* msec */

        struct input_dev *input;
        struct delayed_work work;
};

static void input_dev_poller_queue_work(struct input_dev_poller *poller)
{
        unsigned long delay;

        delay = msecs_to_jiffies(poller->poll_interval);
        if (delay >= HZ)
                delay = round_jiffies_relative(delay);

        queue_delayed_work(system_freezable_wq, &poller->work, delay);
}

static void input_dev_poller_work(struct work_struct *work)
{
        struct input_dev_poller *poller =
                container_of(work, struct input_dev_poller, work.work);

        poller->poll(poller->input);
        input_dev_poller_queue_work(poller);
}

void input_dev_poller_finalize(struct input_dev_poller *poller)
{
        if (!poller->poll_interval)
                poller->poll_interval = 500;
        if (!poller->poll_interval_max)
                poller->poll_interval_max = poller->poll_interval;
}

void input_dev_poller_start(struct input_dev_poller *poller)
{
        /* Only start polling if polling is enabled */
        if (poller->poll_interval > 0) {
                poller->poll(poller->input);
                input_dev_poller_queue_work(poller);
        }
}

void input_dev_poller_stop(struct input_dev_poller *poller)
{
        cancel_delayed_work_sync(&poller->work);
}

int input_setup_polling(struct input_dev *dev,
                        void (*poll_fn)(struct input_dev *dev))
{
        struct input_dev_poller *poller;

        poller = kzalloc(sizeof(*poller), GFP_KERNEL);
        if (!poller) {
                /*
                 * We want to show message even though kzalloc() may have
                 * printed backtrace as knowing what instance of input
                 * device we were dealing with is helpful.
                 */
                dev_err(dev->dev.parent ?: &dev->dev,
                        "%s: unable to allocate poller structure\n", __func__);
                return -ENOMEM;
        }

        INIT_DELAYED_WORK(&poller->work, input_dev_poller_work);
        poller->input = dev;
        poller->poll = poll_fn;

        dev->poller = poller;
        return 0;
}
EXPORT_SYMBOL(input_setup_polling);

static bool input_dev_ensure_poller(struct input_dev *dev)
{
        if (!dev->poller) {
                dev_err(dev->dev.parent ?: &dev->dev,
                        "poller structure has not been set up\n");
                return false;
        }

        return true;
}

void input_set_poll_interval(struct input_dev *dev, unsigned int interval)
{
        if (input_dev_ensure_poller(dev))
                dev->poller->poll_interval = interval;
}
EXPORT_SYMBOL(input_set_poll_interval);

void input_set_min_poll_interval(struct input_dev *dev, unsigned int interval)
{
        if (input_dev_ensure_poller(dev))
                dev->poller->poll_interval_min = interval;
}
EXPORT_SYMBOL(input_set_min_poll_interval);

void input_set_max_poll_interval(struct input_dev *dev, unsigned int interval)
{
        if (input_dev_ensure_poller(dev))
                dev->poller->poll_interval_max = interval;
}
EXPORT_SYMBOL(input_set_max_poll_interval);

int input_get_poll_interval(struct input_dev *dev)
{
        if (!dev->poller)
                return -EINVAL;

        return dev->poller->poll_interval;
}
EXPORT_SYMBOL(input_get_poll_interval);

/* SYSFS interface */

static ssize_t input_dev_get_poll_interval(struct device *dev,
                                           struct device_attribute *attr,
                                           char *buf)
{
        struct input_dev *input = to_input_dev(dev);

        return sprintf(buf, "%d\n", input->poller->poll_interval);
}

static ssize_t input_dev_set_poll_interval(struct device *dev,
                                           struct device_attribute *attr,
                                           const char *buf, size_t count)
{
        struct input_dev *input = to_input_dev(dev);
        struct input_dev_poller *poller = input->poller;
        unsigned int interval;
        int err;

        err = kstrtouint(buf, 0, &interval);
        if (err)
                return err;

        if (interval < poller->poll_interval_min)
                return -EINVAL;

        if (interval > poller->poll_interval_max)
                return -EINVAL;

        guard(mutex)(&input->mutex);

        poller->poll_interval = interval;

        if (input_device_enabled(input)) {
                cancel_delayed_work_sync(&poller->work);
                if (poller->poll_interval > 0)
                        input_dev_poller_queue_work(poller);
        }

        return count;
}

static DEVICE_ATTR(poll, 0644,
                   input_dev_get_poll_interval, input_dev_set_poll_interval);

static ssize_t input_dev_get_poll_max(struct device *dev,
                                      struct device_attribute *attr, char *buf)
{
        struct input_dev *input = to_input_dev(dev);

        return sprintf(buf, "%d\n", input->poller->poll_interval_max);
}

static DEVICE_ATTR(max, 0444, input_dev_get_poll_max, NULL);

static ssize_t input_dev_get_poll_min(struct device *dev,
                                     struct device_attribute *attr, char *buf)
{
        struct input_dev *input = to_input_dev(dev);

        return sprintf(buf, "%d\n", input->poller->poll_interval_min);
}

static DEVICE_ATTR(min, 0444, input_dev_get_poll_min, NULL);

static umode_t input_poller_attrs_visible(struct kobject *kobj,
                                          struct attribute *attr, int n)
{
        struct device *dev = kobj_to_dev(kobj);
        struct input_dev *input = to_input_dev(dev);

        return input->poller ? attr->mode : 0;
}

static struct attribute *input_poller_attrs[] = {
        &dev_attr_poll.attr,
        &dev_attr_max.attr,
        &dev_attr_min.attr,
        NULL
};

struct attribute_group input_poller_attribute_group = {
        .is_visible        = input_poller_attrs_visible,
        .attrs                = input_poller_attrs,
};




















































































    4 












    4 





















































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Internals of the DMA direct mapping implementation.  Only for use by the
 * DMA mapping code and IOMMU drivers.
 */
#ifndef _LINUX_DMA_DIRECT_H
#define _LINUX_DMA_DIRECT_H 1

#include <linux/dma-mapping.h>
#include <linux/dma-map-ops.h>
#include <linux/memblock.h> /* for min_low_pfn */
#include <linux/mem_encrypt.h>
#include <linux/swiotlb.h>

extern u64 zone_dma_limit;

/*
 * Record the mapping of CPU physical to DMA addresses for a given region.
 */
struct bus_dma_region {
        phys_addr_t        cpu_start;
        dma_addr_t        dma_start;
        u64                size;
};

static inline dma_addr_t translate_phys_to_dma(struct device *dev,
                phys_addr_t paddr)
{
        const struct bus_dma_region *m;

        for (m = dev->dma_range_map; m->size; m++) {
                u64 offset = paddr - m->cpu_start;

                if (paddr >= m->cpu_start && offset < m->size)
                        return m->dma_start + offset;
        }

        /* make sure dma_capable fails when no translation is available */
        return DMA_MAPPING_ERROR;
}

static inline phys_addr_t translate_dma_to_phys(struct device *dev,
                dma_addr_t dma_addr)
{
        const struct bus_dma_region *m;

        for (m = dev->dma_range_map; m->size; m++) {
                u64 offset = dma_addr - m->dma_start;

                if (dma_addr >= m->dma_start && offset < m->size)
                        return m->cpu_start + offset;
        }

        return (phys_addr_t)-1;
}

static inline dma_addr_t dma_range_map_min(const struct bus_dma_region *map)
{
        dma_addr_t ret = (dma_addr_t)U64_MAX;

        for (; map->size; map++)
                ret = min(ret, map->dma_start);
        return ret;
}

static inline dma_addr_t dma_range_map_max(const struct bus_dma_region *map)
{
        dma_addr_t ret = 0;

        for (; map->size; map++)
                ret = max(ret, map->dma_start + map->size - 1);
        return ret;
}

#ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA
#include <asm/dma-direct.h>
#ifndef phys_to_dma_unencrypted
#define phys_to_dma_unencrypted                phys_to_dma
#endif
#else
static inline dma_addr_t phys_to_dma_unencrypted(struct device *dev,
                phys_addr_t paddr)
{
        if (dev->dma_range_map)
                return translate_phys_to_dma(dev, paddr);
        return paddr;
}

/*
 * If memory encryption is supported, phys_to_dma will set the memory encryption
 * bit in the DMA address, and dma_to_phys will clear it.
 * phys_to_dma_unencrypted is for use on special unencrypted memory like swiotlb
 * buffers.
 */
static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
{
        return __sme_set(phys_to_dma_unencrypted(dev, paddr));
}

static inline phys_addr_t dma_to_phys(struct device *dev, dma_addr_t dma_addr)
{
        phys_addr_t paddr;

        if (dev->dma_range_map)
                paddr = translate_dma_to_phys(dev, dma_addr);
        else
                paddr = dma_addr;

        return __sme_clr(paddr);
}
#endif /* !CONFIG_ARCH_HAS_PHYS_TO_DMA */

#ifdef CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED
bool force_dma_unencrypted(struct device *dev);
#else
static inline bool force_dma_unencrypted(struct device *dev)
{
        return false;
}
#endif /* CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED */

static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size,
                bool is_ram)
{
        dma_addr_t end = addr + size - 1;

        if (addr == DMA_MAPPING_ERROR)
                return false;
        if (is_ram && !IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) &&
            min(addr, end) < phys_to_dma(dev, PFN_PHYS(min_low_pfn)))
                return false;

        return end <= min_not_zero(*dev->dma_mask, dev->bus_dma_limit);
}

u64 dma_direct_get_required_mask(struct device *dev);
void *dma_direct_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
                gfp_t gfp, unsigned long attrs);
void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
                dma_addr_t dma_addr, unsigned long attrs);
struct page *dma_direct_alloc_pages(struct device *dev, size_t size,
                dma_addr_t *dma_handle, enum dma_data_direction dir, gfp_t gfp);
void dma_direct_free_pages(struct device *dev, size_t size,
                struct page *page, dma_addr_t dma_addr,
                enum dma_data_direction dir);
int dma_direct_supported(struct device *dev, u64 mask);
dma_addr_t dma_direct_map_resource(struct device *dev, phys_addr_t paddr,
                size_t size, enum dma_data_direction dir, unsigned long attrs);

#endif /* _LINUX_DMA_DIRECT_H */
















    3 

    3 
















    7 









    3 



    4 
    3 

    2 
    2 








    8 

    6 





    2 










   10 









    1 



    9 
    8 

    1 
    8 





1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) 2017 Red Hat, Inc.
 * Copyright (c) 2018-2021 Christoph Hellwig.
 */
#include <linux/module.h>
#include <linux/compiler.h>
#include <linux/fs.h>
#include <linux/iomap.h>
#include <linux/pagemap.h>
#include <linux/pagevec.h>

static int iomap_seek_hole_iter(struct iomap_iter *iter,
                loff_t *hole_pos)
{
        loff_t length = iomap_length(iter);

        switch (iter->iomap.type) {
        case IOMAP_UNWRITTEN:
                *hole_pos = mapping_seek_hole_data(iter->inode->i_mapping,
                                iter->pos, iter->pos + length, SEEK_HOLE);
                if (*hole_pos == iter->pos + length)
                        return iomap_iter_advance(iter, &length);
                return 0;
        case IOMAP_HOLE:
                *hole_pos = iter->pos;
                return 0;
        default:
                return iomap_iter_advance(iter, &length);
        }
}

loff_t
iomap_seek_hole(struct inode *inode, loff_t pos, const struct iomap_ops *ops)
{
        loff_t size = i_size_read(inode);
        struct iomap_iter iter = {
                .inode        = inode,
                .pos        = pos,
                .flags        = IOMAP_REPORT,
        };
        int ret;

        /* Nothing to be found before or beyond the end of the file. */
        if (pos < 0 || pos >= size)
                return -ENXIO;

        iter.len = size - pos;
        while ((ret = iomap_iter(&iter, ops)) > 0)
                iter.status = iomap_seek_hole_iter(&iter, &pos);
        if (ret < 0)
                return ret;
        if (iter.len) /* found hole before EOF */
                return pos;
        return size;
}
EXPORT_SYMBOL_GPL(iomap_seek_hole);

static int iomap_seek_data_iter(struct iomap_iter *iter,
                loff_t *hole_pos)
{
        loff_t length = iomap_length(iter);

        switch (iter->iomap.type) {
        case IOMAP_HOLE:
                return iomap_iter_advance(iter, &length);
        case IOMAP_UNWRITTEN:
                *hole_pos = mapping_seek_hole_data(iter->inode->i_mapping,
                                iter->pos, iter->pos + length, SEEK_DATA);
                if (*hole_pos < 0)
                        return iomap_iter_advance(iter, &length);
                return 0;
        default:
                *hole_pos = iter->pos;
                return 0;
        }
}

loff_t
iomap_seek_data(struct inode *inode, loff_t pos, const struct iomap_ops *ops)
{
        loff_t size = i_size_read(inode);
        struct iomap_iter iter = {
                .inode        = inode,
                .pos        = pos,
                .flags        = IOMAP_REPORT,
        };
        int ret;

        /* Nothing to be found before or beyond the end of the file. */
        if (pos < 0 || pos >= size)
                return -ENXIO;

        iter.len = size - pos;
        while ((ret = iomap_iter(&iter, ops)) > 0)
                iter.status = iomap_seek_data_iter(&iter, &pos);
        if (ret < 0)
                return ret;
        if (iter.len) /* found data before EOF */
                return pos;
        /* We've reached the end of the file without finding data */
        return -ENXIO;
}
EXPORT_SYMBOL_GPL(iomap_seek_data);























































    3 






    3 












































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
// SPDX-License-Identifier: GPL-2.0
/*
 * Verification of builtin signatures
 *
 * Copyright 2019 Google LLC
 */

/*
 * This file implements verification of fs-verity builtin signatures.  Please
 * take great care before using this feature.  It is not the only way to do
 * signatures with fs-verity, and the alternatives (such as userspace signature
 * verification, and IMA appraisal) can be much better.  For details about the
 * limitations of this feature, see Documentation/filesystems/fsverity.rst.
 */

#include "fsverity_private.h"

#include <linux/cred.h>
#include <linux/key.h>
#include <linux/security.h>
#include <linux/slab.h>
#include <linux/verification.h>

/*
 * /proc/sys/fs/verity/require_signatures
 * If 1, all verity files must have a valid builtin signature.
 */
int fsverity_require_signatures;

/*
 * Keyring that contains the trusted X.509 certificates.
 *
 * Only root (kuid=0) can modify this.  Also, root may use
 * keyctl_restrict_keyring() to prevent any more additions.
 */
static struct key *fsverity_keyring;

/**
 * fsverity_verify_signature() - check a verity file's signature
 * @vi: the file's fsverity_info
 * @signature: the file's built-in signature
 * @sig_size: size of signature in bytes, or 0 if no signature
 *
 * If the file includes a signature of its fs-verity file digest, verify it
 * against the certificates in the fs-verity keyring. Note that signatures
 * are verified regardless of the state of the 'fsverity_require_signatures'
 * variable and the LSM subsystem relies on this behavior to help enforce
 * file integrity policies. Please discuss changes with the LSM list
 * (thank you!).
 *
 * Return: 0 on success (signature valid or not required); -errno on failure
 */
int fsverity_verify_signature(const struct fsverity_info *vi,
                              const u8 *signature, size_t sig_size)
{
        const struct inode *inode = vi->inode;
        const struct fsverity_hash_alg *hash_alg = vi->tree_params.hash_alg;
        struct fsverity_formatted_digest *d;
        int err;

        if (sig_size == 0) {
                if (fsverity_require_signatures) {
                        fsverity_err(inode,
                                     "require_signatures=1, rejecting unsigned file!");
                        return -EPERM;
                }
                return 0;
        }

        if (fsverity_keyring->keys.nr_leaves_on_tree == 0) {
                /*
                 * The ".fs-verity" keyring is empty, due to builtin signatures
                 * being supported by the kernel but not actually being used.
                 * In this case, verify_pkcs7_signature() would always return an
                 * error, usually ENOKEY.  It could also be EBADMSG if the
                 * PKCS#7 is malformed, but that isn't very important to
                 * distinguish.  So, just skip to ENOKEY to avoid the attack
                 * surface of the PKCS#7 parser, which would otherwise be
                 * reachable by any task able to execute FS_IOC_ENABLE_VERITY.
                 */
                fsverity_err(inode,
                             "fs-verity keyring is empty, rejecting signed file!");
                return -ENOKEY;
        }

        d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);
        if (!d)
                return -ENOMEM;
        memcpy(d->magic, "FSVerity", 8);
        d->digest_algorithm = cpu_to_le16(hash_alg - fsverity_hash_algs);
        d->digest_size = cpu_to_le16(hash_alg->digest_size);
        memcpy(d->digest, vi->file_digest, hash_alg->digest_size);

        err = verify_pkcs7_signature(d, sizeof(*d) + hash_alg->digest_size,
                                     signature, sig_size, fsverity_keyring,
                                     VERIFYING_UNSPECIFIED_SIGNATURE,
                                     NULL, NULL);
        kfree(d);

        if (err) {
                if (err == -ENOKEY)
                        fsverity_err(inode,
                                     "File's signing cert isn't in the fs-verity keyring");
                else if (err == -EKEYREJECTED)
                        fsverity_err(inode, "Incorrect file signature");
                else if (err == -EBADMSG)
                        fsverity_err(inode, "Malformed file signature");
                else
                        fsverity_err(inode, "Error %d verifying file signature",
                                     err);
                return err;
        }

        err = security_inode_setintegrity(inode,
                                          LSM_INT_FSVERITY_BUILTINSIG_VALID,
                                          signature,
                                          sig_size);

        if (err) {
                fsverity_err(inode, "Error %d exposing file signature to LSMs",
                             err);
                return err;
        }

        return 0;
}

void __init fsverity_init_signature(void)
{
        fsverity_keyring =
                keyring_alloc(".fs-verity", KUIDT_INIT(0), KGIDT_INIT(0),
                              current_cred(), KEY_POS_SEARCH |
                                KEY_USR_VIEW | KEY_USR_READ | KEY_USR_WRITE |
                                KEY_USR_SEARCH | KEY_USR_SETATTR,
                              KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
        if (IS_ERR(fsverity_keyring))
                panic("failed to allocate \".fs-verity\" keyring");
}

































    4 



    3 

    1 















    7 






    3 










    7 









    6 

    1 








    4 



































    1 

    1 














    7 








    6 
    1 


















   11 


   11 




   10 








   10 
   10 
   10 
    7 






















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
// SPDX-License-Identifier: GPL-2.0-only

#include "netlink.h"
#include "common.h"

struct pause_req_info {
        struct ethnl_req_info                base;
        enum ethtool_mac_stats_src        src;
};

#define PAUSE_REQINFO(__req_base) \
        container_of(__req_base, struct pause_req_info, base)

struct pause_reply_data {
        struct ethnl_reply_data                base;
        struct ethtool_pauseparam        pauseparam;
        struct ethtool_pause_stats        pausestat;
};

#define PAUSE_REPDATA(__reply_base) \
        container_of(__reply_base, struct pause_reply_data, base)

const struct nla_policy ethnl_pause_get_policy[] = {
        [ETHTOOL_A_PAUSE_HEADER]                =
                NLA_POLICY_NESTED(ethnl_header_policy_stats),
        [ETHTOOL_A_PAUSE_STATS_SRC]                =
                NLA_POLICY_MAX(NLA_U32, ETHTOOL_MAC_STATS_SRC_PMAC),
};

static int pause_parse_request(struct ethnl_req_info *req_base,
                               struct nlattr **tb,
                               struct netlink_ext_ack *extack)
{
        enum ethtool_mac_stats_src src = ETHTOOL_MAC_STATS_SRC_AGGREGATE;
        struct pause_req_info *req_info = PAUSE_REQINFO(req_base);

        if (tb[ETHTOOL_A_PAUSE_STATS_SRC]) {
                if (!(req_base->flags & ETHTOOL_FLAG_STATS)) {
                        NL_SET_ERR_MSG_MOD(extack,
                                           "ETHTOOL_FLAG_STATS must be set when requesting a source of stats");
                        return -EINVAL;
                }

                src = nla_get_u32(tb[ETHTOOL_A_PAUSE_STATS_SRC]);
        }

        req_info->src = src;

        return 0;
}

static int pause_prepare_data(const struct ethnl_req_info *req_base,
                              struct ethnl_reply_data *reply_base,
                              const struct genl_info *info)
{
        const struct pause_req_info *req_info = PAUSE_REQINFO(req_base);
        struct pause_reply_data *data = PAUSE_REPDATA(reply_base);
        enum ethtool_mac_stats_src src = req_info->src;
        struct net_device *dev = reply_base->dev;
        int ret;

        if (!dev->ethtool_ops->get_pauseparam)
                return -EOPNOTSUPP;

        ethtool_stats_init((u64 *)&data->pausestat,
                           sizeof(data->pausestat) / 8);
        data->pausestat.src = src;

        ret = ethnl_ops_begin(dev);
        if (ret < 0)
                return ret;

        if ((src == ETHTOOL_MAC_STATS_SRC_EMAC ||
             src == ETHTOOL_MAC_STATS_SRC_PMAC) &&
            !__ethtool_dev_mm_supported(dev)) {
                NL_SET_ERR_MSG_MOD(info->extack,
                                   "Device does not support MAC merge layer");
                ethnl_ops_complete(dev);
                return -EOPNOTSUPP;
        }

        dev->ethtool_ops->get_pauseparam(dev, &data->pauseparam);
        if (req_base->flags & ETHTOOL_FLAG_STATS &&
            dev->ethtool_ops->get_pause_stats)
                dev->ethtool_ops->get_pause_stats(dev, &data->pausestat);

        ethnl_ops_complete(dev);

        return 0;
}

static int pause_reply_size(const struct ethnl_req_info *req_base,
                            const struct ethnl_reply_data *reply_base)
{
        int n = nla_total_size(sizeof(u8)) +        /* _PAUSE_AUTONEG */
                nla_total_size(sizeof(u8)) +        /* _PAUSE_RX */
                nla_total_size(sizeof(u8));        /* _PAUSE_TX */

        if (req_base->flags & ETHTOOL_FLAG_STATS)
                n += nla_total_size(0) +        /* _PAUSE_STATS */
                     nla_total_size(sizeof(u32)) + /* _PAUSE_STATS_SRC */
                     nla_total_size_64bit(sizeof(u64)) * ETHTOOL_PAUSE_STAT_CNT;
        return n;
}

static int ethtool_put_stat(struct sk_buff *skb, u64 val, u16 attrtype,
                            u16 padtype)
{
        if (val == ETHTOOL_STAT_NOT_SET)
                return 0;
        if (nla_put_u64_64bit(skb, attrtype, val, padtype))
                return -EMSGSIZE;

        return 0;
}

static int pause_put_stats(struct sk_buff *skb,
                           const struct ethtool_pause_stats *pause_stats)
{
        const u16 pad = ETHTOOL_A_PAUSE_STAT_PAD;
        struct nlattr *nest;

        if (nla_put_u32(skb, ETHTOOL_A_PAUSE_STATS_SRC, pause_stats->src))
                return -EMSGSIZE;

        nest = nla_nest_start(skb, ETHTOOL_A_PAUSE_STATS);
        if (!nest)
                return -EMSGSIZE;

        if (ethtool_put_stat(skb, pause_stats->tx_pause_frames,
                             ETHTOOL_A_PAUSE_STAT_TX_FRAMES, pad) ||
            ethtool_put_stat(skb, pause_stats->rx_pause_frames,
                             ETHTOOL_A_PAUSE_STAT_RX_FRAMES, pad))
                goto err_cancel;

        nla_nest_end(skb, nest);
        return 0;

err_cancel:
        nla_nest_cancel(skb, nest);
        return -EMSGSIZE;
}

static int pause_fill_reply(struct sk_buff *skb,
                            const struct ethnl_req_info *req_base,
                            const struct ethnl_reply_data *reply_base)
{
        const struct pause_reply_data *data = PAUSE_REPDATA(reply_base);
        const struct ethtool_pauseparam *pauseparam = &data->pauseparam;

        if (nla_put_u8(skb, ETHTOOL_A_PAUSE_AUTONEG, !!pauseparam->autoneg) ||
            nla_put_u8(skb, ETHTOOL_A_PAUSE_RX, !!pauseparam->rx_pause) ||
            nla_put_u8(skb, ETHTOOL_A_PAUSE_TX, !!pauseparam->tx_pause))
                return -EMSGSIZE;

        if (req_base->flags & ETHTOOL_FLAG_STATS &&
            pause_put_stats(skb, &data->pausestat))
                return -EMSGSIZE;

        return 0;
}

/* PAUSE_SET */

const struct nla_policy ethnl_pause_set_policy[] = {
        [ETHTOOL_A_PAUSE_HEADER]                =
                NLA_POLICY_NESTED(ethnl_header_policy),
        [ETHTOOL_A_PAUSE_AUTONEG]                = { .type = NLA_U8 },
        [ETHTOOL_A_PAUSE_RX]                        = { .type = NLA_U8 },
        [ETHTOOL_A_PAUSE_TX]                        = { .type = NLA_U8 },
};

static int
ethnl_set_pause_validate(struct ethnl_req_info *req_info,
                         struct genl_info *info)
{
        const struct ethtool_ops *ops = req_info->dev->ethtool_ops;

        return ops->get_pauseparam && ops->set_pauseparam ? 1 : -EOPNOTSUPP;
}

static int
ethnl_set_pause(struct ethnl_req_info *req_info, struct genl_info *info)
{
        struct net_device *dev = req_info->dev;
        struct ethtool_pauseparam params = {};
        struct nlattr **tb = info->attrs;
        bool mod = false;
        int ret;

        dev->ethtool_ops->get_pauseparam(dev, &params);

        ethnl_update_bool32(&params.autoneg, tb[ETHTOOL_A_PAUSE_AUTONEG], &mod);
        ethnl_update_bool32(&params.rx_pause, tb[ETHTOOL_A_PAUSE_RX], &mod);
        ethnl_update_bool32(&params.tx_pause, tb[ETHTOOL_A_PAUSE_TX], &mod);
        if (!mod)
                return 0;

        ret = dev->ethtool_ops->set_pauseparam(dev, &params);
        return ret < 0 ? ret : 1;
}

const struct ethnl_request_ops ethnl_pause_request_ops = {
        .request_cmd                = ETHTOOL_MSG_PAUSE_GET,
        .reply_cmd                = ETHTOOL_MSG_PAUSE_GET_REPLY,
        .hdr_attr                = ETHTOOL_A_PAUSE_HEADER,
        .req_info_size                = sizeof(struct pause_req_info),
        .reply_data_size        = sizeof(struct pause_reply_data),

        .parse_request                = pause_parse_request,
        .prepare_data                = pause_prepare_data,
        .reply_size                = pause_reply_size,
        .fill_reply                = pause_fill_reply,

        .set_validate                = ethnl_set_pause_validate,
        .set                        = ethnl_set_pause,
        .set_ntf_cmd                = ETHTOOL_MSG_PAUSE_NTF,
};



































  474 









  473 


  471 
  476 


  449 





  221 
  453 














  316 



  316 
  316 
  315 

  109 






  204 


















  220 
  202 

  315 

  316 









  281 
  279 

  205 







   94 
   35 

   98 


  279 

  279 













   41 



   41 



   41 







































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * lib/plist.c
 *
 * Descending-priority-sorted double-linked list
 *
 * (C) 2002-2003 Intel Corp
 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>.
 *
 * 2001-2005 (c) MontaVista Software, Inc.
 * Daniel Walker <dwalker@mvista.com>
 *
 * (C) 2005 Thomas Gleixner <tglx@linutronix.de>
 *
 * Simplifications of the original code by
 * Oleg Nesterov <oleg@tv-sign.ru>
 *
 * Based on simple lists (include/linux/list.h).
 *
 * This file contains the add / del functions which are considered to
 * be too large to inline. See include/linux/plist.h for further
 * information.
 */

#include <linux/bug.h>
#include <linux/plist.h>

#ifdef CONFIG_DEBUG_PLIST

static struct plist_head test_head;

static void plist_check_prev_next(struct list_head *t, struct list_head *p,
                                  struct list_head *n)
{
        WARN(n->prev != p || p->next != n,
                        "top: %p, n: %p, p: %p\n"
                        "prev: %p, n: %p, p: %p\n"
                        "next: %p, n: %p, p: %p\n",
                         t, t->next, t->prev,
                        p, p->next, p->prev,
                        n, n->next, n->prev);
}

static void plist_check_list(struct list_head *top)
{
        struct list_head *prev = top, *next = top->next;

        plist_check_prev_next(top, prev, next);
        while (next != top) {
                WRITE_ONCE(prev, next);
                WRITE_ONCE(next, prev->next);
                plist_check_prev_next(top, prev, next);
        }
}

static void plist_check_head(struct plist_head *head)
{
        if (!plist_head_empty(head))
                plist_check_list(&plist_first(head)->prio_list);
        plist_check_list(&head->node_list);
}

#else
# define plist_check_head(h)        do { } while (0)
#endif

/**
 * plist_add - add @node to @head
 *
 * @node:        &struct plist_node pointer
 * @head:        &struct plist_head pointer
 */
void plist_add(struct plist_node *node, struct plist_head *head)
{
        struct plist_node *first, *iter, *prev = NULL, *last, *reverse_iter;
        struct list_head *node_next = &head->node_list;

        plist_check_head(head);
        WARN_ON(!plist_node_empty(node));
        WARN_ON(!list_empty(&node->prio_list));

        if (plist_head_empty(head))
                goto ins_node;

        first = iter = plist_first(head);
        last = reverse_iter = list_entry(first->prio_list.prev, struct plist_node, prio_list);

        do {
                if (node->prio < iter->prio) {
                        node_next = &iter->node_list;
                        break;
                } else if (node->prio >= reverse_iter->prio) {
                        prev = reverse_iter;
                        iter = list_entry(reverse_iter->prio_list.next,
                                struct plist_node, prio_list);
                        if (likely(reverse_iter != last))
                                node_next = &iter->node_list;
                        break;
                }

                prev = iter;
                iter = list_entry(iter->prio_list.next,
                                struct plist_node, prio_list);
                reverse_iter = list_entry(reverse_iter->prio_list.prev,
                                struct plist_node, prio_list);
        } while (iter != first);

        if (!prev || prev->prio != node->prio)
                list_add_tail(&node->prio_list, &iter->prio_list);
ins_node:
        list_add_tail(&node->node_list, node_next);

        plist_check_head(head);
}

/**
 * plist_del - Remove a @node from plist.
 *
 * @node:        &struct plist_node pointer - entry to be removed
 * @head:        &struct plist_head pointer - list head
 */
void plist_del(struct plist_node *node, struct plist_head *head)
{
        plist_check_head(head);

        if (!list_empty(&node->prio_list)) {
                if (node->node_list.next != &head->node_list) {
                        struct plist_node *next;

                        next = list_entry(node->node_list.next,
                                        struct plist_node, node_list);

                        /* add the next plist_node into prio_list */
                        if (list_empty(&next->prio_list))
                                list_add(&next->prio_list, &node->prio_list);
                }
                list_del_init(&node->prio_list);
        }

        list_del_init(&node->node_list);

        plist_check_head(head);
}

/**
 * plist_requeue - Requeue @node at end of same-prio entries.
 *
 * This is essentially an optimized plist_del() followed by
 * plist_add().  It moves an entry already in the plist to
 * after any other same-priority entries.
 *
 * @node:        &struct plist_node pointer - entry to be moved
 * @head:        &struct plist_head pointer - list head
 */
void plist_requeue(struct plist_node *node, struct plist_head *head)
{
        struct plist_node *iter;
        struct list_head *node_next = &head->node_list;

        plist_check_head(head);
        BUG_ON(plist_head_empty(head));
        BUG_ON(plist_node_empty(node));

        if (node == plist_last(head))
                return;

        iter = plist_next(node);

        if (node->prio != iter->prio)
                return;

        plist_del(node, head);

        plist_for_each_continue(iter, head) {
                if (node->prio != iter->prio) {
                        node_next = &iter->node_list;
                        break;
                }
        }
        list_add_tail(&node->node_list, node_next);

        plist_check_head(head);
}

#ifdef CONFIG_DEBUG_PLIST
#include <linux/sched.h>
#include <linux/sched/clock.h>
#include <linux/module.h>
#include <linux/init.h>

static struct plist_node __initdata test_node[241];

static void __init plist_test_check(int nr_expect)
{
        struct plist_node *first, *prio_pos, *node_pos;

        if (plist_head_empty(&test_head)) {
                BUG_ON(nr_expect != 0);
                return;
        }

        prio_pos = first = plist_first(&test_head);
        plist_for_each(node_pos, &test_head) {
                if (nr_expect-- < 0)
                        break;
                if (node_pos == first)
                        continue;
                if (node_pos->prio == prio_pos->prio) {
                        BUG_ON(!list_empty(&node_pos->prio_list));
                        continue;
                }

                BUG_ON(prio_pos->prio > node_pos->prio);
                BUG_ON(prio_pos->prio_list.next != &node_pos->prio_list);
                prio_pos = node_pos;
        }

        BUG_ON(nr_expect != 0);
        BUG_ON(prio_pos->prio_list.next != &first->prio_list);
}

static void __init plist_test_requeue(struct plist_node *node)
{
        plist_requeue(node, &test_head);

        if (node != plist_last(&test_head))
                BUG_ON(node->prio == plist_next(node)->prio);
}

static int  __init plist_test(void)
{
        int nr_expect = 0, i, loop;
        unsigned int r = local_clock();

        printk(KERN_DEBUG "start plist test\n");
        plist_head_init(&test_head);
        for (i = 0; i < ARRAY_SIZE(test_node); i++)
                plist_node_init(test_node + i, 0);

        for (loop = 0; loop < 1000; loop++) {
                r = r * 193939 % 47629;
                i = r % ARRAY_SIZE(test_node);
                if (plist_node_empty(test_node + i)) {
                        r = r * 193939 % 47629;
                        test_node[i].prio = r % 99;
                        plist_add(test_node + i, &test_head);
                        nr_expect++;
                } else {
                        plist_del(test_node + i, &test_head);
                        nr_expect--;
                }
                plist_test_check(nr_expect);
                if (!plist_node_empty(test_node + i)) {
                        plist_test_requeue(test_node + i);
                        plist_test_check(nr_expect);
                }
        }

        for (i = 0; i < ARRAY_SIZE(test_node); i++) {
                if (plist_node_empty(test_node + i))
                        continue;
                plist_del(test_node + i, &test_head);
                nr_expect--;
                plist_test_check(nr_expect);
        }

        printk(KERN_DEBUG "end plist test\n");

        /* Worst case test for plist_add() */
        unsigned int test_data[241];

        for (i = 0; i < ARRAY_SIZE(test_data); i++)
                test_data[i] = i;

        ktime_t start, end, time_elapsed = 0;

        plist_head_init(&test_head);

        for (i = 0; i < ARRAY_SIZE(test_node); i++) {
                plist_node_init(test_node + i, 0);
                test_node[i].prio = test_data[i];
        }

        for (i = 0; i < ARRAY_SIZE(test_node); i++) {
                if (plist_node_empty(test_node + i)) {
                        start = ktime_get();
                        plist_add(test_node + i, &test_head);
                        end = ktime_get();
                        time_elapsed += (end - start);
                }
        }

        pr_debug("plist_add worst case test time elapsed %lld\n", time_elapsed);
        return 0;
}

module_init(plist_test);

#endif











































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    5 












    5 






















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
// SPDX-License-Identifier: GPL-2.0+
/*
 * Driver for Realtek RTS51xx USB card reader
 *
 * Copyright(c) 2009 Realtek Semiconductor Corp. All rights reserved.
 *
 * Author:
 *   wwang (wei_wang@realsil.com.cn)
 *   No. 450, Shenhu Road, Suzhou Industry Park, Suzhou, China
 */

#include <linux/module.h>
#include <linux/blkdev.h>
#include <linux/kthread.h>
#include <linux/sched.h>
#include <linux/kernel.h>

#include <scsi/scsi.h>
#include <scsi/scsi_cmnd.h>
#include <scsi/scsi_device.h>
#include <linux/cdrom.h>

#include <linux/usb.h>
#include <linux/slab.h>
#include <linux/usb_usual.h>

#include "usb.h"
#include "transport.h"
#include "protocol.h"
#include "debug.h"
#include "scsiglue.h"

#define DRV_NAME "ums-realtek"

MODULE_DESCRIPTION("Driver for Realtek USB Card Reader");
MODULE_AUTHOR("wwang <wei_wang@realsil.com.cn>");
MODULE_LICENSE("GPL");
MODULE_IMPORT_NS("USB_STORAGE");

static int auto_delink_en = 1;
module_param(auto_delink_en, int, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(auto_delink_en, "auto delink mode (0=firmware, 1=software [default])");

#ifdef CONFIG_REALTEK_AUTOPM
static int ss_en = 1;
module_param(ss_en, int, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(ss_en, "enable selective suspend");

static int ss_delay = 50;
module_param(ss_delay, int, S_IRUGO | S_IWUSR);
MODULE_PARM_DESC(ss_delay,
                 "seconds to delay before entering selective suspend");

enum RTS51X_STAT {
        RTS51X_STAT_INIT,
        RTS51X_STAT_IDLE,
        RTS51X_STAT_RUN,
        RTS51X_STAT_SS
};

#define POLLING_INTERVAL        50

#define rts51x_set_stat(chip, stat)        \
        ((chip)->state = (enum RTS51X_STAT)(stat))
#define rts51x_get_stat(chip)                ((chip)->state)

#define SET_LUN_READY(chip, lun)        ((chip)->lun_ready |= ((u8)1 << (lun)))
#define CLR_LUN_READY(chip, lun)        ((chip)->lun_ready &= ~((u8)1 << (lun)))
#define TST_LUN_READY(chip, lun)        ((chip)->lun_ready & ((u8)1 << (lun)))

#endif

struct rts51x_status {
        u16 vid;
        u16 pid;
        u8 cur_lun;
        u8 card_type;
        u8 total_lun;
        u16 fw_ver;
        u8 phy_exist;
        u8 multi_flag;
        u8 multi_card;
        u8 log_exist;
        union {
                u8 detailed_type1;
                u8 detailed_type2;
        } detailed_type;
        u8 function[2];
};

struct rts51x_chip {
        u16 vendor_id;
        u16 product_id;
        char max_lun;

        struct rts51x_status *status;
        int status_len;

        u32 flag;
        struct us_data *us;

#ifdef CONFIG_REALTEK_AUTOPM
        struct timer_list rts51x_suspend_timer;
        unsigned long timer_expires;
        int pwr_state;
        u8 lun_ready;
        enum RTS51X_STAT state;
        int support_auto_delink;
#endif
        /* used to back up the protocol chosen in probe1 phase */
        proto_cmnd proto_handler_backup;
};

/* flag definition */
#define FLIDX_AUTO_DELINK                0x01

#define SCSI_LUN(srb)                        ((srb)->device->lun)

/* Bit Operation */
#define SET_BIT(data, idx)                ((data) |= 1 << (idx))
#define CLR_BIT(data, idx)                ((data) &= ~(1 << (idx)))
#define CHK_BIT(data, idx)                ((data) & (1 << (idx)))

#define SET_AUTO_DELINK(chip)                ((chip)->flag |= FLIDX_AUTO_DELINK)
#define CLR_AUTO_DELINK(chip)                ((chip)->flag &= ~FLIDX_AUTO_DELINK)
#define CHK_AUTO_DELINK(chip)                ((chip)->flag & FLIDX_AUTO_DELINK)

#define RTS51X_GET_VID(chip)                ((chip)->vendor_id)
#define RTS51X_GET_PID(chip)                ((chip)->product_id)

#define VENDOR_ID(chip)                        ((chip)->status[0].vid)
#define PRODUCT_ID(chip)                ((chip)->status[0].pid)
#define FW_VERSION(chip)                ((chip)->status[0].fw_ver)
#define STATUS_LEN(chip)                ((chip)->status_len)

#define STATUS_SUCCESS                0
#define STATUS_FAIL                1

/* Check card reader function */
#define SUPPORT_DETAILED_TYPE1(chip)        \
                CHK_BIT((chip)->status[0].function[0], 1)
#define SUPPORT_OT(chip)                \
                CHK_BIT((chip)->status[0].function[0], 2)
#define SUPPORT_OC(chip)                \
                CHK_BIT((chip)->status[0].function[0], 3)
#define SUPPORT_AUTO_DELINK(chip)        \
                CHK_BIT((chip)->status[0].function[0], 4)
#define SUPPORT_SDIO(chip)                \
                CHK_BIT((chip)->status[0].function[1], 0)
#define SUPPORT_DETAILED_TYPE2(chip)        \
                CHK_BIT((chip)->status[0].function[1], 1)

#define CHECK_PID(chip, pid)                (RTS51X_GET_PID(chip) == (pid))
#define CHECK_FW_VER(chip, fw_ver)        (FW_VERSION(chip) == (fw_ver))
#define CHECK_ID(chip, pid, fw_ver)        \
                (CHECK_PID((chip), (pid)) && CHECK_FW_VER((chip), (fw_ver)))

static int init_realtek_cr(struct us_data *us);

/*
 * The table of devices
 */
#define UNUSUAL_DEV(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax, \
                    vendorName, productName, useProtocol, useTransport, \
                    initFunction, flags) \
{\
        USB_DEVICE_VER(id_vendor, id_product, bcdDeviceMin, bcdDeviceMax), \
        .driver_info = (flags) \
}

static const struct usb_device_id realtek_cr_ids[] = {
#        include "unusual_realtek.h"
        {}                        /* Terminating entry */
};

MODULE_DEVICE_TABLE(usb, realtek_cr_ids);

#undef UNUSUAL_DEV

/*
 * The flags table
 */
#define UNUSUAL_DEV(idVendor, idProduct, bcdDeviceMin, bcdDeviceMax, \
                    vendor_name, product_name, use_protocol, use_transport, \
                    init_function, Flags) \
{ \
        .vendorName = vendor_name,        \
        .productName = product_name,        \
        .useProtocol = use_protocol,        \
        .useTransport = use_transport,        \
        .initFunction = init_function,        \
}

static struct us_unusual_dev realtek_cr_unusual_dev_list[] = {
#        include "unusual_realtek.h"
        {}                        /* Terminating entry */
};

#undef UNUSUAL_DEV

static int rts51x_bulk_transport(struct us_data *us, u8 lun,
                                 u8 *cmd, int cmd_len, u8 *buf, int buf_len,
                                 enum dma_data_direction dir, int *act_len)
{
        struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *)us->iobuf;
        struct bulk_cs_wrap *bcs = (struct bulk_cs_wrap *)us->iobuf;
        int result;
        unsigned int residue;
        unsigned int cswlen;
        unsigned int cbwlen = US_BULK_CB_WRAP_LEN;

        /* set up the command wrapper */
        bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
        bcb->DataTransferLength = cpu_to_le32(buf_len);
        bcb->Flags = (dir == DMA_FROM_DEVICE) ? US_BULK_FLAG_IN : US_BULK_FLAG_OUT;
        bcb->Tag = ++us->tag;
        bcb->Lun = lun;
        bcb->Length = cmd_len;

        /* copy the command payload */
        memset(bcb->CDB, 0, sizeof(bcb->CDB));
        memcpy(bcb->CDB, cmd, bcb->Length);

        /* send it to out endpoint */
        result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe,
                                            bcb, cbwlen, NULL);
        if (result != USB_STOR_XFER_GOOD)
                return USB_STOR_TRANSPORT_ERROR;

        /* DATA STAGE */
        /* send/receive data payload, if there is any */

        if (buf && buf_len) {
                unsigned int pipe = (dir == DMA_FROM_DEVICE) ?
                    us->recv_bulk_pipe : us->send_bulk_pipe;
                result = usb_stor_bulk_transfer_buf(us, pipe,
                                                    buf, buf_len, NULL);
                if (result == USB_STOR_XFER_ERROR)
                        return USB_STOR_TRANSPORT_ERROR;
        }

        /* get CSW for device status */
        result = usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe,
                                            bcs, US_BULK_CS_WRAP_LEN, &cswlen);
        if (result != USB_STOR_XFER_GOOD)
                return USB_STOR_TRANSPORT_ERROR;

        /* check bulk status */
        if (bcs->Signature != cpu_to_le32(US_BULK_CS_SIGN)) {
                usb_stor_dbg(us, "Signature mismatch: got %08X, expecting %08X\n",
                             le32_to_cpu(bcs->Signature), US_BULK_CS_SIGN);
                return USB_STOR_TRANSPORT_ERROR;
        }

        residue = bcs->Residue;
        if (bcs->Tag != us->tag)
                return USB_STOR_TRANSPORT_ERROR;

        /*
         * try to compute the actual residue, based on how much data
         * was really transferred and what the device tells us
         */
        if (residue)
                residue = residue < buf_len ? residue : buf_len;

        if (act_len)
                *act_len = buf_len - residue;

        /* based on the status code, we report good or bad */
        switch (bcs->Status) {
        case US_BULK_STAT_OK:
                /* command good -- note that data could be short */
                return USB_STOR_TRANSPORT_GOOD;

        case US_BULK_STAT_FAIL:
                /* command failed */
                return USB_STOR_TRANSPORT_FAILED;

        case US_BULK_STAT_PHASE:
                /*
                 * phase error -- note that a transport reset will be
                 * invoked by the invoke_transport() function
                 */
                return USB_STOR_TRANSPORT_ERROR;
        }

        /* we should never get here, but if we do, we're in trouble */
        return USB_STOR_TRANSPORT_ERROR;
}

static int rts51x_bulk_transport_special(struct us_data *us, u8 lun,
                                 u8 *cmd, int cmd_len, u8 *buf, int buf_len,
                                 enum dma_data_direction dir, int *act_len)
{
        struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
        struct bulk_cs_wrap *bcs = (struct bulk_cs_wrap *) us->iobuf;
        int result;
        unsigned int cswlen;
        unsigned int cbwlen = US_BULK_CB_WRAP_LEN;

        /* set up the command wrapper */
        bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
        bcb->DataTransferLength = cpu_to_le32(buf_len);
        bcb->Flags = (dir == DMA_FROM_DEVICE) ? US_BULK_FLAG_IN : US_BULK_FLAG_OUT;
        bcb->Tag = ++us->tag;
        bcb->Lun = lun;
        bcb->Length = cmd_len;

        /* copy the command payload */
        memset(bcb->CDB, 0, sizeof(bcb->CDB));
        memcpy(bcb->CDB, cmd, bcb->Length);

        /* send it to out endpoint */
        result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe,
                                bcb, cbwlen, NULL);
        if (result != USB_STOR_XFER_GOOD)
                return USB_STOR_TRANSPORT_ERROR;

        /* DATA STAGE */
        /* send/receive data payload, if there is any */

        if (buf && buf_len) {
                unsigned int pipe = (dir == DMA_FROM_DEVICE) ?
                                us->recv_bulk_pipe : us->send_bulk_pipe;
                result = usb_stor_bulk_transfer_buf(us, pipe,
                                buf, buf_len, NULL);
                if (result == USB_STOR_XFER_ERROR)
                        return USB_STOR_TRANSPORT_ERROR;
        }

        /* get CSW for device status */
        result = usb_bulk_msg(us->pusb_dev, us->recv_bulk_pipe, bcs,
                        US_BULK_CS_WRAP_LEN, &cswlen, 250);
        return result;
}

/* Determine what the maximum LUN supported is */
static int rts51x_get_max_lun(struct us_data *us)
{
        int result;

        /* issue the command */
        us->iobuf[0] = 0;
        result = usb_stor_control_msg(us, us->recv_ctrl_pipe,
                                      US_BULK_GET_MAX_LUN,
                                      USB_DIR_IN | USB_TYPE_CLASS |
                                      USB_RECIP_INTERFACE,
                                      0, us->ifnum, us->iobuf, 1, 10 * HZ);

        usb_stor_dbg(us, "GetMaxLUN command result is %d, data is %d\n",
                     result, us->iobuf[0]);

        /* if we have a successful request, return the result */
        if (result > 0)
                return us->iobuf[0];

        return 0;
}

static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len)
{
        int retval;
        u8 cmnd[12] = { 0 };
        u8 *buf;

        buf = kmalloc(len, GFP_NOIO);
        if (buf == NULL)
                return -ENOMEM;

        usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len);

        cmnd[0] = 0xF0;
        cmnd[1] = 0x0D;
        cmnd[2] = (u8) (addr >> 8);
        cmnd[3] = (u8) addr;
        cmnd[4] = (u8) (len >> 8);
        cmnd[5] = (u8) len;

        retval = rts51x_bulk_transport(us, 0, cmnd, 12,
                                       buf, len, DMA_FROM_DEVICE, NULL);
        if (retval != USB_STOR_TRANSPORT_GOOD) {
                kfree(buf);
                return -EIO;
        }

        memcpy(data, buf, len);
        kfree(buf);
        return 0;
}

static int rts51x_write_mem(struct us_data *us, u16 addr, u8 *data, u16 len)
{
        int retval;
        u8 cmnd[12] = { 0 };
        u8 *buf;

        buf = kmemdup(data, len, GFP_NOIO);
        if (buf == NULL)
                return USB_STOR_TRANSPORT_ERROR;

        usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len);

        cmnd[0] = 0xF0;
        cmnd[1] = 0x0E;
        cmnd[2] = (u8) (addr >> 8);
        cmnd[3] = (u8) addr;
        cmnd[4] = (u8) (len >> 8);
        cmnd[5] = (u8) len;

        retval = rts51x_bulk_transport(us, 0, cmnd, 12,
                                       buf, len, DMA_TO_DEVICE, NULL);
        kfree(buf);
        if (retval != USB_STOR_TRANSPORT_GOOD)
                return -EIO;

        return 0;
}

static int rts51x_read_status(struct us_data *us,
                              u8 lun, u8 *status, int len, int *actlen)
{
        int retval;
        u8 cmnd[12] = { 0 };
        u8 *buf;

        buf = kmalloc(len, GFP_NOIO);
        if (buf == NULL)
                return USB_STOR_TRANSPORT_ERROR;

        usb_stor_dbg(us, "lun = %d\n", lun);

        cmnd[0] = 0xF0;
        cmnd[1] = 0x09;

        retval = rts51x_bulk_transport(us, lun, cmnd, 12,
                                       buf, len, DMA_FROM_DEVICE, actlen);
        if (retval != USB_STOR_TRANSPORT_GOOD) {
                kfree(buf);
                return -EIO;
        }

        memcpy(status, buf, len);
        kfree(buf);
        return 0;
}

static int rts51x_check_status(struct us_data *us, u8 lun)
{
        struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
        int retval;
        u8 buf[16];

        retval = rts51x_read_status(us, lun, buf, 16, &(chip->status_len));
        if (retval != STATUS_SUCCESS)
                return -EIO;

        usb_stor_dbg(us, "chip->status_len = %d\n", chip->status_len);

        chip->status[lun].vid = ((u16) buf[0] << 8) | buf[1];
        chip->status[lun].pid = ((u16) buf[2] << 8) | buf[3];
        chip->status[lun].cur_lun = buf[4];
        chip->status[lun].card_type = buf[5];
        chip->status[lun].total_lun = buf[6];
        chip->status[lun].fw_ver = ((u16) buf[7] << 8) | buf[8];
        chip->status[lun].phy_exist = buf[9];
        chip->status[lun].multi_flag = buf[10];
        chip->status[lun].multi_card = buf[11];
        chip->status[lun].log_exist = buf[12];
        if (chip->status_len == 16) {
                chip->status[lun].detailed_type.detailed_type1 = buf[13];
                chip->status[lun].function[0] = buf[14];
                chip->status[lun].function[1] = buf[15];
        }

        return 0;
}

static int enable_oscillator(struct us_data *us)
{
        int retval;
        u8 value;

        retval = rts51x_read_mem(us, 0xFE77, &value, 1);
        if (retval < 0)
                return -EIO;

        value |= 0x04;
        retval = rts51x_write_mem(us, 0xFE77, &value, 1);
        if (retval < 0)
                return -EIO;

        retval = rts51x_read_mem(us, 0xFE77, &value, 1);
        if (retval < 0)
                return -EIO;

        if (!(value & 0x04))
                return -EIO;

        return 0;
}

static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len)
{
        int retval;
        u8 cmnd[12] = {0};
        u8 *buf;

        usb_stor_dbg(us, "addr = 0xfe47, len = %d\n", len);

        buf = kmemdup(data, len, GFP_NOIO);
        if (!buf)
                return USB_STOR_TRANSPORT_ERROR;

        cmnd[0] = 0xF0;
        cmnd[1] = 0x0E;
        cmnd[2] = 0xfe;
        cmnd[3] = 0x47;
        cmnd[4] = (u8)(len >> 8);
        cmnd[5] = (u8)len;

        retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, buf, len, DMA_TO_DEVICE, NULL);
        kfree(buf);
        if (retval != USB_STOR_TRANSPORT_GOOD) {
                return -EIO;
        }

        return 0;
}

static int do_config_autodelink(struct us_data *us, int enable, int force)
{
        int retval;
        u8 value;

        retval = rts51x_read_mem(us, 0xFE47, &value, 1);
        if (retval < 0)
                return -EIO;

        if (enable) {
                if (force)
                        value |= 0x03;
                else
                        value |= 0x01;
        } else {
                value &= ~0x03;
        }

        usb_stor_dbg(us, "set 0xfe47 to 0x%x\n", value);

        /* retval = rts51x_write_mem(us, 0xFE47, &value, 1); */
        retval = __do_config_autodelink(us, &value, 1);
        if (retval < 0)
                return -EIO;

        return 0;
}

static int config_autodelink_after_power_on(struct us_data *us)
{
        struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
        int retval;
        u8 value;

        if (!CHK_AUTO_DELINK(chip))
                return 0;

        retval = rts51x_read_mem(us, 0xFE47, &value, 1);
        if (retval < 0)
                return -EIO;

        if (auto_delink_en) {
                CLR_BIT(value, 0);
                CLR_BIT(value, 1);
                SET_BIT(value, 2);

                if (CHECK_ID(chip, 0x0138, 0x3882))
                        CLR_BIT(value, 2);

                SET_BIT(value, 7);

                /* retval = rts51x_write_mem(us, 0xFE47, &value, 1); */
                retval = __do_config_autodelink(us, &value, 1);
                if (retval < 0)
                        return -EIO;

                retval = enable_oscillator(us);
                if (retval == 0)
                        (void)do_config_autodelink(us, 1, 0);
        } else {
                /* Autodelink controlled by firmware */

                SET_BIT(value, 2);

                if (CHECK_ID(chip, 0x0138, 0x3882))
                        CLR_BIT(value, 2);

                if (CHECK_ID(chip, 0x0159, 0x5889) ||
                    CHECK_ID(chip, 0x0138, 0x3880)) {
                        CLR_BIT(value, 0);
                        CLR_BIT(value, 7);
                }

                /* retval = rts51x_write_mem(us, 0xFE47, &value, 1); */
                retval = __do_config_autodelink(us, &value, 1);
                if (retval < 0)
                        return -EIO;

                if (CHECK_ID(chip, 0x0159, 0x5888)) {
                        value = 0xFF;
                        retval = rts51x_write_mem(us, 0xFE79, &value, 1);
                        if (retval < 0)
                                return -EIO;

                        value = 0x01;
                        retval = rts51x_write_mem(us, 0x48, &value, 1);
                        if (retval < 0)
                                return -EIO;
                }
        }

        return 0;
}

#ifdef CONFIG_PM
static int config_autodelink_before_power_down(struct us_data *us)
{
        struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
        int retval;
        u8 value;

        if (!CHK_AUTO_DELINK(chip))
                return 0;

        if (auto_delink_en) {
                retval = rts51x_read_mem(us, 0xFE77, &value, 1);
                if (retval < 0)
                        return -EIO;

                SET_BIT(value, 2);
                retval = rts51x_write_mem(us, 0xFE77, &value, 1);
                if (retval < 0)
                        return -EIO;

                if (CHECK_ID(chip, 0x0159, 0x5888)) {
                        value = 0x01;
                        retval = rts51x_write_mem(us, 0x48, &value, 1);
                        if (retval < 0)
                                return -EIO;
                }

                retval = rts51x_read_mem(us, 0xFE47, &value, 1);
                if (retval < 0)
                        return -EIO;

                SET_BIT(value, 0);
                if (CHECK_ID(chip, 0x0138, 0x3882))
                        SET_BIT(value, 2);
                retval = rts51x_write_mem(us, 0xFE77, &value, 1);
                if (retval < 0)
                        return -EIO;
        } else {
                if (CHECK_ID(chip, 0x0159, 0x5889) ||
                    CHECK_ID(chip, 0x0138, 0x3880) ||
                    CHECK_ID(chip, 0x0138, 0x3882)) {
                        retval = rts51x_read_mem(us, 0xFE47, &value, 1);
                        if (retval < 0)
                                return -EIO;

                        if (CHECK_ID(chip, 0x0159, 0x5889) ||
                            CHECK_ID(chip, 0x0138, 0x3880)) {
                                SET_BIT(value, 0);
                                SET_BIT(value, 7);
                        }

                        if (CHECK_ID(chip, 0x0138, 0x3882))
                                SET_BIT(value, 2);

                        /* retval = rts51x_write_mem(us, 0xFE47, &value, 1); */
                        retval = __do_config_autodelink(us, &value, 1);
                        if (retval < 0)
                                return -EIO;
                }

                if (CHECK_ID(chip, 0x0159, 0x5888)) {
                        value = 0x01;
                        retval = rts51x_write_mem(us, 0x48, &value, 1);
                        if (retval < 0)
                                return -EIO;
                }
        }

        return 0;
}

static void fw5895_init(struct us_data *us)
{
        struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
        int retval;
        u8 val;

        if ((PRODUCT_ID(chip) != 0x0158) || (FW_VERSION(chip) != 0x5895)) {
                usb_stor_dbg(us, "Not the specified device, return immediately!\n");
        } else {
                retval = rts51x_read_mem(us, 0xFD6F, &val, 1);
                if (retval == STATUS_SUCCESS && (val & 0x1F) == 0) {
                        val = 0x1F;
                        retval = rts51x_write_mem(us, 0xFD70, &val, 1);
                        if (retval != STATUS_SUCCESS)
                                usb_stor_dbg(us, "Write memory fail\n");
                } else {
                        usb_stor_dbg(us, "Read memory fail, OR (val & 0x1F) != 0\n");
                }
        }
}
#endif

#ifdef CONFIG_REALTEK_AUTOPM
static void fw5895_set_mmc_wp(struct us_data *us)
{
        struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
        int retval;
        u8 buf[13];

        if ((PRODUCT_ID(chip) != 0x0158) || (FW_VERSION(chip) != 0x5895)) {
                usb_stor_dbg(us, "Not the specified device, return immediately!\n");
        } else {
                retval = rts51x_read_mem(us, 0xFD6F, buf, 1);
                if (retval == STATUS_SUCCESS && (buf[0] & 0x24) == 0x24) {
                        /* SD Exist and SD WP */
                        retval = rts51x_read_mem(us, 0xD04E, buf, 1);
                        if (retval == STATUS_SUCCESS) {
                                buf[0] |= 0x04;
                                retval = rts51x_write_mem(us, 0xFD70, buf, 1);
                                if (retval != STATUS_SUCCESS)
                                        usb_stor_dbg(us, "Write memory fail\n");
                        } else {
                                usb_stor_dbg(us, "Read memory fail\n");
                        }
                } else {
                        usb_stor_dbg(us, "Read memory fail, OR (buf[0]&0x24)!=0x24\n");
                }
        }
}

static void rts51x_modi_suspend_timer(struct rts51x_chip *chip)
{
        struct us_data *us = chip->us;

        usb_stor_dbg(us, "state:%d\n", rts51x_get_stat(chip));

        chip->timer_expires = jiffies + msecs_to_jiffies(1000*ss_delay);
        mod_timer(&chip->rts51x_suspend_timer, chip->timer_expires);
}

static void rts51x_suspend_timer_fn(struct timer_list *t)
{
        struct rts51x_chip *chip = from_timer(chip, t, rts51x_suspend_timer);
        struct us_data *us = chip->us;

        switch (rts51x_get_stat(chip)) {
        case RTS51X_STAT_INIT:
        case RTS51X_STAT_RUN:
                rts51x_modi_suspend_timer(chip);
                break;
        case RTS51X_STAT_IDLE:
        case RTS51X_STAT_SS:
                usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n",
                             atomic_read(&us->pusb_intf->dev.power.usage_count));

                if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) {
                        usb_stor_dbg(us, "Ready to enter SS state\n");
                        rts51x_set_stat(chip, RTS51X_STAT_SS);
                        /* ignore mass storage interface's children */
                        pm_suspend_ignore_children(&us->pusb_intf->dev, true);
                        usb_autopm_put_interface_async(us->pusb_intf);
                        usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n",
                                     atomic_read(&us->pusb_intf->dev.power.usage_count));
                }
                break;
        default:
                usb_stor_dbg(us, "Unknown state !!!\n");
                break;
        }
}

static inline int working_scsi(struct scsi_cmnd *srb)
{
        if ((srb->cmnd[0] == TEST_UNIT_READY) ||
            (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL)) {
                return 0;
        }

        return 1;
}

static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
{
        struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
        static int card_first_show = 1;
        static u8 media_not_present[] = { 0x70, 0, 0x02, 0, 0, 0, 0,
                10, 0, 0, 0, 0, 0x3A, 0, 0, 0, 0, 0
        };
        static u8 invalid_cmd_field[] = { 0x70, 0, 0x05, 0, 0, 0, 0,
                10, 0, 0, 0, 0, 0x24, 0, 0, 0, 0, 0
        };
        int ret;

        if (working_scsi(srb)) {
                usb_stor_dbg(us, "working scsi, power.usage:%d\n",
                             atomic_read(&us->pusb_intf->dev.power.usage_count));

                if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) {
                        ret = usb_autopm_get_interface(us->pusb_intf);
                        usb_stor_dbg(us, "working scsi, ret=%d\n", ret);
                }
                if (rts51x_get_stat(chip) != RTS51X_STAT_RUN)
                        rts51x_set_stat(chip, RTS51X_STAT_RUN);
                chip->proto_handler_backup(srb, us);
        } else {
                if (rts51x_get_stat(chip) == RTS51X_STAT_SS) {
                        usb_stor_dbg(us, "NOT working scsi\n");
                        if ((srb->cmnd[0] == TEST_UNIT_READY) &&
                            (chip->pwr_state == US_SUSPEND)) {
                                if (TST_LUN_READY(chip, srb->device->lun)) {
                                        srb->result = SAM_STAT_GOOD;
                                } else {
                                        srb->result = SAM_STAT_CHECK_CONDITION;
                                        memcpy(srb->sense_buffer,
                                               media_not_present,
                                               US_SENSE_SIZE);
                                }
                                usb_stor_dbg(us, "TEST_UNIT_READY\n");
                                goto out;
                        }
                        if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
                                int prevent = srb->cmnd[4] & 0x1;
                                if (prevent) {
                                        srb->result = SAM_STAT_CHECK_CONDITION;
                                        memcpy(srb->sense_buffer,
                                               invalid_cmd_field,
                                               US_SENSE_SIZE);
                                } else {
                                        srb->result = SAM_STAT_GOOD;
                                }
                                usb_stor_dbg(us, "ALLOW_MEDIUM_REMOVAL\n");
                                goto out;
                        }
                } else {
                        usb_stor_dbg(us, "NOT working scsi, not SS\n");
                        chip->proto_handler_backup(srb, us);
                        /* Check whether card is plugged in */
                        if (srb->cmnd[0] == TEST_UNIT_READY) {
                                if (srb->result == SAM_STAT_GOOD) {
                                        SET_LUN_READY(chip, srb->device->lun);
                                        if (card_first_show) {
                                                card_first_show = 0;
                                                fw5895_set_mmc_wp(us);
                                        }
                                } else {
                                        CLR_LUN_READY(chip, srb->device->lun);
                                        card_first_show = 1;
                                }
                        }
                        if (rts51x_get_stat(chip) != RTS51X_STAT_IDLE)
                                rts51x_set_stat(chip, RTS51X_STAT_IDLE);
                }
        }
out:
        usb_stor_dbg(us, "state:%d\n", rts51x_get_stat(chip));
        if (rts51x_get_stat(chip) == RTS51X_STAT_RUN)
                rts51x_modi_suspend_timer(chip);
}

static int realtek_cr_autosuspend_setup(struct us_data *us)
{
        struct rts51x_chip *chip;
        struct rts51x_status *status = NULL;
        u8 buf[16];
        int retval;

        chip = (struct rts51x_chip *)us->extra;
        chip->support_auto_delink = 0;
        chip->pwr_state = US_RESUME;
        chip->lun_ready = 0;
        rts51x_set_stat(chip, RTS51X_STAT_INIT);

        retval = rts51x_read_status(us, 0, buf, 16, &(chip->status_len));
        if (retval != STATUS_SUCCESS) {
                usb_stor_dbg(us, "Read status fail\n");
                return -EIO;
        }
        status = chip->status;
        status->vid = ((u16) buf[0] << 8) | buf[1];
        status->pid = ((u16) buf[2] << 8) | buf[3];
        status->cur_lun = buf[4];
        status->card_type = buf[5];
        status->total_lun = buf[6];
        status->fw_ver = ((u16) buf[7] << 8) | buf[8];
        status->phy_exist = buf[9];
        status->multi_flag = buf[10];
        status->multi_card = buf[11];
        status->log_exist = buf[12];
        if (chip->status_len == 16) {
                status->detailed_type.detailed_type1 = buf[13];
                status->function[0] = buf[14];
                status->function[1] = buf[15];
        }

        /* back up the proto_handler in us->extra */
        chip = (struct rts51x_chip *)(us->extra);
        chip->proto_handler_backup = us->proto_handler;
        /* Set the autosuspend_delay to 0 */
        pm_runtime_set_autosuspend_delay(&us->pusb_dev->dev, 0);
        /* override us->proto_handler setted in get_protocol() */
        us->proto_handler = rts51x_invoke_transport;

        chip->timer_expires = 0;
        timer_setup(&chip->rts51x_suspend_timer, rts51x_suspend_timer_fn, 0);
        fw5895_init(us);

        /* enable autosuspend function of the usb device */
        usb_enable_autosuspend(us->pusb_dev);

        return 0;
}
#endif

static void realtek_cr_destructor(void *extra)
{
        struct rts51x_chip *chip = extra;

        if (!chip)
                return;

#ifdef CONFIG_REALTEK_AUTOPM
        if (ss_en) {
                del_timer(&chip->rts51x_suspend_timer);
                chip->timer_expires = 0;
        }
#endif
        kfree(chip->status);
}

#ifdef CONFIG_PM
static int realtek_cr_suspend(struct usb_interface *iface, pm_message_t message)
{
        struct us_data *us = usb_get_intfdata(iface);

        /* wait until no command is running */
        mutex_lock(&us->dev_mutex);

        config_autodelink_before_power_down(us);

        mutex_unlock(&us->dev_mutex);

        return 0;
}

static int realtek_cr_resume(struct usb_interface *iface)
{
        struct us_data *us = usb_get_intfdata(iface);

        fw5895_init(us);
        config_autodelink_after_power_on(us);

        return 0;
}
#else
#define realtek_cr_suspend        NULL
#define realtek_cr_resume        NULL
#endif

static int init_realtek_cr(struct us_data *us)
{
        struct rts51x_chip *chip;
        int size, i, retval;

        chip = kzalloc(sizeof(struct rts51x_chip), GFP_KERNEL);
        if (!chip)
                return -ENOMEM;

        us->extra = chip;
        us->extra_destructor = realtek_cr_destructor;
        us->max_lun = chip->max_lun = rts51x_get_max_lun(us);
        chip->us = us;

        usb_stor_dbg(us, "chip->max_lun = %d\n", chip->max_lun);

        size = (chip->max_lun + 1) * sizeof(struct rts51x_status);
        chip->status = kzalloc(size, GFP_KERNEL);
        if (!chip->status)
                goto INIT_FAIL;

        for (i = 0; i <= (int)(chip->max_lun); i++) {
                retval = rts51x_check_status(us, (u8) i);
                if (retval < 0)
                        goto INIT_FAIL;
        }

        if (CHECK_PID(chip, 0x0138) || CHECK_PID(chip, 0x0158) ||
            CHECK_PID(chip, 0x0159)) {
                if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
                                CHECK_FW_VER(chip, 0x5901))
                        SET_AUTO_DELINK(chip);
                if (STATUS_LEN(chip) == 16) {
                        if (SUPPORT_AUTO_DELINK(chip))
                                SET_AUTO_DELINK(chip);
                }
        }
#ifdef CONFIG_REALTEK_AUTOPM
        if (ss_en)
                realtek_cr_autosuspend_setup(us);
#endif

        usb_stor_dbg(us, "chip->flag = 0x%x\n", chip->flag);

        (void)config_autodelink_after_power_on(us);

        return 0;

INIT_FAIL:
        if (us->extra) {
                kfree(chip->status);
                kfree(us->extra);
                us->extra = NULL;
        }

        return -EIO;
}

static struct scsi_host_template realtek_cr_host_template;

static int realtek_cr_probe(struct usb_interface *intf,
                            const struct usb_device_id *id)
{
        struct us_data *us;
        int result;

        dev_dbg(&intf->dev, "Probe Realtek Card Reader!\n");

        result = usb_stor_probe1(&us, intf, id,
                                 (id - realtek_cr_ids) +
                                 realtek_cr_unusual_dev_list,
                                 &realtek_cr_host_template);
        if (result)
                return result;

        result = usb_stor_probe2(us);

        return result;
}

static struct usb_driver realtek_cr_driver = {
        .name = DRV_NAME,
        .probe = realtek_cr_probe,
        .disconnect = usb_stor_disconnect,
        /* .suspend =      usb_stor_suspend, */
        /* .resume =       usb_stor_resume, */
        .reset_resume = usb_stor_reset_resume,
        .suspend = realtek_cr_suspend,
        .resume = realtek_cr_resume,
        .pre_reset = usb_stor_pre_reset,
        .post_reset = usb_stor_post_reset,
        .id_table = realtek_cr_ids,
        .soft_unbind = 1,
        .supports_autosuspend = 1,
        .no_dynamic_id = 1,
};

module_usb_stor_driver(realtek_cr_driver, realtek_cr_host_template, DRV_NAME);







































































































































































































































































































































































































    8 








































































































































    8 



    7 

    1 










    7 



















    8 









    6 
    2 







   28 








    5 


   21 

    8 



   15 


   22 








































































































































































































































































































































































































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
// SPDX-License-Identifier: GPL-2.0-only
/*
 * AppArmor security module
 *
 * This file contains AppArmor policy manipulation functions
 *
 * Copyright (C) 1998-2008 Novell/SUSE
 * Copyright 2009-2010 Canonical Ltd.
 *
 * AppArmor policy is based around profiles, which contain the rules a
 * task is confined by.  Every task in the system has a profile attached
 * to it determined either by matching "unconfined" tasks against the
 * visible set of profiles or by following a profiles attachment rules.
 *
 * Each profile exists in a profile namespace which is a container of
 * visible profiles.  Each namespace contains a special "unconfined" profile,
 * which doesn't enforce any confinement on a task beyond DAC.
 *
 * Namespace and profile names can be written together in either
 * of two syntaxes.
 *        :namespace:profile - used by kernel interfaces for easy detection
 *        namespace://profile - used by policy
 *
 * Profile names can not start with : or @ or ^ and may not contain \0
 *
 * Reserved profile names
 *        unconfined - special automatically generated unconfined profile
 *        inherit - special name to indicate profile inheritance
 *        null-XXXX-YYYY - special automatically generated learning profiles
 *
 * Namespace names may not start with / or @ and may not contain \0 or :
 * Reserved namespace names
 *        user-XXXX - user defined profiles
 *
 * a // in a profile or namespace name indicates a hierarchical name with the
 * name before the // being the parent and the name after the child.
 *
 * Profile and namespace hierarchies serve two different but similar purposes.
 * The namespace contains the set of visible profiles that are considered
 * for attachment.  The hierarchy of namespaces allows for virtualizing
 * the namespace so that for example a chroot can have its own set of profiles
 * which may define some local user namespaces.
 * The profile hierarchy severs two distinct purposes,
 * -  it allows for sub profiles or hats, which allows an application to run
 *    subprograms under its own profile with different restriction than it
 *    self, and not have it use the system profile.
 *    eg. if a mail program starts an editor, the policy might make the
 *        restrictions tighter on the editor tighter than the mail program,
 *        and definitely different than general editor restrictions
 * - it allows for binary hierarchy of profiles, so that execution history
 *   is preserved.  This feature isn't exploited by AppArmor reference policy
 *   but is allowed.  NOTE: this is currently suboptimal because profile
 *   aliasing is not currently implemented so that a profile for each
 *   level must be defined.
 *   eg. /bin/bash///bin/ls as a name would indicate /bin/ls was started
 *       from /bin/bash
 *
 *   A profile or namespace name that can contain one or more // separators
 *   is referred to as an hname (hierarchical).
 *   eg.  /bin/bash//bin/ls
 *
 *   An fqname is a name that may contain both namespace and profile hnames.
 *   eg. :ns:/bin/bash//bin/ls
 *
 * NOTES:
 *   - locking of profile lists is currently fairly coarse.  All profile
 *     lists within a namespace use the namespace lock.
 * FIXME: move profile lists to using rcu_lists
 */

#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/string.h>
#include <linux/cred.h>
#include <linux/rculist.h>
#include <linux/user_namespace.h>

#include "include/apparmor.h"
#include "include/capability.h"
#include "include/cred.h"
#include "include/file.h"
#include "include/ipc.h"
#include "include/match.h"
#include "include/path.h"
#include "include/policy.h"
#include "include/policy_ns.h"
#include "include/policy_unpack.h"
#include "include/resource.h"

int unprivileged_userns_apparmor_policy = 1;
int aa_unprivileged_unconfined_restricted;

const char *const aa_profile_mode_names[] = {
        "enforce",
        "complain",
        "kill",
        "unconfined",
        "user",
};


static void aa_free_pdb(struct aa_policydb *pdb)
{
        if (pdb) {
                aa_put_dfa(pdb->dfa);
                kvfree(pdb->perms);
                aa_free_str_table(&pdb->trans);
                kfree(pdb);
        }
}

/**
 * aa_pdb_free_kref - free aa_policydb by kref (called by aa_put_pdb)
 * @kref: kref callback for freeing of a dfa  (NOT NULL)
 */
void aa_pdb_free_kref(struct kref *kref)
{
        struct aa_policydb *pdb = container_of(kref, struct aa_policydb, count);

        aa_free_pdb(pdb);
}


struct aa_policydb *aa_alloc_pdb(gfp_t gfp)
{
        struct aa_policydb *pdb = kzalloc(sizeof(struct aa_policydb), gfp);

        if (!pdb)
                return NULL;

        kref_init(&pdb->count);

        return pdb;
}


/**
 * __add_profile - add a profiles to list and label tree
 * @list: list to add it to  (NOT NULL)
 * @profile: the profile to add  (NOT NULL)
 *
 * refcount @profile, should be put by __list_remove_profile
 *
 * Requires: namespace lock be held, or list not be shared
 */
static void __add_profile(struct list_head *list, struct aa_profile *profile)
{
        struct aa_label *l;

        AA_BUG(!list);
        AA_BUG(!profile);
        AA_BUG(!profile->ns);
        AA_BUG(!mutex_is_locked(&profile->ns->lock));

        list_add_rcu(&profile->base.list, list);
        /* get list reference */
        aa_get_profile(profile);
        l = aa_label_insert(&profile->ns->labels, &profile->label);
        AA_BUG(l != &profile->label);
        aa_put_label(l);
}

/**
 * __list_remove_profile - remove a profile from the list it is on
 * @profile: the profile to remove  (NOT NULL)
 *
 * remove a profile from the list, warning generally removal should
 * be done with __replace_profile as most profile removals are
 * replacements to the unconfined profile.
 *
 * put @profile list refcount
 *
 * Requires: namespace lock be held, or list not have been live
 */
static void __list_remove_profile(struct aa_profile *profile)
{
        AA_BUG(!profile);
        AA_BUG(!profile->ns);
        AA_BUG(!mutex_is_locked(&profile->ns->lock));

        list_del_rcu(&profile->base.list);
        aa_put_profile(profile);
}

/**
 * __remove_profile - remove old profile, and children
 * @profile: profile to be replaced  (NOT NULL)
 *
 * Requires: namespace list lock be held, or list not be shared
 */
static void __remove_profile(struct aa_profile *profile)
{
        AA_BUG(!profile);
        AA_BUG(!profile->ns);
        AA_BUG(!mutex_is_locked(&profile->ns->lock));

        /* release any children lists first */
        __aa_profile_list_release(&profile->base.profiles);
        /* released by free_profile */
        aa_label_remove(&profile->label);
        __aafs_profile_rmdir(profile);
        __list_remove_profile(profile);
}

/**
 * __aa_profile_list_release - remove all profiles on the list and put refs
 * @head: list of profiles  (NOT NULL)
 *
 * Requires: namespace lock be held
 */
void __aa_profile_list_release(struct list_head *head)
{
        struct aa_profile *profile, *tmp;
        list_for_each_entry_safe(profile, tmp, head, base.list)
                __remove_profile(profile);
}

/**
 * aa_free_data - free a data blob
 * @ptr: data to free
 * @arg: unused
 */
static void aa_free_data(void *ptr, void *arg)
{
        struct aa_data *data = ptr;

        kvfree_sensitive(data->data, data->size);
        kfree_sensitive(data->key);
        kfree_sensitive(data);
}

static void free_attachment(struct aa_attachment *attach)
{
        int i;

        for (i = 0; i < attach->xattr_count; i++)
                kfree_sensitive(attach->xattrs[i]);
        kfree_sensitive(attach->xattrs);
        aa_put_pdb(attach->xmatch);
}

static void free_ruleset(struct aa_ruleset *rules)
{
        int i;

        aa_put_pdb(rules->file);
        aa_put_pdb(rules->policy);
        aa_free_cap_rules(&rules->caps);
        aa_free_rlimit_rules(&rules->rlimits);

        for (i = 0; i < rules->secmark_count; i++)
                kfree_sensitive(rules->secmark[i].label);
        kfree_sensitive(rules->secmark);
        kfree_sensitive(rules);
}

struct aa_ruleset *aa_alloc_ruleset(gfp_t gfp)
{
        struct aa_ruleset *rules;

        rules = kzalloc(sizeof(*rules), gfp);
        if (rules)
                INIT_LIST_HEAD(&rules->list);

        return rules;
}

/**
 * aa_free_profile - free a profile
 * @profile: the profile to free  (MAYBE NULL)
 *
 * Free a profile, its hats and null_profile. All references to the profile,
 * its hats and null_profile must have been put.
 *
 * If the profile was referenced from a task context, free_profile() will
 * be called from an rcu callback routine, so we must not sleep here.
 */
void aa_free_profile(struct aa_profile *profile)
{
        struct aa_ruleset *rule, *tmp;
        struct rhashtable *rht;

        AA_DEBUG("%s(%p)\n", __func__, profile);

        if (!profile)
                return;

        /* free children profiles */
        aa_policy_destroy(&profile->base);
        aa_put_profile(rcu_access_pointer(profile->parent));

        aa_put_ns(profile->ns);
        kfree_sensitive(profile->rename);
        kfree_sensitive(profile->disconnected);

        free_attachment(&profile->attach);

        /*
         * at this point there are no tasks that can have a reference
         * to rules
         */
        list_for_each_entry_safe(rule, tmp, &profile->rules, list) {
                list_del_init(&rule->list);
                free_ruleset(rule);
        }
        kfree_sensitive(profile->dirname);

        if (profile->data) {
                rht = profile->data;
                profile->data = NULL;
                rhashtable_free_and_destroy(rht, aa_free_data, NULL);
                kfree_sensitive(rht);
        }

        kfree_sensitive(profile->hash);
        aa_put_loaddata(profile->rawdata);
        aa_label_destroy(&profile->label);

        kfree_sensitive(profile);
}

/**
 * aa_alloc_profile - allocate, initialize and return a new profile
 * @hname: name of the profile  (NOT NULL)
 * @proxy: proxy to use OR null if to allocate a new one
 * @gfp: allocation type
 *
 * Returns: refcount profile or NULL on failure
 */
struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,
                                    gfp_t gfp)
{
        struct aa_profile *profile;
        struct aa_ruleset *rules;

        /* freed by free_profile - usually through aa_put_profile */
        profile = kzalloc(struct_size(profile, label.vec, 2), gfp);
        if (!profile)
                return NULL;

        if (!aa_policy_init(&profile->base, NULL, hname, gfp))
                goto fail;
        if (!aa_label_init(&profile->label, 1, gfp))
                goto fail;

        INIT_LIST_HEAD(&profile->rules);

        /* allocate the first ruleset, but leave it empty */
        rules = aa_alloc_ruleset(gfp);
        if (!rules)
                goto fail;
        list_add(&rules->list, &profile->rules);

        /* update being set needed by fs interface */
        if (!proxy) {
                proxy = aa_alloc_proxy(&profile->label, gfp);
                if (!proxy)
                        goto fail;
        } else
                aa_get_proxy(proxy);
        profile->label.proxy = proxy;

        profile->label.hname = profile->base.hname;
        profile->label.flags |= FLAG_PROFILE;
        profile->label.vec[0] = profile;

        /* refcount released by caller */
        return profile;

fail:
        aa_free_profile(profile);

        return NULL;
}

/* TODO: profile accounting - setup in remove */

/**
 * __strn_find_child - find a profile on @head list using substring of @name
 * @head: list to search  (NOT NULL)
 * @name: name of profile (NOT NULL)
 * @len: length of @name substring to match
 *
 * Requires: rcu_read_lock be held
 *
 * Returns: unrefcounted profile ptr, or NULL if not found
 */
static struct aa_profile *__strn_find_child(struct list_head *head,
                                            const char *name, int len)
{
        return (struct aa_profile *)__policy_strn_find(head, name, len);
}

/**
 * __find_child - find a profile on @head list with a name matching @name
 * @head: list to search  (NOT NULL)
 * @name: name of profile (NOT NULL)
 *
 * Requires: rcu_read_lock be held
 *
 * Returns: unrefcounted profile ptr, or NULL if not found
 */
static struct aa_profile *__find_child(struct list_head *head, const char *name)
{
        return __strn_find_child(head, name, strlen(name));
}

/**
 * aa_find_child - find a profile by @name in @parent
 * @parent: profile to search  (NOT NULL)
 * @name: profile name to search for  (NOT NULL)
 *
 * Returns: a refcounted profile or NULL if not found
 */
struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
{
        struct aa_profile *profile;

        rcu_read_lock();
        do {
                profile = __find_child(&parent->base.profiles, name);
        } while (profile && !aa_get_profile_not0(profile));
        rcu_read_unlock();

        /* refcount released by caller */
        return profile;
}

/**
 * __lookup_parent - lookup the parent of a profile of name @hname
 * @ns: namespace to lookup profile in  (NOT NULL)
 * @hname: hierarchical profile name to find parent of  (NOT NULL)
 *
 * Lookups up the parent of a fully qualified profile name, the profile
 * that matches hname does not need to exist, in general this
 * is used to load a new profile.
 *
 * Requires: rcu_read_lock be held
 *
 * Returns: unrefcounted policy or NULL if not found
 */
static struct aa_policy *__lookup_parent(struct aa_ns *ns,
                                         const char *hname)
{
        struct aa_policy *policy;
        struct aa_profile *profile = NULL;
        char *split;

        policy = &ns->base;

        for (split = strstr(hname, "//"); split;) {
                profile = __strn_find_child(&policy->profiles, hname,
                                            split - hname);
                if (!profile)
                        return NULL;
                policy = &profile->base;
                hname = split + 2;
                split = strstr(hname, "//");
        }
        if (!profile)
                return &ns->base;
        return &profile->base;
}

/**
 * __create_missing_ancestors - create place holders for missing ancestores
 * @ns: namespace to lookup profile in (NOT NULL)
 * @hname: hierarchical profile name to find parent of (NOT NULL)
 * @gfp: type of allocation.
 *
 * Requires: ns mutex lock held
 *
 * Return: unrefcounted parent policy on success or %NULL if error creating
 *          place holder profiles.
 */
static struct aa_policy *__create_missing_ancestors(struct aa_ns *ns,
                                                    const char *hname,
                                                    gfp_t gfp)
{
        struct aa_policy *policy;
        struct aa_profile *parent, *profile = NULL;
        char *split;

        AA_BUG(!ns);
        AA_BUG(!hname);

        policy = &ns->base;

        for (split = strstr(hname, "//"); split;) {
                parent = profile;
                profile = __strn_find_child(&policy->profiles, hname,
                                            split - hname);
                if (!profile) {
                        const char *name = kstrndup(hname, split - hname,
                                                    gfp);
                        if (!name)
                                return NULL;
                        profile = aa_alloc_null(parent, name, gfp);
                        kfree(name);
                        if (!profile)
                                return NULL;
                        if (!parent)
                                profile->ns = aa_get_ns(ns);
                }
                policy = &profile->base;
                hname = split + 2;
                split = strstr(hname, "//");
        }
        if (!profile)
                return &ns->base;
        return &profile->base;
}

/**
 * __lookupn_profile - lookup the profile matching @hname
 * @base: base list to start looking up profile name from  (NOT NULL)
 * @hname: hierarchical profile name  (NOT NULL)
 * @n: length of @hname
 *
 * Requires: rcu_read_lock be held
 *
 * Returns: unrefcounted profile pointer or NULL if not found
 *
 * Do a relative name lookup, recursing through profile tree.
 */
static struct aa_profile *__lookupn_profile(struct aa_policy *base,
                                            const char *hname, size_t n)
{
        struct aa_profile *profile = NULL;
        const char *split;

        for (split = strnstr(hname, "//", n); split;
             split = strnstr(hname, "//", n)) {
                profile = __strn_find_child(&base->profiles, hname,
                                            split - hname);
                if (!profile)
                        return NULL;

                base = &profile->base;
                n -= split + 2 - hname;
                hname = split + 2;
        }

        if (n)
                return __strn_find_child(&base->profiles, hname, n);
        return NULL;
}

static struct aa_profile *__lookup_profile(struct aa_policy *base,
                                           const char *hname)
{
        return __lookupn_profile(base, hname, strlen(hname));
}

/**
 * aa_lookupn_profile - find a profile by its full or partial name
 * @ns: the namespace to start from (NOT NULL)
 * @hname: name to do lookup on.  Does not contain namespace prefix (NOT NULL)
 * @n: size of @hname
 *
 * Returns: refcounted profile or NULL if not found
 */
struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname,
                                      size_t n)
{
        struct aa_profile *profile;

        rcu_read_lock();
        do {
                profile = __lookupn_profile(&ns->base, hname, n);
        } while (profile && !aa_get_profile_not0(profile));
        rcu_read_unlock();

        /* the unconfined profile is not in the regular profile list */
        if (!profile && strncmp(hname, "unconfined", n) == 0)
                profile = aa_get_newest_profile(ns->unconfined);

        /* refcount released by caller */
        return profile;
}

struct aa_profile *aa_fqlookupn_profile(struct aa_label *base,
                                        const char *fqname, size_t n)
{
        struct aa_profile *profile;
        struct aa_ns *ns;
        const char *name, *ns_name;
        size_t ns_len;

        name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len);
        if (ns_name) {
                ns = aa_lookupn_ns(labels_ns(base), ns_name, ns_len);
                if (!ns)
                        return NULL;
        } else
                ns = aa_get_ns(labels_ns(base));

        if (name)
                profile = aa_lookupn_profile(ns, name, n - (name - fqname));
        else if (ns)
                /* default profile for ns, currently unconfined */
                profile = aa_get_newest_profile(ns->unconfined);
        else
                profile = NULL;
        aa_put_ns(ns);

        return profile;
}


struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name,
                                 gfp_t gfp)
{
        struct aa_profile *profile;
        struct aa_ruleset *rules;

        profile = aa_alloc_profile(name, NULL, gfp);
        if (!profile)
                return NULL;

        /* TODO: ideally we should inherit abi from parent */
        profile->label.flags |= FLAG_NULL;
        profile->attach.xmatch = aa_get_pdb(nullpdb);
        rules = list_first_entry(&profile->rules, typeof(*rules), list);
        rules->file = aa_get_pdb(nullpdb);
        rules->policy = aa_get_pdb(nullpdb);

        if (parent) {
                profile->path_flags = parent->path_flags;

                /* released on free_profile */
                rcu_assign_pointer(profile->parent, aa_get_profile(parent));
                profile->ns = aa_get_ns(parent->ns);
        }

        return profile;
}

/**
 * aa_new_learning_profile - create or find a null-X learning profile
 * @parent: profile that caused this profile to be created (NOT NULL)
 * @hat: true if the null- learning profile is a hat
 * @base: name to base the null profile off of
 * @gfp: type of allocation
 *
 * Find/Create a null- complain mode profile used in learning mode.  The
 * name of the profile is unique and follows the format of parent//null-XXX.
 * where XXX is based on the @name or if that fails or is not supplied
 * a unique number
 *
 * null profiles are added to the profile list but the list does not
 * hold a count on them so that they are automatically released when
 * not in use.
 *
 * Returns: new refcounted profile else NULL on failure
 */
struct aa_profile *aa_new_learning_profile(struct aa_profile *parent, bool hat,
                                           const char *base, gfp_t gfp)
{
        struct aa_profile *p, *profile;
        const char *bname;
        char *name = NULL;

        AA_BUG(!parent);

        if (base) {
                name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
                               gfp);
                if (name) {
                        sprintf(name, "%s//null-%s", parent->base.hname, base);
                        goto name;
                }
                /* fall through to try shorter uniq */
        }

        name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);
        if (!name)
                return NULL;
        sprintf(name, "%s//null-%x", parent->base.hname,
                atomic_inc_return(&parent->ns->uniq_null));

name:
        /* lookup to see if this is a dup creation */
        bname = basename(name);
        profile = aa_find_child(parent, bname);
        if (profile)
                goto out;

        profile = aa_alloc_null(parent, name, gfp);
        if (!profile)
                goto fail;
        profile->mode = APPARMOR_COMPLAIN;
        if (hat)
                profile->label.flags |= FLAG_HAT;

        mutex_lock_nested(&profile->ns->lock, profile->ns->level);
        p = __find_child(&parent->base.profiles, bname);
        if (p) {
                aa_free_profile(profile);
                profile = aa_get_profile(p);
        } else {
                __add_profile(&parent->base.profiles, profile);
        }
        mutex_unlock(&profile->ns->lock);

        /* refcount released by caller */
out:
        kfree(name);

        return profile;

fail:
        kfree(name);
        aa_free_profile(profile);
        return NULL;
}

