2 files changed, 325 insertions, 175 deletions

diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index 54481a887769..86105efb4eb6 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -4,7 +4,7 @@
  * This HVC device driver provides terminal access using
  * z/VM IUCV communication paths.
  *
- * Copyright IBM Corp. 2008
+ * Copyright IBM Corp. 2008, 2009
  *
  * Author(s):   Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
  */
@@ -15,6 +15,7 @@
 #include <asm/ebcdic.h>
 #include <linux/ctype.h>
 #include <linux/delay.h>
+#include <linux/device.h>
 #include <linux/init.h>
 #include <linux/mempool.h>
 #include <linux/moduleparam.h>
@@ -74,6 +75,7 @@ struct hvc_iucv_private {
         wait_queue_head_t       sndbuf_waitq;   /* wait for send completion */
         struct list_head        tty_outqueue;   /* outgoing IUCV messages */
         struct list_head        tty_inqueue;    /* incoming IUCV messages */
+        struct device           *dev;           /* device structure */
 };
 
 struct iucv_tty_buffer {
@@ -542,7 +544,68 @@ static void flush_sndbuf_sync(struct hvc_iucv_private *priv)
 
         if (sync_wait)
                 wait_event_timeout(priv->sndbuf_waitq,
-                                   tty_outqueue_empty(priv), HZ);
+                                   tty_outqueue_empty(priv), HZ/10);
+}
+
+/**
+ * hvc_iucv_hangup() - Sever IUCV path and schedule hvc tty hang up
+ * @priv:       Pointer to hvc_iucv_private structure
+ *
+ * This routine severs an existing IUCV communication path and hangs
+ * up the underlying HVC terminal device.
+ * The hang-up occurs only if an IUCV communication path is established;
+ * otherwise there is no need to hang up the terminal device.
+ *
+ * The IUCV HVC hang-up is separated into two steps:
+ * 1. After the IUCV path has been severed, the iucv_state is set to
+ *    IUCV_SEVERED.
+ * 2. Later, when the HVC thread calls hvc_iucv_get_chars(), the
+ *    IUCV_SEVERED state causes the tty hang-up in the HVC layer.
+ *
+ * If the tty has not yet been opened, clean up the hvc_iucv_private
+ * structure to allow re-connects.
+ * If the tty has been opened, let get_chars() return -EPIPE to signal
+ * the HVC layer to hang up the tty and, if so, wake up the HVC thread
+ * to call get_chars()...
+ *
+ * Special notes on hanging up a HVC terminal instantiated as console:
+ * Hang-up:     1. do_tty_hangup() replaces file ops (= hung_up_tty_fops)
+ *              2. do_tty_hangup() calls tty->ops->close() for console_filp
+ *                      => no hangup notifier is called by HVC (default)
+ *              2. hvc_close() returns because of tty_hung_up_p(filp)
+ *                      => no delete notifier is called!
+ * Finally, the back-end is not being notified, thus, the tty session is
+ * kept active (TTY_OPEN) to be ready for re-connects.
+ *
+ * Locking:     spin_lock(&priv->lock) w/o disabling bh
+ */
+static void hvc_iucv_hangup(struct hvc_iucv_private *priv)
+{
+        struct iucv_path *path;
+
+        path = NULL;
+        spin_lock(&priv->lock);
+        if (priv->iucv_state == IUCV_CONNECTED) {
+                path = priv->path;
+                priv->path = NULL;
+                priv->iucv_state = IUCV_SEVERED;
+                if (priv->tty_state == TTY_CLOSED)
+                        hvc_iucv_cleanup(priv);
+                else
+                        /* console is special (see above) */
+                        if (priv->is_console) {
+                                hvc_iucv_cleanup(priv);
+                                priv->tty_state = TTY_OPENED;
+                        } else
+                                hvc_kick();
+        }
+        spin_unlock(&priv->lock);
+
+        /* finally sever path (outside of priv->lock due to lock ordering) */
+        if (path) {
+                iucv_path_sever(path, NULL);
+                iucv_path_free(path);
+        }
 }
 