/**
 * replacement_allowed - test to see if replacement is allowed
 * @profile: profile to test if it can be replaced  (MAYBE NULL)
 * @noreplace: true if replacement shouldn't be allowed but addition is okay
 * @info: Returns - info about why replacement failed (NOT NULL)
 *
 * Returns: %0 if replacement allowed else error code
 */
static int replacement_allowed(struct aa_profile *profile, int noreplace,
                               const char **info)
{
        if (profile) {
                if (profile->label.flags & FLAG_IMMUTIBLE) {
                        *info = "cannot replace immutable profile";
                        return -EPERM;
                } else if (noreplace) {
                        *info = "profile already exists";
                        return -EEXIST;
                }
        }
        return 0;
}

/* audit callback for net specific fields */
static void audit_cb(struct audit_buffer *ab, void *va)
{
        struct common_audit_data *sa = va;
        struct apparmor_audit_data *ad = aad(sa);

        if (ad->iface.ns) {
                audit_log_format(ab, " ns=");
                audit_log_untrustedstring(ab, ad->iface.ns);
        }
}

/**
 * audit_policy - Do auditing of policy changes
 * @subj_label: label to check if it can manage policy
 * @op: policy operation being performed
 * @ns_name: name of namespace being manipulated
 * @name: name of profile being manipulated (NOT NULL)
 * @info: any extra information to be audited (MAYBE NULL)
 * @error: error code
 *
 * Returns: the error to be returned after audit is done
 */
static int audit_policy(struct aa_label *subj_label, const char *op,
                        const char *ns_name, const char *name,
                        const char *info, int error)
{
        DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, op);

        ad.iface.ns = ns_name;
        ad.name = name;
        ad.info = info;
        ad.error = error;
        ad.subj_label = subj_label;

        aa_audit_msg(AUDIT_APPARMOR_STATUS, &ad, audit_cb);

        return error;
}

/* don't call out to other LSMs in the stack for apparmor policy admin
 * permissions
 */
static int policy_ns_capable(const struct cred *subj_cred,
                             struct aa_label *label,
                             struct user_namespace *userns, int cap)
{
        int err;

        /* check for MAC_ADMIN cap in cred */
        err = cap_capable(subj_cred, userns, cap, CAP_OPT_NONE);
        if (!err)
                err = aa_capable(subj_cred, label, cap, CAP_OPT_NONE);

        return err;
}

/**
 * aa_policy_view_capable - check if viewing policy in at @ns is allowed
 * @subj_cred: cred of subject
 * @label: label that is trying to view policy in ns
 * @ns: namespace being viewed by @label (may be NULL if @label's ns)
 *
 * Returns: true if viewing policy is allowed
 *
 * If @ns is NULL then the namespace being viewed is assumed to be the
 * tasks current namespace.
 */
bool aa_policy_view_capable(const struct cred *subj_cred,
                             struct aa_label *label, struct aa_ns *ns)
{
        struct user_namespace *user_ns = subj_cred->user_ns;
        struct aa_ns *view_ns = labels_view(label);
        bool root_in_user_ns = uid_eq(current_euid(), make_kuid(user_ns, 0)) ||
                               in_egroup_p(make_kgid(user_ns, 0));
        bool response = false;
        if (!ns)
                ns = view_ns;

        if (root_in_user_ns && aa_ns_visible(view_ns, ns, true) &&
            (user_ns == &init_user_ns ||
             (unprivileged_userns_apparmor_policy != 0 &&
              user_ns->level == view_ns->level)))
                response = true;

        return response;
}

bool aa_policy_admin_capable(const struct cred *subj_cred,
                             struct aa_label *label, struct aa_ns *ns)
{
        struct user_namespace *user_ns = subj_cred->user_ns;
        bool capable = policy_ns_capable(subj_cred, label, user_ns,
                                         CAP_MAC_ADMIN) == 0;

        AA_DEBUG("cap_mac_admin? %d\n", capable);
        AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);

        return aa_policy_view_capable(subj_cred, label, ns) && capable &&
                !aa_g_lock_policy;
}

bool aa_current_policy_view_capable(struct aa_ns *ns)
{
        struct aa_label *label;
        bool res;

        label = __begin_current_label_crit_section();
        res = aa_policy_view_capable(current_cred(), label, ns);
        __end_current_label_crit_section(label);

        return res;
}

bool aa_current_policy_admin_capable(struct aa_ns *ns)
{
        struct aa_label *label;
        bool res;

        label = __begin_current_label_crit_section();
        res = aa_policy_admin_capable(current_cred(), label, ns);
        __end_current_label_crit_section(label);

        return res;
}

/**
 * aa_may_manage_policy - can the current task manage policy
 * @subj_cred: subjects cred
 * @label: label to check if it can manage policy
 * @ns: namespace being managed by @label (may be NULL if @label's ns)
 * @mask: contains the policy manipulation operation being done
 *
 * Returns: 0 if the task is allowed to manipulate policy else error
 */
int aa_may_manage_policy(const struct cred *subj_cred, struct aa_label *label,
                         struct aa_ns *ns, u32 mask)
{
        const char *op;

        if (mask & AA_MAY_REMOVE_POLICY)
                op = OP_PROF_RM;
        else if (mask & AA_MAY_REPLACE_POLICY)
                op = OP_PROF_REPL;
        else
                op = OP_PROF_LOAD;

        /* check if loading policy is locked out */
        if (aa_g_lock_policy)
                return audit_policy(label, op, NULL, NULL, "policy_locked",
                                    -EACCES);

        if (!aa_policy_admin_capable(subj_cred, label, ns))
                return audit_policy(label, op, NULL, NULL, "not policy admin",
                                    -EACCES);

        /* TODO: add fine grained mediation of policy loads */
        return 0;
}

static struct aa_profile *__list_lookup_parent(struct list_head *lh,
                                               struct aa_profile *profile)
{
        const char *base = basename(profile->base.hname);
        long len = base - profile->base.hname;
        struct aa_load_ent *ent;

        /* parent won't have trailing // so remove from len */
        if (len <= 2)
                return NULL;
        len -= 2;

        list_for_each_entry(ent, lh, list) {
                if (ent->new == profile)
                        continue;
                if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
                    0 && ent->new->base.hname[len] == 0)
                        return ent->new;
        }

        return NULL;
}

/**
 * __replace_profile - replace @old with @new on a list
 * @old: profile to be replaced  (NOT NULL)
 * @new: profile to replace @old with  (NOT NULL)
 *
 * Will duplicate and refcount elements that @new inherits from @old
 * and will inherit @old children.
 *
 * refcount @new for list, put @old list refcount
 *
 * Requires: namespace list lock be held, or list not be shared
 */
static void __replace_profile(struct aa_profile *old, struct aa_profile *new)
{
        struct aa_profile *child, *tmp;

        if (!list_empty(&old->base.profiles)) {
                LIST_HEAD(lh);
                list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu);

                list_for_each_entry_safe(child, tmp, &lh, base.list) {
                        struct aa_profile *p;

                        list_del_init(&child->base.list);
                        p = __find_child(&new->base.profiles, child->base.name);
                        if (p) {
                                /* @p replaces @child  */
                                __replace_profile(child, p);
                                continue;
                        }

                        /* inherit @child and its children */
                        /* TODO: update hname of inherited children */
                        /* list refcount transferred to @new */
                        p = aa_deref_parent(child);
                        rcu_assign_pointer(child->parent, aa_get_profile(new));
                        list_add_rcu(&child->base.list, &new->base.profiles);
                        aa_put_profile(p);
                }
        }

        if (!rcu_access_pointer(new->parent)) {
                struct aa_profile *parent = aa_deref_parent(old);
                rcu_assign_pointer(new->parent, aa_get_profile(parent));
        }
        aa_label_replace(&old->label, &new->label);
        /* migrate dents must come after label replacement b/c update */
        __aafs_profile_migrate_dents(old, new);

        if (list_empty(&new->base.list)) {
                /* new is not on a list already */
                list_replace_rcu(&old->base.list, &new->base.list);
                aa_get_profile(new);
                aa_put_profile(old);
        } else
                __list_remove_profile(old);
}

/**
 * __lookup_replace - lookup replacement information for a profile
 * @ns: namespace the lookup occurs in
 * @hname: name of profile to lookup
 * @noreplace: true if not replacing an existing profile
 * @p: Returns - profile to be replaced
 * @info: Returns - info string on why lookup failed
 *
 * Returns: profile to replace (no ref) on success else ptr error
 */
static int __lookup_replace(struct aa_ns *ns, const char *hname,
                            bool noreplace, struct aa_profile **p,
                            const char **info)
{
        *p = aa_get_profile(__lookup_profile(&ns->base, hname));
        if (*p) {
                int error = replacement_allowed(*p, noreplace, info);
                if (error) {
                        *info = "profile can not be replaced";
                        return error;
                }
        }

        return 0;
}

static void share_name(struct aa_profile *old, struct aa_profile *new)
{
        aa_put_str(new->base.hname);
        aa_get_str(old->base.hname);
        new->base.hname = old->base.hname;
        new->base.name = old->base.name;
        new->label.hname = old->label.hname;
}

/* Update to newest version of parent after previous replacements
 * Returns: unrefcount newest version of parent
 */
static struct aa_profile *update_to_newest_parent(struct aa_profile *new)
{
        struct aa_profile *parent, *newest;

        parent = rcu_dereference_protected(new->parent,
                                           mutex_is_locked(&new->ns->lock));
        newest = aa_get_newest_profile(parent);

        /* parent replaced in this atomic set? */
        if (newest != parent) {
                aa_put_profile(parent);
                rcu_assign_pointer(new->parent, newest);
        } else
                aa_put_profile(newest);

        return newest;
}

/**
 * aa_replace_profiles - replace profile(s) on the profile list
 * @policy_ns: namespace load is occurring on
 * @label: label that is attempting to load/replace policy
 * @mask: permission mask
 * @udata: serialized data stream  (NOT NULL)
 *
 * unpack and replace a profile on the profile list and uses of that profile
 * by any task creds via invalidating the old version of the profile, which
 * tasks will notice to update their own cred.  If the profile does not exist
 * on the profile list it is added.
 *
 * Returns: size of data consumed else error code on failure.
 */
ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
                            u32 mask, struct aa_loaddata *udata)
{
        const char *ns_name = NULL, *info = NULL;
        struct aa_ns *ns = NULL;
        struct aa_load_ent *ent, *tmp;
        struct aa_loaddata *rawdata_ent;
        const char *op;
        ssize_t count, error;
        LIST_HEAD(lh);

        op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
        aa_get_loaddata(udata);
        /* released below */
        error = aa_unpack(udata, &lh, &ns_name);
        if (error)
                goto out;

        /* ensure that profiles are all for the same ns
         * TODO: update locking to remove this constaint. All profiles in
         *       the load set must succeed as a set or the load will
         *       fail. Sort ent list and take ns locks in hierarchy order
         */
        count = 0;
        list_for_each_entry(ent, &lh, list) {
                if (ns_name) {
                        if (ent->ns_name &&
                            strcmp(ent->ns_name, ns_name) != 0) {
                                info = "policy load has mixed namespaces";
                                error = -EACCES;
                                goto fail;
                        }
                } else if (ent->ns_name) {
                        if (count) {
                                info = "policy load has mixed namespaces";
                                error = -EACCES;
                                goto fail;
                        }
                        ns_name = ent->ns_name;
                } else
                        count++;
        }
        if (ns_name) {
                ns = aa_prepare_ns(policy_ns ? policy_ns : labels_ns(label),
                                   ns_name);
                if (IS_ERR(ns)) {
                        op = OP_PROF_LOAD;
                        info = "failed to prepare namespace";
                        error = PTR_ERR(ns);
                        ns = NULL;
                        ent = NULL;
                        goto fail;
                }
        } else
                ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(label));

        mutex_lock_nested(&ns->lock, ns->level);
        /* check for duplicate rawdata blobs: space and file dedup */
        if (!list_empty(&ns->rawdata_list)) {
                list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) {
                        if (aa_rawdata_eq(rawdata_ent, udata)) {
                                struct aa_loaddata *tmp;

                                tmp = __aa_get_loaddata(rawdata_ent);
                                /* check we didn't fail the race */
                                if (tmp) {
                                        aa_put_loaddata(udata);
                                        udata = tmp;
                                        break;
                                }
                        }
                }
        }
        /* setup parent and ns info */
        list_for_each_entry(ent, &lh, list) {
                struct aa_policy *policy;
                struct aa_profile *p;

                if (aa_g_export_binary)
                        ent->new->rawdata = aa_get_loaddata(udata);
                error = __lookup_replace(ns, ent->new->base.hname,
                                         !(mask & AA_MAY_REPLACE_POLICY),
                                         &ent->old, &info);
                if (error)
                        goto fail_lock;

                if (ent->new->rename) {
                        error = __lookup_replace(ns, ent->new->rename,
                                                !(mask & AA_MAY_REPLACE_POLICY),
                                                &ent->rename, &info);
                        if (error)
                                goto fail_lock;
                }

                /* released when @new is freed */
                ent->new->ns = aa_get_ns(ns);

                if (ent->old || ent->rename)
                        continue;

                /* no ref on policy only use inside lock */
                p = NULL;
                policy = __lookup_parent(ns, ent->new->base.hname);
                if (!policy) {
                        /* first check for parent in the load set */
                        p = __list_lookup_parent(&lh, ent->new);
                        if (!p) {
                                /*
                                 * fill in missing parent with null
                                 * profile that doesn't have
                                 * permissions. This allows for
                                 * individual profile loading where
                                 * the child is loaded before the
                                 * parent, and outside of the current
                                 * atomic set. This unfortunately can
                                 * happen with some userspaces.  The
                                 * null profile will be replaced once
                                 * the parent is loaded.
                                 */
                                policy = __create_missing_ancestors(ns,
                                                        ent->new->base.hname,
                                                        GFP_KERNEL);
                                if (!policy) {
                                        error = -ENOENT;
                                        info = "parent does not exist";
                                        goto fail_lock;
                                }
                        }
                }
                if (!p && policy != &ns->base)
                        /* released on profile replacement or free_profile */
                        p = (struct aa_profile *) policy;
                rcu_assign_pointer(ent->new->parent, aa_get_profile(p));
        }

        /* create new fs entries for introspection if needed */
        if (!udata->dents[AAFS_LOADDATA_DIR] && aa_g_export_binary) {
                error = __aa_fs_create_rawdata(ns, udata);
                if (error) {
                        info = "failed to create raw_data dir and files";
                        ent = NULL;
                        goto fail_lock;
                }
        }
        list_for_each_entry(ent, &lh, list) {
                if (!ent->old) {
                        struct dentry *parent;
                        if (rcu_access_pointer(ent->new->parent)) {
                                struct aa_profile *p;
                                p = aa_deref_parent(ent->new);
                                parent = prof_child_dir(p);
                        } else
                                parent = ns_subprofs_dir(ent->new->ns);
                        error = __aafs_profile_mkdir(ent->new, parent);
                }

                if (error) {
                        info = "failed to create";
                        goto fail_lock;
                }
        }

        /* Done with checks that may fail - do actual replacement */
        __aa_bump_ns_revision(ns);
        if (aa_g_export_binary)
                __aa_loaddata_update(udata, ns->revision);
        list_for_each_entry_safe(ent, tmp, &lh, list) {
                list_del_init(&ent->list);
                op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL;

                if (ent->old && ent->old->rawdata == ent->new->rawdata &&
                    ent->new->rawdata) {
                        /* dedup actual profile replacement */
                        audit_policy(label, op, ns_name, ent->new->base.hname,
                                     "same as current profile, skipping",
                                     error);
                        /* break refcount cycle with proxy. */
                        aa_put_proxy(ent->new->label.proxy);
                        ent->new->label.proxy = NULL;
                        goto skip;
                }

                /*
                 * TODO: finer dedup based on profile range in data. Load set
                 * can differ but profile may remain unchanged
                 */
                audit_policy(label, op, ns_name, ent->new->base.hname, NULL,
                             error);

                if (ent->old) {
                        share_name(ent->old, ent->new);
                        __replace_profile(ent->old, ent->new);
                } else {
                        struct list_head *lh;

                        if (rcu_access_pointer(ent->new->parent)) {
                                struct aa_profile *parent;

                                parent = update_to_newest_parent(ent->new);
                                lh = &parent->base.profiles;
                        } else
                                lh = &ns->base.profiles;
                        __add_profile(lh, ent->new);
                }
        skip:
                aa_load_ent_free(ent);
        }
        __aa_labelset_update_subtree(ns);
        mutex_unlock(&ns->lock);

out:
        aa_put_ns(ns);
        aa_put_loaddata(udata);
        kfree(ns_name);

        if (error)
                return error;
        return udata->size;

fail_lock:
        mutex_unlock(&ns->lock);

        /* audit cause of failure */
        op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
fail:
          audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL,
                       info, error);
        /* audit status that rest of profiles in the atomic set failed too */
        info = "valid profile in failed atomic policy load";
        list_for_each_entry(tmp, &lh, list) {
                if (tmp == ent) {
                        info = "unchecked profile in failed atomic policy load";
                        /* skip entry that caused failure */
                        continue;
                }
                op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL;
                audit_policy(label, op, ns_name, tmp->new->base.hname, info,
                             error);
        }
        list_for_each_entry_safe(ent, tmp, &lh, list) {
                list_del_init(&ent->list);
                aa_load_ent_free(ent);
        }

        goto out;
}

/**
 * aa_remove_profiles - remove profile(s) from the system
 * @policy_ns: namespace the remove is being done from
 * @subj: label attempting to remove policy
 * @fqname: name of the profile or namespace to remove  (NOT NULL)
 * @size: size of the name
 *
 * Remove a profile or sub namespace from the current namespace, so that
 * they can not be found anymore and mark them as replaced by unconfined
 *
 * NOTE: removing confinement does not restore rlimits to preconfinement values
 *
 * Returns: size of data consume else error code if fails
 */
ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
                           char *fqname, size_t size)
{
        struct aa_ns *ns = NULL;
        struct aa_profile *profile = NULL;
        const char *name = fqname, *info = NULL;
        const char *ns_name = NULL;
        ssize_t error = 0;

        if (*fqname == 0) {
                info = "no profile specified";
                error = -ENOENT;
                goto fail;
        }

        if (fqname[0] == ':') {
                size_t ns_len;

                name = aa_splitn_fqname(fqname, size, &ns_name, &ns_len);
                /* released below */
                ns = aa_lookupn_ns(policy_ns ? policy_ns : labels_ns(subj),
                                   ns_name, ns_len);
                if (!ns) {
                        info = "namespace does not exist";
                        error = -ENOENT;
                        goto fail;
                }
        } else
                /* released below */
                ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(subj));

        if (!name) {
                /* remove namespace - can only happen if fqname[0] == ':' */
                mutex_lock_nested(&ns->parent->lock, ns->parent->level);
                __aa_bump_ns_revision(ns);
                __aa_remove_ns(ns);
                mutex_unlock(&ns->parent->lock);
        } else {
                /* remove profile */
                mutex_lock_nested(&ns->lock, ns->level);
                profile = aa_get_profile(__lookup_profile(&ns->base, name));
                if (!profile) {
                        error = -ENOENT;
                        info = "profile does not exist";
                        goto fail_ns_lock;
                }
                name = profile->base.hname;
                __aa_bump_ns_revision(ns);
                __remove_profile(profile);
                __aa_labelset_update_subtree(ns);
                mutex_unlock(&ns->lock);
        }

        /* don't fail removal if audit fails */
        (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
                            error);
        aa_put_ns(ns);
        aa_put_profile(profile);
        return size;

fail_ns_lock:
        mutex_unlock(&ns->lock);
        aa_put_ns(ns);

fail:
        (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
                            error);
        return error;
}






















































































































































































































































 2267 














 2265 





   12 















   13 





























 2266 












 2269 





























 2266 

   13 





 3553 


















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
// SPDX-License-Identifier: GPL-2.0
/*
 * USB-ACPI glue code
 *
 * Copyright 2012 Red Hat <mjg@redhat.com>
 */
#include <linux/module.h>
#include <linux/usb.h>
#include <linux/device.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/acpi.h>
#include <linux/pci.h>
#include <linux/usb/hcd.h>

#include "hub.h"

/**
 * usb_acpi_power_manageable - check whether usb port has
 * acpi power resource.
 * @hdev: USB device belonging to the usb hub
 * @index: port index based zero
 *
 * Return true if the port has acpi power resource and false if no.
 */
bool usb_acpi_power_manageable(struct usb_device *hdev, int index)
{
        acpi_handle port_handle;
        int port1 = index + 1;

        port_handle = usb_get_hub_port_acpi_handle(hdev,
                port1);
        if (port_handle)
                return acpi_bus_power_manageable(port_handle);
        else
                return false;
}
EXPORT_SYMBOL_GPL(usb_acpi_power_manageable);

#define UUID_USB_CONTROLLER_DSM "ce2ee385-00e6-48cb-9f05-2edb927c4899"
#define USB_DSM_DISABLE_U1_U2_FOR_PORT        5

/**
 * usb_acpi_port_lpm_incapable - check if lpm should be disabled for a port.
 * @hdev: USB device belonging to the usb hub
 * @index: zero based port index
 *
 * Some USB3 ports may not support USB3 link power management U1/U2 states
 * due to different retimer setup. ACPI provides _DSM method which returns 0x01
 * if U1 and U2 states should be disabled. Evaluate _DSM with:
 * Arg0: UUID = ce2ee385-00e6-48cb-9f05-2edb927c4899
 * Arg1: Revision ID = 0
 * Arg2: Function Index = 5
 * Arg3: (empty)
 *
 * Return 1 if USB3 port is LPM incapable, negative on error, otherwise 0
 */

int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index)
{
        union acpi_object *obj;
        acpi_handle port_handle;
        int port1 = index + 1;
        guid_t guid;
        int ret;

        ret = guid_parse(UUID_USB_CONTROLLER_DSM, &guid);
        if (ret)
                return ret;

        port_handle = usb_get_hub_port_acpi_handle(hdev, port1);
        if (!port_handle) {
                dev_dbg(&hdev->dev, "port-%d no acpi handle\n", port1);
                return -ENODEV;
        }

        if (!acpi_check_dsm(port_handle, &guid, 0,
                            BIT(USB_DSM_DISABLE_U1_U2_FOR_PORT))) {
                dev_dbg(&hdev->dev, "port-%d no _DSM function %d\n",
                        port1, USB_DSM_DISABLE_U1_U2_FOR_PORT);
                return -ENODEV;
        }

        obj = acpi_evaluate_dsm_typed(port_handle, &guid, 0,
                                      USB_DSM_DISABLE_U1_U2_FOR_PORT, NULL,
                                      ACPI_TYPE_INTEGER);
        if (!obj) {
                dev_dbg(&hdev->dev, "evaluate port-%d _DSM failed\n", port1);
                return -EINVAL;
        }

        if (obj->integer.value == 0x01)
                ret = 1;

        ACPI_FREE(obj);

        return ret;
}
EXPORT_SYMBOL_GPL(usb_acpi_port_lpm_incapable);

/**
 * usb_acpi_set_power_state - control usb port's power via acpi power
 * resource
 * @hdev: USB device belonging to the usb hub
 * @index: port index based zero
 * @enable: power state expected to be set
 *
 * Notice to use usb_acpi_power_manageable() to check whether the usb port
 * has acpi power resource before invoking this function.
 *
 * Returns 0 on success, else negative errno.
 */
int usb_acpi_set_power_state(struct usb_device *hdev, int index, bool enable)
{
        struct usb_hub *hub = usb_hub_to_struct_hub(hdev);
        struct usb_port *port_dev;
        acpi_handle port_handle;
        unsigned char state;
        int port1 = index + 1;
        int error = -EINVAL;

        if (!hub)
                return -ENODEV;
        port_dev = hub->ports[port1 - 1];

        port_handle = (acpi_handle) usb_get_hub_port_acpi_handle(hdev, port1);
        if (!port_handle)
                return error;

        if (enable)
                state = ACPI_STATE_D0;
        else
                state = ACPI_STATE_D3_COLD;

        error = acpi_bus_set_power(port_handle, state);
        if (!error)
                dev_dbg(&port_dev->dev, "acpi: power was set to %d\n", enable);
        else
                dev_dbg(&port_dev->dev, "acpi: power failed to be set\n");

        return error;
}
EXPORT_SYMBOL_GPL(usb_acpi_set_power_state);

/**
 * usb_acpi_add_usb4_devlink - add device link to USB4 Host Interface for tunneled USB3 devices
 *
 * @udev: Tunneled USB3 device connected to a roothub.
 *
 * Adds a device link between a tunneled USB3 device and the USB4 Host Interface
 * device to ensure correct runtime PM suspend and resume order. This function
 * should only be called for tunneled USB3 devices.
 * The USB4 Host Interface this tunneled device depends on is found from the roothub
 * port ACPI device specific data _DSD entry.
 *
 * Return: negative error code on failure, 0 otherwise
 */
static int usb_acpi_add_usb4_devlink(struct usb_device *udev)
{
        const struct device_link *link;
        struct usb_port *port_dev;
        struct usb_hub *hub;

        if (!udev->parent || udev->parent->parent)
                return 0;

        hub = usb_hub_to_struct_hub(udev->parent);
        port_dev = hub->ports[udev->portnum - 1];

        struct fwnode_handle *nhi_fwnode __free(fwnode_handle) =
                fwnode_find_reference(dev_fwnode(&port_dev->dev), "usb4-host-interface", 0);

        if (IS_ERR(nhi_fwnode) || !nhi_fwnode->dev)
                return 0;

        link = device_link_add(&port_dev->child->dev, nhi_fwnode->dev,
                               DL_FLAG_STATELESS |
                               DL_FLAG_RPM_ACTIVE |
                               DL_FLAG_PM_RUNTIME);
        if (!link) {
                dev_err(&port_dev->dev, "Failed to created device link from %s to %s\n",
                        dev_name(&port_dev->child->dev), dev_name(nhi_fwnode->dev));
                return -EINVAL;
        }

        dev_dbg(&port_dev->dev, "Created device link from %s to %s\n",
                dev_name(&port_dev->child->dev), dev_name(nhi_fwnode->dev));

        return 0;
}

/*
 * Private to usb-acpi, all the core needs to know is that
 * port_dev->location is non-zero when it has been set by the firmware.
 */
#define USB_ACPI_LOCATION_VALID (1 << 31)

static void
usb_acpi_get_connect_type(struct usb_port *port_dev, acpi_handle *handle)
{
        enum usb_port_connect_type connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
        union acpi_object *upc = NULL;
        struct acpi_pld_info *pld = NULL;
        acpi_status status;

        /*
         * According to 9.14 in ACPI Spec 6.2. _PLD indicates whether usb port
         * is user visible and _UPC indicates whether it is connectable. If
         * the port was visible and connectable, it could be freely connected
         * and disconnected with USB devices. If no visible and connectable,
         * a usb device is directly hard-wired to the port. If no visible and
         * no connectable, the port would be not used.
         */

        if (acpi_get_physical_device_location(handle, &pld) && pld)
                port_dev->location = USB_ACPI_LOCATION_VALID |
                        pld->group_token << 8 | pld->group_position;

        status = acpi_evaluate_object(handle, "_UPC", NULL, &buffer);
        if (ACPI_FAILURE(status))
                goto out;

        upc = buffer.pointer;
        if (!upc || (upc->type != ACPI_TYPE_PACKAGE) || upc->package.count != 4)
                goto out;

        /* UPC states port is connectable */
        if (upc->package.elements[0].integer.value)
                if (!pld)
                        ; /* keep connect_type as unknown */
                else if (pld->user_visible)
                        connect_type = USB_PORT_CONNECT_TYPE_HOT_PLUG;
                else
                        connect_type = USB_PORT_CONNECT_TYPE_HARD_WIRED;
        else
                connect_type = USB_PORT_NOT_USED;
out:
        port_dev->connect_type = connect_type;
        kfree(upc);
        ACPI_FREE(pld);
}

static struct acpi_device *
usb_acpi_get_companion_for_port(struct usb_port *port_dev)
{
        struct usb_device *udev;
        struct acpi_device *adev;
        acpi_handle *parent_handle;
        int port1;

        /* Get the struct usb_device point of port's hub */
        udev = to_usb_device(port_dev->dev.parent->parent);

        /*
         * The root hub ports' parent is the root hub. The non-root-hub
         * ports' parent is the parent hub port which the hub is
         * connected to.
         */
        if (!udev->parent) {
                adev = ACPI_COMPANION(&udev->dev);
                port1 = usb_hcd_find_raw_port_number(bus_to_hcd(udev->bus),
                                                     port_dev->portnum);
        } else {
                parent_handle = usb_get_hub_port_acpi_handle(udev->parent,
                                                             udev->portnum);
                if (!parent_handle)
                        return NULL;

                adev = acpi_fetch_acpi_dev(parent_handle);
                port1 = port_dev->portnum;
        }

        return acpi_find_child_by_adr(adev, port1);
}

static struct acpi_device *
usb_acpi_find_companion_for_port(struct usb_port *port_dev)
{
        struct acpi_device *adev;

        adev = usb_acpi_get_companion_for_port(port_dev);
        if (!adev)
                return NULL;

        usb_acpi_get_connect_type(port_dev, adev->handle);

        return adev;
}

static struct acpi_device *
usb_acpi_find_companion_for_device(struct usb_device *udev)
{
        struct acpi_device *adev;
        struct usb_port *port_dev;
        struct usb_hub *hub;

        if (!udev->parent) {
                /*
                 * root hub is only child (_ADR=0) under its parent, the HC.
                 * sysdev pointer is the HC as seen from firmware.
                 */
                adev = ACPI_COMPANION(udev->bus->sysdev);
                return acpi_find_child_device(adev, 0, false);
        }

        hub = usb_hub_to_struct_hub(udev->parent);
        if (!hub)
                return NULL;


        /* Tunneled USB3 devices depend on USB4 Host Interface, set device link to it */
        if (udev->speed >= USB_SPEED_SUPER &&
            udev->tunnel_mode != USB_LINK_NATIVE)
                usb_acpi_add_usb4_devlink(udev);

        /*
         * This is an embedded USB device connected to a port and such
         * devices share port's ACPI companion.
         */
        port_dev = hub->ports[udev->portnum - 1];
        return usb_acpi_get_companion_for_port(port_dev);
}

static struct acpi_device *usb_acpi_find_companion(struct device *dev)
{
        /*
         * The USB hierarchy like following:
         *
         * Device (EHC1)
         *        Device (HUBN)
         *                Device (PR01)
         *                        Device (PR11)
         *                        Device (PR12)
         *                                Device (FN12)
         *                                Device (FN13)
         *                        Device (PR13)
         *                        ...
         * where HUBN is root hub, and PRNN are USB ports and devices
         * connected to them, and FNNN are individualk functions for
         * connected composite USB devices. PRNN and FNNN may contain
         * _CRS and other methods describing sideband resources for
         * the connected device.
         *
         * On the kernel side both root hub and embedded USB devices are
         * represented as instances of usb_device structure, and ports
         * are represented as usb_port structures, so the whole process
         * is split into 2 parts: finding companions for devices and
         * finding companions for ports.
         *
         * Note that we do not handle individual functions of composite
         * devices yet, for that we would need to assign companions to
         * devices corresponding to USB interfaces.
         */
        if (is_usb_device(dev))
                return usb_acpi_find_companion_for_device(to_usb_device(dev));
        else if (is_usb_port(dev))
                return usb_acpi_find_companion_for_port(to_usb_port(dev));

        return NULL;
}

static bool usb_acpi_bus_match(struct device *dev)
{
        return is_usb_device(dev) || is_usb_port(dev);
}

static struct acpi_bus_type usb_acpi_bus = {
        .name = "USB",
        .match = usb_acpi_bus_match,
        .find_companion = usb_acpi_find_companion,
};

int usb_acpi_register(void)
{
        return register_acpi_bus_type(&usb_acpi_bus);
}

void usb_acpi_unregister(void)
{
        unregister_acpi_bus_type(&usb_acpi_bus);
}
























































    1 










































































































    6 


























































































































    1 


















    7 





    1 







    6 

    1 






    6 










































































    6 









    1 





    6 


















































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
// SPDX-License-Identifier: GPL-2.0-only
/*
 * linux/net/netfilter/xt_IDLETIMER.c
 *
 * Netfilter module to trigger a timer when packet matches.
 * After timer expires a kevent will be sent.
 *
 * Copyright (C) 2004, 2010 Nokia Corporation
 * Written by Timo Teras <ext-timo.teras@nokia.com>
 *
 * Converted to x_tables and reworked for upstream inclusion
 * by Luciano Coelho <luciano.coelho@nokia.com>
 *
 * Contact: Luciano Coelho <luciano.coelho@nokia.com>
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/timer.h>
#include <linux/alarmtimer.h>
#include <linux/list.h>
#include <linux/mutex.h>
#include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_IDLETIMER.h>
#include <linux/kdev_t.h>
#include <linux/kobject.h>
#include <linux/workqueue.h>
#include <linux/sysfs.h>

struct idletimer_tg {
        struct list_head entry;
        struct alarm alarm;
        struct timer_list timer;
        struct work_struct work;

        struct kobject *kobj;
        struct device_attribute attr;

        unsigned int refcnt;
        u8 timer_type;
};

static LIST_HEAD(idletimer_tg_list);
static DEFINE_MUTEX(list_mutex);

static struct kobject *idletimer_tg_kobj;

static
struct idletimer_tg *__idletimer_tg_find_by_label(const char *label)
{
        struct idletimer_tg *entry;

        list_for_each_entry(entry, &idletimer_tg_list, entry) {
                if (!strcmp(label, entry->attr.attr.name))
                        return entry;
        }

        return NULL;
}

static ssize_t idletimer_tg_show(struct device *dev,
                                 struct device_attribute *attr, char *buf)
{
        struct idletimer_tg *timer;
        unsigned long expires = 0;
        struct timespec64 ktimespec = {};
        long time_diff = 0;

        mutex_lock(&list_mutex);

        timer =        __idletimer_tg_find_by_label(attr->attr.name);
        if (timer) {
                if (timer->timer_type & XT_IDLETIMER_ALARM) {
                        ktime_t expires_alarm = alarm_expires_remaining(&timer->alarm);
                        ktimespec = ktime_to_timespec64(expires_alarm);
                        time_diff = ktimespec.tv_sec;
                } else {
                        expires = timer->timer.expires;
                        time_diff = jiffies_to_msecs(expires - jiffies) / 1000;
                }
        }

        mutex_unlock(&list_mutex);

        if (time_after(expires, jiffies) || ktimespec.tv_sec > 0)
                return sysfs_emit(buf, "%ld\n", time_diff);

        return sysfs_emit(buf, "0\n");
}

static void idletimer_tg_work(struct work_struct *work)
{
        struct idletimer_tg *timer = container_of(work, struct idletimer_tg,
                                                  work);

        sysfs_notify(idletimer_tg_kobj, NULL, timer->attr.attr.name);
}

static void idletimer_tg_expired(struct timer_list *t)
{
        struct idletimer_tg *timer = from_timer(timer, t, timer);

        pr_debug("timer %s expired\n", timer->attr.attr.name);

        schedule_work(&timer->work);
}

static void idletimer_tg_alarmproc(struct alarm *alarm, ktime_t now)
{
        struct idletimer_tg *timer = alarm->data;

        pr_debug("alarm %s expired\n", timer->attr.attr.name);
        schedule_work(&timer->work);
}

static int idletimer_check_sysfs_name(const char *name, unsigned int size)
{
        int ret;

        ret = xt_check_proc_name(name, size);
        if (ret < 0)
                return ret;

        if (!strcmp(name, "power") ||
            !strcmp(name, "subsystem") ||
            !strcmp(name, "uevent"))
                return -EINVAL;

        return 0;
}

static int idletimer_tg_create(struct idletimer_tg_info *info)
{
        int ret;

        info->timer = kzalloc(sizeof(*info->timer), GFP_KERNEL);
        if (!info->timer) {
                ret = -ENOMEM;
                goto out;
        }

        ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
        if (ret < 0)
                goto out_free_timer;

        sysfs_attr_init(&info->timer->attr.attr);
        info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
        if (!info->timer->attr.attr.name) {
                ret = -ENOMEM;
                goto out_free_timer;
        }
        info->timer->attr.attr.mode = 0444;
        info->timer->attr.show = idletimer_tg_show;

        ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
        if (ret < 0) {
                pr_debug("couldn't add file to sysfs");
                goto out_free_attr;
        }

        list_add(&info->timer->entry, &idletimer_tg_list);

        timer_setup(&info->timer->timer, idletimer_tg_expired, 0);
        info->timer->refcnt = 1;

        INIT_WORK(&info->timer->work, idletimer_tg_work);

        mod_timer(&info->timer->timer,
                  msecs_to_jiffies(info->timeout * 1000) + jiffies);

        return 0;

out_free_attr:
        kfree(info->timer->attr.attr.name);
out_free_timer:
        kfree(info->timer);
out:
        return ret;
}

static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
{
        int ret;

        info->timer = kmalloc(sizeof(*info->timer), GFP_KERNEL);
        if (!info->timer) {
                ret = -ENOMEM;
                goto out;
        }

        ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
        if (ret < 0)
                goto out_free_timer;

        sysfs_attr_init(&info->timer->attr.attr);
        info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
        if (!info->timer->attr.attr.name) {
                ret = -ENOMEM;
                goto out_free_timer;
        }
        info->timer->attr.attr.mode = 0444;
        info->timer->attr.show = idletimer_tg_show;

        ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
        if (ret < 0) {
                pr_debug("couldn't add file to sysfs");
                goto out_free_attr;
        }

        /*  notify userspace  */
        kobject_uevent(idletimer_tg_kobj,KOBJ_ADD);

        list_add(&info->timer->entry, &idletimer_tg_list);
        pr_debug("timer type value is %u", info->timer_type);
        info->timer->timer_type = info->timer_type;
        info->timer->refcnt = 1;

        INIT_WORK(&info->timer->work, idletimer_tg_work);

        if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
                ktime_t tout;
                alarm_init(&info->timer->alarm, ALARM_BOOTTIME,
                           idletimer_tg_alarmproc);
                info->timer->alarm.data = info->timer;
                tout = ktime_set(info->timeout, 0);
                alarm_start_relative(&info->timer->alarm, tout);
        } else {
                timer_setup(&info->timer->timer, idletimer_tg_expired, 0);
                mod_timer(&info->timer->timer,
                                msecs_to_jiffies(info->timeout * 1000) + jiffies);
        }

        return 0;

out_free_attr:
        kfree(info->timer->attr.attr.name);
out_free_timer:
        kfree(info->timer);
out:
        return ret;
}

/*
 * The actual xt_tables plugin.
 */
static unsigned int idletimer_tg_target(struct sk_buff *skb,
                                         const struct xt_action_param *par)
{
        const struct idletimer_tg_info *info = par->targinfo;

        pr_debug("resetting timer %s, timeout period %u\n",
                 info->label, info->timeout);

        mod_timer(&info->timer->timer,
                  msecs_to_jiffies(info->timeout * 1000) + jiffies);

        return XT_CONTINUE;
}

/*
 * The actual xt_tables plugin.
 */
static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
                                         const struct xt_action_param *par)
{
        const struct idletimer_tg_info_v1 *info = par->targinfo;

        pr_debug("resetting timer %s, timeout period %u\n",
                 info->label, info->timeout);

        if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
                ktime_t tout = ktime_set(info->timeout, 0);
                alarm_start_relative(&info->timer->alarm, tout);
        } else {
                mod_timer(&info->timer->timer,
                                msecs_to_jiffies(info->timeout * 1000) + jiffies);
        }

        return XT_CONTINUE;
}

static int idletimer_tg_helper(struct idletimer_tg_info *info)
{
        if (info->timeout == 0) {
                pr_debug("timeout value is zero\n");
                return -EINVAL;
        }
        if (info->timeout >= INT_MAX / 1000) {
                pr_debug("timeout value is too big\n");
                return -EINVAL;
        }
        if (info->label[0] == '\0' ||
            strnlen(info->label,
                    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
                pr_debug("label is empty or not nul-terminated\n");
                return -EINVAL;
        }
        return 0;
}


static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
{
        struct idletimer_tg_info *info = par->targinfo;
        int ret;

        pr_debug("checkentry targinfo%s\n", info->label);

        ret = idletimer_tg_helper(info);
        if(ret < 0)
        {
                pr_debug("checkentry helper return invalid\n");
                return -EINVAL;
        }
        mutex_lock(&list_mutex);

        info->timer = __idletimer_tg_find_by_label(info->label);
        if (info->timer) {
                info->timer->refcnt++;
                mod_timer(&info->timer->timer,
                          msecs_to_jiffies(info->timeout * 1000) + jiffies);

                pr_debug("increased refcnt of timer %s to %u\n",
                         info->label, info->timer->refcnt);
        } else {
                ret = idletimer_tg_create(info);
                if (ret < 0) {
                        pr_debug("failed to create timer\n");
                        mutex_unlock(&list_mutex);
                        return ret;
                }
        }

        mutex_unlock(&list_mutex);
        return 0;
}

static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
{
        struct idletimer_tg_info_v1 *info = par->targinfo;
        int ret;

        pr_debug("checkentry targinfo%s\n", info->label);

        if (info->send_nl_msg)
                return -EOPNOTSUPP;

        ret = idletimer_tg_helper((struct idletimer_tg_info *)info);
        if(ret < 0)
        {
                pr_debug("checkentry helper return invalid\n");
                return -EINVAL;
        }

        if (info->timer_type > XT_IDLETIMER_ALARM) {
                pr_debug("invalid value for timer type\n");
                return -EINVAL;
        }

        mutex_lock(&list_mutex);

        info->timer = __idletimer_tg_find_by_label(info->label);
        if (info->timer) {
                if (info->timer->timer_type != info->timer_type) {
                        pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
                        mutex_unlock(&list_mutex);
                        return -EINVAL;
                }

                info->timer->refcnt++;
                if (info->timer_type & XT_IDLETIMER_ALARM) {
                        /* calculate remaining expiry time */
                        ktime_t tout = alarm_expires_remaining(&info->timer->alarm);
                        struct timespec64 ktimespec = ktime_to_timespec64(tout);

                        if (ktimespec.tv_sec > 0) {
                                pr_debug("time_expiry_remaining %lld\n",
                                         ktimespec.tv_sec);
                                alarm_start_relative(&info->timer->alarm, tout);
                        }
                } else {
                                mod_timer(&info->timer->timer,
                                        msecs_to_jiffies(info->timeout * 1000) + jiffies);
                }
                pr_debug("increased refcnt of timer %s to %u\n",
                         info->label, info->timer->refcnt);
        } else {
                ret = idletimer_tg_create_v1(info);
                if (ret < 0) {
                        pr_debug("failed to create timer\n");
                        mutex_unlock(&list_mutex);
                        return ret;
                }
        }

        mutex_unlock(&list_mutex);
        return 0;
}

static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
{
        const struct idletimer_tg_info *info = par->targinfo;

        pr_debug("destroy targinfo %s\n", info->label);

        mutex_lock(&list_mutex);

        if (--info->timer->refcnt > 0) {
                pr_debug("decreased refcnt of timer %s to %u\n",
                         info->label, info->timer->refcnt);
                mutex_unlock(&list_mutex);
                return;
        }

        pr_debug("deleting timer %s\n", info->label);

        list_del(&info->timer->entry);
        mutex_unlock(&list_mutex);

        timer_shutdown_sync(&info->timer->timer);
        cancel_work_sync(&info->timer->work);
        sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
        kfree(info->timer->attr.attr.name);
        kfree(info->timer);
}

static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
{
        const struct idletimer_tg_info_v1 *info = par->targinfo;

        pr_debug("destroy targinfo %s\n", info->label);

        mutex_lock(&list_mutex);

        if (--info->timer->refcnt > 0) {
                pr_debug("decreased refcnt of timer %s to %u\n",
                         info->label, info->timer->refcnt);
                mutex_unlock(&list_mutex);
                return;
        }

        pr_debug("deleting timer %s\n", info->label);

        list_del(&info->timer->entry);
        mutex_unlock(&list_mutex);

        if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
                alarm_cancel(&info->timer->alarm);
        } else {
                timer_shutdown_sync(&info->timer->timer);
        }
        cancel_work_sync(&info->timer->work);
        sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
        kfree(info->timer->attr.attr.name);
        kfree(info->timer);
}


static struct xt_target idletimer_tg[] __read_mostly = {
        {
                .name                = "IDLETIMER",
                .family                = NFPROTO_IPV4,
                .target                = idletimer_tg_target,
                .targetsize     = sizeof(struct idletimer_tg_info),
                .usersize        = offsetof(struct idletimer_tg_info, timer),
                .checkentry        = idletimer_tg_checkentry,
                .destroy        = idletimer_tg_destroy,
                .me                = THIS_MODULE,
        },
        {
                .name                = "IDLETIMER",
                .family                = NFPROTO_IPV4,
                .revision        = 1,
                .target                = idletimer_tg_target_v1,
                .targetsize     = sizeof(struct idletimer_tg_info_v1),
                .usersize        = offsetof(struct idletimer_tg_info_v1, timer),
                .checkentry        = idletimer_tg_checkentry_v1,
                .destroy        = idletimer_tg_destroy_v1,
                .me                = THIS_MODULE,
        },
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
        {
                .name                = "IDLETIMER",
                .family                = NFPROTO_IPV6,
                .target                = idletimer_tg_target,
                .targetsize     = sizeof(struct idletimer_tg_info),
                .usersize        = offsetof(struct idletimer_tg_info, timer),
                .checkentry        = idletimer_tg_checkentry,
                .destroy        = idletimer_tg_destroy,
                .me                = THIS_MODULE,
        },
        {
                .name                = "IDLETIMER",
                .family                = NFPROTO_IPV6,
                .revision        = 1,
                .target                = idletimer_tg_target_v1,
                .targetsize     = sizeof(struct idletimer_tg_info_v1),
                .usersize        = offsetof(struct idletimer_tg_info_v1, timer),
                .checkentry        = idletimer_tg_checkentry_v1,
                .destroy        = idletimer_tg_destroy_v1,
                .me                = THIS_MODULE,
        },
#endif
};

static struct class *idletimer_tg_class;

static struct device *idletimer_tg_device;

static int __init idletimer_tg_init(void)
{
        int err;

        idletimer_tg_class = class_create("xt_idletimer");
        err = PTR_ERR(idletimer_tg_class);
        if (IS_ERR(idletimer_tg_class)) {
                pr_debug("couldn't register device class\n");
                goto out;
        }

        idletimer_tg_device = device_create(idletimer_tg_class, NULL,
                                            MKDEV(0, 0), NULL, "timers");
        err = PTR_ERR(idletimer_tg_device);
        if (IS_ERR(idletimer_tg_device)) {
                pr_debug("couldn't register system device\n");
                goto out_class;
        }

        idletimer_tg_kobj = &idletimer_tg_device->kobj;

        err = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));

        if (err < 0) {
                pr_debug("couldn't register xt target\n");
                goto out_dev;
        }

        return 0;
out_dev:
        device_destroy(idletimer_tg_class, MKDEV(0, 0));
out_class:
        class_destroy(idletimer_tg_class);
out:
        return err;
}

static void __exit idletimer_tg_exit(void)
{
        xt_unregister_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));

        device_destroy(idletimer_tg_class, MKDEV(0, 0));
        class_destroy(idletimer_tg_class);
}

module_init(idletimer_tg_init);
module_exit(idletimer_tg_exit);

MODULE_AUTHOR("Timo Teras <ext-timo.teras@nokia.com>");
MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
MODULE_DESCRIPTION("Xtables: idle time monitor");
MODULE_LICENSE("GPL v2");
MODULE_ALIAS("ipt_IDLETIMER");
MODULE_ALIAS("ip6t_IDLETIMER");




















































    8 

    8 

    4 

















  175 















    5 




   90 


    1 


   77 
    1 

    1 









   35 






  135 






    9 








  120 
   41 




























   61 












    7 






    2 






   13 


    1 


   39 




   32 


   18 
    2 







    1 








   46 








    3 























    2 






    1 




    1 

















   10 





    2 


    1 




    7 
























   10 





    1 




    4 






    5 






    2 




    6 





















   13 





    7 

    1 


    4 
    2 









   10 


















    7 











    1 

    1 

    2 









    4 




    3 















    7 









    1 


    1 

    1 









    4 



    4 


















    9 





    1 





    1 



    7 




















    7 






    1 





    1 





    5 
























   22 



    1 




    3 



    1 





    1 



   16 


























    8 







    5 


    2 

    1 































    2 
    3 


























   29 






    4 





    2 






    3 





   14 


    6 
    1 







    1 






   14 














    5 



    1 
























    3 
   21 















   25 








    1 












   22 








    8 






    2 






    8 




















    9 

   13 





   16 





   12 









    6 





    3 



























   17 

















    1 




    3 














   15 




   15 


   12 




    8 














    2 




    6 













    6 









    1 
   13 

   14 





    9 
    7 


















    8 





    1 




    2 











    7 

    6 


























































    1 

















    4 



    1 









    4 






    5 
























































    2 









    2 


    1 















    3 









    2 

    2 




















    1 




















    4 








    4 











    1 



































   11 












    6 


    2 





    2 









































    4 






    2 


    1 

    1 




















    2 

























    2 





    1 




    1 










    1 
























    8 






    5 
    2 






    1 














    3 
    2 































    9 









    2 




































    2 







    1 


    1 





    5 
    1 




    4 









    8 
    1 
    4 
    5 




















   32 







    3 



    1 


    4 




   21 
    2 



    6 

















   26 







    1 



    1 





    8 





    4 



    6 















    4 
    6 










    2 


    6 





















    7 


    1 


    1 

    5 



































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
// SPDX-License-Identifier: GPL-2.0-or-later
/* Userspace key control operations
 *
 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#include <linux/init.h>
#include <linux/sched.h>
#include <linux/sched/task.h>
#include <linux/slab.h>
#include <linux/syscalls.h>
#include <linux/key.h>
#include <linux/keyctl.h>
#include <linux/fs.h>
#include <linux/capability.h>
#include <linux/cred.h>
#include <linux/string.h>
#include <linux/err.h>
#include <linux/vmalloc.h>
#include <linux/security.h>
#include <linux/uio.h>
#include <linux/uaccess.h>
#include <keys/request_key_auth-type.h>
#include "internal.h"

#define KEY_MAX_DESC_SIZE 4096

static const unsigned char keyrings_capabilities[2] = {
        [0] = (KEYCTL_CAPS0_CAPABILITIES |
               (IS_ENABLED(CONFIG_PERSISTENT_KEYRINGS)        ? KEYCTL_CAPS0_PERSISTENT_KEYRINGS : 0) |
               (IS_ENABLED(CONFIG_KEY_DH_OPERATIONS)        ? KEYCTL_CAPS0_DIFFIE_HELLMAN : 0) |
               (IS_ENABLED(CONFIG_ASYMMETRIC_KEY_TYPE)        ? KEYCTL_CAPS0_PUBLIC_KEY : 0) |
               (IS_ENABLED(CONFIG_BIG_KEYS)                ? KEYCTL_CAPS0_BIG_KEY : 0) |
               KEYCTL_CAPS0_INVALIDATE |
               KEYCTL_CAPS0_RESTRICT_KEYRING |
               KEYCTL_CAPS0_MOVE
               ),
        [1] = (KEYCTL_CAPS1_NS_KEYRING_NAME |
               KEYCTL_CAPS1_NS_KEY_TAG |
               (IS_ENABLED(CONFIG_KEY_NOTIFICATIONS)        ? KEYCTL_CAPS1_NOTIFICATIONS : 0)
               ),
};

static int key_get_type_from_user(char *type,
                                  const char __user *_type,
                                  unsigned len)
{
        int ret;

        ret = strncpy_from_user(type, _type, len);
        if (ret < 0)
                return ret;
        if (ret == 0 || ret >= len)
                return -EINVAL;
        if (type[0] == '.')
                return -EPERM;
        type[len - 1] = '\0';
        return 0;
}

/*
 * Extract the description of a new key from userspace and either add it as a
 * new key to the specified keyring or update a matching key in that keyring.
 *
 * If the description is NULL or an empty string, the key type is asked to
 * generate one from the payload.
 *
 * The keyring must be writable so that we can attach the key to it.
 *
 * If successful, the new key's serial number is returned, otherwise an error
 * code is returned.
 */
SYSCALL_DEFINE5(add_key, const char __user *, _type,
                const char __user *, _description,
                const void __user *, _payload,
                size_t, plen,
                key_serial_t, ringid)
{
        key_ref_t keyring_ref, key_ref;
        char type[32], *description;
        void *payload;
        long ret;

        ret = -EINVAL;
        if (plen > 1024 * 1024 - 1)
                goto error;

        /* draw all the data into kernel space */
        ret = key_get_type_from_user(type, _type, sizeof(type));
        if (ret < 0)
                goto error;

        description = NULL;
        if (_description) {
                description = strndup_user(_description, KEY_MAX_DESC_SIZE);
                if (IS_ERR(description)) {
                        ret = PTR_ERR(description);
                        goto error;
                }
                if (!*description) {
                        kfree(description);
                        description = NULL;
                } else if ((description[0] == '.') &&
                           (strncmp(type, "keyring", 7) == 0)) {
                        ret = -EPERM;
                        goto error2;
                }
        }

        /* pull the payload in if one was supplied */
        payload = NULL;

        if (plen) {
                ret = -ENOMEM;
                payload = kvmalloc(plen, GFP_KERNEL);
                if (!payload)
                        goto error2;

                ret = -EFAULT;
                if (copy_from_user(payload, _payload, plen) != 0)
                        goto error3;
        }

        /* find the target keyring (which must be writable) */
        keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error3;
        }

        /* create or update the requested key and add it to the target
         * keyring */
        key_ref = key_create_or_update(keyring_ref, type, description,
                                       payload, plen, KEY_PERM_UNDEF,
                                       KEY_ALLOC_IN_QUOTA);
        if (!IS_ERR(key_ref)) {
                ret = key_ref_to_ptr(key_ref)->serial;
                key_ref_put(key_ref);
        }
        else {
                ret = PTR_ERR(key_ref);
        }

        key_ref_put(keyring_ref);
 error3:
        kvfree_sensitive(payload, plen);
 error2:
        kfree(description);
 error:
        return ret;
}

/*
 * Search the process keyrings and keyring trees linked from those for a
 * matching key.  Keyrings must have appropriate Search permission to be
 * searched.
 *
 * If a key is found, it will be attached to the destination keyring if there's
 * one specified and the serial number of the key will be returned.
 *
 * If no key is found, /sbin/request-key will be invoked if _callout_info is
 * non-NULL in an attempt to create a key.  The _callout_info string will be
 * passed to /sbin/request-key to aid with completing the request.  If the
 * _callout_info string is "" then it will be changed to "-".
 */
SYSCALL_DEFINE4(request_key, const char __user *, _type,
                const char __user *, _description,
                const char __user *, _callout_info,
                key_serial_t, destringid)
{
        struct key_type *ktype;
        struct key *key;
        key_ref_t dest_ref;
        size_t callout_len;
        char type[32], *description, *callout_info;
        long ret;

        /* pull the type into kernel space */
        ret = key_get_type_from_user(type, _type, sizeof(type));
        if (ret < 0)
                goto error;

        /* pull the description into kernel space */
        description = strndup_user(_description, KEY_MAX_DESC_SIZE);
        if (IS_ERR(description)) {
                ret = PTR_ERR(description);
                goto error;
        }

        /* pull the callout info into kernel space */
        callout_info = NULL;
        callout_len = 0;
        if (_callout_info) {
                callout_info = strndup_user(_callout_info, PAGE_SIZE);
                if (IS_ERR(callout_info)) {
                        ret = PTR_ERR(callout_info);
                        goto error2;
                }
                callout_len = strlen(callout_info);
        }

        /* get the destination keyring if specified */
        dest_ref = NULL;
        if (destringid) {
                dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
                                           KEY_NEED_WRITE);
                if (IS_ERR(dest_ref)) {
                        ret = PTR_ERR(dest_ref);
                        goto error3;
                }
        }

        /* find the key type */
        ktype = key_type_lookup(type);
        if (IS_ERR(ktype)) {
                ret = PTR_ERR(ktype);
                goto error4;
        }

        /* do the search */
        key = request_key_and_link(ktype, description, NULL, callout_info,
                                   callout_len, NULL, key_ref_to_ptr(dest_ref),
                                   KEY_ALLOC_IN_QUOTA);
        if (IS_ERR(key)) {
                ret = PTR_ERR(key);
                goto error5;
        }

        /* wait for the key to finish being constructed */
        ret = wait_for_key_construction(key, 1);
        if (ret < 0)
                goto error6;

        ret = key->serial;

error6:
         key_put(key);
error5:
        key_type_put(ktype);
error4:
        key_ref_put(dest_ref);
error3:
        kfree(callout_info);
error2:
        kfree(description);
error:
        return ret;
}

/*
 * Get the ID of the specified process keyring.
 *
 * The requested keyring must have search permission to be found.
 *
 * If successful, the ID of the requested keyring will be returned.
 */
long keyctl_get_keyring_ID(key_serial_t id, int create)
{
        key_ref_t key_ref;
        unsigned long lflags;
        long ret;

        lflags = create ? KEY_LOOKUP_CREATE : 0;
        key_ref = lookup_user_key(id, lflags, KEY_NEED_SEARCH);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
        }

        ret = key_ref_to_ptr(key_ref)->serial;
        key_ref_put(key_ref);
error:
        return ret;
}

/*
 * Join a (named) session keyring.
 *
 * Create and join an anonymous session keyring or join a named session
 * keyring, creating it if necessary.  A named session keyring must have Search
 * permission for it to be joined.  Session keyrings without this permit will
 * be skipped over.  It is not permitted for userspace to create or join
 * keyrings whose name begin with a dot.
 *
 * If successful, the ID of the joined session keyring will be returned.
 */
long keyctl_join_session_keyring(const char __user *_name)
{
        char *name;
        long ret;

        /* fetch the name from userspace */
        name = NULL;
        if (_name) {
                name = strndup_user(_name, KEY_MAX_DESC_SIZE);
                if (IS_ERR(name)) {
                        ret = PTR_ERR(name);
                        goto error;
                }

                ret = -EPERM;
                if (name[0] == '.')
                        goto error_name;
        }

        /* join the session */
        ret = join_session_keyring(name);
error_name:
        kfree(name);
error:
        return ret;
}

/*
 * Update a key's data payload from the given data.
 *
 * The key must grant the caller Write permission and the key type must support
 * updating for this to work.  A negative key can be positively instantiated
 * with this call.
 *
 * If successful, 0 will be returned.  If the key type does not support
 * updating, then -EOPNOTSUPP will be returned.
 */
long keyctl_update_key(key_serial_t id,
                       const void __user *_payload,
                       size_t plen)
{
        key_ref_t key_ref;
        void *payload;
        long ret;

        ret = -EINVAL;
        if (plen > PAGE_SIZE)
                goto error;

        /* pull the payload in if one was supplied */
        payload = NULL;
        if (plen) {
                ret = -ENOMEM;
                payload = kvmalloc(plen, GFP_KERNEL);
                if (!payload)
                        goto error;

                ret = -EFAULT;
                if (copy_from_user(payload, _payload, plen) != 0)
                        goto error2;
        }

        /* find the target key (which must be writable) */
        key_ref = lookup_user_key(id, 0, KEY_NEED_WRITE);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error2;
        }

        /* update the key */
        ret = key_update(key_ref, payload, plen);

        key_ref_put(key_ref);
error2:
        kvfree_sensitive(payload, plen);
error:
        return ret;
}

/*
 * Revoke a key.
 *
 * The key must be grant the caller Write or Setattr permission for this to
 * work.  The key type should give up its quota claim when revoked.  The key
 * and any links to the key will be automatically garbage collected after a
 * certain amount of time (/proc/sys/kernel/keys/gc_delay).
 *
 * Keys with KEY_FLAG_KEEP set should not be revoked.
 *
 * If successful, 0 is returned.
 */
long keyctl_revoke_key(key_serial_t id)
{
        key_ref_t key_ref;
        struct key *key;
        long ret;

        key_ref = lookup_user_key(id, 0, KEY_NEED_WRITE);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                if (ret != -EACCES)
                        goto error;
                key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR);
                if (IS_ERR(key_ref)) {
                        ret = PTR_ERR(key_ref);
                        goto error;
                }
        }

        key = key_ref_to_ptr(key_ref);
        ret = 0;
        if (test_bit(KEY_FLAG_KEEP, &key->flags))
                ret = -EPERM;
        else
                key_revoke(key);

        key_ref_put(key_ref);
error:
        return ret;
}

/*
 * Invalidate a key.
 *
 * The key must be grant the caller Invalidate permission for this to work.
 * The key and any links to the key will be automatically garbage collected
 * immediately.
 *
 * Keys with KEY_FLAG_KEEP set should not be invalidated.
 *
 * If successful, 0 is returned.
 */
long keyctl_invalidate_key(key_serial_t id)
{
        key_ref_t key_ref;
        struct key *key;
        long ret;

        kenter("%d", id);

        key_ref = lookup_user_key(id, 0, KEY_NEED_SEARCH);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);

                /* Root is permitted to invalidate certain special keys */
                if (capable(CAP_SYS_ADMIN)) {
                        key_ref = lookup_user_key(id, 0, KEY_SYSADMIN_OVERRIDE);
                        if (IS_ERR(key_ref))
                                goto error;
                        if (test_bit(KEY_FLAG_ROOT_CAN_INVAL,
                                     &key_ref_to_ptr(key_ref)->flags))
                                goto invalidate;
                        goto error_put;
                }

                goto error;
        }

invalidate:
        key = key_ref_to_ptr(key_ref);
        ret = 0;
        if (test_bit(KEY_FLAG_KEEP, &key->flags))
                ret = -EPERM;
        else
                key_invalidate(key);
error_put:
        key_ref_put(key_ref);
error:
        kleave(" = %ld", ret);
        return ret;
}

/*
 * Clear the specified keyring, creating an empty process keyring if one of the
 * special keyring IDs is used.
 *
 * The keyring must grant the caller Write permission and not have
 * KEY_FLAG_KEEP set for this to work.  If successful, 0 will be returned.
 */
long keyctl_keyring_clear(key_serial_t ringid)
{
        key_ref_t keyring_ref;
        struct key *keyring;
        long ret;

        keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);

                /* Root is permitted to invalidate certain special keyrings */
                if (capable(CAP_SYS_ADMIN)) {
                        keyring_ref = lookup_user_key(ringid, 0,
                                                      KEY_SYSADMIN_OVERRIDE);
                        if (IS_ERR(keyring_ref))
                                goto error;
                        if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR,
                                     &key_ref_to_ptr(keyring_ref)->flags))
                                goto clear;
                        goto error_put;
                }

                goto error;
        }

clear:
        keyring = key_ref_to_ptr(keyring_ref);
        if (test_bit(KEY_FLAG_KEEP, &keyring->flags))
                ret = -EPERM;
        else
                ret = keyring_clear(keyring);
error_put:
        key_ref_put(keyring_ref);
error:
        return ret;
}

/*
 * Create a link from a keyring to a key if there's no matching key in the
 * keyring, otherwise replace the link to the matching key with a link to the
 * new key.
 *
 * The key must grant the caller Link permission and the keyring must grant
 * the caller Write permission.  Furthermore, if an additional link is created,
 * the keyring's quota will be extended.
 *
 * If successful, 0 will be returned.
 */
long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
{
        key_ref_t keyring_ref, key_ref;
        long ret;

        keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error;
        }

        key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_NEED_LINK);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error2;
        }

        ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));

        key_ref_put(key_ref);
error2:
        key_ref_put(keyring_ref);
error:
        return ret;
}

/*
 * Unlink a key from a keyring.
 *
 * The keyring must grant the caller Write permission for this to work; the key
 * itself need not grant the caller anything.  If the last link to a key is
 * removed then that key will be scheduled for destruction.
 *
 * Keys or keyrings with KEY_FLAG_KEEP set should not be unlinked.
 *
 * If successful, 0 will be returned.
 */
long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
{
        key_ref_t keyring_ref, key_ref;
        struct key *keyring, *key;
        long ret;

        keyring_ref = lookup_user_key(ringid, 0, KEY_NEED_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error;
        }

        key_ref = lookup_user_key(id, KEY_LOOKUP_PARTIAL, KEY_NEED_UNLINK);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error2;
        }

        keyring = key_ref_to_ptr(keyring_ref);
        key = key_ref_to_ptr(key_ref);
        if (test_bit(KEY_FLAG_KEEP, &keyring->flags) &&
            test_bit(KEY_FLAG_KEEP, &key->flags))
                ret = -EPERM;
        else
                ret = key_unlink(keyring, key);

        key_ref_put(key_ref);
error2:
        key_ref_put(keyring_ref);
error:
        return ret;
}

/*
 * Move a link to a key from one keyring to another, displacing any matching
 * key from the destination keyring.
 *
 * The key must grant the caller Link permission and both keyrings must grant
 * the caller Write permission.  There must also be a link in the from keyring
 * to the key.  If both keyrings are the same, nothing is done.
 *
 * If successful, 0 will be returned.
 */
long keyctl_keyring_move(key_serial_t id, key_serial_t from_ringid,
                         key_serial_t to_ringid, unsigned int flags)
{
        key_ref_t key_ref, from_ref, to_ref;
        long ret;

        if (flags & ~KEYCTL_MOVE_EXCL)
                return -EINVAL;

        key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_NEED_LINK);
        if (IS_ERR(key_ref))
                return PTR_ERR(key_ref);

        from_ref = lookup_user_key(from_ringid, 0, KEY_NEED_WRITE);
        if (IS_ERR(from_ref)) {
                ret = PTR_ERR(from_ref);
                goto error2;
        }

        to_ref = lookup_user_key(to_ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE);
        if (IS_ERR(to_ref)) {
                ret = PTR_ERR(to_ref);
                goto error3;
        }

        ret = key_move(key_ref_to_ptr(key_ref), key_ref_to_ptr(from_ref),
                       key_ref_to_ptr(to_ref), flags);

        key_ref_put(to_ref);
error3:
        key_ref_put(from_ref);
error2:
        key_ref_put(key_ref);
        return ret;
}

/*
 * Return a description of a key to userspace.
 *
 * The key must grant the caller View permission for this to work.
 *
 * If there's a buffer, we place up to buflen bytes of data into it formatted
 * in the following way:
 *
 *        type;uid;gid;perm;description<NUL>
 *
 * If successful, we return the amount of description available, irrespective
 * of how much we may have copied into the buffer.
 */
long keyctl_describe_key(key_serial_t keyid,
                         char __user *buffer,
                         size_t buflen)
{
        struct key *key, *instkey;
        key_ref_t key_ref;
        char *infobuf;
        long ret;
        int desclen, infolen;

        key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW);
        if (IS_ERR(key_ref)) {
                /* viewing a key under construction is permitted if we have the
                 * authorisation token handy */
                if (PTR_ERR(key_ref) == -EACCES) {
                        instkey = key_get_instantiation_authkey(keyid);
                        if (!IS_ERR(instkey)) {
                                key_put(instkey);
                                key_ref = lookup_user_key(keyid,
                                                          KEY_LOOKUP_PARTIAL,
                                                          KEY_AUTHTOKEN_OVERRIDE);
                                if (!IS_ERR(key_ref))
                                        goto okay;
                        }
                }

                ret = PTR_ERR(key_ref);
                goto error;
        }

okay:
        key = key_ref_to_ptr(key_ref);
        desclen = strlen(key->description);

        /* calculate how much information we're going to return */
        ret = -ENOMEM;
        infobuf = kasprintf(GFP_KERNEL,
                            "%s;%d;%d;%08x;",
                            key->type->name,
                            from_kuid_munged(current_user_ns(), key->uid),
                            from_kgid_munged(current_user_ns(), key->gid),
                            key->perm);
        if (!infobuf)
                goto error2;
        infolen = strlen(infobuf);
        ret = infolen + desclen + 1;

        /* consider returning the data */
        if (buffer && buflen >= ret) {
                if (copy_to_user(buffer, infobuf, infolen) != 0 ||
                    copy_to_user(buffer + infolen, key->description,
                                 desclen + 1) != 0)
                        ret = -EFAULT;
        }

        kfree(infobuf);
error2:
        key_ref_put(key_ref);
error:
        return ret;
}

/*
 * Search the specified keyring and any keyrings it links to for a matching
 * key.  Only keyrings that grant the caller Search permission will be searched
 * (this includes the starting keyring).  Only keys with Search permission can
 * be found.
 *
 * If successful, the found key will be linked to the destination keyring if
 * supplied and the key has Link permission, and the found key ID will be
 * returned.
 */
long keyctl_keyring_search(key_serial_t ringid,
                           const char __user *_type,
                           const char __user *_description,
                           key_serial_t destringid)
{
        struct key_type *ktype;
        key_ref_t keyring_ref, key_ref, dest_ref;
        char type[32], *description;
        long ret;

        /* pull the type and description into kernel space */
        ret = key_get_type_from_user(type, _type, sizeof(type));
        if (ret < 0)
                goto error;

        description = strndup_user(_description, KEY_MAX_DESC_SIZE);
        if (IS_ERR(description)) {
                ret = PTR_ERR(description);
                goto error;
        }

        /* get the keyring at which to begin the search */
        keyring_ref = lookup_user_key(ringid, 0, KEY_NEED_SEARCH);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error2;
        }

        /* get the destination keyring if specified */
        dest_ref = NULL;
        if (destringid) {
                dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
                                           KEY_NEED_WRITE);
                if (IS_ERR(dest_ref)) {
                        ret = PTR_ERR(dest_ref);
                        goto error3;
                }
        }

        /* find the key type */
        ktype = key_type_lookup(type);
        if (IS_ERR(ktype)) {
                ret = PTR_ERR(ktype);
                goto error4;
        }

        /* do the search */
        key_ref = keyring_search(keyring_ref, ktype, description, true);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);

                /* treat lack or presence of a negative key the same */
                if (ret == -EAGAIN)
                        ret = -ENOKEY;
                goto error5;
        }

        /* link the resulting key to the destination keyring if we can */
        if (dest_ref) {
                ret = key_permission(key_ref, KEY_NEED_LINK);
                if (ret < 0)
                        goto error6;

                ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
                if (ret < 0)
                        goto error6;
        }

        ret = key_ref_to_ptr(key_ref)->serial;

error6:
        key_ref_put(key_ref);
error5:
        key_type_put(ktype);
error4:
        key_ref_put(dest_ref);
error3:
        key_ref_put(keyring_ref);
error2:
        kfree(description);
error:
        return ret;
}

/*
 * Call the read method
 */
static long __keyctl_read_key(struct key *key, char *buffer, size_t buflen)
{
        long ret;

        down_read(&key->sem);
        ret = key_validate(key);
        if (ret == 0)
                ret = key->type->read(key, buffer, buflen);
        up_read(&key->sem);
        return ret;
}

/*
 * Read a key's payload.
 *
 * The key must either grant the caller Read permission, or it must grant the
 * caller Search permission when searched for from the process keyrings.
 *
 * If successful, we place up to buflen bytes of data into the buffer, if one
 * is provided, and return the amount of data that is available in the key,
 * irrespective of how much we copied into the buffer.
 */
long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
{
        struct key *key;
        key_ref_t key_ref;
        long ret;
        char *key_data = NULL;
        size_t key_data_len;

        /* find the key first */
        key_ref = lookup_user_key(keyid, 0, KEY_DEFER_PERM_CHECK);
        if (IS_ERR(key_ref)) {
                ret = -ENOKEY;
                goto out;
        }

        key = key_ref_to_ptr(key_ref);

        ret = key_read_state(key);
        if (ret < 0)
                goto key_put_out; /* Negatively instantiated */

        /* see if we can read it directly */
        ret = key_permission(key_ref, KEY_NEED_READ);
        if (ret == 0)
                goto can_read_key;
        if (ret != -EACCES)
                goto key_put_out;

        /* we can't; see if it's searchable from this process's keyrings
         * - we automatically take account of the fact that it may be
         *   dangling off an instantiation key
         */
        if (!is_key_possessed(key_ref)) {
                ret = -EACCES;
                goto key_put_out;
        }

        /* the key is probably readable - now try to read it */
can_read_key:
        if (!key->type->read) {
                ret = -EOPNOTSUPP;
                goto key_put_out;
        }

        if (!buffer || !buflen) {
                /* Get the key length from the read method */
                ret = __keyctl_read_key(key, NULL, 0);
                goto key_put_out;
        }

        /*
         * Read the data with the semaphore held (since we might sleep)
         * to protect against the key being updated or revoked.
         *
         * Allocating a temporary buffer to hold the keys before
         * transferring them to user buffer to avoid potential
         * deadlock involving page fault and mmap_lock.
         *
         * key_data_len = (buflen <= PAGE_SIZE)
         *                ? buflen : actual length of key data
         *
         * This prevents allocating arbitrary large buffer which can
         * be much larger than the actual key length. In the latter case,
         * at least 2 passes of this loop is required.
         */
        key_data_len = (buflen <= PAGE_SIZE) ? buflen : 0;
        for (;;) {
                if (key_data_len) {
                        key_data = kvmalloc(key_data_len, GFP_KERNEL);
                        if (!key_data) {
                                ret = -ENOMEM;
                                goto key_put_out;
                        }
                }

                ret = __keyctl_read_key(key, key_data, key_data_len);

                /*
                 * Read methods will just return the required length without
                 * any copying if the provided length isn't large enough.
                 */
                if (ret <= 0 || ret > buflen)
                        break;

                /*
                 * The key may change (unlikely) in between 2 consecutive
                 * __keyctl_read_key() calls. In this case, we reallocate
                 * a larger buffer and redo the key read when
                 * key_data_len < ret <= buflen.
                 */
                if (ret > key_data_len) {
                        if (unlikely(key_data))
                                kvfree_sensitive(key_data, key_data_len);
                        key_data_len = ret;
                        continue;        /* Allocate buffer */
                }

                if (copy_to_user(buffer, key_data, ret))
                        ret = -EFAULT;
                break;
        }
        kvfree_sensitive(key_data, key_data_len);

key_put_out:
        key_put(key);
out:
        return ret;
}

/*
 * Change the ownership of a key
 *
 * The key must grant the caller Setattr permission for this to work, though
 * the key need not be fully instantiated yet.  For the UID to be changed, or
 * for the GID to be changed to a group the caller is not a member of, the
 * caller must have sysadmin capability.  If either uid or gid is -1 then that
 * attribute is not changed.
 *
 * If the UID is to be changed, the new user must have sufficient quota to
 * accept the key.  The quota deduction will be removed from the old user to
 * the new user should the attribute be changed.
 *
 * If successful, 0 will be returned.
 */
long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
{
        struct key_user *newowner, *zapowner = NULL;
        struct key *key;
        key_ref_t key_ref;
        long ret;
        kuid_t uid;
        kgid_t gid;
        unsigned long flags;

        uid = make_kuid(current_user_ns(), user);
        gid = make_kgid(current_user_ns(), group);
        ret = -EINVAL;
        if ((user != (uid_t) -1) && !uid_valid(uid))
                goto error;
        if ((group != (gid_t) -1) && !gid_valid(gid))
                goto error;

        ret = 0;
        if (user == (uid_t) -1 && group == (gid_t) -1)
                goto error;

        key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
                                  KEY_NEED_SETATTR);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
        }

        key = key_ref_to_ptr(key_ref);

        /* make the changes with the locks held to prevent chown/chown races */
        ret = -EACCES;
        down_write(&key->sem);

        {
                bool is_privileged_op = false;

                /* only the sysadmin can chown a key to some other UID */
                if (user != (uid_t) -1 && !uid_eq(key->uid, uid))
                        is_privileged_op = true;

                /* only the sysadmin can set the key's GID to a group other
                 * than one of those that the current process subscribes to */
                if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid))
                        is_privileged_op = true;

                if (is_privileged_op && !capable(CAP_SYS_ADMIN))
                        goto error_put;
        }

        /* change the UID */
        if (user != (uid_t) -1 && !uid_eq(uid, key->uid)) {
                ret = -ENOMEM;
                newowner = key_user_lookup(uid);
                if (!newowner)
                        goto error_put;

                /* transfer the quota burden to the new user */
                if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
                        unsigned maxkeys = uid_eq(uid, GLOBAL_ROOT_UID) ?
                                key_quota_root_maxkeys : key_quota_maxkeys;
                        unsigned maxbytes = uid_eq(uid, GLOBAL_ROOT_UID) ?
                                key_quota_root_maxbytes : key_quota_maxbytes;

                        spin_lock_irqsave(&newowner->lock, flags);
                        if (newowner->qnkeys + 1 > maxkeys ||
                            newowner->qnbytes + key->quotalen > maxbytes ||
                            newowner->qnbytes + key->quotalen <
                            newowner->qnbytes)
                                goto quota_overrun;

                        newowner->qnkeys++;
                        newowner->qnbytes += key->quotalen;
                        spin_unlock_irqrestore(&newowner->lock, flags);

                        spin_lock_irqsave(&key->user->lock, flags);
                        key->user->qnkeys--;
                        key->user->qnbytes -= key->quotalen;
                        spin_unlock_irqrestore(&key->user->lock, flags);
                }

                atomic_dec(&key->user->nkeys);
                atomic_inc(&newowner->nkeys);

                if (key->state != KEY_IS_UNINSTANTIATED) {
                        atomic_dec(&key->user->nikeys);
                        atomic_inc(&newowner->nikeys);
                }

                zapowner = key->user;
                key->user = newowner;
                key->uid = uid;
        }

        /* change the GID */
        if (group != (gid_t) -1)
                key->gid = gid;

        notify_key(key, NOTIFY_KEY_SETATTR, 0);
        ret = 0;

error_put:
        up_write(&key->sem);
        key_put(key);
        if (zapowner)
                key_user_put(zapowner);
error:
        return ret;

quota_overrun:
        spin_unlock_irqrestore(&newowner->lock, flags);
        zapowner = newowner;
        ret = -EDQUOT;
        goto error_put;
}

/*
 * Change the permission mask on a key.
 *
 * The key must grant the caller Setattr permission for this to work, though
 * the key need not be fully instantiated yet.  If the caller does not have
 * sysadmin capability, it may only change the permission on keys that it owns.
 */
long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
{
        struct key *key;
        key_ref_t key_ref;
        long ret;

        ret = -EINVAL;
        if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
                goto error;

        key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
                                  KEY_NEED_SETATTR);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
        }

        key = key_ref_to_ptr(key_ref);

        /* make the changes with the locks held to prevent chown/chmod races */
        ret = -EACCES;
        down_write(&key->sem);

        /* if we're not the sysadmin, we can only change a key that we own */
        if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) {
                key->perm = perm;
                notify_key(key, NOTIFY_KEY_SETATTR, 0);
                ret = 0;
        }

        up_write(&key->sem);
        key_put(key);
error:
        return ret;
}

/*
 * Get the destination keyring for instantiation and check that the caller has
 * Write permission on it.
 */
static long get_instantiation_keyring(key_serial_t ringid,
                                      struct request_key_auth *rka,
                                      struct key **_dest_keyring)
{
        key_ref_t dkref;

        *_dest_keyring = NULL;

        /* just return a NULL pointer if we weren't asked to make a link */
        if (ringid == 0)
                return 0;

        /* if a specific keyring is nominated by ID, then use that */
        if (ringid > 0) {
                dkref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE);
                if (IS_ERR(dkref))
                        return PTR_ERR(dkref);
                *_dest_keyring = key_ref_to_ptr(dkref);
                return 0;
        }

        if (ringid == KEY_SPEC_REQKEY_AUTH_KEY)
                return -EINVAL;

        /* otherwise specify the destination keyring recorded in the
         * authorisation key (any KEY_SPEC_*_KEYRING) */
        if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
                *_dest_keyring = key_get(rka->dest_keyring);
                return 0;
        }

        return -ENOKEY;
}

/*
 * Change the request_key authorisation key on the current process.
 */
static int keyctl_change_reqkey_auth(struct key *key)
{
        struct cred *new;

        new = prepare_creds();
        if (!new)
                return -ENOMEM;

        key_put(new->request_key_auth);
        new->request_key_auth = key_get(key);

        return commit_creds(new);
}

/*
 * Instantiate a key with the specified payload and link the key into the
 * destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * If successful, 0 will be returned.
 */
static long keyctl_instantiate_key_common(key_serial_t id,
                                   struct iov_iter *from,
                                   key_serial_t ringid)
{
        const struct cred *cred = current_cred();
        struct request_key_auth *rka;
        struct key *instkey, *dest_keyring;
        size_t plen = from ? iov_iter_count(from) : 0;
        void *payload;
        long ret;

        kenter("%d,,%zu,%d", id, plen, ringid);

        if (!plen)
                from = NULL;

        ret = -EINVAL;
        if (plen > 1024 * 1024 - 1)
                goto error;

        /* the appropriate instantiation authorisation key must have been
         * assumed before calling this */
        ret = -EPERM;
        instkey = cred->request_key_auth;
        if (!instkey)
                goto error;

        rka = instkey->payload.data[0];
        if (rka->target_key->serial != id)
                goto error;

        /* pull the payload in if one was supplied */
        payload = NULL;

        if (from) {
                ret = -ENOMEM;
                payload = kvmalloc(plen, GFP_KERNEL);
                if (!payload)
                        goto error;

                ret = -EFAULT;
                if (!copy_from_iter_full(payload, plen, from))
                        goto error2;
        }

        /* find the destination keyring amongst those belonging to the
         * requesting task */
        ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
        if (ret < 0)
                goto error2;

        /* instantiate the key and link it into a keyring */
        ret = key_instantiate_and_link(rka->target_key, payload, plen,
                                       dest_keyring, instkey);

        key_put(dest_keyring);

        /* discard the assumed authority if it's just been disabled by
         * instantiation of the key */
        if (ret == 0)
                keyctl_change_reqkey_auth(NULL);

error2:
        kvfree_sensitive(payload, plen);
error:
        return ret;
}

/*
 * Instantiate a key with the specified payload and link the key into the
 * destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * If successful, 0 will be returned.
 */
long keyctl_instantiate_key(key_serial_t id,
                            const void __user *_payload,
                            size_t plen,
                            key_serial_t ringid)
{
        if (_payload && plen) {
                struct iov_iter from;
                int ret;

                ret = import_ubuf(ITER_SOURCE, (void __user *)_payload, plen,
                                  &from);
                if (unlikely(ret))
                        return ret;

                return keyctl_instantiate_key_common(id, &from, ringid);
        }

        return keyctl_instantiate_key_common(id, NULL, ringid);
}

/*
 * Instantiate a key with the specified multipart payload and link the key into
 * the destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * If successful, 0 will be returned.
 */
long keyctl_instantiate_key_iov(key_serial_t id,
                                const struct iovec __user *_payload_iov,
                                unsigned ioc,
                                key_serial_t ringid)
{
        struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
        struct iov_iter from;
        long ret;

        if (!_payload_iov)
                ioc = 0;

        ret = import_iovec(ITER_SOURCE, _payload_iov, ioc,
                                    ARRAY_SIZE(iovstack), &iov, &from);
        if (ret < 0)
                return ret;
        ret = keyctl_instantiate_key_common(id, &from, ringid);
        kfree(iov);
        return ret;
}

/*
 * Negatively instantiate the key with the given timeout (in seconds) and link
 * the key into the destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * The key and any links to the key will be automatically garbage collected
 * after the timeout expires.
 *
 * Negative keys are used to rate limit repeated request_key() calls by causing
 * them to return -ENOKEY until the negative key expires.
 *
 * If successful, 0 will be returned.
 */
long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
{
        return keyctl_reject_key(id, timeout, ENOKEY, ringid);
}

/*
 * Negatively instantiate the key with the given timeout (in seconds) and error
 * code and link the key into the destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * The key and any links to the key will be automatically garbage collected
 * after the timeout expires.
 *
 * Negative keys are used to rate limit repeated request_key() calls by causing
 * them to return the specified error code until the negative key expires.
 *
 * If successful, 0 will be returned.
 */
long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,
                       key_serial_t ringid)
{
        const struct cred *cred = current_cred();
        struct request_key_auth *rka;
        struct key *instkey, *dest_keyring;
        long ret;

        kenter("%d,%u,%u,%d", id, timeout, error, ringid);

        /* must be a valid error code and mustn't be a kernel special */
        if (error <= 0 ||
            error >= MAX_ERRNO ||
            error == ERESTARTSYS ||
            error == ERESTARTNOINTR ||
            error == ERESTARTNOHAND ||
            error == ERESTART_RESTARTBLOCK)
                return -EINVAL;

        /* the appropriate instantiation authorisation key must have been
         * assumed before calling this */
        ret = -EPERM;
        instkey = cred->request_key_auth;
        if (!instkey)
                goto error;

        rka = instkey->payload.data[0];
        if (rka->target_key->serial != id)
                goto error;

        /* find the destination keyring if present (which must also be
         * writable) */
        ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
        if (ret < 0)
                goto error;

        /* instantiate the key and link it into a keyring */
        ret = key_reject_and_link(rka->target_key, timeout, error,
                                  dest_keyring, instkey);

        key_put(dest_keyring);

        /* discard the assumed authority if it's just been disabled by
         * instantiation of the key */
        if (ret == 0)
                keyctl_change_reqkey_auth(NULL);

error:
        return ret;
}

/*
 * Read or set the default keyring in which request_key() will cache keys and
 * return the old setting.
 *
 * If a thread or process keyring is specified then it will be created if it
 * doesn't yet exist.  The old setting will be returned if successful.
 */
long keyctl_set_reqkey_keyring(int reqkey_defl)
{
        struct cred *new;
        int ret, old_setting;

        old_setting = current_cred_xxx(jit_keyring);

        if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
                return old_setting;

        new = prepare_creds();
        if (!new)
                return -ENOMEM;

        switch (reqkey_defl) {
        case KEY_REQKEY_DEFL_THREAD_KEYRING:
                ret = install_thread_keyring_to_cred(new);
                if (ret < 0)
                        goto error;
                goto set;

        case KEY_REQKEY_DEFL_PROCESS_KEYRING:
                ret = install_process_keyring_to_cred(new);
                if (ret < 0)
                        goto error;
                goto set;

        case KEY_REQKEY_DEFL_DEFAULT:
        case KEY_REQKEY_DEFL_SESSION_KEYRING:
        case KEY_REQKEY_DEFL_USER_KEYRING:
        case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
        case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
                goto set;

        case KEY_REQKEY_DEFL_NO_CHANGE:
        case KEY_REQKEY_DEFL_GROUP_KEYRING:
        default:
                ret = -EINVAL;
                goto error;
        }

set:
        new->jit_keyring = reqkey_defl;
        commit_creds(new);
        return old_setting;
error:
        abort_creds(new);
        return ret;
}

/*
 * Set or clear the timeout on a key.
 *
 * Either the key must grant the caller Setattr permission or else the caller
 * must hold an instantiation authorisation token for the key.
 *
 * The timeout is either 0 to clear the timeout, or a number of seconds from
 * the current time.  The key and any links to the key will be automatically
 * garbage collected after the timeout expires.
 *
 * Keys with KEY_FLAG_KEEP set should not be timed out.
 *
 * If successful, 0 is returned.
 */
long keyctl_set_timeout(key_serial_t id, unsigned timeout)
{
        struct key *key, *instkey;
        key_ref_t key_ref;
        long ret;

        key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
                                  KEY_NEED_SETATTR);
        if (IS_ERR(key_ref)) {
                /* setting the timeout on a key under construction is permitted
                 * if we have the authorisation token handy */
                if (PTR_ERR(key_ref) == -EACCES) {
                        instkey = key_get_instantiation_authkey(id);
                        if (!IS_ERR(instkey)) {
                                key_put(instkey);
                                key_ref = lookup_user_key(id,
                                                          KEY_LOOKUP_PARTIAL,
                                                          KEY_AUTHTOKEN_OVERRIDE);
                                if (!IS_ERR(key_ref))
                                        goto okay;
                        }
                }

                ret = PTR_ERR(key_ref);
                goto error;
        }

okay:
        key = key_ref_to_ptr(key_ref);
        ret = 0;
        if (test_bit(KEY_FLAG_KEEP, &key->flags)) {
                ret = -EPERM;
        } else {
                key_set_timeout(key, timeout);
                notify_key(key, NOTIFY_KEY_SETATTR, 0);
        }
        key_put(key);

error:
        return ret;
}

/*
 * Assume (or clear) the authority to instantiate the specified key.
 *
 * This sets the authoritative token currently in force for key instantiation.
 * This must be done for a key to be instantiated.  It has the effect of making
 * available all the keys from the caller of the request_key() that created a
 * key to request_key() calls made by the caller of this function.
 *
 * The caller must have the instantiation key in their process keyrings with a
 * Search permission grant available to the caller.
 *
 * If the ID given is 0, then the setting will be cleared and 0 returned.
 *
 * If the ID given has a matching an authorisation key, then that key will be
 * set and its ID will be returned.  The authorisation key can be read to get
 * the callout information passed to request_key().
 */
long keyctl_assume_authority(key_serial_t id)
{
        struct key *authkey;
        long ret;

        /* special key IDs aren't permitted */
        ret = -EINVAL;
        if (id < 0)
                goto error;

        /* we divest ourselves of authority if given an ID of 0 */
        if (id == 0) {
                ret = keyctl_change_reqkey_auth(NULL);
                goto error;
        }

        /* attempt to assume the authority temporarily granted to us whilst we
         * instantiate the specified key
         * - the authorisation key must be in the current task's keyrings
         *   somewhere
         */
        authkey = key_get_instantiation_authkey(id);
        if (IS_ERR(authkey)) {
                ret = PTR_ERR(authkey);
                goto error;
        }

        ret = keyctl_change_reqkey_auth(authkey);
        if (ret == 0)
                ret = authkey->serial;
        key_put(authkey);
error:
        return ret;
}

/*
 * Get a key's the LSM security label.
 *
 * The key must grant the caller View permission for this to work.
 *
 * If there's a buffer, then up to buflen bytes of data will be placed into it.
 *
 * If successful, the amount of information available will be returned,
 * irrespective of how much was copied (including the terminal NUL).
 */
long keyctl_get_security(key_serial_t keyid,
                         char __user *buffer,
                         size_t buflen)
{
        struct key *key, *instkey;
        key_ref_t key_ref;
        char *context;
        long ret;

        key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW);
        if (IS_ERR(key_ref)) {
                if (PTR_ERR(key_ref) != -EACCES)
                        return PTR_ERR(key_ref);

                /* viewing a key under construction is also permitted if we
                 * have the authorisation token handy */
                instkey = key_get_instantiation_authkey(keyid);
                if (IS_ERR(instkey))
                        return PTR_ERR(instkey);
                key_put(instkey);

                key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL,
                                          KEY_AUTHTOKEN_OVERRIDE);
                if (IS_ERR(key_ref))
                        return PTR_ERR(key_ref);
        }

        key = key_ref_to_ptr(key_ref);
        ret = security_key_getsecurity(key, &context);
        if (ret == 0) {
                /* if no information was returned, give userspace an empty
                 * string */
                ret = 1;
                if (buffer && buflen > 0 &&
                    copy_to_user(buffer, "", 1) != 0)
                        ret = -EFAULT;
        } else if (ret > 0) {
                /* return as much data as there's room for */
                if (buffer && buflen > 0) {
                        if (buflen > ret)
                                buflen = ret;

                        if (copy_to_user(buffer, context, buflen) != 0)
                                ret = -EFAULT;
                }

                kfree(context);
        }

        key_ref_put(key_ref);
        return ret;
}

/*
 * Attempt to install the calling process's session keyring on the process's
 * parent process.
 *
 * The keyring must exist and must grant the caller LINK permission, and the
 * parent process must be single-threaded and must have the same effective
 * ownership as this process and mustn't be SUID/SGID.
 *
 * The keyring will be emplaced on the parent when it next resumes userspace.
 *
 * If successful, 0 will be returned.
 */
long keyctl_session_to_parent(void)
{
        struct task_struct *me, *parent;
        const struct cred *mycred, *pcred;
        struct callback_head *newwork, *oldwork;
        key_ref_t keyring_r;
        struct cred *cred;
        int ret;

        keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_NEED_LINK);
        if (IS_ERR(keyring_r))
                return PTR_ERR(keyring_r);

        ret = -ENOMEM;

        /* our parent is going to need a new cred struct, a new tgcred struct
         * and new security data, so we allocate them here to prevent ENOMEM in
         * our parent */
        cred = cred_alloc_blank();
        if (!cred)
                goto error_keyring;
        newwork = &cred->rcu;

        cred->session_keyring = key_ref_to_ptr(keyring_r);
        keyring_r = NULL;
        init_task_work(newwork, key_change_session_keyring);

        me = current;
        rcu_read_lock();
        write_lock_irq(&tasklist_lock);

        ret = -EPERM;
        oldwork = NULL;
        parent = rcu_dereference_protected(me->real_parent,
                                           lockdep_is_held(&tasklist_lock));

        /* the parent mustn't be init and mustn't be a kernel thread */
        if (parent->pid <= 1 || !parent->mm)
                goto unlock;

        /* the parent must be single threaded */
        if (!thread_group_empty(parent))
                goto unlock;

        /* the parent and the child must have different session keyrings or
         * there's no point */
        mycred = current_cred();
        pcred = __task_cred(parent);
        if (mycred == pcred ||
            mycred->session_keyring == pcred->session_keyring) {
                ret = 0;
                goto unlock;
        }

        /* the parent must have the same effective ownership and mustn't be
         * SUID/SGID */
        if (!uid_eq(pcred->uid,         mycred->euid) ||
            !uid_eq(pcred->euid, mycred->euid) ||
            !uid_eq(pcred->suid, mycred->euid) ||
            !gid_eq(pcred->gid,         mycred->egid) ||
            !gid_eq(pcred->egid, mycred->egid) ||
            !gid_eq(pcred->sgid, mycred->egid))
                goto unlock;

        /* the keyrings must have the same UID */
        if ((pcred->session_keyring &&
             !uid_eq(pcred->session_keyring->uid, mycred->euid)) ||
            !uid_eq(mycred->session_keyring->uid, mycred->euid))
                goto unlock;

        /* cancel an already pending keyring replacement */
        oldwork = task_work_cancel_func(parent, key_change_session_keyring);

        /* the replacement session keyring is applied just prior to userspace
         * restarting */
        ret = task_work_add(parent, newwork, TWA_RESUME);
        if (!ret)
                newwork = NULL;
unlock:
        write_unlock_irq(&tasklist_lock);
        rcu_read_unlock();
        if (oldwork)
                put_cred(container_of(oldwork, struct cred, rcu));
        if (newwork)
                put_cred(cred);
        return ret;

error_keyring:
        key_ref_put(keyring_r);
        return ret;
}

/*
 * Apply a restriction to a given keyring.
 *
 * The caller must have Setattr permission to change keyring restrictions.
 *
 * The requested type name may be a NULL pointer to reject all attempts
 * to link to the keyring.  In this case, _restriction must also be NULL.
 * Otherwise, both _type and _restriction must be non-NULL.
 *
 * Returns 0 if successful.
 */
long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
                             const char __user *_restriction)
{
        key_ref_t key_ref;
        char type[32];
        char *restriction = NULL;
        long ret;

        key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR);
        if (IS_ERR(key_ref))
                return PTR_ERR(key_ref);

        ret = -EINVAL;
        if (_type) {
                if (!_restriction)
                        goto error;

                ret = key_get_type_from_user(type, _type, sizeof(type));
                if (ret < 0)
                        goto error;

                restriction = strndup_user(_restriction, PAGE_SIZE);
                if (IS_ERR(restriction)) {
                        ret = PTR_ERR(restriction);
                        goto error;
                }
        } else {
                if (_restriction)
                        goto error;
        }

        ret = keyring_restrict(key_ref, _type ? type : NULL, restriction);
        kfree(restriction);
error:
        key_ref_put(key_ref);
        return ret;
}

#ifdef CONFIG_KEY_NOTIFICATIONS
/*
 * Watch for changes to a key.
 *
 * The caller must have View permission to watch a key or keyring.
 */
long keyctl_watch_key(key_serial_t id, int watch_queue_fd, int watch_id)
{
        struct watch_queue *wqueue;
        struct watch_list *wlist = NULL;
        struct watch *watch = NULL;
        struct key *key;
        key_ref_t key_ref;
        long ret;

        if (watch_id < -1 || watch_id > 0xff)
                return -EINVAL;

        key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_NEED_VIEW);
        if (IS_ERR(key_ref))
                return PTR_ERR(key_ref);
        key = key_ref_to_ptr(key_ref);

        wqueue = get_watch_queue(watch_queue_fd);
        if (IS_ERR(wqueue)) {
                ret = PTR_ERR(wqueue);
                goto err_key;
        }

        if (watch_id >= 0) {
                ret = -ENOMEM;
                if (!key->watchers) {
                        wlist = kzalloc(sizeof(*wlist), GFP_KERNEL);
                        if (!wlist)
                                goto err_wqueue;
                        init_watch_list(wlist, NULL);
                }

                watch = kzalloc(sizeof(*watch), GFP_KERNEL);
                if (!watch)
                        goto err_wlist;

                init_watch(watch, wqueue);
                watch->id        = key->serial;
                watch->info_id        = (u32)watch_id << WATCH_INFO_ID__SHIFT;

                ret = security_watch_key(key);
                if (ret < 0)
                        goto err_watch;

                down_write(&key->sem);
                if (!key->watchers) {
                        key->watchers = wlist;
                        wlist = NULL;
                }

                ret = add_watch_to_object(watch, key->watchers);
                up_write(&key->sem);

                if (ret == 0)
                        watch = NULL;
        } else {
                ret = -EBADSLT;
                if (key->watchers) {
                        down_write(&key->sem);
                        ret = remove_watch_from_object(key->watchers,
                                                       wqueue, key_serial(key),
                                                       false);
                        up_write(&key->sem);
                }
        }

err_watch:
        kfree(watch);
err_wlist:
        kfree(wlist);
err_wqueue:
        put_watch_queue(wqueue);
err_key:
        key_put(key);
        return ret;
}
#endif /* CONFIG_KEY_NOTIFICATIONS */

/*
 * Get keyrings subsystem capabilities.
 */
long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen)
{
        size_t size = buflen;

        if (size > 0) {
                if (size > sizeof(keyrings_capabilities))
                        size = sizeof(keyrings_capabilities);
                if (copy_to_user(_buffer, keyrings_capabilities, size) != 0)
                        return -EFAULT;
                if (size < buflen &&
                    clear_user(_buffer + size, buflen - size) != 0)
                        return -EFAULT;
        }

        return sizeof(keyrings_capabilities);
}

/*
 * The key control system call
 */
SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
                unsigned long, arg4, unsigned long, arg5)
{
        switch (option) {
        case KEYCTL_GET_KEYRING_ID:
                return keyctl_get_keyring_ID((key_serial_t) arg2,
                                             (int) arg3);

        case KEYCTL_JOIN_SESSION_KEYRING:
                return keyctl_join_session_keyring((const char __user *) arg2);

        case KEYCTL_UPDATE:
                return keyctl_update_key((key_serial_t) arg2,
                                         (const void __user *) arg3,
                                         (size_t) arg4);

        case KEYCTL_REVOKE:
                return keyctl_revoke_key((key_serial_t) arg2);

        case KEYCTL_DESCRIBE:
                return keyctl_describe_key((key_serial_t) arg2,
                                           (char __user *) arg3,
                                           (unsigned) arg4);

        case KEYCTL_CLEAR:
                return keyctl_keyring_clear((key_serial_t) arg2);

        case KEYCTL_LINK:
                return keyctl_keyring_link((key_serial_t) arg2,
                                           (key_serial_t) arg3);

        case KEYCTL_UNLINK:
                return keyctl_keyring_unlink((key_serial_t) arg2,
                                             (key_serial_t) arg3);

        case KEYCTL_SEARCH:
                return keyctl_keyring_search((key_serial_t) arg2,
                                             (const char __user *) arg3,
                                             (const char __user *) arg4,
                                             (key_serial_t) arg5);

        case KEYCTL_READ:
                return keyctl_read_key((key_serial_t) arg2,
                                       (char __user *) arg3,
                                       (size_t) arg4);

        case KEYCTL_CHOWN:
                return keyctl_chown_key((key_serial_t) arg2,
                                        (uid_t) arg3,
                                        (gid_t) arg4);

        case KEYCTL_SETPERM:
                return keyctl_setperm_key((key_serial_t) arg2,
                                          (key_perm_t) arg3);

        case KEYCTL_INSTANTIATE:
                return keyctl_instantiate_key((key_serial_t) arg2,
                                              (const void __user *) arg3,
                                              (size_t) arg4,
                                              (key_serial_t) arg5);

        case KEYCTL_NEGATE:
                return keyctl_negate_key((key_serial_t) arg2,
                                         (unsigned) arg3,
                                         (key_serial_t) arg4);

        case KEYCTL_SET_REQKEY_KEYRING:
                return keyctl_set_reqkey_keyring(arg2);

        case KEYCTL_SET_TIMEOUT:
                return keyctl_set_timeout((key_serial_t) arg2,
                                          (unsigned) arg3);

        case KEYCTL_ASSUME_AUTHORITY:
                return keyctl_assume_authority((key_serial_t) arg2);

        case KEYCTL_GET_SECURITY:
                return keyctl_get_security((key_serial_t) arg2,
                                           (char __user *) arg3,
                                           (size_t) arg4);

        case KEYCTL_SESSION_TO_PARENT:
                return keyctl_session_to_parent();

        case KEYCTL_REJECT:
                return keyctl_reject_key((key_serial_t) arg2,
                                         (unsigned) arg3,
                                         (unsigned) arg4,
                                         (key_serial_t) arg5);

        case KEYCTL_INSTANTIATE_IOV:
                return keyctl_instantiate_key_iov(
                        (key_serial_t) arg2,
                        (const struct iovec __user *) arg3,
                        (unsigned) arg4,
                        (key_serial_t) arg5);

        case KEYCTL_INVALIDATE:
                return keyctl_invalidate_key((key_serial_t) arg2);

        case KEYCTL_GET_PERSISTENT:
                return keyctl_get_persistent((uid_t)arg2, (key_serial_t)arg3);

        case KEYCTL_DH_COMPUTE:
                return keyctl_dh_compute((struct keyctl_dh_params __user *) arg2,
                                         (char __user *) arg3, (size_t) arg4,
                                         (struct keyctl_kdf_params __user *) arg5);

        case KEYCTL_RESTRICT_KEYRING:
                return keyctl_restrict_keyring((key_serial_t) arg2,
                                               (const char __user *) arg3,
                                               (const char __user *) arg4);

        case KEYCTL_PKEY_QUERY:
                if (arg3 != 0)
                        return -EINVAL;
                return keyctl_pkey_query((key_serial_t)arg2,
                                         (const char __user *)arg4,
                                         (struct keyctl_pkey_query __user *)arg5);

        case KEYCTL_PKEY_ENCRYPT:
        case KEYCTL_PKEY_DECRYPT:
        case KEYCTL_PKEY_SIGN:
                return keyctl_pkey_e_d_s(
                        option,
                        (const struct keyctl_pkey_params __user *)arg2,
                        (const char __user *)arg3,
                        (const void __user *)arg4,
                        (void __user *)arg5);

        case KEYCTL_PKEY_VERIFY:
                return keyctl_pkey_verify(
                        (const struct keyctl_pkey_params __user *)arg2,
                        (const char __user *)arg3,
                        (const void __user *)arg4,
                        (const void __user *)arg5);

        case KEYCTL_MOVE:
                return keyctl_keyring_move((key_serial_t)arg2,
                                           (key_serial_t)arg3,
                                           (key_serial_t)arg4,
                                           (unsigned int)arg5);

        case KEYCTL_CAPABILITIES:
                return keyctl_capabilities((unsigned char __user *)arg2, (size_t)arg3);

        case KEYCTL_WATCH_KEY:
                return keyctl_watch_key((key_serial_t)arg2, (int)arg3, (int)arg4);

        default:
                return -EOPNOTSUPP;
        }
}










































































    1 









    1 













    1 



    6 






    6 













































































































































   12 







    9 


    2 











    2 




    1 



    1 


    1 



    1 










    1 









    1 









    1 



    1 















    2 




    1 



    1 



























































































    6 







    6 
















    5 
    1 




    4 

    1 


    1 














































    2 
    3 






    1 










    1 

























































































    6 






























































































































































    5 





























































































    7 








    7 


    2 
    6 











    7 






    7 


















    6 


































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *   Copyright (C) International Business Machines Corp., 2000-2004
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */

#include <linux/fs.h>
#include <linux/module.h>
#include <linux/completion.h>
#include <linux/vfs.h>
#include <linux/quotaops.h>
#include <linux/fs_context.h>
#include <linux/fs_parser.h>
#include <linux/moduleparam.h>
#include <linux/kthread.h>
#include <linux/posix_acl.h>
#include <linux/buffer_head.h>
#include <linux/exportfs.h>
#include <linux/crc32.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/seq_file.h>
#include <linux/blkdev.h>

#include "jfs_incore.h"
#include "jfs_filsys.h"
#include "jfs_inode.h"
#include "jfs_metapage.h"
#include "jfs_superblock.h"
#include "jfs_dmap.h"
#include "jfs_imap.h"
#include "jfs_acl.h"
#include "jfs_debug.h"
#include "jfs_xattr.h"
#include "jfs_dinode.h"

MODULE_DESCRIPTION("The Journaled Filesystem (JFS)");
MODULE_AUTHOR("Steve Best/Dave Kleikamp/Barry Arndt, IBM");
MODULE_LICENSE("GPL");

static struct kmem_cache *jfs_inode_cachep;

static const struct super_operations jfs_super_operations;
static const struct export_operations jfs_export_operations;
static struct file_system_type jfs_fs_type;

#define MAX_COMMIT_THREADS 64
static int commit_threads;
module_param(commit_threads, int, 0);
MODULE_PARM_DESC(commit_threads, "Number of commit threads");

static struct task_struct *jfsCommitThread[MAX_COMMIT_THREADS];
struct task_struct *jfsIOthread;
struct task_struct *jfsSyncThread;

#ifdef CONFIG_JFS_DEBUG
int jfsloglevel = JFS_LOGLEVEL_WARN;
module_param(jfsloglevel, int, 0644);
MODULE_PARM_DESC(jfsloglevel, "Specify JFS loglevel (0, 1 or 2)");
#endif

static void jfs_handle_error(struct super_block *sb)
{
        struct jfs_sb_info *sbi = JFS_SBI(sb);

        if (sb_rdonly(sb))
                return;

        updateSuper(sb, FM_DIRTY);

        if (sbi->flag & JFS_ERR_PANIC)
                panic("JFS (device %s): panic forced after error\n",
                        sb->s_id);
        else if (sbi->flag & JFS_ERR_REMOUNT_RO) {
                jfs_err("ERROR: (device %s): remounting filesystem as read-only",
                        sb->s_id);
                sb->s_flags |= SB_RDONLY;
        }

        /* nothing is done for continue beyond marking the superblock dirty */
}

void jfs_error(struct super_block *sb, const char *fmt, ...)
{
        struct va_format vaf;
        va_list args;

        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        pr_err("ERROR: (device %s): %ps: %pV\n",
               sb->s_id, __builtin_return_address(0), &vaf);

        va_end(args);

        jfs_handle_error(sb);
}

static struct inode *jfs_alloc_inode(struct super_block *sb)
{
        struct jfs_inode_info *jfs_inode;

        jfs_inode = alloc_inode_sb(sb, jfs_inode_cachep, GFP_NOFS);
        if (!jfs_inode)
                return NULL;
#ifdef CONFIG_QUOTA
        memset(&jfs_inode->i_dquot, 0, sizeof(jfs_inode->i_dquot));
#endif
        return &jfs_inode->vfs_inode;
}

static void jfs_free_inode(struct inode *inode)
{
        kmem_cache_free(jfs_inode_cachep, JFS_IP(inode));
}

static int jfs_statfs(struct dentry *dentry, struct kstatfs *buf)
{
        struct jfs_sb_info *sbi = JFS_SBI(dentry->d_sb);
        s64 maxinodes;
        struct inomap *imap = JFS_IP(sbi->ipimap)->i_imap;

        jfs_info("In jfs_statfs");
        buf->f_type = JFS_SUPER_MAGIC;
        buf->f_bsize = sbi->bsize;
        buf->f_blocks = sbi->bmap->db_mapsize;
        buf->f_bfree = sbi->bmap->db_nfree;
        buf->f_bavail = sbi->bmap->db_nfree;
        /*
         * If we really return the number of allocated & free inodes, some
         * applications will fail because they won't see enough free inodes.
         * We'll try to calculate some guess as to how many inodes we can
         * really allocate
         *
         * buf->f_files = atomic_read(&imap->im_numinos);
         * buf->f_ffree = atomic_read(&imap->im_numfree);
         */
        maxinodes = min((s64) atomic_read(&imap->im_numinos) +
                        ((sbi->bmap->db_nfree >> imap->im_l2nbperiext)
                         << L2INOSPEREXT), (s64) 0xffffffffLL);
        buf->f_files = maxinodes;
        buf->f_ffree = maxinodes - (atomic_read(&imap->im_numinos) -
                                    atomic_read(&imap->im_numfree));
        buf->f_fsid.val[0] = crc32_le(0, (char *)&sbi->uuid,
                                      sizeof(sbi->uuid)/2);
        buf->f_fsid.val[1] = crc32_le(0,
                                      (char *)&sbi->uuid + sizeof(sbi->uuid)/2,
                                      sizeof(sbi->uuid)/2);

        buf->f_namelen = JFS_NAME_MAX;
        return 0;
}

#ifdef CONFIG_QUOTA
static int jfs_quota_off(struct super_block *sb, int type);
static int jfs_quota_on(struct super_block *sb, int type, int format_id,
                        const struct path *path);

static void jfs_quota_off_umount(struct super_block *sb)
{
        int type;

        for (type = 0; type < MAXQUOTAS; type++)
                jfs_quota_off(sb, type);
}

static const struct quotactl_ops jfs_quotactl_ops = {
        .quota_on        = jfs_quota_on,
        .quota_off        = jfs_quota_off,
        .quota_sync        = dquot_quota_sync,
        .get_state        = dquot_get_state,
        .set_info        = dquot_set_dqinfo,
        .get_dqblk        = dquot_get_dqblk,
        .set_dqblk        = dquot_set_dqblk,
        .get_nextdqblk        = dquot_get_next_dqblk,
};
#else
static inline void jfs_quota_off_umount(struct super_block *sb)
{
}
#endif

static void jfs_put_super(struct super_block *sb)
{
        struct jfs_sb_info *sbi = JFS_SBI(sb);
        int rc;

        jfs_info("In jfs_put_super");

        jfs_quota_off_umount(sb);

        rc = jfs_umount(sb);
        if (rc)
                jfs_err("jfs_umount failed with return code %d", rc);

        unload_nls(sbi->nls_tab);

        truncate_inode_pages(sbi->direct_inode->i_mapping, 0);
        iput(sbi->direct_inode);

        kfree(sbi);
}

enum {
        Opt_integrity, Opt_nointegrity, Opt_iocharset, Opt_resize,
        Opt_resize_nosize, Opt_errors, Opt_ignore, Opt_err, Opt_quota,
        Opt_usrquota, Opt_grpquota, Opt_uid, Opt_gid, Opt_umask,
        Opt_discard, Opt_nodiscard, Opt_discard_minblk
};

static const struct constant_table jfs_param_errors[] = {
        {"continue",        JFS_ERR_CONTINUE},
        {"remount-ro",        JFS_ERR_REMOUNT_RO},
        {"panic",        JFS_ERR_PANIC},
        {}
};

static const struct fs_parameter_spec jfs_param_spec[] = {
        fsparam_flag_no        ("integrity",        Opt_integrity),
        fsparam_string        ("iocharset",        Opt_iocharset),
        fsparam_u64        ("resize",        Opt_resize),
        fsparam_flag        ("resize",        Opt_resize_nosize),
        fsparam_enum        ("errors",        Opt_errors,        jfs_param_errors),
        fsparam_flag        ("quota",        Opt_quota),
        fsparam_flag        ("noquota",        Opt_ignore),
        fsparam_flag        ("usrquota",        Opt_usrquota),
        fsparam_flag        ("grpquota",        Opt_grpquota),
        fsparam_uid        ("uid",                Opt_uid),
        fsparam_gid        ("gid",                Opt_gid),
        fsparam_u32oct        ("umask",        Opt_umask),
        fsparam_flag        ("discard",        Opt_discard),
        fsparam_u32        ("discard",        Opt_discard_minblk),
        fsparam_flag        ("nodiscard",        Opt_nodiscard),
        {}
};

struct jfs_context {
        int        flag;
        kuid_t        uid;
        kgid_t        gid;
        uint        umask;
        uint        minblks_trim;
        void        *nls_map;
        bool        resize;
        s64        newLVSize;
};

static int jfs_parse_param(struct fs_context *fc, struct fs_parameter *param)
{
        struct jfs_context *ctx = fc->fs_private;
        int reconfigure = (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE);
        struct fs_parse_result result;
        struct nls_table *nls_map;
        int opt;

        opt = fs_parse(fc, jfs_param_spec, param, &result);
        if (opt < 0)
                return opt;

        switch (opt) {
        case Opt_integrity:
                if (result.negated)
                        ctx->flag |= JFS_NOINTEGRITY;
                else
                        ctx->flag &= ~JFS_NOINTEGRITY;
                break;
        case Opt_ignore:
                /* Silently ignore the quota options */
                /* Don't do anything ;-) */
                break;
        case Opt_iocharset:
                if (ctx->nls_map && ctx->nls_map != (void *) -1) {
                        unload_nls(ctx->nls_map);
                        ctx->nls_map = NULL;
                }
                if (!strcmp(param->string, "none"))
                        ctx->nls_map = NULL;
                else {
                        nls_map = load_nls(param->string);
                        if (!nls_map) {
                                pr_err("JFS: charset not found\n");
                                return -EINVAL;
                        }
                        ctx->nls_map = nls_map;
                }
                break;
        case Opt_resize:
                if (!reconfigure)
                        return -EINVAL;
                ctx->resize = true;
                ctx->newLVSize = result.uint_64;
                break;
        case Opt_resize_nosize:
                if (!reconfigure)
                        return -EINVAL;
                ctx->resize = true;
                break;
        case Opt_errors:
                ctx->flag &= ~JFS_ERR_MASK;
                ctx->flag |= result.uint_32;
                break;

#ifdef CONFIG_QUOTA
        case Opt_quota:
        case Opt_usrquota:
                ctx->flag |= JFS_USRQUOTA;
                break;
        case Opt_grpquota:
                ctx->flag |= JFS_GRPQUOTA;
                break;
#else
        case Opt_usrquota:
        case Opt_grpquota:
        case Opt_quota:
                pr_err("JFS: quota operations not supported\n");
                break;
#endif
        case Opt_uid:
                ctx->uid = result.uid;
                break;

        case Opt_gid:
                ctx->gid = result.gid;
                break;

        case Opt_umask:
                if (result.uint_32 & ~0777) {
                        pr_err("JFS: Invalid value of umask\n");
                        return -EINVAL;
                }
                ctx->umask = result.uint_32;
                break;

        case Opt_discard:
                /* if set to 1, even copying files will cause
                 * trimming :O
                 * -> user has more control over the online trimming
                 */
                ctx->minblks_trim = 64;
                ctx->flag |= JFS_DISCARD;
                break;

        case Opt_nodiscard:
                ctx->flag &= ~JFS_DISCARD;
                break;

        case Opt_discard_minblk:
                ctx->minblks_trim = result.uint_32;
                ctx->flag |= JFS_DISCARD;
                break;

        default:
                return -EINVAL;
        }

        return 0;
}

static int jfs_reconfigure(struct fs_context *fc)
{
        struct jfs_context *ctx = fc->fs_private;
        struct super_block *sb = fc->root->d_sb;
        int readonly = fc->sb_flags & SB_RDONLY;
        int rc = 0;
        int flag = ctx->flag;
        int ret;

        sync_filesystem(sb);

        /* Transfer results of parsing to the sbi */
        JFS_SBI(sb)->flag = ctx->flag;
        JFS_SBI(sb)->uid = ctx->uid;
        JFS_SBI(sb)->gid = ctx->gid;
        JFS_SBI(sb)->umask = ctx->umask;
        JFS_SBI(sb)->minblks_trim = ctx->minblks_trim;
        if (ctx->nls_map != (void *) -1) {
                unload_nls(JFS_SBI(sb)->nls_tab);
                JFS_SBI(sb)->nls_tab = ctx->nls_map;
        }
        ctx->nls_map = NULL;

        if (ctx->resize) {
                if (sb_rdonly(sb)) {
                        pr_err("JFS: resize requires volume to be mounted read-write\n");
                        return -EROFS;
                }

                if (!ctx->newLVSize) {
                        ctx->newLVSize = sb_bdev_nr_blocks(sb);
                                if (ctx->newLVSize == 0)
                                        pr_err("JFS: Cannot determine volume size\n");
                }

                rc = jfs_extendfs(sb, ctx->newLVSize, 0);
                if (rc)
                        return rc;
        }

        if (sb_rdonly(sb) && !readonly) {
                /*
                 * Invalidate any previously read metadata.  fsck may have
                 * changed the on-disk data since we mounted r/o
                 */
                truncate_inode_pages(JFS_SBI(sb)->direct_inode->i_mapping, 0);

                JFS_SBI(sb)->flag = flag;
                ret = jfs_mount_rw(sb, 1);

                /* mark the fs r/w for quota activity */
                sb->s_flags &= ~SB_RDONLY;

                dquot_resume(sb, -1);
                return ret;
        }
        if (!sb_rdonly(sb) && readonly) {
                rc = dquot_suspend(sb, -1);
                if (rc < 0)
                        return rc;
                rc = jfs_umount_rw(sb);
                JFS_SBI(sb)->flag = flag;
                return rc;
        }
        if ((JFS_SBI(sb)->flag & JFS_NOINTEGRITY) != (flag & JFS_NOINTEGRITY)) {
                if (!sb_rdonly(sb)) {
                        rc = jfs_umount_rw(sb);
                        if (rc)
                                return rc;

                        JFS_SBI(sb)->flag = flag;
                        ret = jfs_mount_rw(sb, 1);
                        return ret;
                }
        }
        JFS_SBI(sb)->flag = flag;

        return 0;
}

static int jfs_fill_super(struct super_block *sb, struct fs_context *fc)
{
        struct jfs_context *ctx = fc->fs_private;
        int silent = fc->sb_flags & SB_SILENT;
        struct jfs_sb_info *sbi;
        struct inode *inode;
        int rc;
        int ret = -EINVAL;

        jfs_info("In jfs_read_super: s_flags=0x%lx", sb->s_flags);

        sbi = kzalloc(sizeof(struct jfs_sb_info), GFP_KERNEL);
        if (!sbi)
                return -ENOMEM;

        sb->s_fs_info = sbi;
        sb->s_max_links = JFS_LINK_MAX;
        sb->s_time_min = 0;
        sb->s_time_max = U32_MAX;
        sbi->sb = sb;

        /* Transfer results of parsing to the sbi */
        sbi->flag = ctx->flag;
        sbi->uid = ctx->uid;
        sbi->gid = ctx->gid;
        sbi->umask = ctx->umask;
        if (ctx->nls_map != (void *) -1) {
                unload_nls(sbi->nls_tab);
                sbi->nls_tab = ctx->nls_map;
        }
        ctx->nls_map = NULL;

        if (sbi->flag & JFS_DISCARD) {
                if (!bdev_max_discard_sectors(sb->s_bdev)) {
                        pr_err("JFS: discard option not supported on device\n");
                        sbi->flag &= ~JFS_DISCARD;
                } else {
                        sbi->minblks_trim = ctx->minblks_trim;
                }
        }

#ifdef CONFIG_JFS_POSIX_ACL
        sb->s_flags |= SB_POSIXACL;
#endif

        if (ctx->resize) {
                pr_err("resize option for remount only\n");
                goto out_unload;
        }

        /*
         * Initialize blocksize to 4K.
         */
        sb_set_blocksize(sb, PSIZE);

        /*
         * Set method vectors.
         */
        sb->s_op = &jfs_super_operations;
        sb->s_export_op = &jfs_export_operations;
        sb->s_xattr = jfs_xattr_handlers;
#ifdef CONFIG_QUOTA
        sb->dq_op = &dquot_operations;
        sb->s_qcop = &jfs_quotactl_ops;
        sb->s_quota_types = QTYPE_MASK_USR | QTYPE_MASK_GRP;
#endif

        /*
         * Initialize direct-mapping inode/address-space
         */
        inode = new_inode(sb);
        if (inode == NULL) {
                ret = -ENOMEM;
                goto out_unload;
        }
        inode->i_size = bdev_nr_bytes(sb->s_bdev);
        inode->i_mapping->a_ops = &jfs_metapage_aops;
        inode_fake_hash(inode);
        mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);

        sbi->direct_inode = inode;

        rc = jfs_mount(sb);
        if (rc) {
                if (!silent)
                        jfs_err("jfs_mount failed w/return code = %d", rc);
                goto out_mount_failed;
        }
        if (sb_rdonly(sb))
                sbi->log = NULL;
        else {
                rc = jfs_mount_rw(sb, 0);
                if (rc) {
                        if (!silent) {
                                jfs_err("jfs_mount_rw failed, return code = %d",
                                        rc);
                        }
                        goto out_no_rw;
                }
        }

        sb->s_magic = JFS_SUPER_MAGIC;

        if (sbi->mntflag & JFS_OS2)
                sb->s_d_op = &jfs_ci_dentry_operations;

        inode = jfs_iget(sb, ROOT_I);
        if (IS_ERR(inode)) {
                ret = PTR_ERR(inode);
                goto out_no_rw;
        }
        sb->s_root = d_make_root(inode);
        if (!sb->s_root)
                goto out_no_root;

        /* logical blocks are represented by 40 bits in pxd_t, etc.
         * and page cache is indexed by long
         */
        sb->s_maxbytes = min(((loff_t)sb->s_blocksize) << 40, MAX_LFS_FILESIZE);
        sb->s_time_gran = 1;
        return 0;

out_no_root:
        jfs_err("jfs_read_super: get root dentry failed");

out_no_rw:
        rc = jfs_umount(sb);
        if (rc)
                jfs_err("jfs_umount failed with return code %d", rc);
out_mount_failed:
        filemap_write_and_wait(sbi->direct_inode->i_mapping);
        truncate_inode_pages(sbi->direct_inode->i_mapping, 0);
        make_bad_inode(sbi->direct_inode);
        iput(sbi->direct_inode);
        sbi->direct_inode = NULL;
out_unload:
        unload_nls(sbi->nls_tab);
        kfree(sbi);
        return ret;
}

static int jfs_freeze(struct super_block *sb)
{
        struct jfs_sb_info *sbi = JFS_SBI(sb);
        struct jfs_log *log = sbi->log;
        int rc = 0;

        if (!sb_rdonly(sb)) {
                txQuiesce(sb);
                rc = lmLogShutdown(log);
                if (rc) {
                        jfs_error(sb, "lmLogShutdown failed\n");

                        /* let operations fail rather than hang */
                        txResume(sb);

                        return rc;
                }
                rc = updateSuper(sb, FM_CLEAN);
                if (rc) {
                        jfs_err("jfs_freeze: updateSuper failed");
                        /*
                         * Don't fail here. Everything succeeded except
                         * marking the superblock clean, so there's really
                         * no harm in leaving it frozen for now.
                         */
                }
        }
        return 0;
}

static int jfs_unfreeze(struct super_block *sb)
{
        struct jfs_sb_info *sbi = JFS_SBI(sb);
        struct jfs_log *log = sbi->log;
        int rc = 0;

        if (!sb_rdonly(sb)) {
                rc = updateSuper(sb, FM_MOUNT);
                if (rc) {
                        jfs_error(sb, "updateSuper failed\n");
                        goto out;
                }
                rc = lmLogInit(log);
                if (rc)
                        jfs_error(sb, "lmLogInit failed\n");
out:
                txResume(sb);
        }
        return rc;
}

static int jfs_get_tree(struct fs_context *fc)
{
        return get_tree_bdev(fc, jfs_fill_super);
}

static int jfs_sync_fs(struct super_block *sb, int wait)
{
        struct jfs_log *log = JFS_SBI(sb)->log;

        /* log == NULL indicates read-only mount */
        if (log) {
                /*
                 * Write quota structures to quota file, sync_blockdev() will
                 * write them to disk later
                 */
                dquot_writeback_dquots(sb, -1);
                jfs_flush_journal(log, wait);
                jfs_syncpt(log, 0);
        }

        return 0;
}

static int jfs_show_options(struct seq_file *seq, struct dentry *root)
{
        struct jfs_sb_info *sbi = JFS_SBI(root->d_sb);

        if (uid_valid(sbi->uid))
                seq_printf(seq, ",uid=%d", from_kuid(&init_user_ns, sbi->uid));
        if (gid_valid(sbi->gid))
                seq_printf(seq, ",gid=%d", from_kgid(&init_user_ns, sbi->gid));
        if (sbi->umask != -1)
                seq_printf(seq, ",umask=%03o", sbi->umask);
        if (sbi->flag & JFS_NOINTEGRITY)
                seq_puts(seq, ",nointegrity");
        if (sbi->flag & JFS_DISCARD)
                seq_printf(seq, ",discard=%u", sbi->minblks_trim);
        if (sbi->nls_tab)
                seq_printf(seq, ",iocharset=%s", sbi->nls_tab->charset);
        if (sbi->flag & JFS_ERR_CONTINUE)
                seq_printf(seq, ",errors=continue");
        if (sbi->flag & JFS_ERR_PANIC)
                seq_printf(seq, ",errors=panic");

#ifdef CONFIG_QUOTA
        if (sbi->flag & JFS_USRQUOTA)
                seq_puts(seq, ",usrquota");

        if (sbi->flag & JFS_GRPQUOTA)
                seq_puts(seq, ",grpquota");
#endif

        return 0;
}

#ifdef CONFIG_QUOTA

/* Read data from quotafile - avoid pagecache and such because we cannot afford
 * acquiring the locks... As quota files are never truncated and quota code
 * itself serializes the operations (and no one else should touch the files)
 * we don't have to be afraid of races */
static ssize_t jfs_quota_read(struct super_block *sb, int type, char *data,
                              size_t len, loff_t off)
{
        struct inode *inode = sb_dqopt(sb)->files[type];
        sector_t blk = off >> sb->s_blocksize_bits;
        int err = 0;
        int offset = off & (sb->s_blocksize - 1);
        int tocopy;
        size_t toread;
        struct buffer_head tmp_bh;
        struct buffer_head *bh;
        loff_t i_size = i_size_read(inode);

        if (off > i_size)
                return 0;
        if (off+len > i_size)
                len = i_size-off;
        toread = len;
        while (toread > 0) {
                tocopy = min_t(size_t, sb->s_blocksize - offset, toread);

                tmp_bh.b_state = 0;
                tmp_bh.b_size = i_blocksize(inode);
                err = jfs_get_block(inode, blk, &tmp_bh, 0);
                if (err)
                        return err;
                if (!buffer_mapped(&tmp_bh))        /* A hole? */
                        memset(data, 0, tocopy);
                else {
                        bh = sb_bread(sb, tmp_bh.b_blocknr);
                        if (!bh)
                                return -EIO;
                        memcpy(data, bh->b_data+offset, tocopy);
                        brelse(bh);
                }
                offset = 0;
                toread -= tocopy;
                data += tocopy;
                blk++;
        }
        return len;
}

/* Write to quotafile */
static ssize_t jfs_quota_write(struct super_block *sb, int type,
                               const char *data, size_t len, loff_t off)
{
        struct inode *inode = sb_dqopt(sb)->files[type];
        sector_t blk = off >> sb->s_blocksize_bits;
        int err = 0;
        int offset = off & (sb->s_blocksize - 1);
        int tocopy;
        size_t towrite = len;
        struct buffer_head tmp_bh;
        struct buffer_head *bh;

        inode_lock(inode);
        while (towrite > 0) {
                tocopy = min_t(size_t, sb->s_blocksize - offset, towrite);

                tmp_bh.b_state = 0;
                tmp_bh.b_size = i_blocksize(inode);
                err = jfs_get_block(inode, blk, &tmp_bh, 1);
                if (err)
                        goto out;
                if (offset || tocopy != sb->s_blocksize)
                        bh = sb_bread(sb, tmp_bh.b_blocknr);
                else
                        bh = sb_getblk(sb, tmp_bh.b_blocknr);
                if (!bh) {
                        err = -EIO;
                        goto out;
                }
                lock_buffer(bh);
                memcpy(bh->b_data+offset, data, tocopy);
                flush_dcache_page(bh->b_page);
                set_buffer_uptodate(bh);
                mark_buffer_dirty(bh);
                unlock_buffer(bh);
                brelse(bh);
                offset = 0;
                towrite -= tocopy;
                data += tocopy;
                blk++;
        }
out:
        if (len == towrite) {
                inode_unlock(inode);
                return err;
        }
        if (inode->i_size < off+len-towrite)
                i_size_write(inode, off+len-towrite);
        inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
        mark_inode_dirty(inode);
        inode_unlock(inode);
        return len - towrite;
}

static struct dquot __rcu **jfs_get_dquots(struct inode *inode)
{
        return JFS_IP(inode)->i_dquot;
}

static int jfs_quota_on(struct super_block *sb, int type, int format_id,
                        const struct path *path)
{
        int err;
        struct inode *inode;

        err = dquot_quota_on(sb, type, format_id, path);
        if (err)
                return err;

        inode = d_inode(path->dentry);
        inode_lock(inode);
        JFS_IP(inode)->mode2 |= JFS_NOATIME_FL | JFS_IMMUTABLE_FL;
        inode_set_flags(inode, S_NOATIME | S_IMMUTABLE,
                        S_NOATIME | S_IMMUTABLE);
        inode_unlock(inode);
        mark_inode_dirty(inode);

        return 0;
}

static int jfs_quota_off(struct super_block *sb, int type)
{
        struct inode *inode = sb_dqopt(sb)->files[type];
        int err;

        if (!inode || !igrab(inode))
                goto out;

        err = dquot_quota_off(sb, type);
        if (err)
                goto out_put;

        inode_lock(inode);
        JFS_IP(inode)->mode2 &= ~(JFS_NOATIME_FL | JFS_IMMUTABLE_FL);
        inode_set_flags(inode, 0, S_NOATIME | S_IMMUTABLE);
        inode_unlock(inode);
        mark_inode_dirty(inode);
out_put:
        iput(inode);
        return err;
out:
        return dquot_quota_off(sb, type);
}
#endif

static const struct super_operations jfs_super_operations = {
        .alloc_inode        = jfs_alloc_inode,
        .free_inode        = jfs_free_inode,
        .dirty_inode        = jfs_dirty_inode,
        .write_inode        = jfs_write_inode,
        .evict_inode        = jfs_evict_inode,
        .put_super        = jfs_put_super,
        .sync_fs        = jfs_sync_fs,
        .freeze_fs        = jfs_freeze,
        .unfreeze_fs        = jfs_unfreeze,
        .statfs                = jfs_statfs,
        .show_options        = jfs_show_options,
#ifdef CONFIG_QUOTA
        .quota_read        = jfs_quota_read,
        .quota_write        = jfs_quota_write,
        .get_dquots        = jfs_get_dquots,
#endif
};

static const struct export_operations jfs_export_operations = {
        .encode_fh        = generic_encode_ino32_fh,
        .fh_to_dentry        = jfs_fh_to_dentry,
        .fh_to_parent        = jfs_fh_to_parent,
        .get_parent        = jfs_get_parent,
};

static void jfs_init_options(struct fs_context *fc, struct jfs_context *ctx)
{
        if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE) {
                struct super_block *sb = fc->root->d_sb;

                /* Copy over current option values and mount flags */
                ctx->uid = JFS_SBI(sb)->uid;
                ctx->gid = JFS_SBI(sb)->gid;
                ctx->umask = JFS_SBI(sb)->umask;
                ctx->nls_map = (void *)-1;
                ctx->minblks_trim = JFS_SBI(sb)->minblks_trim;
                ctx->flag = JFS_SBI(sb)->flag;

        } else {
                /*
                 * Initialize the mount flag and determine the default
                 * error handler
                 */
                ctx->flag = JFS_ERR_REMOUNT_RO;
                ctx->uid = INVALID_UID;
                ctx->gid = INVALID_GID;
                ctx->umask = -1;
                ctx->nls_map = (void *)-1;
        }
}

static void jfs_free_fc(struct fs_context *fc)
{
        struct jfs_context *ctx = fc->fs_private;

        if (ctx->nls_map != (void *) -1)
                unload_nls(ctx->nls_map);
        kfree(ctx);
}

static const struct fs_context_operations jfs_context_ops = {
        .parse_param        = jfs_parse_param,
        .get_tree        = jfs_get_tree,
        .reconfigure        = jfs_reconfigure,
        .free                = jfs_free_fc,
};

static int jfs_init_fs_context(struct fs_context *fc)
{
        struct jfs_context *ctx;

        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
        if (!ctx)
                return -ENOMEM;

        jfs_init_options(fc, ctx);

        fc->fs_private = ctx;
        fc->ops = &jfs_context_ops;

        return 0;
}

static struct file_system_type jfs_fs_type = {
        .owner                = THIS_MODULE,
        .name                = "jfs",
        .kill_sb        = kill_block_super,
        .fs_flags        = FS_REQUIRES_DEV,
        .init_fs_context = jfs_init_fs_context,
        .parameters        = jfs_param_spec,
};
MODULE_ALIAS_FS("jfs");

static void init_once(void *foo)
{
        struct jfs_inode_info *jfs_ip = (struct jfs_inode_info *) foo;

        memset(jfs_ip, 0, sizeof(struct jfs_inode_info));
        INIT_LIST_HEAD(&jfs_ip->anon_inode_list);
        init_rwsem(&jfs_ip->rdwrlock);
        mutex_init(&jfs_ip->commit_mutex);
        init_rwsem(&jfs_ip->xattr_sem);
        spin_lock_init(&jfs_ip->ag_lock);
        jfs_ip->active_ag = -1;
        inode_init_once(&jfs_ip->vfs_inode);
}

static int __init init_jfs_fs(void)
{
        int i;
        int rc;

        jfs_inode_cachep =
            kmem_cache_create_usercopy("jfs_ip", sizeof(struct jfs_inode_info),
                        0, SLAB_RECLAIM_ACCOUNT|SLAB_ACCOUNT,
                        offsetof(struct jfs_inode_info, i_inline_all),
                        sizeof_field(struct jfs_inode_info, i_inline_all),
                        init_once);
        if (jfs_inode_cachep == NULL)
                return -ENOMEM;

        /*
         * Metapage initialization
         */
        rc = metapage_init();
        if (rc) {
                jfs_err("metapage_init failed w/rc = %d", rc);
                goto free_slab;
        }

        /*
         * Transaction Manager initialization
         */
        rc = txInit();
        if (rc) {
                jfs_err("txInit failed w/rc = %d", rc);
                goto free_metapage;
        }

        /*
         * I/O completion thread (endio)
         */
        jfsIOthread = kthread_run(jfsIOWait, NULL, "jfsIO");
        if (IS_ERR(jfsIOthread)) {
                rc = PTR_ERR(jfsIOthread);
                jfs_err("init_jfs_fs: fork failed w/rc = %d", rc);
                goto end_txmngr;
        }

        if (commit_threads < 1)
                commit_threads = num_online_cpus();
        if (commit_threads > MAX_COMMIT_THREADS)
                commit_threads = MAX_COMMIT_THREADS;

        for (i = 0; i < commit_threads; i++) {
                jfsCommitThread[i] = kthread_run(jfs_lazycommit, NULL,
                                                 "jfsCommit");
                if (IS_ERR(jfsCommitThread[i])) {
                        rc = PTR_ERR(jfsCommitThread[i]);
                        jfs_err("init_jfs_fs: fork failed w/rc = %d", rc);
                        commit_threads = i;
                        goto kill_committask;
                }
        }

        jfsSyncThread = kthread_run(jfs_sync, NULL, "jfsSync");
        if (IS_ERR(jfsSyncThread)) {
                rc = PTR_ERR(jfsSyncThread);
                jfs_err("init_jfs_fs: fork failed w/rc = %d", rc);
                goto kill_committask;
        }

#ifdef PROC_FS_JFS
        jfs_proc_init();
#endif

        rc = register_filesystem(&jfs_fs_type);
        if (!rc)
                return 0;

#ifdef PROC_FS_JFS
        jfs_proc_clean();
#endif
        kthread_stop(jfsSyncThread);
kill_committask:
        for (i = 0; i < commit_threads; i++)
                kthread_stop(jfsCommitThread[i]);
        kthread_stop(jfsIOthread);
end_txmngr:
        txExit();
free_metapage:
        metapage_exit();
free_slab:
        kmem_cache_destroy(jfs_inode_cachep);
        return rc;
}

static void __exit exit_jfs_fs(void)
{
        int i;

        jfs_info("exit_jfs_fs called");

        txExit();
        metapage_exit();

        kthread_stop(jfsIOthread);
        for (i = 0; i < commit_threads; i++)
                kthread_stop(jfsCommitThread[i]);
        kthread_stop(jfsSyncThread);
#ifdef PROC_FS_JFS
        jfs_proc_clean();
#endif
        unregister_filesystem(&jfs_fs_type);

        /*
         * Make sure all delayed rcu free inodes are flushed before we
         * destroy cache.
         */
        rcu_barrier();
        kmem_cache_destroy(jfs_inode_cachep);
}

module_init(init_jfs_fs)
module_exit(exit_jfs_fs)



























































































































































 4984 
 4982 




































    2 







    2 



















   11 
















   11 


   11 







   47 




















 11321 
























 11041 





 11055 




 11057 

 11057 



 11044 




 11312 



 11321 


 11047 
 11094 
 11059 










 5397 
 11351 







 11838 
 11854 




    2 
   42 

   33 










  396 
  151 
    3 
  409 



 11751 
 11734 







 11741 




 14853 



 14854 



    1 







    1 
    1 
    1 










  268 




  267 





   16 













   22 






    8 











    8 
  413 
 5871 


















 8628 













 11864 



 11912 








 10526 












 11855 
    1 


















   47 

   46 

   37 








 10474 












 10465 

 10526 
    3 







    3 




 10474 















  170 

  135 
  136 



  160 
   10 
   10 

  102 
   73 





















   86 















   91 









    1 


    1 





   86 
    3 




    3 

   86 





   89 

    3 


   86 

































  170 



    1 


  170 







   98 
   77 




   54 


  120 
    6 
    8 

  101 

   73 






   41 
  135 









  163 
    1 
    9 






  170 
























 10429 

















  685 











 10438 


















   52 
 9836 
















 2979 
 9881 













 1620 
 1615 














 7376 
 7386 




   22 
   41 
   21 








    4 
   10 
   26 




   52 













   13 







   40 











    8 



    3 


    5 
    4 
    3 




   36 








    3 


    1 




    6 
   27 


   24 



    8 
   22 



   21 



   10 



    8 



   20 
   14 


   18 










    8 

    6 
   10 
   13 
    3 




   20 

   17 


   17 



   17 





    7 





   12 





    2 


    1 

    1 











    9 
    3 






    2 


    5 












   10 









    5 





    5 
    5 






   44 










 11850 






 11841 

   11 






   10 




    2 



    2 



    2 


    4 

    8 


 11842 





 11653 








  201 

















 8688 




   18 



   17 
   16 
   17 







    1 


    1 



    1 

    1 





 8705 




  891 


 12741 







 8673 
 8677 

 8676 




    2 

    2 



 15315 


 15379 
 15302 

 15258 


 1833 



  418 


















 11888 

 11888 





 11784 





 11837 






 11872 

 11892 





 11889 




   10 




   18 




 8661 




 5244 









 5246 








  332 








   39 

 2876 
 2865 


























    2 


 4948 



 2866 
 4573 















 2871 
    9 

 2701 

  222 




  221 


 2872 








 2870 






    1 




 2871 

 2881 

   39 








 2874 







 5759 
























 5778 
 5485 



 5765 


   30 




 5688 
 2860 
   40 








 3797 











































































   23 




   23 
   23 
   23 




   50 





    1 


   50 



   32 







   26 




    3 

    7 

   17 






   20 
    3 







    3 
    2 
    1 




    3 
















   15 





   30 





    2 


    2 

    1 


    3 













    7 











    1 




















   11 





    1 

















    3 







 11864 










    2 



   96 



 11903 
   11 




    1 

    2 




  146 





 11750 






 10424 



 1674 



    2 












 11840 










 11831 
   20 





 11789 





  410 







    1 





   71 





  406 










    2 











  325 
  240 





  123 








  400 
    6 
  403 
    3 



  325 
   86 



  165 


  334 
    1 




  408 

  411 

















   47 



















   47 










   47 




















   47 




















































































 4629 


















 8997 


 8987 



    3 
   10 




    3 




    4 
    6 

















   11 
    1 
   10 
   11 



    2 


    2 
    7 

    3 
    6 

    8 
    1 

    9 












  891 








  887 



  888 


    3 









 1349 










 1098 
  335 
    1 




    1 











 1130 





  301 



 1126 












 1351 




 1347 


 1357 

    2 










 1308 
   41 

    1 


 1333 




    1 

  620 











  892 






    2 

  894 

  468 
  424 


















 1241 





 1240 

 1245 








    2 






















  564 



  534 








 1091 









  142 


  142 









 8157 












  842 
 7609 



















  843 
 7629 


 7600 



 8163 
    8 


















 10462 




 10407 






  224 



    9 



  172 



 1066 



 9419 
 7545 























 2584 





 2199 
  608 










 2198 


  608 




























    6 


















    4 


    6 

    6 






    6 








    6 






    6 








    4 


    3 






    6 










    6 

































    6 






    6 








    6 



    3 


    4 



    6 




























































   47 





























































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * NETLINK      Kernel-user communication protocol.
 *
 *                 Authors:        Alan Cox <alan@lxorguk.ukuu.org.uk>
 *                                 Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
 *                                 Patrick McHardy <kaber@trash.net>
 *
 * Tue Jun 26 14:36:48 MEST 2001 Herbert "herp" Rosmanith
 *                               added netlink_proto_exit
 * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
 *                                  use nlk_sk, as sk->protinfo is on a diet 8)
 * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
 *                                  - inc module use count of module that owns
 *                                    the kernel socket in case userspace opens
 *                                    socket of same protocol
 *                                  - remove all module support, since netlink is
 *                                    mandatory if CONFIG_NET=y these days
 */

#include <linux/module.h>

#include <linux/bpf.h>
#include <linux/capability.h>
#include <linux/kernel.h>
#include <linux/filter.h>
#include <linux/init.h>
#include <linux/signal.h>
#include <linux/sched.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/un.h>
#include <linux/fcntl.h>
#include <linux/termios.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/notifier.h>
#include <linux/security.h>
#include <linux/jhash.h>
#include <linux/jiffies.h>
#include <linux/random.h>
#include <linux/bitops.h>
#include <linux/mm.h>
#include <linux/types.h>
#include <linux/audit.h>
#include <linux/mutex.h>
#include <linux/vmalloc.h>
#include <linux/if_arp.h>
#include <linux/rhashtable.h>
#include <asm/cacheflush.h>
#include <linux/hash.h>
#include <linux/net_namespace.h>
#include <linux/nospec.h>
#include <linux/btf_ids.h>

#include <net/net_namespace.h>
#include <net/netns/generic.h>
#include <net/sock.h>
#include <net/scm.h>
#include <net/netlink.h>
#define CREATE_TRACE_POINTS
#include <trace/events/netlink.h>

#include "af_netlink.h"
#include "genetlink.h"

struct listeners {
        struct rcu_head                rcu;
        unsigned long                masks[];
};

/* state bits */
#define NETLINK_S_CONGESTED                0x0

static inline int netlink_is_kernel(struct sock *sk)
{
        return nlk_test_bit(KERNEL_SOCKET, sk);
}

struct netlink_table *nl_table __read_mostly;
EXPORT_SYMBOL_GPL(nl_table);

static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);

static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS];

static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
        "nlk_cb_mutex-ROUTE",
        "nlk_cb_mutex-1",
        "nlk_cb_mutex-USERSOCK",
        "nlk_cb_mutex-FIREWALL",
        "nlk_cb_mutex-SOCK_DIAG",
        "nlk_cb_mutex-NFLOG",
        "nlk_cb_mutex-XFRM",
        "nlk_cb_mutex-SELINUX",
        "nlk_cb_mutex-ISCSI",
        "nlk_cb_mutex-AUDIT",
        "nlk_cb_mutex-FIB_LOOKUP",
        "nlk_cb_mutex-CONNECTOR",
        "nlk_cb_mutex-NETFILTER",
        "nlk_cb_mutex-IP6_FW",
        "nlk_cb_mutex-DNRTMSG",
        "nlk_cb_mutex-KOBJECT_UEVENT",
        "nlk_cb_mutex-GENERIC",
        "nlk_cb_mutex-17",
        "nlk_cb_mutex-SCSITRANSPORT",
        "nlk_cb_mutex-ECRYPTFS",
        "nlk_cb_mutex-RDMA",
        "nlk_cb_mutex-CRYPTO",
        "nlk_cb_mutex-SMC",
        "nlk_cb_mutex-23",
        "nlk_cb_mutex-24",
        "nlk_cb_mutex-25",
        "nlk_cb_mutex-26",
        "nlk_cb_mutex-27",
        "nlk_cb_mutex-28",
        "nlk_cb_mutex-29",
        "nlk_cb_mutex-30",
        "nlk_cb_mutex-31",
        "nlk_cb_mutex-MAX_LINKS"
};

static int netlink_dump(struct sock *sk, bool lock_taken);

/* nl_table locking explained:
 * Lookup and traversal are protected with an RCU read-side lock. Insertion
 * and removal are protected with per bucket lock while using RCU list
 * modification primitives and may run in parallel to RCU protected lookups.
 * Destruction of the Netlink socket may only occur *after* nl_table_lock has
 * been acquired * either during or after the socket has been removed from
 * the list and after an RCU grace period.
 */
DEFINE_RWLOCK(nl_table_lock);
EXPORT_SYMBOL_GPL(nl_table_lock);
static atomic_t nl_table_users = ATOMIC_INIT(0);

#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));

static BLOCKING_NOTIFIER_HEAD(netlink_chain);


static const struct rhashtable_params netlink_rhashtable_params;

void do_trace_netlink_extack(const char *msg)
{
        trace_netlink_extack(msg);
}
EXPORT_SYMBOL(do_trace_netlink_extack);

static inline u32 netlink_group_mask(u32 group)
{
        if (group > 32)
                return 0;
        return group ? 1 << (group - 1) : 0;
}

static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
                                           gfp_t gfp_mask)
{
        unsigned int len = skb->len;
        struct sk_buff *new;

        new = alloc_skb(len, gfp_mask);
        if (new == NULL)
                return NULL;

        NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
        NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
        NETLINK_CB(new).creds = NETLINK_CB(skb).creds;

        skb_put_data(new, skb->data, len);
        return new;
}

static unsigned int netlink_tap_net_id;

struct netlink_tap_net {
        struct list_head netlink_tap_all;
        struct mutex netlink_tap_lock;
};

int netlink_add_tap(struct netlink_tap *nt)
{
        struct net *net = dev_net(nt->dev);
        struct netlink_tap_net *nn = net_generic(net, netlink_tap_net_id);

        if (unlikely(nt->dev->type != ARPHRD_NETLINK))
                return -EINVAL;

        mutex_lock(&nn->netlink_tap_lock);
        list_add_rcu(&nt->list, &nn->netlink_tap_all);
        mutex_unlock(&nn->netlink_tap_lock);

        __module_get(nt->module);

        return 0;
}
EXPORT_SYMBOL_GPL(netlink_add_tap);

static int __netlink_remove_tap(struct netlink_tap *nt)
{
        struct net *net = dev_net(nt->dev);
        struct netlink_tap_net *nn = net_generic(net, netlink_tap_net_id);
        bool found = false;
        struct netlink_tap *tmp;

        mutex_lock(&nn->netlink_tap_lock);

        list_for_each_entry(tmp, &nn->netlink_tap_all, list) {
                if (nt == tmp) {
                        list_del_rcu(&nt->list);
                        found = true;
                        goto out;
                }
        }

        pr_warn("__netlink_remove_tap: %p not found\n", nt);
out:
        mutex_unlock(&nn->netlink_tap_lock);

        if (found)
                module_put(nt->module);

        return found ? 0 : -ENODEV;
}

int netlink_remove_tap(struct netlink_tap *nt)
{
        int ret;

        ret = __netlink_remove_tap(nt);
        synchronize_net();

        return ret;
}
EXPORT_SYMBOL_GPL(netlink_remove_tap);

static __net_init int netlink_tap_init_net(struct net *net)
{
        struct netlink_tap_net *nn = net_generic(net, netlink_tap_net_id);

        INIT_LIST_HEAD(&nn->netlink_tap_all);
        mutex_init(&nn->netlink_tap_lock);
        return 0;
}

static struct pernet_operations netlink_tap_net_ops = {
        .init = netlink_tap_init_net,
        .id   = &netlink_tap_net_id,
        .size = sizeof(struct netlink_tap_net),
};

static bool netlink_filter_tap(const struct sk_buff *skb)
{
        struct sock *sk = skb->sk;

        /* We take the more conservative approach and
         * whitelist socket protocols that may pass.
         */
        switch (sk->sk_protocol) {
        case NETLINK_ROUTE:
        case NETLINK_USERSOCK:
        case NETLINK_SOCK_DIAG:
        case NETLINK_NFLOG:
        case NETLINK_XFRM:
        case NETLINK_FIB_LOOKUP:
        case NETLINK_NETFILTER:
        case NETLINK_GENERIC:
                return true;
        }

        return false;
}

static int __netlink_deliver_tap_skb(struct sk_buff *skb,
                                     struct net_device *dev)
{
        struct sk_buff *nskb;
        struct sock *sk = skb->sk;
        int ret = -ENOMEM;

        if (!net_eq(dev_net(dev), sock_net(sk)))
                return 0;

        dev_hold(dev);

        if (is_vmalloc_addr(skb->head))
                nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
        else
                nskb = skb_clone(skb, GFP_ATOMIC);
        if (nskb) {
                nskb->dev = dev;
                nskb->protocol = htons((u16) sk->sk_protocol);
                nskb->pkt_type = netlink_is_kernel(sk) ?
                                 PACKET_KERNEL : PACKET_USER;
                skb_reset_network_header(nskb);
                ret = dev_queue_xmit(nskb);
                if (unlikely(ret > 0))
                        ret = net_xmit_errno(ret);
        }

        dev_put(dev);
        return ret;
}

static void __netlink_deliver_tap(struct sk_buff *skb, struct netlink_tap_net *nn)
{
        int ret;
        struct netlink_tap *tmp;

        if (!netlink_filter_tap(skb))
                return;

        list_for_each_entry_rcu(tmp, &nn->netlink_tap_all, list) {
                ret = __netlink_deliver_tap_skb(skb, tmp->dev);
                if (unlikely(ret))
                        break;
        }
}

static void netlink_deliver_tap(struct net *net, struct sk_buff *skb)
{
        struct netlink_tap_net *nn = net_generic(net, netlink_tap_net_id);

        rcu_read_lock();

        if (unlikely(!list_empty(&nn->netlink_tap_all)))
                __netlink_deliver_tap(skb, nn);

        rcu_read_unlock();
}

static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
                                       struct sk_buff *skb)
{
        if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
                netlink_deliver_tap(sock_net(dst), skb);
}

static void netlink_overrun(struct sock *sk)
{
        if (!nlk_test_bit(RECV_NO_ENOBUFS, sk)) {
                if (!test_and_set_bit(NETLINK_S_CONGESTED,
                                      &nlk_sk(sk)->state)) {
                        WRITE_ONCE(sk->sk_err, ENOBUFS);
                        sk_error_report(sk);
                }
        }
        atomic_inc(&sk->sk_drops);
}

static void netlink_rcv_wake(struct sock *sk)
{
        struct netlink_sock *nlk = nlk_sk(sk);

        if (skb_queue_empty_lockless(&sk->sk_receive_queue))
                clear_bit(NETLINK_S_CONGESTED, &nlk->state);
        if (!test_bit(NETLINK_S_CONGESTED, &nlk->state))
                wake_up_interruptible(&nlk->wait);
}

static void netlink_skb_destructor(struct sk_buff *skb)
{
        if (is_vmalloc_addr(skb->head)) {
                if (!skb->cloned ||
                    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
                        vfree_atomic(skb->head);

                skb->head = NULL;
        }
        if (skb->sk != NULL)
                sock_rfree(skb);
}

static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
{
        WARN_ON(skb->sk != NULL);
        skb->sk = sk;
        skb->destructor = netlink_skb_destructor;
        atomic_add(skb->truesize, &sk->sk_rmem_alloc);
        sk_mem_charge(sk, skb->truesize);
}

static void netlink_sock_destruct(struct sock *sk)
{
        skb_queue_purge(&sk->sk_receive_queue);

        if (!sock_flag(sk, SOCK_DEAD)) {
                printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
                return;
        }

        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
        WARN_ON(refcount_read(&sk->sk_wmem_alloc));
        WARN_ON(nlk_sk(sk)->groups);
}

/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
 * SMP. Look, when several writers sleep and reader wakes them up, all but one
 * immediately hit write lock and grab all the cpus. Exclusive sleep solves
 * this, _but_ remember, it adds useless work on UP machines.
 */

void netlink_table_grab(void)
        __acquires(nl_table_lock)
{
        might_sleep();

        write_lock_irq(&nl_table_lock);

        if (atomic_read(&nl_table_users)) {
                DECLARE_WAITQUEUE(wait, current);

                add_wait_queue_exclusive(&nl_table_wait, &wait);
                for (;;) {
                        set_current_state(TASK_UNINTERRUPTIBLE);
                        if (atomic_read(&nl_table_users) == 0)
                                break;
                        write_unlock_irq(&nl_table_lock);
                        schedule();
                        write_lock_irq(&nl_table_lock);
                }

                __set_current_state(TASK_RUNNING);
                remove_wait_queue(&nl_table_wait, &wait);
        }
}

void netlink_table_ungrab(void)
        __releases(nl_table_lock)
{
        write_unlock_irq(&nl_table_lock);
        wake_up(&nl_table_wait);
}

static inline void
netlink_lock_table(void)
{
        unsigned long flags;

        /* read_lock() synchronizes us to netlink_table_grab */

        read_lock_irqsave(&nl_table_lock, flags);
        atomic_inc(&nl_table_users);
        read_unlock_irqrestore(&nl_table_lock, flags);
}

static inline void
netlink_unlock_table(void)
{
        if (atomic_dec_and_test(&nl_table_users))
                wake_up(&nl_table_wait);
}

struct netlink_compare_arg
{
        possible_net_t pnet;
        u32 portid;
};

/* Doing sizeof directly may yield 4 extra bytes on 64-bit. */
#define netlink_compare_arg_len \
        (offsetof(struct netlink_compare_arg, portid) + sizeof(u32))

static inline int netlink_compare(struct rhashtable_compare_arg *arg,
                                  const void *ptr)
{
        const struct netlink_compare_arg *x = arg->key;
        const struct netlink_sock *nlk = ptr;

        return nlk->portid != x->portid ||
               !net_eq(sock_net(&nlk->sk), read_pnet(&x->pnet));
}

static void netlink_compare_arg_init(struct netlink_compare_arg *arg,
                                     struct net *net, u32 portid)
{
        memset(arg, 0, sizeof(*arg));
        write_pnet(&arg->pnet, net);
        arg->portid = portid;
}

static struct sock *__netlink_lookup(struct netlink_table *table, u32 portid,
                                     struct net *net)
{
        struct netlink_compare_arg arg;

        netlink_compare_arg_init(&arg, net, portid);
        return rhashtable_lookup_fast(&table->hash, &arg,
                                      netlink_rhashtable_params);
}

static int __netlink_insert(struct netlink_table *table, struct sock *sk)
{
        struct netlink_compare_arg arg;

        netlink_compare_arg_init(&arg, sock_net(sk), nlk_sk(sk)->portid);
        return rhashtable_lookup_insert_key(&table->hash, &arg,
                                            &nlk_sk(sk)->node,
                                            netlink_rhashtable_params);
}

static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
{
        struct netlink_table *table = &nl_table[protocol];
        struct sock *sk;

        rcu_read_lock();
        sk = __netlink_lookup(table, portid, net);
        if (sk)
                sock_hold(sk);
        rcu_read_unlock();

        return sk;
}

static const struct proto_ops netlink_ops;

static void
netlink_update_listeners(struct sock *sk)
{
        struct netlink_table *tbl = &nl_table[sk->sk_protocol];
        unsigned long mask;
        unsigned int i;
        struct listeners *listeners;

        listeners = nl_deref_protected(tbl->listeners);
        if (!listeners)
                return;

        for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
                mask = 0;
                sk_for_each_bound(sk, &tbl->mc_list) {
                        if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
                                mask |= nlk_sk(sk)->groups[i];
                }
                listeners->masks[i] = mask;
        }
        /* this function is only called with the netlink table "grabbed", which
         * makes sure updates are visible before bind or setsockopt return. */
}

static int netlink_insert(struct sock *sk, u32 portid)
{
        struct netlink_table *table = &nl_table[sk->sk_protocol];
        int err;

        lock_sock(sk);

        err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
        if (nlk_sk(sk)->bound)
                goto err;

        /* portid can be read locklessly from netlink_getname(). */
        WRITE_ONCE(nlk_sk(sk)->portid, portid);

        sock_hold(sk);

        err = __netlink_insert(table, sk);
        if (err) {
                /* In case the hashtable backend returns with -EBUSY
                 * from here, it must not escape to the caller.
                 */
                if (unlikely(err == -EBUSY))
                        err = -EOVERFLOW;
                if (err == -EEXIST)
                        err = -EADDRINUSE;
                sock_put(sk);
                goto err;
        }

        /* We need to ensure that the socket is hashed and visible. */
        smp_wmb();
        /* Paired with lockless reads from netlink_bind(),
         * netlink_connect() and netlink_sendmsg().
         */
        WRITE_ONCE(nlk_sk(sk)->bound, portid);

err:
        release_sock(sk);
        return err;
}

static void netlink_remove(struct sock *sk)
{
        struct netlink_table *table;

        table = &nl_table[sk->sk_protocol];
        if (!rhashtable_remove_fast(&table->hash, &nlk_sk(sk)->node,
                                    netlink_rhashtable_params)) {
                WARN_ON(refcount_read(&sk->sk_refcnt) == 1);
                __sock_put(sk);
        }

        netlink_table_grab();
        if (nlk_sk(sk)->subscriptions) {
                __sk_del_bind_node(sk);
                netlink_update_listeners(sk);
        }
        if (sk->sk_protocol == NETLINK_GENERIC)
                atomic_inc(&genl_sk_destructing_cnt);
        netlink_table_ungrab();
}

static struct proto netlink_proto = {
        .name          = "NETLINK",
        .owner          = THIS_MODULE,
        .obj_size = sizeof(struct netlink_sock),
};

static int __netlink_create(struct net *net, struct socket *sock,
                            int protocol, int kern)
{
        struct sock *sk;
        struct netlink_sock *nlk;

        sock->ops = &netlink_ops;

        sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, kern);
        if (!sk)
                return -ENOMEM;

        sock_init_data(sock, sk);

        nlk = nlk_sk(sk);
        mutex_init(&nlk->nl_cb_mutex);
        lockdep_set_class_and_name(&nlk->nl_cb_mutex,
                                           nlk_cb_mutex_keys + protocol,
                                           nlk_cb_mutex_key_strings[protocol]);
        init_waitqueue_head(&nlk->wait);

        sk->sk_destruct = netlink_sock_destruct;
        sk->sk_protocol = protocol;
        return 0;
}

static int netlink_create(struct net *net, struct socket *sock, int protocol,
                          int kern)
{
        struct module *module = NULL;
        struct netlink_sock *nlk;
        int (*bind)(struct net *net, int group);
        void (*unbind)(struct net *net, int group);
        void (*release)(struct sock *sock, unsigned long *groups);
        int err = 0;

        sock->state = SS_UNCONNECTED;

        if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
                return -ESOCKTNOSUPPORT;

        if (protocol < 0 || protocol >= MAX_LINKS)
                return -EPROTONOSUPPORT;
        protocol = array_index_nospec(protocol, MAX_LINKS);

        netlink_lock_table();
#ifdef CONFIG_MODULES
        if (!nl_table[protocol].registered) {
                netlink_unlock_table();
                request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
                netlink_lock_table();
        }
#endif
        if (nl_table[protocol].registered &&
            try_module_get(nl_table[protocol].module))
                module = nl_table[protocol].module;
        else
                err = -EPROTONOSUPPORT;
        bind = nl_table[protocol].bind;
        unbind = nl_table[protocol].unbind;
        release = nl_table[protocol].release;
        netlink_unlock_table();

        if (err < 0)
                goto out;

        err = __netlink_create(net, sock, protocol, kern);
        if (err < 0)
                goto out_module;

        sock_prot_inuse_add(net, &netlink_proto, 1);

        nlk = nlk_sk(sock->sk);
        nlk->module = module;
        nlk->netlink_bind = bind;
        nlk->netlink_unbind = unbind;
        nlk->netlink_release = release;
out:
        return err;

out_module:
        module_put(module);
        goto out;
}

static void deferred_put_nlk_sk(struct rcu_head *head)
{
        struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
        struct sock *sk = &nlk->sk;

        kfree(nlk->groups);
        nlk->groups = NULL;

        if (!refcount_dec_and_test(&sk->sk_refcnt))
                return;

        sk_free(sk);
}

static int netlink_release(struct socket *sock)
{
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk;

        if (!sk)
                return 0;

        netlink_remove(sk);
        sock_orphan(sk);
        nlk = nlk_sk(sk);

        /*
         * OK. Socket is unlinked, any packets that arrive now
         * will be purged.
         */
        if (nlk->netlink_release)
                nlk->netlink_release(sk, nlk->groups);

        /* must not acquire netlink_table_lock in any way again before unbind
         * and notifying genetlink is done as otherwise it might deadlock
         */
        if (nlk->netlink_unbind) {
                int i;

                for (i = 0; i < nlk->ngroups; i++)
                        if (test_bit(i, nlk->groups))
                                nlk->netlink_unbind(sock_net(sk), i + 1);
        }
        if (sk->sk_protocol == NETLINK_GENERIC &&
            atomic_dec_return(&genl_sk_destructing_cnt) == 0)
                wake_up(&genl_sk_destructing_waitq);

        sock->sk = NULL;
        wake_up_interruptible_all(&nlk->wait);

        skb_queue_purge(&sk->sk_write_queue);

        if (nlk->portid && nlk->bound) {
                struct netlink_notify n = {
                                                .net = sock_net(sk),
                                                .protocol = sk->sk_protocol,
                                                .portid = nlk->portid,
                                          };
                blocking_notifier_call_chain(&netlink_chain,
                                NETLINK_URELEASE, &n);
        }

        /* Terminate any outstanding dump */
        if (nlk->cb_running) {
                if (nlk->cb.done)
                        nlk->cb.done(&nlk->cb);
                module_put(nlk->cb.module);
                kfree_skb(nlk->cb.skb);
        }

        module_put(nlk->module);

        if (netlink_is_kernel(sk)) {
                netlink_table_grab();
                BUG_ON(nl_table[sk->sk_protocol].registered == 0);
                if (--nl_table[sk->sk_protocol].registered == 0) {
                        struct listeners *old;

                        old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
                        RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
                        kfree_rcu(old, rcu);
                        nl_table[sk->sk_protocol].module = NULL;
                        nl_table[sk->sk_protocol].bind = NULL;
                        nl_table[sk->sk_protocol].unbind = NULL;
                        nl_table[sk->sk_protocol].flags = 0;
                        nl_table[sk->sk_protocol].registered = 0;
                }
                netlink_table_ungrab();
        }

        sock_prot_inuse_add(sock_net(sk), &netlink_proto, -1);

        call_rcu(&nlk->rcu, deferred_put_nlk_sk);
        return 0;
}

static int netlink_autobind(struct socket *sock)
{
        struct sock *sk = sock->sk;
        struct net *net = sock_net(sk);
        struct netlink_table *table = &nl_table[sk->sk_protocol];
        s32 portid = task_tgid_vnr(current);
        int err;
        s32 rover = -4096;
        bool ok;

retry:
        cond_resched();
        rcu_read_lock();
        ok = !__netlink_lookup(table, portid, net);
        rcu_read_unlock();
        if (!ok) {
                /* Bind collision, search negative portid values. */
                if (rover == -4096)
                        /* rover will be in range [S32_MIN, -4097] */
                        rover = S32_MIN + get_random_u32_below(-4096 - S32_MIN);
                else if (rover >= -4096)
                        rover = -4097;
                portid = rover--;
                goto retry;
        }

        err = netlink_insert(sk, portid);
        if (err == -EADDRINUSE)
                goto retry;

        /* If 2 threads race to autobind, that is fine.  */
        if (err == -EBUSY)
                err = 0;

        return err;
}

/**
 * __netlink_ns_capable - General netlink message capability test
 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has the capability @cap in the user namespace @user_ns.
 */
bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
                        struct user_namespace *user_ns, int cap)
{
        return ((nsp->flags & NETLINK_SKB_DST) ||
                file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
                ns_capable(user_ns, cap);
}
EXPORT_SYMBOL(__netlink_ns_capable);

/**
 * netlink_ns_capable - General netlink message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has the capability @cap in the user namespace @user_ns.
 */
bool netlink_ns_capable(const struct sk_buff *skb,
                        struct user_namespace *user_ns, int cap)
{
        return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
}
EXPORT_SYMBOL(netlink_ns_capable);

/**
 * netlink_capable - Netlink global message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has the capability @cap in all user namespaces.
 */
bool netlink_capable(const struct sk_buff *skb, int cap)
{
        return netlink_ns_capable(skb, &init_user_ns, cap);
}
EXPORT_SYMBOL(netlink_capable);

/**
 * netlink_net_capable - Netlink network namespace message capability test
 * @skb: socket buffer holding a netlink command from userspace
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket we received the message
 * from had when the netlink socket was created and the sender of the
 * message has the capability @cap over the network namespace of
 * the socket we received the message from.
 */
bool netlink_net_capable(const struct sk_buff *skb, int cap)
{
        return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
}
EXPORT_SYMBOL(netlink_net_capable);

static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
{
        return (nl_table[sock->sk->sk_protocol].flags & flag) ||
                ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
}

static void
netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
{
        struct netlink_sock *nlk = nlk_sk(sk);

        if (nlk->subscriptions && !subscriptions)
                __sk_del_bind_node(sk);
        else if (!nlk->subscriptions && subscriptions)
                sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
        nlk->subscriptions = subscriptions;
}

static int netlink_realloc_groups(struct sock *sk)
{
        struct netlink_sock *nlk = nlk_sk(sk);
        unsigned int groups;
        unsigned long *new_groups;
        int err = 0;

        netlink_table_grab();

        groups = nl_table[sk->sk_protocol].groups;
        if (!nl_table[sk->sk_protocol].registered) {
                err = -ENOENT;
                goto out_unlock;
        }

        if (nlk->ngroups >= groups)
                goto out_unlock;

        new_groups = krealloc(nlk->groups, NLGRPSZ(groups), GFP_ATOMIC);
        if (new_groups == NULL) {
                err = -ENOMEM;
                goto out_unlock;
        }
        memset((char *)new_groups + NLGRPSZ(nlk->ngroups), 0,
               NLGRPSZ(groups) - NLGRPSZ(nlk->ngroups));

        nlk->groups = new_groups;
        nlk->ngroups = groups;
 out_unlock:
        netlink_table_ungrab();
        return err;
}

static void netlink_undo_bind(int group, long unsigned int groups,
                              struct sock *sk)
{
        struct netlink_sock *nlk = nlk_sk(sk);
        int undo;

        if (!nlk->netlink_unbind)
                return;

        for (undo = 0; undo < group; undo++)
                if (test_bit(undo, &groups))
                        nlk->netlink_unbind(sock_net(sk), undo + 1);
}

static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                        int addr_len)
{
        struct sock *sk = sock->sk;
        struct net *net = sock_net(sk);
        struct netlink_sock *nlk = nlk_sk(sk);
        struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
        int err = 0;
        unsigned long groups;
        bool bound;

        if (addr_len < sizeof(struct sockaddr_nl))
                return -EINVAL;

        if (nladdr->nl_family != AF_NETLINK)
                return -EINVAL;
        groups = nladdr->nl_groups;

        /* Only superuser is allowed to listen multicasts */
        if (groups) {
                if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
                        return -EPERM;
                err = netlink_realloc_groups(sk);
                if (err)
                        return err;
        }

        if (nlk->ngroups < BITS_PER_LONG)
                groups &= (1UL << nlk->ngroups) - 1;

        /* Paired with WRITE_ONCE() in netlink_insert() */
        bound = READ_ONCE(nlk->bound);
        if (bound) {
                /* Ensure nlk->portid is up-to-date. */
                smp_rmb();

                if (nladdr->nl_pid != nlk->portid)
                        return -EINVAL;
        }

        if (nlk->netlink_bind && groups) {
                int group;

                /* nl_groups is a u32, so cap the maximum groups we can bind */
                for (group = 0; group < BITS_PER_TYPE(u32); group++) {
                        if (!test_bit(group, &groups))
                                continue;
                        err = nlk->netlink_bind(net, group + 1);
                        if (!err)
                                continue;
                        netlink_undo_bind(group, groups, sk);
                        return err;
                }
        }

        /* No need for barriers here as we return to user-space without
         * using any of the bound attributes.
         */
        netlink_lock_table();
        if (!bound) {
                err = nladdr->nl_pid ?
                        netlink_insert(sk, nladdr->nl_pid) :
                        netlink_autobind(sock);
                if (err) {
                        netlink_undo_bind(BITS_PER_TYPE(u32), groups, sk);
                        goto unlock;
                }
        }

        if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
                goto unlock;
        netlink_unlock_table();

        netlink_table_grab();
        netlink_update_subscriptions(sk, nlk->subscriptions +
                                         hweight32(groups) -
                                         hweight32(nlk->groups[0]));
        nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | groups;
        netlink_update_listeners(sk);
        netlink_table_ungrab();

        return 0;

unlock:
        netlink_unlock_table();
        return err;
}

static int netlink_connect(struct socket *sock, struct sockaddr *addr,
                           int alen, int flags)
{
        int err = 0;
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
        struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;

        if (alen < sizeof(addr->sa_family))
                return -EINVAL;

        if (addr->sa_family == AF_UNSPEC) {
                /* paired with READ_ONCE() in netlink_getsockbyportid() */
                WRITE_ONCE(sk->sk_state, NETLINK_UNCONNECTED);
                /* dst_portid and dst_group can be read locklessly */
                WRITE_ONCE(nlk->dst_portid, 0);
                WRITE_ONCE(nlk->dst_group, 0);
                return 0;
        }
        if (addr->sa_family != AF_NETLINK)
                return -EINVAL;

        if (alen < sizeof(struct sockaddr_nl))
                return -EINVAL;

        if ((nladdr->nl_groups || nladdr->nl_pid) &&
            !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                return -EPERM;

        /* No need for barriers here as we return to user-space without
         * using any of the bound attributes.
         * Paired with WRITE_ONCE() in netlink_insert().
         */
        if (!READ_ONCE(nlk->bound))
                err = netlink_autobind(sock);

        if (err == 0) {
                /* paired with READ_ONCE() in netlink_getsockbyportid() */
                WRITE_ONCE(sk->sk_state, NETLINK_CONNECTED);
                /* dst_portid and dst_group can be read locklessly */
                WRITE_ONCE(nlk->dst_portid, nladdr->nl_pid);
                WRITE_ONCE(nlk->dst_group, ffs(nladdr->nl_groups));
        }

        return err;
}

static int netlink_getname(struct socket *sock, struct sockaddr *addr,
                           int peer)
{
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
        DECLARE_SOCKADDR(struct sockaddr_nl *, nladdr, addr);

        nladdr->nl_family = AF_NETLINK;
        nladdr->nl_pad = 0;

        if (peer) {
                /* Paired with WRITE_ONCE() in netlink_connect() */
                nladdr->nl_pid = READ_ONCE(nlk->dst_portid);
                nladdr->nl_groups = netlink_group_mask(READ_ONCE(nlk->dst_group));
        } else {
                /* Paired with WRITE_ONCE() in netlink_insert() */
                nladdr->nl_pid = READ_ONCE(nlk->portid);
                netlink_lock_table();
                nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
                netlink_unlock_table();
        }
        return sizeof(*nladdr);
}

static int netlink_ioctl(struct socket *sock, unsigned int cmd,
                         unsigned long arg)
{
        /* try to hand this ioctl down to the NIC drivers.
         */
        return -ENOIOCTLCMD;
}

static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
{
        struct sock *sock;
        struct netlink_sock *nlk;

        sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid);
        if (!sock)
                return ERR_PTR(-ECONNREFUSED);

        /* Don't bother queuing skb if kernel socket has no input function */
        nlk = nlk_sk(sock);
        /* dst_portid and sk_state can be changed in netlink_connect() */
        if (READ_ONCE(sock->sk_state) == NETLINK_CONNECTED &&
            READ_ONCE(nlk->dst_portid) != nlk_sk(ssk)->portid) {
                sock_put(sock);
                return ERR_PTR(-ECONNREFUSED);
        }
        return sock;
}

struct sock *netlink_getsockbyfd(int fd)
{
        CLASS(fd, f)(fd);
        struct inode *inode;
        struct sock *sock;

        if (fd_empty(f))
                return ERR_PTR(-EBADF);

        inode = file_inode(fd_file(f));
        if (!S_ISSOCK(inode->i_mode))
                return ERR_PTR(-ENOTSOCK);

        sock = SOCKET_I(inode)->sk;
        if (sock->sk_family != AF_NETLINK)
                return ERR_PTR(-EINVAL);

        sock_hold(sock);
        return sock;
}

struct sk_buff *netlink_alloc_large_skb(unsigned int size, int broadcast)
{
        size_t head_size = SKB_HEAD_ALIGN(size);
        struct sk_buff *skb;
        void *data;

        if (head_size <= PAGE_SIZE || broadcast)
                return alloc_skb(size, GFP_KERNEL);

        data = kvmalloc(head_size, GFP_KERNEL);
        if (!data)
                return NULL;

        skb = __build_skb(data, head_size);
        if (!skb)
                kvfree(data);
        else if (is_vmalloc_addr(data))
                skb->destructor = netlink_skb_destructor;

        return skb;
}

/*
 * Attach a skb to a netlink socket.
 * The caller must hold a reference to the destination socket. On error, the
 * reference is dropped. The skb is not send to the destination, just all
 * all error checks are performed and memory in the queue is reserved.
 * Return values:
 * < 0: error. skb freed, reference to sock dropped.
 * 0: continue
 * 1: repeat lookup - reference dropped while waiting for socket memory.
 */
int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
                      long *timeo, struct sock *ssk)
{
        struct netlink_sock *nlk;

        nlk = nlk_sk(sk);

        if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
             test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
                DECLARE_WAITQUEUE(wait, current);
                if (!*timeo) {
                        if (!ssk || netlink_is_kernel(ssk))
                                netlink_overrun(sk);
                        sock_put(sk);
                        kfree_skb(skb);
                        return -EAGAIN;
                }

                __set_current_state(TASK_INTERRUPTIBLE);
                add_wait_queue(&nlk->wait, &wait);

                if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
                     test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
                    !sock_flag(sk, SOCK_DEAD))
                        *timeo = schedule_timeout(*timeo);

                __set_current_state(TASK_RUNNING);
                remove_wait_queue(&nlk->wait, &wait);
                sock_put(sk);

                if (signal_pending(current)) {
                        kfree_skb(skb);
                        return sock_intr_errno(*timeo);
                }
                return 1;
        }
        netlink_skb_set_owner_r(skb, sk);
        return 0;
}

static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
        int len = skb->len;

        netlink_deliver_tap(sock_net(sk), skb);

        skb_queue_tail(&sk->sk_receive_queue, skb);
        sk->sk_data_ready(sk);
        return len;
}

int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
        int len = __netlink_sendskb(sk, skb);

        sock_put(sk);
        return len;
}

void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
{
        kfree_skb(skb);
        sock_put(sk);
}

static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
{
        int delta;

        skb_assert_len(skb);
        WARN_ON(skb->sk != NULL);
        delta = skb->end - skb->tail;
        if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
                return skb;

        if (skb_shared(skb)) {
                struct sk_buff *nskb = skb_clone(skb, allocation);
                if (!nskb)
                        return skb;
                consume_skb(skb);
                skb = nskb;
        }

        pskb_expand_head(skb, 0, -delta,
                         (allocation & ~__GFP_DIRECT_RECLAIM) |
                         __GFP_NOWARN | __GFP_NORETRY);
        return skb;
}

static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
                                  struct sock *ssk)
{
        int ret;
        struct netlink_sock *nlk = nlk_sk(sk);

        ret = -ECONNREFUSED;
        if (nlk->netlink_rcv != NULL) {
                ret = skb->len;
                netlink_skb_set_owner_r(skb, sk);
                NETLINK_CB(skb).sk = ssk;
                netlink_deliver_tap_kernel(sk, ssk, skb);
                nlk->netlink_rcv(skb);
                consume_skb(skb);
        } else {
                kfree_skb(skb);
        }
        sock_put(sk);
        return ret;
}

int netlink_unicast(struct sock *ssk, struct sk_buff *skb,
                    u32 portid, int nonblock)
{
        struct sock *sk;
        int err;
        long timeo;

        skb = netlink_trim(skb, gfp_any());

        timeo = sock_sndtimeo(ssk, nonblock);
retry:
        sk = netlink_getsockbyportid(ssk, portid);
        if (IS_ERR(sk)) {
                kfree_skb(skb);
                return PTR_ERR(sk);
        }
        if (netlink_is_kernel(sk))
                return netlink_unicast_kernel(sk, skb, ssk);

        if (sk_filter(sk, skb)) {
                err = skb->len;
                kfree_skb(skb);
                sock_put(sk);
                return err;
        }

        err = netlink_attachskb(sk, skb, &timeo, ssk);
        if (err == 1)
                goto retry;
        if (err)
                return err;

        return netlink_sendskb(sk, skb);
}
EXPORT_SYMBOL(netlink_unicast);

int netlink_has_listeners(struct sock *sk, unsigned int group)
{
        int res = 0;
        struct listeners *listeners;

        BUG_ON(!netlink_is_kernel(sk));

        rcu_read_lock();
        listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);

        if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
                res = test_bit(group - 1, listeners->masks);

        rcu_read_unlock();

        return res;
}
EXPORT_SYMBOL_GPL(netlink_has_listeners);

bool netlink_strict_get_check(struct sk_buff *skb)
{
        return nlk_test_bit(STRICT_CHK, NETLINK_CB(skb).sk);
}
EXPORT_SYMBOL_GPL(netlink_strict_get_check);

static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
{
        struct netlink_sock *nlk = nlk_sk(sk);

        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
            !test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
                netlink_skb_set_owner_r(skb, sk);
                __netlink_sendskb(sk, skb);
                return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
        }
        return -1;
}

struct netlink_broadcast_data {
        struct sock *exclude_sk;
        struct net *net;
        u32 portid;
        u32 group;
        int failure;
        int delivery_failure;
        int congested;
        int delivered;
        gfp_t allocation;
        struct sk_buff *skb, *skb2;
        int (*tx_filter)(struct sock *dsk, struct sk_buff *skb, void *data);
        void *tx_data;
};

static void do_one_broadcast(struct sock *sk,
                                    struct netlink_broadcast_data *p)
{
        struct netlink_sock *nlk = nlk_sk(sk);
        int val;

        if (p->exclude_sk == sk)
                return;

        if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
            !test_bit(p->group - 1, nlk->groups))
                return;

        if (!net_eq(sock_net(sk), p->net)) {
                if (!nlk_test_bit(LISTEN_ALL_NSID, sk))
                        return;

                if (!peernet_has_id(sock_net(sk), p->net))
                        return;

                if (!file_ns_capable(sk->sk_socket->file, p->net->user_ns,
                                     CAP_NET_BROADCAST))
                        return;
        }

        if (p->failure) {
                netlink_overrun(sk);
                return;
        }

        sock_hold(sk);
        if (p->skb2 == NULL) {
                if (skb_shared(p->skb)) {
                        p->skb2 = skb_clone(p->skb, p->allocation);
                } else {
                        p->skb2 = skb_get(p->skb);
                        /*
                         * skb ownership may have been set when
                         * delivered to a previous socket.
                         */
                        skb_orphan(p->skb2);
                }
        }
        if (p->skb2 == NULL) {
                netlink_overrun(sk);
                /* Clone failed. Notify ALL listeners. */
                p->failure = 1;
                if (nlk_test_bit(BROADCAST_SEND_ERROR, sk))
                        p->delivery_failure = 1;
                goto out;
        }

        if (p->tx_filter && p->tx_filter(sk, p->skb2, p->tx_data)) {
                kfree_skb(p->skb2);
                p->skb2 = NULL;
                goto out;
        }

        if (sk_filter(sk, p->skb2)) {
                kfree_skb(p->skb2);
                p->skb2 = NULL;
                goto out;
        }
        NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
                NETLINK_CB(p->skb2).nsid_is_set = true;
        val = netlink_broadcast_deliver(sk, p->skb2);
        if (val < 0) {
                netlink_overrun(sk);
                if (nlk_test_bit(BROADCAST_SEND_ERROR, sk))
                        p->delivery_failure = 1;
        } else {
                p->congested |= val;
                p->delivered = 1;
                p->skb2 = NULL;
        }
out:
        sock_put(sk);
}

int netlink_broadcast_filtered(struct sock *ssk, struct sk_buff *skb,
                               u32 portid,
                               u32 group, gfp_t allocation,
                               netlink_filter_fn filter,
                               void *filter_data)
{
        struct net *net = sock_net(ssk);
        struct netlink_broadcast_data info;
        struct sock *sk;

        skb = netlink_trim(skb, allocation);

        info.exclude_sk = ssk;
        info.net = net;
        info.portid = portid;
        info.group = group;
        info.failure = 0;
        info.delivery_failure = 0;
        info.congested = 0;
        info.delivered = 0;
        info.allocation = allocation;
        info.skb = skb;
        info.skb2 = NULL;
        info.tx_filter = filter;
        info.tx_data = filter_data;