 /**
@@ -735,11 +798,8 @@ out_path_handled:
  * @ipuser:     User specified data for this path
  *              (AF_IUCV: port/service name and originator port)
  *
- * The function also severs the path (as required by the IUCV protocol) and
- * sets the iucv state to IUCV_SEVERED for the associated struct
- * hvc_iucv_private instance. Later, the IUCV_SEVERED state triggers a tty
- * hangup (hvc_iucv_get_chars() / hvc_iucv_write()).
- * If tty portion of the HVC is closed, clean up the outqueue.
+ * This function calls the hvc_iucv_hangup() function for the
+ * respective IUCV HVC terminal.
  *
  * Locking:     struct hvc_iucv_private->lock
  */
@@ -747,33 +807,7 @@ static void hvc_iucv_path_severed(struct iucv_path *path, u8 ipuser[16])
 {
         struct hvc_iucv_private *priv = path->private;
 
-        spin_lock(&priv->lock);
-        priv->iucv_state = IUCV_SEVERED;
-
-        /* If the tty has not yet been opened, clean up the hvc_iucv_private
-         * structure to allow re-connects.
-         * This is also done for our console device because console hangups
-         * are handled specially and no notifier is called by HVC.
-         * The tty session is active (TTY_OPEN) and ready for re-connects...
-         *
-         * If it has been opened, let get_chars() return -EPIPE to signal the
-         * HVC layer to hang up the tty.
-         * If so, we need to wake up the HVC thread to call get_chars()...
-         */
-        priv->path = NULL;
-        if (priv->tty_state == TTY_CLOSED)
-                hvc_iucv_cleanup(priv);
-        else
-                if (priv->is_console) {
-                        hvc_iucv_cleanup(priv);
-                        priv->tty_state = TTY_OPENED;
-                } else
-                        hvc_kick();
-        spin_unlock(&priv->lock);
-
-        /* finally sever path (outside of priv->lock due to lock ordering) */
-        iucv_path_sever(path, ipuser);
-        iucv_path_free(path);
+        hvc_iucv_hangup(priv);
 }
 
 /**
@@ -853,6 +887,37 @@ static void hvc_iucv_msg_complete(struct iucv_path *path,
         destroy_tty_buffer_list(&list_remove);
 }
 
+/**
+ * hvc_iucv_pm_freeze() - Freeze PM callback
+ * @dev:        IUVC HVC terminal device
+ *
+ * Sever an established IUCV communication path and
+ * trigger a hang-up of the underlying HVC terminal.
+ */
+static int hvc_iucv_pm_freeze(struct device *dev)
+{
+        struct hvc_iucv_private *priv = dev_get_drvdata(dev);
+
+        local_bh_disable();
+        hvc_iucv_hangup(priv);
+        local_bh_enable();
+
+        return 0;
+}
+
+/**
+ * hvc_iucv_pm_restore_thaw() - Thaw and restore PM callback
+ * @dev:        IUVC HVC terminal device
+ *
+ * Wake up the HVC thread to trigger hang-up and respective
+ * HVC back-end notifier invocations.
+ */
+static int hvc_iucv_pm_restore_thaw(struct device *dev)
+{
+        hvc_kick();
+        return 0;
+}
+
 
 /* HVC operations */
 static struct hv_ops hvc_iucv_ops = {
@@ -863,6 +928,20 @@ static struct hv_ops hvc_iucv_ops = {
         .notifier_hangup = hvc_iucv_notifier_hangup,
 };
 