        /* While we sleep in clone, do not allow to change socket list */

        netlink_lock_table();

        sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
                do_one_broadcast(sk, &info);

        consume_skb(skb);

        netlink_unlock_table();

        if (info.delivery_failure) {
                kfree_skb(info.skb2);
                return -ENOBUFS;
        }
        consume_skb(info.skb2);

        if (info.delivered) {
                if (info.congested && gfpflags_allow_blocking(allocation))
                        yield();
                return 0;
        }
        return -ESRCH;
}
EXPORT_SYMBOL(netlink_broadcast_filtered);

int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 portid,
                      u32 group, gfp_t allocation)
{
        return netlink_broadcast_filtered(ssk, skb, portid, group, allocation,
                                          NULL, NULL);
}
EXPORT_SYMBOL(netlink_broadcast);

struct netlink_set_err_data {
        struct sock *exclude_sk;
        u32 portid;
        u32 group;
        int code;
};

static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p)
{
        struct netlink_sock *nlk = nlk_sk(sk);
        int ret = 0;

        if (sk == p->exclude_sk)
                goto out;

        if (!net_eq(sock_net(sk), sock_net(p->exclude_sk)))
                goto out;

        if (nlk->portid == p->portid || p->group - 1 >= nlk->ngroups ||
            !test_bit(p->group - 1, nlk->groups))
                goto out;

        if (p->code == ENOBUFS && nlk_test_bit(RECV_NO_ENOBUFS, sk)) {
                ret = 1;
                goto out;
        }

        WRITE_ONCE(sk->sk_err, p->code);
        sk_error_report(sk);
out:
        return ret;
}

/**
 * netlink_set_err - report error to broadcast listeners
 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
 * @portid: the PORTID of a process that we want to skip (if any)
 * @group: the broadcast group that will notice the error
 * @code: error code, must be negative (as usual in kernelspace)
 *
 * This function returns the number of broadcast listeners that have set the
 * NETLINK_NO_ENOBUFS socket option.
 */
int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
{
        struct netlink_set_err_data info;
        unsigned long flags;
        struct sock *sk;
        int ret = 0;

        info.exclude_sk = ssk;
        info.portid = portid;
        info.group = group;
        /* sk->sk_err wants a positive error value */
        info.code = -code;

        read_lock_irqsave(&nl_table_lock, flags);

        sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
                ret += do_one_set_err(sk, &info);

        read_unlock_irqrestore(&nl_table_lock, flags);
        return ret;
}
EXPORT_SYMBOL(netlink_set_err);

/* must be called with netlink table grabbed */
static void netlink_update_socket_mc(struct netlink_sock *nlk,
                                     unsigned int group,
                                     int is_new)
{
        int old, new = !!is_new, subscriptions;

        old = test_bit(group - 1, nlk->groups);
        subscriptions = nlk->subscriptions - old + new;
        __assign_bit(group - 1, nlk->groups, new);
        netlink_update_subscriptions(&nlk->sk, subscriptions);
        netlink_update_listeners(&nlk->sk);
}

static int netlink_setsockopt(struct socket *sock, int level, int optname,
                              sockptr_t optval, unsigned int optlen)
{
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
        unsigned int val = 0;
        int nr = -1;

        if (level != SOL_NETLINK)
                return -ENOPROTOOPT;

        if (optlen >= sizeof(int) &&
            copy_from_sockptr(&val, optval, sizeof(val)))
                return -EFAULT;

        switch (optname) {
        case NETLINK_PKTINFO:
                nr = NETLINK_F_RECV_PKTINFO;
                break;
        case NETLINK_ADD_MEMBERSHIP:
        case NETLINK_DROP_MEMBERSHIP: {
                int err;

                if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
                        return -EPERM;
                err = netlink_realloc_groups(sk);
                if (err)
                        return err;
                if (!val || val - 1 >= nlk->ngroups)
                        return -EINVAL;
                if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
                        err = nlk->netlink_bind(sock_net(sk), val);
                        if (err)
                                return err;
                }
                netlink_table_grab();
                netlink_update_socket_mc(nlk, val,
                                         optname == NETLINK_ADD_MEMBERSHIP);
                netlink_table_ungrab();
                if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
                        nlk->netlink_unbind(sock_net(sk), val);

                break;
        }
        case NETLINK_BROADCAST_ERROR:
                nr = NETLINK_F_BROADCAST_SEND_ERROR;
                break;
        case NETLINK_NO_ENOBUFS:
                assign_bit(NETLINK_F_RECV_NO_ENOBUFS, &nlk->flags, val);
                if (val) {
                        clear_bit(NETLINK_S_CONGESTED, &nlk->state);
                        wake_up_interruptible(&nlk->wait);
                }
                break;
        case NETLINK_LISTEN_ALL_NSID:
                if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
                        return -EPERM;
                nr = NETLINK_F_LISTEN_ALL_NSID;
                break;
        case NETLINK_CAP_ACK:
                nr = NETLINK_F_CAP_ACK;
                break;
        case NETLINK_EXT_ACK:
                nr = NETLINK_F_EXT_ACK;
                break;
        case NETLINK_GET_STRICT_CHK:
                nr = NETLINK_F_STRICT_CHK;
                break;
        default:
                return -ENOPROTOOPT;
        }
        if (nr >= 0)
                assign_bit(nr, &nlk->flags, val);
        return 0;
}

static int netlink_getsockopt(struct socket *sock, int level, int optname,
                              char __user *optval, int __user *optlen)
{
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
        unsigned int flag;
        int len, val;

        if (level != SOL_NETLINK)
                return -ENOPROTOOPT;

        if (get_user(len, optlen))
                return -EFAULT;
        if (len < 0)
                return -EINVAL;

        switch (optname) {
        case NETLINK_PKTINFO:
                flag = NETLINK_F_RECV_PKTINFO;
                break;
        case NETLINK_BROADCAST_ERROR:
                flag = NETLINK_F_BROADCAST_SEND_ERROR;
                break;
        case NETLINK_NO_ENOBUFS:
                flag = NETLINK_F_RECV_NO_ENOBUFS;
                break;
        case NETLINK_LIST_MEMBERSHIPS: {
                int pos, idx, shift, err = 0;

                netlink_lock_table();
                for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
                        if (len - pos < sizeof(u32))
                                break;

                        idx = pos / sizeof(unsigned long);
                        shift = (pos % sizeof(unsigned long)) * 8;
                        if (put_user((u32)(nlk->groups[idx] >> shift),
                                     (u32 __user *)(optval + pos))) {
                                err = -EFAULT;
                                break;
                        }
                }
                if (put_user(ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)), optlen))
                        err = -EFAULT;
                netlink_unlock_table();
                return err;
        }
        case NETLINK_LISTEN_ALL_NSID:
                flag = NETLINK_F_LISTEN_ALL_NSID;
                break;
        case NETLINK_CAP_ACK:
                flag = NETLINK_F_CAP_ACK;
                break;
        case NETLINK_EXT_ACK:
                flag = NETLINK_F_EXT_ACK;
                break;
        case NETLINK_GET_STRICT_CHK:
                flag = NETLINK_F_STRICT_CHK;
                break;
        default:
                return -ENOPROTOOPT;
        }

        if (len < sizeof(int))
                return -EINVAL;

        len = sizeof(int);
        val = test_bit(flag, &nlk->flags);

        if (put_user(len, optlen) ||
            copy_to_user(optval, &val, len))
                return -EFAULT;

        return 0;
}

static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
{
        struct nl_pktinfo info;

        info.group = NETLINK_CB(skb).dst_group;
        put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
}

static void netlink_cmsg_listen_all_nsid(struct sock *sk, struct msghdr *msg,
                                         struct sk_buff *skb)
{
        if (!NETLINK_CB(skb).nsid_is_set)
                return;

        put_cmsg(msg, SOL_NETLINK, NETLINK_LISTEN_ALL_NSID, sizeof(int),
                 &NETLINK_CB(skb).nsid);
}

static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
{
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
        DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
        u32 dst_portid;
        u32 dst_group;
        struct sk_buff *skb;
        int err;
        struct scm_cookie scm;
        u32 netlink_skb_flags = 0;

        if (msg->msg_flags & MSG_OOB)
                return -EOPNOTSUPP;

        if (len == 0) {
                pr_warn_once("Zero length message leads to an empty skb\n");
                return -ENODATA;
        }

        err = scm_send(sock, msg, &scm, true);
        if (err < 0)
                return err;

        if (msg->msg_namelen) {
                err = -EINVAL;
                if (msg->msg_namelen < sizeof(struct sockaddr_nl))
                        goto out;
                if (addr->nl_family != AF_NETLINK)
                        goto out;
                dst_portid = addr->nl_pid;
                dst_group = ffs(addr->nl_groups);
                err =  -EPERM;
                if ((dst_group || dst_portid) &&
                    !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                        goto out;
                netlink_skb_flags |= NETLINK_SKB_DST;
        } else {
                /* Paired with WRITE_ONCE() in netlink_connect() */
                dst_portid = READ_ONCE(nlk->dst_portid);
                dst_group = READ_ONCE(nlk->dst_group);
        }

        /* Paired with WRITE_ONCE() in netlink_insert() */
        if (!READ_ONCE(nlk->bound)) {
                err = netlink_autobind(sock);
                if (err)
                        goto out;
        } else {
                /* Ensure nlk is hashed and visible. */
                smp_rmb();
        }

        err = -EMSGSIZE;
        if (len > sk->sk_sndbuf - 32)
                goto out;
        err = -ENOBUFS;
        skb = netlink_alloc_large_skb(len, dst_group);
        if (skb == NULL)
                goto out;

        NETLINK_CB(skb).portid        = nlk->portid;
        NETLINK_CB(skb).dst_group = dst_group;
        NETLINK_CB(skb).creds        = scm.creds;
        NETLINK_CB(skb).flags        = netlink_skb_flags;

        err = -EFAULT;
        if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
                kfree_skb(skb);
                goto out;
        }

        err = security_netlink_send(sk, skb);
        if (err) {
                kfree_skb(skb);
                goto out;
        }

        if (dst_group) {
                refcount_inc(&skb->users);
                netlink_broadcast(sk, skb, dst_portid, dst_group, GFP_KERNEL);
        }
        err = netlink_unicast(sk, skb, dst_portid, msg->msg_flags & MSG_DONTWAIT);

out:
        scm_destroy(&scm);
        return err;
}

static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                           int flags)
{
        struct scm_cookie scm;
        struct sock *sk = sock->sk;
        struct netlink_sock *nlk = nlk_sk(sk);
        size_t copied, max_recvmsg_len;
        struct sk_buff *skb, *data_skb;
        int err, ret;

        if (flags & MSG_OOB)
                return -EOPNOTSUPP;

        copied = 0;

        skb = skb_recv_datagram(sk, flags, &err);
        if (skb == NULL)
                goto out;

        data_skb = skb;

#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
        if (unlikely(skb_shinfo(skb)->frag_list)) {
                /*
                 * If this skb has a frag_list, then here that means that we
                 * will have to use the frag_list skb's data for compat tasks
                 * and the regular skb's data for normal (non-compat) tasks.
                 *
                 * If we need to send the compat skb, assign it to the
                 * 'data_skb' variable so that it will be used below for data
                 * copying. We keep 'skb' for everything else, including
                 * freeing both later.
                 */
                if (flags & MSG_CMSG_COMPAT)
                        data_skb = skb_shinfo(skb)->frag_list;
        }
#endif

        /* Record the max length of recvmsg() calls for future allocations */
        max_recvmsg_len = max(READ_ONCE(nlk->max_recvmsg_len), len);
        max_recvmsg_len = min_t(size_t, max_recvmsg_len,
                                SKB_WITH_OVERHEAD(32768));
        WRITE_ONCE(nlk->max_recvmsg_len, max_recvmsg_len);

        copied = data_skb->len;
        if (len < copied) {
                msg->msg_flags |= MSG_TRUNC;
                copied = len;
        }

        err = skb_copy_datagram_msg(data_skb, 0, msg, copied);

        if (msg->msg_name) {
                DECLARE_SOCKADDR(struct sockaddr_nl *, addr, msg->msg_name);
                addr->nl_family = AF_NETLINK;
                addr->nl_pad    = 0;
                addr->nl_pid        = NETLINK_CB(skb).portid;
                addr->nl_groups        = netlink_group_mask(NETLINK_CB(skb).dst_group);
                msg->msg_namelen = sizeof(*addr);
        }

        if (nlk_test_bit(RECV_PKTINFO, sk))
                netlink_cmsg_recv_pktinfo(msg, skb);
        if (nlk_test_bit(LISTEN_ALL_NSID, sk))
                netlink_cmsg_listen_all_nsid(sk, msg, skb);

        memset(&scm, 0, sizeof(scm));
        scm.creds = *NETLINK_CREDS(skb);
        if (flags & MSG_TRUNC)
                copied = data_skb->len;

        skb_free_datagram(sk, skb);

        if (READ_ONCE(nlk->cb_running) &&
            atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
                ret = netlink_dump(sk, false);
                if (ret) {
                        WRITE_ONCE(sk->sk_err, -ret);
                        sk_error_report(sk);
                }
        }

        scm_recv(sock, msg, &scm, flags);
out:
        netlink_rcv_wake(sk);
        return err ? : copied;
}

static void netlink_data_ready(struct sock *sk)
{
        BUG();
}

/*
 *        We export these functions to other modules. They provide a
 *        complete set of kernel non-blocking support for message
 *        queueing.
 */

struct sock *
__netlink_kernel_create(struct net *net, int unit, struct module *module,
                        struct netlink_kernel_cfg *cfg)
{
        struct socket *sock;
        struct sock *sk;
        struct netlink_sock *nlk;
        struct listeners *listeners = NULL;
        unsigned int groups;

        BUG_ON(!nl_table);

        if (unit < 0 || unit >= MAX_LINKS)
                return NULL;

        if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
                return NULL;

        if (__netlink_create(net, sock, unit, 1) < 0)
                goto out_sock_release_nosk;

        sk = sock->sk;

        if (!cfg || cfg->groups < 32)
                groups = 32;
        else
                groups = cfg->groups;

        listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
        if (!listeners)
                goto out_sock_release;

        sk->sk_data_ready = netlink_data_ready;
        if (cfg && cfg->input)
                nlk_sk(sk)->netlink_rcv = cfg->input;

        if (netlink_insert(sk, 0))
                goto out_sock_release;

        nlk = nlk_sk(sk);
        set_bit(NETLINK_F_KERNEL_SOCKET, &nlk->flags);

        netlink_table_grab();
        if (!nl_table[unit].registered) {
                nl_table[unit].groups = groups;
                rcu_assign_pointer(nl_table[unit].listeners, listeners);
                nl_table[unit].module = module;
                if (cfg) {
                        nl_table[unit].bind = cfg->bind;
                        nl_table[unit].unbind = cfg->unbind;
                        nl_table[unit].release = cfg->release;
                        nl_table[unit].flags = cfg->flags;
                }
                nl_table[unit].registered = 1;
        } else {
                kfree(listeners);
                nl_table[unit].registered++;
        }
        netlink_table_ungrab();
        return sk;

out_sock_release:
        kfree(listeners);
        netlink_kernel_release(sk);
        return NULL;

out_sock_release_nosk:
        sock_release(sock);
        return NULL;
}
EXPORT_SYMBOL(__netlink_kernel_create);

void
netlink_kernel_release(struct sock *sk)
{
        if (sk == NULL || sk->sk_socket == NULL)
                return;

        sock_release(sk->sk_socket);
}
EXPORT_SYMBOL(netlink_kernel_release);

int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
{
        struct listeners *new, *old;
        struct netlink_table *tbl = &nl_table[sk->sk_protocol];

        if (groups < 32)
                groups = 32;

        if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
                new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
                if (!new)
                        return -ENOMEM;
                old = nl_deref_protected(tbl->listeners);
                memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
                rcu_assign_pointer(tbl->listeners, new);

                kfree_rcu(old, rcu);
        }
        tbl->groups = groups;

        return 0;
}

/**
 * netlink_change_ngroups - change number of multicast groups
 *
 * This changes the number of multicast groups that are available
 * on a certain netlink family. Note that it is not possible to
 * change the number of groups to below 32. Also note that it does
 * not implicitly call netlink_clear_multicast_users() when the
 * number of groups is reduced.
 *
 * @sk: The kernel netlink socket, as returned by netlink_kernel_create().
 * @groups: The new number of groups.
 */
int netlink_change_ngroups(struct sock *sk, unsigned int groups)
{
        int err;

        netlink_table_grab();
        err = __netlink_change_ngroups(sk, groups);
        netlink_table_ungrab();

        return err;
}

void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
{
        struct sock *sk;
        struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
        struct hlist_node *tmp;

        sk_for_each_bound_safe(sk, tmp, &tbl->mc_list)
                netlink_update_socket_mc(nlk_sk(sk), group, 0);
}

struct nlmsghdr *
__nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags)
{
        struct nlmsghdr *nlh;
        int size = nlmsg_msg_size(len);

        nlh = skb_put(skb, NLMSG_ALIGN(size));
        nlh->nlmsg_type = type;
        nlh->nlmsg_len = size;
        nlh->nlmsg_flags = flags;
        nlh->nlmsg_pid = portid;
        nlh->nlmsg_seq = seq;
        if (!__builtin_constant_p(size) || NLMSG_ALIGN(size) - size != 0)
                memset(nlmsg_data(nlh) + len, 0, NLMSG_ALIGN(size) - size);
        return nlh;
}
EXPORT_SYMBOL(__nlmsg_put);

static size_t
netlink_ack_tlv_len(struct netlink_sock *nlk, int err,
                    const struct netlink_ext_ack *extack)
{
        size_t tlvlen;

        if (!extack || !test_bit(NETLINK_F_EXT_ACK, &nlk->flags))
                return 0;

        tlvlen = 0;
        if (extack->_msg)
                tlvlen += nla_total_size(strlen(extack->_msg) + 1);
        if (extack->cookie_len)
                tlvlen += nla_total_size(extack->cookie_len);

        /* Following attributes are only reported as error (not warning) */
        if (!err)
                return tlvlen;

        if (extack->bad_attr)
                tlvlen += nla_total_size(sizeof(u32));
        if (extack->policy)
                tlvlen += netlink_policy_dump_attr_size_estimate(extack->policy);
        if (extack->miss_type)
                tlvlen += nla_total_size(sizeof(u32));
        if (extack->miss_nest)
                tlvlen += nla_total_size(sizeof(u32));

        return tlvlen;
}

static bool nlmsg_check_in_payload(const struct nlmsghdr *nlh, const void *addr)
{
        return !WARN_ON(addr < nlmsg_data(nlh) ||
                        addr - (const void *) nlh >= nlh->nlmsg_len);
}

static void
netlink_ack_tlv_fill(struct sk_buff *skb, const struct nlmsghdr *nlh, int err,
                     const struct netlink_ext_ack *extack)
{
        if (extack->_msg)
                WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG, extack->_msg));
        if (extack->cookie_len)
                WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE,
                                extack->cookie_len, extack->cookie));

        if (!err)
                return;

        if (extack->bad_attr && nlmsg_check_in_payload(nlh, extack->bad_attr))
                WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS,
                                    (u8 *)extack->bad_attr - (const u8 *)nlh));
        if (extack->policy)
                netlink_policy_dump_write_attr(skb, extack->policy,
                                               NLMSGERR_ATTR_POLICY);
        if (extack->miss_type)
                WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_MISS_TYPE,
                                    extack->miss_type));
        if (extack->miss_nest && nlmsg_check_in_payload(nlh, extack->miss_nest))
                WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_MISS_NEST,
                                    (u8 *)extack->miss_nest - (const u8 *)nlh));
}

/*
 * It looks a bit ugly.
 * It would be better to create kernel thread.
 */

static int netlink_dump_done(struct netlink_sock *nlk, struct sk_buff *skb,
                             struct netlink_callback *cb,
                             struct netlink_ext_ack *extack)
{
        struct nlmsghdr *nlh;
        size_t extack_len;

        nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(nlk->dump_done_errno),
                               NLM_F_MULTI | cb->answer_flags);
        if (WARN_ON(!nlh))
                return -ENOBUFS;

        nl_dump_check_consistent(cb, nlh);
        memcpy(nlmsg_data(nlh), &nlk->dump_done_errno, sizeof(nlk->dump_done_errno));

        extack_len = netlink_ack_tlv_len(nlk, nlk->dump_done_errno, extack);
        if (extack_len) {
                nlh->nlmsg_flags |= NLM_F_ACK_TLVS;
                if (skb_tailroom(skb) >= extack_len) {
                        netlink_ack_tlv_fill(skb, cb->nlh,
                                             nlk->dump_done_errno, extack);
                        nlmsg_end(skb, nlh);
                }
        }

        return 0;
}

static int netlink_dump(struct sock *sk, bool lock_taken)
{
        struct netlink_sock *nlk = nlk_sk(sk);
        struct netlink_ext_ack extack = {};
        struct netlink_callback *cb;
        struct sk_buff *skb = NULL;
        size_t max_recvmsg_len;
        struct module *module;
        int err = -ENOBUFS;
        int alloc_min_size;
        int alloc_size;

        if (!lock_taken)
                mutex_lock(&nlk->nl_cb_mutex);
        if (!nlk->cb_running) {
                err = -EINVAL;
                goto errout_skb;
        }

        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
                goto errout_skb;

        /* NLMSG_GOODSIZE is small to avoid high order allocations being
         * required, but it makes sense to _attempt_ a 32KiB allocation
         * to reduce number of system calls on dump operations, if user
         * ever provided a big enough buffer.
         */
        cb = &nlk->cb;
        alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);

        max_recvmsg_len = READ_ONCE(nlk->max_recvmsg_len);
        if (alloc_min_size < max_recvmsg_len) {
                alloc_size = max_recvmsg_len;
                skb = alloc_skb(alloc_size,
                                (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) |
                                __GFP_NOWARN | __GFP_NORETRY);
        }
        if (!skb) {
                alloc_size = alloc_min_size;
                skb = alloc_skb(alloc_size, GFP_KERNEL);
        }
        if (!skb)
                goto errout_skb;

        /* Trim skb to allocated size. User is expected to provide buffer as
         * large as max(min_dump_alloc, 32KiB (max_recvmsg_len capped at
         * netlink_recvmsg())). dump will pack as many smaller messages as
         * could fit within the allocated skb. skb is typically allocated
         * with larger space than required (could be as much as near 2x the
         * requested size with align to next power of 2 approach). Allowing
         * dump to use the excess space makes it difficult for a user to have a
         * reasonable static buffer based on the expected largest dump of a
         * single netdev. The outcome is MSG_TRUNC error.
         */
        skb_reserve(skb, skb_tailroom(skb) - alloc_size);

        /* Make sure malicious BPF programs can not read unitialized memory
         * from skb->head -> skb->data
         */
        skb_reset_network_header(skb);
        skb_reset_mac_header(skb);

        netlink_skb_set_owner_r(skb, sk);

        if (nlk->dump_done_errno > 0) {
                cb->extack = &extack;

                nlk->dump_done_errno = cb->dump(skb, cb);

                /* EMSGSIZE plus something already in the skb means
                 * that there's more to dump but current skb has filled up.
                 * If the callback really wants to return EMSGSIZE to user space
                 * it needs to do so again, on the next cb->dump() call,
                 * without putting data in the skb.
                 */
                if (nlk->dump_done_errno == -EMSGSIZE && skb->len)
                        nlk->dump_done_errno = skb->len;

                cb->extack = NULL;
        }

        if (nlk->dump_done_errno > 0 ||
            skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
                mutex_unlock(&nlk->nl_cb_mutex);

                if (sk_filter(sk, skb))
                        kfree_skb(skb);
                else
                        __netlink_sendskb(sk, skb);
                return 0;
        }

        if (netlink_dump_done(nlk, skb, cb, &extack))
                goto errout_skb;

#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
        /* frag_list skb's data is used for compat tasks
         * and the regular skb's data for normal (non-compat) tasks.
         * See netlink_recvmsg().
         */
        if (unlikely(skb_shinfo(skb)->frag_list)) {
                if (netlink_dump_done(nlk, skb_shinfo(skb)->frag_list, cb, &extack))
                        goto errout_skb;
        }
#endif

        if (sk_filter(sk, skb))
                kfree_skb(skb);
        else
                __netlink_sendskb(sk, skb);

        if (cb->done)
                cb->done(cb);

        WRITE_ONCE(nlk->cb_running, false);
        module = cb->module;
        skb = cb->skb;
        mutex_unlock(&nlk->nl_cb_mutex);
        module_put(module);
        consume_skb(skb);
        return 0;

errout_skb:
        mutex_unlock(&nlk->nl_cb_mutex);
        kfree_skb(skb);
        return err;
}

int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
                         const struct nlmsghdr *nlh,
                         struct netlink_dump_control *control)
{
        struct netlink_callback *cb;
        struct netlink_sock *nlk;
        struct sock *sk;
        int ret;

        refcount_inc(&skb->users);

        sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
        if (sk == NULL) {
                ret = -ECONNREFUSED;
                goto error_free;
        }

        nlk = nlk_sk(sk);
        mutex_lock(&nlk->nl_cb_mutex);
        /* A dump is in progress... */
        if (nlk->cb_running) {
                ret = -EBUSY;
                goto error_unlock;
        }
        /* add reference of module which cb->dump belongs to */
        if (!try_module_get(control->module)) {
                ret = -EPROTONOSUPPORT;
                goto error_unlock;
        }

        cb = &nlk->cb;
        memset(cb, 0, sizeof(*cb));
        cb->dump = control->dump;
        cb->done = control->done;
        cb->nlh = nlh;
        cb->data = control->data;
        cb->module = control->module;
        cb->min_dump_alloc = control->min_dump_alloc;
        cb->flags = control->flags;
        cb->skb = skb;

        cb->strict_check = nlk_test_bit(STRICT_CHK, NETLINK_CB(skb).sk);

        if (control->start) {
                cb->extack = control->extack;
                ret = control->start(cb);
                cb->extack = NULL;
                if (ret)
                        goto error_put;
        }

        WRITE_ONCE(nlk->cb_running, true);
        nlk->dump_done_errno = INT_MAX;

        ret = netlink_dump(sk, true);

        sock_put(sk);

        if (ret)
                return ret;

        /* We successfully started a dump, by returning -EINTR we
         * signal not to send ACK even if it was requested.
         */
        return -EINTR;

error_put:
        module_put(control->module);
error_unlock:
        sock_put(sk);
        mutex_unlock(&nlk->nl_cb_mutex);
error_free:
        kfree_skb(skb);
        return ret;
}
EXPORT_SYMBOL(__netlink_dump_start);

void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
                 const struct netlink_ext_ack *extack)
{
        struct sk_buff *skb;
        struct nlmsghdr *rep;
        struct nlmsgerr *errmsg;
        size_t payload = sizeof(*errmsg);
        struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
        unsigned int flags = 0;
        size_t tlvlen;

        /* Error messages get the original request appened, unless the user
         * requests to cap the error message, and get extra error data if
         * requested.
         */
        if (err && !test_bit(NETLINK_F_CAP_ACK, &nlk->flags))
                payload += nlmsg_len(nlh);
        else
                flags |= NLM_F_CAPPED;

        tlvlen = netlink_ack_tlv_len(nlk, err, extack);
        if (tlvlen)
                flags |= NLM_F_ACK_TLVS;

        skb = nlmsg_new(payload + tlvlen, GFP_KERNEL);
        if (!skb)
                goto err_skb;

        rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
                        NLMSG_ERROR, sizeof(*errmsg), flags);
        if (!rep)
                goto err_bad_put;
        errmsg = nlmsg_data(rep);
        errmsg->error = err;
        errmsg->msg = *nlh;

        if (!(flags & NLM_F_CAPPED)) {
                if (!nlmsg_append(skb, nlmsg_len(nlh)))
                        goto err_bad_put;

                memcpy(nlmsg_data(&errmsg->msg), nlmsg_data(nlh),
                       nlmsg_len(nlh));
        }

        if (tlvlen)
                netlink_ack_tlv_fill(skb, nlh, err, extack);

        nlmsg_end(skb, rep);

        nlmsg_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid);

        return;

err_bad_put:
        nlmsg_free(skb);
err_skb:
        WRITE_ONCE(NETLINK_CB(in_skb).sk->sk_err, ENOBUFS);
        sk_error_report(NETLINK_CB(in_skb).sk);
}
EXPORT_SYMBOL(netlink_ack);

int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
                                                   struct nlmsghdr *,
                                                   struct netlink_ext_ack *))
{
        struct netlink_ext_ack extack;
        struct nlmsghdr *nlh;
        int err;

        while (skb->len >= nlmsg_total_size(0)) {
                int msglen;

                memset(&extack, 0, sizeof(extack));
                nlh = nlmsg_hdr(skb);
                err = 0;

                if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
                        return 0;

                /* Only requests are handled by the kernel */
                if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
                        goto ack;

                /* Skip control messages */
                if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
                        goto ack;

                err = cb(skb, nlh, &extack);
                if (err == -EINTR)
                        goto skip;

ack:
                if (nlh->nlmsg_flags & NLM_F_ACK || err)
                        netlink_ack(skb, nlh, err, &extack);

skip:
                msglen = NLMSG_ALIGN(nlh->nlmsg_len);
                if (msglen > skb->len)
                        msglen = skb->len;
                skb_pull(skb, msglen);
        }

        return 0;
}
EXPORT_SYMBOL(netlink_rcv_skb);

/**
 * nlmsg_notify - send a notification netlink message
 * @sk: netlink socket to use
 * @skb: notification message
 * @portid: destination netlink portid for reports or 0
 * @group: destination multicast group or 0
 * @report: 1 to report back, 0 to disable
 * @flags: allocation flags
 */
int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
                 unsigned int group, int report, gfp_t flags)
{
        int err = 0;

        if (group) {
                int exclude_portid = 0;

                if (report) {
                        refcount_inc(&skb->users);
                        exclude_portid = portid;
                }

                /* errors reported via destination sk->sk_err, but propagate
                 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
                err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
                if (err == -ESRCH)
                        err = 0;
        }

        if (report) {
                int err2;

                err2 = nlmsg_unicast(sk, skb, portid);
                if (!err)
                        err = err2;
        }

        return err;
}
EXPORT_SYMBOL(nlmsg_notify);

#ifdef CONFIG_PROC_FS
struct nl_seq_iter {
        struct seq_net_private p;
        struct rhashtable_iter hti;
        int link;
};

static void netlink_walk_start(struct nl_seq_iter *iter)
{
        rhashtable_walk_enter(&nl_table[iter->link].hash, &iter->hti);
        rhashtable_walk_start(&iter->hti);
}

static void netlink_walk_stop(struct nl_seq_iter *iter)
{
        rhashtable_walk_stop(&iter->hti);
        rhashtable_walk_exit(&iter->hti);
}

static void *__netlink_seq_next(struct seq_file *seq)
{
        struct nl_seq_iter *iter = seq->private;
        struct netlink_sock *nlk;

        do {
                for (;;) {
                        nlk = rhashtable_walk_next(&iter->hti);

                        if (IS_ERR(nlk)) {
                                if (PTR_ERR(nlk) == -EAGAIN)
                                        continue;

                                return nlk;
                        }

                        if (nlk)
                                break;

                        netlink_walk_stop(iter);
                        if (++iter->link >= MAX_LINKS)
                                return NULL;

                        netlink_walk_start(iter);
                }
        } while (sock_net(&nlk->sk) != seq_file_net(seq));

        return nlk;
}

static void *netlink_seq_start(struct seq_file *seq, loff_t *posp)
        __acquires(RCU)
{
        struct nl_seq_iter *iter = seq->private;
        void *obj = SEQ_START_TOKEN;
        loff_t pos;

        iter->link = 0;

        netlink_walk_start(iter);

        for (pos = *posp; pos && obj && !IS_ERR(obj); pos--)
                obj = __netlink_seq_next(seq);

        return obj;
}

static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
        ++*pos;
        return __netlink_seq_next(seq);
}

static void netlink_native_seq_stop(struct seq_file *seq, void *v)
{
        struct nl_seq_iter *iter = seq->private;

        if (iter->link >= MAX_LINKS)
                return;

        netlink_walk_stop(iter);
}


static int netlink_native_seq_show(struct seq_file *seq, void *v)
{
        if (v == SEQ_START_TOKEN) {
                seq_puts(seq,
                         "sk               Eth Pid        Groups   "
                         "Rmem     Wmem     Dump  Locks    Drops    Inode\n");
        } else {
                struct sock *s = v;
                struct netlink_sock *nlk = nlk_sk(s);

                seq_printf(seq, "%pK %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8u %-8lu\n",
                           s,
                           s->sk_protocol,
                           nlk->portid,
                           nlk->groups ? (u32)nlk->groups[0] : 0,
                           sk_rmem_alloc_get(s),
                           sk_wmem_alloc_get(s),
                           READ_ONCE(nlk->cb_running),
                           refcount_read(&s->sk_refcnt),
                           atomic_read(&s->sk_drops),
                           sock_i_ino(s)
                        );

        }
        return 0;
}

#ifdef CONFIG_BPF_SYSCALL
struct bpf_iter__netlink {
        __bpf_md_ptr(struct bpf_iter_meta *, meta);
        __bpf_md_ptr(struct netlink_sock *, sk);
};

DEFINE_BPF_ITER_FUNC(netlink, struct bpf_iter_meta *meta, struct netlink_sock *sk)

static int netlink_prog_seq_show(struct bpf_prog *prog,
                                  struct bpf_iter_meta *meta,
                                  void *v)
{
        struct bpf_iter__netlink ctx;

        meta->seq_num--;  /* skip SEQ_START_TOKEN */
        ctx.meta = meta;
        ctx.sk = nlk_sk((struct sock *)v);
        return bpf_iter_run_prog(prog, &ctx);
}

static int netlink_seq_show(struct seq_file *seq, void *v)
{
        struct bpf_iter_meta meta;
        struct bpf_prog *prog;

        meta.seq = seq;
        prog = bpf_iter_get_info(&meta, false);
        if (!prog)
                return netlink_native_seq_show(seq, v);

        if (v != SEQ_START_TOKEN)
                return netlink_prog_seq_show(prog, &meta, v);

        return 0;
}

static void netlink_seq_stop(struct seq_file *seq, void *v)
{
        struct bpf_iter_meta meta;
        struct bpf_prog *prog;

        if (!v) {
                meta.seq = seq;
                prog = bpf_iter_get_info(&meta, true);
                if (prog)
                        (void)netlink_prog_seq_show(prog, &meta, v);
        }

        netlink_native_seq_stop(seq, v);
}
#else
static int netlink_seq_show(struct seq_file *seq, void *v)
{
        return netlink_native_seq_show(seq, v);
}

static void netlink_seq_stop(struct seq_file *seq, void *v)
{
        netlink_native_seq_stop(seq, v);
}
#endif

static const struct seq_operations netlink_seq_ops = {
        .start  = netlink_seq_start,
        .next   = netlink_seq_next,
        .stop   = netlink_seq_stop,
        .show   = netlink_seq_show,
};
#endif

int netlink_register_notifier(struct notifier_block *nb)
{
        return blocking_notifier_chain_register(&netlink_chain, nb);
}
EXPORT_SYMBOL(netlink_register_notifier);

int netlink_unregister_notifier(struct notifier_block *nb)
{
        return blocking_notifier_chain_unregister(&netlink_chain, nb);
}
EXPORT_SYMBOL(netlink_unregister_notifier);

static const struct proto_ops netlink_ops = {
        .family =        PF_NETLINK,
        .owner =        THIS_MODULE,
        .release =        netlink_release,
        .bind =                netlink_bind,
        .connect =        netlink_connect,
        .socketpair =        sock_no_socketpair,
        .accept =        sock_no_accept,
        .getname =        netlink_getname,
        .poll =                datagram_poll,
        .ioctl =        netlink_ioctl,
        .listen =        sock_no_listen,
        .shutdown =        sock_no_shutdown,
        .setsockopt =        netlink_setsockopt,
        .getsockopt =        netlink_getsockopt,
        .sendmsg =        netlink_sendmsg,
        .recvmsg =        netlink_recvmsg,
        .mmap =                sock_no_mmap,
};

static const struct net_proto_family netlink_family_ops = {
        .family = PF_NETLINK,
        .create = netlink_create,
        .owner        = THIS_MODULE,        /* for consistency 8) */
};

static int __net_init netlink_net_init(struct net *net)
{
#ifdef CONFIG_PROC_FS
        if (!proc_create_net("netlink", 0, net->proc_net, &netlink_seq_ops,
                        sizeof(struct nl_seq_iter)))
                return -ENOMEM;
#endif
        return 0;
}

static void __net_exit netlink_net_exit(struct net *net)
{
#ifdef CONFIG_PROC_FS
        remove_proc_entry("netlink", net->proc_net);
#endif
}

static void __init netlink_add_usersock_entry(void)
{
        struct listeners *listeners;
        int groups = 32;

        listeners = kzalloc(sizeof(*listeners) + NLGRPSZ(groups), GFP_KERNEL);
        if (!listeners)
                panic("netlink_add_usersock_entry: Cannot allocate listeners\n");

        netlink_table_grab();

        nl_table[NETLINK_USERSOCK].groups = groups;
        rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
        nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
        nl_table[NETLINK_USERSOCK].registered = 1;
        nl_table[NETLINK_USERSOCK].flags = NL_CFG_F_NONROOT_SEND;

        netlink_table_ungrab();
}

static struct pernet_operations __net_initdata netlink_net_ops = {
        .init = netlink_net_init,
        .exit = netlink_net_exit,
};

static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
{
        const struct netlink_sock *nlk = data;
        struct netlink_compare_arg arg;

        netlink_compare_arg_init(&arg, sock_net(&nlk->sk), nlk->portid);
        return jhash2((u32 *)&arg, netlink_compare_arg_len / sizeof(u32), seed);
}

static const struct rhashtable_params netlink_rhashtable_params = {
        .head_offset = offsetof(struct netlink_sock, node),
        .key_len = netlink_compare_arg_len,
        .obj_hashfn = netlink_hash,
        .obj_cmpfn = netlink_compare,
        .automatic_shrinking = true,
};

#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
BTF_ID_LIST(btf_netlink_sock_id)
BTF_ID(struct, netlink_sock)

static const struct bpf_iter_seq_info netlink_seq_info = {
        .seq_ops                = &netlink_seq_ops,
        .init_seq_private        = bpf_iter_init_seq_net,
        .fini_seq_private        = bpf_iter_fini_seq_net,
        .seq_priv_size                = sizeof(struct nl_seq_iter),
};

static struct bpf_iter_reg netlink_reg_info = {
        .target                        = "netlink",
        .ctx_arg_info_size        = 1,
        .ctx_arg_info                = {
                { offsetof(struct bpf_iter__netlink, sk),
                  PTR_TO_BTF_ID_OR_NULL },
        },
        .seq_info                = &netlink_seq_info,
};

static int __init bpf_iter_register(void)
{
        netlink_reg_info.ctx_arg_info[0].btf_id = *btf_netlink_sock_id;
        return bpf_iter_reg_target(&netlink_reg_info);
}
#endif

static int __init netlink_proto_init(void)
{
        int i;
        int err = proto_register(&netlink_proto, 0);

        if (err != 0)
                goto out;

#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
        err = bpf_iter_register();
        if (err)
                goto out;
#endif

        BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > sizeof_field(struct sk_buff, cb));

        nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
        if (!nl_table)
                goto panic;

        for (i = 0; i < MAX_LINKS; i++) {
                if (rhashtable_init(&nl_table[i].hash,
                                    &netlink_rhashtable_params) < 0)
                        goto panic;
        }

        netlink_add_usersock_entry();

        sock_register(&netlink_family_ops);
        register_pernet_subsys(&netlink_net_ops);
        register_pernet_subsys(&netlink_tap_net_ops);
        /* The netlink device handler may be needed early. */
        rtnetlink_init();
out:
        return err;
panic:
        panic("netlink_init: Cannot allocate nl_table\n");
}

core_initcall(netlink_proto_init);


















































    6 






    1 












    4 
    1 




    4 


























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
// SPDX-License-Identifier: GPL-2.0-only
/*
 * (C) 2013 Astaro GmbH & Co KG
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_labels.h>
#include <linux/netfilter/x_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
MODULE_DESCRIPTION("Xtables: add/match connection tracking labels");
MODULE_ALIAS("ipt_connlabel");
MODULE_ALIAS("ip6t_connlabel");

static bool
connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
        const struct xt_connlabel_mtinfo *info = par->matchinfo;
        enum ip_conntrack_info ctinfo;
        struct nf_conn_labels *labels;
        struct nf_conn *ct;
        bool invert = info->options & XT_CONNLABEL_OP_INVERT;

        ct = nf_ct_get(skb, &ctinfo);
        if (ct == NULL)
                return invert;

        labels = nf_ct_labels_find(ct);
        if (!labels)
                return invert;

        if (test_bit(info->bit, labels->bits))
                return !invert;

        if (info->options & XT_CONNLABEL_OP_SET) {
                if (!test_and_set_bit(info->bit, labels->bits))
                        nf_conntrack_event_cache(IPCT_LABEL, ct);

                return !invert;
        }

        return invert;
}

static int connlabel_mt_check(const struct xt_mtchk_param *par)
{
        const int options = XT_CONNLABEL_OP_INVERT |
                            XT_CONNLABEL_OP_SET;
        struct xt_connlabel_mtinfo *info = par->matchinfo;
        int ret;

        if (info->options & ~options) {
                pr_info_ratelimited("Unknown options in mask %x\n",
                                    info->options);
                return -EINVAL;
        }

        ret = nf_ct_netns_get(par->net, par->family);
        if (ret < 0) {
                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
                                    par->family);
                return ret;
        }

        ret = nf_connlabels_get(par->net, info->bit);
        if (ret < 0)
                nf_ct_netns_put(par->net, par->family);
        return ret;
}

static void connlabel_mt_destroy(const struct xt_mtdtor_param *par)
{
        nf_connlabels_put(par->net);
        nf_ct_netns_put(par->net, par->family);
}

static struct xt_match connlabels_mt_reg __read_mostly = {
        .name           = "connlabel",
        .family         = NFPROTO_UNSPEC,
        .checkentry     = connlabel_mt_check,
        .match          = connlabel_mt,
        .matchsize      = sizeof(struct xt_connlabel_mtinfo),
        .destroy        = connlabel_mt_destroy,
        .me             = THIS_MODULE,
};

static int __init connlabel_mt_init(void)
{
        return xt_register_match(&connlabels_mt_reg);
}

static void __exit connlabel_mt_exit(void)
{
        xt_unregister_match(&connlabels_mt_reg);
}

module_init(connlabel_mt_init);
module_exit(connlabel_mt_exit);





















































































































































































   76 






   25 



   60 
   58 














   31 



   31 
   31 





   31 
   31 









   60 
   59 









   76 
   76 



    7 



















   76 
   31 








   60 


   57 



   15 




   15 




   15 

   15 




   15 
   15 
   15 








   15 



   15 




























































































































   15 



   15 

   15 







   15 


















   15 










































  234 








  234 









  149 
  149 


  149 
  149 











































































  232 















  234 



  234 

  234 



   96 















  234 



  234 













1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
// SPDX-License-Identifier: GPL-2.0
/*
 *  linux/mm/page_io.c
 *
 *  Copyright (C) 1991, 1992, 1993, 1994  Linus Torvalds
 *
 *  Swap reorganised 29.12.95, 
 *  Asynchronous swapping added 30.12.95. Stephen Tweedie
 *  Removed race in async swapping. 14.4.1996. Bruno Haible
 *  Add swap of shared pages through the page cache. 20.2.1998. Stephen Tweedie
 *  Always use brw_page, life becomes simpler. 12 May 1998 Eric Biederman
 */

#include <linux/mm.h>
#include <linux/kernel_stat.h>
#include <linux/gfp.h>
#include <linux/pagemap.h>
#include <linux/swap.h>
#include <linux/bio.h>
#include <linux/swapops.h>
#include <linux/writeback.h>
#include <linux/blkdev.h>
#include <linux/psi.h>
#include <linux/uio.h>
#include <linux/sched/task.h>
#include <linux/delayacct.h>
#include <linux/zswap.h>
#include "swap.h"

static void __end_swap_bio_write(struct bio *bio)
{
        struct folio *folio = bio_first_folio_all(bio);

        if (bio->bi_status) {
                /*
                 * We failed to write the page out to swap-space.
                 * Re-dirty the page in order to avoid it being reclaimed.
                 * Also print a dire warning that things will go BAD (tm)
                 * very quickly.
                 *
                 * Also clear PG_reclaim to avoid folio_rotate_reclaimable()
                 */
                folio_mark_dirty(folio);
                pr_alert_ratelimited("Write-error on swap-device (%u:%u:%llu)\n",
                                     MAJOR(bio_dev(bio)), MINOR(bio_dev(bio)),
                                     (unsigned long long)bio->bi_iter.bi_sector);
                folio_clear_reclaim(folio);
        }
        folio_end_writeback(folio);
}

static void end_swap_bio_write(struct bio *bio)
{
        __end_swap_bio_write(bio);
        bio_put(bio);
}

static void __end_swap_bio_read(struct bio *bio)
{
        struct folio *folio = bio_first_folio_all(bio);

        if (bio->bi_status) {
                pr_alert_ratelimited("Read-error on swap-device (%u:%u:%llu)\n",
                                     MAJOR(bio_dev(bio)), MINOR(bio_dev(bio)),
                                     (unsigned long long)bio->bi_iter.bi_sector);
        } else {
                folio_mark_uptodate(folio);
        }
        folio_unlock(folio);
}

static void end_swap_bio_read(struct bio *bio)
{
        __end_swap_bio_read(bio);
        bio_put(bio);
}

int generic_swapfile_activate(struct swap_info_struct *sis,
                                struct file *swap_file,
                                sector_t *span)
{
        struct address_space *mapping = swap_file->f_mapping;
        struct inode *inode = mapping->host;
        unsigned blocks_per_page;
        unsigned long page_no;
        unsigned blkbits;
        sector_t probe_block;
        sector_t last_block;
        sector_t lowest_block = -1;
        sector_t highest_block = 0;
        int nr_extents = 0;
        int ret;

        blkbits = inode->i_blkbits;
        blocks_per_page = PAGE_SIZE >> blkbits;

        /*
         * Map all the blocks into the extent tree.  This code doesn't try
         * to be very smart.
         */
        probe_block = 0;
        page_no = 0;
        last_block = i_size_read(inode) >> blkbits;
        while ((probe_block + blocks_per_page) <= last_block &&
                        page_no < sis->max) {
                unsigned block_in_page;
                sector_t first_block;

                cond_resched();

                first_block = probe_block;
                ret = bmap(inode, &first_block);
                if (ret || !first_block)
                        goto bad_bmap;

                /*
                 * It must be PAGE_SIZE aligned on-disk
                 */
                if (first_block & (blocks_per_page - 1)) {
                        probe_block++;
                        goto reprobe;
                }

                for (block_in_page = 1; block_in_page < blocks_per_page;
                                        block_in_page++) {
                        sector_t block;

                        block = probe_block + block_in_page;
                        ret = bmap(inode, &block);
                        if (ret || !block)
                                goto bad_bmap;

                        if (block != first_block + block_in_page) {
                                /* Discontiguity */
                                probe_block++;
                                goto reprobe;
                        }
                }

                first_block >>= (PAGE_SHIFT - blkbits);
                if (page_no) {        /* exclude the header page */
                        if (first_block < lowest_block)
                                lowest_block = first_block;
                        if (first_block > highest_block)
                                highest_block = first_block;
                }

                /*
                 * We found a PAGE_SIZE-length, PAGE_SIZE-aligned run of blocks
                 */
                ret = add_swap_extent(sis, page_no, 1, first_block);
                if (ret < 0)
                        goto out;
                nr_extents += ret;
                page_no++;
                probe_block += blocks_per_page;
reprobe:
                continue;
        }
        ret = nr_extents;
        *span = 1 + highest_block - lowest_block;
        if (page_no == 0)
                page_no = 1;        /* force Empty message */
        sis->max = page_no;
        sis->pages = page_no - 1;
out:
        return ret;
bad_bmap:
        pr_err("swapon: swapfile has holes\n");
        ret = -EINVAL;
        goto out;
}

static bool is_folio_zero_filled(struct folio *folio)
{
        unsigned int pos, last_pos;
        unsigned long *data;
        unsigned int i;

        last_pos = PAGE_SIZE / sizeof(*data) - 1;
        for (i = 0; i < folio_nr_pages(folio); i++) {
                data = kmap_local_folio(folio, i * PAGE_SIZE);
                /*
                 * Check last word first, incase the page is zero-filled at
                 * the start and has non-zero data at the end, which is common
                 * in real-world workloads.
                 */
                if (data[last_pos]) {
                        kunmap_local(data);
                        return false;
                }
                for (pos = 0; pos < last_pos; pos++) {
                        if (data[pos]) {
                                kunmap_local(data);
                                return false;
                        }
                }
                kunmap_local(data);
        }

        return true;
}

static void swap_zeromap_folio_set(struct folio *folio)
{
        struct obj_cgroup *objcg = get_obj_cgroup_from_folio(folio);
        struct swap_info_struct *sis = swp_swap_info(folio->swap);
        int nr_pages = folio_nr_pages(folio);
        swp_entry_t entry;
        unsigned int i;

        for (i = 0; i < folio_nr_pages(folio); i++) {
                entry = page_swap_entry(folio_page(folio, i));
                set_bit(swp_offset(entry), sis->zeromap);
        }

        count_vm_events(SWPOUT_ZERO, nr_pages);
        if (objcg) {
                count_objcg_events(objcg, SWPOUT_ZERO, nr_pages);
                obj_cgroup_put(objcg);
        }
}

static void swap_zeromap_folio_clear(struct folio *folio)
{
        struct swap_info_struct *sis = swp_swap_info(folio->swap);
        swp_entry_t entry;
        unsigned int i;

        for (i = 0; i < folio_nr_pages(folio); i++) {
                entry = page_swap_entry(folio_page(folio, i));
                clear_bit(swp_offset(entry), sis->zeromap);
        }
}

/*
 * We may have stale swap cache pages in memory: notice
 * them here and get rid of the unnecessary final write.
 */
int swap_writepage(struct page *page, struct writeback_control *wbc)
{
        struct folio *folio = page_folio(page);
        int ret;

        if (folio_free_swap(folio)) {
                folio_unlock(folio);
                return 0;
        }
        /*
         * Arch code may have to preserve more data than just the page
         * contents, e.g. memory tags.
         */
        ret = arch_prepare_to_swap(folio);
        if (ret) {
                folio_mark_dirty(folio);
                folio_unlock(folio);
                return ret;
        }

        /*
         * Use a bitmap (zeromap) to avoid doing IO for zero-filled pages.
         * The bits in zeromap are protected by the locked swapcache folio
         * and atomic updates are used to protect against read-modify-write
         * corruption due to other zero swap entries seeing concurrent updates.
         */
        if (is_folio_zero_filled(folio)) {
                swap_zeromap_folio_set(folio);
                folio_unlock(folio);
                return 0;
        } else {
                /*
                 * Clear bits this folio occupies in the zeromap to prevent
                 * zero data being read in from any previous zero writes that
                 * occupied the same swap entries.
                 */
                swap_zeromap_folio_clear(folio);
        }
        if (zswap_store(folio)) {
                count_mthp_stat(folio_order(folio), MTHP_STAT_ZSWPOUT);
                folio_unlock(folio);
                return 0;
        }
        if (!mem_cgroup_zswap_writeback_enabled(folio_memcg(folio))) {
                folio_mark_dirty(folio);
                return AOP_WRITEPAGE_ACTIVATE;
        }

        __swap_writepage(folio, wbc);
        return 0;
}

static inline void count_swpout_vm_event(struct folio *folio)
{
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
        if (unlikely(folio_test_pmd_mappable(folio))) {
                count_memcg_folio_events(folio, THP_SWPOUT, 1);
                count_vm_event(THP_SWPOUT);
        }
#endif
        count_mthp_stat(folio_order(folio), MTHP_STAT_SWPOUT);
        count_memcg_folio_events(folio, PSWPOUT, folio_nr_pages(folio));
        count_vm_events(PSWPOUT, folio_nr_pages(folio));
}

#if defined(CONFIG_MEMCG) && defined(CONFIG_BLK_CGROUP)
static void bio_associate_blkg_from_page(struct bio *bio, struct folio *folio)
{
        struct cgroup_subsys_state *css;
        struct mem_cgroup *memcg;

        memcg = folio_memcg(folio);
        if (!memcg)
                return;

        rcu_read_lock();
        css = cgroup_e_css(memcg->css.cgroup, &io_cgrp_subsys);
        bio_associate_blkg_from_css(bio, css);
        rcu_read_unlock();
}
#else
#define bio_associate_blkg_from_page(bio, folio)                do { } while (0)
#endif /* CONFIG_MEMCG && CONFIG_BLK_CGROUP */

struct swap_iocb {
        struct kiocb                iocb;
        struct bio_vec                bvec[SWAP_CLUSTER_MAX];
        int                        pages;
        int                        len;
};
static mempool_t *sio_pool;

int sio_pool_init(void)
{
        if (!sio_pool) {
                mempool_t *pool = mempool_create_kmalloc_pool(
                        SWAP_CLUSTER_MAX, sizeof(struct swap_iocb));
                if (cmpxchg(&sio_pool, NULL, pool))
                        mempool_destroy(pool);
        }
        if (!sio_pool)
                return -ENOMEM;
        return 0;
}

static void sio_write_complete(struct kiocb *iocb, long ret)
{
        struct swap_iocb *sio = container_of(iocb, struct swap_iocb, iocb);
        struct page *page = sio->bvec[0].bv_page;
        int p;

        if (ret != sio->len) {
                /*
                 * In the case of swap-over-nfs, this can be a
                 * temporary failure if the system has limited
                 * memory for allocating transmit buffers.
                 * Mark the page dirty and avoid
                 * folio_rotate_reclaimable but rate-limit the
                 * messages.
                 */
                pr_err_ratelimited("Write error %ld on dio swapfile (%llu)\n",
                                   ret, swap_dev_pos(page_swap_entry(page)));
                for (p = 0; p < sio->pages; p++) {
                        page = sio->bvec[p].bv_page;
                        set_page_dirty(page);
                        ClearPageReclaim(page);
                }
        }

        for (p = 0; p < sio->pages; p++)
                end_page_writeback(sio->bvec[p].bv_page);

        mempool_free(sio, sio_pool);
}

static void swap_writepage_fs(struct folio *folio, struct writeback_control *wbc)
{
        struct swap_iocb *sio = NULL;
        struct swap_info_struct *sis = swp_swap_info(folio->swap);
        struct file *swap_file = sis->swap_file;
        loff_t pos = swap_dev_pos(folio->swap);

        count_swpout_vm_event(folio);
        folio_start_writeback(folio);
        folio_unlock(folio);
        if (wbc->swap_plug)
                sio = *wbc->swap_plug;
        if (sio) {
                if (sio->iocb.ki_filp != swap_file ||
                    sio->iocb.ki_pos + sio->len != pos) {
                        swap_write_unplug(sio);
                        sio = NULL;
                }
        }
        if (!sio) {
                sio = mempool_alloc(sio_pool, GFP_NOIO);
                init_sync_kiocb(&sio->iocb, swap_file);
                sio->iocb.ki_complete = sio_write_complete;
                sio->iocb.ki_pos = pos;
                sio->pages = 0;
                sio->len = 0;
        }
        bvec_set_folio(&sio->bvec[sio->pages], folio, folio_size(folio), 0);
        sio->len += folio_size(folio);
        sio->pages += 1;
        if (sio->pages == ARRAY_SIZE(sio->bvec) || !wbc->swap_plug) {
                swap_write_unplug(sio);
                sio = NULL;
        }
        if (wbc->swap_plug)
                *wbc->swap_plug = sio;
}

static void swap_writepage_bdev_sync(struct folio *folio,
                struct writeback_control *wbc, struct swap_info_struct *sis)
{
        struct bio_vec bv;
        struct bio bio;

        bio_init(&bio, sis->bdev, &bv, 1,
                 REQ_OP_WRITE | REQ_SWAP | wbc_to_write_flags(wbc));
        bio.bi_iter.bi_sector = swap_folio_sector(folio);
        bio_add_folio_nofail(&bio, folio, folio_size(folio), 0);

        bio_associate_blkg_from_page(&bio, folio);
        count_swpout_vm_event(folio);

        folio_start_writeback(folio);
        folio_unlock(folio);

        submit_bio_wait(&bio);
        __end_swap_bio_write(&bio);
}

static void swap_writepage_bdev_async(struct folio *folio,
                struct writeback_control *wbc, struct swap_info_struct *sis)
{
        struct bio *bio;

        bio = bio_alloc(sis->bdev, 1,
                        REQ_OP_WRITE | REQ_SWAP | wbc_to_write_flags(wbc),
                        GFP_NOIO);
        bio->bi_iter.bi_sector = swap_folio_sector(folio);
        bio->bi_end_io = end_swap_bio_write;
        bio_add_folio_nofail(bio, folio, folio_size(folio), 0);

        bio_associate_blkg_from_page(bio, folio);
        count_swpout_vm_event(folio);
        folio_start_writeback(folio);
        folio_unlock(folio);
        submit_bio(bio);
}

void __swap_writepage(struct folio *folio, struct writeback_control *wbc)
{
        struct swap_info_struct *sis = swp_swap_info(folio->swap);

        VM_BUG_ON_FOLIO(!folio_test_swapcache(folio), folio);
        /*
         * ->flags can be updated non-atomicially (scan_swap_map_slots),
         * but that will never affect SWP_FS_OPS, so the data_race
         * is safe.
         */
        if (data_race(sis->flags & SWP_FS_OPS))
                swap_writepage_fs(folio, wbc);
        /*
         * ->flags can be updated non-atomicially (scan_swap_map_slots),
         * but that will never affect SWP_SYNCHRONOUS_IO, so the data_race
         * is safe.
         */
        else if (data_race(sis->flags & SWP_SYNCHRONOUS_IO))
                swap_writepage_bdev_sync(folio, wbc, sis);
        else
                swap_writepage_bdev_async(folio, wbc, sis);
}

void swap_write_unplug(struct swap_iocb *sio)
{
        struct iov_iter from;
        struct address_space *mapping = sio->iocb.ki_filp->f_mapping;
        int ret;

        iov_iter_bvec(&from, ITER_SOURCE, sio->bvec, sio->pages, sio->len);
        ret = mapping->a_ops->swap_rw(&sio->iocb, &from);
        if (ret != -EIOCBQUEUED)
                sio_write_complete(&sio->iocb, ret);
}

static void sio_read_complete(struct kiocb *iocb, long ret)
{
        struct swap_iocb *sio = container_of(iocb, struct swap_iocb, iocb);
        int p;

        if (ret == sio->len) {
                for (p = 0; p < sio->pages; p++) {
                        struct folio *folio = page_folio(sio->bvec[p].bv_page);

                        count_mthp_stat(folio_order(folio), MTHP_STAT_SWPIN);
                        count_memcg_folio_events(folio, PSWPIN, folio_nr_pages(folio));
                        folio_mark_uptodate(folio);
                        folio_unlock(folio);
                }
                count_vm_events(PSWPIN, sio->pages);
        } else {
                for (p = 0; p < sio->pages; p++) {
                        struct folio *folio = page_folio(sio->bvec[p].bv_page);

                        folio_unlock(folio);
                }
                pr_alert_ratelimited("Read-error on swap-device\n");
        }
        mempool_free(sio, sio_pool);
}

static bool swap_read_folio_zeromap(struct folio *folio)
{
        int nr_pages = folio_nr_pages(folio);
        struct obj_cgroup *objcg;
        bool is_zeromap;

        /*
         * Swapping in a large folio that is partially in the zeromap is not
         * currently handled. Return true without marking the folio uptodate so
         * that an IO error is emitted (e.g. do_swap_page() will sigbus).
         */
        if (WARN_ON_ONCE(swap_zeromap_batch(folio->swap, nr_pages,
                        &is_zeromap) != nr_pages))
                return true;

        if (!is_zeromap)
                return false;

        objcg = get_obj_cgroup_from_folio(folio);
        count_vm_events(SWPIN_ZERO, nr_pages);
        if (objcg) {
                count_objcg_events(objcg, SWPIN_ZERO, nr_pages);
                obj_cgroup_put(objcg);
        }

        folio_zero_range(folio, 0, folio_size(folio));
        folio_mark_uptodate(folio);
        return true;
}

static void swap_read_folio_fs(struct folio *folio, struct swap_iocb **plug)
{
        struct swap_info_struct *sis = swp_swap_info(folio->swap);
        struct swap_iocb *sio = NULL;
        loff_t pos = swap_dev_pos(folio->swap);

        if (plug)
                sio = *plug;
        if (sio) {
                if (sio->iocb.ki_filp != sis->swap_file ||
                    sio->iocb.ki_pos + sio->len != pos) {
                        swap_read_unplug(sio);
                        sio = NULL;
                }
        }
        if (!sio) {
                sio = mempool_alloc(sio_pool, GFP_KERNEL);
                init_sync_kiocb(&sio->iocb, sis->swap_file);
                sio->iocb.ki_pos = pos;
                sio->iocb.ki_complete = sio_read_complete;
                sio->pages = 0;
                sio->len = 0;
        }
        bvec_set_folio(&sio->bvec[sio->pages], folio, folio_size(folio), 0);
        sio->len += folio_size(folio);
        sio->pages += 1;
        if (sio->pages == ARRAY_SIZE(sio->bvec) || !plug) {
                swap_read_unplug(sio);
                sio = NULL;
        }
        if (plug)
                *plug = sio;
}

static void swap_read_folio_bdev_sync(struct folio *folio,
                struct swap_info_struct *sis)
{
        struct bio_vec bv;
        struct bio bio;

        bio_init(&bio, sis->bdev, &bv, 1, REQ_OP_READ);
        bio.bi_iter.bi_sector = swap_folio_sector(folio);
        bio_add_folio_nofail(&bio, folio, folio_size(folio), 0);
        /*
         * Keep this task valid during swap readpage because the oom killer may
         * attempt to access it in the page fault retry time check.
         */
        get_task_struct(current);
        count_mthp_stat(folio_order(folio), MTHP_STAT_SWPIN);
        count_memcg_folio_events(folio, PSWPIN, folio_nr_pages(folio));
        count_vm_events(PSWPIN, folio_nr_pages(folio));
        submit_bio_wait(&bio);
        __end_swap_bio_read(&bio);
        put_task_struct(current);
}

static void swap_read_folio_bdev_async(struct folio *folio,
                struct swap_info_struct *sis)
{
        struct bio *bio;

        bio = bio_alloc(sis->bdev, 1, REQ_OP_READ, GFP_KERNEL);
        bio->bi_iter.bi_sector = swap_folio_sector(folio);
        bio->bi_end_io = end_swap_bio_read;
        bio_add_folio_nofail(bio, folio, folio_size(folio), 0);
        count_mthp_stat(folio_order(folio), MTHP_STAT_SWPIN);
        count_memcg_folio_events(folio, PSWPIN, folio_nr_pages(folio));
        count_vm_events(PSWPIN, folio_nr_pages(folio));
        submit_bio(bio);
}

void swap_read_folio(struct folio *folio, struct swap_iocb **plug)
{
        struct swap_info_struct *sis = swp_swap_info(folio->swap);
        bool synchronous = sis->flags & SWP_SYNCHRONOUS_IO;
        bool workingset = folio_test_workingset(folio);
        unsigned long pflags;
        bool in_thrashing;

        VM_BUG_ON_FOLIO(!folio_test_swapcache(folio) && !synchronous, folio);
        VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
        VM_BUG_ON_FOLIO(folio_test_uptodate(folio), folio);

        /*
         * Count submission time as memory stall and delay. When the device
         * is congested, or the submitting cgroup IO-throttled, submission
         * can be a significant part of overall IO time.
         */
        if (workingset) {
                delayacct_thrashing_start(&in_thrashing);
                psi_memstall_enter(&pflags);
        }
        delayacct_swapin_start();

        if (swap_read_folio_zeromap(folio)) {
                folio_unlock(folio);
                goto finish;
        } else if (zswap_load(folio)) {
                folio_unlock(folio);
                goto finish;
        }

        /* We have to read from slower devices. Increase zswap protection. */
        zswap_folio_swapin(folio);

        if (data_race(sis->flags & SWP_FS_OPS)) {
                swap_read_folio_fs(folio, plug);
        } else if (synchronous) {
                swap_read_folio_bdev_sync(folio, sis);
        } else {
                swap_read_folio_bdev_async(folio, sis);
        }

finish:
        if (workingset) {
                delayacct_thrashing_end(&in_thrashing);
                psi_memstall_leave(&pflags);
        }
        delayacct_swapin_end();
}

void __swap_read_unplug(struct swap_iocb *sio)
{
        struct iov_iter from;
        struct address_space *mapping = sio->iocb.ki_filp->f_mapping;
        int ret;

        iov_iter_bvec(&from, ITER_DEST, sio->bvec, sio->pages, sio->len);
        ret = mapping->a_ops->swap_rw(&sio->iocb, &from);
        if (ret != -EIOCBQUEUED)
                sio_read_complete(&sio->iocb, ret);
}
































    1 

   66 



   62 



   54 



    1 


   54 










  174 







    6 




















   66 


  151 















    4 





    3 



    1 


    1 


    1 






    2 

    4 


    2 


    2 
    2 









   19 





    1 




   11 

    7 



   52 



   52 






   50 





   13 
















    1 

   48 














   48 










   48 



    3 








    7 
   42 





















  123 







   99 
   48 















    3 






    1 




















    2 


















    8 



    6 





    1 





    1 




    1 





















   74 

















   18 


   56 













    2 
    5 








    1 
































    2 

    6 


    1 

   54 

    2 








    4 




    6 



    2 


    2 


   52 














    7 



















   35 







    1 


   11 



    7 











    9 









    4 






   26 





















































  205 














   74 




   83 











   82 






    7 
   77 

















   20 














































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
// SPDX-License-Identifier: GPL-2.0-only
/*
 *  linux/fs/hfsplus/super.c
 *
 * Copyright (C) 2001
 * Brad Boyer (flar@allandria.com)
 * (C) 2003 Ardis Technologies <roman@ardistech.com>
 *
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/pagemap.h>
#include <linux/blkdev.h>
#include <linux/backing-dev.h>
#include <linux/fs.h>
#include <linux/fs_context.h>
#include <linux/slab.h>
#include <linux/vfs.h>
#include <linux/nls.h>

static struct inode *hfsplus_alloc_inode(struct super_block *sb);
static void hfsplus_free_inode(struct inode *inode);

#include "hfsplus_fs.h"
#include "xattr.h"

static int hfsplus_system_read_inode(struct inode *inode)
{
        struct hfsplus_vh *vhdr = HFSPLUS_SB(inode->i_sb)->s_vhdr;

        switch (inode->i_ino) {
        case HFSPLUS_EXT_CNID:
                hfsplus_inode_read_fork(inode, &vhdr->ext_file);
                inode->i_mapping->a_ops = &hfsplus_btree_aops;
                break;
        case HFSPLUS_CAT_CNID:
                hfsplus_inode_read_fork(inode, &vhdr->cat_file);
                inode->i_mapping->a_ops = &hfsplus_btree_aops;
                break;
        case HFSPLUS_ALLOC_CNID:
                hfsplus_inode_read_fork(inode, &vhdr->alloc_file);
                inode->i_mapping->a_ops = &hfsplus_aops;
                break;
        case HFSPLUS_START_CNID:
                hfsplus_inode_read_fork(inode, &vhdr->start_file);
                break;
        case HFSPLUS_ATTR_CNID:
                hfsplus_inode_read_fork(inode, &vhdr->attr_file);
                inode->i_mapping->a_ops = &hfsplus_btree_aops;
                break;
        default:
                return -EIO;
        }

        return 0;
}

struct inode *hfsplus_iget(struct super_block *sb, unsigned long ino)
{
        struct hfs_find_data fd;
        struct inode *inode;
        int err;

        inode = iget_locked(sb, ino);
        if (!inode)
                return ERR_PTR(-ENOMEM);
        if (!(inode->i_state & I_NEW))
                return inode;

        INIT_LIST_HEAD(&HFSPLUS_I(inode)->open_dir_list);
        spin_lock_init(&HFSPLUS_I(inode)->open_dir_lock);
        mutex_init(&HFSPLUS_I(inode)->extents_lock);
        HFSPLUS_I(inode)->flags = 0;
        HFSPLUS_I(inode)->extent_state = 0;
        HFSPLUS_I(inode)->rsrc_inode = NULL;
        atomic_set(&HFSPLUS_I(inode)->opencnt, 0);

        if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID ||
            inode->i_ino == HFSPLUS_ROOT_CNID) {
                err = hfs_find_init(HFSPLUS_SB(inode->i_sb)->cat_tree, &fd);
                if (!err) {
                        err = hfsplus_find_cat(inode->i_sb, inode->i_ino, &fd);
                        if (!err)
                                err = hfsplus_cat_read_inode(inode, &fd);
                        hfs_find_exit(&fd);
                }
        } else {
                err = hfsplus_system_read_inode(inode);
        }

        if (err) {
                iget_failed(inode);
                return ERR_PTR(err);
        }

        unlock_new_inode(inode);
        return inode;
}

static int hfsplus_system_write_inode(struct inode *inode)
{
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(inode->i_sb);
        struct hfsplus_vh *vhdr = sbi->s_vhdr;
        struct hfsplus_fork_raw *fork;
        struct hfs_btree *tree = NULL;

        switch (inode->i_ino) {
        case HFSPLUS_EXT_CNID:
                fork = &vhdr->ext_file;
                tree = sbi->ext_tree;
                break;
        case HFSPLUS_CAT_CNID:
                fork = &vhdr->cat_file;
                tree = sbi->cat_tree;
                break;
        case HFSPLUS_ALLOC_CNID:
                fork = &vhdr->alloc_file;
                break;
        case HFSPLUS_START_CNID:
                fork = &vhdr->start_file;
                break;
        case HFSPLUS_ATTR_CNID:
                fork = &vhdr->attr_file;
                tree = sbi->attr_tree;
                break;
        default:
                return -EIO;
        }

        if (fork->total_size != cpu_to_be64(inode->i_size)) {
                set_bit(HFSPLUS_SB_WRITEBACKUP, &sbi->flags);
                hfsplus_mark_mdb_dirty(inode->i_sb);
        }
        hfsplus_inode_write_fork(inode, fork);
        if (tree) {
                int err = hfs_btree_write(tree);

                if (err) {
                        pr_err("b-tree write err: %d, ino %lu\n",
                               err, inode->i_ino);
                        return err;
                }
        }
        return 0;
}

static int hfsplus_write_inode(struct inode *inode,
                struct writeback_control *wbc)
{
        int err;

        hfs_dbg(INODE, "hfsplus_write_inode: %lu\n", inode->i_ino);

        err = hfsplus_ext_write_extent(inode);
        if (err)
                return err;

        if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID ||
            inode->i_ino == HFSPLUS_ROOT_CNID)
                return hfsplus_cat_write_inode(inode);
        else
                return hfsplus_system_write_inode(inode);
}

static void hfsplus_evict_inode(struct inode *inode)
{
        hfs_dbg(INODE, "hfsplus_evict_inode: %lu\n", inode->i_ino);
        truncate_inode_pages_final(&inode->i_data);
        clear_inode(inode);
        if (HFSPLUS_IS_RSRC(inode)) {
                HFSPLUS_I(HFSPLUS_I(inode)->rsrc_inode)->rsrc_inode = NULL;
                iput(HFSPLUS_I(inode)->rsrc_inode);
        }
}

static int hfsplus_sync_fs(struct super_block *sb, int wait)
{
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
        struct hfsplus_vh *vhdr = sbi->s_vhdr;
        int write_backup = 0;
        int error, error2;

        if (!wait)
                return 0;

        hfs_dbg(SUPER, "hfsplus_sync_fs\n");

        /*
         * Explicitly write out the special metadata inodes.
         *
         * While these special inodes are marked as hashed and written
         * out peridocically by the flusher threads we redirty them
         * during writeout of normal inodes, and thus the life lock
         * prevents us from getting the latest state to disk.
         */
        error = filemap_write_and_wait(sbi->cat_tree->inode->i_mapping);
        error2 = filemap_write_and_wait(sbi->ext_tree->inode->i_mapping);
        if (!error)
                error = error2;
        if (sbi->attr_tree) {
                error2 =
                    filemap_write_and_wait(sbi->attr_tree->inode->i_mapping);
                if (!error)
                        error = error2;
        }
        error2 = filemap_write_and_wait(sbi->alloc_file->i_mapping);
        if (!error)
                error = error2;

        mutex_lock(&sbi->vh_mutex);
        mutex_lock(&sbi->alloc_mutex);
        vhdr->free_blocks = cpu_to_be32(sbi->free_blocks);
        vhdr->next_cnid = cpu_to_be32(sbi->next_cnid);
        vhdr->folder_count = cpu_to_be32(sbi->folder_count);
        vhdr->file_count = cpu_to_be32(sbi->file_count);

        if (test_and_clear_bit(HFSPLUS_SB_WRITEBACKUP, &sbi->flags)) {
                memcpy(sbi->s_backup_vhdr, sbi->s_vhdr, sizeof(*sbi->s_vhdr));
                write_backup = 1;
        }

        error2 = hfsplus_submit_bio(sb,
                                   sbi->part_start + HFSPLUS_VOLHEAD_SECTOR,
                                   sbi->s_vhdr_buf, NULL, REQ_OP_WRITE |
                                   REQ_SYNC);
        if (!error)
                error = error2;
        if (!write_backup)
                goto out;

        error2 = hfsplus_submit_bio(sb,
                                  sbi->part_start + sbi->sect_count - 2,
                                  sbi->s_backup_vhdr_buf, NULL, REQ_OP_WRITE |
                                  REQ_SYNC);
        if (!error)
                error2 = error;
out:
        mutex_unlock(&sbi->alloc_mutex);
        mutex_unlock(&sbi->vh_mutex);

        if (!test_bit(HFSPLUS_SB_NOBARRIER, &sbi->flags))
                blkdev_issue_flush(sb->s_bdev);

        return error;
}

static void delayed_sync_fs(struct work_struct *work)
{
        int err;
        struct hfsplus_sb_info *sbi;

        sbi = container_of(work, struct hfsplus_sb_info, sync_work.work);

        spin_lock(&sbi->work_lock);
        sbi->work_queued = 0;
        spin_unlock(&sbi->work_lock);

        err = hfsplus_sync_fs(sbi->alloc_file->i_sb, 1);
        if (err)
                pr_err("delayed sync fs err %d\n", err);
}

void hfsplus_mark_mdb_dirty(struct super_block *sb)
{
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
        unsigned long delay;

        if (sb_rdonly(sb))
                return;

        spin_lock(&sbi->work_lock);
        if (!sbi->work_queued) {
                delay = msecs_to_jiffies(dirty_writeback_interval * 10);
                queue_delayed_work(system_long_wq, &sbi->sync_work, delay);
                sbi->work_queued = 1;
        }
        spin_unlock(&sbi->work_lock);
}

static void delayed_free(struct rcu_head *p)
{
        struct hfsplus_sb_info *sbi = container_of(p, struct hfsplus_sb_info, rcu);

        unload_nls(sbi->nls);
        kfree(sbi);
}

static void hfsplus_put_super(struct super_block *sb)
{
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);

        hfs_dbg(SUPER, "hfsplus_put_super\n");

        cancel_delayed_work_sync(&sbi->sync_work);

        if (!sb_rdonly(sb) && sbi->s_vhdr) {
                struct hfsplus_vh *vhdr = sbi->s_vhdr;

                vhdr->modify_date = hfsp_now2mt();
                vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_UNMNT);
                vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_INCNSTNT);

                hfsplus_sync_fs(sb, 1);
        }

        iput(sbi->alloc_file);
        iput(sbi->hidden_dir);
        hfs_btree_close(sbi->attr_tree);
        hfs_btree_close(sbi->cat_tree);
        hfs_btree_close(sbi->ext_tree);
        kfree(sbi->s_vhdr_buf);
        kfree(sbi->s_backup_vhdr_buf);
        call_rcu(&sbi->rcu, delayed_free);
}

static int hfsplus_statfs(struct dentry *dentry, struct kstatfs *buf)
{
        struct super_block *sb = dentry->d_sb;
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
        u64 id = huge_encode_dev(sb->s_bdev->bd_dev);

        buf->f_type = HFSPLUS_SUPER_MAGIC;
        buf->f_bsize = sb->s_blocksize;
        buf->f_blocks = sbi->total_blocks << sbi->fs_shift;
        buf->f_bfree = sbi->free_blocks << sbi->fs_shift;
        buf->f_bavail = buf->f_bfree;
        buf->f_files = 0xFFFFFFFF;
        buf->f_ffree = 0xFFFFFFFF - sbi->next_cnid;
        buf->f_fsid = u64_to_fsid(id);
        buf->f_namelen = HFSPLUS_MAX_STRLEN;

        return 0;
}

static int hfsplus_reconfigure(struct fs_context *fc)
{
        struct super_block *sb = fc->root->d_sb;

        sync_filesystem(sb);
        if ((bool)(fc->sb_flags & SB_RDONLY) == sb_rdonly(sb))
                return 0;
        if (!(fc->sb_flags & SB_RDONLY)) {
                struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
                struct hfsplus_vh *vhdr = sbi->s_vhdr;

                if (!(vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_UNMNT))) {
                        pr_warn("filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  leaving read-only.\n");
                        sb->s_flags |= SB_RDONLY;
                        fc->sb_flags |= SB_RDONLY;
                } else if (test_bit(HFSPLUS_SB_FORCE, &sbi->flags)) {
                        /* nothing */
                } else if (vhdr->attributes &
                                cpu_to_be32(HFSPLUS_VOL_SOFTLOCK)) {
                        pr_warn("filesystem is marked locked, leaving read-only.\n");
                        sb->s_flags |= SB_RDONLY;
                        fc->sb_flags |= SB_RDONLY;
                } else if (vhdr->attributes &
                                cpu_to_be32(HFSPLUS_VOL_JOURNALED)) {
                        pr_warn("filesystem is marked journaled, leaving read-only.\n");
                        sb->s_flags |= SB_RDONLY;
                        fc->sb_flags |= SB_RDONLY;
                }
        }
        return 0;
}

static const struct super_operations hfsplus_sops = {
        .alloc_inode        = hfsplus_alloc_inode,
        .free_inode        = hfsplus_free_inode,
        .write_inode        = hfsplus_write_inode,
        .evict_inode        = hfsplus_evict_inode,
        .put_super        = hfsplus_put_super,
        .sync_fs        = hfsplus_sync_fs,
        .statfs                = hfsplus_statfs,
        .show_options        = hfsplus_show_options,
};

static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
{
        struct hfsplus_vh *vhdr;
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
        hfsplus_cat_entry entry;
        struct hfs_find_data fd;
        struct inode *root, *inode;
        struct qstr str;
        struct nls_table *nls;
        u64 last_fs_block, last_fs_page;
        int silent = fc->sb_flags & SB_SILENT;
        int err;

        mutex_init(&sbi->alloc_mutex);
        mutex_init(&sbi->vh_mutex);
        spin_lock_init(&sbi->work_lock);
        INIT_DELAYED_WORK(&sbi->sync_work, delayed_sync_fs);

        err = -EINVAL;
        if (!sbi->nls) {
                /* try utf8 first, as this is the old default behaviour */
                sbi->nls = load_nls("utf8");
                if (!sbi->nls)
                        sbi->nls = load_nls_default();
        }

        /* temporarily use utf8 to correctly find the hidden dir below */
        nls = sbi->nls;
        sbi->nls = load_nls("utf8");
        if (!sbi->nls) {
                pr_err("unable to load nls for utf8\n");
                goto out_unload_nls;
        }

        /* Grab the volume header */
        if (hfsplus_read_wrapper(sb)) {
                if (!silent)
                        pr_warn("unable to find HFS+ superblock\n");
                goto out_unload_nls;
        }
        vhdr = sbi->s_vhdr;

        /* Copy parts of the volume header into the superblock */
        sb->s_magic = HFSPLUS_VOLHEAD_SIG;
        if (be16_to_cpu(vhdr->version) < HFSPLUS_MIN_VERSION ||
            be16_to_cpu(vhdr->version) > HFSPLUS_CURRENT_VERSION) {
                pr_err("wrong filesystem version\n");
                goto out_free_vhdr;
        }
        sbi->total_blocks = be32_to_cpu(vhdr->total_blocks);
        sbi->free_blocks = be32_to_cpu(vhdr->free_blocks);
        sbi->next_cnid = be32_to_cpu(vhdr->next_cnid);
        sbi->file_count = be32_to_cpu(vhdr->file_count);
        sbi->folder_count = be32_to_cpu(vhdr->folder_count);
        sbi->data_clump_blocks =
                be32_to_cpu(vhdr->data_clump_sz) >> sbi->alloc_blksz_shift;
        if (!sbi->data_clump_blocks)
                sbi->data_clump_blocks = 1;
        sbi->rsrc_clump_blocks =
                be32_to_cpu(vhdr->rsrc_clump_sz) >> sbi->alloc_blksz_shift;
        if (!sbi->rsrc_clump_blocks)
                sbi->rsrc_clump_blocks = 1;

        err = -EFBIG;
        last_fs_block = sbi->total_blocks - 1;
        last_fs_page = (last_fs_block << sbi->alloc_blksz_shift) >>
                        PAGE_SHIFT;

        if ((last_fs_block > (sector_t)(~0ULL) >> (sbi->alloc_blksz_shift - 9)) ||
            (last_fs_page > (pgoff_t)(~0ULL))) {
                pr_err("filesystem size too large\n");
                goto out_free_vhdr;
        }

        /* Set up operations so we can load metadata */
        sb->s_op = &hfsplus_sops;
        sb->s_maxbytes = MAX_LFS_FILESIZE;

        if (!(vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_UNMNT))) {
                pr_warn("Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  mounting read-only.\n");
                sb->s_flags |= SB_RDONLY;
        } else if (test_and_clear_bit(HFSPLUS_SB_FORCE, &sbi->flags)) {
                /* nothing */
        } else if (vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_SOFTLOCK)) {
                pr_warn("Filesystem is marked locked, mounting read-only.\n");
                sb->s_flags |= SB_RDONLY;
        } else if ((vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_JOURNALED)) &&
                        !sb_rdonly(sb)) {
                pr_warn("write access to a journaled filesystem is not supported, use the force option at your own risk, mounting read-only.\n");
                sb->s_flags |= SB_RDONLY;
        }

        err = -EINVAL;

        /* Load metadata objects (B*Trees) */
        sbi->ext_tree = hfs_btree_open(sb, HFSPLUS_EXT_CNID);
        if (!sbi->ext_tree) {
                pr_err("failed to load extents file\n");
                goto out_free_vhdr;
        }
        sbi->cat_tree = hfs_btree_open(sb, HFSPLUS_CAT_CNID);
        if (!sbi->cat_tree) {
                pr_err("failed to load catalog file\n");
                goto out_close_ext_tree;
        }
        atomic_set(&sbi->attr_tree_state, HFSPLUS_EMPTY_ATTR_TREE);
        if (vhdr->attr_file.total_blocks != 0) {
                sbi->attr_tree = hfs_btree_open(sb, HFSPLUS_ATTR_CNID);
                if (!sbi->attr_tree) {
                        pr_err("failed to load attributes file\n");
                        goto out_close_cat_tree;
                }
                atomic_set(&sbi->attr_tree_state, HFSPLUS_VALID_ATTR_TREE);
        }
        sb->s_xattr = hfsplus_xattr_handlers;

        inode = hfsplus_iget(sb, HFSPLUS_ALLOC_CNID);
        if (IS_ERR(inode)) {
                pr_err("failed to load allocation file\n");
                err = PTR_ERR(inode);
                goto out_close_attr_tree;
        }
        sbi->alloc_file = inode;

        /* Load the root directory */
        root = hfsplus_iget(sb, HFSPLUS_ROOT_CNID);
        if (IS_ERR(root)) {
                pr_err("failed to load root directory\n");
                err = PTR_ERR(root);
                goto out_put_alloc_file;
        }

        sb->s_d_op = &hfsplus_dentry_operations;
        sb->s_root = d_make_root(root);
        if (!sb->s_root) {
                err = -ENOMEM;
                goto out_put_alloc_file;
        }

        str.len = sizeof(HFSP_HIDDENDIR_NAME) - 1;
        str.name = HFSP_HIDDENDIR_NAME;
        err = hfs_find_init(sbi->cat_tree, &fd);
        if (err)
                goto out_put_root;
        err = hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);
        if (unlikely(err < 0))
                goto out_put_root;
        if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
                hfs_find_exit(&fd);
                if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) {
                        err = -EINVAL;
                        goto out_put_root;
                }
                inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
                if (IS_ERR(inode)) {
                        err = PTR_ERR(inode);
                        goto out_put_root;
                }
                sbi->hidden_dir = inode;
        } else
                hfs_find_exit(&fd);

        if (!sb_rdonly(sb)) {
                /*
                 * H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
                 * all three are registered with Apple for our use
                 */
                vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
                vhdr->modify_date = hfsp_now2mt();
                be32_add_cpu(&vhdr->write_count, 1);
                vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
                vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
                hfsplus_sync_fs(sb, 1);

                if (!sbi->hidden_dir) {
                        mutex_lock(&sbi->vh_mutex);
                        sbi->hidden_dir = hfsplus_new_inode(sb, root, S_IFDIR);
                        if (!sbi->hidden_dir) {
                                mutex_unlock(&sbi->vh_mutex);
                                err = -ENOMEM;
                                goto out_put_root;
                        }
                        err = hfsplus_create_cat(sbi->hidden_dir->i_ino, root,
                                                 &str, sbi->hidden_dir);
                        if (err) {
                                mutex_unlock(&sbi->vh_mutex);
                                goto out_put_hidden_dir;
                        }

                        err = hfsplus_init_security(sbi->hidden_dir,
                                                        root, &str);
                        if (err == -EOPNOTSUPP)
                                err = 0; /* Operation is not supported. */
                        else if (err) {
                                /*
                                 * Try to delete anyway without
                                 * error analysis.
                                 */
                                hfsplus_delete_cat(sbi->hidden_dir->i_ino,
                                                        root, &str);
                                mutex_unlock(&sbi->vh_mutex);
                                goto out_put_hidden_dir;
                        }

                        mutex_unlock(&sbi->vh_mutex);
                        hfsplus_mark_inode_dirty(sbi->hidden_dir,
                                                 HFSPLUS_I_CAT_DIRTY);
                }
        }

        unload_nls(sbi->nls);
        sbi->nls = nls;
        return 0;

out_put_hidden_dir:
        cancel_delayed_work_sync(&sbi->sync_work);
        iput(sbi->hidden_dir);
out_put_root:
        dput(sb->s_root);
        sb->s_root = NULL;
out_put_alloc_file:
        iput(sbi->alloc_file);
out_close_attr_tree:
        hfs_btree_close(sbi->attr_tree);
out_close_cat_tree:
        hfs_btree_close(sbi->cat_tree);
out_close_ext_tree:
        hfs_btree_close(sbi->ext_tree);
out_free_vhdr:
        kfree(sbi->s_vhdr_buf);
        kfree(sbi->s_backup_vhdr_buf);
out_unload_nls:
        unload_nls(sbi->nls);
        unload_nls(nls);
        kfree(sbi);
        return err;
}

MODULE_AUTHOR("Brad Boyer");
MODULE_DESCRIPTION("Extended Macintosh Filesystem");
MODULE_LICENSE("GPL");

static struct kmem_cache *hfsplus_inode_cachep;

static struct inode *hfsplus_alloc_inode(struct super_block *sb)
{
        struct hfsplus_inode_info *i;

        i = alloc_inode_sb(sb, hfsplus_inode_cachep, GFP_KERNEL);
        return i ? &i->vfs_inode : NULL;
}

static void hfsplus_free_inode(struct inode *inode)
{
        kmem_cache_free(hfsplus_inode_cachep, HFSPLUS_I(inode));
}