+/* Suspend / resume device operations */
+static struct dev_pm_ops hvc_iucv_pm_ops = {
+        .freeze   = hvc_iucv_pm_freeze,
+        .thaw     = hvc_iucv_pm_restore_thaw,
+        .restore  = hvc_iucv_pm_restore_thaw,
+};
+
+/* IUCV HVC device driver */
+static struct device_driver hvc_iucv_driver = {
+        .name = KMSG_COMPONENT,
+        .bus  = &iucv_bus,
+        .pm   = &hvc_iucv_pm_ops,
+};
+
 /**
  * hvc_iucv_alloc() - Allocates a new struct hvc_iucv_private instance
  * @id:                 hvc_iucv_table index
@@ -897,14 +976,12 @@ static int __init hvc_iucv_alloc(int id, unsigned int is_console)
         /* set console flag */
         priv->is_console = is_console;
 
-        /* finally allocate hvc */
+        /* allocate hvc device */
         priv->hvc = hvc_alloc(HVC_IUCV_MAGIC + id, /*             PAGE_SIZE */
                               HVC_IUCV_MAGIC + id, &hvc_iucv_ops, 256);
         if (IS_ERR(priv->hvc)) {
                 rc = PTR_ERR(priv->hvc);
-                free_page((unsigned long) priv->sndbuf);
-                kfree(priv);
-                return rc;
+                goto out_error_hvc;
         }
 
         /* notify HVC thread instead of using polling */
@@ -915,8 +992,45 @@ static int __init hvc_iucv_alloc(int id, unsigned int is_console)
         memcpy(priv->srv_name, name, 8);
         ASCEBC(priv->srv_name, 8);
 
+        /* create and setup device */
+        priv->dev = kzalloc(sizeof(*priv->dev), GFP_KERNEL);
+        if (!priv->dev) {
+                rc = -ENOMEM;
+                goto out_error_dev;
+        }
+        dev_set_name(priv->dev, "hvc_iucv%d", id);
+        dev_set_drvdata(priv->dev, priv);
+        priv->dev->bus = &iucv_bus;
+        priv->dev->parent = iucv_root;
+        priv->dev->driver = &hvc_iucv_driver;
+        priv->dev->release = (void (*)(struct device *)) kfree;
+        rc = device_register(priv->dev);
+        if (rc) {
+                kfree(priv->dev);
+                goto out_error_dev;
+        }
+
         hvc_iucv_table[id] = priv;
         return 0;
+
+out_error_dev:
+        hvc_remove(priv->hvc);
+out_error_hvc:
+        free_page((unsigned long) priv->sndbuf);
+        kfree(priv);
+
+        return rc;
+}
+
+/**
+ * hvc_iucv_destroy() - Destroy and free hvc_iucv_private instances
+ */
+static void __init hvc_iucv_destroy(struct hvc_iucv_private *priv)
+{
+        hvc_remove(priv->hvc);
+        device_unregister(priv->dev);
+        free_page((unsigned long) priv->sndbuf);
+        kfree(priv);
 }
 
 /**
@@ -1109,6 +1223,11 @@ static int __init hvc_iucv_init(void)
                 goto out_error;
         }
 
+        /* register IUCV HVC device driver */
+        rc = driver_register(&hvc_iucv_driver);
+        if (rc)
+                goto out_error;
+
         /* parse hvc_iucv_allow string and create z/VM user ID filter list */
         if (hvc_iucv_filter_string) {
                 rc = hvc_iucv_setup_filter(hvc_iucv_filter_string);
@@ -1183,15 +1302,14 @@ out_error_iucv:
         iucv_unregister(&hvc_iucv_handler, 0);
 out_error_hvc:
         for (i = 0; i < hvc_iucv_devices; i++)
-                if (hvc_iucv_table[i]) {
-                        if (hvc_iucv_table[i]->hvc)
-                                hvc_remove(hvc_iucv_table[i]->hvc);
-                        kfree(hvc_iucv_table[i]);
-                }
+                if (hvc_iucv_table[i])
+                        hvc_iucv_destroy(hvc_iucv_table[i]);
 out_error_memory:
         mempool_destroy(hvc_iucv_mempool);
         kmem_cache_destroy(hvc_iucv_buffer_cache);
 out_error:
+        if (hvc_iucv_filter)
+                kfree(hvc_iucv_filter);
         hvc_iucv_devices = 0; /* ensure that we do not provide any device */
         return rc;
 }
diff --git a/drivers/char/ps3flash.c b/drivers/char/ps3flash.c
index afbe45676d71..f424d394a286 100644
--- a/drivers/char/ps3flash.c
+++ b/drivers/char/ps3flash.c
@@ -33,48 +33,64 @@
 