#define HFSPLUS_INODE_SIZE        sizeof(struct hfsplus_inode_info)

static int hfsplus_get_tree(struct fs_context *fc)
{
        return get_tree_bdev(fc, hfsplus_fill_super);
}

static void hfsplus_free_fc(struct fs_context *fc)
{
        kfree(fc->s_fs_info);
}

static const struct fs_context_operations hfsplus_context_ops = {
        .parse_param        = hfsplus_parse_param,
        .get_tree        = hfsplus_get_tree,
        .reconfigure        = hfsplus_reconfigure,
        .free                = hfsplus_free_fc,
};

static int hfsplus_init_fs_context(struct fs_context *fc)
{
        struct hfsplus_sb_info *sbi;

        sbi = kzalloc(sizeof(struct hfsplus_sb_info), GFP_KERNEL);
        if (!sbi)
                return -ENOMEM;

        if (fc->purpose != FS_CONTEXT_FOR_RECONFIGURE)
                hfsplus_fill_defaults(sbi);

        fc->s_fs_info = sbi;
        fc->ops = &hfsplus_context_ops;

        return 0;
}

static struct file_system_type hfsplus_fs_type = {
        .owner                = THIS_MODULE,
        .name                = "hfsplus",
        .kill_sb        = kill_block_super,
        .fs_flags        = FS_REQUIRES_DEV,
        .init_fs_context = hfsplus_init_fs_context,
};
MODULE_ALIAS_FS("hfsplus");

static void hfsplus_init_once(void *p)
{
        struct hfsplus_inode_info *i = p;

        inode_init_once(&i->vfs_inode);
}

static int __init init_hfsplus_fs(void)
{
        int err;

        hfsplus_inode_cachep = kmem_cache_create("hfsplus_icache",
                HFSPLUS_INODE_SIZE, 0, SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT,
                hfsplus_init_once);
        if (!hfsplus_inode_cachep)
                return -ENOMEM;
        err = hfsplus_create_attr_tree_cache();
        if (err)
                goto destroy_inode_cache;
        err = register_filesystem(&hfsplus_fs_type);
        if (err)
                goto destroy_attr_tree_cache;
        return 0;

destroy_attr_tree_cache:
        hfsplus_destroy_attr_tree_cache();

destroy_inode_cache:
        kmem_cache_destroy(hfsplus_inode_cachep);

        return err;
}

static void __exit exit_hfsplus_fs(void)
{
        unregister_filesystem(&hfsplus_fs_type);

        /*
         * Make sure all delayed rcu free inodes are flushed before we
         * destroy cache.
         */
        rcu_barrier();
        hfsplus_destroy_attr_tree_cache();
        kmem_cache_destroy(hfsplus_inode_cachep);
}

module_init(init_hfsplus_fs)
module_exit(exit_hfsplus_fs)



















































   32 




   10 


















   10 













   21 
   40 
   58 






































   63 




    3 




   60 



    1 






   58 



























   58 


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
// SPDX-License-Identifier: GPL-2.0
/*
 *  linux/fs/ext4/fsync.c
 *
 *  Copyright (C) 1993  Stephen Tweedie (sct@redhat.com)
 *  from
 *  Copyright (C) 1992  Remy Card (card@masi.ibp.fr)
 *                      Laboratoire MASI - Institut Blaise Pascal
 *                      Universite Pierre et Marie Curie (Paris VI)
 *  from
 *  linux/fs/minix/truncate.c   Copyright (C) 1991, 1992  Linus Torvalds
 *
 *  ext4fs fsync primitive
 *
 *  Big-endian to little-endian byte-swapping/bitmaps by
 *        David S. Miller (davem@caip.rutgers.edu), 1995
 *
 *  Removed unnecessary code duplication for little endian machines
 *  and excessive __inline__s.
 *        Andi Kleen, 1997
 *
 * Major simplications and cleanup - we only need to do the metadata, because
 * we can depend on generic_block_fdatasync() to sync the data blocks.
 */

#include <linux/time.h>
#include <linux/fs.h>
#include <linux/sched.h>
#include <linux/writeback.h>
#include <linux/blkdev.h>
#include <linux/buffer_head.h>

#include "ext4.h"
#include "ext4_jbd2.h"

#include <trace/events/ext4.h>

/*
 * If we're not journaling and this is a just-created file, we have to
 * sync our parent directory (if it was freshly created) since
 * otherwise it will only be written by writeback, leaving a huge
 * window during which a crash may lose the file.  This may apply for
 * the parent directory's parent as well, and so on recursively, if
 * they are also freshly created.
 */
static int ext4_sync_parent(struct inode *inode)
{
        struct dentry *dentry, *next;
        int ret = 0;

        if (!ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY))
                return 0;
        dentry = d_find_any_alias(inode);
        if (!dentry)
                return 0;
        while (ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
                ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);

                next = dget_parent(dentry);
                dput(dentry);
                dentry = next;
                inode = dentry->d_inode;

                /*
                 * The directory inode may have gone through rmdir by now. But
                 * the inode itself and its blocks are still allocated (we hold
                 * a reference to the inode via its dentry), so it didn't go
                 * through ext4_evict_inode()) and so we are safe to flush
                 * metadata blocks and the inode.
                 */
                ret = sync_mapping_buffers(inode->i_mapping);
                if (ret)
                        break;
                ret = sync_inode_metadata(inode, 1);
                if (ret)
                        break;
        }
        dput(dentry);
        return ret;
}

static int ext4_fsync_nojournal(struct file *file, loff_t start, loff_t end,
                                int datasync, bool *needs_barrier)
{
        struct inode *inode = file->f_inode;
        int ret;

        ret = generic_buffers_fsync_noflush(file, start, end, datasync);
        if (!ret)
                ret = ext4_sync_parent(inode);
        if (test_opt(inode->i_sb, BARRIER))
                *needs_barrier = true;

        return ret;
}

static int ext4_fsync_journal(struct inode *inode, bool datasync,
                             bool *needs_barrier)
{
        struct ext4_inode_info *ei = EXT4_I(inode);
        journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
        tid_t commit_tid = datasync ? ei->i_datasync_tid : ei->i_sync_tid;

        /*
         * Fastcommit does not really support fsync on directories or other
         * special files. Force a full commit.
         */
        if (!S_ISREG(inode->i_mode))
                return ext4_force_commit(inode->i_sb);

        if (journal->j_flags & JBD2_BARRIER &&
            !jbd2_trans_will_send_data_barrier(journal, commit_tid))
                *needs_barrier = true;

        return ext4_fc_commit(journal, commit_tid);
}

/*
 * akpm: A new design for ext4_sync_file().
 *
 * This is only called from sys_fsync(), sys_fdatasync() and sys_msync().
 * There cannot be a transaction open by this task.
 * Another task could have dirtied this inode.  Its data can be in any
 * state in the journalling system.
 *
 * What we do is just kick off a commit and wait on it.  This will snapshot the
 * inode to disk.
 */
int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
{
        int ret = 0, err;
        bool needs_barrier = false;
        struct inode *inode = file->f_mapping->host;

        if (unlikely(ext4_forced_shutdown(inode->i_sb)))
                return -EIO;

        ASSERT(ext4_journal_current_handle() == NULL);

        trace_ext4_sync_file_enter(file, datasync);

        if (sb_rdonly(inode->i_sb)) {
                /* Make sure that we read updated s_ext4_flags value */
                smp_rmb();
                if (ext4_forced_shutdown(inode->i_sb))
                        ret = -EROFS;
                goto out;
        }

        if (!EXT4_SB(inode->i_sb)->s_journal) {
                ret = ext4_fsync_nojournal(file, start, end, datasync,
                                           &needs_barrier);
                if (needs_barrier)
                        goto issue_flush;
                goto out;
        }

        ret = file_write_and_wait_range(file, start, end);
        if (ret)
                goto out;

        /*
         *  The caller's filemap_fdatawrite()/wait will sync the data.
         *  Metadata is in the journal, we wait for proper transaction to
         *  commit here.
         */
        ret = ext4_fsync_journal(inode, datasync, &needs_barrier);

issue_flush:
        if (needs_barrier) {
                err = blkdev_issue_flush(inode->i_sb->s_bdev);
                if (!ret)
                        ret = err;
        }
out:
        err = file_check_and_advance_wb_err(file);
        if (ret == 0)
                ret = err;
        trace_ext4_sync_file_exit(inode, ret);
        return ret;
}




















































































   14 



































































































































































































































































































































































































































































































































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
// SPDX-License-Identifier: GPL-2.0-only
/*
 * VMware VMCI Driver
 *
 * Copyright (C) 2012 VMware, Inc. All rights reserved.
 */

#include <linux/vmw_vmci_defs.h>
#include <linux/vmw_vmci_api.h>
#include <linux/moduleparam.h>
#include <linux/interrupt.h>
#include <linux/highmem.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/module.h>
#include <linux/processor.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/init.h>
#include <linux/pci.h>
#include <linux/smp.h>
#include <linux/io.h>
#include <linux/vmalloc.h>

#include "vmci_datagram.h"
#include "vmci_doorbell.h"
#include "vmci_context.h"
#include "vmci_driver.h"
#include "vmci_event.h"

#define PCI_DEVICE_ID_VMWARE_VMCI        0x0740

#define VMCI_UTIL_NUM_RESOURCES 1

/*
 * Datagram buffers for DMA send/receive must accommodate at least
 * a maximum sized datagram and the header.
 */
#define VMCI_DMA_DG_BUFFER_SIZE (VMCI_MAX_DG_SIZE + PAGE_SIZE)

static bool vmci_disable_msi;
module_param_named(disable_msi, vmci_disable_msi, bool, 0);
MODULE_PARM_DESC(disable_msi, "Disable MSI use in driver - (default=0)");

static bool vmci_disable_msix;
module_param_named(disable_msix, vmci_disable_msix, bool, 0);
MODULE_PARM_DESC(disable_msix, "Disable MSI-X use in driver - (default=0)");

static u32 ctx_update_sub_id = VMCI_INVALID_ID;
static u32 vm_context_id = VMCI_INVALID_ID;

struct vmci_guest_device {
        struct device *dev;        /* PCI device we are attached to */
        void __iomem *iobase;
        void __iomem *mmio_base;

        bool exclusive_vectors;

        struct wait_queue_head inout_wq;

        void *data_buffer;
        dma_addr_t data_buffer_base;
        void *tx_buffer;
        dma_addr_t tx_buffer_base;
        void *notification_bitmap;
        dma_addr_t notification_base;
};

static bool use_ppn64;

bool vmci_use_ppn64(void)
{
        return use_ppn64;
}

/* vmci_dev singleton device and supporting data*/
struct pci_dev *vmci_pdev;
static struct vmci_guest_device *vmci_dev_g;
static DEFINE_SPINLOCK(vmci_dev_spinlock);

static atomic_t vmci_num_guest_devices = ATOMIC_INIT(0);

bool vmci_guest_code_active(void)
{
        return atomic_read(&vmci_num_guest_devices) != 0;
}

u32 vmci_get_vm_context_id(void)
{
        if (vm_context_id == VMCI_INVALID_ID) {
                struct vmci_datagram get_cid_msg;
                get_cid_msg.dst =
                    vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
                                     VMCI_GET_CONTEXT_ID);
                get_cid_msg.src = VMCI_ANON_SRC_HANDLE;
                get_cid_msg.payload_size = 0;
                vm_context_id = vmci_send_datagram(&get_cid_msg);
        }
        return vm_context_id;
}

static unsigned int vmci_read_reg(struct vmci_guest_device *dev, u32 reg)
{
        if (dev->mmio_base != NULL)
                return readl(dev->mmio_base + reg);
        return ioread32(dev->iobase + reg);
}

static void vmci_write_reg(struct vmci_guest_device *dev, u32 val, u32 reg)
{
        if (dev->mmio_base != NULL)
                writel(val, dev->mmio_base + reg);
        else
                iowrite32(val, dev->iobase + reg);
}

static void vmci_read_data(struct vmci_guest_device *vmci_dev,
                           void *dest, size_t size)
{
        if (vmci_dev->mmio_base == NULL)
                ioread8_rep(vmci_dev->iobase + VMCI_DATA_IN_ADDR,
                            dest, size);
        else {
                /*
                 * For DMA datagrams, the data_buffer will contain the header on the
                 * first page, followed by the incoming datagram(s) on the following
                 * pages. The header uses an S/G element immediately following the
                 * header on the first page to point to the data area.
                 */
                struct vmci_data_in_out_header *buffer_header = vmci_dev->data_buffer;
                struct vmci_sg_elem *sg_array = (struct vmci_sg_elem *)(buffer_header + 1);
                size_t buffer_offset = dest - vmci_dev->data_buffer;

                buffer_header->opcode = 1;
                buffer_header->size = 1;
                buffer_header->busy = 0;
                sg_array[0].addr = vmci_dev->data_buffer_base + buffer_offset;
                sg_array[0].size = size;

                vmci_write_reg(vmci_dev, lower_32_bits(vmci_dev->data_buffer_base),
                               VMCI_DATA_IN_LOW_ADDR);

                wait_event(vmci_dev->inout_wq, buffer_header->busy == 1);
        }
}

static int vmci_write_data(struct vmci_guest_device *dev,
                           struct vmci_datagram *dg)
{
        int result;

        if (dev->mmio_base != NULL) {
                struct vmci_data_in_out_header *buffer_header = dev->tx_buffer;
                u8 *dg_out_buffer = (u8 *)(buffer_header + 1);

                if (VMCI_DG_SIZE(dg) > VMCI_MAX_DG_SIZE)
                        return VMCI_ERROR_INVALID_ARGS;

                /*
                 * Initialize send buffer with outgoing datagram
                 * and set up header for inline data. Device will
                 * not access buffer asynchronously - only after
                 * the write to VMCI_DATA_OUT_LOW_ADDR.
                 */
                memcpy(dg_out_buffer, dg, VMCI_DG_SIZE(dg));
                buffer_header->opcode = 0;
                buffer_header->size = VMCI_DG_SIZE(dg);
                buffer_header->busy = 1;

                vmci_write_reg(dev, lower_32_bits(dev->tx_buffer_base),
                               VMCI_DATA_OUT_LOW_ADDR);

                /* Caller holds a spinlock, so cannot block. */
                spin_until_cond(buffer_header->busy == 0);

                result = vmci_read_reg(vmci_dev_g, VMCI_RESULT_LOW_ADDR);
                if (result == VMCI_SUCCESS)
                        result = (int)buffer_header->result;
        } else {
                iowrite8_rep(dev->iobase + VMCI_DATA_OUT_ADDR,
                             dg, VMCI_DG_SIZE(dg));
                result = vmci_read_reg(vmci_dev_g, VMCI_RESULT_LOW_ADDR);
        }

        return result;
}

/*
 * VM to hypervisor call mechanism. We use the standard VMware naming
 * convention since shared code is calling this function as well.
 */
int vmci_send_datagram(struct vmci_datagram *dg)
{
        unsigned long flags;
        int result;

        /* Check args. */
        if (dg == NULL)
                return VMCI_ERROR_INVALID_ARGS;

        /*
         * Need to acquire spinlock on the device because the datagram
         * data may be spread over multiple pages and the monitor may
         * interleave device user rpc calls from multiple
         * VCPUs. Acquiring the spinlock precludes that
         * possibility. Disabling interrupts to avoid incoming
         * datagrams during a "rep out" and possibly landing up in
         * this function.
         */
        spin_lock_irqsave(&vmci_dev_spinlock, flags);

        if (vmci_dev_g) {
                vmci_write_data(vmci_dev_g, dg);
                result = vmci_read_reg(vmci_dev_g, VMCI_RESULT_LOW_ADDR);
        } else {
                result = VMCI_ERROR_UNAVAILABLE;
        }

        spin_unlock_irqrestore(&vmci_dev_spinlock, flags);

        return result;
}
EXPORT_SYMBOL_GPL(vmci_send_datagram);

/*
 * Gets called with the new context id if updated or resumed.
 * Context id.
 */
static void vmci_guest_cid_update(u32 sub_id,
                                  const struct vmci_event_data *event_data,
                                  void *client_data)
{
        const struct vmci_event_payld_ctx *ev_payload =
                                vmci_event_data_const_payload(event_data);

        if (sub_id != ctx_update_sub_id) {
                pr_devel("Invalid subscriber (ID=0x%x)\n", sub_id);
                return;
        }

        if (!event_data || ev_payload->context_id == VMCI_INVALID_ID) {
                pr_devel("Invalid event data\n");
                return;
        }

        pr_devel("Updating context from (ID=0x%x) to (ID=0x%x) on event (type=%d)\n",
                 vm_context_id, ev_payload->context_id, event_data->event);

        vm_context_id = ev_payload->context_id;
}

/*
 * Verify that the host supports the hypercalls we need. If it does not,
 * try to find fallback hypercalls and use those instead.  Returns 0 if
 * required hypercalls (or fallback hypercalls) are supported by the host,
 * an error code otherwise.
 */
static int vmci_check_host_caps(struct pci_dev *pdev)
{
        bool result;
        struct vmci_resource_query_msg *msg;
        u32 msg_size = sizeof(struct vmci_resource_query_hdr) +
                                VMCI_UTIL_NUM_RESOURCES * sizeof(u32);
        struct vmci_datagram *check_msg;

        check_msg = kzalloc(msg_size, GFP_KERNEL);
        if (!check_msg) {
                dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__);
                return -ENOMEM;
        }

        check_msg->dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
                                          VMCI_RESOURCES_QUERY);
        check_msg->src = VMCI_ANON_SRC_HANDLE;
        check_msg->payload_size = msg_size - VMCI_DG_HEADERSIZE;
        msg = (struct vmci_resource_query_msg *)VMCI_DG_PAYLOAD(check_msg);

        msg->num_resources = VMCI_UTIL_NUM_RESOURCES;
        msg->resources[0] = VMCI_GET_CONTEXT_ID;

        /* Checks that hyper calls are supported */
        result = vmci_send_datagram(check_msg) == 0x01;
        kfree(check_msg);

        dev_dbg(&pdev->dev, "%s: Host capability check: %s\n",
                __func__, result ? "PASSED" : "FAILED");

        /* We need the vector. There are no fallbacks. */
        return result ? 0 : -ENXIO;
}

/*
 * Reads datagrams from the device and dispatches them. For IO port
 * based access to the device, we always start reading datagrams into
 * only the first page of the datagram buffer. If the datagrams don't
 * fit into one page, we use the maximum datagram buffer size for the
 * remainder of the invocation. This is a simple heuristic for not
 * penalizing small datagrams. For DMA-based datagrams, we always
 * use the maximum datagram buffer size, since there is no performance
 * penalty for doing so.
 *
 * This function assumes that it has exclusive access to the data
 * in register(s) for the duration of the call.
 */
static void vmci_dispatch_dgs(struct vmci_guest_device *vmci_dev)
{
        u8 *dg_in_buffer = vmci_dev->data_buffer;
        struct vmci_datagram *dg;
        size_t dg_in_buffer_size = VMCI_MAX_DG_SIZE;
        size_t current_dg_in_buffer_size;
        size_t remaining_bytes;
        bool is_io_port = vmci_dev->mmio_base == NULL;

        BUILD_BUG_ON(VMCI_MAX_DG_SIZE < PAGE_SIZE);

        if (!is_io_port) {
                /* For mmio, the first page is used for the header. */
                dg_in_buffer += PAGE_SIZE;

                /*
                 * For DMA-based datagram operations, there is no performance
                 * penalty for reading the maximum buffer size.
                 */
                current_dg_in_buffer_size = VMCI_MAX_DG_SIZE;
        } else {
                current_dg_in_buffer_size = PAGE_SIZE;
        }
        vmci_read_data(vmci_dev, dg_in_buffer, current_dg_in_buffer_size);
        dg = (struct vmci_datagram *)dg_in_buffer;
        remaining_bytes = current_dg_in_buffer_size;

        /*
         * Read through the buffer until an invalid datagram header is
         * encountered. The exit condition for datagrams read through
         * VMCI_DATA_IN_ADDR is a bit more complicated, since a datagram
         * can start on any page boundary in the buffer.
         */
        while (dg->dst.resource != VMCI_INVALID_ID ||
               (is_io_port && remaining_bytes > PAGE_SIZE)) {
                unsigned dg_in_size;

                /*
                 * If using VMCI_DATA_IN_ADDR, skip to the next page
                 * as a datagram can start on any page boundary.
                 */
                if (dg->dst.resource == VMCI_INVALID_ID) {
                        dg = (struct vmci_datagram *)roundup(
                                (uintptr_t)dg + 1, PAGE_SIZE);
                        remaining_bytes =
                                (size_t)(dg_in_buffer +
                                         current_dg_in_buffer_size -
                                         (u8 *)dg);
                        continue;
                }

                dg_in_size = VMCI_DG_SIZE_ALIGNED(dg);

                if (dg_in_size <= dg_in_buffer_size) {
                        int result;

                        /*
                         * If the remaining bytes in the datagram
                         * buffer doesn't contain the complete
                         * datagram, we first make sure we have enough
                         * room for it and then we read the reminder
                         * of the datagram and possibly any following
                         * datagrams.
                         */
                        if (dg_in_size > remaining_bytes) {
                                if (remaining_bytes !=
                                    current_dg_in_buffer_size) {

                                        /*
                                         * We move the partial
                                         * datagram to the front and
                                         * read the reminder of the
                                         * datagram and possibly
                                         * following calls into the
                                         * following bytes.
                                         */
                                        memmove(dg_in_buffer, dg_in_buffer +
                                                current_dg_in_buffer_size -
                                                remaining_bytes,
                                                remaining_bytes);
                                        dg = (struct vmci_datagram *)
                                            dg_in_buffer;
                                }

                                if (current_dg_in_buffer_size !=
                                    dg_in_buffer_size)
                                        current_dg_in_buffer_size =
                                            dg_in_buffer_size;

                                vmci_read_data(vmci_dev,
                                               dg_in_buffer +
                                                remaining_bytes,
                                               current_dg_in_buffer_size -
                                                remaining_bytes);
                        }

                        /*
                         * We special case event datagrams from the
                         * hypervisor.
                         */
                        if (dg->src.context == VMCI_HYPERVISOR_CONTEXT_ID &&
                            dg->dst.resource == VMCI_EVENT_HANDLER) {
                                result = vmci_event_dispatch(dg);
                        } else {
                                result = vmci_datagram_invoke_guest_handler(dg);
                        }
                        if (result < VMCI_SUCCESS)
                                dev_dbg(vmci_dev->dev,
                                        "Datagram with resource (ID=0x%x) failed (err=%d)\n",
                                         dg->dst.resource, result);

                        /* On to the next datagram. */
                        dg = (struct vmci_datagram *)((u8 *)dg +
                                                      dg_in_size);
                } else {
                        size_t bytes_to_skip;

                        /*
                         * Datagram doesn't fit in datagram buffer of maximal
                         * size. We drop it.
                         */
                        dev_dbg(vmci_dev->dev,
                                "Failed to receive datagram (size=%u bytes)\n",
                                 dg_in_size);

                        bytes_to_skip = dg_in_size - remaining_bytes;
                        if (current_dg_in_buffer_size != dg_in_buffer_size)
                                current_dg_in_buffer_size = dg_in_buffer_size;

                        for (;;) {
                                vmci_read_data(vmci_dev, dg_in_buffer,
                                               current_dg_in_buffer_size);
                                if (bytes_to_skip <= current_dg_in_buffer_size)
                                        break;

                                bytes_to_skip -= current_dg_in_buffer_size;
                        }
                        dg = (struct vmci_datagram *)(dg_in_buffer +
                                                      bytes_to_skip);
                }

                remaining_bytes =
                    (size_t) (dg_in_buffer + current_dg_in_buffer_size -
                              (u8 *)dg);

                if (remaining_bytes < VMCI_DG_HEADERSIZE) {
                        /* Get the next batch of datagrams. */

                        vmci_read_data(vmci_dev, dg_in_buffer,
                                    current_dg_in_buffer_size);
                        dg = (struct vmci_datagram *)dg_in_buffer;
                        remaining_bytes = current_dg_in_buffer_size;
                }
        }
}

/*
 * Scans the notification bitmap for raised flags, clears them
 * and handles the notifications.
 */
static void vmci_process_bitmap(struct vmci_guest_device *dev)
{
        if (!dev->notification_bitmap) {
                dev_dbg(dev->dev, "No bitmap present in %s\n", __func__);
                return;
        }

        vmci_dbell_scan_notification_entries(dev->notification_bitmap);
}

/*
 * Interrupt handler for legacy or MSI interrupt, or for first MSI-X
 * interrupt (vector VMCI_INTR_DATAGRAM).
 */
static irqreturn_t vmci_interrupt(int irq, void *_dev)
{
        struct vmci_guest_device *dev = _dev;

        /*
         * If we are using MSI-X with exclusive vectors then we simply call
         * vmci_dispatch_dgs(), since we know the interrupt was meant for us.
         * Otherwise we must read the ICR to determine what to do.
         */

        if (dev->exclusive_vectors) {
                vmci_dispatch_dgs(dev);
        } else {
                unsigned int icr;

                /* Acknowledge interrupt and determine what needs doing. */
                icr = vmci_read_reg(dev, VMCI_ICR_ADDR);
                if (icr == 0 || icr == ~0)
                        return IRQ_NONE;

                if (icr & VMCI_ICR_DATAGRAM) {
                        vmci_dispatch_dgs(dev);
                        icr &= ~VMCI_ICR_DATAGRAM;
                }

                if (icr & VMCI_ICR_NOTIFICATION) {
                        vmci_process_bitmap(dev);
                        icr &= ~VMCI_ICR_NOTIFICATION;
                }


                if (icr & VMCI_ICR_DMA_DATAGRAM) {
                        wake_up_all(&dev->inout_wq);
                        icr &= ~VMCI_ICR_DMA_DATAGRAM;
                }

                if (icr != 0)
                        dev_warn(dev->dev,
                                 "Ignoring unknown interrupt cause (%d)\n",
                                 icr);
        }

        return IRQ_HANDLED;
}

/*
 * Interrupt handler for MSI-X interrupt vector VMCI_INTR_NOTIFICATION,
 * which is for the notification bitmap.  Will only get called if we are
 * using MSI-X with exclusive vectors.
 */
static irqreturn_t vmci_interrupt_bm(int irq, void *_dev)
{
        struct vmci_guest_device *dev = _dev;

        /* For MSI-X we can just assume it was meant for us. */
        vmci_process_bitmap(dev);

        return IRQ_HANDLED;
}

/*
 * Interrupt handler for MSI-X interrupt vector VMCI_INTR_DMA_DATAGRAM,
 * which is for the completion of a DMA datagram send or receive operation.
 * Will only get called if we are using MSI-X with exclusive vectors.
 */
static irqreturn_t vmci_interrupt_dma_datagram(int irq, void *_dev)
{
        struct vmci_guest_device *dev = _dev;

        wake_up_all(&dev->inout_wq);

        return IRQ_HANDLED;
}

static void vmci_free_dg_buffers(struct vmci_guest_device *vmci_dev)
{
        if (vmci_dev->mmio_base != NULL) {
                if (vmci_dev->tx_buffer != NULL)
                        dma_free_coherent(vmci_dev->dev,
                                          VMCI_DMA_DG_BUFFER_SIZE,
                                          vmci_dev->tx_buffer,
                                          vmci_dev->tx_buffer_base);
                if (vmci_dev->data_buffer != NULL)
                        dma_free_coherent(vmci_dev->dev,
                                          VMCI_DMA_DG_BUFFER_SIZE,
                                          vmci_dev->data_buffer,
                                          vmci_dev->data_buffer_base);
        } else {
                vfree(vmci_dev->data_buffer);
        }
}

/*
 * Most of the initialization at module load time is done here.
 */
static int vmci_guest_probe_device(struct pci_dev *pdev,
                                   const struct pci_device_id *id)
{
        struct vmci_guest_device *vmci_dev;
        void __iomem *iobase = NULL;
        void __iomem *mmio_base = NULL;
        unsigned int num_irq_vectors;
        unsigned int capabilities;
        unsigned int caps_in_use;
        unsigned long cmd;
        int vmci_err;
        int error;

        dev_dbg(&pdev->dev, "Probing for vmci/PCI guest device\n");

        error = pcim_enable_device(pdev);
        if (error) {
                dev_err(&pdev->dev,
                        "Failed to enable VMCI device: %d\n", error);
                return error;
        }

        /*
         * The VMCI device with mmio access to registers requests 256KB
         * for BAR1. If present, driver will use new VMCI device
         * functionality for register access and datagram send/recv.
         */

        if (pci_resource_len(pdev, 1) == VMCI_WITH_MMIO_ACCESS_BAR_SIZE) {
                dev_info(&pdev->dev, "MMIO register access is available\n");
                mmio_base = pci_iomap_range(pdev, 1, VMCI_MMIO_ACCESS_OFFSET,
                                            VMCI_MMIO_ACCESS_SIZE);
                /* If the map fails, we fall back to IOIO access. */
                if (!mmio_base)
                        dev_warn(&pdev->dev, "Failed to map MMIO register access\n");
        }

        if (!mmio_base) {
                if (IS_ENABLED(CONFIG_ARM64)) {
                        dev_err(&pdev->dev, "MMIO base is invalid\n");
                        return -ENXIO;
                }
                error = pcim_iomap_regions(pdev, BIT(0), KBUILD_MODNAME);
                if (error) {
                        dev_err(&pdev->dev, "Failed to reserve/map IO regions\n");
                        return error;
                }
                iobase = pcim_iomap_table(pdev)[0];
        }

        vmci_dev = devm_kzalloc(&pdev->dev, sizeof(*vmci_dev), GFP_KERNEL);
        if (!vmci_dev) {
                dev_err(&pdev->dev,
                        "Can't allocate memory for VMCI device\n");
                error = -ENOMEM;
                goto err_unmap_mmio_base;
        }

        vmci_dev->dev = &pdev->dev;
        vmci_dev->exclusive_vectors = false;
        vmci_dev->iobase = iobase;
        vmci_dev->mmio_base = mmio_base;

        init_waitqueue_head(&vmci_dev->inout_wq);

        if (mmio_base != NULL) {
                vmci_dev->tx_buffer = dma_alloc_coherent(&pdev->dev, VMCI_DMA_DG_BUFFER_SIZE,
                                                         &vmci_dev->tx_buffer_base,
                                                         GFP_KERNEL);
                if (!vmci_dev->tx_buffer) {
                        dev_err(&pdev->dev,
                                "Can't allocate memory for datagram tx buffer\n");
                        error = -ENOMEM;
                        goto err_unmap_mmio_base;
                }

                vmci_dev->data_buffer = dma_alloc_coherent(&pdev->dev, VMCI_DMA_DG_BUFFER_SIZE,
                                                           &vmci_dev->data_buffer_base,
                                                           GFP_KERNEL);
        } else {
                vmci_dev->data_buffer = vmalloc(VMCI_MAX_DG_SIZE);
        }
        if (!vmci_dev->data_buffer) {
                dev_err(&pdev->dev,
                        "Can't allocate memory for datagram buffer\n");
                error = -ENOMEM;
                goto err_free_data_buffers;
        }

        pci_set_master(pdev);        /* To enable queue_pair functionality. */

        /*
         * Verify that the VMCI Device supports the capabilities that
         * we need. If the device is missing capabilities that we would
         * like to use, check for fallback capabilities and use those
         * instead (so we can run a new VM on old hosts). Fail the load if
         * a required capability is missing and there is no fallback.
         *
         * Right now, we need datagrams. There are no fallbacks.
         */
        capabilities = vmci_read_reg(vmci_dev, VMCI_CAPS_ADDR);
        if (!(capabilities & VMCI_CAPS_DATAGRAM)) {
                dev_err(&pdev->dev, "Device does not support datagrams\n");
                error = -ENXIO;
                goto err_free_data_buffers;
        }
        caps_in_use = VMCI_CAPS_DATAGRAM;

        /*
         * Use 64-bit PPNs if the device supports.
         *
         * There is no check for the return value of dma_set_mask_and_coherent
         * since this driver can handle the default mask values if
         * dma_set_mask_and_coherent fails.
         */
        if (capabilities & VMCI_CAPS_PPN64) {
                dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
                use_ppn64 = true;
                caps_in_use |= VMCI_CAPS_PPN64;
        } else {
                dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
                use_ppn64 = false;
        }

        /*
         * If the hardware supports notifications, we will use that as
         * well.
         */
        if (capabilities & VMCI_CAPS_NOTIFICATIONS) {
                vmci_dev->notification_bitmap = dma_alloc_coherent(
                        &pdev->dev, PAGE_SIZE, &vmci_dev->notification_base,
                        GFP_KERNEL);
                if (!vmci_dev->notification_bitmap)
                        dev_warn(&pdev->dev,
                                 "Unable to allocate notification bitmap\n");
                else
                        caps_in_use |= VMCI_CAPS_NOTIFICATIONS;
        }

        if (mmio_base != NULL) {
                if (capabilities & VMCI_CAPS_DMA_DATAGRAM) {
                        caps_in_use |= VMCI_CAPS_DMA_DATAGRAM;
                } else {
                        dev_err(&pdev->dev,
                                "Missing capability: VMCI_CAPS_DMA_DATAGRAM\n");
                        error = -ENXIO;
                        goto err_free_notification_bitmap;
                }
        }

        dev_info(&pdev->dev, "Using capabilities 0x%x\n", caps_in_use);

        /* Let the host know which capabilities we intend to use. */
        vmci_write_reg(vmci_dev, caps_in_use, VMCI_CAPS_ADDR);

        if (caps_in_use & VMCI_CAPS_DMA_DATAGRAM) {
                /* Let the device know the size for pages passed down. */
                vmci_write_reg(vmci_dev, PAGE_SHIFT, VMCI_GUEST_PAGE_SHIFT);

                /* Configure the high order parts of the data in/out buffers. */
                vmci_write_reg(vmci_dev, upper_32_bits(vmci_dev->data_buffer_base),
                               VMCI_DATA_IN_HIGH_ADDR);
                vmci_write_reg(vmci_dev, upper_32_bits(vmci_dev->tx_buffer_base),
                               VMCI_DATA_OUT_HIGH_ADDR);
        }

        /* Set up global device so that we can start sending datagrams */
        spin_lock_irq(&vmci_dev_spinlock);
        vmci_dev_g = vmci_dev;
        vmci_pdev = pdev;
        spin_unlock_irq(&vmci_dev_spinlock);

        /*
         * Register notification bitmap with device if that capability is
         * used.
         */
        if (caps_in_use & VMCI_CAPS_NOTIFICATIONS) {
                unsigned long bitmap_ppn =
                        vmci_dev->notification_base >> PAGE_SHIFT;
                if (!vmci_dbell_register_notification_bitmap(bitmap_ppn)) {
                        dev_warn(&pdev->dev,
                                 "VMCI device unable to register notification bitmap with PPN 0x%lx\n",
                                 bitmap_ppn);
                        error = -ENXIO;
                        goto err_remove_vmci_dev_g;
                }
        }

        /* Check host capabilities. */
        error = vmci_check_host_caps(pdev);
        if (error)
                goto err_remove_vmci_dev_g;

        /* Enable device. */

        /*
         * We subscribe to the VMCI_EVENT_CTX_ID_UPDATE here so we can
         * update the internal context id when needed.
         */
        vmci_err = vmci_event_subscribe(VMCI_EVENT_CTX_ID_UPDATE,
                                        vmci_guest_cid_update, NULL,
                                        &ctx_update_sub_id);
        if (vmci_err < VMCI_SUCCESS)
                dev_warn(&pdev->dev,
                         "Failed to subscribe to event (type=%d): %d\n",
                         VMCI_EVENT_CTX_ID_UPDATE, vmci_err);

        /*
         * Enable interrupts.  Try MSI-X first, then MSI, and then fallback on
         * legacy interrupts.
         */
        if (vmci_dev->mmio_base != NULL)
                num_irq_vectors = VMCI_MAX_INTRS;
        else
                num_irq_vectors = VMCI_MAX_INTRS_NOTIFICATION;
        error = pci_alloc_irq_vectors(pdev, num_irq_vectors, num_irq_vectors,
                                      PCI_IRQ_MSIX);
        if (error < 0) {
                error = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
                if (error < 0)
                        goto err_unsubscribe_event;
        } else {
                vmci_dev->exclusive_vectors = true;
        }

        /*
         * Request IRQ for legacy or MSI interrupts, or for first
         * MSI-X vector.
         */
        error = request_threaded_irq(pci_irq_vector(pdev, 0), NULL,
                                     vmci_interrupt, IRQF_SHARED,
                                     KBUILD_MODNAME, vmci_dev);
        if (error) {
                dev_err(&pdev->dev, "Irq %u in use: %d\n",
                        pci_irq_vector(pdev, 0), error);
                goto err_disable_msi;
        }

        /*
         * For MSI-X with exclusive vectors we need to request an
         * interrupt for each vector so that we get a separate
         * interrupt handler routine.  This allows us to distinguish
         * between the vectors.
         */
        if (vmci_dev->exclusive_vectors) {
                error = request_threaded_irq(pci_irq_vector(pdev, 1), NULL,
                                             vmci_interrupt_bm, 0,
                                             KBUILD_MODNAME, vmci_dev);
                if (error) {
                        dev_err(&pdev->dev,
                                "Failed to allocate irq %u: %d\n",
                                pci_irq_vector(pdev, 1), error);
                        goto err_free_irq;
                }
                if (caps_in_use & VMCI_CAPS_DMA_DATAGRAM) {
                        error = request_threaded_irq(pci_irq_vector(pdev, 2),
                                                     NULL,
                                                    vmci_interrupt_dma_datagram,
                                                     0, KBUILD_MODNAME,
                                                     vmci_dev);
                        if (error) {
                                dev_err(&pdev->dev,
                                        "Failed to allocate irq %u: %d\n",
                                        pci_irq_vector(pdev, 2), error);
                                goto err_free_bm_irq;
                        }
                }
        }

        dev_dbg(&pdev->dev, "Registered device\n");

        atomic_inc(&vmci_num_guest_devices);

        /* Enable specific interrupt bits. */
        cmd = VMCI_IMR_DATAGRAM;
        if (caps_in_use & VMCI_CAPS_NOTIFICATIONS)
                cmd |= VMCI_IMR_NOTIFICATION;
        if (caps_in_use & VMCI_CAPS_DMA_DATAGRAM)
                cmd |= VMCI_IMR_DMA_DATAGRAM;
        vmci_write_reg(vmci_dev, cmd, VMCI_IMR_ADDR);

        /* Enable interrupts. */
        vmci_write_reg(vmci_dev, VMCI_CONTROL_INT_ENABLE, VMCI_CONTROL_ADDR);

        pci_set_drvdata(pdev, vmci_dev);

        vmci_call_vsock_callback(false);
        return 0;

err_free_bm_irq:
        if (vmci_dev->exclusive_vectors)
                free_irq(pci_irq_vector(pdev, 1), vmci_dev);

err_free_irq:
        free_irq(pci_irq_vector(pdev, 0), vmci_dev);

err_disable_msi:
        pci_free_irq_vectors(pdev);

err_unsubscribe_event:
        vmci_err = vmci_event_unsubscribe(ctx_update_sub_id);
        if (vmci_err < VMCI_SUCCESS)
                dev_warn(&pdev->dev,
                         "Failed to unsubscribe from event (type=%d) with subscriber (ID=0x%x): %d\n",
                         VMCI_EVENT_CTX_ID_UPDATE, ctx_update_sub_id, vmci_err);

err_remove_vmci_dev_g:
        spin_lock_irq(&vmci_dev_spinlock);
        vmci_pdev = NULL;
        vmci_dev_g = NULL;
        spin_unlock_irq(&vmci_dev_spinlock);

err_free_notification_bitmap:
        if (vmci_dev->notification_bitmap) {
                vmci_write_reg(vmci_dev, VMCI_CONTROL_RESET, VMCI_CONTROL_ADDR);
                dma_free_coherent(&pdev->dev, PAGE_SIZE,
                                  vmci_dev->notification_bitmap,
                                  vmci_dev->notification_base);
        }

err_free_data_buffers:
        vmci_free_dg_buffers(vmci_dev);

err_unmap_mmio_base:
        if (mmio_base != NULL)
                pci_iounmap(pdev, mmio_base);

        /* The rest are managed resources and will be freed by PCI core */
        return error;
}

static void vmci_guest_remove_device(struct pci_dev *pdev)
{
        struct vmci_guest_device *vmci_dev = pci_get_drvdata(pdev);
        int vmci_err;

        dev_dbg(&pdev->dev, "Removing device\n");

        atomic_dec(&vmci_num_guest_devices);

        vmci_qp_guest_endpoints_exit();

        vmci_err = vmci_event_unsubscribe(ctx_update_sub_id);
        if (vmci_err < VMCI_SUCCESS)
                dev_warn(&pdev->dev,
                         "Failed to unsubscribe from event (type=%d) with subscriber (ID=0x%x): %d\n",
                         VMCI_EVENT_CTX_ID_UPDATE, ctx_update_sub_id, vmci_err);

        spin_lock_irq(&vmci_dev_spinlock);
        vmci_dev_g = NULL;
        vmci_pdev = NULL;
        spin_unlock_irq(&vmci_dev_spinlock);

        dev_dbg(&pdev->dev, "Resetting vmci device\n");
        vmci_write_reg(vmci_dev, VMCI_CONTROL_RESET, VMCI_CONTROL_ADDR);

        /*
         * Free IRQ and then disable MSI/MSI-X as appropriate.  For
         * MSI-X, we might have multiple vectors, each with their own
         * IRQ, which we must free too.
         */
        if (vmci_dev->exclusive_vectors) {
                free_irq(pci_irq_vector(pdev, 1), vmci_dev);
                if (vmci_dev->mmio_base != NULL)
                        free_irq(pci_irq_vector(pdev, 2), vmci_dev);
        }
        free_irq(pci_irq_vector(pdev, 0), vmci_dev);
        pci_free_irq_vectors(pdev);

        if (vmci_dev->notification_bitmap) {
                /*
                 * The device reset above cleared the bitmap state of the
                 * device, so we can safely free it here.
                 */

                dma_free_coherent(&pdev->dev, PAGE_SIZE,
                                  vmci_dev->notification_bitmap,
                                  vmci_dev->notification_base);
        }

        vmci_free_dg_buffers(vmci_dev);

        if (vmci_dev->mmio_base != NULL)
                pci_iounmap(pdev, vmci_dev->mmio_base);

        /* The rest are managed resources and will be freed by PCI core */
}

static const struct pci_device_id vmci_ids[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_VMWARE, PCI_DEVICE_ID_VMWARE_VMCI), },
        { 0 },
};
MODULE_DEVICE_TABLE(pci, vmci_ids);

static struct pci_driver vmci_guest_driver = {
        .name                = KBUILD_MODNAME,
        .id_table        = vmci_ids,
        .probe                = vmci_guest_probe_device,
        .remove                = vmci_guest_remove_device,
};

int __init vmci_guest_init(void)
{
        return pci_register_driver(&vmci_guest_driver);
}

void __exit vmci_guest_exit(void)
{
        pci_unregister_driver(&vmci_guest_driver);
}













































    3 























































    3 





























    3 

























































































    3 







































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
/* SPDX-License-Identifier: GPL-2.0 */
#undef TRACE_SYSTEM
#define TRACE_SYSTEM compaction

#if !defined(_TRACE_COMPACTION_H) || defined(TRACE_HEADER_MULTI_READ)
#define _TRACE_COMPACTION_H

#include <linux/types.h>
#include <linux/list.h>
#include <linux/tracepoint.h>
#include <trace/events/mmflags.h>


DECLARE_EVENT_CLASS(mm_compaction_isolate_template,

        TP_PROTO(
                unsigned long start_pfn,
                unsigned long end_pfn,
                unsigned long nr_scanned,
                unsigned long nr_taken),

        TP_ARGS(start_pfn, end_pfn, nr_scanned, nr_taken),

        TP_STRUCT__entry(
                __field(unsigned long, start_pfn)
                __field(unsigned long, end_pfn)
                __field(unsigned long, nr_scanned)
                __field(unsigned long, nr_taken)
        ),

        TP_fast_assign(
                __entry->start_pfn = start_pfn;
                __entry->end_pfn = end_pfn;
                __entry->nr_scanned = nr_scanned;
                __entry->nr_taken = nr_taken;
        ),

        TP_printk("range=(0x%lx ~ 0x%lx) nr_scanned=%lu nr_taken=%lu",
                __entry->start_pfn,
                __entry->end_pfn,
                __entry->nr_scanned,
                __entry->nr_taken)
);

DEFINE_EVENT(mm_compaction_isolate_template, mm_compaction_isolate_migratepages,

        TP_PROTO(
                unsigned long start_pfn,
                unsigned long end_pfn,
                unsigned long nr_scanned,
                unsigned long nr_taken),

        TP_ARGS(start_pfn, end_pfn, nr_scanned, nr_taken)
);

DEFINE_EVENT(mm_compaction_isolate_template, mm_compaction_isolate_freepages,

        TP_PROTO(
                unsigned long start_pfn,
                unsigned long end_pfn,
                unsigned long nr_scanned,
                unsigned long nr_taken),

        TP_ARGS(start_pfn, end_pfn, nr_scanned, nr_taken)
);

DEFINE_EVENT(mm_compaction_isolate_template, mm_compaction_fast_isolate_freepages,

        TP_PROTO(
                unsigned long start_pfn,
                unsigned long end_pfn,
                unsigned long nr_scanned,
                unsigned long nr_taken),

        TP_ARGS(start_pfn, end_pfn, nr_scanned, nr_taken)
);

#ifdef CONFIG_COMPACTION
TRACE_EVENT(mm_compaction_migratepages,

        TP_PROTO(unsigned int nr_migratepages,
                unsigned int nr_succeeded),

        TP_ARGS(nr_migratepages, nr_succeeded),

        TP_STRUCT__entry(
                __field(unsigned long, nr_migrated)
                __field(unsigned long, nr_failed)
        ),

        TP_fast_assign(
                __entry->nr_migrated = nr_succeeded;
                __entry->nr_failed = nr_migratepages - nr_succeeded;
        ),

        TP_printk("nr_migrated=%lu nr_failed=%lu",
                __entry->nr_migrated,
                __entry->nr_failed)
);

TRACE_EVENT(mm_compaction_begin,
        TP_PROTO(struct compact_control *cc, unsigned long zone_start,
                unsigned long zone_end, bool sync),

        TP_ARGS(cc, zone_start, zone_end, sync),

        TP_STRUCT__entry(
                __field(unsigned long, zone_start)
                __field(unsigned long, migrate_pfn)
                __field(unsigned long, free_pfn)
                __field(unsigned long, zone_end)
                __field(bool, sync)
        ),

        TP_fast_assign(
                __entry->zone_start = zone_start;
                __entry->migrate_pfn = cc->migrate_pfn;
                __entry->free_pfn = cc->free_pfn;
                __entry->zone_end = zone_end;
                __entry->sync = sync;
        ),

        TP_printk("zone_start=0x%lx migrate_pfn=0x%lx free_pfn=0x%lx zone_end=0x%lx, mode=%s",
                __entry->zone_start,
                __entry->migrate_pfn,
                __entry->free_pfn,
                __entry->zone_end,
                __entry->sync ? "sync" : "async")
);

TRACE_EVENT(mm_compaction_end,
        TP_PROTO(struct compact_control *cc, unsigned long zone_start,
                unsigned long zone_end, bool sync,
                int status),

        TP_ARGS(cc, zone_start, zone_end, sync, status),

        TP_STRUCT__entry(
                __field(unsigned long, zone_start)
                __field(unsigned long, migrate_pfn)
                __field(unsigned long, free_pfn)
                __field(unsigned long, zone_end)
                __field(bool, sync)
                __field(int, status)
        ),

        TP_fast_assign(
                __entry->zone_start = zone_start;
                __entry->migrate_pfn = cc->migrate_pfn;
                __entry->free_pfn = cc->free_pfn;
                __entry->zone_end = zone_end;
                __entry->sync = sync;
                __entry->status = status;
        ),

        TP_printk("zone_start=0x%lx migrate_pfn=0x%lx free_pfn=0x%lx zone_end=0x%lx, mode=%s status=%s",
                __entry->zone_start,
                __entry->migrate_pfn,
                __entry->free_pfn,
                __entry->zone_end,
                __entry->sync ? "sync" : "async",
                __print_symbolic(__entry->status, COMPACTION_STATUS))
);

TRACE_EVENT(mm_compaction_try_to_compact_pages,

        TP_PROTO(
                int order,
                gfp_t gfp_mask,
                int prio),

        TP_ARGS(order, gfp_mask, prio),

        TP_STRUCT__entry(
                __field(int, order)
                __field(unsigned long, gfp_mask)
                __field(int, prio)
        ),

        TP_fast_assign(
                __entry->order = order;
                __entry->gfp_mask = (__force unsigned long)gfp_mask;
                __entry->prio = prio;
        ),

        TP_printk("order=%d gfp_mask=%s priority=%d",
                __entry->order,
                show_gfp_flags(__entry->gfp_mask),
                __entry->prio)
);

DECLARE_EVENT_CLASS(mm_compaction_suitable_template,

        TP_PROTO(struct zone *zone,
                int order,
                int ret),

        TP_ARGS(zone, order, ret),

        TP_STRUCT__entry(
                __field(int, nid)
                __field(enum zone_type, idx)
                __field(int, order)
                __field(int, ret)
        ),

        TP_fast_assign(
                __entry->nid = zone_to_nid(zone);
                __entry->idx = zone_idx(zone);
                __entry->order = order;
                __entry->ret = ret;
        ),

        TP_printk("node=%d zone=%-8s order=%d ret=%s",
                __entry->nid,
                __print_symbolic(__entry->idx, ZONE_TYPE),
                __entry->order,
                __print_symbolic(__entry->ret, COMPACTION_STATUS))
);

DEFINE_EVENT(mm_compaction_suitable_template, mm_compaction_finished,

        TP_PROTO(struct zone *zone,
                int order,
                int ret),

        TP_ARGS(zone, order, ret)
);

DEFINE_EVENT(mm_compaction_suitable_template, mm_compaction_suitable,

        TP_PROTO(struct zone *zone,
                int order,
                int ret),

        TP_ARGS(zone, order, ret)
);

DECLARE_EVENT_CLASS(mm_compaction_defer_template,

        TP_PROTO(struct zone *zone, int order),

        TP_ARGS(zone, order),

        TP_STRUCT__entry(
                __field(int, nid)
                __field(enum zone_type, idx)
                __field(int, order)
                __field(unsigned int, considered)
                __field(unsigned int, defer_shift)
                __field(int, order_failed)
        ),

        TP_fast_assign(
                __entry->nid = zone_to_nid(zone);
                __entry->idx = zone_idx(zone);
                __entry->order = order;
                __entry->considered = zone->compact_considered;
                __entry->defer_shift = zone->compact_defer_shift;
                __entry->order_failed = zone->compact_order_failed;
        ),

        TP_printk("node=%d zone=%-8s order=%d order_failed=%d consider=%u limit=%lu",
                __entry->nid,
                __print_symbolic(__entry->idx, ZONE_TYPE),
                __entry->order,
                __entry->order_failed,
                __entry->considered,
                1UL << __entry->defer_shift)
);

DEFINE_EVENT(mm_compaction_defer_template, mm_compaction_deferred,

        TP_PROTO(struct zone *zone, int order),

        TP_ARGS(zone, order)
);

DEFINE_EVENT(mm_compaction_defer_template, mm_compaction_defer_compaction,

        TP_PROTO(struct zone *zone, int order),

        TP_ARGS(zone, order)
);

DEFINE_EVENT(mm_compaction_defer_template, mm_compaction_defer_reset,

        TP_PROTO(struct zone *zone, int order),

        TP_ARGS(zone, order)
);

TRACE_EVENT(mm_compaction_kcompactd_sleep,

        TP_PROTO(int nid),

        TP_ARGS(nid),

        TP_STRUCT__entry(
                __field(int, nid)
        ),

        TP_fast_assign(
                __entry->nid = nid;
        ),

        TP_printk("nid=%d", __entry->nid)
);

DECLARE_EVENT_CLASS(kcompactd_wake_template,

        TP_PROTO(int nid, int order, enum zone_type highest_zoneidx),

        TP_ARGS(nid, order, highest_zoneidx),

        TP_STRUCT__entry(
                __field(int, nid)
                __field(int, order)
                __field(enum zone_type, highest_zoneidx)
        ),

        TP_fast_assign(
                __entry->nid = nid;
                __entry->order = order;
                __entry->highest_zoneidx = highest_zoneidx;
        ),

        /*
         * classzone_idx is previous name of the highest_zoneidx.
         * Reason not to change it is the ABI requirement of the tracepoint.
         */
        TP_printk("nid=%d order=%d classzone_idx=%-8s",
                __entry->nid,
                __entry->order,
                __print_symbolic(__entry->highest_zoneidx, ZONE_TYPE))
);

DEFINE_EVENT(kcompactd_wake_template, mm_compaction_wakeup_kcompactd,

        TP_PROTO(int nid, int order, enum zone_type highest_zoneidx),

        TP_ARGS(nid, order, highest_zoneidx)
);

DEFINE_EVENT(kcompactd_wake_template, mm_compaction_kcompactd_wake,

        TP_PROTO(int nid, int order, enum zone_type highest_zoneidx),

        TP_ARGS(nid, order, highest_zoneidx)
);
#endif

#endif /* _TRACE_COMPACTION_H */

/* This part must be outside protection */
#include <trace/define_trace.h>



























    3 











    8 
    1 



    3 































































































































































































































    4 






























































    1 





   19 



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * User-mode machine state access
 *
 * Copyright (C) 2007 Red Hat, Inc.  All rights reserved.
 *
 * Red Hat Author: Roland McGrath.
 */

#ifndef _LINUX_REGSET_H
#define _LINUX_REGSET_H        1

#include <linux/compiler.h>
#include <linux/types.h>
#include <linux/bug.h>
#include <linux/uaccess.h>
struct task_struct;
struct user_regset;

struct membuf {
        void *p;
        size_t left;
};

static inline int membuf_zero(struct membuf *s, size_t size)
{
        if (s->left) {
                if (size > s->left)
                        size = s->left;
                memset(s->p, 0, size);
                s->p += size;
                s->left -= size;
        }
        return s->left;
}

static inline int membuf_write(struct membuf *s, const void *v, size_t size)
{
        if (s->left) {
                if (size > s->left)
                        size = s->left;
                memcpy(s->p, v, size);
                s->p += size;
                s->left -= size;
        }
        return s->left;
}

static inline struct membuf membuf_at(const struct membuf *s, size_t offs)
{
        struct membuf n = *s;

        if (offs > n.left)
                offs = n.left;
        n.p += offs;
        n.left -= offs;

        return n;
}

/* current s->p must be aligned for v; v must be a scalar */
#define membuf_store(s, v)                                \
({                                                        \
        struct membuf *__s = (s);                        \
        if (__s->left) {                                \
                typeof(v) __v = (v);                        \
                size_t __size = sizeof(__v);                \
                if (unlikely(__size > __s->left)) {        \
                        __size = __s->left;                \
                        memcpy(__s->p, &__v, __size);        \
                } else {                                \
                        *(typeof(__v + 0) *)__s->p = __v;        \
                }                                        \
                __s->p += __size;                        \
                __s->left -= __size;                        \
        }                                                \
        __s->left;})

/**
 * user_regset_active_fn - type of @active function in &struct user_regset
 * @target:        thread being examined
 * @regset:        regset being examined
 *
 * Return -%ENODEV if not available on the hardware found.
 * Return %0 if no interesting state in this thread.
 * Return >%0 number of @size units of interesting state.
 * Any get call fetching state beyond that number will
 * see the default initialization state for this data,
 * so a caller that knows what the default state is need
 * not copy it all out.
 * This call is optional; the pointer is %NULL if there
 * is no inexpensive check to yield a value < @n.
 */
typedef int user_regset_active_fn(struct task_struct *target,
                                  const struct user_regset *regset);

typedef int user_regset_get2_fn(struct task_struct *target,
                               const struct user_regset *regset,
                               struct membuf to);

/**
 * user_regset_set_fn - type of @set function in &struct user_regset
 * @target:        thread being examined
 * @regset:        regset being examined
 * @pos:        offset into the regset data to access, in bytes
 * @count:        amount of data to copy, in bytes
 * @kbuf:        if not %NULL, a kernel-space pointer to copy from
 * @ubuf:        if @kbuf is %NULL, a user-space pointer to copy from
 *
 * Store register values.  Return %0 on success; -%EIO or -%ENODEV
 * are usual failure returns.  The @pos and @count values are in
 * bytes, but must be properly aligned.  If @kbuf is non-null, that
 * buffer is used and @ubuf is ignored.  If @kbuf is %NULL, then
 * ubuf gives a userland pointer to access directly, and an -%EFAULT
 * return value is possible.
 */
typedef int user_regset_set_fn(struct task_struct *target,
                               const struct user_regset *regset,
                               unsigned int pos, unsigned int count,
                               const void *kbuf, const void __user *ubuf);

/**
 * user_regset_writeback_fn - type of @writeback function in &struct user_regset
 * @target:        thread being examined
 * @regset:        regset being examined
 * @immediate:        zero if writeback at completion of next context switch is OK
 *
 * This call is optional; usually the pointer is %NULL.  When
 * provided, there is some user memory associated with this regset's
 * hardware, such as memory backing cached register data on register
 * window machines; the regset's data controls what user memory is
 * used (e.g. via the stack pointer value).
 *
 * Write register data back to user memory.  If the @immediate flag
 * is nonzero, it must be written to the user memory so uaccess or
 * access_process_vm() can see it when this call returns; if zero,
 * then it must be written back by the time the task completes a
 * context switch (as synchronized with wait_task_inactive()).
 * Return %0 on success or if there was nothing to do, -%EFAULT for
 * a memory problem (bad stack pointer or whatever), or -%EIO for a
 * hardware problem.
 */
typedef int user_regset_writeback_fn(struct task_struct *target,
                                     const struct user_regset *regset,
                                     int immediate);

/**
 * struct user_regset - accessible thread CPU state
 * @n:                        Number of slots (registers).
 * @size:                Size in bytes of a slot (register).
 * @align:                Required alignment, in bytes.
 * @bias:                Bias from natural indexing.
 * @core_note_type:        ELF note @n_type value used in core dumps.
 * @get:                Function to fetch values.
 * @set:                Function to store values.
 * @active:                Function to report if regset is active, or %NULL.
 * @writeback:                Function to write data back to user memory, or %NULL.
 *
 * This data structure describes a machine resource we call a register set.
 * This is part of the state of an individual thread, not necessarily
 * actual CPU registers per se.  A register set consists of a number of
 * similar slots, given by @n.  Each slot is @size bytes, and aligned to
 * @align bytes (which is at least @size).  For dynamically-sized
 * regsets, @n must contain the maximum possible number of slots for the
 * regset.
 *
 * For backward compatibility, the @get and @set methods must pad to, or
 * accept, @n * @size bytes, even if the current regset size is smaller.
 * The precise semantics of these operations depend on the regset being
 * accessed.
 *
 * The functions to which &struct user_regset members point must be
 * called only on the current thread or on a thread that is in
 * %TASK_STOPPED or %TASK_TRACED state, that we are guaranteed will not
 * be woken up and return to user mode, and that we have called
 * wait_task_inactive() on.  (The target thread always might wake up for
 * SIGKILL while these functions are working, in which case that
 * thread's user_regset state might be scrambled.)
 *
 * The @pos argument must be aligned according to @align; the @count
 * argument must be a multiple of @size.  These functions are not
 * responsible for checking for invalid arguments.
 *
 * When there is a natural value to use as an index, @bias gives the
 * difference between the natural index and the slot index for the
 * register set.  For example, x86 GDT segment descriptors form a regset;
 * the segment selector produces a natural index, but only a subset of
 * that index space is available as a regset (the TLS slots); subtracting
 * @bias from a segment selector index value computes the regset slot.
 *
 * If nonzero, @core_note_type gives the n_type field (NT_* value)
 * of the core file note in which this regset's data appears.
 * NT_PRSTATUS is a special case in that the regset data starts at
 * offsetof(struct elf_prstatus, pr_reg) into the note data; that is
 * part of the per-machine ELF formats userland knows about.  In
 * other cases, the core file note contains exactly the whole regset
 * (@n * @size) and nothing else.  The core file note is normally
 * omitted when there is an @active function and it returns zero.
 */
struct user_regset {
        user_regset_get2_fn                *regset_get;
        user_regset_set_fn                *set;
        user_regset_active_fn                *active;
        user_regset_writeback_fn        *writeback;
        unsigned int                        n;
        unsigned int                         size;
        unsigned int                         align;
        unsigned int                         bias;
        unsigned int                         core_note_type;
};

/**
 * struct user_regset_view - available regsets
 * @name:        Identifier, e.g. UTS_MACHINE string.
 * @regsets:        Array of @n regsets available in this view.
 * @n:                Number of elements in @regsets.
 * @e_machine:        ELF header @e_machine %EM_* value written in core dumps.
 * @e_flags:        ELF header @e_flags value written in core dumps.
 * @ei_osabi:        ELF header @e_ident[%EI_OSABI] value written in core dumps.
 *
 * A regset view is a collection of regsets (&struct user_regset,
 * above).  This describes all the state of a thread that can be seen
 * from a given architecture/ABI environment.  More than one view might
 * refer to the same &struct user_regset, or more than one regset
 * might refer to the same machine-specific state in the thread.  For
 * example, a 32-bit thread's state could be examined from the 32-bit
 * view or from the 64-bit view.  Either method reaches the same thread
 * register state, doing appropriate widening or truncation.
 */
struct user_regset_view {
        const char *name;
        const struct user_regset *regsets;
        unsigned int n;
        u32 e_flags;
        u16 e_machine;
        u8 ei_osabi;
};

/*
 * This is documented here rather than at the definition sites because its
 * implementation is machine-dependent but its interface is universal.
 */
/**
 * task_user_regset_view - Return the process's native regset view.
 * @tsk: a thread of the process in question
 *
 * Return the &struct user_regset_view that is native for the given process.
 * For example, what it would access when it called ptrace().
 * Throughout the life of the process, this only changes at exec.
 */
const struct user_regset_view *task_user_regset_view(struct task_struct *tsk);

static inline int user_regset_copyin(unsigned int *pos, unsigned int *count,
                                     const void **kbuf,
                                     const void __user **ubuf, void *data,
                                     const int start_pos, const int end_pos)
{
        if (*count == 0)
                return 0;
        BUG_ON(*pos < start_pos);
        if (end_pos < 0 || *pos < end_pos) {
                unsigned int copy = (end_pos < 0 ? *count
                                     : min(*count, end_pos - *pos));
                data += *pos - start_pos;
                if (*kbuf) {
                        memcpy(data, *kbuf, copy);
                        *kbuf += copy;
                } else if (__copy_from_user(data, *ubuf, copy))
                        return -EFAULT;
                else
                        *ubuf += copy;
                *pos += copy;
                *count -= copy;
        }
        return 0;
}

static inline void user_regset_copyin_ignore(unsigned int *pos,
                                             unsigned int *count,
                                             const void **kbuf,
                                             const void __user **ubuf,
                                             const int start_pos,
                                             const int end_pos)
{
        if (*count == 0)
                return;
        BUG_ON(*pos < start_pos);
        if (end_pos < 0 || *pos < end_pos) {
                unsigned int copy = (end_pos < 0 ? *count
                                     : min(*count, end_pos - *pos));
                if (*kbuf)
                        *kbuf += copy;
                else
                        *ubuf += copy;
                *pos += copy;
                *count -= copy;
        }
}

extern int regset_get(struct task_struct *target,
                      const struct user_regset *regset,
                      unsigned int size, void *data);

extern int regset_get_alloc(struct task_struct *target,
                            const struct user_regset *regset,
                            unsigned int size,
                            void **data);

extern int copy_regset_to_user(struct task_struct *target,
                               const struct user_regset_view *view,
                               unsigned int setno, unsigned int offset,
                               unsigned int size, void __user *data);

/**
 * copy_regset_from_user - store into thread's user_regset data from user memory
 * @target:        thread to be examined
 * @view:        &struct user_regset_view describing user thread machine state
 * @setno:        index in @view->regsets
 * @offset:        offset into the regset data, in bytes
 * @size:        amount of data to copy, in bytes
 * @data:        user-mode pointer to copy from
 */
static inline int copy_regset_from_user(struct task_struct *target,
                                        const struct user_regset_view *view,
                                        unsigned int setno,
                                        unsigned int offset, unsigned int size,
                                        const void __user *data)
{
        const struct user_regset *regset = &view->regsets[setno];

        if (!regset->set)
                return -EOPNOTSUPP;

        if (!access_ok(data, size))
                return -EFAULT;

        return regset->set(target, regset, offset, size, NULL, data);
}

#endif        /* <linux/regset.h> */



























   16 







  315 



















   30 


   15 



   26 

   10 

   30 
















   29 



   30 
   23 
   20 
























  737 

































 1334 
  737 







 1330 





































  737 
  315 










  700 
  701 





   55 
   55 





















































   33 








































  579 

































 1325 


 1014 
  579 






  578 


  272 






  582 



  581 



















 1334 




 1330 
 1329 
 1334 























 1152 












 1143 
 1152 














  214 











 1330 












 1327 








   14 







 1330 



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
#include <linux/gfp.h>
#include <linux/highmem.h>
#include <linux/kernel.h>
#include <linux/mmdebug.h>
#include <linux/mm_types.h>
#include <linux/mm_inline.h>
#include <linux/pagemap.h>
#include <linux/rcupdate.h>
#include <linux/smp.h>
#include <linux/swap.h>
#include <linux/rmap.h>

#include <asm/pgalloc.h>
#include <asm/tlb.h>

#ifndef CONFIG_MMU_GATHER_NO_GATHER

static bool tlb_next_batch(struct mmu_gather *tlb)
{
        struct mmu_gather_batch *batch;

        /* Limit batching if we have delayed rmaps pending */
        if (tlb->delayed_rmap && tlb->active != &tlb->local)
                return false;

        batch = tlb->active;
        if (batch->next) {
                tlb->active = batch->next;
                return true;
        }

        if (tlb->batch_count == MAX_GATHER_BATCH_COUNT)
                return false;

        batch = (void *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
        if (!batch)
                return false;

        tlb->batch_count++;
        batch->next = NULL;
        batch->nr   = 0;
        batch->max  = MAX_GATHER_BATCH;

        tlb->active->next = batch;
        tlb->active = batch;

        return true;
}

#ifdef CONFIG_SMP
static void tlb_flush_rmap_batch(struct mmu_gather_batch *batch, struct vm_area_struct *vma)
{
        struct encoded_page **pages = batch->encoded_pages;

        for (int i = 0; i < batch->nr; i++) {
                struct encoded_page *enc = pages[i];

                if (encoded_page_flags(enc) & ENCODED_PAGE_BIT_DELAY_RMAP) {
                        struct page *page = encoded_page_ptr(enc);
                        unsigned int nr_pages = 1;

                        if (unlikely(encoded_page_flags(enc) &
                                     ENCODED_PAGE_BIT_NR_PAGES_NEXT))
                                nr_pages = encoded_nr_pages(pages[++i]);

                        folio_remove_rmap_ptes(page_folio(page), page, nr_pages,
                                               vma);
                }
        }
}

/**
 * tlb_flush_rmaps - do pending rmap removals after we have flushed the TLB
 * @tlb: the current mmu_gather
 * @vma: The memory area from which the pages are being removed.
 *
 * Note that because of how tlb_next_batch() above works, we will
 * never start multiple new batches with pending delayed rmaps, so
 * we only need to walk through the current active batch and the
 * original local one.
 */
void tlb_flush_rmaps(struct mmu_gather *tlb, struct vm_area_struct *vma)
{
        if (!tlb->delayed_rmap)
                return;

        tlb_flush_rmap_batch(&tlb->local, vma);
        if (tlb->active != &tlb->local)
                tlb_flush_rmap_batch(tlb->active, vma);
        tlb->delayed_rmap = 0;
}
#endif

/*
 * We might end up freeing a lot of pages. Reschedule on a regular
 * basis to avoid soft lockups in configurations without full
 * preemption enabled. The magic number of 512 folios seems to work.
 */
#define MAX_NR_FOLIOS_PER_FREE                512

static void __tlb_batch_free_encoded_pages(struct mmu_gather_batch *batch)
{
        struct encoded_page **pages = batch->encoded_pages;
        unsigned int nr, nr_pages;

        while (batch->nr) {
                if (!page_poisoning_enabled_static() && !want_init_on_free()) {
                        nr = min(MAX_NR_FOLIOS_PER_FREE, batch->nr);

                        /*
                         * Make sure we cover page + nr_pages, and don't leave
                         * nr_pages behind when capping the number of entries.
                         */
                        if (unlikely(encoded_page_flags(pages[nr - 1]) &
                                     ENCODED_PAGE_BIT_NR_PAGES_NEXT))
                                nr++;
                } else {
                        /*
                         * With page poisoning and init_on_free, the time it
                         * takes to free memory grows proportionally with the
                         * actual memory size. Therefore, limit based on the
                         * actual memory size and not the number of involved
                         * folios.
                         */
                        for (nr = 0, nr_pages = 0;
                             nr < batch->nr && nr_pages < MAX_NR_FOLIOS_PER_FREE;
                             nr++) {
                                if (unlikely(encoded_page_flags(pages[nr]) &
                                             ENCODED_PAGE_BIT_NR_PAGES_NEXT))
                                        nr_pages += encoded_nr_pages(pages[++nr]);
                                else
                                        nr_pages++;
                        }
                }

                free_pages_and_swap_cache(pages, nr);
                pages += nr;
                batch->nr -= nr;

                cond_resched();
        }
}

static void tlb_batch_pages_flush(struct mmu_gather *tlb)
{
        struct mmu_gather_batch *batch;

        for (batch = &tlb->local; batch && batch->nr; batch = batch->next)
                __tlb_batch_free_encoded_pages(batch);
        tlb->active = &tlb->local;
}

static void tlb_batch_list_free(struct mmu_gather *tlb)
{
        struct mmu_gather_batch *batch, *next;

        for (batch = tlb->local.next; batch; batch = next) {
                next = batch->next;
                free_pages((unsigned long)batch, 0);
        }
        tlb->local.next = NULL;
}

static bool __tlb_remove_folio_pages_size(struct mmu_gather *tlb,
                struct page *page, unsigned int nr_pages, bool delay_rmap,
                int page_size)
{
        int flags = delay_rmap ? ENCODED_PAGE_BIT_DELAY_RMAP : 0;
        struct mmu_gather_batch *batch;

        VM_BUG_ON(!tlb->end);

#ifdef CONFIG_MMU_GATHER_PAGE_SIZE
        VM_WARN_ON(tlb->page_size != page_size);
        VM_WARN_ON_ONCE(nr_pages != 1 && page_size != PAGE_SIZE);
        VM_WARN_ON_ONCE(page_folio(page) != page_folio(page + nr_pages - 1));
#endif

        batch = tlb->active;
        /*
         * Add the page and check if we are full. If so
         * force a flush.
         */
        if (likely(nr_pages == 1)) {
                batch->encoded_pages[batch->nr++] = encode_page(page, flags);
        } else {
                flags |= ENCODED_PAGE_BIT_NR_PAGES_NEXT;
                batch->encoded_pages[batch->nr++] = encode_page(page, flags);
                batch->encoded_pages[batch->nr++] = encode_nr_pages(nr_pages);
        }
        /*
         * Make sure that we can always add another "page" + "nr_pages",
         * requiring two entries instead of only a single one.
         */
        if (batch->nr >= batch->max - 1) {
                if (!tlb_next_batch(tlb))
                        return true;
                batch = tlb->active;
        }
        VM_BUG_ON_PAGE(batch->nr > batch->max - 1, page);

        return false;
}

bool __tlb_remove_folio_pages(struct mmu_gather *tlb, struct page *page,
                unsigned int nr_pages, bool delay_rmap)
{
        return __tlb_remove_folio_pages_size(tlb, page, nr_pages, delay_rmap,
                                             PAGE_SIZE);
}

bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page,
                bool delay_rmap, int page_size)
{
        return __tlb_remove_folio_pages_size(tlb, page, 1, delay_rmap, page_size);
}

#endif /* MMU_GATHER_NO_GATHER */

#ifdef CONFIG_MMU_GATHER_TABLE_FREE

static void __tlb_remove_table_free(struct mmu_table_batch *batch)
{
        int i;

        for (i = 0; i < batch->nr; i++)
                __tlb_remove_table(batch->tables[i]);

        free_page((unsigned long)batch);
}

#ifdef CONFIG_MMU_GATHER_RCU_TABLE_FREE

/*
 * Semi RCU freeing of the page directories.
 *
 * This is needed by some architectures to implement software pagetable walkers.
 *
 * gup_fast() and other software pagetable walkers do a lockless page-table
 * walk and therefore needs some synchronization with the freeing of the page
 * directories. The chosen means to accomplish that is by disabling IRQs over
 * the walk.
 *
 * Architectures that use IPIs to flush TLBs will then automagically DTRT,
 * since we unlink the page, flush TLBs, free the page. Since the disabling of
 * IRQs delays the completion of the TLB flush we can never observe an already
 * freed page.
 *
 * Architectures that do not have this (PPC) need to delay the freeing by some
 * other means, this is that means.
 *
 * What we do is batch the freed directory pages (tables) and RCU free them.
 * We use the sched RCU variant, as that guarantees that IRQ/preempt disabling
 * holds off grace periods.
 *
 * However, in order to batch these pages we need to allocate storage, this
 * allocation is deep inside the MM code and can thus easily fail on memory
 * pressure. To guarantee progress we fall back to single table freeing, see
 * the implementation of tlb_remove_table_one().
 *
 */

static void tlb_remove_table_smp_sync(void *arg)
{
        /* Simply deliver the interrupt */
}

void tlb_remove_table_sync_one(void)
{
        /*
         * This isn't an RCU grace period and hence the page-tables cannot be
         * assumed to be actually RCU-freed.
         *
         * It is however sufficient for software page-table walkers that rely on
         * IRQ disabling.
         */
        smp_call_function(tlb_remove_table_smp_sync, NULL, 1);
}

static void tlb_remove_table_rcu(struct rcu_head *head)
{
        __tlb_remove_table_free(container_of(head, struct mmu_table_batch, rcu));
}

static void tlb_remove_table_free(struct mmu_table_batch *batch)
{
        call_rcu(&batch->rcu, tlb_remove_table_rcu);
}

#else /* !CONFIG_MMU_GATHER_RCU_TABLE_FREE */

static void tlb_remove_table_free(struct mmu_table_batch *batch)
{
        __tlb_remove_table_free(batch);
}

#endif /* CONFIG_MMU_GATHER_RCU_TABLE_FREE */

/*
 * If we want tlb_remove_table() to imply TLB invalidates.
 */
static inline void tlb_table_invalidate(struct mmu_gather *tlb)
{
        if (tlb_needs_table_invalidate()) {
                /*
                 * Invalidate page-table caches used by hardware walkers. Then
                 * we still need to RCU-sched wait while freeing the pages
                 * because software walkers can still be in-flight.
                 */
                tlb_flush_mmu_tlbonly(tlb);
        }
}

#ifdef CONFIG_PT_RECLAIM
static inline void __tlb_remove_table_one_rcu(struct rcu_head *head)
{
        struct ptdesc *ptdesc;

        ptdesc = container_of(head, struct ptdesc, pt_rcu_head);
        __tlb_remove_table(ptdesc);
}

static inline void __tlb_remove_table_one(void *table)
{
        struct ptdesc *ptdesc;

        ptdesc = table;
        call_rcu(&ptdesc->pt_rcu_head, __tlb_remove_table_one_rcu);
}
#else
static inline void __tlb_remove_table_one(void *table)
{
        tlb_remove_table_sync_one();
        __tlb_remove_table(table);
}
#endif /* CONFIG_PT_RECLAIM */

static void tlb_remove_table_one(void *table)
{
        __tlb_remove_table_one(table);
}

static void tlb_table_flush(struct mmu_gather *tlb)
{
        struct mmu_table_batch **batch = &tlb->batch;

        if (*batch) {
                tlb_table_invalidate(tlb);
                tlb_remove_table_free(*batch);
                *batch = NULL;
        }
}

void tlb_remove_table(struct mmu_gather *tlb, void *table)
{
        struct mmu_table_batch **batch = &tlb->batch;

        if (*batch == NULL) {
                *batch = (struct mmu_table_batch *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
                if (*batch == NULL) {
                        tlb_table_invalidate(tlb);
                        tlb_remove_table_one(table);
                        return;
                }
                (*batch)->nr = 0;
        }

        (*batch)->tables[(*batch)->nr++] = table;
        if ((*batch)->nr == MAX_TABLE_BATCH)
                tlb_table_flush(tlb);
}

static inline void tlb_table_init(struct mmu_gather *tlb)
{
        tlb->batch = NULL;
}

#else /* !CONFIG_MMU_GATHER_TABLE_FREE */

static inline void tlb_table_flush(struct mmu_gather *tlb) { }
static inline void tlb_table_init(struct mmu_gather *tlb) { }

#endif /* CONFIG_MMU_GATHER_TABLE_FREE */

static void tlb_flush_mmu_free(struct mmu_gather *tlb)
{
        tlb_table_flush(tlb);
#ifndef CONFIG_MMU_GATHER_NO_GATHER
        tlb_batch_pages_flush(tlb);
#endif
}

void tlb_flush_mmu(struct mmu_gather *tlb)
{
        tlb_flush_mmu_tlbonly(tlb);
        tlb_flush_mmu_free(tlb);
}

static void __tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
                             bool fullmm)
{
        tlb->mm = mm;
        tlb->fullmm = fullmm;

#ifndef CONFIG_MMU_GATHER_NO_GATHER
        tlb->need_flush_all = 0;
        tlb->local.next = NULL;
        tlb->local.nr   = 0;
        tlb->local.max  = ARRAY_SIZE(tlb->__pages);
        tlb->active     = &tlb->local;
        tlb->batch_count = 0;
#endif
        tlb->delayed_rmap = 0;

        tlb_table_init(tlb);
#ifdef CONFIG_MMU_GATHER_PAGE_SIZE
        tlb->page_size = 0;
#endif

        __tlb_reset_range(tlb);
        inc_tlb_flush_pending(tlb->mm);
}

/**
 * tlb_gather_mmu - initialize an mmu_gather structure for page-table tear-down
 * @tlb: the mmu_gather structure to initialize
 * @mm: the mm_struct of the target address space
 *
 * Called to initialize an (on-stack) mmu_gather structure for page-table
 * tear-down from @mm.
 */
void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm)
{
        __tlb_gather_mmu(tlb, mm, false);
}

/**
 * tlb_gather_mmu_fullmm - initialize an mmu_gather structure for page-table tear-down
 * @tlb: the mmu_gather structure to initialize
 * @mm: the mm_struct of the target address space
 *
 * In this case, @mm is without users and we're going to destroy the
 * full address space (exit/execve).
 *
 * Called to initialize an (on-stack) mmu_gather structure for page-table
 * tear-down from @mm.
 */
void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm)
{
        __tlb_gather_mmu(tlb, mm, true);
}

/**
 * tlb_finish_mmu - finish an mmu_gather structure
 * @tlb: the mmu_gather structure to finish
 *
 * Called at the end of the shootdown operation to free up any resources that
 * were required.
 */
void tlb_finish_mmu(struct mmu_gather *tlb)
{
        /*
         * If there are parallel threads are doing PTE changes on same range
         * under non-exclusive lock (e.g., mmap_lock read-side) but defer TLB
         * flush by batching, one thread may end up seeing inconsistent PTEs
         * and result in having stale TLB entries.  So flush TLB forcefully
         * if we detect parallel PTE batching threads.
         *
         * However, some syscalls, e.g. munmap(), may free page tables, this
         * needs force flush everything in the given range. Otherwise this
         * may result in having stale TLB entries for some architectures,
         * e.g. aarch64, that could specify flush what level TLB.
         */
        if (mm_tlb_flush_nested(tlb->mm)) {
                /*
                 * The aarch64 yields better performance with fullmm by
                 * avoiding multiple CPUs spamming TLBI messages at the
                 * same time.
                 *
                 * On x86 non-fullmm doesn't yield significant difference
                 * against fullmm.
                 */
                tlb->fullmm = 1;
                __tlb_reset_range(tlb);
                tlb->freed_tables = 1;
        }

        tlb_flush_mmu(tlb);

#ifndef CONFIG_MMU_GATHER_NO_GATHER
        tlb_batch_list_free(tlb);
#endif
        dec_tlb_flush_pending(tlb->mm);
}














































































































































































































    1 


    1 




    1 

















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
// SPDX-License-Identifier: GPL-2.0-only
/*
 * (C) 2001 Clemson University and The University of Chicago
 *
 * Changes by Acxiom Corporation to add proc file handler for pvfs2 client
 * parameters, Copyright Acxiom Corporation, 2005.
 *
 * See COPYING in top-level directory.
 */

#include "protocol.h"
#include "orangefs-kernel.h"
#include "orangefs-debugfs.h"
#include "orangefs-sysfs.h"

/* ORANGEFS_VERSION is a ./configure define */
#ifndef ORANGEFS_VERSION
#define ORANGEFS_VERSION "upstream"
#endif

/*
 * global variables declared here
 */

struct orangefs_stats orangefs_stats;

/* the size of the hash tables for ops in progress */
int hash_table_size = 509;

static ulong module_parm_debug_mask;
__u64 orangefs_gossip_debug_mask;
int op_timeout_secs = ORANGEFS_DEFAULT_OP_TIMEOUT_SECS;
int slot_timeout_secs = ORANGEFS_DEFAULT_SLOT_TIMEOUT_SECS;
int orangefs_cache_timeout_msecs = 500;
int orangefs_dcache_timeout_msecs = 50;
int orangefs_getattr_timeout_msecs = 50;

MODULE_LICENSE("GPL");
MODULE_AUTHOR("ORANGEFS Development Team");
MODULE_DESCRIPTION("The Linux Kernel VFS interface to ORANGEFS");
MODULE_PARM_DESC(module_parm_debug_mask, "debugging level (see orangefs-debug.h for values)");
MODULE_PARM_DESC(op_timeout_secs, "Operation timeout in seconds");
MODULE_PARM_DESC(slot_timeout_secs, "Slot timeout in seconds");
MODULE_PARM_DESC(hash_table_size,
                 "size of hash table for operations in progress");

static struct file_system_type orangefs_fs_type = {
        .name = "pvfs2",
        .mount = orangefs_mount,
        .kill_sb = orangefs_kill_sb,
        .owner = THIS_MODULE,
};

module_param(hash_table_size, int, 0);
module_param(module_parm_debug_mask, ulong, 0644);
module_param(op_timeout_secs, int, 0);
module_param(slot_timeout_secs, int, 0);

/*
 * Blocks non-priority requests from being queued for servicing.  This
 * could be used for protecting the request list data structure, but
 * for now it's only being used to stall the op addition to the request
 * list
 */
DEFINE_MUTEX(orangefs_request_mutex);

/* hash table for storing operations waiting for matching downcall */
struct list_head *orangefs_htable_ops_in_progress;
DEFINE_SPINLOCK(orangefs_htable_ops_in_progress_lock);

/* list for queueing upcall operations */
LIST_HEAD(orangefs_request_list);

/* used to protect the above orangefs_request_list */
DEFINE_SPINLOCK(orangefs_request_list_lock);

/* used for incoming request notification */
DECLARE_WAIT_QUEUE_HEAD(orangefs_request_list_waitq);

static int __init orangefs_init(void)
{
        int ret;
        __u32 i = 0;

        if (op_timeout_secs < 0)
                op_timeout_secs = 0;

        if (slot_timeout_secs < 0)
                slot_timeout_secs = 0;

        /* initialize global book keeping data structures */
        ret = op_cache_initialize();
        if (ret < 0)
                goto out;

        ret = orangefs_inode_cache_initialize();
        if (ret < 0)
                goto cleanup_op;

        orangefs_htable_ops_in_progress =
            kcalloc(hash_table_size, sizeof(struct list_head), GFP_KERNEL);
        if (!orangefs_htable_ops_in_progress) {
                ret = -ENOMEM;
                goto cleanup_inode;
        }

        /* initialize a doubly linked at each hash table index */
        for (i = 0; i < hash_table_size; i++)
                INIT_LIST_HEAD(&orangefs_htable_ops_in_progress[i]);

        ret = fsid_key_table_initialize();
        if (ret < 0)
                goto cleanup_progress_table;

        /*
         * Build the contents of /sys/kernel/debug/orangefs/debug-help
         * from the keywords in the kernel keyword/mask array.
         *
         * The keywords in the client keyword/mask array are
         * unknown at boot time.
         *
         * orangefs_prepare_debugfs_help_string will be used again
         * later to rebuild the debug-help-string after the client starts
         * and passes along the needed info. The argument signifies
         * which time orangefs_prepare_debugfs_help_string is being
         * called.
         */
        ret = orangefs_prepare_debugfs_help_string(1);
        if (ret)
                goto cleanup_key_table;

        orangefs_debugfs_init(module_parm_debug_mask);

        ret = orangefs_sysfs_init();
        if (ret)
                goto sysfs_init_failed;

        /* Initialize the orangefsdev subsystem. */
        ret = orangefs_dev_init();
        if (ret < 0) {
                gossip_err("%s: could not initialize device subsystem %d!\n",
                           __func__,
                           ret);
                goto cleanup_sysfs;
        }

        ret = register_filesystem(&orangefs_fs_type);
        if (ret == 0) {
                pr_info("%s: module version %s loaded\n",
                        __func__,
                        ORANGEFS_VERSION);
                goto out;
        }

        orangefs_dev_cleanup();

cleanup_sysfs:
        orangefs_sysfs_exit();

sysfs_init_failed:
        orangefs_debugfs_cleanup();

cleanup_key_table:
        fsid_key_table_finalize();

cleanup_progress_table:
        kfree(orangefs_htable_ops_in_progress);

cleanup_inode:
        orangefs_inode_cache_finalize();

cleanup_op:
        op_cache_finalize();

out:
        return ret;
}

static void __exit orangefs_exit(void)
{
        int i = 0;
        gossip_debug(GOSSIP_INIT_DEBUG, "orangefs: orangefs_exit called\n");

        unregister_filesystem(&orangefs_fs_type);
        orangefs_debugfs_cleanup();
        orangefs_sysfs_exit();
        fsid_key_table_finalize();
        orangefs_dev_cleanup();
        BUG_ON(!list_empty(&orangefs_request_list));
        for (i = 0; i < hash_table_size; i++)
                BUG_ON(!list_empty(&orangefs_htable_ops_in_progress[i]));

        orangefs_inode_cache_finalize();
        op_cache_finalize();

        kfree(orangefs_htable_ops_in_progress);

        pr_info("orangefs: module version %s unloaded\n", ORANGEFS_VERSION);
}

/*
 * What we do in this function is to walk the list of operations
 * that are in progress in the hash table and mark them as purged as well.
 */
void purge_inprogress_ops(void)
{
        int i;

        for (i = 0; i < hash_table_size; i++) {
                struct orangefs_kernel_op_s *op;
                struct orangefs_kernel_op_s *next;

                spin_lock(&orangefs_htable_ops_in_progress_lock);
                list_for_each_entry_safe(op,
                                         next,
                                         &orangefs_htable_ops_in_progress[i],
                                         list) {
                        set_op_state_purged(op);
                        gossip_debug(GOSSIP_DEV_DEBUG,
                                     "%s: op:%s: op_state:%d: process:%s:\n",
                                     __func__,
                                     get_opname_string(op),
                                     op->op_state,
                                     current->comm);
                }
                spin_unlock(&orangefs_htable_ops_in_progress_lock);
        }
}

module_init(orangefs_init);
module_exit(orangefs_exit);




























































  358 



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *        Network event notifiers
 *
 *        Authors:
 *      Tom Tucker             <tom@opengridcomputing.com>
 *      Steve Wise             <swise@opengridcomputing.com>
 *
 *        Fixes:
 */

#include <linux/rtnetlink.h>
#include <linux/notifier.h>
#include <linux/export.h>
#include <net/netevent.h>

static ATOMIC_NOTIFIER_HEAD(netevent_notif_chain);

/**
 *        register_netevent_notifier - register a netevent notifier block
 *        @nb: notifier
 *
 *        Register a notifier to be called when a netevent occurs.
 *        The notifier passed is linked into the kernel structures and must
 *        not be reused until it has been unregistered. A negative errno code
 *        is returned on a failure.
 */
int register_netevent_notifier(struct notifier_block *nb)
{
        return atomic_notifier_chain_register(&netevent_notif_chain, nb);
}
EXPORT_SYMBOL_GPL(register_netevent_notifier);

/**
 *        unregister_netevent_notifier - unregister a netevent notifier block
 *        @nb: notifier
 *
 *        Unregister a notifier previously registered by
 *        register_neigh_notifier(). The notifier is unlinked into the
 *        kernel structures and may then be reused. A negative errno code
 *        is returned on a failure.
 */

int unregister_netevent_notifier(struct notifier_block *nb)
{
        return atomic_notifier_chain_unregister(&netevent_notif_chain, nb);
}
EXPORT_SYMBOL_GPL(unregister_netevent_notifier);

/**
 *        call_netevent_notifiers - call all netevent notifier blocks
 *      @val: value passed unmodified to notifier function
 *      @v:   pointer passed unmodified to notifier function
 *
 *        Call all neighbour notifier blocks.  Parameters and return value
 *        are as for notifier_call_chain().
 */

int call_netevent_notifiers(unsigned long val, void *v)
{
        return atomic_notifier_call_chain(&netevent_notif_chain, val, v);
}
EXPORT_SYMBOL_GPL(call_netevent_notifiers);









































































































































































































































































































































  684 





























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 * linux/include/linux/jbd2.h
 *
 * Written by Stephen C. Tweedie <sct@redhat.com>
 *
 * Copyright 1998-2000 Red Hat, Inc --- All Rights Reserved
 *
 * Definitions for transaction data structures for the buffer cache
 * filesystem journaling support.
 */

#ifndef _LINUX_JBD2_H
#define _LINUX_JBD2_H

/* Allow this file to be included directly into e2fsprogs */
#ifndef __KERNEL__
#include "jfs_compat.h"
#define JBD2_DEBUG
#else

#include <linux/types.h>
#include <linux/buffer_head.h>
#include <linux/journal-head.h>
#include <linux/stddef.h>
#include <linux/mutex.h>
#include <linux/timer.h>
#include <linux/slab.h>
#include <linux/bit_spinlock.h>
#include <linux/blkdev.h>
#include <linux/crc32c.h>
#endif

#define journal_oom_retry 1

/*
 * Define JBD2_PARANIOD_IOFAIL to cause a kernel BUG() if ext4 finds
 * certain classes of error which can occur due to failed IOs.  Under
 * normal use we want ext4 to continue after such errors, because
 * hardware _can_ fail, but for debugging purposes when running tests on
 * known-good hardware we may want to trap these errors.
 */
#undef JBD2_PARANOID_IOFAIL

/*
 * The default maximum commit age, in seconds.
 */
#define JBD2_DEFAULT_MAX_COMMIT_AGE 5

#ifdef CONFIG_JBD2_DEBUG
/*
 * Define JBD2_EXPENSIVE_CHECKING to enable more expensive internal
 * consistency checks.  By default we don't do this unless
 * CONFIG_JBD2_DEBUG is on.
 */
#define JBD2_EXPENSIVE_CHECKING
void __jbd2_debug(int level, const char *file, const char *func,
                  unsigned int line, const char *fmt, ...);

#define jbd2_debug(n, fmt, a...) \
        __jbd2_debug((n), __FILE__, __func__, __LINE__, (fmt), ##a)
#else
#define jbd2_debug(n, fmt, a...)  no_printk(fmt, ##a)
#endif

extern void *jbd2_alloc(size_t size, gfp_t flags);
extern void jbd2_free(void *ptr, size_t size);

#define JBD2_MIN_JOURNAL_BLOCKS 1024
#define JBD2_DEFAULT_FAST_COMMIT_BLOCKS 256

#ifdef __KERNEL__

/**
 * typedef handle_t - The handle_t type represents a single atomic update being performed by some process.
 *
 * All filesystem modifications made by the process go
 * through this handle.  Recursive operations (such as quota operations)
 * are gathered into a single update.
 *
 * The buffer credits field is used to account for journaled buffers
 * being modified by the running process.  To ensure that there is
 * enough log space for all outstanding operations, we need to limit the
 * number of outstanding buffers possible at any time.  When the
 * operation completes, any buffer credits not used are credited back to
 * the transaction, so that at all times we know how many buffers the
 * outstanding updates on a transaction might possibly touch.
 *
 * This is an opaque datatype.
 **/
typedef struct jbd2_journal_handle handle_t;        /* Atomic operation type */


/**
 * typedef journal_t - The journal_t maintains all of the journaling state information for a single filesystem.
 *
 * journal_t is linked to from the fs superblock structure.
 *
 * We use the journal_t to keep track of all outstanding transaction
 * activity on the filesystem, and to manage the state of the log
 * writing process.
 *
 * This is an opaque datatype.
 **/
typedef struct journal_s        journal_t;        /* Journal control structure */
#endif

/*
 * Internal structures used by the logging mechanism:
 */

#define JBD2_MAGIC_NUMBER 0xc03b3998U /* The first 4 bytes of /dev/random! */

/*
 * On-disk structures
 */

/*
 * Descriptor block types:
 */

#define JBD2_DESCRIPTOR_BLOCK        1
#define JBD2_COMMIT_BLOCK        2
#define JBD2_SUPERBLOCK_V1        3
#define JBD2_SUPERBLOCK_V2        4
#define JBD2_REVOKE_BLOCK        5

/*
 * Standard header for all descriptor blocks:
 */
typedef struct journal_header_s
{
        __be32                h_magic;
        __be32                h_blocktype;
        __be32                h_sequence;
} journal_header_t;

/*
 * Checksum types.
 */
#define JBD2_CRC32_CHKSUM   1
#define JBD2_MD5_CHKSUM     2
#define JBD2_SHA1_CHKSUM    3
#define JBD2_CRC32C_CHKSUM  4

#define JBD2_CRC32_CHKSUM_SIZE 4

#define JBD2_CHECKSUM_BYTES (32 / sizeof(u32))
/*
 * Commit block header for storing transactional checksums:
 *
 * NOTE: If FEATURE_COMPAT_CHECKSUM (checksum v1) is set, the h_chksum*
 * fields are used to store a checksum of the descriptor and data blocks.
 *
 * If FEATURE_INCOMPAT_CSUM_V2 (checksum v2) is set, then the h_chksum
 * field is used to store crc32c(uuid+commit_block).  Each journal metadata
 * block gets its own checksum, and data block checksums are stored in
 * journal_block_tag (in the descriptor).  The other h_chksum* fields are
 * not used.
 *
 * If FEATURE_INCOMPAT_CSUM_V3 is set, the descriptor block uses
 * journal_block_tag3_t to store a full 32-bit checksum.  Everything else
 * is the same as v2.
 *
 * Checksum v1, v2, and v3 are mutually exclusive features.
 */
struct commit_header {
        __be32                h_magic;
        __be32          h_blocktype;
        __be32          h_sequence;
        unsigned char   h_chksum_type;
        unsigned char   h_chksum_size;
        unsigned char         h_padding[2];
        __be32                 h_chksum[JBD2_CHECKSUM_BYTES];
        __be64                h_commit_sec;
        __be32                h_commit_nsec;
};

/*
 * The block tag: used to describe a single buffer in the journal.
 * t_blocknr_high is only used if INCOMPAT_64BIT is set, so this
 * raw struct shouldn't be used for pointer math or sizeof() - use
 * journal_tag_bytes(journal) instead to compute this.
 */
typedef struct journal_block_tag3_s
{
        __be32                t_blocknr;        /* The on-disk block number */
        __be32                t_flags;        /* See below */
        __be32                t_blocknr_high; /* most-significant high 32bits. */
        __be32                t_checksum;        /* crc32c(uuid+seq+block) */
} journal_block_tag3_t;

typedef struct journal_block_tag_s
{
        __be32                t_blocknr;        /* The on-disk block number */
        __be16                t_checksum;        /* truncated crc32c(uuid+seq+block) */
        __be16                t_flags;        /* See below */
        __be32                t_blocknr_high; /* most-significant high 32bits. */
} journal_block_tag_t;

/* Tail of descriptor or revoke block, for checksumming */
struct jbd2_journal_block_tail {
        __be32                t_checksum;        /* crc32c(uuid+descr_block) */
};

/*
 * The revoke descriptor: used on disk to describe a series of blocks to
 * be revoked from the log
 */
typedef struct jbd2_journal_revoke_header_s
{
        journal_header_t r_header;
        __be32                 r_count;        /* Count of bytes used in the block */
} jbd2_journal_revoke_header_t;

/* Definitions for the journal tag flags word: */
#define JBD2_FLAG_ESCAPE                1        /* on-disk block is escaped */
#define JBD2_FLAG_SAME_UUID        2        /* block has same uuid as previous */
#define JBD2_FLAG_DELETED        4        /* block deleted by this transaction */
#define JBD2_FLAG_LAST_TAG        8        /* last tag in this descriptor block */


/*
 * The journal superblock.  All fields are in big-endian byte order.
 */
typedef struct journal_superblock_s
{
/* 0x0000 */
        journal_header_t s_header;

/* 0x000C */
        /* Static information describing the journal */
        __be32        s_blocksize;                /* journal device blocksize */
        __be32        s_maxlen;                /* total blocks in journal file */
        __be32        s_first;                /* first block of log information */

/* 0x0018 */
        /* Dynamic information describing the current state of the log */
        __be32        s_sequence;                /* first commit ID expected in log */
        __be32        s_start;                /* blocknr of start of log */

/* 0x0020 */
        /* Error value, as set by jbd2_journal_abort(). */
        __be32        s_errno;

/* 0x0024 */
        /* Remaining fields are only valid in a version-2 superblock */
        __be32        s_feature_compat;        /* compatible feature set */
        __be32        s_feature_incompat;        /* incompatible feature set */
        __be32        s_feature_ro_compat;        /* readonly-compatible feature set */
/* 0x0030 */
        __u8        s_uuid[16];                /* 128-bit uuid for journal */

/* 0x0040 */
        __be32        s_nr_users;                /* Nr of filesystems sharing log */

        __be32        s_dynsuper;                /* Blocknr of dynamic superblock copy*/

/* 0x0048 */
        __be32        s_max_transaction;        /* Limit of journal blocks per trans.*/
        __be32        s_max_trans_data;        /* Limit of data blocks per trans. */

/* 0x0050 */
        __u8        s_checksum_type;        /* checksum type */
        __u8        s_padding2[3];
/* 0x0054 */
        __be32        s_num_fc_blks;                /* Number of fast commit blocks */
        __be32        s_head;                        /* blocknr of head of log, only uptodate
                                         * while the filesystem is clean */
/* 0x005C */
        __u32        s_padding[40];
        __be32        s_checksum;                /* crc32c(superblock) */

/* 0x0100 */
        __u8        s_users[16*48];                /* ids of all fs'es sharing the log */
/* 0x0400 */
} journal_superblock_t;

#define JBD2_FEATURE_COMPAT_CHECKSUM                0x00000001

#define JBD2_FEATURE_INCOMPAT_REVOKE                0x00000001
#define JBD2_FEATURE_INCOMPAT_64BIT                0x00000002
#define JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT        0x00000004
#define JBD2_FEATURE_INCOMPAT_CSUM_V2                0x00000008
#define JBD2_FEATURE_INCOMPAT_CSUM_V3                0x00000010
#define JBD2_FEATURE_INCOMPAT_FAST_COMMIT        0x00000020

/* See "journal feature predicate functions" below */

/* Features known to this kernel version: */
#define JBD2_KNOWN_COMPAT_FEATURES        JBD2_FEATURE_COMPAT_CHECKSUM
#define JBD2_KNOWN_ROCOMPAT_FEATURES        0
#define JBD2_KNOWN_INCOMPAT_FEATURES        (JBD2_FEATURE_INCOMPAT_REVOKE | \
                                        JBD2_FEATURE_INCOMPAT_64BIT | \
                                        JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT | \
                                        JBD2_FEATURE_INCOMPAT_CSUM_V2 | \
                                        JBD2_FEATURE_INCOMPAT_CSUM_V3 | \
                                        JBD2_FEATURE_INCOMPAT_FAST_COMMIT)

#ifdef __KERNEL__

#include <linux/fs.h>
#include <linux/sched.h>

enum jbd_state_bits {
        BH_JBD                        /* Has an attached ext3 journal_head */
          = BH_PrivateStart,
        BH_JWrite,                /* Being written to log (@@@ DEBUGGING) */
        BH_Freed,                /* Has been freed (truncated) */
        BH_Revoked,                /* Has been revoked from the log */
        BH_RevokeValid,                /* Revoked flag is valid */
        BH_JBDDirty,                /* Is dirty but journaled */
        BH_JournalHead,                /* Pins bh->b_private and jh->b_bh */
        BH_Shadow,                /* IO on shadow buffer is running */
        BH_Verified,                /* Metadata block has been verified ok */
        BH_JBDPrivateStart,        /* First bit available for private use by FS */
};

BUFFER_FNS(JBD, jbd)
BUFFER_FNS(JWrite, jwrite)
BUFFER_FNS(JBDDirty, jbddirty)
TAS_BUFFER_FNS(JBDDirty, jbddirty)
BUFFER_FNS(Revoked, revoked)
TAS_BUFFER_FNS(Revoked, revoked)
BUFFER_FNS(RevokeValid, revokevalid)
TAS_BUFFER_FNS(RevokeValid, revokevalid)
BUFFER_FNS(Freed, freed)
BUFFER_FNS(Shadow, shadow)
BUFFER_FNS(Verified, verified)

static inline struct buffer_head *jh2bh(struct journal_head *jh)
{
        return jh->b_bh;
}

static inline struct journal_head *bh2jh(struct buffer_head *bh)
{
        return bh->b_private;
}

static inline void jbd_lock_bh_journal_head(struct buffer_head *bh)
{
        bit_spin_lock(BH_JournalHead, &bh->b_state);
}

static inline void jbd_unlock_bh_journal_head(struct buffer_head *bh)
{
        bit_spin_unlock(BH_JournalHead, &bh->b_state);
}

#define J_ASSERT(assert)        BUG_ON(!(assert))

#define J_ASSERT_BH(bh, expr)        J_ASSERT(expr)
#define J_ASSERT_JH(jh, expr)        J_ASSERT(expr)

#if defined(JBD2_PARANOID_IOFAIL)
#define J_EXPECT(expr, why...)                J_ASSERT(expr)
#define J_EXPECT_BH(bh, expr, why...)        J_ASSERT_BH(bh, expr)
#define J_EXPECT_JH(jh, expr, why...)        J_ASSERT_JH(jh, expr)
#else
#define __journal_expect(expr, why...)                                             \
        ({                                                                     \
                int val = (expr);                                             \
                if (!val) {                                                     \
                        printk(KERN_ERR                                             \
                               "JBD2 unexpected failure: %s: %s;\n",             \
                               __func__, #expr);                             \
                        printk(KERN_ERR why "\n");                             \
                }                                                             \
                val;                                                             \
        })
#define J_EXPECT(expr, why...)                __journal_expect(expr, ## why)
#define J_EXPECT_BH(bh, expr, why...)        __journal_expect(expr, ## why)
#define J_EXPECT_JH(jh, expr, why...)        __journal_expect(expr, ## why)
#endif

/* Flags in jbd_inode->i_flags */
#define __JI_COMMIT_RUNNING 0
#define __JI_WRITE_DATA 1
#define __JI_WAIT_DATA 2

/*
 * Commit of the inode data in progress. We use this flag to protect us from
 * concurrent deletion of inode. We cannot use reference to inode for this
 * since we cannot afford doing last iput() on behalf of kjournald
 */
#define JI_COMMIT_RUNNING (1 << __JI_COMMIT_RUNNING)
/* Write allocated dirty buffers in this inode before commit */
#define JI_WRITE_DATA (1 << __JI_WRITE_DATA)
/* Wait for outstanding data writes for this inode before commit */
#define JI_WAIT_DATA (1 << __JI_WAIT_DATA)

/**
 * struct jbd2_inode - The jbd_inode type is the structure linking inodes in
 * ordered mode present in a transaction so that we can sync them during commit.
 */
struct jbd2_inode {
        /**
         * @i_transaction:
         *
         * Which transaction does this inode belong to? Either the running
         * transaction or the committing one. [j_list_lock]
         */
        transaction_t *i_transaction;

        /**
         * @i_next_transaction:
         *
         * Pointer to the running transaction modifying inode's data in case
         * there is already a committing transaction touching it. [j_list_lock]
         */
        transaction_t *i_next_transaction;

        /**
         * @i_list: List of inodes in the i_transaction [j_list_lock]
         */
        struct list_head i_list;

        /**
         * @i_vfs_inode:
         *
         * VFS inode this inode belongs to [constant for lifetime of structure]
         */
        struct inode *i_vfs_inode;

        /**
         * @i_flags: Flags of inode [j_list_lock]
         */
        unsigned long i_flags;

        /**
         * @i_dirty_start:
         *
         * Offset in bytes where the dirty range for this inode starts.
         * [j_list_lock]
         */
        loff_t i_dirty_start;

        /**
         * @i_dirty_end:
         *
         * Inclusive offset in bytes where the dirty range for this inode
         * ends. [j_list_lock]
         */
        loff_t i_dirty_end;
};

struct jbd2_revoke_table_s;

/**
 * struct jbd2_journal_handle - The jbd2_journal_handle type is the concrete
 *     type associated with handle_t.
 * @h_transaction: Which compound transaction is this update a part of?
 * @h_journal: Which journal handle belongs to - used iff h_reserved set.
 * @h_rsv_handle: Handle reserved for finishing the logical operation.
 * @h_total_credits: Number of remaining buffers we are allowed to add to
 *        journal. These are dirty buffers and revoke descriptor blocks.
 * @h_revoke_credits: Number of remaining revoke records available for handle
 * @h_ref: Reference count on this handle.
 * @h_err: Field for caller's use to track errors through large fs operations.
 * @h_sync: Flag for sync-on-close.
 * @h_jdata: Flag to force data journaling.
 * @h_reserved: Flag for handle for reserved credits.
 * @h_aborted: Flag indicating fatal error on handle.
 * @h_type: For handle statistics.
 * @h_line_no: For handle statistics.
 * @h_start_jiffies: Handle Start time.
 * @h_requested_credits: Holds @h_total_credits after handle is started.
 * @h_revoke_credits_requested: Holds @h_revoke_credits after handle is started.
 * @saved_alloc_context: Saved context while transaction is open.
 **/

/* Docbook can't yet cope with the bit fields, but will leave the documentation
 * in so it can be fixed later.
 */

struct jbd2_journal_handle
{
        union {
                transaction_t        *h_transaction;
                /* Which journal handle belongs to - used iff h_reserved set */
                journal_t        *h_journal;
        };

        handle_t                *h_rsv_handle;
        int                        h_total_credits;
        int                        h_revoke_credits;
        int                        h_revoke_credits_requested;
        int                        h_ref;
        int                        h_err;

        /* Flags [no locking] */
        unsigned int        h_sync:                1;
        unsigned int        h_jdata:        1;
        unsigned int        h_reserved:        1;
        unsigned int        h_aborted:        1;
        unsigned int        h_type:                8;
        unsigned int        h_line_no:        16;

        unsigned long                h_start_jiffies;
        unsigned int                h_requested_credits;

        unsigned int                saved_alloc_context;
};


/*
 * Some stats for checkpoint phase
 */
struct transaction_chp_stats_s {
        unsigned long                cs_chp_time;
        __u32                        cs_forced_to_close;
        __u32                        cs_written;
        __u32                        cs_dropped;
};

/* The transaction_t type is the guts of the journaling mechanism.  It
 * tracks a compound transaction through its various states:
 *
 * RUNNING:        accepting new updates
 * LOCKED:        Updates still running but we don't accept new ones
 * RUNDOWN:        Updates are tidying up but have finished requesting
 *                new buffers to modify (state not used for now)
 * FLUSH:       All updates complete, but we are still writing to disk
 * COMMIT:      All data on disk, writing commit record
 * FINISHED:        We still have to keep the transaction for checkpointing.
 *
 * The transaction keeps track of all of the buffers modified by a
 * running transaction, and all of the buffers committed but not yet
 * flushed to home for finished transactions.
 * (Locking Documentation improved by LockDoc)
 */

/*
 * Lock ranking:
 *
 *    j_list_lock
 *      ->jbd_lock_bh_journal_head()        (This is "innermost")
 *
 *    j_state_lock
 *    ->b_state_lock
 *
 *    b_state_lock
 *    ->j_list_lock
 *
 *    j_state_lock
 *    ->j_list_lock                        (journal_unmap_buffer)
 *
 */

struct transaction_s
{
        /* Pointer to the journal for this transaction. [no locking] */
        journal_t                *t_journal;

        /* Sequence number for this transaction [no locking] */
        tid_t                        t_tid;

        /*
         * Transaction's current state
         * [no locking - only kjournald2 alters this]
         * [j_list_lock] guards transition of a transaction into T_FINISHED
         * state and subsequent call of __jbd2_journal_drop_transaction()
         * FIXME: needs barriers
         * KLUDGE: [use j_state_lock]
         */
        enum {
                T_RUNNING,
                T_LOCKED,
                T_SWITCH,
                T_FLUSH,
                T_COMMIT,
                T_COMMIT_DFLUSH,
                T_COMMIT_JFLUSH,
                T_COMMIT_CALLBACK,
                T_FINISHED
        }                        t_state;

        /*
         * Where in the log does this transaction's commit start? [no locking]
         */
        unsigned long                t_log_start;

        /*
         * Number of buffers on the t_buffers list [j_list_lock, no locks
         * needed for jbd2 thread]
         */
        int                        t_nr_buffers;

        /*
         * Doubly-linked circular list of all buffers reserved but not yet
         * modified by this transaction [j_list_lock, no locks needed fo
         * jbd2 thread]
         */
        struct journal_head        *t_reserved_list;

        /*
         * Doubly-linked circular list of all metadata buffers owned by this
         * transaction [j_list_lock, no locks needed for jbd2 thread]
         */
        struct journal_head        *t_buffers;

        /*
         * Doubly-linked circular list of all forget buffers (superseded
         * buffers which we can un-checkpoint once this transaction commits)
         * [j_list_lock]
         */
        struct journal_head        *t_forget;

        /*
         * Doubly-linked circular list of all buffers still to be flushed before
         * this transaction can be checkpointed. [j_list_lock]
         */
        struct journal_head        *t_checkpoint_list;

        /*
         * Doubly-linked circular list of metadata buffers being
         * shadowed by log IO.  The IO buffers on the iobuf list and
         * the shadow buffers on this list match each other one for
         * one at all times. [j_list_lock, no locks needed for jbd2
         * thread]
         */
        struct journal_head        *t_shadow_list;

        /*
         * List of inodes associated with the transaction; e.g., ext4 uses
         * this to track inodes in data=ordered and data=journal mode that
         * need special handling on transaction commit; also used by ocfs2.
         * [j_list_lock]
         */
        struct list_head        t_inode_list;

        /*
         * Longest time some handle had to wait for running transaction
         */
        unsigned long                t_max_wait;

        /*
         * When transaction started
         */
        unsigned long                t_start;

        /*
         * When commit was requested [j_state_lock]
         */
        unsigned long                t_requested;

        /*
         * Checkpointing stats [j_list_lock]
         */
        struct transaction_chp_stats_s t_chp_stats;

        /*
         * Number of outstanding updates running on this transaction
         * [none]
         */
        atomic_t                t_updates;

        /*
         * Number of blocks reserved for this transaction in the journal.
         * This is including all credits reserved when starting transaction
         * handles as well as all journal descriptor blocks needed for this
         * transaction. [none]
         */
        atomic_t                t_outstanding_credits;

        /*
         * Number of revoke records for this transaction added by already
         * stopped handles. [none]
         */
        atomic_t                t_outstanding_revokes;

        /*
         * How many handles used this transaction? [none]
         */
        atomic_t                t_handle_count;

        /*
         * Forward and backward links for the circular list of all transactions
         * awaiting checkpoint. [j_list_lock]
         */
        transaction_t                *t_cpnext, *t_cpprev;

        /*
         * When will the transaction expire (become due for commit), in jiffies?
         * [no locking]
         */
        unsigned long                t_expires;

        /*
         * When this transaction started, in nanoseconds [no locking]
         */
        ktime_t                        t_start_time;

        /*
         * This transaction is being forced and some process is
         * waiting for it to finish.
         */
        unsigned int t_synchronous_commit:1;

        /* Disk flush needs to be sent to fs partition [no locking] */
        int                        t_need_data_flush;

        /*
         * For use by the filesystem to store fs-specific data
         * structures associated with the transaction
         */
        struct list_head        t_private_list;
};

struct transaction_run_stats_s {
        unsigned long                rs_wait;
        unsigned long                rs_request_delay;
        unsigned long                rs_running;
        unsigned long                rs_locked;
        unsigned long                rs_flushing;
        unsigned long                rs_logging;

        __u32                        rs_handle_count;
        __u32                        rs_blocks;
        __u32                        rs_blocks_logged;
};

struct transaction_stats_s {
        unsigned long                ts_tid;
        unsigned long                ts_requested;
        struct transaction_run_stats_s run;
};

static inline unsigned long
jbd2_time_diff(unsigned long start, unsigned long end)
{
        if (end >= start)
                return end - start;

        return end + (MAX_JIFFY_OFFSET - start);
}

#define JBD2_NR_BATCH        64

enum passtype {PASS_SCAN, PASS_REVOKE, PASS_REPLAY};

#define JBD2_FC_REPLAY_STOP        0
#define JBD2_FC_REPLAY_CONTINUE        1

/**
 * struct journal_s - The journal_s type is the concrete type associated with
 *     journal_t.
 */
struct journal_s
{
        /**
         * @j_flags: General journaling state flags [j_state_lock,
         * no lock for quick racy checks]
         */
        unsigned long                j_flags;

        /**
         * @j_errno:
         *
         * Is there an outstanding uncleared error on the journal (from a prior
         * abort)? [j_state_lock]
         */
        int                        j_errno;

        /**
         * @j_abort_mutex: Lock the whole aborting procedure.
         */
        struct mutex                j_abort_mutex;

        /**
         * @j_sb_buffer: The first part of the superblock buffer.
         */
        struct buffer_head        *j_sb_buffer;

        /**
         * @j_superblock: The second part of the superblock buffer.
         */
        journal_superblock_t        *j_superblock;

        /**
         * @j_state_lock: Protect the various scalars in the journal.
         */
        rwlock_t                j_state_lock;

        /**
         * @j_barrier_count:
         *
         * Number of processes waiting to create a barrier lock [j_state_lock,
         * no lock for quick racy checks]
         */
        int                        j_barrier_count;

        /**
         * @j_barrier: The barrier lock itself.
         */
        struct mutex                j_barrier;

        /**
         * @j_running_transaction:
         *
         * Transactions: The current running transaction...
         * [j_state_lock, no lock for quick racy checks] [caller holding
         * open handle]
         */
        transaction_t                *j_running_transaction;

        /**
         * @j_committing_transaction:
         *
         * the transaction we are pushing to disk
         * [j_state_lock] [caller holding open handle]
         */
        transaction_t                *j_committing_transaction;

        /**
         * @j_checkpoint_transactions:
         *
         * ... and a linked circular list of all transactions waiting for
         * checkpointing. [j_list_lock]
         */
        transaction_t                *j_checkpoint_transactions;

        /**
         * @j_wait_transaction_locked:
         *
         * Wait queue for waiting for a locked transaction to start committing,
         * or for a barrier lock to be released.
         */
        wait_queue_head_t        j_wait_transaction_locked;

        /**
         * @j_wait_done_commit: Wait queue for waiting for commit to complete.
         */
        wait_queue_head_t        j_wait_done_commit;

        /**
         * @j_wait_commit: Wait queue to trigger commit.
         */
        wait_queue_head_t        j_wait_commit;

        /**
         * @j_wait_updates: Wait queue to wait for updates to complete.
         */
        wait_queue_head_t        j_wait_updates;

        /**
         * @j_wait_reserved:
         *
         * Wait queue to wait for reserved buffer credits to drop.
         */
        wait_queue_head_t        j_wait_reserved;

        /**
         * @j_fc_wait:
         *
         * Wait queue to wait for completion of async fast commits.
         */
        wait_queue_head_t        j_fc_wait;

        /**
         * @j_checkpoint_mutex:
         *
         * Semaphore for locking against concurrent checkpoints.
         */
        struct mutex                j_checkpoint_mutex;

        /**
         * @j_chkpt_bhs:
         *
         * List of buffer heads used by the checkpoint routine.  This
         * was moved from jbd2_log_do_checkpoint() to reduce stack
         * usage.  Access to this array is controlled by the
         * @j_checkpoint_mutex.  [j_checkpoint_mutex]
         */
        struct buffer_head        *j_chkpt_bhs[JBD2_NR_BATCH];

        /**
         * @j_shrinker:
         *
         * Journal head shrinker, reclaim buffer's journal head which
         * has been written back.
         */
        struct shrinker                *j_shrinker;

        /**
         * @j_checkpoint_jh_count:
         *
         * Number of journal buffers on the checkpoint list. [j_list_lock]
         */
        struct percpu_counter        j_checkpoint_jh_count;

        /**
         * @j_shrink_transaction:
         *
         * Record next transaction will shrink on the checkpoint list.
         * [j_list_lock]
         */
        transaction_t                *j_shrink_transaction;

        /**
         * @j_head:
         *
         * Journal head: identifies the first unused block in the journal.
         * [j_state_lock]
         */
        unsigned long                j_head;

        /**
         * @j_tail:
         *
         * Journal tail: identifies the oldest still-used block in the journal.
         * [j_state_lock]
         */
        unsigned long                j_tail;

        /**
         * @j_free:
         *
         * Journal free: how many free blocks are there in the journal?
         * [j_state_lock]
         */
        unsigned long                j_free;

        /**
         * @j_first:
         *
         * The block number of the first usable block in the journal
         * [j_state_lock].
         */
        unsigned long                j_first;

        /**
         * @j_last:
         *
         * The block number one beyond the last usable block in the journal
         * [j_state_lock].
         */
        unsigned long                j_last;

        /**
         * @j_fc_first:
         *
         * The block number of the first fast commit block in the journal
         * [j_state_lock].
         */
        unsigned long                j_fc_first;

        /**
         * @j_fc_off:
         *
         * Number of fast commit blocks currently allocated. Accessed only
         * during fast commit. Currently only process can do fast commit, so
         * this field is not protected by any lock.
         */
        unsigned long                j_fc_off;

        /**
         * @j_fc_last:
         *
         * The block number one beyond the last fast commit block in the journal
         * [j_state_lock].
         */
        unsigned long                j_fc_last;

        /**
         * @j_dev: Device where we store the journal.
         */
        struct block_device        *j_dev;

        /**
         * @j_blocksize: Block size for the location where we store the journal.
         */
        int                        j_blocksize;

        /**
         * @j_blk_offset:
         *
         * Starting block offset into the device where we store the journal.
         */
        unsigned long long        j_blk_offset;

        /**
         * @j_devname: Journal device name.
         */
        char                        j_devname[BDEVNAME_SIZE+24];

        /**
         * @j_fs_dev:
         *
         * Device which holds the client fs.  For internal journal this will be
         * equal to j_dev.
         */
        struct block_device        *j_fs_dev;

        /**
         * @j_fs_dev_wb_err:
         *
         * Records the errseq of the client fs's backing block device.
         */
        errseq_t                j_fs_dev_wb_err;

        /**
         * @j_total_len: Total maximum capacity of the journal region on disk.
         */
        unsigned int                j_total_len;

        /**
         * @j_reserved_credits:
         *
         * Number of buffers reserved from the running transaction.
         */
        atomic_t                j_reserved_credits;

        /**
         * @j_list_lock: Protects the buffer lists and internal buffer state.
         */
        spinlock_t                j_list_lock;

        /**
         * @j_inode:
         *
         * Optional inode where we store the journal.  If present, all
         * journal block numbers are mapped into this inode via bmap().
         */
        struct inode                *j_inode;

        /**
         * @j_tail_sequence:
         *
         * Sequence number of the oldest transaction in the log [j_state_lock]
         */
        tid_t                        j_tail_sequence;

        /**
         * @j_transaction_sequence:
         *
         * Sequence number of the next transaction to grant [j_state_lock]
         */
        tid_t                        j_transaction_sequence;

        /**
         * @j_commit_sequence:
         *
         * Sequence number of the most recently committed transaction
         * [j_state_lock, no lock for quick racy checks]
         */
        tid_t                        j_commit_sequence;

        /**
         * @j_commit_request:
         *
         * Sequence number of the most recent transaction wanting commit
         * [j_state_lock, no lock for quick racy checks]
         */
        tid_t                        j_commit_request;

        /**
         * @j_uuid:
         *
         * Journal uuid: identifies the object (filesystem, LVM volume etc)
         * backed by this journal.  This will eventually be replaced by an array
         * of uuids, allowing us to index multiple devices within a single
         * journal and to perform atomic updates across them.
         */
        __u8                        j_uuid[16];

        /**
         * @j_task: Pointer to the current commit thread for this journal.
         */
        struct task_struct        *j_task;

        /**
         * @j_max_transaction_buffers:
         *
         * Maximum number of metadata buffers to allow in a single compound
         * commit transaction.
         */
        int                        j_max_transaction_buffers;

        /**
         * @j_revoke_records_per_block:
         *
         * Number of revoke records that fit in one descriptor block.
         */
        int                        j_revoke_records_per_block;

        /**
         * @j_transaction_overhead_buffers:
         *
         * Number of blocks each transaction needs for its own bookkeeping
         */
        int                        j_transaction_overhead_buffers;

        /**
         * @j_commit_interval:
         *
         * What is the maximum transaction lifetime before we begin a commit?
         */
        unsigned long                j_commit_interval;

        /**
         * @j_commit_timer: The timer used to wakeup the commit thread.
         */
        struct timer_list        j_commit_timer;

        /**
         * @j_revoke_lock: Protect the revoke table.
         */
        spinlock_t                j_revoke_lock;

        /**
         * @j_revoke:
         *
         * The revoke table - maintains the list of revoked blocks in the
         * current transaction.
         */
        struct jbd2_revoke_table_s *j_revoke;

        /**
         * @j_revoke_table: Alternate revoke tables for j_revoke.
         */
        struct jbd2_revoke_table_s *j_revoke_table[2];

        /**
         * @j_wbuf: Array of bhs for jbd2_journal_commit_transaction.
         */
        struct buffer_head        **j_wbuf;

        /**
         * @j_fc_wbuf: Array of fast commit bhs for fast commit. Accessed only
         * during a fast commit. Currently only process can do fast commit, so
         * this field is not protected by any lock.
         */
        struct buffer_head        **j_fc_wbuf;

        /**
         * @j_wbufsize:
         *
         * Size of @j_wbuf array.
         */
        int                        j_wbufsize;

        /**
         * @j_fc_wbufsize:
         *
         * Size of @j_fc_wbuf array.
         */
        int                        j_fc_wbufsize;

        /**
         * @j_last_sync_writer:
         *
         * The pid of the last person to run a synchronous operation
         * through the journal.
         */
        pid_t                        j_last_sync_writer;

        /**
         * @j_average_commit_time:
         *
         * The average amount of time in nanoseconds it takes to commit a
         * transaction to disk. [j_state_lock]
         */
        u64                        j_average_commit_time;

        /**
         * @j_min_batch_time:
         *
         * Minimum time that we should wait for additional filesystem operations
         * to get batched into a synchronous handle in microseconds.
         */
        u32                        j_min_batch_time;

        /**
         * @j_max_batch_time:
         *
         * Maximum time that we should wait for additional filesystem operations
         * to get batched into a synchronous handle in microseconds.
         */
        u32                        j_max_batch_time;

        /**
         * @j_commit_callback:
         *
         * This function is called when a transaction is closed.
         */
        void                        (*j_commit_callback)(journal_t *,
                                                     transaction_t *);

        /**
         * @j_submit_inode_data_buffers:
         *
         * This function is called for all inodes associated with the
         * committing transaction marked with JI_WRITE_DATA flag
         * before we start to write out the transaction to the journal.
         */
        int                        (*j_submit_inode_data_buffers)
                                        (struct jbd2_inode *);

        /**
         * @j_finish_inode_data_buffers:
         *
         * This function is called for all inodes associated with the
         * committing transaction marked with JI_WAIT_DATA flag
         * after we have written the transaction to the journal
         * but before we write out the commit block.
         */
        int                        (*j_finish_inode_data_buffers)
                                        (struct jbd2_inode *);

        /*
         * Journal statistics
         */

        /**
         * @j_history_lock: Protect the transactions statistics history.
         */
        spinlock_t                j_history_lock;

        /**
         * @j_proc_entry: procfs entry for the jbd statistics directory.
         */
        struct proc_dir_entry        *j_proc_entry;

        /**
         * @j_stats: Overall statistics.
         */
        struct transaction_stats_s j_stats;

        /**
         * @j_failed_commit: Failed journal commit ID.
         */
        unsigned int                j_failed_commit;

        /**
         * @j_private:
         *
         * An opaque pointer to fs-private information.  ext3 puts its
         * superblock pointer here.
         */
        void *j_private;

        /**
         * @j_csum_seed:
         *
         * Precomputed journal UUID checksum for seeding other checksums.
         */
        __u32 j_csum_seed;

#ifdef CONFIG_DEBUG_LOCK_ALLOC
        /**
         * @j_trans_commit_map:
         *
         * Lockdep entity to track transaction commit dependencies. Handles
         * hold this "lock" for read, when we wait for commit, we acquire the
         * "lock" for writing. This matches the properties of jbd2 journalling
         * where the running transaction has to wait for all handles to be
         * dropped to commit that transaction and also acquiring a handle may
         * require transaction commit to finish.
         */
        struct lockdep_map        j_trans_commit_map;
#endif

        /**
         * @j_fc_cleanup_callback:
         *
         * Clean-up after fast commit or full commit. JBD2 calls this function
         * after every commit operation.
         */
        void (*j_fc_cleanup_callback)(struct journal_s *journal, int full, tid_t tid);

        /**
         * @j_fc_replay_callback:
         *
         * File-system specific function that performs replay of a fast
         * commit. JBD2 calls this function for each fast commit block found in
         * the journal. This function should return JBD2_FC_REPLAY_CONTINUE
         * to indicate that the block was processed correctly and more fast
         * commit replay should continue. Return value of JBD2_FC_REPLAY_STOP
         * indicates the end of replay (no more blocks remaining). A negative
         * return value indicates error.
         */
        int (*j_fc_replay_callback)(struct journal_s *journal,
                                    struct buffer_head *bh,
                                    enum passtype pass, int off,
                                    tid_t expected_commit_id);

        /**
         * @j_bmap:
         *
         * Bmap function that should be used instead of the generic
         * VFS bmap function.
         */
        int (*j_bmap)(struct journal_s *journal, sector_t *block);
};

#define jbd2_might_wait_for_commit(j) \
        do { \
                rwsem_acquire(&j->j_trans_commit_map, 0, 0, _THIS_IP_); \
                rwsem_release(&j->j_trans_commit_map, _THIS_IP_); \
        } while (0)

/*
 * We can support any known requested features iff the
 * superblock is not in version 1.  Otherwise we fail to support any
 * extended sb features.
 */
static inline bool jbd2_format_support_feature(journal_t *j)
{
        return j->j_superblock->s_header.h_blocktype !=
                                        cpu_to_be32(JBD2_SUPERBLOCK_V1);
}

/* journal feature predicate functions */
#define JBD2_FEATURE_COMPAT_FUNCS(name, flagname) \
static inline bool jbd2_has_feature_##name(journal_t *j) \
{ \
        return (jbd2_format_support_feature(j) && \
                ((j)->j_superblock->s_feature_compat & \
                 cpu_to_be32(JBD2_FEATURE_COMPAT_##flagname)) != 0); \
} \
static inline void jbd2_set_feature_##name(journal_t *j) \
{ \
        (j)->j_superblock->s_feature_compat |= \
                cpu_to_be32(JBD2_FEATURE_COMPAT_##flagname); \
} \
static inline void jbd2_clear_feature_##name(journal_t *j) \
{ \
        (j)->j_superblock->s_feature_compat &= \
                ~cpu_to_be32(JBD2_FEATURE_COMPAT_##flagname); \
}

#define JBD2_FEATURE_RO_COMPAT_FUNCS(name, flagname) \
static inline bool jbd2_has_feature_##name(journal_t *j) \
{ \
        return (jbd2_format_support_feature(j) && \
                ((j)->j_superblock->s_feature_ro_compat & \
                 cpu_to_be32(JBD2_FEATURE_RO_COMPAT_##flagname)) != 0); \
} \
static inline void jbd2_set_feature_##name(journal_t *j) \
{ \
        (j)->j_superblock->s_feature_ro_compat |= \
                cpu_to_be32(JBD2_FEATURE_RO_COMPAT_##flagname); \
} \
static inline void jbd2_clear_feature_##name(journal_t *j) \
{ \
        (j)->j_superblock->s_feature_ro_compat &= \
                ~cpu_to_be32(JBD2_FEATURE_RO_COMPAT_##flagname); \
}

#define JBD2_FEATURE_INCOMPAT_FUNCS(name, flagname) \
static inline bool jbd2_has_feature_##name(journal_t *j) \
{ \
        return (jbd2_format_support_feature(j) && \
                ((j)->j_superblock->s_feature_incompat & \
                 cpu_to_be32(JBD2_FEATURE_INCOMPAT_##flagname)) != 0); \
} \
static inline void jbd2_set_feature_##name(journal_t *j) \
{ \
        (j)->j_superblock->s_feature_incompat |= \
                cpu_to_be32(JBD2_FEATURE_INCOMPAT_##flagname); \
} \
static inline void jbd2_clear_feature_##name(journal_t *j) \
{ \
        (j)->j_superblock->s_feature_incompat &= \
                ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_##flagname); \
}

JBD2_FEATURE_COMPAT_FUNCS(checksum,                CHECKSUM)

JBD2_FEATURE_INCOMPAT_FUNCS(revoke,                REVOKE)
JBD2_FEATURE_INCOMPAT_FUNCS(64bit,                64BIT)
JBD2_FEATURE_INCOMPAT_FUNCS(async_commit,        ASYNC_COMMIT)
JBD2_FEATURE_INCOMPAT_FUNCS(csum2,                CSUM_V2)
JBD2_FEATURE_INCOMPAT_FUNCS(csum3,                CSUM_V3)
JBD2_FEATURE_INCOMPAT_FUNCS(fast_commit,        FAST_COMMIT)

/* Journal high priority write IO operation flags */
#define JBD2_JOURNAL_REQ_FLAGS                (REQ_META | REQ_SYNC | REQ_IDLE)

/*
 * Journal flag definitions
 */
#define JBD2_UNMOUNT        0x001        /* Journal thread is being destroyed */
#define JBD2_ABORT        0x002        /* Journaling has been aborted for errors. */
#define JBD2_ACK_ERR        0x004        /* The errno in the sb has been acked */
#define JBD2_FLUSHED        0x008        /* The journal superblock has been flushed */
#define JBD2_LOADED        0x010        /* The journal superblock has been loaded */
#define JBD2_BARRIER        0x020        /* Use IDE barriers */
#define JBD2_ABORT_ON_SYNCDATA_ERR        0x040        /* Abort the journal on file
                                                 * data write error in ordered
                                                 * mode */
#define JBD2_CYCLE_RECORD                0x080        /* Journal cycled record log on
                                                 * clean and empty filesystem
                                                 * logging area */
#define JBD2_FAST_COMMIT_ONGOING        0x100        /* Fast commit is ongoing */
#define JBD2_FULL_COMMIT_ONGOING        0x200        /* Full commit is ongoing */
#define JBD2_JOURNAL_FLUSH_DISCARD        0x0001
#define JBD2_JOURNAL_FLUSH_ZEROOUT        0x0002
#define JBD2_JOURNAL_FLUSH_VALID        (JBD2_JOURNAL_FLUSH_DISCARD | \
                                        JBD2_JOURNAL_FLUSH_ZEROOUT)

/*
 * Function declarations for the journaling transaction and buffer
 * management
 */

/* Filing buffers */
extern void jbd2_journal_unfile_buffer(journal_t *, struct journal_head *);
extern bool __jbd2_journal_refile_buffer(struct journal_head *);
extern void jbd2_journal_refile_buffer(journal_t *, struct journal_head *);
extern void __jbd2_journal_file_buffer(struct journal_head *, transaction_t *, int);
extern void jbd2_journal_file_buffer(struct journal_head *, transaction_t *, int);
static inline void jbd2_file_log_bh(struct list_head *head, struct buffer_head *bh)
{
        list_add_tail(&bh->b_assoc_buffers, head);
}
static inline void jbd2_unfile_log_bh(struct buffer_head *bh)
{
        list_del_init(&bh->b_assoc_buffers);
}

/* Log buffer allocation */
struct buffer_head *jbd2_journal_get_descriptor_buffer(transaction_t *, int);
void jbd2_descriptor_block_csum_set(journal_t *, struct buffer_head *);
int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
                              unsigned long *block);
int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);

/* Commit management */
extern void jbd2_journal_commit_transaction(journal_t *);

/* Checkpoint list management */
enum jbd2_shrink_type {JBD2_SHRINK_DESTROY, JBD2_SHRINK_BUSY_STOP, JBD2_SHRINK_BUSY_SKIP};

void __jbd2_journal_clean_checkpoint_list(journal_t *journal, enum jbd2_shrink_type type);
unsigned long jbd2_journal_shrink_checkpoint_list(journal_t *journal, unsigned long *nr_to_scan);
int __jbd2_journal_remove_checkpoint(struct journal_head *);
int jbd2_journal_try_remove_checkpoint(struct journal_head *jh);
void jbd2_journal_destroy_checkpoint(journal_t *journal);
void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *);


/*
 * Triggers
 */

struct jbd2_buffer_trigger_type {
        /*
         * Fired a the moment data to write to the journal are known to be
         * stable - so either at the moment b_frozen_data is created or just
         * before a buffer is written to the journal.  mapped_data is a mapped
         * buffer that is the frozen data for commit.
         */
        void (*t_frozen)(struct jbd2_buffer_trigger_type *type,
                         struct buffer_head *bh, void *mapped_data,
                         size_t size);

        /*
         * Fired during journal abort for dirty buffers that will not be
         * committed.
         */
        void (*t_abort)(struct jbd2_buffer_trigger_type *type,
                        struct buffer_head *bh);
};

extern void jbd2_buffer_frozen_trigger(struct journal_head *jh,
                                       void *mapped_data,
                                       struct jbd2_buffer_trigger_type *triggers);
extern void jbd2_buffer_abort_trigger(struct journal_head *jh,
                                      struct jbd2_buffer_trigger_type *triggers);

/* Buffer IO */
extern int jbd2_journal_write_metadata_buffer(transaction_t *transaction,
                                              struct journal_head *jh_in,
                                              struct buffer_head **bh_out,
                                              sector_t blocknr);

/* Transaction cache support */
extern void jbd2_journal_destroy_transaction_cache(void);
extern int __init jbd2_journal_init_transaction_cache(void);
extern void jbd2_journal_free_transaction(transaction_t *);

/*
 * Journal locking.
 *
 * We need to lock the journal during transaction state changes so that nobody
 * ever tries to take a handle on the running transaction while we are in the
 * middle of moving it to the commit phase.  j_state_lock does this.
 *
 * Note that the locking is completely interrupt unsafe.  We never touch
 * journal structures from interrupts.
 */

static inline handle_t *journal_current_handle(void)
{
        return current->journal_info;
}

/* The journaling code user interface:
 *
 * Create and destroy handles
 * Register buffer modifications against the current transaction.
 */

extern handle_t *jbd2_journal_start(journal_t *, int nblocks);
extern handle_t *jbd2__journal_start(journal_t *, int blocks, int rsv_blocks,
                                     int revoke_records, gfp_t gfp_mask,
                                     unsigned int type, unsigned int line_no);
extern int         jbd2_journal_restart(handle_t *, int nblocks);
extern int         jbd2__journal_restart(handle_t *, int nblocks,
                                       int revoke_records, gfp_t gfp_mask);
extern int         jbd2_journal_start_reserved(handle_t *handle,
                                unsigned int type, unsigned int line_no);
extern void         jbd2_journal_free_reserved(handle_t *handle);
extern int         jbd2_journal_extend(handle_t *handle, int nblocks,
                                     int revoke_records);
extern int         jbd2_journal_get_write_access(handle_t *, struct buffer_head *);
extern int         jbd2_journal_get_create_access (handle_t *, struct buffer_head *);
extern int         jbd2_journal_get_undo_access(handle_t *, struct buffer_head *);
void                 jbd2_journal_set_triggers(struct buffer_head *,
                                           struct jbd2_buffer_trigger_type *type);
extern int         jbd2_journal_dirty_metadata (handle_t *, struct buffer_head *);
extern int         jbd2_journal_forget (handle_t *, struct buffer_head *);
int jbd2_journal_invalidate_folio(journal_t *, struct folio *,
                                        size_t offset, size_t length);
bool jbd2_journal_try_to_free_buffers(journal_t *journal, struct folio *folio);
extern int         jbd2_journal_stop(handle_t *);
extern int         jbd2_journal_flush(journal_t *journal, unsigned int flags);
extern void         jbd2_journal_lock_updates (journal_t *);
extern void         jbd2_journal_unlock_updates (journal_t *);

void jbd2_journal_wait_updates(journal_t *);

extern journal_t * jbd2_journal_init_dev(struct block_device *bdev,
                                struct block_device *fs_dev,
                                unsigned long long start, int len, int bsize);
extern journal_t * jbd2_journal_init_inode (struct inode *);
extern int           jbd2_journal_update_format (journal_t *);
extern int           jbd2_journal_check_used_features
                   (journal_t *, unsigned long, unsigned long, unsigned long);
extern int           jbd2_journal_check_available_features
                   (journal_t *, unsigned long, unsigned long, unsigned long);
extern int           jbd2_journal_set_features
                   (journal_t *, unsigned long, unsigned long, unsigned long);
extern void           jbd2_journal_clear_features
                   (journal_t *, unsigned long, unsigned long, unsigned long);
extern int           jbd2_journal_load       (journal_t *journal);
extern int           jbd2_journal_destroy    (journal_t *);
extern int           jbd2_journal_recover    (journal_t *journal);
extern int           jbd2_journal_wipe       (journal_t *, int);
extern int           jbd2_journal_skip_recovery        (journal_t *);
extern void           jbd2_journal_update_sb_errno(journal_t *);
extern int           jbd2_journal_update_sb_log_tail        (journal_t *, tid_t,
                                unsigned long, blk_opf_t);
extern void           jbd2_journal_abort      (journal_t *, int);
extern int           jbd2_journal_errno      (journal_t *);
extern void           jbd2_journal_ack_err    (journal_t *);
extern int           jbd2_journal_clear_err  (journal_t *);
extern int           jbd2_journal_bmap(journal_t *, unsigned long, unsigned long long *);
extern int           jbd2_journal_force_commit(journal_t *);
extern int           jbd2_journal_force_commit_nested(journal_t *);
extern int           jbd2_journal_inode_ranged_write(handle_t *handle,
                        struct jbd2_inode *inode, loff_t start_byte,
                        loff_t length);
extern int           jbd2_journal_inode_ranged_wait(handle_t *handle,
                        struct jbd2_inode *inode, loff_t start_byte,
                        loff_t length);
extern int           jbd2_journal_finish_inode_data_buffers(
                        struct jbd2_inode *jinode);
extern int           jbd2_journal_begin_ordered_truncate(journal_t *journal,
                                struct jbd2_inode *inode, loff_t new_size);
extern void           jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode);
extern void           jbd2_journal_release_jbd_inode(journal_t *journal, struct jbd2_inode *jinode);

/*
 * journal_head management
 */
struct journal_head *jbd2_journal_add_journal_head(struct buffer_head *bh);
struct journal_head *jbd2_journal_grab_journal_head(struct buffer_head *bh);
void jbd2_journal_put_journal_head(struct journal_head *jh);

/*
 * handle management
 */
extern struct kmem_cache *jbd2_handle_cache;

/*
 * This specialized allocator has to be a macro for its allocations to be
 * accounted separately (to have a separate alloc_tag). The typecast is
 * intentional to enforce typesafety.
 */
#define jbd2_alloc_handle(_gfp_flags)        \
                ((handle_t *)kmem_cache_zalloc(jbd2_handle_cache, _gfp_flags))

static inline void jbd2_free_handle(handle_t *handle)
{
        kmem_cache_free(jbd2_handle_cache, handle);
}

/*
 * jbd2_inode management (optional, for those file systems that want to use
 * dynamically allocated jbd2_inode structures)
 */
extern struct kmem_cache *jbd2_inode_cache;

/*
 * This specialized allocator has to be a macro for its allocations to be
 * accounted separately (to have a separate alloc_tag). The typecast is
 * intentional to enforce typesafety.
 */
#define jbd2_alloc_inode(_gfp_flags)        \
                ((struct jbd2_inode *)kmem_cache_alloc(jbd2_inode_cache, _gfp_flags))

static inline void jbd2_free_inode(struct jbd2_inode *jinode)
{
        kmem_cache_free(jbd2_inode_cache, jinode);
}

/* Primary revoke support */
#define JOURNAL_REVOKE_DEFAULT_HASH 256
extern int           jbd2_journal_init_revoke(journal_t *, int);
extern void           jbd2_journal_destroy_revoke_record_cache(void);
extern void           jbd2_journal_destroy_revoke_table_cache(void);
extern int __init jbd2_journal_init_revoke_record_cache(void);
extern int __init jbd2_journal_init_revoke_table_cache(void);

extern void           jbd2_journal_destroy_revoke(journal_t *);
extern int           jbd2_journal_revoke (handle_t *, unsigned long long, struct buffer_head *);
extern int           jbd2_journal_cancel_revoke(handle_t *, struct journal_head *);
extern void           jbd2_journal_write_revoke_records(transaction_t *transaction,
                                                     struct list_head *log_bufs);

/* Recovery revoke support */
extern int        jbd2_journal_set_revoke(journal_t *, unsigned long long, tid_t);
extern int        jbd2_journal_test_revoke(journal_t *, unsigned long long, tid_t);
extern void        jbd2_journal_clear_revoke(journal_t *);
extern void        jbd2_journal_switch_revoke_table(journal_t *journal);
extern void        jbd2_clear_buffer_revoked_flags(journal_t *journal);

/*
 * The log thread user interface:
 *
 * Request space in the current transaction, and force transaction commit
 * transitions on demand.
 */

int jbd2_log_start_commit(journal_t *journal, tid_t tid);
int jbd2_journal_start_commit(journal_t *journal, tid_t *tid);
int jbd2_log_wait_commit(journal_t *journal, tid_t tid);
int jbd2_transaction_committed(journal_t *journal, tid_t tid);
int jbd2_complete_transaction(journal_t *journal, tid_t tid);
int jbd2_log_do_checkpoint(journal_t *journal);
int jbd2_trans_will_send_data_barrier(journal_t *journal, tid_t tid);

void __jbd2_log_wait_for_space(journal_t *journal);
extern void __jbd2_journal_drop_transaction(journal_t *, transaction_t *);
extern int jbd2_cleanup_journal_tail(journal_t *);

/* Fast commit related APIs */
int jbd2_fc_begin_commit(journal_t *journal, tid_t tid);
int jbd2_fc_end_commit(journal_t *journal);
int jbd2_fc_end_commit_fallback(journal_t *journal);
int jbd2_fc_get_buf(journal_t *journal, struct buffer_head **bh_out);
int jbd2_submit_inode_data(journal_t *journal, struct jbd2_inode *jinode);
int jbd2_wait_inode_data(journal_t *journal, struct jbd2_inode *jinode);
int jbd2_fc_wait_bufs(journal_t *journal, int num_blks);
void jbd2_fc_release_bufs(journal_t *journal);

/*
 * is_journal_abort
 *
 * Simple test wrapper function to test the JBD2_ABORT state flag.  This
 * bit, when set, indicates that we have had a fatal error somewhere,
 * either inside the journaling layer or indicated to us by the client
 * (eg. ext3), and that we and should not commit any further
 * transactions.
 */

static inline int is_journal_aborted(journal_t *journal)
{
        return journal->j_flags & JBD2_ABORT;
}

static inline int is_handle_aborted(handle_t *handle)
{
        if (handle->h_aborted || !handle->h_transaction)
                return 1;
        return is_journal_aborted(handle->h_transaction->t_journal);
}

static inline void jbd2_journal_abort_handle(handle_t *handle)
{
        handle->h_aborted = 1;
}

static inline void jbd2_init_fs_dev_write_error(journal_t *journal)
{
        struct address_space *mapping = journal->j_fs_dev->bd_mapping;

        /*
         * Save the original wb_err value of client fs's bdev mapping which
         * could be used to detect the client fs's metadata async write error.
         */
        errseq_check_and_advance(&mapping->wb_err, &journal->j_fs_dev_wb_err);
}

static inline int jbd2_check_fs_dev_write_error(journal_t *journal)
{
        struct address_space *mapping = journal->j_fs_dev->bd_mapping;

        return errseq_check(&mapping->wb_err,
                            READ_ONCE(journal->j_fs_dev_wb_err));
}

#endif /* __KERNEL__   */

/* Comparison functions for transaction IDs: perform comparisons using
 * modulo arithmetic so that they work over sequence number wraps. */

static inline int tid_gt(tid_t x, tid_t y)
{
        int difference = (x - y);
        return (difference > 0);
}

static inline int tid_geq(tid_t x, tid_t y)
{
        int difference = (x - y);
        return (difference >= 0);
}

extern int jbd2_journal_blocks_per_page(struct inode *inode);
extern size_t journal_tag_bytes(journal_t *journal);

static inline bool jbd2_journal_has_csum_v2or3_feature(journal_t *j)
{
        return jbd2_has_feature_csum2(j) || jbd2_has_feature_csum3(j);
}

static inline int jbd2_journal_has_csum_v2or3(journal_t *journal)
{
        return jbd2_journal_has_csum_v2or3_feature(journal);
}

static inline int jbd2_journal_get_num_fc_blks(journal_superblock_t *jsb)
{
        int num_fc_blocks = be32_to_cpu(jsb->s_num_fc_blks);

        return num_fc_blocks ? num_fc_blocks : JBD2_DEFAULT_FAST_COMMIT_BLOCKS;
}

/*
 * Return number of free blocks in the log. Must be called under j_state_lock.
 */
static inline unsigned long jbd2_log_space_left(journal_t *journal)
{
        /* Allow for rounding errors */
        long free = journal->j_free - 32;

        if (journal->j_committing_transaction) {
                free -= atomic_read(&journal->
                        j_committing_transaction->t_outstanding_credits);
        }
        return max_t(long, free, 0);
}

/*
 * Definitions which augment the buffer_head layer
 */

/* journaling buffer types */
#define BJ_None                0        /* Not journaled */
#define BJ_Metadata        1        /* Normal journaled metadata */
#define BJ_Forget        2        /* Buffer superseded by this transaction */
#define BJ_Shadow        3        /* Buffer contents being shadowed to the log */
#define BJ_Reserved        4        /* Buffer is reserved for access by journal */
#define BJ_Types        5

static inline u32 jbd2_chksum(journal_t *journal, u32 crc,
                              const void *address, unsigned int length)
{
        return crc32c(crc, address, length);
}

/* Return most recent uncommitted transaction */
static inline tid_t  jbd2_get_latest_transaction(journal_t *journal)
{
        tid_t tid;

        read_lock(&journal->j_state_lock);
        tid = journal->j_commit_request;
        if (journal->j_running_transaction)
                tid = journal->j_running_transaction->t_tid;
        read_unlock(&journal->j_state_lock);
        return tid;
}

static inline int jbd2_handle_buffer_credits(handle_t *handle)
{
        journal_t *journal;

        if (!handle->h_reserved)
                journal = handle->h_transaction->t_journal;
        else
                journal = handle->h_journal;

        return handle->h_total_credits -
                DIV_ROUND_UP(handle->h_revoke_credits_requested,
                             journal->j_revoke_records_per_block);
}

#ifdef __KERNEL__

#define buffer_trace_init(bh)        do {} while (0)
#define print_buffer_fields(bh)        do {} while (0)
#define print_buffer_trace(bh)        do {} while (0)
#define BUFFER_TRACE(bh, info)        do {} while (0)
#define BUFFER_TRACE2(bh, bh2, info)        do {} while (0)
#define JBUFFER_TRACE(jh, info)        do {} while (0)

#endif        /* __KERNEL__ */

#define EFSBADCRC        EBADMSG                /* Bad CRC detected */
#define EFSCORRUPTED        EUCLEAN                /* Filesystem is corrupted */

#endif        /* _LINUX_JBD2_H */
















    6 













    6 










































































































































































































































































































































































































































































    3 



    3 




















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright 1997-1998 Transmeta Corporation -- All Rights Reserved
 * Copyright 2001-2006 Ian Kent <raven@themaw.net>
 */

#include <linux/sched/signal.h>
#include "autofs_i.h"

/* We make this a static variable rather than a part of the superblock; it
 * is better if we don't reassign numbers easily even across filesystems
 */
static autofs_wqt_t autofs_next_wait_queue = 1;

void autofs_catatonic_mode(struct autofs_sb_info *sbi)
{
        struct autofs_wait_queue *wq, *nwq;

        mutex_lock(&sbi->wq_mutex);
        if (sbi->flags & AUTOFS_SBI_CATATONIC) {
                mutex_unlock(&sbi->wq_mutex);
                return;
        }

        pr_debug("entering catatonic mode\n");

        sbi->flags |= AUTOFS_SBI_CATATONIC;
        wq = sbi->queues;
        sbi->queues = NULL;        /* Erase all wait queues */
        while (wq) {
                nwq = wq->next;
                wq->status = -ENOENT; /* Magic is gone - report failure */
                kfree(wq->name.name - wq->offset);
                wq->name.name = NULL;
                wake_up(&wq->queue);
                if (!--wq->wait_ctr)
                        kfree(wq);
                wq = nwq;
        }
        fput(sbi->pipe);        /* Close the pipe */
        sbi->pipe = NULL;
        sbi->pipefd = -1;
        mutex_unlock(&sbi->wq_mutex);
}

static int autofs_write(struct autofs_sb_info *sbi,
                        struct file *file, const void *addr, int bytes)
{
        unsigned long sigpipe, flags;
        const char *data = (const char *)addr;
        ssize_t wr = 0;

        sigpipe = sigismember(&current->pending.signal, SIGPIPE);

        mutex_lock(&sbi->pipe_mutex);
        while (bytes) {
                wr = __kernel_write(file, data, bytes, NULL);
                if (wr <= 0)
                        break;
                data += wr;
                bytes -= wr;
        }
        mutex_unlock(&sbi->pipe_mutex);

        /* Keep the currently executing process from receiving a
         * SIGPIPE unless it was already supposed to get one
         */
        if (wr == -EPIPE && !sigpipe) {
                spin_lock_irqsave(&current->sighand->siglock, flags);
                sigdelset(&current->pending.signal, SIGPIPE);
                recalc_sigpending();
                spin_unlock_irqrestore(&current->sighand->siglock, flags);
        }

        /* if 'wr' returned 0 (impossible) we assume -EIO (safe) */
        return bytes == 0 ? 0 : wr < 0 ? wr : -EIO;
}

static void autofs_notify_daemon(struct autofs_sb_info *sbi,
                                 struct autofs_wait_queue *wq,
                                 int type)
{
        union {
                struct autofs_packet_hdr hdr;
                union autofs_packet_union v4_pkt;
                union autofs_v5_packet_union v5_pkt;
        } pkt;
        struct file *pipe = NULL;
        size_t pktsz;
        int ret;

        pr_debug("wait id = 0x%08lx, name = %.*s, type=%d\n",
                 (unsigned long) wq->wait_queue_token,
                 wq->name.len, wq->name.name, type);

        memset(&pkt, 0, sizeof(pkt)); /* For security reasons */

        pkt.hdr.proto_version = sbi->version;
        pkt.hdr.type = type;

        switch (type) {
        /* Kernel protocol v4 missing and expire packets */
        case autofs_ptype_missing:
        {
                struct autofs_packet_missing *mp = &pkt.v4_pkt.missing;

                pktsz = sizeof(*mp);

                mp->wait_queue_token = wq->wait_queue_token;
                mp->len = wq->name.len;
                memcpy(mp->name, wq->name.name, wq->name.len);
                mp->name[wq->name.len] = '\0';
                break;
        }
        case autofs_ptype_expire_multi:
        {
                struct autofs_packet_expire_multi *ep =
                                        &pkt.v4_pkt.expire_multi;

                pktsz = sizeof(*ep);

                ep->wait_queue_token = wq->wait_queue_token;
                ep->len = wq->name.len;
                memcpy(ep->name, wq->name.name, wq->name.len);
                ep->name[wq->name.len] = '\0';
                break;
        }
        /*
         * Kernel protocol v5 packet for handling indirect and direct
         * mount missing and expire requests
         */
        case autofs_ptype_missing_indirect:
        case autofs_ptype_expire_indirect:
        case autofs_ptype_missing_direct:
        case autofs_ptype_expire_direct:
        {
                struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
                struct user_namespace *user_ns = sbi->pipe->f_cred->user_ns;

                pktsz = sizeof(*packet);

                packet->wait_queue_token = wq->wait_queue_token;
                packet->len = wq->name.len;
                memcpy(packet->name, wq->name.name, wq->name.len);
                packet->name[wq->name.len] = '\0';
                packet->dev = wq->dev;
                packet->ino = wq->ino;
                packet->uid = from_kuid_munged(user_ns, wq->uid);
                packet->gid = from_kgid_munged(user_ns, wq->gid);
                packet->pid = wq->pid;
                packet->tgid = wq->tgid;
                break;
        }
        default:
                pr_warn("bad type %d!\n", type);
                mutex_unlock(&sbi->wq_mutex);
                return;
        }

        pipe = get_file(sbi->pipe);

        mutex_unlock(&sbi->wq_mutex);

        switch (ret = autofs_write(sbi, pipe, &pkt, pktsz)) {
        case 0:
                break;
        case -ENOMEM:
        case -ERESTARTSYS:
                /* Just fail this one */
                autofs_wait_release(sbi, wq->wait_queue_token, ret);
                break;
        default:
                autofs_catatonic_mode(sbi);
                break;
        }
        fput(pipe);
}

static struct autofs_wait_queue *
autofs_find_wait(struct autofs_sb_info *sbi, const struct qstr *qstr)
{
        struct autofs_wait_queue *wq;

        for (wq = sbi->queues; wq; wq = wq->next) {
                if (wq->name.hash == qstr->hash &&
                    wq->name.len == qstr->len &&
                    wq->name.name &&
                    !memcmp(wq->name.name, qstr->name, qstr->len))
                        break;
        }
        return wq;
}

/*
 * Check if we have a valid request.
 * Returns
 * 1 if the request should continue.
 *   In this case we can return an autofs_wait_queue entry if one is
 *   found or NULL to idicate a new wait needs to be created.
 * 0 or a negative errno if the request shouldn't continue.
 */
static int validate_request(struct autofs_wait_queue **wait,
                            struct autofs_sb_info *sbi,
                            const struct qstr *qstr,
                            const struct path *path, enum autofs_notify notify)
{
        struct dentry *dentry = path->dentry;
        struct autofs_wait_queue *wq;
        struct autofs_info *ino;

        if (sbi->flags & AUTOFS_SBI_CATATONIC)
                return -ENOENT;

        /* Wait in progress, continue; */
        wq = autofs_find_wait(sbi, qstr);
        if (wq) {
                *wait = wq;
                return 1;
        }

        *wait = NULL;

        /* If we don't yet have any info this is a new request */
        ino = autofs_dentry_ino(dentry);
        if (!ino)
                return 1;

        /*
         * If we've been asked to wait on an existing expire (NFY_NONE)
         * but there is no wait in the queue ...
         */
        if (notify == NFY_NONE) {
                /*
                 * Either we've betean the pending expire to post it's
                 * wait or it finished while we waited on the mutex.
                 * So we need to wait till either, the wait appears
                 * or the expire finishes.
                 */

                while (ino->flags & AUTOFS_INF_EXPIRING) {
                        mutex_unlock(&sbi->wq_mutex);
                        schedule_timeout_interruptible(HZ/10);
                        if (mutex_lock_interruptible(&sbi->wq_mutex))
                                return -EINTR;

                        if (sbi->flags & AUTOFS_SBI_CATATONIC)
                                return -ENOENT;

                        wq = autofs_find_wait(sbi, qstr);
                        if (wq) {
                                *wait = wq;
                                return 1;
                        }
                }

                /*
                 * Not ideal but the status has already gone. Of the two
                 * cases where we wait on NFY_NONE neither depend on the
                 * return status of the wait.
                 */
                return 0;
        }

        /*
         * If we've been asked to trigger a mount and the request
         * completed while we waited on the mutex ...
         */
        if (notify == NFY_MOUNT) {
                struct dentry *new = NULL;
                struct path this;
                int valid = 1;

                /*
                 * If the dentry was successfully mounted while we slept
                 * on the wait queue mutex we can return success. If it
                 * isn't mounted (doesn't have submounts for the case of
                 * a multi-mount with no mount at it's base) we can
                 * continue on and create a new request.
                 */
                if (!IS_ROOT(dentry)) {
                        if (d_unhashed(dentry) &&
                            d_really_is_positive(dentry)) {
                                struct dentry *parent = dentry->d_parent;

                                new = d_lookup(parent, &dentry->d_name);
                                if (new)
                                        dentry = new;
                        }
                }
                this.mnt = path->mnt;
                this.dentry = dentry;
                if (path_has_submounts(&this))
                        valid = 0;

                if (new)
                        dput(new);
                return valid;
        }

        return 1;
}

int autofs_wait(struct autofs_sb_info *sbi,
                 const struct path *path, enum autofs_notify notify)
{
        struct dentry *dentry = path->dentry;
        struct autofs_wait_queue *wq;
        struct qstr qstr;
        char *name;
        int status, ret, type;
        unsigned int offset = 0;
        pid_t pid;
        pid_t tgid;

        /* In catatonic mode, we don't wait for nobody */
        if (sbi->flags & AUTOFS_SBI_CATATONIC)
                return -ENOENT;

        /*
         * Try translating pids to the namespace of the daemon.
         *
         * Zero means failure: we are in an unrelated pid namespace.
         */
        pid = task_pid_nr_ns(current, ns_of_pid(sbi->oz_pgrp));
        tgid = task_tgid_nr_ns(current, ns_of_pid(sbi->oz_pgrp));
        if (pid == 0 || tgid == 0)
                return -ENOENT;

        if (d_really_is_negative(dentry)) {
                /*
                 * A wait for a negative dentry is invalid for certain
                 * cases. A direct or offset mount "always" has its mount
                 * point directory created and so the request dentry must
                 * be positive or the map key doesn't exist. The situation
                 * is very similar for indirect mounts except only dentrys
                 * in the root of the autofs file system may be negative.
                 */
                if (autofs_type_trigger(sbi->type))
                        return -ENOENT;
                else if (!IS_ROOT(dentry->d_parent))
                        return -ENOENT;
        }

        name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
        if (!name)
                return -ENOMEM;

        /* If this is a direct mount request create a dummy name */
        if (IS_ROOT(dentry) && autofs_type_trigger(sbi->type)) {
                qstr.name = name;
                qstr.len = sprintf(name, "%p", dentry);
        } else {
                char *p = dentry_path_raw(dentry, name, NAME_MAX);
                if (IS_ERR(p)) {
                        kfree(name);
                        return -ENOENT;
                }
                qstr.name = ++p; // skip the leading slash
                qstr.len = strlen(p);
                offset = p - name;
        }
        qstr.hash = full_name_hash(dentry, qstr.name, qstr.len);

        if (mutex_lock_interruptible(&sbi->wq_mutex)) {
                kfree(name);
                return -EINTR;
        }

        ret = validate_request(&wq, sbi, &qstr, path, notify);
        if (ret <= 0) {
                if (ret != -EINTR)
                        mutex_unlock(&sbi->wq_mutex);
                kfree(name);
                return ret;
        }

        if (!wq) {
                /* Create a new wait queue */
                wq = kmalloc(sizeof(struct autofs_wait_queue), GFP_KERNEL);
                if (!wq) {
                        kfree(name);
                        mutex_unlock(&sbi->wq_mutex);
                        return -ENOMEM;
                }

                wq->wait_queue_token = autofs_next_wait_queue;
                if (++autofs_next_wait_queue == 0)
                        autofs_next_wait_queue = 1;
                wq->next = sbi->queues;
                sbi->queues = wq;
                init_waitqueue_head(&wq->queue);
                memcpy(&wq->name, &qstr, sizeof(struct qstr));
                wq->offset = offset;
                wq->dev = autofs_get_dev(sbi);
                wq->ino = autofs_get_ino(sbi);
                wq->uid = current_uid();
                wq->gid = current_gid();
                wq->pid = pid;
                wq->tgid = tgid;
                wq->status = -EINTR; /* Status return if interrupted */
                wq->wait_ctr = 2;

                if (sbi->version < 5) {
                        if (notify == NFY_MOUNT)
                                type = autofs_ptype_missing;
                        else
                                type = autofs_ptype_expire_multi;
                } else {
                        if (notify == NFY_MOUNT)
                                type = autofs_type_trigger(sbi->type) ?
                                        autofs_ptype_missing_direct :
                                         autofs_ptype_missing_indirect;
                        else
                                type = autofs_type_trigger(sbi->type) ?
                                        autofs_ptype_expire_direct :
                                        autofs_ptype_expire_indirect;
                }

                pr_debug("new wait id = 0x%08lx, name = %.*s, nfy=%d\n",
                         (unsigned long) wq->wait_queue_token, wq->name.len,
                         wq->name.name, notify);

                /*
                 * autofs_notify_daemon() may block; it will unlock ->wq_mutex
                 */
                autofs_notify_daemon(sbi, wq, type);
        } else {
                wq->wait_ctr++;
                pr_debug("existing wait id = 0x%08lx, name = %.*s, nfy=%d\n",
                         (unsigned long) wq->wait_queue_token, wq->name.len,
                         wq->name.name, notify);
                mutex_unlock(&sbi->wq_mutex);
                kfree(name);
        }

        /*
         * wq->name.name is NULL iff the lock is already released
         * or the mount has been made catatonic.
         */
        wait_event_killable(wq->queue, wq->name.name == NULL);
        status = wq->status;

        /*
         * For direct and offset mounts we need to track the requester's
         * uid and gid in the dentry info struct. This is so it can be
         * supplied, on request, by the misc device ioctl interface.
         * This is needed during daemon resatart when reconnecting
         * to existing, active, autofs mounts. The uid and gid (and
         * related string values) may be used for macro substitution
         * in autofs mount maps.
         */
        if (!status) {
                struct autofs_info *ino;
                struct dentry *de = NULL;

                /* direct mount or browsable map */
                ino = autofs_dentry_ino(dentry);
                if (!ino) {
                        /* If not lookup actual dentry used */
                        de = d_lookup(dentry->d_parent, &dentry->d_name);
                        if (de)
                                ino = autofs_dentry_ino(de);
                }

                /* Set mount requester */
                if (ino) {
                        spin_lock(&sbi->fs_lock);
                        ino->uid = wq->uid;
                        ino->gid = wq->gid;
                        spin_unlock(&sbi->fs_lock);
                }

                if (de)
                        dput(de);
        }

        /* Are we the last process to need status? */
        mutex_lock(&sbi->wq_mutex);
        if (!--wq->wait_ctr)
                kfree(wq);
        mutex_unlock(&sbi->wq_mutex);

        return status;
}


int autofs_wait_release(struct autofs_sb_info *sbi,
                        autofs_wqt_t wait_queue_token, int status)
{
        struct autofs_wait_queue *wq, **wql;

        mutex_lock(&sbi->wq_mutex);
        for (wql = &sbi->queues; (wq = *wql) != NULL; wql = &wq->next) {
                if (wq->wait_queue_token == wait_queue_token)
                        break;
        }

        if (!wq) {
                mutex_unlock(&sbi->wq_mutex);
                return -EINVAL;
        }

        *wql = wq->next;        /* Unlink from chain */
        kfree(wq->name.name - wq->offset);
        wq->name.name = NULL;        /* Do not wait on this queue */
        wq->status = status;
        wake_up(&wq->queue);
        if (!--wq->wait_ctr)
                kfree(wq);
        mutex_unlock(&sbi->wq_mutex);

        return 0;
}


























































   22 















   13 






   13 
   12 













   12 




    1 
    6 




    5 











    1 




   10 




   10 

   10 











    1 





   10 

    4 






    6 





   44 











    2 

    1 


    3 
    3 



   11 







    2 


   15 


    5 






    2 





    8 
    8 












    1 







   21 
    4 










   10 










    6 



    9 




   10 
    1 















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
/*
 * Copyright (c) 2006, 2019 Oracle and/or its affiliates. All rights reserved.
 *
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
 * General Public License (GPL) Version 2, available from the file
 * COPYING in the main directory of this source tree, or the
 * OpenIB.org BSD license below:
 *
 *     Redistribution and use in source and binary forms, with or
 *     without modification, are permitted provided that the following
 *     conditions are met:
 *
 *      - Redistributions of source code must retain the above
 *        copyright notice, this list of conditions and the following
 *        disclaimer.
 *
 *      - Redistributions in binary form must reproduce the above
 *        copyright notice, this list of conditions and the following
 *        disclaimer in the documentation and/or other materials
 *        provided with the distribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 *
 */
#include <linux/kernel.h>
#include <net/sock.h>
#include <linux/in.h>
#include <linux/ipv6.h>
#include <linux/if_arp.h>
#include <linux/jhash.h>
#include <linux/ratelimit.h>
#include "rds.h"

static struct rhashtable bind_hash_table;

static const struct rhashtable_params ht_parms = {
        .nelem_hint = 768,
        .key_len = RDS_BOUND_KEY_LEN,
        .key_offset = offsetof(struct rds_sock, rs_bound_key),
        .head_offset = offsetof(struct rds_sock, rs_bound_node),
        .max_size = 16384,
        .min_size = 1024,
};

/* Create a key for the bind hash table manipulation.  Port is in network byte
 * order.
 */
static inline void __rds_create_bind_key(u8 *key, const struct in6_addr *addr,
                                         __be16 port, __u32 scope_id)
{
        memcpy(key, addr, sizeof(*addr));
        key += sizeof(*addr);
        memcpy(key, &port, sizeof(port));
        key += sizeof(port);
        memcpy(key, &scope_id, sizeof(scope_id));
}

/*
 * Return the rds_sock bound at the given local address.
 *
 * The rx path can race with rds_release.  We notice if rds_release() has
 * marked this socket and don't return a rs ref to the rx path.
 */
struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
                                __u32 scope_id)
{
        u8 key[RDS_BOUND_KEY_LEN];
        struct rds_sock *rs;

        __rds_create_bind_key(key, addr, port, scope_id);
        rcu_read_lock();
        rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
        if (rs && (sock_flag(rds_rs_to_sk(rs), SOCK_DEAD) ||
                   !refcount_inc_not_zero(&rds_rs_to_sk(rs)->sk_refcnt)))
                rs = NULL;

        rcu_read_unlock();

        rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,
                 ntohs(port));

        return rs;
}

/* returns -ve errno or +ve port */
static int rds_add_bound(struct rds_sock *rs, const struct in6_addr *addr,
                         __be16 *port, __u32 scope_id)
{
        int ret = -EADDRINUSE;
        u16 rover, last;
        u8 key[RDS_BOUND_KEY_LEN];

        if (*port != 0) {
                rover = be16_to_cpu(*port);
                if (rover == RDS_FLAG_PROBE_PORT)
                        return -EINVAL;
                last = rover;
        } else {
                rover = max_t(u16, get_random_u16(), 2);
                last = rover - 1;
        }

        do {
                if (rover == 0)
                        rover++;

                if (rover == RDS_FLAG_PROBE_PORT)
                        continue;
                __rds_create_bind_key(key, addr, cpu_to_be16(rover),
                                      scope_id);
                if (rhashtable_lookup_fast(&bind_hash_table, key, ht_parms))
                        continue;

                memcpy(rs->rs_bound_key, key, sizeof(rs->rs_bound_key));
                rs->rs_bound_addr = *addr;
                net_get_random_once(&rs->rs_hash_initval,
                                    sizeof(rs->rs_hash_initval));
                rs->rs_bound_port = cpu_to_be16(rover);
                rs->rs_bound_node.next = NULL;
                rds_sock_addref(rs);
                if (!rhashtable_insert_fast(&bind_hash_table,
                                            &rs->rs_bound_node, ht_parms)) {
                        *port = rs->rs_bound_port;
                        rs->rs_bound_scope_id = scope_id;
                        ret = 0;
                        rdsdebug("rs %p binding to %pI6c:%d\n",
                                 rs, addr, (int)ntohs(*port));
                        break;
                } else {
                        rs->rs_bound_addr = in6addr_any;
                        rds_sock_put(rs);
                        ret = -ENOMEM;
                        break;
                }
        } while (rover++ != last);

        return ret;
}

void rds_remove_bound(struct rds_sock *rs)
{

        if (ipv6_addr_any(&rs->rs_bound_addr))
                return;

        rdsdebug("rs %p unbinding from %pI6c:%d\n",
                 rs, &rs->rs_bound_addr,
                 ntohs(rs->rs_bound_port));

        rhashtable_remove_fast(&bind_hash_table, &rs->rs_bound_node, ht_parms);
        rds_sock_put(rs);
        rs->rs_bound_addr = in6addr_any;
}

int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
{
        struct sock *sk = sock->sk;
        struct rds_sock *rs = rds_sk_to_rs(sk);
        struct in6_addr v6addr, *binding_addr;
        struct rds_transport *trans;
        __u32 scope_id = 0;
        int ret = 0;
        __be16 port;

        /* We allow an RDS socket to be bound to either IPv4 or IPv6
         * address.
         */
        if (addr_len < offsetofend(struct sockaddr, sa_family))
                return -EINVAL;
        if (uaddr->sa_family == AF_INET) {
                struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;

                if (addr_len < sizeof(struct sockaddr_in) ||
                    sin->sin_addr.s_addr == htonl(INADDR_ANY) ||
                    sin->sin_addr.s_addr == htonl(INADDR_BROADCAST) ||
                    ipv4_is_multicast(sin->sin_addr.s_addr))
                        return -EINVAL;
                ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, &v6addr);
                binding_addr = &v6addr;
                port = sin->sin_port;
#if IS_ENABLED(CONFIG_IPV6)
        } else if (uaddr->sa_family == AF_INET6) {
                struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)uaddr;
                int addr_type;

                if (addr_len < sizeof(struct sockaddr_in6))
                        return -EINVAL;
                addr_type = ipv6_addr_type(&sin6->sin6_addr);
                if (!(addr_type & IPV6_ADDR_UNICAST)) {
                        __be32 addr4;

                        if (!(addr_type & IPV6_ADDR_MAPPED))
                                return -EINVAL;

                        /* It is a mapped address.  Need to do some sanity
                         * checks.
                         */
                        addr4 = sin6->sin6_addr.s6_addr32[3];
                        if (addr4 == htonl(INADDR_ANY) ||
                            addr4 == htonl(INADDR_BROADCAST) ||
                            ipv4_is_multicast(addr4))
                                return -EINVAL;
                }
                /* The scope ID must be specified for link local address. */
                if (addr_type & IPV6_ADDR_LINKLOCAL) {
                        if (sin6->sin6_scope_id == 0)
                                return -EINVAL;
                        scope_id = sin6->sin6_scope_id;
                }
                binding_addr = &sin6->sin6_addr;
                port = sin6->sin6_port;
#endif
        } else {
                return -EINVAL;
        }
        lock_sock(sk);

        /* RDS socket does not allow re-binding. */
        if (!ipv6_addr_any(&rs->rs_bound_addr)) {
                ret = -EINVAL;
                goto out;
        }
        /* Socket is connected.  The binding address should have the same
         * scope ID as the connected address, except the case when one is
         * non-link local address (scope_id is 0).
         */
        if (!ipv6_addr_any(&rs->rs_conn_addr) && scope_id &&
            rs->rs_bound_scope_id &&
            scope_id != rs->rs_bound_scope_id) {
                ret = -EINVAL;
                goto out;
        }

        /* The transport can be set using SO_RDS_TRANSPORT option before the
         * socket is bound.
         */
        if (rs->rs_transport) {
                trans = rs->rs_transport;
                if (!trans->laddr_check ||
                    trans->laddr_check(sock_net(sock->sk),
                                       binding_addr, scope_id) != 0) {
                        ret = -ENOPROTOOPT;
                        goto out;
                }
        } else {
                trans = rds_trans_get_preferred(sock_net(sock->sk),
                                                binding_addr, scope_id);
                if (!trans) {
                        ret = -EADDRNOTAVAIL;
                        pr_info_ratelimited("RDS: %s could not find a transport for %pI6c, load rds_tcp or rds_rdma?\n",
                                            __func__, binding_addr);
                        goto out;
                }
                rs->rs_transport = trans;
        }

        sock_set_flag(sk, SOCK_RCU_FREE);
        ret = rds_add_bound(rs, binding_addr, &port, scope_id);
        if (ret)
                rs->rs_transport = NULL;

out:
        release_sock(sk);
        return ret;
}

void rds_bind_lock_destroy(void)
{
        rhashtable_destroy(&bind_hash_table);
}

int rds_bind_lock_init(void)
{
        return rhashtable_init(&bind_hash_table, &ht_parms);
}




















































   14 








   14 


































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
// SPDX-License-Identifier: GPL-2.0-or-later
/* Testing module to load key from trusted PKCS#7 message
 *
 * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#define pr_fmt(fmt) "PKCS7key: "fmt
#include <linux/key.h>
#include <linux/err.h>
#include <linux/module.h>
#include <linux/verification.h>
#include <linux/key-type.h>
#include <keys/user-type.h>

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("PKCS#7 testing key type");
MODULE_AUTHOR("Red Hat, Inc.");

static unsigned pkcs7_usage;
module_param_named(usage, pkcs7_usage, uint, S_IWUSR | S_IRUGO);
MODULE_PARM_DESC(pkcs7_usage,
                 "Usage to specify when verifying the PKCS#7 message");

/*
 * Retrieve the PKCS#7 message content.
 */
static int pkcs7_view_content(void *ctx, const void *data, size_t len,
                              size_t asn1hdrlen)
{
        struct key_preparsed_payload *prep = ctx;
        const void *saved_prep_data;
        size_t saved_prep_datalen;
        int ret;

        saved_prep_data = prep->data;
        saved_prep_datalen = prep->datalen;
        prep->data = data;
        prep->datalen = len;

        ret = user_preparse(prep);

        prep->data = saved_prep_data;
        prep->datalen = saved_prep_datalen;
        return ret;
}

/*
 * Preparse a PKCS#7 wrapped and validated data blob.
 */
static int pkcs7_preparse(struct key_preparsed_payload *prep)
{
        enum key_being_used_for usage = pkcs7_usage;

        if (usage >= NR__KEY_BEING_USED_FOR) {
                pr_err("Invalid usage type %d\n", usage);
                return -EINVAL;
        }

        return verify_pkcs7_signature(NULL, 0,
                                      prep->data, prep->datalen,
                                      VERIFY_USE_SECONDARY_KEYRING, usage,
                                      pkcs7_view_content, prep);
}

/*
 * user defined keys take an arbitrary string as the description and an
 * arbitrary blob of data as the payload
 */
static struct key_type key_type_pkcs7 = {
        .name                        = "pkcs7_test",
        .preparse                = pkcs7_preparse,
        .free_preparse                = user_free_preparse,
        .instantiate                = generic_key_instantiate,
        .revoke                        = user_revoke,
        .destroy                = user_destroy,
        .describe                = user_describe,
        .read                        = user_read,
};

/*
 * Module stuff
 */
static int __init pkcs7_key_init(void)
{
        return register_key_type(&key_type_pkcs7);
}

static void __exit pkcs7_key_cleanup(void)
{
        unregister_key_type(&key_type_pkcs7);
}

module_init(pkcs7_key_init);
module_exit(pkcs7_key_cleanup);













































































































































































































    4 





















































































    4 






















































































































































    3 








    1 







    1 
    1 






   74 














    3 
























































































































    3 



    3 


    3 


























 1667 





 1666 








    1 



























































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
// SPDX-License-Identifier: GPL-2.0
/* drivers/net/wireless/virt_wifi.c
 *
 * A fake implementation of cfg80211_ops that can be tacked on to an ethernet
 * net_device to make it appear as a wireless connection.
 *
 * Copyright (C) 2018 Google, Inc.
 *
 * Author: schuffelen@google.com
 */

#include <net/cfg80211.h>
#include <net/rtnetlink.h>
#include <linux/etherdevice.h>
#include <linux/math64.h>
#include <linux/module.h>

static struct wiphy *common_wiphy;

struct virt_wifi_wiphy_priv {
        struct delayed_work scan_result;
        struct cfg80211_scan_request *scan_request;
        bool being_deleted;
};

static struct ieee80211_channel channel_2ghz = {
        .band = NL80211_BAND_2GHZ,
        .center_freq = 2432,
        .hw_value = 2432,
        .max_power = 20,
};

static struct ieee80211_rate bitrates_2ghz[] = {
        { .bitrate = 10 },
        { .bitrate = 20 },
        { .bitrate = 55 },
        { .bitrate = 110 },
        { .bitrate = 60 },
        { .bitrate = 120 },
        { .bitrate = 240 },
};

static struct ieee80211_supported_band band_2ghz = {
        .channels = &channel_2ghz,
        .bitrates = bitrates_2ghz,
        .band = NL80211_BAND_2GHZ,
        .n_channels = 1,
        .n_bitrates = ARRAY_SIZE(bitrates_2ghz),
        .ht_cap = {
                .ht_supported = true,
                .cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                       IEEE80211_HT_CAP_GRN_FLD |
                       IEEE80211_HT_CAP_SGI_20 |
                       IEEE80211_HT_CAP_SGI_40 |
                       IEEE80211_HT_CAP_DSSSCCK40,
                .ampdu_factor = 0x3,
                .ampdu_density = 0x6,
                .mcs = {
                        .rx_mask = {0xff, 0xff},
                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
                },
        },
};

static struct ieee80211_channel channel_5ghz = {
        .band = NL80211_BAND_5GHZ,
        .center_freq = 5240,
        .hw_value = 5240,
        .max_power = 20,
};

static struct ieee80211_rate bitrates_5ghz[] = {
        { .bitrate = 60 },
        { .bitrate = 120 },
        { .bitrate = 240 },
};

#define RX_MCS_MAP (IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 14)

#define TX_MCS_MAP (IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 | \
                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 14)

static struct ieee80211_supported_band band_5ghz = {
        .channels = &channel_5ghz,
        .bitrates = bitrates_5ghz,
        .band = NL80211_BAND_5GHZ,
        .n_channels = 1,
        .n_bitrates = ARRAY_SIZE(bitrates_5ghz),
        .ht_cap = {
                .ht_supported = true,
                .cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                       IEEE80211_HT_CAP_GRN_FLD |
                       IEEE80211_HT_CAP_SGI_20 |
                       IEEE80211_HT_CAP_SGI_40 |
                       IEEE80211_HT_CAP_DSSSCCK40,
                .ampdu_factor = 0x3,
                .ampdu_density = 0x6,
                .mcs = {
                        .rx_mask = {0xff, 0xff},
                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
                },
        },
        .vht_cap = {
                .vht_supported = true,
                .cap = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
                       IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
                       IEEE80211_VHT_CAP_RXLDPC |
                       IEEE80211_VHT_CAP_SHORT_GI_80 |
                       IEEE80211_VHT_CAP_SHORT_GI_160 |
                       IEEE80211_VHT_CAP_TXSTBC |
                       IEEE80211_VHT_CAP_RXSTBC_1 |
                       IEEE80211_VHT_CAP_RXSTBC_2 |
                       IEEE80211_VHT_CAP_RXSTBC_3 |
                       IEEE80211_VHT_CAP_RXSTBC_4 |
                       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
                .vht_mcs = {
                        .rx_mcs_map = cpu_to_le16(RX_MCS_MAP),
                        .tx_mcs_map = cpu_to_le16(TX_MCS_MAP),
                }
        },
};

/* Assigned at module init. Guaranteed locally-administered and unicast. */
static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {};

#define VIRT_WIFI_SSID "VirtWifi"
#define VIRT_WIFI_SSID_LEN 8

static void virt_wifi_inform_bss(struct wiphy *wiphy)
{
        u64 tsf = div_u64(ktime_get_boottime_ns(), 1000);
        struct cfg80211_bss *informed_bss;
        static const struct {
                u8 tag;
                u8 len;
                u8 ssid[8];
        } __packed ssid = {
                .tag = WLAN_EID_SSID,
                .len = VIRT_WIFI_SSID_LEN,
                .ssid = VIRT_WIFI_SSID,
        };

        informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
                                           CFG80211_BSS_FTYPE_PRESP,
                                           fake_router_bssid, tsf,
                                           WLAN_CAPABILITY_ESS, 0,
                                           (void *)&ssid, sizeof(ssid),
                                           DBM_TO_MBM(-50), GFP_KERNEL);
        cfg80211_put_bss(wiphy, informed_bss);
}

/* Called with the rtnl lock held. */
static int virt_wifi_scan(struct wiphy *wiphy,
                          struct cfg80211_scan_request *request)
{
        struct virt_wifi_wiphy_priv *priv = wiphy_priv(wiphy);

        wiphy_debug(wiphy, "scan\n");

        if (priv->scan_request || priv->being_deleted)
                return -EBUSY;

        priv->scan_request = request;
        schedule_delayed_work(&priv->scan_result, HZ * 2);

        return 0;
}

/* Acquires and releases the rdev BSS lock. */
static void virt_wifi_scan_result(struct work_struct *work)
{
        struct virt_wifi_wiphy_priv *priv =
                container_of(work, struct virt_wifi_wiphy_priv,
                             scan_result.work);
        struct wiphy *wiphy = priv_to_wiphy(priv);
        struct cfg80211_scan_info scan_info = { .aborted = false };

        virt_wifi_inform_bss(wiphy);