 struct ps3flash_private {
         struct mutex mutex;     /* Bounce buffer mutex */
+        u64 chunk_sectors;
+        int tag;                /* Start sector of buffer, -1 if invalid */
+        bool dirty;
 };
 
 static struct ps3_storage_device *ps3flash_dev;
 
-static ssize_t ps3flash_read_write_sectors(struct ps3_storage_device *dev,
-                                           u64 lpar, u64 start_sector,
-                                           u64 sectors, int write)
+static int ps3flash_read_write_sectors(struct ps3_storage_device *dev,
+                                       u64 start_sector, int write)
 {
-        u64 res = ps3stor_read_write_sectors(dev, lpar, start_sector, sectors,
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        u64 res = ps3stor_read_write_sectors(dev, dev->bounce_lpar,
+                                             start_sector, priv->chunk_sectors,
                                              write);
         if (res) {
                 dev_err(&dev->sbd.core, "%s:%u: %s failed 0x%llx\n", __func__,
                         __LINE__, write ? "write" : "read", res);
                 return -EIO;
         }
-        return sectors;
+        return 0;
 }
 
-static ssize_t ps3flash_read_sectors(struct ps3_storage_device *dev,
-                                     u64 start_sector, u64 sectors,
-                                     unsigned int sector_offset)
+static int ps3flash_writeback(struct ps3_storage_device *dev)
 {
-        u64 max_sectors, lpar;
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        int res;
 
-        max_sectors = dev->bounce_size / dev->blk_size;
-        if (sectors > max_sectors) {
-                dev_dbg(&dev->sbd.core, "%s:%u Limiting sectors to %llu\n",
-                        __func__, __LINE__, max_sectors);
-                sectors = max_sectors;
-        }
+        if (!priv->dirty || priv->tag < 0)
+                return 0;
 
-        lpar = dev->bounce_lpar + sector_offset * dev->blk_size;
-        return ps3flash_read_write_sectors(dev, lpar, start_sector, sectors,
-                                           0);
+        res = ps3flash_read_write_sectors(dev, priv->tag, 1);
+        if (res)
+                return res;
+
+        priv->dirty = false;
+        return 0;
 }
 
-static ssize_t ps3flash_write_chunk(struct ps3_storage_device *dev,
-                                    u64 start_sector)
+static int ps3flash_fetch(struct ps3_storage_device *dev, u64 start_sector)
 {
-       u64 sectors = dev->bounce_size / dev->blk_size;
-       return ps3flash_read_write_sectors(dev, dev->bounce_lpar, start_sector,
-                                          sectors, 1);
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        int res;
+
+        if (start_sector == priv->tag)
+                return 0;
+
+        res = ps3flash_writeback(dev);
+        if (res)
+                return res;
+
+        priv->tag = -1;
+
+        res = ps3flash_read_write_sectors(dev, start_sector, 0);
+        if (res)
+                return res;
+
+        priv->tag = start_sector;
+        return 0;
 }
 
 static loff_t ps3flash_llseek(struct file *file, loff_t offset, int origin)
@@ -104,18 +120,19 @@ out:
         return res;
 }
 
-static ssize_t ps3flash_read(struct file *file, char __user *buf, size_t count,
-                             loff_t *pos)
+static ssize_t ps3flash_read(char __user *userbuf, void *kernelbuf,
+                             size_t count, loff_t *pos)
 {
         struct ps3_storage_device *dev = ps3flash_dev;
-        struct ps3flash_private *priv = dev->sbd.core.driver_data;
-        u64 size, start_sector, end_sector, offset;
-        ssize_t sectors_read;
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        u64 size, sector, offset;
+        int res;
         size_t remaining, n;
+        const void *src;
 
         dev_dbg(&dev->sbd.core,
-                "%s:%u: Reading %zu bytes at position %lld to user 0x%p\n",
-                __func__, __LINE__, count, *pos, buf);
+                "%s:%u: Reading %zu bytes at position %lld to U0x%p/K0x%p\n",
+                __func__, __LINE__, count, *pos, userbuf, kernelbuf);
 
         size = dev->regions[dev->region_idx].size*dev->blk_size;
         if (*pos >= size || !count)
@@ -128,61 +145,63 @@ static ssize_t ps3flash_read(struct file *file, char __user *buf, size_t count,
                 count = size - *pos;
         }
 
-        start_sector = *pos / dev->blk_size;
-        offset = *pos % dev->blk_size;
-        end_sector = DIV_ROUND_UP(*pos + count, dev->blk_size);
+        sector = *pos / dev->bounce_size * priv->chunk_sectors;
+        offset = *pos % dev->bounce_size;
 
         remaining = count;
         do {
+                n = min_t(u64, remaining, dev->bounce_size - offset);
+                src = dev->bounce_buf + offset;
+
                 mutex_lock(&priv->mutex);
 
-                sectors_read = ps3flash_read_sectors(dev, start_sector,
-                                                     end_sector-start_sector,
-                                                     0);
-                if (sectors_read < 0) {
-                        mutex_unlock(&priv->mutex);
+                res = ps3flash_fetch(dev, sector);
+                if (res)
                         goto fail;
-                }
 
-                n = min_t(u64, remaining, sectors_read*dev->blk_size-offset);
                 dev_dbg(&dev->sbd.core,
-                        "%s:%u: copy %lu bytes from 0x%p to user 0x%p\n",
-                        __func__, __LINE__, n, dev->bounce_buf+offset, buf);
-                if (copy_to_user(buf, dev->bounce_buf+offset, n)) {
-                        mutex_unlock(&priv->mutex);
-                        sectors_read = -EFAULT;
-                        goto fail;
+                        "%s:%u: copy %lu bytes from 0x%p to U0x%p/K0x%p\n",
+                        __func__, __LINE__, n, src, userbuf, kernelbuf);
+                if (userbuf) {
+                        if (copy_to_user(userbuf, src, n)) {
+                                res = -EFAULT;
+                                goto fail;
+                        }
+                        userbuf += n;
+                }
+                if (kernelbuf) {
+                        memcpy(kernelbuf, src, n);
+                        kernelbuf += n;
                 }
 
                 mutex_unlock(&priv->mutex);
 
                 *pos += n;
-                buf += n;
                 remaining -= n;
-                start_sector += sectors_read;
+                sector += priv->chunk_sectors;
                 offset = 0;
         } while (remaining > 0);
 
         return count;
 
 fail:
-        return sectors_read;
+        mutex_unlock(&priv->mutex);
+        return res;
 }
 
-static ssize_t ps3flash_write(struct file *file, const char __user *buf,
-                              size_t count, loff_t *pos)
+static ssize_t ps3flash_write(const char __user *userbuf,
+                              const void *kernelbuf, size_t count, loff_t *pos)
 {
         struct ps3_storage_device *dev = ps3flash_dev;
-        struct ps3flash_private *priv = dev->sbd.core.driver_data;
-        u64 size, chunk_sectors, start_write_sector, end_write_sector,
-            end_read_sector, start_read_sector, head, tail, offset;
-        ssize_t res;
+        struct ps3flash_private *priv = ps3_system_bus_get_drvdata(&dev->sbd);
+        u64 size, sector, offset;
+        int res = 0;
         size_t remaining, n;
-        unsigned int sec_off;
+        void *dst;
 
         dev_dbg(&dev->sbd.core,
-                "%s:%u: Writing %zu bytes at position %lld from user 0x%p\n",
-                __func__, __LINE__, count, *pos, buf);
+                "%s:%u: Writing %zu bytes at position %lld from U0x%p/K0x%p\n",
+                __func__, __LINE__, count, *pos, userbuf, kernelbuf);
 
         size = dev->regions[dev->region_idx].size*dev->blk_size;
         if (*pos >= size || !count)
@@ -195,89 +214,46 @@ static ssize_t ps3flash_write(struct file *file, const char __user *buf,
                 count = size - *pos;
         }
 