        /* Schedules work which acquires and releases the rtnl lock. */
        cfg80211_scan_done(priv->scan_request, &scan_info);
        priv->scan_request = NULL;
}

/* May acquire and release the rdev BSS lock. */
static void virt_wifi_cancel_scan(struct wiphy *wiphy)
{
        struct virt_wifi_wiphy_priv *priv = wiphy_priv(wiphy);

        cancel_delayed_work_sync(&priv->scan_result);
        /* Clean up dangling callbacks if necessary. */
        if (priv->scan_request) {
                struct cfg80211_scan_info scan_info = { .aborted = true };
                /* Schedules work which acquires and releases the rtnl lock. */
                cfg80211_scan_done(priv->scan_request, &scan_info);
                priv->scan_request = NULL;
        }
}

struct virt_wifi_netdev_priv {
        struct delayed_work connect;
        struct net_device *lowerdev;
        struct net_device *upperdev;
        u32 tx_packets;
        u32 tx_failed;
        u32 connect_requested_ssid_len;
        u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN];
        u8 connect_requested_bss[ETH_ALEN];
        bool is_up;
        bool is_connected;
        bool being_deleted;
};

/* Called with the rtnl lock held. */
static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev,
                             struct cfg80211_connect_params *sme)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(netdev);
        bool could_schedule;

        if (priv->being_deleted || !priv->is_up)
                return -EBUSY;

        if (!sme->ssid)
                return -EINVAL;

        priv->connect_requested_ssid_len = sme->ssid_len;
        memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len);

        could_schedule = schedule_delayed_work(&priv->connect, HZ * 2);
        if (!could_schedule)
                return -EBUSY;

        if (sme->bssid) {
                ether_addr_copy(priv->connect_requested_bss, sme->bssid);
        } else {
                virt_wifi_inform_bss(wiphy);
                eth_zero_addr(priv->connect_requested_bss);
        }

        wiphy_debug(wiphy, "connect\n");

        return 0;
}

/* Acquires and releases the rdev event lock. */
static void virt_wifi_connect_complete(struct work_struct *work)
{
        struct virt_wifi_netdev_priv *priv =
                container_of(work, struct virt_wifi_netdev_priv, connect.work);
        u8 *requested_bss = priv->connect_requested_bss;
        bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid);
        bool right_ssid = priv->connect_requested_ssid_len == VIRT_WIFI_SSID_LEN &&
                          !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID,
                                  priv->connect_requested_ssid_len);
        u16 status = WLAN_STATUS_SUCCESS;

        if (is_zero_ether_addr(requested_bss))
                requested_bss = NULL;

        if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid)
                status = WLAN_STATUS_UNSPECIFIED_FAILURE;
        else
                priv->is_connected = true;

        /* Schedules an event that acquires the rtnl lock. */
        cfg80211_connect_result(priv->upperdev, requested_bss, NULL, 0, NULL, 0,
                                status, GFP_KERNEL);
        netif_carrier_on(priv->upperdev);
}

/* May acquire and release the rdev event lock. */
static void virt_wifi_cancel_connect(struct net_device *netdev)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(netdev);

        /* If there is work pending, clean up dangling callbacks. */
        if (cancel_delayed_work_sync(&priv->connect)) {
                /* Schedules an event that acquires the rtnl lock. */
                cfg80211_connect_result(priv->upperdev,
                                        priv->connect_requested_bss, NULL, 0,
                                        NULL, 0,
                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
                                        GFP_KERNEL);
        }
}

/* Called with the rtnl lock held. Acquires the rdev event lock. */
static int virt_wifi_disconnect(struct wiphy *wiphy, struct net_device *netdev,
                                u16 reason_code)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(netdev);

        if (priv->being_deleted)
                return -EBUSY;

        wiphy_debug(wiphy, "disconnect\n");
        virt_wifi_cancel_connect(netdev);

        cfg80211_disconnected(netdev, reason_code, NULL, 0, true, GFP_KERNEL);
        priv->is_connected = false;
        netif_carrier_off(netdev);

        return 0;
}

/* Called with the rtnl lock held. */
static int virt_wifi_get_station(struct wiphy *wiphy, struct net_device *dev,
                                 const u8 *mac, struct station_info *sinfo)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);

        wiphy_debug(wiphy, "get_station\n");

        if (!priv->is_connected || !ether_addr_equal(mac, fake_router_bssid))
                return -ENOENT;

        sinfo->filled = BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
                BIT_ULL(NL80211_STA_INFO_TX_FAILED) |
                BIT_ULL(NL80211_STA_INFO_SIGNAL) |
                BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
        sinfo->tx_packets = priv->tx_packets;
        sinfo->tx_failed = priv->tx_failed;
        /* For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_ */
        sinfo->signal = -50;
        sinfo->txrate = (struct rate_info) {
                .legacy = 10, /* units are 100kbit/s */
        };
        return 0;
}

/* Called with the rtnl lock held. */
static int virt_wifi_dump_station(struct wiphy *wiphy, struct net_device *dev,
                                  int idx, u8 *mac, struct station_info *sinfo)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);

        wiphy_debug(wiphy, "dump_station\n");

        if (idx != 0 || !priv->is_connected)
                return -ENOENT;

        ether_addr_copy(mac, fake_router_bssid);
        return virt_wifi_get_station(wiphy, dev, fake_router_bssid, sinfo);
}

static const struct cfg80211_ops virt_wifi_cfg80211_ops = {
        .scan = virt_wifi_scan,

        .connect = virt_wifi_connect,
        .disconnect = virt_wifi_disconnect,

        .get_station = virt_wifi_get_station,
        .dump_station = virt_wifi_dump_station,
};

/* Acquires and releases the rtnl lock. */
static struct wiphy *virt_wifi_make_wiphy(void)
{
        struct wiphy *wiphy;
        struct virt_wifi_wiphy_priv *priv;
        int err;

        wiphy = wiphy_new(&virt_wifi_cfg80211_ops, sizeof(*priv));

        if (!wiphy)
                return NULL;

        wiphy->max_scan_ssids = 4;
        wiphy->max_scan_ie_len = 1000;
        wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;

        wiphy->bands[NL80211_BAND_2GHZ] = &band_2ghz;
        wiphy->bands[NL80211_BAND_5GHZ] = &band_5ghz;
        wiphy->bands[NL80211_BAND_60GHZ] = NULL;

        wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);

        priv = wiphy_priv(wiphy);
        priv->being_deleted = false;
        priv->scan_request = NULL;
        INIT_DELAYED_WORK(&priv->scan_result, virt_wifi_scan_result);

        err = wiphy_register(wiphy);
        if (err < 0) {
                wiphy_free(wiphy);
                return NULL;
        }

        return wiphy;
}

/* Acquires and releases the rtnl lock. */
static void virt_wifi_destroy_wiphy(struct wiphy *wiphy)
{
        struct virt_wifi_wiphy_priv *priv;

        WARN(!wiphy, "%s called with null wiphy", __func__);
        if (!wiphy)
                return;

        priv = wiphy_priv(wiphy);
        priv->being_deleted = true;
        virt_wifi_cancel_scan(wiphy);

        if (wiphy->registered)
                wiphy_unregister(wiphy);
        wiphy_free(wiphy);
}

/* Enters and exits a RCU-bh critical section. */
static netdev_tx_t virt_wifi_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);

        priv->tx_packets++;
        if (!priv->is_connected) {
                priv->tx_failed++;
                return NET_XMIT_DROP;
        }

        skb->dev = priv->lowerdev;
        return dev_queue_xmit(skb);
}

/* Called with rtnl lock held. */
static int virt_wifi_net_device_open(struct net_device *dev)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);

        priv->is_up = true;
        return 0;
}

/* Called with rtnl lock held. */
static int virt_wifi_net_device_stop(struct net_device *dev)
{
        struct virt_wifi_netdev_priv *n_priv = netdev_priv(dev);

        n_priv->is_up = false;

        if (!dev->ieee80211_ptr)
                return 0;

        virt_wifi_cancel_scan(dev->ieee80211_ptr->wiphy);
        virt_wifi_cancel_connect(dev);
        netif_carrier_off(dev);

        return 0;
}

static int virt_wifi_net_device_get_iflink(const struct net_device *dev)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);

        return READ_ONCE(priv->lowerdev->ifindex);
}

static const struct net_device_ops virt_wifi_ops = {
        .ndo_start_xmit = virt_wifi_start_xmit,
        .ndo_open        = virt_wifi_net_device_open,
        .ndo_stop        = virt_wifi_net_device_stop,
        .ndo_get_iflink = virt_wifi_net_device_get_iflink,
};

/* Invoked as part of rtnl lock release. */
static void virt_wifi_net_device_destructor(struct net_device *dev)
{
        /* Delayed past dellink to allow nl80211 to react to the device being
         * deleted.
         */
        kfree(dev->ieee80211_ptr);
        dev->ieee80211_ptr = NULL;
}

/* No lock interaction. */
static void virt_wifi_setup(struct net_device *dev)
{
        ether_setup(dev);
        dev->netdev_ops = &virt_wifi_ops;
        dev->needs_free_netdev  = true;
}

/* Called in a RCU read critical section from netif_receive_skb */
static rx_handler_result_t virt_wifi_rx_handler(struct sk_buff **pskb)
{
        struct sk_buff *skb = *pskb;
        struct virt_wifi_netdev_priv *priv =
                rcu_dereference(skb->dev->rx_handler_data);

        if (!priv->is_connected)
                return RX_HANDLER_PASS;

        /* GFP_ATOMIC because this is a packet interrupt handler. */
        skb = skb_share_check(skb, GFP_ATOMIC);
        if (!skb) {
                dev_err(&priv->upperdev->dev, "can't skb_share_check\n");
                return RX_HANDLER_CONSUMED;
        }

        *pskb = skb;
        skb->dev = priv->upperdev;
        skb->pkt_type = PACKET_HOST;
        return RX_HANDLER_ANOTHER;
}

/* Called with rtnl lock held. */
static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
                             struct nlattr *tb[], struct nlattr *data[],
                             struct netlink_ext_ack *extack)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);
        int err;

        if (!tb[IFLA_LINK])
                return -EINVAL;

        netif_carrier_off(dev);

        priv->upperdev = dev;
        priv->lowerdev = __dev_get_by_index(src_net,
                                            nla_get_u32(tb[IFLA_LINK]));

        if (!priv->lowerdev)
                return -ENODEV;
        if (!tb[IFLA_MTU])
                dev->mtu = priv->lowerdev->mtu;
        else if (dev->mtu > priv->lowerdev->mtu)
                return -EINVAL;

        err = netdev_rx_handler_register(priv->lowerdev, virt_wifi_rx_handler,
                                         priv);
        if (err) {
                dev_err(&priv->lowerdev->dev,
                        "can't netdev_rx_handler_register: %d\n", err);
                return err;
        }

        eth_hw_addr_inherit(dev, priv->lowerdev);
        netif_stacked_transfer_operstate(priv->lowerdev, dev);

        SET_NETDEV_DEV(dev, &priv->lowerdev->dev);
        dev->ieee80211_ptr = kzalloc(sizeof(*dev->ieee80211_ptr), GFP_KERNEL);

        if (!dev->ieee80211_ptr) {
                err = -ENOMEM;
                goto remove_handler;
        }

        dev->ieee80211_ptr->iftype = NL80211_IFTYPE_STATION;
        dev->ieee80211_ptr->wiphy = common_wiphy;

        err = register_netdevice(dev);
        if (err) {
                dev_err(&priv->lowerdev->dev, "can't register_netdevice: %d\n",
                        err);
                goto free_wireless_dev;
        }

        err = netdev_upper_dev_link(priv->lowerdev, dev, extack);
        if (err) {
                dev_err(&priv->lowerdev->dev, "can't netdev_upper_dev_link: %d\n",
                        err);
                goto unregister_netdev;
        }

        dev->priv_destructor = virt_wifi_net_device_destructor;
        priv->being_deleted = false;
        priv->is_connected = false;
        priv->is_up = false;
        INIT_DELAYED_WORK(&priv->connect, virt_wifi_connect_complete);
        __module_get(THIS_MODULE);

        return 0;
unregister_netdev:
        unregister_netdevice(dev);
free_wireless_dev:
        kfree(dev->ieee80211_ptr);
        dev->ieee80211_ptr = NULL;
remove_handler:
        netdev_rx_handler_unregister(priv->lowerdev);

        return err;
}

/* Called with rtnl lock held. */
static void virt_wifi_dellink(struct net_device *dev,
                              struct list_head *head)
{
        struct virt_wifi_netdev_priv *priv = netdev_priv(dev);

        if (dev->ieee80211_ptr)
                virt_wifi_cancel_scan(dev->ieee80211_ptr->wiphy);

        priv->being_deleted = true;
        virt_wifi_cancel_connect(dev);
        netif_carrier_off(dev);

        netdev_rx_handler_unregister(priv->lowerdev);
        netdev_upper_dev_unlink(priv->lowerdev, dev);

        unregister_netdevice_queue(dev, head);
        module_put(THIS_MODULE);

        /* Deleting the wiphy is handled in the module destructor. */
}

static struct rtnl_link_ops virt_wifi_link_ops = {
        .kind                = "virt_wifi",
        .setup                = virt_wifi_setup,
        .newlink        = virt_wifi_newlink,
        .dellink        = virt_wifi_dellink,
        .priv_size        = sizeof(struct virt_wifi_netdev_priv),
};

static bool netif_is_virt_wifi_dev(const struct net_device *dev)
{
        return rcu_access_pointer(dev->rx_handler) == virt_wifi_rx_handler;
}

static int virt_wifi_event(struct notifier_block *this, unsigned long event,
                           void *ptr)
{
        struct net_device *lower_dev = netdev_notifier_info_to_dev(ptr);
        struct virt_wifi_netdev_priv *priv;
        struct net_device *upper_dev;
        LIST_HEAD(list_kill);

        if (!netif_is_virt_wifi_dev(lower_dev))
                return NOTIFY_DONE;

        switch (event) {
        case NETDEV_UNREGISTER:
                priv = rtnl_dereference(lower_dev->rx_handler_data);
                if (!priv)
                        return NOTIFY_DONE;

                upper_dev = priv->upperdev;

                upper_dev->rtnl_link_ops->dellink(upper_dev, &list_kill);
                unregister_netdevice_many(&list_kill);
                break;
        }

        return NOTIFY_DONE;
}

static struct notifier_block virt_wifi_notifier = {
        .notifier_call = virt_wifi_event,
};

/* Acquires and releases the rtnl lock. */
static int __init virt_wifi_init_module(void)
{
        int err;

        /* Guaranteed to be locally-administered and not multicast. */
        eth_random_addr(fake_router_bssid);

        err = register_netdevice_notifier(&virt_wifi_notifier);
        if (err)
                return err;

        err = -ENOMEM;
        common_wiphy = virt_wifi_make_wiphy();
        if (!common_wiphy)
                goto notifier;

        err = rtnl_link_register(&virt_wifi_link_ops);
        if (err)
                goto destroy_wiphy;

        return 0;

destroy_wiphy:
        virt_wifi_destroy_wiphy(common_wiphy);
notifier:
        unregister_netdevice_notifier(&virt_wifi_notifier);
        return err;
}

/* Acquires and releases the rtnl lock. */
static void __exit virt_wifi_cleanup_module(void)
{
        /* Will delete any devices that depend on the wiphy. */
        rtnl_link_unregister(&virt_wifi_link_ops);
        virt_wifi_destroy_wiphy(common_wiphy);
        unregister_netdevice_notifier(&virt_wifi_notifier);
}

module_init(virt_wifi_init_module);
module_exit(virt_wifi_cleanup_module);

MODULE_LICENSE("GPL v2");
MODULE_AUTHOR("Cody Schuffelen <schuffelen@google.com>");
MODULE_DESCRIPTION("Driver for a wireless wrapper of ethernet devices");
MODULE_ALIAS_RTNL_LINK("virt_wifi");























































































































































































    8 



    1 


    8 






    7 






   70 











    1 













   37 














    8 




























  123 





  123 



   78 
   32 
   31 



  123 




















   68 


   69 


   68 







































































































    2 




    6 





    6 





    1 





    2 




    2 




    2 


    1 
    1 



















































   64 


   79 

    1 
    1 
    8 



















   55 


































   55 









   55 




    1 



















   55 



    1 


   43 






   55 
























   32 
   23 









   55 


































   18 













































  231 
  232 




    6 
    4 


    5 
   11 

















    7 



   14 





    2 
   43 


    3 
   11 
   14 














   53 



   54 










  101 









   35 

   84 

    9 





























   18 


















   16 









   13 
























   47 



















   42 


   27 
   14 





   38 





   39 
  211 


   16 















  162 























   28 










  146 









    2 



   46 







  106 
   17 


   75 


    2 

   87 

   34 
   89 



































  162 






    1 


  163 




    1 


  163 



















  164 




































   15 



    2 





   12 





    8 

    7 








































    8 


  170 






















   11 



   58 

    1 
   28 











    3 




   26 




   15 


    7 
















   38 
   38 
   37 





















    8 















   12 

   11 












   28 




   28 



    1 


   26 




   13 










   15 





























   49 





















    8 
   40 


   24 


   23 

















   48 





    1 





























   17 




    5 



    2 















   11 
   12 




























































  217 
   55 
  195 

















   23 

   23 
   23 
   22 
    1 
   23 
   23 

   23 
   11 
   12 

   23 
   11 


   12 
   22 



















   22 







   13 























































   23 






   23 































   37 













   37 


   20 

   18 

   37 







   37 





















   30 



   30 




   25 
   11 



   11 




   11 














   18 




   37 













   37 








    8 

















   18 



























































   67 




























   69 
   69 











































































































   69 














   28 







   22 
    6 



   42 































   69 








    1 





   69 

    8 

    7 


    1 



   63 










    3 




    3 















    6 


   45 

   11 


















   54 










    3 
   53 



















   73 















    3 










    7 




    7 
    7 




















  104 



  105 


  106 

    2 






    1 

















    3 


















   19 




    1 




   18 

























    7 


    1 



    5 

    1 











    1 















    1 























   70 



   70 


















    2 






    2 
















   11 


    3 






    8 




    8 







    8 
















    1 

















    3 


    1 
    1 
    1 





















    3 



    1 

































    2 







    3 



    2 



    1 


















































  263 

  158 







  415 









  418 




  371 



























    2 








    2 






   70 

    1 

   38 



    2 







    2 



    2 
    1 






    2 
    1 


   10 






    7 

    3 

   14 













    9 


  157 
   10 

   42 

  113 
   13 





    1 
  154 



















































    1 







    1 















  742 




  412 





















































































    1 

   10 

   61 
  279 





   56 

   22 
   56 























































































































   49 































   49 



















  118 

   84 
   33 















  129 






























  101 



























  129 















  129 

























  129 




  129 





























  101 


  101 









































































































   69 
   68 
































































































  129 
  100 

  129 









































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
// SPDX-License-Identifier: GPL-2.0
/*
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
 * or rs-channels. It also implements echoing, cooked mode etc.
 *
 * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
 *
 * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
 * tty_struct and tty_queue structures.  Previously there was an array
 * of 256 tty_struct's which was statically allocated, and the
 * tty_queue structures were allocated at boot time.  Both are now
 * dynamically allocated only when the tty is open.
 *
 * Also restructured routines so that there is more of a separation
 * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
 * the low-level tty routines (serial.c, pty.c, console.c).  This
 * makes for cleaner and more compact code.  -TYT, 9/17/92
 *
 * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
 * which can be dynamically activated and de-activated by the line
 * discipline handling modules (like SLIP).
 *
 * NOTE: pay no attention to the line discipline code (yet); its
 * interface is still subject to change in this version...
 * -- TYT, 1/31/92
 *
 * Added functionality to the OPOST tty handling.  No delays, but all
 * other bits should be there.
 *        -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
 *
 * Rewrote canonical mode and added more termios flags.
 *        -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
 *
 * Reorganized FASYNC support so mouse code can share it.
 *        -- ctm@ardi.com, 9Sep95
 *
 * New TIOCLINUX variants added.
 *        -- mj@k332.feld.cvut.cz, 19-Nov-95
 *
 * Restrict vt switching via ioctl()
 *      -- grif@cs.ucr.edu, 5-Dec-95
 *
 * Move console and virtual terminal code to more appropriate files,
 * implement CONFIG_VT and generalize console device interface.
 *        -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
 *
 * Rewrote tty_init_dev and tty_release_dev to eliminate races.
 *        -- Bill Hawes <whawes@star.net>, June 97
 *
 * Added devfs support.
 *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
 *
 * Added support for a Unix98-style ptmx device.
 *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
 *
 * Reduced memory usage for older ARM systems
 *      -- Russell King <rmk@arm.linux.org.uk>
 *
 * Move do_SAK() into process context.  Less stack use in devfs functions.
 * alloc_tty_struct() always uses kmalloc()
 *                         -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
 */

#include <linux/types.h>
#include <linux/major.h>
#include <linux/errno.h>
#include <linux/signal.h>
#include <linux/fcntl.h>
#include <linux/sched/signal.h>
#include <linux/sched/task.h>
#include <linux/interrupt.h>
#include <linux/tty.h>
#include <linux/tty_driver.h>
#include <linux/tty_flip.h>
#include <linux/devpts_fs.h>
#include <linux/file.h>
#include <linux/fdtable.h>
#include <linux/console.h>
#include <linux/timer.h>
#include <linux/ctype.h>
#include <linux/kd.h>
#include <linux/mm.h>
#include <linux/string.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/ppp-ioctl.h>
#include <linux/proc_fs.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/device.h>
#include <linux/wait.h>
#include <linux/bitops.h>
#include <linux/delay.h>
#include <linux/seq_file.h>
#include <linux/serial.h>
#include <linux/ratelimit.h>
#include <linux/compat.h>
#include <linux/uaccess.h>
#include <linux/termios_internal.h>
#include <linux/fs.h>

#include <linux/kbd_kern.h>
#include <linux/vt_kern.h>
#include <linux/selection.h>

#include <linux/kmod.h>
#include <linux/nsproxy.h>
#include "tty.h"

#undef TTY_DEBUG_HANGUP
#ifdef TTY_DEBUG_HANGUP
# define tty_debug_hangup(tty, f, args...)        tty_debug(tty, f, ##args)
#else
# define tty_debug_hangup(tty, f, args...)        do { } while (0)
#endif

#define TTY_PARANOIA_CHECK 1
#define CHECK_TTY_COUNT 1

struct ktermios tty_std_termios = {        /* for the benefit of tty drivers  */
        .c_iflag = ICRNL | IXON,
        .c_oflag = OPOST | ONLCR,
        .c_cflag = B38400 | CS8 | CREAD | HUPCL,
        .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
                   ECHOCTL | ECHOKE | IEXTEN,
        .c_cc = INIT_C_CC,
        .c_ispeed = 38400,
        .c_ospeed = 38400,
        /* .c_line = N_TTY, */
};
EXPORT_SYMBOL(tty_std_termios);

/* This list gets poked at by procfs and various bits of boot up code. This
 * could do with some rationalisation such as pulling the tty proc function
 * into this file.
 */

LIST_HEAD(tty_drivers);                        /* linked list of tty drivers */

/* Mutex to protect creating and releasing a tty */
DEFINE_MUTEX(tty_mutex);

static ssize_t tty_read(struct kiocb *, struct iov_iter *);
static ssize_t tty_write(struct kiocb *, struct iov_iter *);
static __poll_t tty_poll(struct file *, poll_table *);
static int tty_open(struct inode *, struct file *);
#ifdef CONFIG_COMPAT
static long tty_compat_ioctl(struct file *file, unsigned int cmd,
                                unsigned long arg);
#else
#define tty_compat_ioctl NULL
#endif
static int __tty_fasync(int fd, struct file *filp, int on);
static int tty_fasync(int fd, struct file *filp, int on);
static void release_tty(struct tty_struct *tty, int idx);

/**
 * free_tty_struct - free a disused tty
 * @tty: tty struct to free
 *
 * Free the write buffers, tty queue and tty memory itself.
 *
 * Locking: none. Must be called after tty is definitely unused
 */
static void free_tty_struct(struct tty_struct *tty)
{
        tty_ldisc_deinit(tty);
        put_device(tty->dev);
        kvfree(tty->write_buf);
        kfree(tty);
}

static inline struct tty_struct *file_tty(struct file *file)
{
        return ((struct tty_file_private *)file->private_data)->tty;
}

int tty_alloc_file(struct file *file)
{
        struct tty_file_private *priv;

        priv = kmalloc(sizeof(*priv), GFP_KERNEL);
        if (!priv)
                return -ENOMEM;

        file->private_data = priv;

        return 0;
}

/* Associate a new file with the tty structure */
void tty_add_file(struct tty_struct *tty, struct file *file)
{
        struct tty_file_private *priv = file->private_data;

        priv->tty = tty;
        priv->file = file;

        spin_lock(&tty->files_lock);
        list_add(&priv->list, &tty->tty_files);
        spin_unlock(&tty->files_lock);
}

/**
 * tty_free_file - free file->private_data
 * @file: to free private_data of
 *
 * This shall be used only for fail path handling when tty_add_file was not
 * called yet.
 */
void tty_free_file(struct file *file)
{
        struct tty_file_private *priv = file->private_data;

        file->private_data = NULL;
        kfree(priv);
}

/* Delete file from its tty */
static void tty_del_file(struct file *file)
{
        struct tty_file_private *priv = file->private_data;
        struct tty_struct *tty = priv->tty;

        spin_lock(&tty->files_lock);
        list_del(&priv->list);
        spin_unlock(&tty->files_lock);
        tty_free_file(file);
}

/**
 * tty_name - return tty naming
 * @tty: tty structure
 *
 * Convert a tty structure into a name. The name reflects the kernel naming
 * policy and if udev is in use may not reflect user space
 *
 * Locking: none
 */
const char *tty_name(const struct tty_struct *tty)
{
        if (!tty) /* Hmm.  NULL pointer.  That's fun. */
                return "NULL tty";
        return tty->name;
}
EXPORT_SYMBOL(tty_name);

const char *tty_driver_name(const struct tty_struct *tty)
{
        if (!tty || !tty->driver)
                return "";
        return tty->driver->name;
}

static int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
                              const char *routine)
{
#ifdef TTY_PARANOIA_CHECK
        if (!tty) {
                pr_warn("(%d:%d): %s: NULL tty\n",
                        imajor(inode), iminor(inode), routine);
                return 1;
        }
#endif
        return 0;
}

/* Caller must hold tty_lock */
static void check_tty_count(struct tty_struct *tty, const char *routine)
{
#ifdef CHECK_TTY_COUNT
        struct list_head *p;
        int count = 0, kopen_count = 0;

        spin_lock(&tty->files_lock);
        list_for_each(p, &tty->tty_files) {
                count++;
        }
        spin_unlock(&tty->files_lock);
        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
            tty->driver->subtype == PTY_TYPE_SLAVE &&
            tty->link && tty->link->count)
                count++;
        if (tty_port_kopened(tty->port))
                kopen_count++;
        if (tty->count != (count + kopen_count)) {
                tty_warn(tty, "%s: tty->count(%d) != (#fd's(%d) + #kopen's(%d))\n",
                         routine, tty->count, count, kopen_count);
        }
#endif
}

/**
 * get_tty_driver - find device of a tty
 * @device: device identifier
 * @index: returns the index of the tty
 *
 * This routine returns a tty driver structure, given a device number and also
 * passes back the index number.
 *
 * Locking: caller must hold tty_mutex
 */
static struct tty_driver *get_tty_driver(dev_t device, int *index)
{
        struct tty_driver *p;

        list_for_each_entry(p, &tty_drivers, tty_drivers) {
                dev_t base = MKDEV(p->major, p->minor_start);

                if (device < base || device >= base + p->num)
                        continue;
                *index = device - base;
                return tty_driver_kref_get(p);
        }
        return NULL;
}

/**
 * tty_dev_name_to_number - return dev_t for device name
 * @name: user space name of device under /dev
 * @number: pointer to dev_t that this function will populate
 *
 * This function converts device names like ttyS0 or ttyUSB1 into dev_t like
 * (4, 64) or (188, 1). If no corresponding driver is registered then the
 * function returns -%ENODEV.
 *
 * Locking: this acquires tty_mutex to protect the tty_drivers list from
 *        being modified while we are traversing it, and makes sure to
 *        release it before exiting.
 */
int tty_dev_name_to_number(const char *name, dev_t *number)
{
        struct tty_driver *p;
        int ret;
        int index, prefix_length = 0;
        const char *str;

        for (str = name; *str && !isdigit(*str); str++)
                ;

        if (!*str)
                return -EINVAL;

        ret = kstrtoint(str, 10, &index);
        if (ret)
                return ret;

        prefix_length = str - name;

        guard(mutex)(&tty_mutex);

        list_for_each_entry(p, &tty_drivers, tty_drivers)
                if (prefix_length == strlen(p->name) && strncmp(name,
                                        p->name, prefix_length) == 0) {
                        if (index < p->num) {
                                *number = MKDEV(p->major, p->minor_start + index);
                                return 0;
                        }
                }

        return -ENODEV;
}
EXPORT_SYMBOL_GPL(tty_dev_name_to_number);

#ifdef CONFIG_CONSOLE_POLL

/**
 * tty_find_polling_driver - find device of a polled tty
 * @name: name string to match
 * @line: pointer to resulting tty line nr
 *
 * This routine returns a tty driver structure, given a name and the condition
 * that the tty driver is capable of polled operation.
 */
struct tty_driver *tty_find_polling_driver(char *name, int *line)
{
        struct tty_driver *p, *res = NULL;
        int tty_line = 0;
        int len;
        char *str, *stp;

        for (str = name; *str; str++)
                if ((*str >= '0' && *str <= '9') || *str == ',')
                        break;
        if (!*str)
                return NULL;

        len = str - name;
        tty_line = simple_strtoul(str, &str, 10);

        mutex_lock(&tty_mutex);
        /* Search through the tty devices to look for a match */
        list_for_each_entry(p, &tty_drivers, tty_drivers) {
                if (!len || strncmp(name, p->name, len) != 0)
                        continue;
                stp = str;
                if (*stp == ',')
                        stp++;
                if (*stp == '\0')
                        stp = NULL;

                if (tty_line >= 0 && tty_line < p->num && p->ops &&
                    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
                        res = tty_driver_kref_get(p);
                        *line = tty_line;
                        break;
                }
        }
        mutex_unlock(&tty_mutex);

        return res;
}
EXPORT_SYMBOL_GPL(tty_find_polling_driver);
#endif

static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to)
{
        return 0;
}

static ssize_t hung_up_tty_write(struct kiocb *iocb, struct iov_iter *from)
{
        return -EIO;
}

/* No kernel lock held - none needed ;) */
static __poll_t hung_up_tty_poll(struct file *filp, poll_table *wait)
{
        return EPOLLIN | EPOLLOUT | EPOLLERR | EPOLLHUP | EPOLLRDNORM | EPOLLWRNORM;
}

static long hung_up_tty_ioctl(struct file *file, unsigned int cmd,
                unsigned long arg)
{
        return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
}

static long hung_up_tty_compat_ioctl(struct file *file,
                                     unsigned int cmd, unsigned long arg)
{
        return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
}

static int hung_up_tty_fasync(int fd, struct file *file, int on)
{
        return -ENOTTY;
}

static void tty_show_fdinfo(struct seq_file *m, struct file *file)
{
        struct tty_struct *tty = file_tty(file);

        if (tty && tty->ops && tty->ops->show_fdinfo)
                tty->ops->show_fdinfo(tty, m);
}

static const struct file_operations tty_fops = {
        .read_iter        = tty_read,
        .write_iter        = tty_write,
        .splice_read        = copy_splice_read,
        .splice_write        = iter_file_splice_write,
        .poll                = tty_poll,
        .unlocked_ioctl        = tty_ioctl,
        .compat_ioctl        = tty_compat_ioctl,
        .open                = tty_open,
        .release        = tty_release,
        .fasync                = tty_fasync,
        .show_fdinfo        = tty_show_fdinfo,
};

static const struct file_operations console_fops = {
        .read_iter        = tty_read,
        .write_iter        = redirected_tty_write,
        .splice_read        = copy_splice_read,
        .splice_write        = iter_file_splice_write,
        .poll                = tty_poll,
        .unlocked_ioctl        = tty_ioctl,
        .compat_ioctl        = tty_compat_ioctl,
        .open                = tty_open,
        .release        = tty_release,
        .fasync                = tty_fasync,
};

static const struct file_operations hung_up_tty_fops = {
        .read_iter        = hung_up_tty_read,
        .write_iter        = hung_up_tty_write,
        .poll                = hung_up_tty_poll,
        .unlocked_ioctl        = hung_up_tty_ioctl,
        .compat_ioctl        = hung_up_tty_compat_ioctl,
        .release        = tty_release,
        .fasync                = hung_up_tty_fasync,
};

static DEFINE_SPINLOCK(redirect_lock);
static struct file *redirect;

/**
 * tty_wakeup - request more data
 * @tty: terminal
 *
 * Internal and external helper for wakeups of tty. This function informs the
 * line discipline if present that the driver is ready to receive more output
 * data.
 */
void tty_wakeup(struct tty_struct *tty)
{
        struct tty_ldisc *ld;

        if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
                ld = tty_ldisc_ref(tty);
                if (ld) {
                        if (ld->ops->write_wakeup)
                                ld->ops->write_wakeup(tty);
                        tty_ldisc_deref(ld);
                }
        }
        wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
}
EXPORT_SYMBOL_GPL(tty_wakeup);

/**
 * tty_release_redirect - Release a redirect on a pty if present
 * @tty: tty device
 *
 * This is available to the pty code so if the master closes, if the slave is a
 * redirect it can release the redirect.
 */
static struct file *tty_release_redirect(struct tty_struct *tty)
{
        struct file *f = NULL;

        spin_lock(&redirect_lock);
        if (redirect && file_tty(redirect) == tty) {
                f = redirect;
                redirect = NULL;
        }
        spin_unlock(&redirect_lock);

        return f;
}

/**
 * __tty_hangup - actual handler for hangup events
 * @tty: tty device
 * @exit_session: if non-zero, signal all foreground group processes
 *
 * This can be called by a "kworker" kernel thread. That is process synchronous
 * but doesn't hold any locks, so we need to make sure we have the appropriate
 * locks for what we're doing.
 *
 * The hangup event clears any pending redirections onto the hung up device. It
 * ensures future writes will error and it does the needed line discipline
 * hangup and signal delivery. The tty object itself remains intact.
 *
 * Locking:
 *  * BTM
 *
 *   * redirect lock for undoing redirection
 *   * file list lock for manipulating list of ttys
 *   * tty_ldiscs_lock from called functions
 *   * termios_rwsem resetting termios data
 *   * tasklist_lock to walk task list for hangup event
 *
 *    * ->siglock to protect ->signal/->sighand
 *
 */
static void __tty_hangup(struct tty_struct *tty, int exit_session)
{
        struct file *cons_filp = NULL;
        struct file *filp, *f;
        struct tty_file_private *priv;
        int    closecount = 0, n;
        int refs;

        if (!tty)
                return;

        f = tty_release_redirect(tty);

        tty_lock(tty);

        if (test_bit(TTY_HUPPED, &tty->flags)) {
                tty_unlock(tty);
                return;
        }

        /*
         * Some console devices aren't actually hung up for technical and
         * historical reasons, which can lead to indefinite interruptible
         * sleep in n_tty_read().  The following explicitly tells
         * n_tty_read() to abort readers.
         */
        set_bit(TTY_HUPPING, &tty->flags);

        /* inuse_filps is protected by the single tty lock,
         * this really needs to change if we want to flush the
         * workqueue with the lock held.
         */
        check_tty_count(tty, "tty_hangup");

        spin_lock(&tty->files_lock);
        /* This breaks for file handles being sent over AF_UNIX sockets ? */
        list_for_each_entry(priv, &tty->tty_files, list) {
                filp = priv->file;
                if (filp->f_op->write_iter == redirected_tty_write)
                        cons_filp = filp;
                if (filp->f_op->write_iter != tty_write)
                        continue;
                closecount++;
                __tty_fasync(-1, filp, 0);        /* can't block */
                filp->f_op = &hung_up_tty_fops;
        }
        spin_unlock(&tty->files_lock);

        refs = tty_signal_session_leader(tty, exit_session);
        /* Account for the p->signal references we killed */
        while (refs--)
                tty_kref_put(tty);

        tty_ldisc_hangup(tty, cons_filp != NULL);

        spin_lock_irq(&tty->ctrl.lock);
        clear_bit(TTY_THROTTLED, &tty->flags);
        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
        put_pid(tty->ctrl.session);
        put_pid(tty->ctrl.pgrp);
        tty->ctrl.session = NULL;
        tty->ctrl.pgrp = NULL;
        tty->ctrl.pktstatus = 0;
        spin_unlock_irq(&tty->ctrl.lock);

        /*
         * If one of the devices matches a console pointer, we
         * cannot just call hangup() because that will cause
         * tty->count and state->count to go out of sync.
         * So we just call close() the right number of times.
         */
        if (cons_filp) {
                if (tty->ops->close)
                        for (n = 0; n < closecount; n++)
                                tty->ops->close(tty, cons_filp);
        } else if (tty->ops->hangup)
                tty->ops->hangup(tty);
        /*
         * We don't want to have driver/ldisc interactions beyond the ones
         * we did here. The driver layer expects no calls after ->hangup()
         * from the ldisc side, which is now guaranteed.
         */
        set_bit(TTY_HUPPED, &tty->flags);
        clear_bit(TTY_HUPPING, &tty->flags);
        tty_unlock(tty);

        if (f)
                fput(f);
}

static void do_tty_hangup(struct work_struct *work)
{
        struct tty_struct *tty =
                container_of(work, struct tty_struct, hangup_work);

        __tty_hangup(tty, 0);
}

/**
 * tty_hangup - trigger a hangup event
 * @tty: tty to hangup
 *
 * A carrier loss (virtual or otherwise) has occurred on @tty. Schedule a
 * hangup sequence to run after this event.
 */
void tty_hangup(struct tty_struct *tty)
{
        tty_debug_hangup(tty, "hangup\n");
        schedule_work(&tty->hangup_work);
}
EXPORT_SYMBOL(tty_hangup);

/**
 * tty_vhangup - process vhangup
 * @tty: tty to hangup
 *
 * The user has asked via system call for the terminal to be hung up. We do
 * this synchronously so that when the syscall returns the process is complete.
 * That guarantee is necessary for security reasons.
 */
void tty_vhangup(struct tty_struct *tty)
{
        tty_debug_hangup(tty, "vhangup\n");
        __tty_hangup(tty, 0);
}
EXPORT_SYMBOL(tty_vhangup);


/**
 * tty_vhangup_self - process vhangup for own ctty
 *
 * Perform a vhangup on the current controlling tty
 */
void tty_vhangup_self(void)
{
        struct tty_struct *tty;

        tty = get_current_tty();
        if (tty) {
                tty_vhangup(tty);
                tty_kref_put(tty);
        }
}

/**
 * tty_vhangup_session - hangup session leader exit
 * @tty: tty to hangup
 *
 * The session leader is exiting and hanging up its controlling terminal.
 * Every process in the foreground process group is signalled %SIGHUP.
 *
 * We do this synchronously so that when the syscall returns the process is
 * complete. That guarantee is necessary for security reasons.
 */
void tty_vhangup_session(struct tty_struct *tty)
{
        tty_debug_hangup(tty, "session hangup\n");
        __tty_hangup(tty, 1);
}

/**
 * tty_hung_up_p - was tty hung up
 * @filp: file pointer of tty
 *
 * Return: true if the tty has been subject to a vhangup or a carrier loss
 */
int tty_hung_up_p(struct file *filp)
{
        return (filp && filp->f_op == &hung_up_tty_fops);
}
EXPORT_SYMBOL(tty_hung_up_p);

void __stop_tty(struct tty_struct *tty)
{
        if (tty->flow.stopped)
                return;
        tty->flow.stopped = true;
        if (tty->ops->stop)
                tty->ops->stop(tty);
}

/**
 * stop_tty - propagate flow control
 * @tty: tty to stop
 *
 * Perform flow control to the driver. May be called on an already stopped
 * device and will not re-call the &tty_driver->stop() method.
 *
 * This functionality is used by both the line disciplines for halting incoming
 * flow and by the driver. It may therefore be called from any context, may be
 * under the tty %atomic_write_lock but not always.
 *
 * Locking:
 *        flow.lock
 */
void stop_tty(struct tty_struct *tty)
{
        unsigned long flags;

        spin_lock_irqsave(&tty->flow.lock, flags);
        __stop_tty(tty);
        spin_unlock_irqrestore(&tty->flow.lock, flags);
}
EXPORT_SYMBOL(stop_tty);

void __start_tty(struct tty_struct *tty)
{
        if (!tty->flow.stopped || tty->flow.tco_stopped)
                return;
        tty->flow.stopped = false;
        if (tty->ops->start)
                tty->ops->start(tty);
        tty_wakeup(tty);
}

/**
 * start_tty - propagate flow control
 * @tty: tty to start
 *
 * Start a tty that has been stopped if at all possible. If @tty was previously
 * stopped and is now being started, the &tty_driver->start() method is invoked
 * and the line discipline woken.
 *
 * Locking:
 *        flow.lock
 */
void start_tty(struct tty_struct *tty)
{
        unsigned long flags;

        spin_lock_irqsave(&tty->flow.lock, flags);
        __start_tty(tty);
        spin_unlock_irqrestore(&tty->flow.lock, flags);
}
EXPORT_SYMBOL(start_tty);

static void tty_update_time(struct tty_struct *tty, bool mtime)
{
        time64_t sec = ktime_get_real_seconds();
        struct tty_file_private *priv;

        spin_lock(&tty->files_lock);
        list_for_each_entry(priv, &tty->tty_files, list) {
                struct inode *inode = file_inode(priv->file);
                struct timespec64 time = mtime ? inode_get_mtime(inode) : inode_get_atime(inode);

                /*
                 * We only care if the two values differ in anything other than the
                 * lower three bits (i.e every 8 seconds).  If so, then we can update
                 * the time of the tty device, otherwise it could be construded as a
                 * security leak to let userspace know the exact timing of the tty.
                 */
                if ((sec ^ time.tv_sec) & ~7) {
                        if (mtime)
                                inode_set_mtime(inode, sec, 0);
                        else
                                inode_set_atime(inode, sec, 0);
                }
        }
        spin_unlock(&tty->files_lock);
}

/*
 * Iterate on the ldisc ->read() function until we've gotten all
 * the data the ldisc has for us.
 *
 * The "cookie" is something that the ldisc read function can fill
 * in to let us know that there is more data to be had.
 *
 * We promise to continue to call the ldisc until it stops returning
 * data or clears the cookie. The cookie may be something that the
 * ldisc maintains state for and needs to free.
 */
static ssize_t iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
                                struct file *file, struct iov_iter *to)
{
        void *cookie = NULL;
        unsigned long offset = 0;
        ssize_t retval = 0;
        size_t copied, count = iov_iter_count(to);
        u8 kernel_buf[64];

        do {
                ssize_t size = min(count, sizeof(kernel_buf));

                size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
                if (!size)
                        break;

                if (size < 0) {
                        /* Did we have an earlier error (ie -EFAULT)? */
                        if (retval)
                                break;
                        retval = size;

                        /*
                         * -EOVERFLOW means we didn't have enough space
                         * for a whole packet, and we shouldn't return
                         * a partial result.
                         */
                        if (retval == -EOVERFLOW)
                                offset = 0;
                        break;
                }

                copied = copy_to_iter(kernel_buf, size, to);
                offset += copied;
                count -= copied;

                /*
                 * If the user copy failed, we still need to do another ->read()
                 * call if we had a cookie to let the ldisc clear up.
                 *
                 * But make sure size is zeroed.
                 */
                if (unlikely(copied != size)) {
                        count = 0;
                        retval = -EFAULT;
                }
        } while (cookie);

        /* We always clear tty buffer in case they contained passwords */
        memzero_explicit(kernel_buf, sizeof(kernel_buf));
        return offset ? offset : retval;
}


/**
 * tty_read - read method for tty device files
 * @iocb: kernel I/O control block
 * @to: destination for the data read
 *
 * Perform the read system call function on this terminal device. Checks
 * for hung up devices before calling the line discipline method.
 *
 * Locking:
 *        Locks the line discipline internally while needed. Multiple read calls
 *        may be outstanding in parallel.
 */
static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
{
        struct file *file = iocb->ki_filp;
        struct inode *inode = file_inode(file);
        struct tty_struct *tty = file_tty(file);
        struct tty_ldisc *ld;
        ssize_t ret;

        if (tty_paranoia_check(tty, inode, "tty_read"))
                return -EIO;
        if (!tty || tty_io_error(tty))
                return -EIO;

        /* We want to wait for the line discipline to sort out in this
         * situation.
         */
        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return hung_up_tty_read(iocb, to);
        ret = -EIO;
        if (ld->ops->read)
                ret = iterate_tty_read(ld, tty, file, to);
        tty_ldisc_deref(ld);

        if (ret > 0)
                tty_update_time(tty, false);

        return ret;
}

void tty_write_unlock(struct tty_struct *tty)
{
        mutex_unlock(&tty->atomic_write_lock);
        wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
}

int tty_write_lock(struct tty_struct *tty, bool ndelay)
{
        if (!mutex_trylock(&tty->atomic_write_lock)) {
                if (ndelay)
                        return -EAGAIN;
                if (mutex_lock_interruptible(&tty->atomic_write_lock))
                        return -ERESTARTSYS;
        }
        return 0;
}

/*
 * Split writes up in sane blocksizes to avoid
 * denial-of-service type attacks
 */
static ssize_t iterate_tty_write(struct tty_ldisc *ld, struct tty_struct *tty,
                                 struct file *file, struct iov_iter *from)
{
        size_t chunk, count = iov_iter_count(from);
        ssize_t ret, written = 0;

        ret = tty_write_lock(tty, file->f_flags & O_NDELAY);
        if (ret < 0)
                return ret;

        /*
         * We chunk up writes into a temporary buffer. This
         * simplifies low-level drivers immensely, since they
         * don't have locking issues and user mode accesses.
         *
         * But if TTY_NO_WRITE_SPLIT is set, we should use a
         * big chunk-size..
         *
         * The default chunk-size is 2kB, because the NTTY
         * layer has problems with bigger chunks. It will
         * claim to be able to handle more characters than
         * it actually does.
         */
        chunk = 2048;
        if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
                chunk = 65536;
        if (count < chunk)
                chunk = count;

        /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
        if (tty->write_cnt < chunk) {
                u8 *buf_chunk;

                if (chunk < 1024)
                        chunk = 1024;

                buf_chunk = kvmalloc(chunk, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
                if (!buf_chunk) {
                        ret = -ENOMEM;
                        goto out;
                }
                kvfree(tty->write_buf);
                tty->write_cnt = chunk;
                tty->write_buf = buf_chunk;
        }

        /* Do the write .. */
        for (;;) {
                size_t size = min(chunk, count);

                ret = -EFAULT;
                if (copy_from_iter(tty->write_buf, size, from) != size)
                        break;

                ret = ld->ops->write(tty, file, tty->write_buf, size);
                if (ret <= 0)
                        break;

                written += ret;
                if (ret > size)
                        break;

                /* FIXME! Have Al check this! */
                if (ret != size)
                        iov_iter_revert(from, size-ret);

                count -= ret;
                if (!count)
                        break;
                ret = -ERESTARTSYS;
                if (signal_pending(current))
                        break;
                cond_resched();
        }
        if (written) {
                tty_update_time(tty, true);
                ret = written;
        }
out:
        tty_write_unlock(tty);
        return ret;
}

#ifdef CONFIG_PRINT_QUOTA_WARNING
/**
 * tty_write_message - write a message to a certain tty, not just the console.
 * @tty: the destination tty_struct
 * @msg: the message to write
 *
 * This is used for messages that need to be redirected to a specific tty. We
 * don't put it into the syslog queue right now maybe in the future if really
 * needed.
 *
 * We must still hold the BTM and test the CLOSING flag for the moment.
 *
 * This function is DEPRECATED, do not use in new code.
 */
void tty_write_message(struct tty_struct *tty, char *msg)
{
        if (tty) {
                mutex_lock(&tty->atomic_write_lock);
                tty_lock(tty);
                if (tty->ops->write && tty->count > 0)
                        tty->ops->write(tty, msg, strlen(msg));
                tty_unlock(tty);
                tty_write_unlock(tty);
        }
}
#endif

static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
{
        struct tty_struct *tty = file_tty(file);
        struct tty_ldisc *ld;
        ssize_t ret;

        if (tty_paranoia_check(tty, file_inode(file), "tty_write"))
                return -EIO;
        if (!tty || !tty->ops->write ||        tty_io_error(tty))
                return -EIO;
        /* Short term debug to catch buggy drivers */
        if (tty->ops->write_room == NULL)
                tty_err(tty, "missing write_room method\n");
        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return hung_up_tty_write(iocb, from);
        if (!ld->ops->write)
                ret = -EIO;
        else
                ret = iterate_tty_write(ld, tty, file, from);
        tty_ldisc_deref(ld);
        return ret;
}

/**
 * tty_write - write method for tty device file
 * @iocb: kernel I/O control block
 * @from: iov_iter with data to write
 *
 * Write data to a tty device via the line discipline.
 *
 * Locking:
 *        Locks the line discipline as required
 *        Writes to the tty driver are serialized by the atomic_write_lock
 *        and are then processed in chunks to the device. The line
 *        discipline write method will not be invoked in parallel for
 *        each device.
 */
static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
{
        return file_tty_write(iocb->ki_filp, iocb, from);
}

ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
{
        struct file *p = NULL;

        spin_lock(&redirect_lock);
        if (redirect)
                p = get_file(redirect);
        spin_unlock(&redirect_lock);

        /*
         * We know the redirected tty is just another tty, we can
         * call file_tty_write() directly with that file pointer.
         */
        if (p) {
                ssize_t res;

                res = file_tty_write(p, iocb, iter);
                fput(p);
                return res;
        }
        return tty_write(iocb, iter);
}

/**
 * tty_send_xchar - send priority character
 * @tty: the tty to send to
 * @ch: xchar to send
 *
 * Send a high priority character to the tty even if stopped.
 *
 * Locking: none for xchar method, write ordering for write method.
 */
int tty_send_xchar(struct tty_struct *tty, u8 ch)
{
        bool was_stopped = tty->flow.stopped;

        if (tty->ops->send_xchar) {
                down_read(&tty->termios_rwsem);
                tty->ops->send_xchar(tty, ch);
                up_read(&tty->termios_rwsem);
                return 0;
        }

        if (tty_write_lock(tty, false) < 0)
                return -ERESTARTSYS;

        down_read(&tty->termios_rwsem);
        if (was_stopped)
                start_tty(tty);
        tty->ops->write(tty, &ch, 1);
        if (was_stopped)
                stop_tty(tty);
        up_read(&tty->termios_rwsem);
        tty_write_unlock(tty);
        return 0;
}

/**
 * pty_line_name - generate name for a pty
 * @driver: the tty driver in use
 * @index: the minor number
 * @p: output buffer of at least 6 bytes
 *
 * Generate a name from a @driver reference and write it to the output buffer
 * @p.
 *
 * Locking: None
 */
static void pty_line_name(struct tty_driver *driver, int index, char *p)
{
        static const char ptychar[] = "pqrstuvwxyzabcde";
        int i = index + driver->name_base;
        /* ->name is initialized to "ttyp", but "tty" is expected */
        sprintf(p, "%s%c%x",
                driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
                ptychar[i >> 4 & 0xf], i & 0xf);
}

/**
 * tty_line_name - generate name for a tty
 * @driver: the tty driver in use
 * @index: the minor number
 * @p: output buffer of at least 7 bytes
 *
 * Generate a name from a @driver reference and write it to the output buffer
 * @p.
 *
 * Locking: None
 */
static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
{
        if (driver->flags & TTY_DRIVER_UNNUMBERED_NODE)
                return sprintf(p, "%s", driver->name);
        else
                return sprintf(p, "%s%d", driver->name,
                               index + driver->name_base);
}

/**
 * tty_driver_lookup_tty() - find an existing tty, if any
 * @driver: the driver for the tty
 * @file: file object
 * @idx: the minor number
 *
 * Return: the tty, if found. If not found, return %NULL or ERR_PTR() if the
 * driver lookup() method returns an error.
 *
 * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
 */
static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
                struct file *file, int idx)
{
        struct tty_struct *tty;

        if (driver->ops->lookup) {
                if (!file)
                        tty = ERR_PTR(-EIO);
                else
                        tty = driver->ops->lookup(driver, file, idx);
        } else {
                if (idx >= driver->num)
                        return ERR_PTR(-EINVAL);
                tty = driver->ttys[idx];
        }
        if (!IS_ERR(tty))
                tty_kref_get(tty);
        return tty;
}

/**
 * tty_init_termios - helper for termios setup
 * @tty: the tty to set up
 *
 * Initialise the termios structure for this tty. This runs under the
 * %tty_mutex currently so we can be relaxed about ordering.
 */
void tty_init_termios(struct tty_struct *tty)
{
        struct ktermios *tp;
        int idx = tty->index;

        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
                tty->termios = tty->driver->init_termios;
        else {
                /* Check for lazy saved data */
                tp = tty->driver->termios[idx];
                if (tp != NULL) {
                        tty->termios = *tp;
                        tty->termios.c_line  = tty->driver->init_termios.c_line;
                } else
                        tty->termios = tty->driver->init_termios;
        }
        /* Compatibility until drivers always set this */
        tty->termios.c_ispeed = tty_termios_input_baud_rate(&tty->termios);
        tty->termios.c_ospeed = tty_termios_baud_rate(&tty->termios);
}
EXPORT_SYMBOL_GPL(tty_init_termios);

/**
 * tty_standard_install - usual tty->ops->install
 * @driver: the driver for the tty
 * @tty: the tty
 *
 * If the @driver overrides @tty->ops->install, it still can call this function
 * to perform the standard install operations.
 */
int tty_standard_install(struct tty_driver *driver, struct tty_struct *tty)
{
        tty_init_termios(tty);
        tty_driver_kref_get(driver);
        tty->count++;
        driver->ttys[tty->index] = tty;
        return 0;
}
EXPORT_SYMBOL_GPL(tty_standard_install);

/**
 * tty_driver_install_tty() - install a tty entry in the driver
 * @driver: the driver for the tty
 * @tty: the tty
 *
 * Install a tty object into the driver tables. The @tty->index field will be
 * set by the time this is called. This method is responsible for ensuring any
 * need additional structures are allocated and configured.
 *
 * Locking: tty_mutex for now
 */
static int tty_driver_install_tty(struct tty_driver *driver,
                                                struct tty_struct *tty)
{
        return driver->ops->install ? driver->ops->install(driver, tty) :
                tty_standard_install(driver, tty);
}

/**
 * tty_driver_remove_tty() - remove a tty from the driver tables
 * @driver: the driver for the tty
 * @tty: tty to remove
 *
 * Remove a tty object from the driver tables. The tty->index field will be set
 * by the time this is called.
 *
 * Locking: tty_mutex for now
 */
static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
{
        if (driver->ops->remove)
                driver->ops->remove(driver, tty);
        else
                driver->ttys[tty->index] = NULL;
}

/**
 * tty_reopen() - fast re-open of an open tty
 * @tty: the tty to open
 *
 * Re-opens on master ptys are not allowed and return -%EIO.
 *
 * Locking: Caller must hold tty_lock
 * Return: 0 on success, -errno on error.
 */
static int tty_reopen(struct tty_struct *tty)
{
        struct tty_driver *driver = tty->driver;
        struct tty_ldisc *ld;
        int retval = 0;

        if (driver->type == TTY_DRIVER_TYPE_PTY &&
            driver->subtype == PTY_TYPE_MASTER)
                return -EIO;

        if (!tty->count)
                return -EAGAIN;

        if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
                return -EBUSY;

        ld = tty_ldisc_ref_wait(tty);
        if (ld) {
                tty_ldisc_deref(ld);
        } else {
                retval = tty_ldisc_lock(tty, 5 * HZ);
                if (retval)
                        return retval;

                if (!tty->ldisc)
                        retval = tty_ldisc_reinit(tty, tty->termios.c_line);
                tty_ldisc_unlock(tty);
        }

        if (retval == 0)
                tty->count++;

        return retval;
}

/**
 * tty_init_dev - initialise a tty device
 * @driver: tty driver we are opening a device on
 * @idx: device index
 *
 * Prepare a tty device. This may not be a "new" clean device but could also be
 * an active device. The pty drivers require special handling because of this.
 *
 * Locking:
 *        The function is called under the tty_mutex, which protects us from the
 *        tty struct or driver itself going away.
 *
 * On exit the tty device has the line discipline attached and a reference
 * count of 1. If a pair was created for pty/tty use and the other was a pty
 * master then it too has a reference count of 1.
 *
 * WSH 06/09/97: Rewritten to remove races and properly clean up after a failed
 * open. The new code protects the open with a mutex, so it's really quite
 * straightforward. The mutex locking can probably be relaxed for the (most
 * common) case of reopening a tty.
 *
 * Return: new tty structure
 */
struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx)
{
        struct tty_struct *tty;
        int retval;

        /*
         * First time open is complex, especially for PTY devices.
         * This code guarantees that either everything succeeds and the
         * TTY is ready for operation, or else the table slots are vacated
         * and the allocated memory released.  (Except that the termios
         * may be retained.)
         */

        if (!try_module_get(driver->owner))
                return ERR_PTR(-ENODEV);

        tty = alloc_tty_struct(driver, idx);
        if (!tty) {
                retval = -ENOMEM;
                goto err_module_put;
        }

        tty_lock(tty);
        retval = tty_driver_install_tty(driver, tty);
        if (retval < 0)
                goto err_free_tty;

        if (!tty->port)
                tty->port = driver->ports[idx];

        if (WARN_RATELIMIT(!tty->port,
                        "%s: %s driver does not set tty->port. This would crash the kernel. Fix the driver!\n",
                        __func__, tty->driver->name)) {
                retval = -EINVAL;
                goto err_release_lock;
        }

        retval = tty_ldisc_lock(tty, 5 * HZ);
        if (retval)
                goto err_release_lock;
        tty->port->itty = tty;

        /*
         * Structures all installed ... call the ldisc open routines.
         * If we fail here just call release_tty to clean up.  No need
         * to decrement the use counts, as release_tty doesn't care.
         */
        retval = tty_ldisc_setup(tty, tty->link);
        if (retval)
                goto err_release_tty;
        tty_ldisc_unlock(tty);
        /* Return the tty locked so that it cannot vanish under the caller */
        return tty;

err_free_tty:
        tty_unlock(tty);
        free_tty_struct(tty);
err_module_put:
        module_put(driver->owner);
        return ERR_PTR(retval);

        /* call the tty release_tty routine to clean out this slot */
err_release_tty:
        tty_ldisc_unlock(tty);
        tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
                             retval, idx);
err_release_lock:
        tty_unlock(tty);
        release_tty(tty, idx);
        return ERR_PTR(retval);
}

/**
 * tty_save_termios() - save tty termios data in driver table
 * @tty: tty whose termios data to save
 *
 * Locking: Caller guarantees serialisation with tty_init_termios().
 */
void tty_save_termios(struct tty_struct *tty)
{
        struct ktermios *tp;
        int idx = tty->index;

        /* If the port is going to reset then it has no termios to save */
        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
                return;

        /* Stash the termios data */
        tp = tty->driver->termios[idx];
        if (tp == NULL) {
                tp = kmalloc(sizeof(*tp), GFP_KERNEL);
                if (tp == NULL)
                        return;
                tty->driver->termios[idx] = tp;
        }
        *tp = tty->termios;
}
EXPORT_SYMBOL_GPL(tty_save_termios);

/**
 * tty_flush_works - flush all works of a tty/pty pair
 * @tty: tty device to flush works for (or either end of a pty pair)
 *
 * Sync flush all works belonging to @tty (and the 'other' tty).
 */
static void tty_flush_works(struct tty_struct *tty)
{
        flush_work(&tty->SAK_work);
        flush_work(&tty->hangup_work);
        if (tty->link) {
                flush_work(&tty->link->SAK_work);
                flush_work(&tty->link->hangup_work);
        }
}

/**
 * release_one_tty - release tty structure memory
 * @work: work of tty we are obliterating
 *
 * Releases memory associated with a tty structure, and clears out the
 * driver table slots. This function is called when a device is no longer
 * in use. It also gets called when setup of a device fails.
 *
 * Locking:
 *        takes the file list lock internally when working on the list of ttys
 *        that the driver keeps.
 *
 * This method gets called from a work queue so that the driver private
 * cleanup ops can sleep (needed for USB at least)
 */
static void release_one_tty(struct work_struct *work)
{
        struct tty_struct *tty =
                container_of(work, struct tty_struct, hangup_work);
        struct tty_driver *driver = tty->driver;
        struct module *owner = driver->owner;

        if (tty->ops->cleanup)
                tty->ops->cleanup(tty);

        tty_driver_kref_put(driver);
        module_put(owner);

        spin_lock(&tty->files_lock);
        list_del_init(&tty->tty_files);
        spin_unlock(&tty->files_lock);

        put_pid(tty->ctrl.pgrp);
        put_pid(tty->ctrl.session);
        free_tty_struct(tty);
}

static void queue_release_one_tty(struct kref *kref)
{
        struct tty_struct *tty = container_of(kref, struct tty_struct, kref);

        /* The hangup queue is now free so we can reuse it rather than
         *  waste a chunk of memory for each port.
         */
        INIT_WORK(&tty->hangup_work, release_one_tty);
        schedule_work(&tty->hangup_work);
}

/**
 * tty_kref_put - release a tty kref
 * @tty: tty device
 *
 * Release a reference to the @tty device and if need be let the kref layer
 * destruct the object for us.
 */
void tty_kref_put(struct tty_struct *tty)
{
        if (tty)
                kref_put(&tty->kref, queue_release_one_tty);
}
EXPORT_SYMBOL(tty_kref_put);

/**
 * release_tty - release tty structure memory
 * @tty: tty device release
 * @idx: index of the tty device release
 *
 * Release both @tty and a possible linked partner (think pty pair),
 * and decrement the refcount of the backing module.
 *
 * Locking:
 *        tty_mutex
 *        takes the file list lock internally when working on the list of ttys
 *        that the driver keeps.
 */
static void release_tty(struct tty_struct *tty, int idx)
{
        /* This should always be true but check for the moment */
        WARN_ON(tty->index != idx);
        WARN_ON(!mutex_is_locked(&tty_mutex));
        if (tty->ops->shutdown)
                tty->ops->shutdown(tty);
        tty_save_termios(tty);
        tty_driver_remove_tty(tty->driver, tty);
        if (tty->port)
                tty->port->itty = NULL;
        if (tty->link)
                tty->link->port->itty = NULL;
        if (tty->port)
                tty_buffer_cancel_work(tty->port);
        if (tty->link)
                tty_buffer_cancel_work(tty->link->port);

        tty_kref_put(tty->link);
        tty_kref_put(tty);
}

/**
 * tty_release_checks - check a tty before real release
 * @tty: tty to check
 * @idx: index of the tty
 *
 * Performs some paranoid checking before true release of the @tty. This is a
 * no-op unless %TTY_PARANOIA_CHECK is defined.
 */
static int tty_release_checks(struct tty_struct *tty, int idx)
{
#ifdef TTY_PARANOIA_CHECK
        if (idx < 0 || idx >= tty->driver->num) {
                tty_debug(tty, "bad idx %d\n", idx);
                return -1;
        }

        /* not much to check for devpts */
        if (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)
                return 0;

        if (tty != tty->driver->ttys[idx]) {
                tty_debug(tty, "bad driver table[%d] = %p\n",
                          idx, tty->driver->ttys[idx]);
                return -1;
        }
        if (tty->driver->other) {
                struct tty_struct *o_tty = tty->link;

                if (o_tty != tty->driver->other->ttys[idx]) {
                        tty_debug(tty, "bad other table[%d] = %p\n",
                                  idx, tty->driver->other->ttys[idx]);
                        return -1;
                }
                if (o_tty->link != tty) {
                        tty_debug(tty, "bad link = %p\n", o_tty->link);
                        return -1;
                }
        }
#endif
        return 0;
}

/**
 * tty_kclose - closes tty opened by tty_kopen
 * @tty: tty device
 *
 * Performs the final steps to release and free a tty device. It is the same as
 * tty_release_struct() except that it also resets %TTY_PORT_KOPENED flag on
 * @tty->port.
 */
void tty_kclose(struct tty_struct *tty)
{
        /*
         * Ask the line discipline code to release its structures
         */
        tty_ldisc_release(tty);

        /* Wait for pending work before tty destruction commences */
        tty_flush_works(tty);

        tty_debug_hangup(tty, "freeing structure\n");
        /*
         * The release_tty function takes care of the details of clearing
         * the slots and preserving the termios structure.
         */
        mutex_lock(&tty_mutex);
        tty_port_set_kopened(tty->port, 0);
        release_tty(tty, tty->index);
        mutex_unlock(&tty_mutex);
}
EXPORT_SYMBOL_GPL(tty_kclose);

/**
 * tty_release_struct - release a tty struct
 * @tty: tty device
 * @idx: index of the tty
 *
 * Performs the final steps to release and free a tty device. It is roughly the
 * reverse of tty_init_dev().
 */
void tty_release_struct(struct tty_struct *tty, int idx)
{
        /*
         * Ask the line discipline code to release its structures
         */
        tty_ldisc_release(tty);

        /* Wait for pending work before tty destruction commmences */
        tty_flush_works(tty);

        tty_debug_hangup(tty, "freeing structure\n");
        /*
         * The release_tty function takes care of the details of clearing
         * the slots and preserving the termios structure.
         */
        mutex_lock(&tty_mutex);
        release_tty(tty, idx);
        mutex_unlock(&tty_mutex);
}
EXPORT_SYMBOL_GPL(tty_release_struct);

/**
 * tty_release - vfs callback for close
 * @inode: inode of tty
 * @filp: file pointer for handle to tty
 *
 * Called the last time each file handle is closed that references this tty.
 * There may however be several such references.
 *
 * Locking:
 *        Takes BKL. See tty_release_dev().
 *
 * Even releasing the tty structures is a tricky business. We have to be very
 * careful that the structures are all released at the same time, as interrupts
 * might otherwise get the wrong pointers.
 *
 * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
 * lead to double frees or releasing memory still in use.
 */
int tty_release(struct inode *inode, struct file *filp)
{
        struct tty_struct *tty = file_tty(filp);
        struct tty_struct *o_tty = NULL;
        int        do_sleep, final;
        int        idx;
        long        timeout = 0;
        int        once = 1;

        if (tty_paranoia_check(tty, inode, __func__))
                return 0;

        tty_lock(tty);
        check_tty_count(tty, __func__);

        __tty_fasync(-1, filp, 0);

        idx = tty->index;
        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
            tty->driver->subtype == PTY_TYPE_MASTER)
                o_tty = tty->link;

        if (tty_release_checks(tty, idx)) {
                tty_unlock(tty);
                return 0;
        }

        tty_debug_hangup(tty, "releasing (count=%d)\n", tty->count);

        if (tty->ops->close)
                tty->ops->close(tty, filp);

        /* If tty is pty master, lock the slave pty (stable lock order) */
        tty_lock_slave(o_tty);

        /*
         * Sanity check: if tty->count is going to zero, there shouldn't be
         * any waiters on tty->read_wait or tty->write_wait.  We test the
         * wait queues and kick everyone out _before_ actually starting to
         * close.  This ensures that we won't block while releasing the tty
         * structure.
         *
         * The test for the o_tty closing is necessary, since the master and
         * slave sides may close in any order.  If the slave side closes out
         * first, its count will be one, since the master side holds an open.
         * Thus this test wouldn't be triggered at the time the slave closed,
         * so we do it now.
         */
        while (1) {
                do_sleep = 0;

                if (tty->count <= 1) {
                        if (waitqueue_active(&tty->read_wait)) {
                                wake_up_poll(&tty->read_wait, EPOLLIN);
                                do_sleep++;
                        }
                        if (waitqueue_active(&tty->write_wait)) {
                                wake_up_poll(&tty->write_wait, EPOLLOUT);
                                do_sleep++;
                        }
                }
                if (o_tty && o_tty->count <= 1) {
                        if (waitqueue_active(&o_tty->read_wait)) {
                                wake_up_poll(&o_tty->read_wait, EPOLLIN);
                                do_sleep++;
                        }
                        if (waitqueue_active(&o_tty->write_wait)) {
                                wake_up_poll(&o_tty->write_wait, EPOLLOUT);
                                do_sleep++;
                        }
                }
                if (!do_sleep)
                        break;

                if (once) {
                        once = 0;
                        tty_warn(tty, "read/write wait queue active!\n");
                }
                schedule_timeout_killable(timeout);
                if (timeout < 120 * HZ)
                        timeout = 2 * timeout + 1;
                else
                        timeout = MAX_SCHEDULE_TIMEOUT;
        }

        if (o_tty) {
                if (--o_tty->count < 0) {
                        tty_warn(tty, "bad slave count (%d)\n", o_tty->count);
                        o_tty->count = 0;
                }
        }
        if (--tty->count < 0) {
                tty_warn(tty, "bad tty->count (%d)\n", tty->count);
                tty->count = 0;
        }

        /*
         * We've decremented tty->count, so we need to remove this file
         * descriptor off the tty->tty_files list; this serves two
         * purposes:
         *  - check_tty_count sees the correct number of file descriptors
         *    associated with this tty.
         *  - do_tty_hangup no longer sees this file descriptor as
         *    something that needs to be handled for hangups.
         */
        tty_del_file(filp);

        /*
         * Perform some housekeeping before deciding whether to return.
         *
         * If _either_ side is closing, make sure there aren't any
         * processes that still think tty or o_tty is their controlling
         * tty.
         */
        if (!tty->count) {
                read_lock(&tasklist_lock);
                session_clear_tty(tty->ctrl.session);
                if (o_tty)
                        session_clear_tty(o_tty->ctrl.session);
                read_unlock(&tasklist_lock);
        }

        /* check whether both sides are closing ... */
        final = !tty->count && !(o_tty && o_tty->count);

        tty_unlock_slave(o_tty);
        tty_unlock(tty);

        /* At this point, the tty->count == 0 should ensure a dead tty
         * cannot be re-opened by a racing opener.
         */

        if (!final)
                return 0;

        tty_debug_hangup(tty, "final close\n");

        tty_release_struct(tty, idx);
        return 0;
}

/**
 * tty_open_current_tty - get locked tty of current task
 * @device: device number
 * @filp: file pointer to tty
 * @return: locked tty of the current task iff @device is /dev/tty
 *
 * Performs a re-open of the current task's controlling tty.
 *
 * We cannot return driver and index like for the other nodes because devpts
 * will not work then. It expects inodes to be from devpts FS.
 */
static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
{
        struct tty_struct *tty;
        int retval;

        if (device != MKDEV(TTYAUX_MAJOR, 0))
                return NULL;

        tty = get_current_tty();
        if (!tty)
                return ERR_PTR(-ENXIO);

        filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
        /* noctty = 1; */
        tty_lock(tty);
        tty_kref_put(tty);        /* safe to drop the kref now */

        retval = tty_reopen(tty);
        if (retval < 0) {
                tty_unlock(tty);
                tty = ERR_PTR(retval);
        }
        return tty;
}

/**
 * tty_lookup_driver - lookup a tty driver for a given device file
 * @device: device number
 * @filp: file pointer to tty
 * @index: index for the device in the @return driver
 *
 * If returned value is not erroneous, the caller is responsible to decrement
 * the refcount by tty_driver_kref_put().
 *
 * Locking: %tty_mutex protects get_tty_driver()
 *
 * Return: driver for this inode (with increased refcount)
 */
static struct tty_driver *tty_lookup_driver(dev_t device, struct file *filp,
                int *index)
{
        struct tty_driver *driver = NULL;

        switch (device) {
#ifdef CONFIG_VT
        case MKDEV(TTY_MAJOR, 0): {
                extern struct tty_driver *console_driver;

                driver = tty_driver_kref_get(console_driver);
                *index = fg_console;
                break;
        }
#endif
        case MKDEV(TTYAUX_MAJOR, 1): {
                struct tty_driver *console_driver = console_device(index);

                if (console_driver) {
                        driver = tty_driver_kref_get(console_driver);
                        if (driver && filp) {
                                /* Don't let /dev/console block */
                                filp->f_flags |= O_NONBLOCK;
                                break;
                        }
                }
                if (driver)
                        tty_driver_kref_put(driver);
                return ERR_PTR(-ENODEV);
        }
        default:
                driver = get_tty_driver(device, index);
                if (!driver)
                        return ERR_PTR(-ENODEV);
                break;
        }
        return driver;
}

static struct tty_struct *tty_kopen(dev_t device, int shared)
{
        struct tty_struct *tty;
        struct tty_driver *driver;
        int index = -1;

        mutex_lock(&tty_mutex);
        driver = tty_lookup_driver(device, NULL, &index);
        if (IS_ERR(driver)) {
                mutex_unlock(&tty_mutex);
                return ERR_CAST(driver);
        }

        /* check whether we're reopening an existing tty */
        tty = tty_driver_lookup_tty(driver, NULL, index);
        if (IS_ERR(tty) || shared)
                goto out;

        if (tty) {
                /* drop kref from tty_driver_lookup_tty() */
                tty_kref_put(tty);
                tty = ERR_PTR(-EBUSY);
        } else { /* tty_init_dev returns tty with the tty_lock held */
                tty = tty_init_dev(driver, index);
                if (IS_ERR(tty))
                        goto out;
                tty_port_set_kopened(tty->port, 1);
        }
out:
        mutex_unlock(&tty_mutex);
        tty_driver_kref_put(driver);
        return tty;
}

/**
 * tty_kopen_exclusive - open a tty device for kernel
 * @device: dev_t of device to open
 *
 * Opens tty exclusively for kernel. Performs the driver lookup, makes sure
 * it's not already opened and performs the first-time tty initialization.
 *
 * Claims the global %tty_mutex to serialize:
 *  * concurrent first-time tty initialization
 *  * concurrent tty driver removal w/ lookup
 *  * concurrent tty removal from driver table
 *
 * Return: the locked initialized &tty_struct
 */
struct tty_struct *tty_kopen_exclusive(dev_t device)
{
        return tty_kopen(device, 0);
}
EXPORT_SYMBOL_GPL(tty_kopen_exclusive);

/**
 * tty_kopen_shared - open a tty device for shared in-kernel use
 * @device: dev_t of device to open
 *
 * Opens an already existing tty for in-kernel use. Compared to
 * tty_kopen_exclusive() above it doesn't ensure to be the only user.
 *
 * Locking: identical to tty_kopen() above.
 */
struct tty_struct *tty_kopen_shared(dev_t device)
{
        return tty_kopen(device, 1);
}
EXPORT_SYMBOL_GPL(tty_kopen_shared);

/**
 * tty_open_by_driver - open a tty device
 * @device: dev_t of device to open
 * @filp: file pointer to tty
 *
 * Performs the driver lookup, checks for a reopen, or otherwise performs the
 * first-time tty initialization.
 *
 *
 * Claims the global tty_mutex to serialize:
 *  * concurrent first-time tty initialization
 *  * concurrent tty driver removal w/ lookup
 *  * concurrent tty removal from driver table
 *
 * Return: the locked initialized or re-opened &tty_struct
 */
static struct tty_struct *tty_open_by_driver(dev_t device,
                                             struct file *filp)
{
        struct tty_struct *tty;
        struct tty_driver *driver = NULL;
        int index = -1;
        int retval;

        mutex_lock(&tty_mutex);
        driver = tty_lookup_driver(device, filp, &index);
        if (IS_ERR(driver)) {
                mutex_unlock(&tty_mutex);
                return ERR_CAST(driver);
        }

        /* check whether we're reopening an existing tty */
        tty = tty_driver_lookup_tty(driver, filp, index);
        if (IS_ERR(tty)) {
                mutex_unlock(&tty_mutex);
                goto out;
        }

        if (tty) {
                if (tty_port_kopened(tty->port)) {
                        tty_kref_put(tty);
                        mutex_unlock(&tty_mutex);
                        tty = ERR_PTR(-EBUSY);
                        goto out;
                }
                mutex_unlock(&tty_mutex);
                retval = tty_lock_interruptible(tty);
                tty_kref_put(tty);  /* drop kref from tty_driver_lookup_tty() */
                if (retval) {
                        if (retval == -EINTR)
                                retval = -ERESTARTSYS;
                        tty = ERR_PTR(retval);
                        goto out;
                }
                retval = tty_reopen(tty);
                if (retval < 0) {
                        tty_unlock(tty);
                        tty = ERR_PTR(retval);
                }
        } else { /* Returns with the tty_lock held for now */
                tty = tty_init_dev(driver, index);
                mutex_unlock(&tty_mutex);
        }
out:
        tty_driver_kref_put(driver);
        return tty;
}

/**
 * tty_open - open a tty device
 * @inode: inode of device file
 * @filp: file pointer to tty
 *
 * tty_open() and tty_release() keep up the tty count that contains the number
 * of opens done on a tty. We cannot use the inode-count, as different inodes
 * might point to the same tty.
 *
 * Open-counting is needed for pty masters, as well as for keeping track of
 * serial lines: DTR is dropped when the last close happens.
 * (This is not done solely through tty->count, now.  - Ted 1/27/92)
 *
 * The termios state of a pty is reset on the first open so that settings don't
 * persist across reuse.
 *
 * Locking:
 *  * %tty_mutex protects tty, tty_lookup_driver() and tty_init_dev().
 *  * @tty->count should protect the rest.
 *  * ->siglock protects ->signal/->sighand
 *
 * Note: the tty_unlock/lock cases without a ref are only safe due to %tty_mutex
 */
static int tty_open(struct inode *inode, struct file *filp)
{
        struct tty_struct *tty;
        int noctty, retval;
        dev_t device = inode->i_rdev;
        unsigned saved_flags = filp->f_flags;

        nonseekable_open(inode, filp);

retry_open:
        retval = tty_alloc_file(filp);
        if (retval)
                return -ENOMEM;

        tty = tty_open_current_tty(device, filp);
        if (!tty)
                tty = tty_open_by_driver(device, filp);

        if (IS_ERR(tty)) {
                tty_free_file(filp);
                retval = PTR_ERR(tty);
                if (retval != -EAGAIN || signal_pending(current))
                        return retval;
                schedule();
                goto retry_open;
        }

        tty_add_file(tty, filp);

        check_tty_count(tty, __func__);
        tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);

        if (tty->ops->open)
                retval = tty->ops->open(tty, filp);
        else
                retval = -ENODEV;
        filp->f_flags = saved_flags;

        if (retval) {
                tty_debug_hangup(tty, "open error %d, releasing\n", retval);

                tty_unlock(tty); /* need to call tty_release without BTM */
                tty_release(inode, filp);
                if (retval != -ERESTARTSYS)
                        return retval;

                if (signal_pending(current))
                        return retval;

                schedule();
                /*
                 * Need to reset f_op in case a hangup happened.
                 */
                if (tty_hung_up_p(filp))
                        filp->f_op = &tty_fops;
                goto retry_open;
        }
        clear_bit(TTY_HUPPED, &tty->flags);

        noctty = (filp->f_flags & O_NOCTTY) ||
                 (IS_ENABLED(CONFIG_VT) && device == MKDEV(TTY_MAJOR, 0)) ||
                 device == MKDEV(TTYAUX_MAJOR, 1) ||
                 (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
                  tty->driver->subtype == PTY_TYPE_MASTER);
        if (!noctty)
                tty_open_proc_set_tty(filp, tty);
        tty_unlock(tty);
        return 0;
}


/**
 * tty_poll - check tty status
 * @filp: file being polled
 * @wait: poll wait structures to update
 *
 * Call the line discipline polling method to obtain the poll status of the
 * device.
 *
 * Locking: locks called line discipline but ldisc poll method may be
 * re-entered freely by other callers.
 */
static __poll_t tty_poll(struct file *filp, poll_table *wait)
{
        struct tty_struct *tty = file_tty(filp);
        struct tty_ldisc *ld;
        __poll_t ret = 0;

        if (tty_paranoia_check(tty, file_inode(filp), "tty_poll"))
                return 0;

        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return hung_up_tty_poll(filp, wait);
        if (ld->ops->poll)
                ret = ld->ops->poll(tty, filp, wait);
        tty_ldisc_deref(ld);
        return ret;
}

static int __tty_fasync(int fd, struct file *filp, int on)
{
        struct tty_struct *tty = file_tty(filp);
        unsigned long flags;
        int retval = 0;

        if (tty_paranoia_check(tty, file_inode(filp), "tty_fasync"))
                goto out;

        if (on) {
                retval = file_f_owner_allocate(filp);
                if (retval)
                        goto out;
        }

        retval = fasync_helper(fd, filp, on, &tty->fasync);
        if (retval <= 0)
                goto out;

        if (on) {
                enum pid_type type;
                struct pid *pid;

                spin_lock_irqsave(&tty->ctrl.lock, flags);
                if (tty->ctrl.pgrp) {
                        pid = tty->ctrl.pgrp;
                        type = PIDTYPE_PGID;
                } else {
                        pid = task_pid(current);
                        type = PIDTYPE_TGID;
                }
                get_pid(pid);
                spin_unlock_irqrestore(&tty->ctrl.lock, flags);
                __f_setown(filp, pid, type, 0);
                put_pid(pid);
                retval = 0;
        }
out:
        return retval;
}

static int tty_fasync(int fd, struct file *filp, int on)
{
        struct tty_struct *tty = file_tty(filp);
        int retval = -ENOTTY;

        tty_lock(tty);
        if (!tty_hung_up_p(filp))
                retval = __tty_fasync(fd, filp, on);
        tty_unlock(tty);

        return retval;
}

static bool tty_legacy_tiocsti __read_mostly = IS_ENABLED(CONFIG_LEGACY_TIOCSTI);
/**
 * tiocsti - fake input character
 * @tty: tty to fake input into
 * @p: pointer to character
 *
 * Fake input to a tty device. Does the necessary locking and input management.
 *
 * FIXME: does not honour flow control ??
 *
 * Locking:
 *  * Called functions take tty_ldiscs_lock
 *  * current->signal->tty check is safe without locks
 */
static int tiocsti(struct tty_struct *tty, u8 __user *p)
{
        struct tty_ldisc *ld;
        u8 ch;

        if (!tty_legacy_tiocsti && !capable(CAP_SYS_ADMIN))
                return -EIO;

        if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
                return -EPERM;
        if (get_user(ch, p))
                return -EFAULT;
        tty_audit_tiocsti(tty, ch);
        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return -EIO;
        tty_buffer_lock_exclusive(tty->port);
        if (ld->ops->receive_buf)
                ld->ops->receive_buf(tty, &ch, NULL, 1);
        tty_buffer_unlock_exclusive(tty->port);
        tty_ldisc_deref(ld);
        return 0;
}

/**
 * tiocgwinsz - implement window query ioctl
 * @tty: tty
 * @arg: user buffer for result
 *
 * Copies the kernel idea of the window size into the user buffer.
 *
 * Locking: @tty->winsize_mutex is taken to ensure the winsize data is
 * consistent.
 */
static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
{
        int err;

        mutex_lock(&tty->winsize_mutex);
        err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
        mutex_unlock(&tty->winsize_mutex);

        return err ? -EFAULT : 0;
}

/**
 * tty_do_resize - resize event
 * @tty: tty being resized
 * @ws: new dimensions
 *
 * Update the termios variables and send the necessary signals to peform a
 * terminal resize correctly.
 */
int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
{
        struct pid *pgrp;

        /* Lock the tty */
        mutex_lock(&tty->winsize_mutex);
        if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
                goto done;

        /* Signal the foreground process group */
        pgrp = tty_get_pgrp(tty);
        if (pgrp)
                kill_pgrp(pgrp, SIGWINCH, 1);
        put_pid(pgrp);

        tty->winsize = *ws;
done:
        mutex_unlock(&tty->winsize_mutex);
        return 0;
}
EXPORT_SYMBOL(tty_do_resize);

/**
 * tiocswinsz - implement window size set ioctl
 * @tty: tty side of tty
 * @arg: user buffer for result
 *
 * Copies the user idea of the window size to the kernel. Traditionally this is
 * just advisory information but for the Linux console it actually has driver
 * level meaning and triggers a VC resize.
 *
 * Locking:
 *        Driver dependent. The default do_resize method takes the tty termios
 *        mutex and ctrl.lock. The console takes its own lock then calls into the
 *        default method.
 */
static int tiocswinsz(struct tty_struct *tty, struct winsize __user *arg)
{
        struct winsize tmp_ws;

        if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
                return -EFAULT;

        if (tty->ops->resize)
                return tty->ops->resize(tty, &tmp_ws);
        else
                return tty_do_resize(tty, &tmp_ws);
}

/**
 * tioccons - allow admin to move logical console
 * @file: the file to become console
 *
 * Allow the administrator to move the redirected console device.
 *
 * Locking: uses redirect_lock to guard the redirect information
 */
static int tioccons(struct file *file)
{
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
        if (file->f_op->write_iter == redirected_tty_write) {
                struct file *f;

                spin_lock(&redirect_lock);
                f = redirect;
                redirect = NULL;
                spin_unlock(&redirect_lock);
                if (f)
                        fput(f);
                return 0;
        }
        if (file->f_op->write_iter != tty_write)
                return -ENOTTY;
        if (!(file->f_mode & FMODE_WRITE))
                return -EBADF;
        if (!(file->f_mode & FMODE_CAN_WRITE))
                return -EINVAL;
        spin_lock(&redirect_lock);
        if (redirect) {
                spin_unlock(&redirect_lock);
                return -EBUSY;
        }
        redirect = get_file(file);
        spin_unlock(&redirect_lock);
        return 0;
}

/**
 * tiocsetd - set line discipline
 * @tty: tty device
 * @p: pointer to user data
 *
 * Set the line discipline according to user request.
 *
 * Locking: see tty_set_ldisc(), this function is just a helper
 */
static int tiocsetd(struct tty_struct *tty, int __user *p)
{
        int disc;
        int ret;

        if (get_user(disc, p))
                return -EFAULT;

        ret = tty_set_ldisc(tty, disc);

        return ret;
}

/**
 * tiocgetd - get line discipline
 * @tty: tty device
 * @p: pointer to user data
 *
 * Retrieves the line discipline id directly from the ldisc.
 *
 * Locking: waits for ldisc reference (in case the line discipline is changing
 * or the @tty is being hungup)
 */
static int tiocgetd(struct tty_struct *tty, int __user *p)
{
        struct tty_ldisc *ld;
        int ret;

        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return -EIO;
        ret = put_user(ld->ops->num, p);
        tty_ldisc_deref(ld);
        return ret;
}

/**
 * send_break - performed time break
 * @tty: device to break on
 * @duration: timeout in mS
 *
 * Perform a timed break on hardware that lacks its own driver level timed
 * break functionality.
 *
 * Locking:
 *        @tty->atomic_write_lock serializes
 */
static int send_break(struct tty_struct *tty, unsigned int duration)
{
        int retval;

        if (tty->ops->break_ctl == NULL)
                return 0;

        if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
                return tty->ops->break_ctl(tty, duration);

        /* Do the work ourselves */
        if (tty_write_lock(tty, false) < 0)
                return -EINTR;

        retval = tty->ops->break_ctl(tty, -1);
        if (!retval) {
                msleep_interruptible(duration);
                retval = tty->ops->break_ctl(tty, 0);
        } else if (retval == -EOPNOTSUPP) {
                /* some drivers can tell only dynamically */
                retval = 0;
        }
        tty_write_unlock(tty);

        if (signal_pending(current))
                retval = -EINTR;

        return retval;
}

/**
 * tty_get_tiocm - get tiocm status register
 * @tty: tty device
 *
 * Obtain the modem status bits from the tty driver if the feature
 * is supported.
 */
int tty_get_tiocm(struct tty_struct *tty)
{
        int retval = -ENOTTY;

        if (tty->ops->tiocmget)
                retval = tty->ops->tiocmget(tty);

        return retval;
}
EXPORT_SYMBOL_GPL(tty_get_tiocm);

/**
 * tty_tiocmget - get modem status
 * @tty: tty device
 * @p: pointer to result
 *
 * Obtain the modem status bits from the tty driver if the feature is
 * supported. Return -%ENOTTY if it is not available.
 *
 * Locking: none (up to the driver)
 */
static int tty_tiocmget(struct tty_struct *tty, int __user *p)
{
        int retval;

        retval = tty_get_tiocm(tty);
        if (retval >= 0)
                retval = put_user(retval, p);

        return retval;
}

/**
 * tty_tiocmset - set modem status
 * @tty: tty device
 * @cmd: command - clear bits, set bits or set all
 * @p: pointer to desired bits
 *
 * Set the modem status bits from the tty driver if the feature
 * is supported. Return -%ENOTTY if it is not available.
 *
 * Locking: none (up to the driver)
 */
static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
             unsigned __user *p)
{
        int retval;
        unsigned int set, clear, val;

        if (tty->ops->tiocmset == NULL)
                return -ENOTTY;

        retval = get_user(val, p);
        if (retval)
                return retval;
        set = clear = 0;
        switch (cmd) {
        case TIOCMBIS:
                set = val;
                break;
        case TIOCMBIC:
                clear = val;
                break;
        case TIOCMSET:
                set = val;
                clear = ~val;
                break;
        }
        set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
        clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
        return tty->ops->tiocmset(tty, set, clear);
}