-        chunk_sectors = dev->bounce_size / dev->blk_size;
-
-        start_write_sector = *pos / dev->bounce_size * chunk_sectors;
+        sector = *pos / dev->bounce_size * priv->chunk_sectors;
         offset = *pos % dev->bounce_size;
-        end_write_sector = DIV_ROUND_UP(*pos + count, dev->bounce_size) *
-                           chunk_sectors;
-
-        end_read_sector = DIV_ROUND_UP(*pos, dev->blk_size);
-        start_read_sector = (*pos + count) / dev->blk_size;
-
-        /*
-         * As we have to write in 256 KiB chunks, while we can read in blk_size
-         * (usually 512 bytes) chunks, we perform the following steps:
-         *   1. Read from start_write_sector to end_read_sector ("head")
-         *   2. Read from start_read_sector to end_write_sector ("tail")
-         *   3. Copy data to buffer
-         *   4. Write from start_write_sector to end_write_sector
-         * All of this is complicated by using only one 256 KiB bounce buffer.
-         */
-
-        head = end_read_sector - start_write_sector;
-        tail = end_write_sector - start_read_sector;
 
         remaining = count;
         do {
+                n = min_t(u64, remaining, dev->bounce_size - offset);
+                dst = dev->bounce_buf + offset;
+
                 mutex_lock(&priv->mutex);
 
-                if (end_read_sector >= start_read_sector) {
-                        /* Merge head and tail */
-                        dev_dbg(&dev->sbd.core,
-                                "Merged head and tail: %llu sectors at %llu\n",
-                                chunk_sectors, start_write_sector);
-                        res = ps3flash_read_sectors(dev, start_write_sector,
-                                                    chunk_sectors, 0);
-                        if (res < 0)
+                if (n != dev->bounce_size)
+                        res = ps3flash_fetch(dev, sector);
+                else if (sector != priv->tag)
+                        res = ps3flash_writeback(dev);
+                if (res)
+                        goto fail;
+
+                dev_dbg(&dev->sbd.core,
+                        "%s:%u: copy %lu bytes from U0x%p/K0x%p to 0x%p\n",
+                        __func__, __LINE__, n, userbuf, kernelbuf, dst);
+                if (userbuf) {
+                        if (copy_from_user(dst, userbuf, n)) {
+                                res = -EFAULT;
                                 goto fail;
-                } else {
-                        if (head) {
-                                /* Read head */
-                                dev_dbg(&dev->sbd.core,
-                                        "head: %llu sectors at %llu\n", head,
-                                        start_write_sector);
-                                res = ps3flash_read_sectors(dev,
-                                                            start_write_sector,
-                                                            head, 0);
-                                if (res < 0)
-                                        goto fail;
-                        }
-                        if (start_read_sector <
-                            start_write_sector+chunk_sectors) {
-                                /* Read tail */
-                                dev_dbg(&dev->sbd.core,
-                                        "tail: %llu sectors at %llu\n", tail,
-                                        start_read_sector);
-                                sec_off = start_read_sector-start_write_sector;
-                                res = ps3flash_read_sectors(dev,
-                                                            start_read_sector,
-                                                            tail, sec_off);
-                                if (res < 0)
-                                        goto fail;
                         }
+                        userbuf += n;
                 }
-
-                n = min_t(u64, remaining, dev->bounce_size-offset);
-                dev_dbg(&dev->sbd.core,
-                        "%s:%u: copy %lu bytes from user 0x%p to 0x%p\n",
-                        __func__, __LINE__, n, buf, dev->bounce_buf+offset);
-                if (copy_from_user(dev->bounce_buf+offset, buf, n)) {
-                        res = -EFAULT;
-                        goto fail;
+                if (kernelbuf) {
+                        memcpy(dst, kernelbuf, n);
+                        kernelbuf += n;
                 }
 