/**
 * tty_get_icount - get tty statistics
 * @tty: tty device
 * @icount: output parameter
 *
 * Gets a copy of the @tty's icount statistics.
 *
 * Locking: none (up to the driver)
 */
int tty_get_icount(struct tty_struct *tty,
                   struct serial_icounter_struct *icount)
{
        memset(icount, 0, sizeof(*icount));

        if (tty->ops->get_icount)
                return tty->ops->get_icount(tty, icount);
        else
                return -ENOTTY;
}
EXPORT_SYMBOL_GPL(tty_get_icount);

static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
{
        struct serial_icounter_struct icount;
        int retval;

        retval = tty_get_icount(tty, &icount);
        if (retval != 0)
                return retval;

        if (copy_to_user(arg, &icount, sizeof(icount)))
                return -EFAULT;
        return 0;
}

static int tty_set_serial(struct tty_struct *tty, struct serial_struct *ss)
{
        int flags;

        flags = ss->flags & ASYNC_DEPRECATED;

        if (flags)
                pr_warn_ratelimited("%s: '%s' is using deprecated serial flags (with no effect): %.8x\n",
                                __func__, current->comm, flags);

        if (!tty->ops->set_serial)
                return -ENOTTY;

        return tty->ops->set_serial(tty, ss);
}

static int tty_tiocsserial(struct tty_struct *tty, struct serial_struct __user *ss)
{
        struct serial_struct v;

        if (copy_from_user(&v, ss, sizeof(*ss)))
                return -EFAULT;

        return tty_set_serial(tty, &v);
}

static int tty_tiocgserial(struct tty_struct *tty, struct serial_struct __user *ss)
{
        struct serial_struct v;
        int err;

        memset(&v, 0, sizeof(v));
        if (!tty->ops->get_serial)
                return -ENOTTY;
        err = tty->ops->get_serial(tty, &v);
        if (!err && copy_to_user(ss, &v, sizeof(v)))
                err = -EFAULT;
        return err;
}

/*
 * if pty, return the slave side (real_tty)
 * otherwise, return self
 */
static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
{
        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
            tty->driver->subtype == PTY_TYPE_MASTER)
                tty = tty->link;
        return tty;
}

/*
 * Split this up, as gcc can choke on it otherwise..
 */
long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
        struct tty_struct *tty = file_tty(file);
        struct tty_struct *real_tty;
        void __user *p = (void __user *)arg;
        int retval;
        struct tty_ldisc *ld;

        if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
                return -EINVAL;

        real_tty = tty_pair_get_tty(tty);

        /*
         * Factor out some common prep work
         */
        switch (cmd) {
        case TIOCSETD:
        case TIOCSBRK:
        case TIOCCBRK:
        case TCSBRK:
        case TCSBRKP:
                retval = tty_check_change(tty);
                if (retval)
                        return retval;
                if (cmd != TIOCCBRK) {
                        tty_wait_until_sent(tty, 0);
                        if (signal_pending(current))
                                return -EINTR;
                }
                break;
        }

        /*
         *        Now do the stuff.
         */
        switch (cmd) {
        case TIOCSTI:
                return tiocsti(tty, p);
        case TIOCGWINSZ:
                return tiocgwinsz(real_tty, p);
        case TIOCSWINSZ:
                return tiocswinsz(real_tty, p);
        case TIOCCONS:
                return real_tty != tty ? -EINVAL : tioccons(file);
        case TIOCEXCL:
                set_bit(TTY_EXCLUSIVE, &tty->flags);
                return 0;
        case TIOCNXCL:
                clear_bit(TTY_EXCLUSIVE, &tty->flags);
                return 0;
        case TIOCGEXCL:
        {
                int excl = test_bit(TTY_EXCLUSIVE, &tty->flags);

                return put_user(excl, (int __user *)p);
        }
        case TIOCGETD:
                return tiocgetd(tty, p);
        case TIOCSETD:
                return tiocsetd(tty, p);
        case TIOCVHANGUP:
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
                tty_vhangup(tty);
                return 0;
        case TIOCGDEV:
        {
                unsigned int ret = new_encode_dev(tty_devnum(real_tty));

                return put_user(ret, (unsigned int __user *)p);
        }
        /*
         * Break handling
         */
        case TIOCSBRK:        /* Turn break on, unconditionally */
                if (tty->ops->break_ctl)
                        return tty->ops->break_ctl(tty, -1);
                return 0;
        case TIOCCBRK:        /* Turn break off, unconditionally */
                if (tty->ops->break_ctl)
                        return tty->ops->break_ctl(tty, 0);
                return 0;
        case TCSBRK:   /* SVID version: non-zero arg --> no break */
                /* non-zero arg means wait for all output data
                 * to be sent (performed above) but don't send break.
                 * This is used by the tcdrain() termios function.
                 */
                if (!arg)
                        return send_break(tty, 250);
                return 0;
        case TCSBRKP:        /* support for POSIX tcsendbreak() */
                return send_break(tty, arg ? arg*100 : 250);

        case TIOCMGET:
                return tty_tiocmget(tty, p);
        case TIOCMSET:
        case TIOCMBIC:
        case TIOCMBIS:
                return tty_tiocmset(tty, cmd, p);
        case TIOCGICOUNT:
                return tty_tiocgicount(tty, p);
        case TCFLSH:
                switch (arg) {
                case TCIFLUSH:
                case TCIOFLUSH:
                /* flush tty buffer and allow ldisc to process ioctl */
                        tty_buffer_flush(tty, NULL);
                        break;
                }
                break;
        case TIOCSSERIAL:
                return tty_tiocsserial(tty, p);
        case TIOCGSERIAL:
                return tty_tiocgserial(tty, p);
        case TIOCGPTPEER:
                /* Special because the struct file is needed */
                return ptm_open_peer(file, tty, (int)arg);
        default:
                retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
                if (retval != -ENOIOCTLCMD)
                        return retval;
        }
        if (tty->ops->ioctl) {
                retval = tty->ops->ioctl(tty, cmd, arg);
                if (retval != -ENOIOCTLCMD)
                        return retval;
        }
        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return hung_up_tty_ioctl(file, cmd, arg);
        retval = -EINVAL;
        if (ld->ops->ioctl) {
                retval = ld->ops->ioctl(tty, cmd, arg);
                if (retval == -ENOIOCTLCMD)
                        retval = -ENOTTY;
        }
        tty_ldisc_deref(ld);
        return retval;
}

#ifdef CONFIG_COMPAT

struct serial_struct32 {
        compat_int_t    type;
        compat_int_t    line;
        compat_uint_t   port;
        compat_int_t    irq;
        compat_int_t    flags;
        compat_int_t    xmit_fifo_size;
        compat_int_t    custom_divisor;
        compat_int_t    baud_base;
        unsigned short  close_delay;
        char    io_type;
        char    reserved_char;
        compat_int_t    hub6;
        unsigned short  closing_wait; /* time to wait before closing */
        unsigned short  closing_wait2; /* no longer used... */
        compat_uint_t   iomem_base;
        unsigned short  iomem_reg_shift;
        unsigned int    port_high;
        /* compat_ulong_t  iomap_base FIXME */
        compat_int_t    reserved;
};

static int compat_tty_tiocsserial(struct tty_struct *tty,
                struct serial_struct32 __user *ss)
{
        struct serial_struct32 v32;
        struct serial_struct v;

        if (copy_from_user(&v32, ss, sizeof(*ss)))
                return -EFAULT;

        memcpy(&v, &v32, offsetof(struct serial_struct32, iomem_base));
        v.iomem_base = compat_ptr(v32.iomem_base);
        v.iomem_reg_shift = v32.iomem_reg_shift;
        v.port_high = v32.port_high;
        v.iomap_base = 0;

        return tty_set_serial(tty, &v);
}

static int compat_tty_tiocgserial(struct tty_struct *tty,
                        struct serial_struct32 __user *ss)
{
        struct serial_struct32 v32;
        struct serial_struct v;
        int err;

        memset(&v, 0, sizeof(v));
        memset(&v32, 0, sizeof(v32));

        if (!tty->ops->get_serial)
                return -ENOTTY;
        err = tty->ops->get_serial(tty, &v);
        if (!err) {
                memcpy(&v32, &v, offsetof(struct serial_struct32, iomem_base));
                v32.iomem_base = (unsigned long)v.iomem_base >> 32 ?
                        0xfffffff : ptr_to_compat(v.iomem_base);
                v32.iomem_reg_shift = v.iomem_reg_shift;
                v32.port_high = v.port_high;
                if (copy_to_user(ss, &v32, sizeof(v32)))
                        err = -EFAULT;
        }
        return err;
}
static long tty_compat_ioctl(struct file *file, unsigned int cmd,
                                unsigned long arg)
{
        struct tty_struct *tty = file_tty(file);
        struct tty_ldisc *ld;
        int retval = -ENOIOCTLCMD;

        switch (cmd) {
        case TIOCOUTQ:
        case TIOCSTI:
        case TIOCGWINSZ:
        case TIOCSWINSZ:
        case TIOCGEXCL:
        case TIOCGETD:
        case TIOCSETD:
        case TIOCGDEV:
        case TIOCMGET:
        case TIOCMSET:
        case TIOCMBIC:
        case TIOCMBIS:
        case TIOCGICOUNT:
        case TIOCGPGRP:
        case TIOCSPGRP:
        case TIOCGSID:
        case TIOCSERGETLSR:
        case TIOCGRS485:
        case TIOCSRS485:
#ifdef TIOCGETP
        case TIOCGETP:
        case TIOCSETP:
        case TIOCSETN:
#endif
#ifdef TIOCGETC
        case TIOCGETC:
        case TIOCSETC:
#endif
#ifdef TIOCGLTC
        case TIOCGLTC:
        case TIOCSLTC:
#endif
        case TCSETSF:
        case TCSETSW:
        case TCSETS:
        case TCGETS:
#ifdef TCGETS2
        case TCGETS2:
        case TCSETSF2:
        case TCSETSW2:
        case TCSETS2:
#endif
        case TCGETA:
        case TCSETAF:
        case TCSETAW:
        case TCSETA:
        case TIOCGLCKTRMIOS:
        case TIOCSLCKTRMIOS:
#ifdef TCGETX
        case TCGETX:
        case TCSETX:
        case TCSETXW:
        case TCSETXF:
#endif
        case TIOCGSOFTCAR:
        case TIOCSSOFTCAR:

        case PPPIOCGCHAN:
        case PPPIOCGUNIT:
                return tty_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
        case TIOCCONS:
        case TIOCEXCL:
        case TIOCNXCL:
        case TIOCVHANGUP:
        case TIOCSBRK:
        case TIOCCBRK:
        case TCSBRK:
        case TCSBRKP:
        case TCFLSH:
        case TIOCGPTPEER:
        case TIOCNOTTY:
        case TIOCSCTTY:
        case TCXONC:
        case TIOCMIWAIT:
        case TIOCSERCONFIG:
                return tty_ioctl(file, cmd, arg);
        }

        if (tty_paranoia_check(tty, file_inode(file), "tty_ioctl"))
                return -EINVAL;

        switch (cmd) {
        case TIOCSSERIAL:
                return compat_tty_tiocsserial(tty, compat_ptr(arg));
        case TIOCGSERIAL:
                return compat_tty_tiocgserial(tty, compat_ptr(arg));
        }
        if (tty->ops->compat_ioctl) {
                retval = tty->ops->compat_ioctl(tty, cmd, arg);
                if (retval != -ENOIOCTLCMD)
                        return retval;
        }

        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return hung_up_tty_compat_ioctl(file, cmd, arg);
        if (ld->ops->compat_ioctl)
                retval = ld->ops->compat_ioctl(tty, cmd, arg);
        if (retval == -ENOIOCTLCMD && ld->ops->ioctl)
                retval = ld->ops->ioctl(tty, (unsigned long)compat_ptr(cmd),
                                arg);
        tty_ldisc_deref(ld);

        return retval;
}
#endif

static int this_tty(const void *t, struct file *file, unsigned fd)
{
        if (likely(file->f_op->read_iter != tty_read))
                return 0;
        return file_tty(file) != t ? 0 : fd + 1;
}

/*
 * This implements the "Secure Attention Key" ---  the idea is to
 * prevent trojan horses by killing all processes associated with this
 * tty when the user hits the "Secure Attention Key".  Required for
 * super-paranoid applications --- see the Orange Book for more details.
 *
 * This code could be nicer; ideally it should send a HUP, wait a few
 * seconds, then send a INT, and then a KILL signal.  But you then
 * have to coordinate with the init process, since all processes associated
 * with the current tty must be dead before the new getty is allowed
 * to spawn.
 *
 * Now, if it would be correct ;-/ The current code has a nasty hole -
 * it doesn't catch files in flight. We may send the descriptor to ourselves
 * via AF_UNIX socket, close it and later fetch from socket. FIXME.
 *
 * Nasty bug: do_SAK is being called in interrupt context.  This can
 * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
 */
void __do_SAK(struct tty_struct *tty)
{
        struct task_struct *g, *p;
        struct pid *session;
        int i;
        unsigned long flags;

        spin_lock_irqsave(&tty->ctrl.lock, flags);
        session = get_pid(tty->ctrl.session);
        spin_unlock_irqrestore(&tty->ctrl.lock, flags);

        tty_ldisc_flush(tty);

        tty_driver_flush_buffer(tty);

        read_lock(&tasklist_lock);
        /* Kill the entire session */
        do_each_pid_task(session, PIDTYPE_SID, p) {
                tty_notice(tty, "SAK: killed process %d (%s): by session\n",
                           task_pid_nr(p), p->comm);
                group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_SID);
        } while_each_pid_task(session, PIDTYPE_SID, p);

        /* Now kill any processes that happen to have the tty open */
        for_each_process_thread(g, p) {
                if (p->signal->tty == tty) {
                        tty_notice(tty, "SAK: killed process %d (%s): by controlling tty\n",
                                   task_pid_nr(p), p->comm);
                        group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
                                        PIDTYPE_SID);
                        continue;
                }
                task_lock(p);
                i = iterate_fd(p->files, 0, this_tty, tty);
                if (i != 0) {
                        tty_notice(tty, "SAK: killed process %d (%s): by fd#%d\n",
                                   task_pid_nr(p), p->comm, i - 1);
                        group_send_sig_info(SIGKILL, SEND_SIG_PRIV, p,
                                        PIDTYPE_SID);
                }
                task_unlock(p);
        }
        read_unlock(&tasklist_lock);
        put_pid(session);
}

static void do_SAK_work(struct work_struct *work)
{
        struct tty_struct *tty =
                container_of(work, struct tty_struct, SAK_work);
        __do_SAK(tty);
}

/*
 * The tq handling here is a little racy - tty->SAK_work may already be queued.
 * Fortunately we don't need to worry, because if ->SAK_work is already queued,
 * the values which we write to it will be identical to the values which it
 * already has. --akpm
 */
void do_SAK(struct tty_struct *tty)
{
        if (!tty)
                return;
        schedule_work(&tty->SAK_work);
}
EXPORT_SYMBOL(do_SAK);

/* Must put_device() after it's unused! */
static struct device *tty_get_device(struct tty_struct *tty)
{
        dev_t devt = tty_devnum(tty);

        return class_find_device_by_devt(&tty_class, devt);
}


/**
 * alloc_tty_struct - allocate a new tty
 * @driver: driver which will handle the returned tty
 * @idx: minor of the tty
 *
 * This subroutine allocates and initializes a tty structure.
 *
 * Locking: none - @tty in question is not exposed at this point
 */
struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
{
        struct tty_struct *tty;

        tty = kzalloc(sizeof(*tty), GFP_KERNEL_ACCOUNT);
        if (!tty)
                return NULL;

        kref_init(&tty->kref);
        if (tty_ldisc_init(tty)) {
                kfree(tty);
                return NULL;
        }
        tty->ctrl.session = NULL;
        tty->ctrl.pgrp = NULL;
        mutex_init(&tty->legacy_mutex);
        mutex_init(&tty->throttle_mutex);
        init_rwsem(&tty->termios_rwsem);
        mutex_init(&tty->winsize_mutex);
        init_ldsem(&tty->ldisc_sem);
        init_waitqueue_head(&tty->write_wait);
        init_waitqueue_head(&tty->read_wait);
        INIT_WORK(&tty->hangup_work, do_tty_hangup);
        mutex_init(&tty->atomic_write_lock);
        spin_lock_init(&tty->ctrl.lock);
        spin_lock_init(&tty->flow.lock);
        spin_lock_init(&tty->files_lock);
        INIT_LIST_HEAD(&tty->tty_files);
        INIT_WORK(&tty->SAK_work, do_SAK_work);

        tty->driver = driver;
        tty->ops = driver->ops;
        tty->index = idx;
        tty_line_name(driver, idx, tty->name);
        tty->dev = tty_get_device(tty);

        return tty;
}

/**
 * tty_put_char - write one character to a tty
 * @tty: tty
 * @ch: character to write
 *
 * Write one byte to the @tty using the provided @tty->ops->put_char() method
 * if present.
 *
 * Note: the specific put_char operation in the driver layer may go
 * away soon. Don't call it directly, use this method
 *
 * Return: the number of characters successfully output.
 */
int tty_put_char(struct tty_struct *tty, u8 ch)
{
        if (tty->ops->put_char)
                return tty->ops->put_char(tty, ch);
        return tty->ops->write(tty, &ch, 1);
}
EXPORT_SYMBOL_GPL(tty_put_char);

static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
                unsigned int index, unsigned int count)
{
        int err;

        /* init here, since reused cdevs cause crashes */
        driver->cdevs[index] = cdev_alloc();
        if (!driver->cdevs[index])
                return -ENOMEM;
        driver->cdevs[index]->ops = &tty_fops;
        driver->cdevs[index]->owner = driver->owner;
        err = cdev_add(driver->cdevs[index], dev, count);
        if (err)
                kobject_put(&driver->cdevs[index]->kobj);
        return err;
}

/**
 * tty_register_device - register a tty device
 * @driver: the tty driver that describes the tty device
 * @index: the index in the tty driver for this tty device
 * @device: a struct device that is associated with this tty device.
 *        This field is optional, if there is no known struct device
 *        for this tty device it can be set to NULL safely.
 *
 * This call is required to be made to register an individual tty device
 * if the tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set.  If
 * that bit is not set, this function should not be called by a tty
 * driver.
 *
 * Locking: ??
 *
 * Return: A pointer to the struct device for this tty device (or
 * ERR_PTR(-EFOO) on error).
 */
struct device *tty_register_device(struct tty_driver *driver, unsigned index,
                                   struct device *device)
{
        return tty_register_device_attr(driver, index, device, NULL, NULL);
}
EXPORT_SYMBOL(tty_register_device);

static void tty_device_create_release(struct device *dev)
{
        dev_dbg(dev, "releasing...\n");
        kfree(dev);
}

/**
 * tty_register_device_attr - register a tty device
 * @driver: the tty driver that describes the tty device
 * @index: the index in the tty driver for this tty device
 * @device: a struct device that is associated with this tty device.
 *        This field is optional, if there is no known struct device
 *        for this tty device it can be set to %NULL safely.
 * @drvdata: Driver data to be set to device.
 * @attr_grp: Attribute group to be set on device.
 *
 * This call is required to be made to register an individual tty device if the
 * tty driver's flags have the %TTY_DRIVER_DYNAMIC_DEV bit set. If that bit is
 * not set, this function should not be called by a tty driver.
 *
 * Locking: ??
 *
 * Return: A pointer to the struct device for this tty device (or
 * ERR_PTR(-EFOO) on error).
 */
struct device *tty_register_device_attr(struct tty_driver *driver,
                                   unsigned index, struct device *device,
                                   void *drvdata,
                                   const struct attribute_group **attr_grp)
{
        char name[64];
        dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
        struct ktermios *tp;
        struct device *dev;
        int retval;

        if (index >= driver->num) {
                pr_err("%s: Attempt to register invalid tty line number (%d)\n",
                       driver->name, index);
                return ERR_PTR(-EINVAL);
        }

        if (driver->type == TTY_DRIVER_TYPE_PTY)
                pty_line_name(driver, index, name);
        else
                tty_line_name(driver, index, name);

        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
        if (!dev)
                return ERR_PTR(-ENOMEM);

        dev->devt = devt;
        dev->class = &tty_class;
        dev->parent = device;
        dev->release = tty_device_create_release;
        dev_set_name(dev, "%s", name);
        dev->groups = attr_grp;
        dev_set_drvdata(dev, drvdata);

        dev_set_uevent_suppress(dev, 1);

        retval = device_register(dev);
        if (retval)
                goto err_put;

        if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
                /*
                 * Free any saved termios data so that the termios state is
                 * reset when reusing a minor number.
                 */
                tp = driver->termios[index];
                if (tp) {
                        driver->termios[index] = NULL;
                        kfree(tp);
                }

                retval = tty_cdev_add(driver, devt, index, 1);
                if (retval)
                        goto err_del;
        }

        dev_set_uevent_suppress(dev, 0);
        kobject_uevent(&dev->kobj, KOBJ_ADD);

        return dev;

err_del:
        device_del(dev);
err_put:
        put_device(dev);

        return ERR_PTR(retval);
}
EXPORT_SYMBOL_GPL(tty_register_device_attr);

/**
 * tty_unregister_device - unregister a tty device
 * @driver: the tty driver that describes the tty device
 * @index: the index in the tty driver for this tty device
 *
 * If a tty device is registered with a call to tty_register_device() then
 * this function must be called when the tty device is gone.
 *
 * Locking: ??
 */
void tty_unregister_device(struct tty_driver *driver, unsigned index)
{
        device_destroy(&tty_class, MKDEV(driver->major, driver->minor_start) + index);
        if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
                cdev_del(driver->cdevs[index]);
                driver->cdevs[index] = NULL;
        }
}
EXPORT_SYMBOL(tty_unregister_device);

/**
 * __tty_alloc_driver - allocate tty driver
 * @lines: count of lines this driver can handle at most
 * @owner: module which is responsible for this driver
 * @flags: some of %TTY_DRIVER_ flags, will be set in driver->flags
 *
 * This should not be called directly, some of the provided macros should be
 * used instead. Use IS_ERR() and friends on @retval.
 */
struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
                unsigned long flags)
{
        struct tty_driver *driver;
        unsigned int cdevs = 1;
        int err;

        if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
                return ERR_PTR(-EINVAL);

        driver = kzalloc(sizeof(*driver), GFP_KERNEL);
        if (!driver)
                return ERR_PTR(-ENOMEM);

        kref_init(&driver->kref);
        driver->num = lines;
        driver->owner = owner;
        driver->flags = flags;

        if (!(flags & TTY_DRIVER_DEVPTS_MEM)) {
                driver->ttys = kcalloc(lines, sizeof(*driver->ttys),
                                GFP_KERNEL);
                driver->termios = kcalloc(lines, sizeof(*driver->termios),
                                GFP_KERNEL);
                if (!driver->ttys || !driver->termios) {
                        err = -ENOMEM;
                        goto err_free_all;
                }
        }

        if (!(flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
                driver->ports = kcalloc(lines, sizeof(*driver->ports),
                                GFP_KERNEL);
                if (!driver->ports) {
                        err = -ENOMEM;
                        goto err_free_all;
                }
                cdevs = lines;
        }

        driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
        if (!driver->cdevs) {
                err = -ENOMEM;
                goto err_free_all;
        }

        return driver;
err_free_all:
        kfree(driver->ports);
        kfree(driver->ttys);
        kfree(driver->termios);
        kfree(driver->cdevs);
        kfree(driver);
        return ERR_PTR(err);
}
EXPORT_SYMBOL(__tty_alloc_driver);

static void destruct_tty_driver(struct kref *kref)
{
        struct tty_driver *driver = container_of(kref, struct tty_driver, kref);
        int i;
        struct ktermios *tp;

        if (driver->flags & TTY_DRIVER_INSTALLED) {
                for (i = 0; i < driver->num; i++) {
                        tp = driver->termios[i];
                        if (tp) {
                                driver->termios[i] = NULL;
                                kfree(tp);
                        }
                        if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
                                tty_unregister_device(driver, i);
                }
                proc_tty_unregister_driver(driver);
                if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
                        cdev_del(driver->cdevs[0]);
        }
        kfree(driver->cdevs);
        kfree(driver->ports);
        kfree(driver->termios);
        kfree(driver->ttys);
        kfree(driver);
}

/**
 * tty_driver_kref_put - drop a reference to a tty driver
 * @driver: driver of which to drop the reference
 *
 * The final put will destroy and free up the driver.
 */
void tty_driver_kref_put(struct tty_driver *driver)
{
        kref_put(&driver->kref, destruct_tty_driver);
}
EXPORT_SYMBOL(tty_driver_kref_put);

/**
 * tty_register_driver - register a tty driver
 * @driver: driver to register
 *
 * Called by a tty driver to register itself.
 */
int tty_register_driver(struct tty_driver *driver)
{
        int error;
        int i;
        dev_t dev;
        struct device *d;

        if (!driver->major) {
                error = alloc_chrdev_region(&dev, driver->minor_start,
                                                driver->num, driver->name);
                if (!error) {
                        driver->major = MAJOR(dev);
                        driver->minor_start = MINOR(dev);
                }
        } else {
                dev = MKDEV(driver->major, driver->minor_start);
                error = register_chrdev_region(dev, driver->num, driver->name);
        }
        if (error < 0)
                goto err;

        if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
                error = tty_cdev_add(driver, dev, 0, driver->num);
                if (error)
                        goto err_unreg_char;
        }

        mutex_lock(&tty_mutex);
        list_add(&driver->tty_drivers, &tty_drivers);
        mutex_unlock(&tty_mutex);

        if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV)) {
                for (i = 0; i < driver->num; i++) {
                        d = tty_register_device(driver, i, NULL);
                        if (IS_ERR(d)) {
                                error = PTR_ERR(d);
                                goto err_unreg_devs;
                        }
                }
        }
        proc_tty_register_driver(driver);
        driver->flags |= TTY_DRIVER_INSTALLED;
        return 0;

err_unreg_devs:
        for (i--; i >= 0; i--)
                tty_unregister_device(driver, i);

        mutex_lock(&tty_mutex);
        list_del(&driver->tty_drivers);
        mutex_unlock(&tty_mutex);

err_unreg_char:
        unregister_chrdev_region(dev, driver->num);
err:
        return error;
}
EXPORT_SYMBOL(tty_register_driver);

/**
 * tty_unregister_driver - unregister a tty driver
 * @driver: driver to unregister
 *
 * Called by a tty driver to unregister itself.
 */
void tty_unregister_driver(struct tty_driver *driver)
{
        unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
                                driver->num);
        mutex_lock(&tty_mutex);
        list_del(&driver->tty_drivers);
        mutex_unlock(&tty_mutex);
}
EXPORT_SYMBOL(tty_unregister_driver);

dev_t tty_devnum(struct tty_struct *tty)
{
        return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
}
EXPORT_SYMBOL(tty_devnum);

void tty_default_fops(struct file_operations *fops)
{
        *fops = tty_fops;
}

static char *tty_devnode(const struct device *dev, umode_t *mode)
{
        if (!mode)
                return NULL;
        if (dev->devt == MKDEV(TTYAUX_MAJOR, 0) ||
            dev->devt == MKDEV(TTYAUX_MAJOR, 2))
                *mode = 0666;
        return NULL;
}

const struct class tty_class = {
        .name                = "tty",
        .devnode        = tty_devnode,
};

static int __init tty_class_init(void)
{
        return class_register(&tty_class);
}

postcore_initcall(tty_class_init);

/* 3/2004 jmc: why do these devices exist? */
static struct cdev tty_cdev, console_cdev;

static ssize_t show_cons_active(struct device *dev,
                                struct device_attribute *attr, char *buf)
{
        struct console *cs[16];
        int i = 0;
        struct console *c;
        ssize_t count = 0;

        /*
         * Hold the console_list_lock to guarantee that no consoles are
         * unregistered until all console processing is complete.
         * This also allows safe traversal of the console list and
         * race-free reading of @flags.
         */
        console_list_lock();

        for_each_console(c) {
                if (!c->device)
                        continue;
                if (!(c->flags & CON_NBCON) && !c->write)
                        continue;
                if ((c->flags & CON_ENABLED) == 0)
                        continue;
                cs[i++] = c;
                if (i >= ARRAY_SIZE(cs))
                        break;
        }

        /*
         * Take console_lock to serialize device() callback with
         * other console operations. For example, fg_console is
         * modified under console_lock when switching vt.
         */
        console_lock();
        while (i--) {
                int index = cs[i]->index;
                struct tty_driver *drv = cs[i]->device(cs[i], &index);

                /* don't resolve tty0 as some programs depend on it */
                if (drv && (cs[i]->index > 0 || drv->major != TTY_MAJOR))
                        count += tty_line_name(drv, index, buf + count);
                else
                        count += sprintf(buf + count, "%s%d",
                                         cs[i]->name, cs[i]->index);

                count += sprintf(buf + count, "%c", i ? ' ':'\n');
        }
        console_unlock();

        console_list_unlock();

        return count;
}
static DEVICE_ATTR(active, S_IRUGO, show_cons_active, NULL);

static struct attribute *cons_dev_attrs[] = {
        &dev_attr_active.attr,
        NULL
};

ATTRIBUTE_GROUPS(cons_dev);

static struct device *consdev;

void console_sysfs_notify(void)
{
        if (consdev)
                sysfs_notify(&consdev->kobj, NULL, "active");
}

static const struct ctl_table tty_table[] = {
        {
                .procname        = "legacy_tiocsti",
                .data                = &tty_legacy_tiocsti,
                .maxlen                = sizeof(tty_legacy_tiocsti),
                .mode                = 0644,
                .proc_handler        = proc_dobool,
        },
        {
                .procname        = "ldisc_autoload",
                .data                = &tty_ldisc_autoload,
                .maxlen                = sizeof(tty_ldisc_autoload),
                .mode                = 0644,
                .proc_handler        = proc_dointvec_minmax,
                .extra1                = SYSCTL_ZERO,
                .extra2                = SYSCTL_ONE,
        },
};

/*
 * Ok, now we can initialize the rest of the tty devices and can count
 * on memory allocations, interrupts etc..
 */
int __init tty_init(void)
{
        register_sysctl_init("dev/tty", tty_table);
        cdev_init(&tty_cdev, &tty_fops);
        if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
                panic("Couldn't register /dev/tty driver\n");
        device_create(&tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), NULL, "tty");

        cdev_init(&console_cdev, &console_fops);
        if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
                panic("Couldn't register /dev/console driver\n");
        consdev = device_create_with_groups(&tty_class, NULL,
                                            MKDEV(TTYAUX_MAJOR, 1), NULL,
                                            cons_dev_groups, "console");
        if (IS_ERR(consdev))
                consdev = NULL;

#ifdef CONFIG_VT
        vty_init(&console_fops);
#endif
        return 0;
}




































 20092 




 15487 
   39 



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _NF_CONNTRACK_COMMON_H
#define _NF_CONNTRACK_COMMON_H

#include <linux/refcount.h>
#include <uapi/linux/netfilter/nf_conntrack_common.h>

struct ip_conntrack_stat {
        unsigned int found;
        unsigned int invalid;
        unsigned int insert;
        unsigned int insert_failed;
        unsigned int clash_resolve;
        unsigned int drop;
        unsigned int early_drop;
        unsigned int error;
        unsigned int expect_new;
        unsigned int expect_create;
        unsigned int expect_delete;
        unsigned int search_restart;
        unsigned int chaintoolong;
};

#define NFCT_INFOMASK        7UL
#define NFCT_PTRMASK        ~(NFCT_INFOMASK)

struct nf_conntrack {
        refcount_t use;
};

void nf_conntrack_destroy(struct nf_conntrack *nfct);

/* like nf_ct_put, but without module dependency on nf_conntrack */
static inline void nf_conntrack_put(struct nf_conntrack *nfct)
{
        if (nfct && refcount_dec_and_test(&nfct->use))
                nf_conntrack_destroy(nfct);
}
static inline void nf_conntrack_get(struct nf_conntrack *nfct)
{
        if (nfct)
                refcount_inc(&nfct->use);
}

#endif /* _NF_CONNTRACK_COMMON_H */

















































    1 






























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * Copyright (C) 2019 HUAWEI, Inc.
 *             https://www.huawei.com/
 */
#ifndef __EROFS_FS_COMPRESS_H
#define __EROFS_FS_COMPRESS_H

#include "internal.h"

struct z_erofs_decompress_req {
        struct super_block *sb;
        struct page **in, **out;
        unsigned short pageofs_in, pageofs_out;
        unsigned int inputsize, outputsize;

        unsigned int alg;       /* the algorithm for decompression */
        bool inplace_io, partial_decoding, fillgaps;
        gfp_t gfp;      /* allocation flags for extra temporary buffers */
};

struct z_erofs_decompressor {
        int (*config)(struct super_block *sb, struct erofs_super_block *dsb,
                      void *data, int size);
        int (*decompress)(struct z_erofs_decompress_req *rq,
                          struct page **pagepool);
        int (*init)(void);
        void (*exit)(void);
        char *name;
};

#define Z_EROFS_SHORTLIVED_PAGE                (-1UL << 2)
#define Z_EROFS_PREALLOCATED_FOLIO        ((void *)(-2UL << 2))

/*
 * Currently, short-lived pages are pages directly from buddy system
 * with specific page->private (Z_EROFS_SHORTLIVED_PAGE).
 * In the future world of Memdescs, it should be type 0 (Misc) memory
 * which type can be checked with a new helper.
 */
static inline bool z_erofs_is_shortlived_page(struct page *page)
{
        return page->private == Z_EROFS_SHORTLIVED_PAGE;
}

static inline bool z_erofs_put_shortlivedpage(struct page **pagepool,
                                              struct page *page)
{
        if (!z_erofs_is_shortlived_page(page))
                return false;
        erofs_pagepool_add(pagepool, page);
        return true;
}

extern const struct z_erofs_decompressor z_erofs_lzma_decomp;
extern const struct z_erofs_decompressor z_erofs_deflate_decomp;
extern const struct z_erofs_decompressor z_erofs_zstd_decomp;
extern const struct z_erofs_decompressor *z_erofs_decomp[];

struct z_erofs_stream_dctx {
        struct z_erofs_decompress_req *rq;
        unsigned int inpages, outpages;        /* # of {en,de}coded pages */
        int no, ni;                        /* the current {en,de}coded page # */

        unsigned int avail_out;                /* remaining bytes in the decoded buffer */
        unsigned int inbuf_pos, inbuf_sz;
                                        /* current status of the encoded buffer */
        u8 *kin, *kout;                        /* buffer mapped pointers */
        void *bounce;                        /* bounce buffer for inplace I/Os */
        bool bounced;                        /* is the bounce buffer used now? */
};

int z_erofs_stream_switch_bufs(struct z_erofs_stream_dctx *dctx, void **dst,
                               void **src, struct page **pgpl);
int z_erofs_fixup_insize(struct z_erofs_decompress_req *rq, const char *padbuf,
                         unsigned int padbufsize);
int __init z_erofs_init_decompressor(void);
void z_erofs_exit_decompressor(void);
#endif



























































































   85 



    8 


   76 





   77 






   27 


    8 
    8 



   26 



    2 




   73 







   19 

















   67 


   66 
































































   84 


   85 



































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Create default crypto algorithm instances.
 *
 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au>
 */

#include <crypto/internal/aead.h>
#include <linux/completion.h>
#include <linux/ctype.h>
#include <linux/err.h>
#include <linux/init.h>
#include <linux/kthread.h>
#include <linux/module.h>
#include <linux/notifier.h>
#include <linux/rtnetlink.h>
#include <linux/sched/signal.h>
#include <linux/slab.h>
#include <linux/string.h>

#include "internal.h"

struct cryptomgr_param {
        struct rtattr *tb[CRYPTO_MAX_ATTRS + 2];

        struct {
                struct rtattr attr;
                struct crypto_attr_type data;
        } type;

        struct {
                struct rtattr attr;
                struct crypto_attr_alg data;
        } attrs[CRYPTO_MAX_ATTRS];

        char template[CRYPTO_MAX_ALG_NAME];

        struct crypto_larval *larval;

        u32 otype;
        u32 omask;
};

struct crypto_test_param {
        char driver[CRYPTO_MAX_ALG_NAME];
        char alg[CRYPTO_MAX_ALG_NAME];
        u32 type;
};

static int cryptomgr_probe(void *data)
{
        struct cryptomgr_param *param = data;
        struct crypto_template *tmpl;
        int err = -ENOENT;

        tmpl = crypto_lookup_template(param->template);
        if (!tmpl)
                goto out;

        do {
                err = tmpl->create(tmpl, param->tb);
        } while (err == -EAGAIN && !signal_pending(current));

        crypto_tmpl_put(tmpl);

out:
        param->larval->adult = ERR_PTR(err);
        param->larval->alg.cra_flags |= CRYPTO_ALG_DEAD;
        complete_all(&param->larval->completion);
        crypto_alg_put(&param->larval->alg);
        kfree(param);
        module_put_and_kthread_exit(0);
}

static int cryptomgr_schedule_probe(struct crypto_larval *larval)
{
        struct task_struct *thread;
        struct cryptomgr_param *param;
        const char *name = larval->alg.cra_name;
        const char *p;
        unsigned int len;
        int i;

        if (!try_module_get(THIS_MODULE))
                goto err;

        param = kzalloc(sizeof(*param), GFP_KERNEL);
        if (!param)
                goto err_put_module;

        for (p = name; isalnum(*p) || *p == '-' || *p == '_'; p++)
                ;

        len = p - name;
        if (!len || *p != '(')
                goto err_free_param;

        memcpy(param->template, name, len);

        i = 0;
        for (;;) {
                name = ++p;

                for (; isalnum(*p) || *p == '-' || *p == '_'; p++)
                        ;

                if (*p == '(') {
                        int recursion = 0;

                        for (;;) {
                                if (!*++p)
                                        goto err_free_param;
                                if (*p == '(')
                                        recursion++;
                                else if (*p == ')' && !recursion--)
                                        break;
                        }

                        p++;
                }

                len = p - name;
                if (!len)
                        goto err_free_param;

                param->attrs[i].attr.rta_len = sizeof(param->attrs[i]);
                param->attrs[i].attr.rta_type = CRYPTOA_ALG;
                memcpy(param->attrs[i].data.name, name, len);

                param->tb[i + 1] = &param->attrs[i].attr;
                i++;

                if (i >= CRYPTO_MAX_ATTRS)
                        goto err_free_param;

                if (*p == ')')
                        break;

                if (*p != ',')
                        goto err_free_param;
        }

        param->tb[i + 1] = NULL;

        param->type.attr.rta_len = sizeof(param->type);
        param->type.attr.rta_type = CRYPTOA_TYPE;
        param->type.data.type = larval->alg.cra_flags & ~CRYPTO_ALG_TESTED;
        param->type.data.mask = larval->mask & ~CRYPTO_ALG_TESTED;
        param->tb[0] = &param->type.attr;

        param->otype = larval->alg.cra_flags;
        param->omask = larval->mask;

        crypto_alg_get(&larval->alg);
        param->larval = larval;

        thread = kthread_run(cryptomgr_probe, param, "cryptomgr_probe");
        if (IS_ERR(thread))
                goto err_put_larval;

        return NOTIFY_STOP;

err_put_larval:
        crypto_alg_put(&larval->alg);
err_free_param:
        kfree(param);
err_put_module:
        module_put(THIS_MODULE);
err:
        return NOTIFY_OK;
}

static int cryptomgr_test(void *data)
{
        struct crypto_test_param *param = data;
        u32 type = param->type;
        int err;

        err = alg_test(param->driver, param->alg, type, CRYPTO_ALG_TESTED);

        crypto_alg_tested(param->driver, err);

        kfree(param);
        module_put_and_kthread_exit(0);
}

static int cryptomgr_schedule_test(struct crypto_alg *alg)
{
        struct task_struct *thread;
        struct crypto_test_param *param;

        if (IS_ENABLED(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS))
                return NOTIFY_DONE;

        if (!try_module_get(THIS_MODULE))
                goto err;

        param = kzalloc(sizeof(*param), GFP_KERNEL);
        if (!param)
                goto err_put_module;

        memcpy(param->driver, alg->cra_driver_name, sizeof(param->driver));
        memcpy(param->alg, alg->cra_name, sizeof(param->alg));
        param->type = alg->cra_flags;

        thread = kthread_run(cryptomgr_test, param, "cryptomgr_test");
        if (IS_ERR(thread))
                goto err_free_param;

        return NOTIFY_STOP;

err_free_param:
        kfree(param);
err_put_module:
        module_put(THIS_MODULE);
err:
        return NOTIFY_OK;
}

static int cryptomgr_notify(struct notifier_block *this, unsigned long msg,
                            void *data)
{
        switch (msg) {
        case CRYPTO_MSG_ALG_REQUEST:
                return cryptomgr_schedule_probe(data);
        case CRYPTO_MSG_ALG_REGISTER:
                return cryptomgr_schedule_test(data);
        case CRYPTO_MSG_ALG_LOADED:
                break;
        }

        return NOTIFY_DONE;
}

static struct notifier_block cryptomgr_notifier = {
        .notifier_call = cryptomgr_notify,
};

static int __init cryptomgr_init(void)
{
        return crypto_register_notifier(&cryptomgr_notifier);
}

static void __exit cryptomgr_exit(void)
{
        int err = crypto_unregister_notifier(&cryptomgr_notifier);
        BUG_ON(err);
}

/*
 * This is arch_initcall() so that the crypto self-tests are run on algorithms
 * registered early by subsys_initcall().  subsys_initcall() is needed for
 * generic implementations so that they're available for comparison tests when
 * other implementations are registered later by module_init().
 */
arch_initcall(cryptomgr_init);
module_exit(cryptomgr_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Crypto Algorithm Manager");






































   29 






   29 


    3 


    1 




    3 









    1 









   22 




   22 























    4 




   16 



   16 

    6 





   25 




























    8 














    8 

    3 

















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/fs.h>
#include <linux/fs_struct.h>
#include <linux/kernel_read_file.h>
#include <linux/security.h>
#include <linux/vmalloc.h>

/**
 * kernel_read_file() - read file contents into a kernel buffer
 *
 * @file:        file to read from
 * @offset:        where to start reading from (see below).
 * @buf:        pointer to a "void *" buffer for reading into (if
 *                *@buf is NULL, a buffer will be allocated, and
 *                @buf_size will be ignored)
 * @buf_size:        size of buf, if already allocated. If @buf not
 *                allocated, this is the largest size to allocate.
 * @file_size:        if non-NULL, the full size of @file will be
 *                written here.
 * @id:                the kernel_read_file_id identifying the type of
 *                file contents being read (for LSMs to examine)
 *
 * @offset must be 0 unless both @buf and @file_size are non-NULL
 * (i.e. the caller must be expecting to read partial file contents
 * via an already-allocated @buf, in at most @buf_size chunks, and
 * will be able to determine when the entire file was read by
 * checking @file_size). This isn't a recommended way to read a
 * file, though, since it is possible that the contents might
 * change between calls to kernel_read_file().
 *
 * Returns number of bytes read (no single read will be bigger
 * than SSIZE_MAX), or negative on error.
 *
 */
ssize_t kernel_read_file(struct file *file, loff_t offset, void **buf,
                         size_t buf_size, size_t *file_size,
                         enum kernel_read_file_id id)
{
        loff_t i_size, pos;
        ssize_t copied;
        void *allocated = NULL;
        bool whole_file;
        int ret;

        if (offset != 0 && (!*buf || !file_size))
                return -EINVAL;

        if (!S_ISREG(file_inode(file)->i_mode))
                return -EINVAL;

        ret = deny_write_access(file);
        if (ret)
                return ret;

        i_size = i_size_read(file_inode(file));
        if (i_size <= 0) {
                ret = -EINVAL;
                goto out;
        }
        /* The file is too big for sane activities. */
        if (i_size > SSIZE_MAX) {
                ret = -EFBIG;
                goto out;
        }
        /* The entire file cannot be read in one buffer. */
        if (!file_size && offset == 0 && i_size > buf_size) {
                ret = -EFBIG;
                goto out;
        }

        whole_file = (offset == 0 && i_size <= buf_size);
        ret = security_kernel_read_file(file, id, whole_file);
        if (ret)
                goto out;

        if (file_size)
                *file_size = i_size;

        if (!*buf)
                *buf = allocated = vmalloc(i_size);
        if (!*buf) {
                ret = -ENOMEM;
                goto out;
        }

        pos = offset;
        copied = 0;
        while (copied < buf_size) {
                ssize_t bytes;
                size_t wanted = min_t(size_t, buf_size - copied,
                                              i_size - pos);

                bytes = kernel_read(file, *buf + copied, wanted, &pos);
                if (bytes < 0) {
                        ret = bytes;
                        goto out_free;
                }

                if (bytes == 0)
                        break;
                copied += bytes;
        }

        if (whole_file) {
                if (pos != i_size) {
                        ret = -EIO;
                        goto out_free;
                }

                ret = security_kernel_post_read_file(file, *buf, i_size, id);
        }

out_free:
        if (ret < 0) {
                if (allocated) {
                        vfree(*buf);
                        *buf = NULL;
                }
        }

out:
        allow_write_access(file);
        return ret == 0 ? copied : ret;
}
EXPORT_SYMBOL_GPL(kernel_read_file);

ssize_t kernel_read_file_from_path(const char *path, loff_t offset, void **buf,
                                   size_t buf_size, size_t *file_size,
                                   enum kernel_read_file_id id)
{
        struct file *file;
        ssize_t ret;

        if (!path || !*path)
                return -EINVAL;

        file = filp_open(path, O_RDONLY, 0);
        if (IS_ERR(file))
                return PTR_ERR(file);

        ret = kernel_read_file(file, offset, buf, buf_size, file_size, id);
        fput(file);
        return ret;
}
EXPORT_SYMBOL_GPL(kernel_read_file_from_path);

ssize_t kernel_read_file_from_path_initns(const char *path, loff_t offset,
                                          void **buf, size_t buf_size,
                                          size_t *file_size,
                                          enum kernel_read_file_id id)
{
        struct file *file;
        struct path root;
        ssize_t ret;

        if (!path || !*path)
                return -EINVAL;

        task_lock(&init_task);
        get_fs_root(init_task.fs, &root);
        task_unlock(&init_task);

        file = file_open_root(&root, path, O_RDONLY, 0);
        path_put(&root);
        if (IS_ERR(file))
                return PTR_ERR(file);

        ret = kernel_read_file(file, offset, buf, buf_size, file_size, id);
        fput(file);
        return ret;
}
EXPORT_SYMBOL_GPL(kernel_read_file_from_path_initns);

ssize_t kernel_read_file_from_fd(int fd, loff_t offset, void **buf,
                                 size_t buf_size, size_t *file_size,
                                 enum kernel_read_file_id id)
{
        CLASS(fd, f)(fd);

        if (fd_empty(f) || !(fd_file(f)->f_mode & FMODE_READ))
                return -EBADF;

        return kernel_read_file(fd_file(f), offset, buf, buf_size, file_size, id);
}
EXPORT_SYMBOL_GPL(kernel_read_file_from_fd);







































































































   40 






    5 

   38 














   32 

   32 
















    4 


    4 



    4 


    4 



   33 











   26 




    7 






   20 


    1 
    8 


    6 







   11 


   11 




   15 



   12 

   12 


   22 
    3 









    2 





   22 




    2 







    2 






    2 






    1 







    3 





    1 









   29 


    4 


   24 





    1 




















   24 



   24 




    7 














    2 






    3 





    9 







   10 






    1 







    3 












    2 




    2 





    1 


    1 










    1 






















    1 







    1 





1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *  MIDI byte <-> sequencer event coder
 *
 *  Copyright (C) 1998,99 Takashi Iwai <tiwai@suse.de>,
 *                        Jaroslav Kysela <perex@perex.cz>
 */

#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/module.h>
#include <sound/core.h>
#include <sound/seq_kernel.h>
#include <sound/seq_midi_event.h>
#include <sound/asoundef.h>

MODULE_AUTHOR("Takashi Iwai <tiwai@suse.de>, Jaroslav Kysela <perex@perex.cz>");
MODULE_DESCRIPTION("MIDI byte <-> sequencer event coder");
MODULE_LICENSE("GPL");

/* event type, index into status_event[] */
/* from 0 to 6 are normal commands (note off, on, etc.) for 0x9?-0xe? */
#define ST_INVALID        7
#define ST_SPECIAL        8
#define ST_SYSEX        ST_SPECIAL
/* from 8 to 15 are events for 0xf0-0xf7 */


/*
 * prototypes
 */
static void note_event(struct snd_midi_event *dev, struct snd_seq_event *ev);
static void one_param_ctrl_event(struct snd_midi_event *dev, struct snd_seq_event *ev);
static void pitchbend_ctrl_event(struct snd_midi_event *dev, struct snd_seq_event *ev);
static void two_param_ctrl_event(struct snd_midi_event *dev, struct snd_seq_event *ev);
static void one_param_event(struct snd_midi_event *dev, struct snd_seq_event *ev);
static void songpos_event(struct snd_midi_event *dev, struct snd_seq_event *ev);
static void note_decode(struct snd_seq_event *ev, unsigned char *buf);
static void one_param_decode(struct snd_seq_event *ev, unsigned char *buf);
static void pitchbend_decode(struct snd_seq_event *ev, unsigned char *buf);
static void two_param_decode(struct snd_seq_event *ev, unsigned char *buf);
static void songpos_decode(struct snd_seq_event *ev, unsigned char *buf);

/*
 * event list
 */
static struct status_event_list {
        int event;
        int qlen;
        void (*encode)(struct snd_midi_event *dev, struct snd_seq_event *ev);
        void (*decode)(struct snd_seq_event *ev, unsigned char *buf);
} status_event[] = {
        /* 0x80 - 0xef */
        {SNDRV_SEQ_EVENT_NOTEOFF,         2, note_event, note_decode},
        {SNDRV_SEQ_EVENT_NOTEON,         2, note_event, note_decode},
        {SNDRV_SEQ_EVENT_KEYPRESS,         2, note_event, note_decode},
        {SNDRV_SEQ_EVENT_CONTROLLER,         2, two_param_ctrl_event, two_param_decode},
        {SNDRV_SEQ_EVENT_PGMCHANGE,         1, one_param_ctrl_event, one_param_decode},
        {SNDRV_SEQ_EVENT_CHANPRESS,         1, one_param_ctrl_event, one_param_decode},
        {SNDRV_SEQ_EVENT_PITCHBEND,         2, pitchbend_ctrl_event, pitchbend_decode},
        /* invalid */
        {SNDRV_SEQ_EVENT_NONE,                -1, NULL, NULL},
        /* 0xf0 - 0xff */
        {SNDRV_SEQ_EVENT_SYSEX,                 1, NULL, NULL}, /* sysex: 0xf0 */
        {SNDRV_SEQ_EVENT_QFRAME,         1, one_param_event, one_param_decode}, /* 0xf1 */
        {SNDRV_SEQ_EVENT_SONGPOS,         2, songpos_event, songpos_decode}, /* 0xf2 */
        {SNDRV_SEQ_EVENT_SONGSEL,         1, one_param_event, one_param_decode}, /* 0xf3 */
        {SNDRV_SEQ_EVENT_NONE,                -1, NULL, NULL}, /* 0xf4 */
        {SNDRV_SEQ_EVENT_NONE,                -1, NULL, NULL}, /* 0xf5 */
        {SNDRV_SEQ_EVENT_TUNE_REQUEST,         0, NULL, NULL}, /* 0xf6 */
        {SNDRV_SEQ_EVENT_NONE,                -1, NULL, NULL}, /* 0xf7 */
        {SNDRV_SEQ_EVENT_CLOCK,                 0, NULL, NULL}, /* 0xf8 */
        {SNDRV_SEQ_EVENT_NONE,                -1, NULL, NULL}, /* 0xf9 */
        {SNDRV_SEQ_EVENT_START,                 0, NULL, NULL}, /* 0xfa */
        {SNDRV_SEQ_EVENT_CONTINUE,         0, NULL, NULL}, /* 0xfb */
        {SNDRV_SEQ_EVENT_STOP,                  0, NULL, NULL}, /* 0xfc */
        {SNDRV_SEQ_EVENT_NONE,                 -1, NULL, NULL}, /* 0xfd */
        {SNDRV_SEQ_EVENT_SENSING,          0, NULL, NULL}, /* 0xfe */
        {SNDRV_SEQ_EVENT_RESET,          0, NULL, NULL}, /* 0xff */
};

static int extra_decode_ctrl14(struct snd_midi_event *dev, unsigned char *buf, int len,
                               struct snd_seq_event *ev);
static int extra_decode_xrpn(struct snd_midi_event *dev, unsigned char *buf, int count,
                             struct snd_seq_event *ev);

static struct extra_event_list {
        int event;
        int (*decode)(struct snd_midi_event *dev, unsigned char *buf, int len,
                      struct snd_seq_event *ev);
} extra_event[] = {
        {SNDRV_SEQ_EVENT_CONTROL14, extra_decode_ctrl14},
        {SNDRV_SEQ_EVENT_NONREGPARAM, extra_decode_xrpn},
        {SNDRV_SEQ_EVENT_REGPARAM, extra_decode_xrpn},
};

/*
 *  new/delete record
 */

int snd_midi_event_new(int bufsize, struct snd_midi_event **rdev)
{
        struct snd_midi_event *dev;

        *rdev = NULL;
        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
        if (dev == NULL)
                return -ENOMEM;
        if (bufsize > 0) {
                dev->buf = kmalloc(bufsize, GFP_KERNEL);
                if (dev->buf == NULL) {
                        kfree(dev);
                        return -ENOMEM;
                }
        }
        dev->bufsize = bufsize;
        dev->lastcmd = 0xff;
        dev->type = ST_INVALID;
        spin_lock_init(&dev->lock);
        *rdev = dev;
        return 0;
}
EXPORT_SYMBOL(snd_midi_event_new);

void snd_midi_event_free(struct snd_midi_event *dev)
{
        if (dev != NULL) {
                kfree(dev->buf);
                kfree(dev);
        }
}
EXPORT_SYMBOL(snd_midi_event_free);

/*
 * initialize record
 */
static inline void reset_encode(struct snd_midi_event *dev)
{
        dev->read = 0;
        dev->qlen = 0;
        dev->type = ST_INVALID;
}

void snd_midi_event_reset_encode(struct snd_midi_event *dev)
{
        guard(spinlock_irqsave)(&dev->lock);
        reset_encode(dev);
}
EXPORT_SYMBOL(snd_midi_event_reset_encode);

void snd_midi_event_reset_decode(struct snd_midi_event *dev)
{
        guard(spinlock_irqsave)(&dev->lock);
        dev->lastcmd = 0xff;
}
EXPORT_SYMBOL(snd_midi_event_reset_decode);

void snd_midi_event_no_status(struct snd_midi_event *dev, int on)
{
        dev->nostat = on ? 1 : 0;
}
EXPORT_SYMBOL(snd_midi_event_no_status);

/*
 *  read one byte and encode to sequencer event:
 *  return true if MIDI bytes are encoded to an event
 *         false data is not finished
 */
bool snd_midi_event_encode_byte(struct snd_midi_event *dev, unsigned char c,
                                struct snd_seq_event *ev)
{
        bool rc = false;

        if (c >= MIDI_CMD_COMMON_CLOCK) {
                /* real-time event */
                ev->type = status_event[ST_SPECIAL + c - 0xf0].event;
                ev->flags &= ~SNDRV_SEQ_EVENT_LENGTH_MASK;
                ev->flags |= SNDRV_SEQ_EVENT_LENGTH_FIXED;
                return ev->type != SNDRV_SEQ_EVENT_NONE;
        }

        guard(spinlock_irqsave)(&dev->lock);
        if ((c & 0x80) &&
            (c != MIDI_CMD_COMMON_SYSEX_END || dev->type != ST_SYSEX)) {
                /* new command */
                dev->buf[0] = c;
                if ((c & 0xf0) == 0xf0) /* system messages */
                        dev->type = (c & 0x0f) + ST_SPECIAL;
                else
                        dev->type = (c >> 4) & 0x07;
                dev->read = 1;
                dev->qlen = status_event[dev->type].qlen;
        } else {
                if (dev->qlen > 0) {
                        /* rest of command */
                        dev->buf[dev->read++] = c;
                        if (dev->type != ST_SYSEX)
                                dev->qlen--;
                } else {
                        /* running status */
                        dev->buf[1] = c;
                        dev->qlen = status_event[dev->type].qlen - 1;
                        dev->read = 2;
                }
        }
        if (dev->qlen == 0) {
                ev->type = status_event[dev->type].event;
                ev->flags &= ~SNDRV_SEQ_EVENT_LENGTH_MASK;
                ev->flags |= SNDRV_SEQ_EVENT_LENGTH_FIXED;
                if (status_event[dev->type].encode) /* set data values */
                        status_event[dev->type].encode(dev, ev);
                if (dev->type >= ST_SPECIAL)
                        dev->type = ST_INVALID;
                rc = true;
        } else         if (dev->type == ST_SYSEX) {
                if (c == MIDI_CMD_COMMON_SYSEX_END ||
                    dev->read >= dev->bufsize) {
                        ev->flags &= ~SNDRV_SEQ_EVENT_LENGTH_MASK;
                        ev->flags |= SNDRV_SEQ_EVENT_LENGTH_VARIABLE;
                        ev->type = SNDRV_SEQ_EVENT_SYSEX;
                        ev->data.ext.len = dev->read;
                        ev->data.ext.ptr = dev->buf;
                        if (c != MIDI_CMD_COMMON_SYSEX_END)
                                dev->read = 0; /* continue to parse */
                        else
                                reset_encode(dev); /* all parsed */
                        rc = true;
                }
        }

        return rc;
}
EXPORT_SYMBOL(snd_midi_event_encode_byte);

/* encode note event */
static void note_event(struct snd_midi_event *dev, struct snd_seq_event *ev)
{
        ev->data.note.channel = dev->buf[0] & 0x0f;
        ev->data.note.note = dev->buf[1];
        ev->data.note.velocity = dev->buf[2];
}

/* encode one parameter controls */
static void one_param_ctrl_event(struct snd_midi_event *dev, struct snd_seq_event *ev)
{
        ev->data.control.channel = dev->buf[0] & 0x0f;
        ev->data.control.value = dev->buf[1];
}

/* encode pitch wheel change */
static void pitchbend_ctrl_event(struct snd_midi_event *dev, struct snd_seq_event *ev)
{
        ev->data.control.channel = dev->buf[0] & 0x0f;
        ev->data.control.value = (int)dev->buf[2] * 128 + (int)dev->buf[1] - 8192;
}

/* encode midi control change */
static void two_param_ctrl_event(struct snd_midi_event *dev, struct snd_seq_event *ev)
{
        ev->data.control.channel = dev->buf[0] & 0x0f;
        ev->data.control.param = dev->buf[1];
        ev->data.control.value = dev->buf[2];
}

/* encode one parameter value*/
static void one_param_event(struct snd_midi_event *dev, struct snd_seq_event *ev)
{
        ev->data.control.value = dev->buf[1];
}

/* encode song position */
static void songpos_event(struct snd_midi_event *dev, struct snd_seq_event *ev)
{
        ev->data.control.value = (int)dev->buf[2] * 128 + (int)dev->buf[1];
}

/*
 * decode from a sequencer event to midi bytes
 * return the size of decoded midi events
 */
long snd_midi_event_decode(struct snd_midi_event *dev, unsigned char *buf, long count,
                           struct snd_seq_event *ev)
{
        unsigned int cmd, type;

        if (ev->type == SNDRV_SEQ_EVENT_NONE)
                return -ENOENT;

        for (type = 0; type < ARRAY_SIZE(status_event); type++) {
                if (ev->type == status_event[type].event)
                        goto __found;
        }
        for (type = 0; type < ARRAY_SIZE(extra_event); type++) {
                if (ev->type == extra_event[type].event)
                        return extra_event[type].decode(dev, buf, count, ev);
        }
        return -ENOENT;

      __found:
        if (type >= ST_SPECIAL)
                cmd = 0xf0 + (type - ST_SPECIAL);
        else
                /* data.note.channel and data.control.channel is identical */
                cmd = 0x80 | (type << 4) | (ev->data.note.channel & 0x0f);


        if (cmd == MIDI_CMD_COMMON_SYSEX) {
                snd_midi_event_reset_decode(dev);
                return snd_seq_expand_var_event(ev, count, buf, 1, 0);
        } else {
                int qlen;
                unsigned char xbuf[4];
                unsigned long flags;

                spin_lock_irqsave(&dev->lock, flags);
                if ((cmd & 0xf0) == 0xf0 || dev->lastcmd != cmd || dev->nostat) {
                        dev->lastcmd = cmd;
                        spin_unlock_irqrestore(&dev->lock, flags);
                        xbuf[0] = cmd;
                        if (status_event[type].decode)
                                status_event[type].decode(ev, xbuf + 1);
                        qlen = status_event[type].qlen + 1;
                } else {
                        spin_unlock_irqrestore(&dev->lock, flags);
                        if (status_event[type].decode)
                                status_event[type].decode(ev, xbuf + 0);
                        qlen = status_event[type].qlen;
                }
                if (count < qlen)
                        return -ENOMEM;
                memcpy(buf, xbuf, qlen);
                return qlen;
        }
}
EXPORT_SYMBOL(snd_midi_event_decode);


/* decode note event */
static void note_decode(struct snd_seq_event *ev, unsigned char *buf)
{
        buf[0] = ev->data.note.note & 0x7f;
        buf[1] = ev->data.note.velocity & 0x7f;
}

/* decode one parameter controls */
static void one_param_decode(struct snd_seq_event *ev, unsigned char *buf)
{
        buf[0] = ev->data.control.value & 0x7f;
}

/* decode pitch wheel change */
static void pitchbend_decode(struct snd_seq_event *ev, unsigned char *buf)
{
        int value = ev->data.control.value + 8192;
        buf[0] = value & 0x7f;
        buf[1] = (value >> 7) & 0x7f;
}

/* decode midi control change */
static void two_param_decode(struct snd_seq_event *ev, unsigned char *buf)
{
        buf[0] = ev->data.control.param & 0x7f;
        buf[1] = ev->data.control.value & 0x7f;
}

/* decode song position */
static void songpos_decode(struct snd_seq_event *ev, unsigned char *buf)
{
        buf[0] = ev->data.control.value & 0x7f;
        buf[1] = (ev->data.control.value >> 7) & 0x7f;
}

/* decode 14bit control */
static int extra_decode_ctrl14(struct snd_midi_event *dev, unsigned char *buf,
                               int count, struct snd_seq_event *ev)
{
        unsigned char cmd;
        int idx = 0;

        cmd = MIDI_CMD_CONTROL|(ev->data.control.channel & 0x0f);
        if (ev->data.control.param < 0x20) {
                if (count < 4)
                        return -ENOMEM;
                if (dev->nostat && count < 6)
                        return -ENOMEM;
                if (cmd != dev->lastcmd || dev->nostat) {
                        if (count < 5)
                                return -ENOMEM;
                        buf[idx++] = dev->lastcmd = cmd;
                }
                buf[idx++] = ev->data.control.param;
                buf[idx++] = (ev->data.control.value >> 7) & 0x7f;
                if (dev->nostat)
                        buf[idx++] = cmd;
                buf[idx++] = ev->data.control.param + 0x20;
                buf[idx++] = ev->data.control.value & 0x7f;
        } else {
                if (count < 2)
                        return -ENOMEM;
                if (cmd != dev->lastcmd || dev->nostat) {
                        if (count < 3)
                                return -ENOMEM;
                        buf[idx++] = dev->lastcmd = cmd;
                }
                buf[idx++] = ev->data.control.param & 0x7f;
                buf[idx++] = ev->data.control.value & 0x7f;
        }
        return idx;
}

/* decode reg/nonreg param */
static int extra_decode_xrpn(struct snd_midi_event *dev, unsigned char *buf,
                             int count, struct snd_seq_event *ev)
{
        unsigned char cmd;
        const char *cbytes;
        static const char cbytes_nrpn[4] = { MIDI_CTL_NONREG_PARM_NUM_MSB,
                                       MIDI_CTL_NONREG_PARM_NUM_LSB,
                                       MIDI_CTL_MSB_DATA_ENTRY,
                                       MIDI_CTL_LSB_DATA_ENTRY };
        static const char cbytes_rpn[4] =  { MIDI_CTL_REGIST_PARM_NUM_MSB,
                                       MIDI_CTL_REGIST_PARM_NUM_LSB,
                                       MIDI_CTL_MSB_DATA_ENTRY,
                                       MIDI_CTL_LSB_DATA_ENTRY };
        unsigned char bytes[4];
        int idx = 0, i;

        if (count < 8)
                return -ENOMEM;
        if (dev->nostat && count < 12)
                return -ENOMEM;
        cmd = MIDI_CMD_CONTROL|(ev->data.control.channel & 0x0f);
        bytes[0] = (ev->data.control.param & 0x3f80) >> 7;
        bytes[1] = ev->data.control.param & 0x007f;
        bytes[2] = (ev->data.control.value & 0x3f80) >> 7;
        bytes[3] = ev->data.control.value & 0x007f;
        if (cmd != dev->lastcmd && !dev->nostat) {
                if (count < 9)
                        return -ENOMEM;
                buf[idx++] = dev->lastcmd = cmd;
        }
        cbytes = ev->type == SNDRV_SEQ_EVENT_NONREGPARAM ? cbytes_nrpn : cbytes_rpn;
        for (i = 0; i < 4; i++) {
                if (dev->nostat)
                        buf[idx++] = dev->lastcmd = cmd;
                buf[idx++] = cbytes[i];
                buf[idx++] = bytes[i];
        }
        return idx;
}







































































































































































































































































































































































































































































































































































    1 












    3 



    1 
















    4 












1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * cec - HDMI Consumer Electronics Control support header
 *
 * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
 */

#ifndef _MEDIA_CEC_H
#define _MEDIA_CEC_H

#include <linux/poll.h>
#include <linux/fs.h>
#include <linux/device.h>
#include <linux/cdev.h>
#include <linux/kthread.h>
#include <linux/timer.h>
#include <linux/cec-funcs.h>
#include <media/rc-core.h>

#define CEC_CAP_DEFAULTS (CEC_CAP_LOG_ADDRS | CEC_CAP_TRANSMIT | \
                          CEC_CAP_PASSTHROUGH | CEC_CAP_RC)

/**
 * struct cec_devnode - cec device node
 * @dev:        cec device
 * @cdev:        cec character device
 * @minor:        device node minor number
 * @lock:        lock to serialize open/release and registration
 * @registered:        the device was correctly registered
 * @unregistered: the device was unregistered
 * @lock_fhs:        lock to control access to @fhs
 * @fhs:        the list of open filehandles (cec_fh)
 *
 * This structure represents a cec-related device node.
 *
 * To add or remove filehandles from @fhs the @lock must be taken first,
 * followed by @lock_fhs. It is safe to access @fhs if either lock is held.
 *
 * The @parent is a physical device. It must be set by core or device drivers
 * before registering the node.
 */
struct cec_devnode {
        /* sysfs */
        struct device dev;
        struct cdev cdev;

        /* device info */
        int minor;
        /* serialize open/release and registration */
        struct mutex lock;
        bool registered;
        bool unregistered;
        /* protect access to fhs */
        struct mutex lock_fhs;
        struct list_head fhs;
};

struct cec_adapter;
struct cec_data;
struct cec_pin;
struct cec_notifier;

struct cec_data {
        struct list_head list;
        struct list_head xfer_list;
        struct cec_adapter *adap;
        struct cec_msg msg;
        u8 match_len;
        u8 match_reply[5];
        struct cec_fh *fh;
        struct delayed_work work;
        struct completion c;
        u8 attempts;
        bool blocking;
        bool completed;
};

struct cec_msg_entry {
        struct list_head        list;
        struct cec_msg                msg;
};

struct cec_event_entry {
        struct list_head        list;
        struct cec_event        ev;
};

#define CEC_NUM_CORE_EVENTS 2
#define CEC_NUM_EVENTS CEC_EVENT_PIN_5V_HIGH

struct cec_fh {
        struct list_head        list;
        struct list_head        xfer_list;
        struct cec_adapter        *adap;
        u8                        mode_initiator;
        u8                        mode_follower;

        /* Events */
        wait_queue_head_t        wait;
        struct mutex                lock;
        struct list_head        events[CEC_NUM_EVENTS]; /* queued events */
        u16                        queued_events[CEC_NUM_EVENTS];
        unsigned int                total_queued_events;
        struct cec_event_entry        core_events[CEC_NUM_CORE_EVENTS];
        struct list_head        msgs; /* queued messages */
        unsigned int                queued_msgs;
};

#define CEC_SIGNAL_FREE_TIME_RETRY                3
#define CEC_SIGNAL_FREE_TIME_NEW_INITIATOR        5
#define CEC_SIGNAL_FREE_TIME_NEXT_XFER                7

/* The nominal data bit period is 2.4 ms */
#define CEC_FREE_TIME_TO_USEC(ft)                ((ft) * 2400)

struct cec_adap_ops {
        /* Low-level callbacks, called with adap->lock held */
        int (*adap_enable)(struct cec_adapter *adap, bool enable);
        int (*adap_monitor_all_enable)(struct cec_adapter *adap, bool enable);
        int (*adap_monitor_pin_enable)(struct cec_adapter *adap, bool enable);
        int (*adap_log_addr)(struct cec_adapter *adap, u8 logical_addr);
        void (*adap_unconfigured)(struct cec_adapter *adap);
        int (*adap_transmit)(struct cec_adapter *adap, u8 attempts,
                             u32 signal_free_time, struct cec_msg *msg);
        void (*adap_nb_transmit_canceled)(struct cec_adapter *adap,
                                          const struct cec_msg *msg);
        void (*adap_status)(struct cec_adapter *adap, struct seq_file *file);
        void (*adap_free)(struct cec_adapter *adap);

        /* Error injection callbacks, called without adap->lock held */
        int (*error_inj_show)(struct cec_adapter *adap, struct seq_file *sf);
        bool (*error_inj_parse_line)(struct cec_adapter *adap, char *line);

        /* High-level CEC message callback, called without adap->lock held */
        void (*configured)(struct cec_adapter *adap);
        int (*received)(struct cec_adapter *adap, struct cec_msg *msg);
};

/*
 * The minimum message length you can receive (excepting poll messages) is 2.
 * With a transfer rate of at most 36 bytes per second this makes 18 messages
 * per second worst case.
 *
 * We queue at most 3 seconds worth of received messages. The CEC specification
 * requires that messages are replied to within a second, so 3 seconds should
 * give more than enough margin. Since most messages are actually more than 2
 * bytes, this is in practice a lot more than 3 seconds.
 */
#define CEC_MAX_MSG_RX_QUEUE_SZ                (18 * 3)

/*
 * The transmit queue is limited to 1 second worth of messages (worst case).
 * Messages can be transmitted by userspace and kernel space. But for both it
 * makes no sense to have a lot of messages queued up. One second seems
 * reasonable.
 */
#define CEC_MAX_MSG_TX_QUEUE_SZ                (18 * 1)

/**
 * struct cec_adapter - cec adapter structure
 * @owner:                module owner
 * @name:                name of the CEC adapter
 * @devnode:                device node for the /dev/cecX device
 * @lock:                mutex controlling access to this structure
 * @rc:                        remote control device
 * @transmit_queue:        queue of pending transmits
 * @transmit_queue_sz:        number of pending transmits
 * @wait_queue:                queue of transmits waiting for a reply
 * @transmitting:        CEC messages currently being transmitted
 * @transmit_in_progress: true if a transmit is in progress
 * @transmit_in_progress_aborted: true if a transmit is in progress is to be
 *                        aborted. This happens if the logical address is
 *                        invalidated while the transmit is ongoing. In that
 *                        case the transmit will finish, but will not retransmit
 *                        and be marked as ABORTED.
 * @xfer_timeout_ms:        the transfer timeout in ms.
 *                        If 0, then timeout after 2100 ms.
 * @kthread_config:        kthread used to configure a CEC adapter
 * @config_completion:        used to signal completion of the config kthread
 * @kthread:                main CEC processing thread
 * @kthread_waitq:        main CEC processing wait_queue
 * @ops:                cec adapter ops
 * @priv:                cec driver's private data
 * @capabilities:        cec adapter capabilities
 * @available_log_addrs: maximum number of available logical addresses
 * @phys_addr:                the current physical address
 * @needs_hpd:                if true, then the HDMI HotPlug Detect pin must be high
 *        in order to transmit or receive CEC messages. This is usually a HW
 *        limitation.
 * @is_enabled:                the CEC adapter is enabled
 * @is_claiming_log_addrs:  true if cec_claim_log_addrs() is running
 * @is_configuring:        the CEC adapter is configuring (i.e. claiming LAs)
 * @must_reconfigure:        while configuring, the PA changed, so reclaim LAs
 * @is_configured:        the CEC adapter is configured (i.e. has claimed LAs)
 * @cec_pin_is_high:        if true then the CEC pin is high. Only used with the
 *        CEC pin framework.
 * @adap_controls_phys_addr: if true, then the CEC adapter controls the
 *        physical address, i.e. the CEC hardware can detect HPD changes and
 *        read the EDID and is not dependent on an external HDMI driver.
 *        Drivers that need this can set this field to true after the
 *        cec_allocate_adapter() call.
 * @last_initiator:        the initiator of the last transmitted message.
 * @monitor_all_cnt:        number of filehandles monitoring all msgs
 * @monitor_pin_cnt:        number of filehandles monitoring pin changes
 * @follower_cnt:        number of filehandles in follower mode
 * @cec_follower:        filehandle of the exclusive follower
 * @cec_initiator:        filehandle of the exclusive initiator
 * @passthrough:        if true, then the exclusive follower is in
 *        passthrough mode.
 * @log_addrs:                current logical addresses
 * @conn_info:                current connector info
 * @tx_timeout_cnt:        count the number of Timed Out transmits.
 *                        Reset to 0 when this is reported in cec_adap_status().
 * @tx_low_drive_cnt:        count the number of Low Drive transmits.
 *                        Reset to 0 when this is reported in cec_adap_status().
 * @tx_error_cnt:        count the number of Error transmits.
 *                        Reset to 0 when this is reported in cec_adap_status().
 * @tx_arb_lost_cnt:        count the number of Arb Lost transmits.
 *                        Reset to 0 when this is reported in cec_adap_status().
 * @tx_low_drive_log_cnt: number of logged Low Drive transmits since the
 *                        adapter was enabled. Used to avoid flooding the kernel
 *                        log if this happens a lot.
 * @tx_error_log_cnt:        number of logged Error transmits since the adapter was
 *                      enabled. Used to avoid flooding the kernel log if this
 *                      happens a lot.
 * @notifier:                CEC notifier
 * @pin:                CEC pin status struct
 * @cec_dir:                debugfs cec directory
 * @sequence:                transmit sequence counter
 * @input_phys:                remote control input_phys name
 *
 * This structure represents a cec adapter.
 */
struct cec_adapter {
        struct module *owner;
        char name[32];
        struct cec_devnode devnode;
        struct mutex lock;
        struct rc_dev *rc;

        struct list_head transmit_queue;
        unsigned int transmit_queue_sz;
        struct list_head wait_queue;
        struct cec_data *transmitting;
        bool transmit_in_progress;
        bool transmit_in_progress_aborted;
        unsigned int xfer_timeout_ms;

        struct task_struct *kthread_config;
        struct completion config_completion;

        struct task_struct *kthread;
        wait_queue_head_t kthread_waitq;

        const struct cec_adap_ops *ops;
        void *priv;
        u32 capabilities;
        u8 available_log_addrs;

        u16 phys_addr;
        bool needs_hpd;
        bool is_enabled;
        bool is_claiming_log_addrs;
        bool is_configuring;
        bool must_reconfigure;
        bool is_configured;
        bool cec_pin_is_high;
        bool adap_controls_phys_addr;
        u8 last_initiator;
        u32 monitor_all_cnt;
        u32 monitor_pin_cnt;
        u32 follower_cnt;
        struct cec_fh *cec_follower;
        struct cec_fh *cec_initiator;
        bool passthrough;
        struct cec_log_addrs log_addrs;
        struct cec_connector_info conn_info;

        u32 tx_timeout_cnt;
        u32 tx_low_drive_cnt;
        u32 tx_error_cnt;
        u32 tx_arb_lost_cnt;
        u32 tx_low_drive_log_cnt;
        u32 tx_error_log_cnt;

#ifdef CONFIG_CEC_NOTIFIER
        struct cec_notifier *notifier;
#endif
#ifdef CONFIG_CEC_PIN
        struct cec_pin *pin;
#endif

        struct dentry *cec_dir;

        u32 sequence;

        char input_phys[40];
};

static inline int cec_get_device(struct cec_adapter *adap)
{
        struct cec_devnode *devnode = &adap->devnode;

        /*
         * Check if the cec device is available. This needs to be done with
         * the devnode->lock held to prevent an open/unregister race:
         * without the lock, the device could be unregistered and freed between
         * the devnode->registered check and get_device() calls, leading to
         * a crash.
         */
        mutex_lock(&devnode->lock);
        /*
         * return ENODEV if the cec device has been removed
         * already or if it is not registered anymore.
         */
        if (!devnode->registered) {
                mutex_unlock(&devnode->lock);
                return -ENODEV;
        }
        /* and increase the device refcount */
        get_device(&devnode->dev);
        mutex_unlock(&devnode->lock);
        return 0;
}

static inline void cec_put_device(struct cec_adapter *adap)
{
        put_device(&adap->devnode.dev);
}

static inline void *cec_get_drvdata(const struct cec_adapter *adap)
{
        return adap->priv;
}

static inline bool cec_has_log_addr(const struct cec_adapter *adap, u8 log_addr)
{
        return adap->log_addrs.log_addr_mask & (1 << log_addr);
}

static inline bool cec_is_sink(const struct cec_adapter *adap)
{
        return adap->phys_addr == 0;
}

/**
 * cec_is_registered() - is the CEC adapter registered?
 *
 * @adap:        the CEC adapter, may be NULL.
 *
 * Return: true if the adapter is registered, false otherwise.
 */
static inline bool cec_is_registered(const struct cec_adapter *adap)
{
        return adap && adap->devnode.registered;
}

#define cec_phys_addr_exp(pa) \
        ((pa) >> 12), ((pa) >> 8) & 0xf, ((pa) >> 4) & 0xf, (pa) & 0xf

struct edid;
struct drm_connector;

#if IS_REACHABLE(CONFIG_CEC_CORE)
struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops,
                void *priv, const char *name, u32 caps, u8 available_las);
int cec_register_adapter(struct cec_adapter *adap, struct device *parent);
void cec_unregister_adapter(struct cec_adapter *adap);
void cec_delete_adapter(struct cec_adapter *adap);

int cec_s_log_addrs(struct cec_adapter *adap, struct cec_log_addrs *log_addrs,
                    bool block);
void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr,
                     bool block);
void cec_s_phys_addr_from_edid(struct cec_adapter *adap,
                               const struct edid *edid);
void cec_s_conn_info(struct cec_adapter *adap,
                     const struct cec_connector_info *conn_info);
int cec_transmit_msg(struct cec_adapter *adap, struct cec_msg *msg,
                     bool block);

/* Called by the adapter */
void cec_transmit_done_ts(struct cec_adapter *adap, u8 status,
                          u8 arb_lost_cnt, u8 nack_cnt, u8 low_drive_cnt,
                          u8 error_cnt, ktime_t ts);

static inline void cec_transmit_done(struct cec_adapter *adap, u8 status,
                                     u8 arb_lost_cnt, u8 nack_cnt,
                                     u8 low_drive_cnt, u8 error_cnt)
{
        cec_transmit_done_ts(adap, status, arb_lost_cnt, nack_cnt,
                             low_drive_cnt, error_cnt, ktime_get());
}
/*
 * Simplified version of cec_transmit_done for hardware that doesn't retry
 * failed transmits. So this is always just one attempt in which case
 * the status is sufficient.
 */
void cec_transmit_attempt_done_ts(struct cec_adapter *adap,
                                  u8 status, ktime_t ts);

static inline void cec_transmit_attempt_done(struct cec_adapter *adap,
                                             u8 status)
{
        cec_transmit_attempt_done_ts(adap, status, ktime_get());
}

void cec_received_msg_ts(struct cec_adapter *adap,
                         struct cec_msg *msg, ktime_t ts);

static inline void cec_received_msg(struct cec_adapter *adap,
                                    struct cec_msg *msg)
{
        cec_received_msg_ts(adap, msg, ktime_get());
}

/**
 * cec_queue_pin_cec_event() - queue a CEC pin event with a given timestamp.
 *
 * @adap:        pointer to the cec adapter
 * @is_high:        when true the CEC pin is high, otherwise it is low
 * @dropped_events: when true some events were dropped
 * @ts:                the timestamp for this event
 *
 */
void cec_queue_pin_cec_event(struct cec_adapter *adap, bool is_high,
                             bool dropped_events, ktime_t ts);

/**
 * cec_queue_pin_hpd_event() - queue a pin event with a given timestamp.
 *
 * @adap:        pointer to the cec adapter
 * @is_high:        when true the HPD pin is high, otherwise it is low
 * @ts:                the timestamp for this event
 *
 */
void cec_queue_pin_hpd_event(struct cec_adapter *adap, bool is_high, ktime_t ts);

/**
 * cec_queue_pin_5v_event() - queue a pin event with a given timestamp.
 *
 * @adap:        pointer to the cec adapter
 * @is_high:        when true the 5V pin is high, otherwise it is low
 * @ts:                the timestamp for this event
 *
 */
void cec_queue_pin_5v_event(struct cec_adapter *adap, bool is_high, ktime_t ts);

/**
 * cec_get_edid_phys_addr() - find and return the physical address
 *
 * @edid:        pointer to the EDID data
 * @size:        size in bytes of the EDID data
 * @offset:        If not %NULL then the location of the physical address
 *                bytes in the EDID will be returned here. This is set to 0
 *                if there is no physical address found.
 *
 * Return: the physical address or CEC_PHYS_ADDR_INVALID if there is none.
 */
u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
                           unsigned int *offset);

void cec_fill_conn_info_from_drm(struct cec_connector_info *conn_info,
                                 const struct drm_connector *connector);

#else

static inline int cec_register_adapter(struct cec_adapter *adap,
                                       struct device *parent)
{
        return 0;
}

static inline void cec_unregister_adapter(struct cec_adapter *adap)
{
}

static inline void cec_delete_adapter(struct cec_adapter *adap)
{
}

static inline void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr,
                                   bool block)
{
}

static inline void cec_s_phys_addr_from_edid(struct cec_adapter *adap,
                                             const struct edid *edid)
{
}

static inline u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
                                         unsigned int *offset)
{
        if (offset)
                *offset = 0;
        return CEC_PHYS_ADDR_INVALID;
}

static inline void cec_s_conn_info(struct cec_adapter *adap,
                                   const struct cec_connector_info *conn_info)
{
}

static inline void
cec_fill_conn_info_from_drm(struct cec_connector_info *conn_info,
                            const struct drm_connector *connector)
{
        memset(conn_info, 0, sizeof(*conn_info));
}

#endif

/**
 * cec_phys_addr_invalidate() - set the physical address to INVALID
 *
 * @adap:        the CEC adapter
 *
 * This is a simple helper function to invalidate the physical
 * address.
 */
static inline void cec_phys_addr_invalidate(struct cec_adapter *adap)
{
        cec_s_phys_addr(adap, CEC_PHYS_ADDR_INVALID, false);
}

/**
 * cec_get_edid_spa_location() - find location of the Source Physical Address
 *
 * @edid: the EDID
 * @size: the size of the EDID
 *
 * This EDID is expected to be a CEA-861 compliant, which means that there are
 * at least two blocks and one or more of the extensions blocks are CEA-861
 * blocks.
 *
 * The returned location is guaranteed to be <= size-2.
 *
 * This is an inline function since it is used by both CEC and V4L2.
 * Ideally this would go in a module shared by both, but it is overkill to do
 * that for just a single function.
 */
static inline unsigned int cec_get_edid_spa_location(const u8 *edid,
                                                     unsigned int size)
{
        unsigned int blocks = size / 128;
        unsigned int block;
        u8 d;

        /* Sanity check: at least 2 blocks and a multiple of the block size */
        if (blocks < 2 || size % 128)
                return 0;

        /*
         * If there are fewer extension blocks than the size, then update
         * 'blocks'. It is allowed to have more extension blocks than the size,
         * since some hardware can only read e.g. 256 bytes of the EDID, even
         * though more blocks are present. The first CEA-861 extension block
         * should normally be in block 1 anyway.
         */
        if (edid[0x7e] + 1 < blocks)
                blocks = edid[0x7e] + 1;

        for (block = 1; block < blocks; block++) {
                unsigned int offset = block * 128;

                /* Skip any non-CEA-861 extension blocks */
                if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
                        continue;

                /* search Vendor Specific Data Block (tag 3) */
                d = edid[offset + 2] & 0x7f;
                /* Check if there are Data Blocks */
                if (d <= 4)
                        continue;
                if (d > 4) {
                        unsigned int i = offset + 4;
                        unsigned int end = offset + d;

                        /* Note: 'end' is always < 'size' */
                        do {
                                u8 tag = edid[i] >> 5;
                                u8 len = edid[i] & 0x1f;

                                if (tag == 3 && len >= 5 && i + len <= end &&
                                    edid[i + 1] == 0x03 &&
                                    edid[i + 2] == 0x0c &&
                                    edid[i + 3] == 0x00)
                                        return i + 4;
                                i += len + 1;
                        } while (i < end);
                }
        }
        return 0;
}

#endif /* _MEDIA_CEC_H */




























    4 




    4 

    3 












    3 


    4 



    2 

    2 










    4 




    3 

    4 

















    4 




    2 
    4 





    5 





    4 




    5 





























































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
// SPDX-License-Identifier: GPL-2.0
/*
 * proc_tty.c -- handles /proc/tty
 *
 * Copyright 1997, Theodore Ts'o
 */
#include <linux/module.h>
#include <linux/init.h>
#include <linux/errno.h>
#include <linux/time.h>
#include <linux/proc_fs.h>
#include <linux/stat.h>
#include <linux/tty.h>
#include <linux/seq_file.h>
#include <linux/bitops.h>
#include "internal.h"

/*
 * The /proc/tty directory inodes...
 */
static struct proc_dir_entry *proc_tty_driver;

/*
 * This is the handler for /proc/tty/drivers
 */
static void show_tty_range(struct seq_file *m, struct tty_driver *p,
        dev_t from, int num)
{
        seq_printf(m, "%-20s ", p->driver_name ? p->driver_name : "unknown");
        seq_printf(m, "/dev/%-8s ", p->name);
        if (p->num > 1) {
                seq_printf(m, "%3d %d-%d ", MAJOR(from), MINOR(from),
                        MINOR(from) + num - 1);
        } else {
                seq_printf(m, "%3d %7d ", MAJOR(from), MINOR(from));
        }
        switch (p->type) {
        case TTY_DRIVER_TYPE_SYSTEM:
                seq_puts(m, "system");
                if (p->subtype == SYSTEM_TYPE_TTY)
                        seq_puts(m, ":/dev/tty");
                else if (p->subtype == SYSTEM_TYPE_SYSCONS)
                        seq_puts(m, ":console");
                else if (p->subtype == SYSTEM_TYPE_CONSOLE)
                        seq_puts(m, ":vtmaster");
                break;
        case TTY_DRIVER_TYPE_CONSOLE:
                seq_puts(m, "console");
                break;
        case TTY_DRIVER_TYPE_SERIAL:
                seq_puts(m, "serial");
                break;
        case TTY_DRIVER_TYPE_PTY:
                if (p->subtype == PTY_TYPE_MASTER)
                        seq_puts(m, "pty:master");
                else if (p->subtype == PTY_TYPE_SLAVE)
                        seq_puts(m, "pty:slave");
                else
                        seq_puts(m, "pty");
                break;
        default:
                seq_printf(m, "type:%d.%d", p->type, p->subtype);
        }
        seq_putc(m, '\n');
}

static int show_tty_driver(struct seq_file *m, void *v)
{
        struct tty_driver *p = list_entry(v, struct tty_driver, tty_drivers);
        dev_t from = MKDEV(p->major, p->minor_start);
        dev_t to = from + p->num;

        if (&p->tty_drivers == tty_drivers.next) {
                /* pseudo-drivers first */
                seq_printf(m, "%-20s /dev/%-8s ", "/dev/tty", "tty");
                seq_printf(m, "%3d %7d ", TTYAUX_MAJOR, 0);
                seq_puts(m, "system:/dev/tty\n");
                seq_printf(m, "%-20s /dev/%-8s ", "/dev/console", "console");
                seq_printf(m, "%3d %7d ", TTYAUX_MAJOR, 1);
                seq_puts(m, "system:console\n");
#ifdef CONFIG_UNIX98_PTYS
                seq_printf(m, "%-20s /dev/%-8s ", "/dev/ptmx", "ptmx");
                seq_printf(m, "%3d %7d ", TTYAUX_MAJOR, 2);
                seq_puts(m, "system\n");
#endif
#ifdef CONFIG_VT
                seq_printf(m, "%-20s /dev/%-8s ", "/dev/vc/0", "vc/0");
                seq_printf(m, "%3d %7d ", TTY_MAJOR, 0);
                seq_puts(m, "system:vtmaster\n");
#endif
        }

        while (MAJOR(from) < MAJOR(to)) {
                dev_t next = MKDEV(MAJOR(from)+1, 0);
                show_tty_range(m, p, from, next - from);
                from = next;
        }
        if (from != to)
                show_tty_range(m, p, from, to - from);
        return 0;
}

/* iterator */
static void *t_start(struct seq_file *m, loff_t *pos)
{
        mutex_lock(&tty_mutex);
        return seq_list_start(&tty_drivers, *pos);
}

static void *t_next(struct seq_file *m, void *v, loff_t *pos)
{
        return seq_list_next(v, &tty_drivers, pos);
}

static void t_stop(struct seq_file *m, void *v)
{
        mutex_unlock(&tty_mutex);
}

static const struct seq_operations tty_drivers_op = {
        .start        = t_start,
        .next        = t_next,
        .stop        = t_stop,
        .show        = show_tty_driver
};

/*
 * This function is called by tty_register_driver() to handle
 * registering the driver's /proc handler into /proc/tty/driver/<foo>
 */
void proc_tty_register_driver(struct tty_driver *driver)
{
        struct proc_dir_entry *ent;
                
        if (!driver->driver_name || driver->proc_entry ||
            !driver->ops->proc_show)
                return;

        ent = proc_create_single_data(driver->driver_name, 0, proc_tty_driver,
                               driver->ops->proc_show, driver);
        driver->proc_entry = ent;
}

/*
 * This function is called by tty_unregister_driver()
 */
void proc_tty_unregister_driver(struct tty_driver *driver)
{
        struct proc_dir_entry *ent;

        ent = driver->proc_entry;
        if (!ent)
                return;
                
        remove_proc_entry(ent->name, proc_tty_driver);
        
        driver->proc_entry = NULL;
}

/*
 * Called by proc_root_init() to initialize the /proc/tty subtree
 */
void __init proc_tty_init(void)
{
        if (!proc_mkdir("tty", NULL))
                return;
        proc_mkdir("tty/ldisc", NULL);        /* Preserved: it's userspace visible */
        /*
         * /proc/tty/driver/serial reveals the exact character counts for
         * serial links which is just too easy to abuse for inferring