-                res = ps3flash_write_chunk(dev, start_write_sector);
-                if (res < 0)
-                        goto fail;
+                priv->tag = sector;
+                priv->dirty = true;
 
                 mutex_unlock(&priv->mutex);
 
                 *pos += n;
-                buf += n;
                 remaining -= n;
-                start_write_sector += chunk_sectors;
-                head = 0;
+                sector += priv->chunk_sectors;
                 offset = 0;
         } while (remaining > 0);
 
@@ -288,6 +264,51 @@ fail:
         return res;
 }
 
+static ssize_t ps3flash_user_read(struct file *file, char __user *buf,
+                                  size_t count, loff_t *pos)
+{
+        return ps3flash_read(buf, NULL, count, pos);
+}
+
+static ssize_t ps3flash_user_write(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *pos)
+{
+        return ps3flash_write(buf, NULL, count, pos);
+}
+
+static ssize_t ps3flash_kernel_read(void *buf, size_t count, loff_t pos)
+{
+        return ps3flash_read(NULL, buf, count, &pos);
+}
+
+static ssize_t ps3flash_kernel_write(const void *buf, size_t count,
+                                     loff_t pos)
+{
+        ssize_t res;
+        int wb;
+
+        res = ps3flash_write(NULL, buf, count, &pos);
+        if (res < 0)
+                return res;
+
+        /* Make kernel writes synchronous */
+        wb = ps3flash_writeback(ps3flash_dev);
+        if (wb)
+                return wb;
+
+        return res;
+}
+
+static int ps3flash_flush(struct file *file, fl_owner_t id)
+{
+        return ps3flash_writeback(ps3flash_dev);
+}
+
+static int ps3flash_fsync(struct file *file, struct dentry *dentry,
+                          int datasync)
+{
+        return ps3flash_writeback(ps3flash_dev);
+}
 
 static irqreturn_t ps3flash_interrupt(int irq, void *data)
 {
@@ -312,12 +333,18 @@ static irqreturn_t ps3flash_interrupt(int irq, void *data)
         return IRQ_HANDLED;
 }
 
-
 static const struct file_operations ps3flash_fops = {
         .owner  = THIS_MODULE,
         .llseek = ps3flash_llseek,
-        .read   = ps3flash_read,
-        .write  = ps3flash_write,
+        .read   = ps3flash_user_read,
+        .write  = ps3flash_user_write,
+        .flush  = ps3flash_flush,
+        .fsync  = ps3flash_fsync,
+};
+
+static const struct ps3_os_area_flash_ops ps3flash_kernel_ops = {
+        .read   = ps3flash_kernel_read,
+        .write  = ps3flash_kernel_write,
 };
 
 static struct miscdevice ps3flash_misc = {
@@ -366,11 +393,13 @@ static int __devinit ps3flash_probe(struct ps3_system_bus_device *_dev)
                 goto fail;
         }
 
-        dev->sbd.core.driver_data = priv;
+        ps3_system_bus_set_drvdata(&dev->sbd, priv);
         mutex_init(&priv->mutex);
+        priv->tag = -1;
 
         dev->bounce_size = ps3flash_bounce_buffer.size;
         dev->bounce_buf = ps3flash_bounce_buffer.address;
+        priv->chunk_sectors = dev->bounce_size / dev->blk_size;
 
         error = ps3stor_setup(dev, ps3flash_interrupt);
         if (error)
@@ -386,13 +415,15 @@ static int __devinit ps3flash_probe(struct ps3_system_bus_device *_dev)
 
         dev_info(&dev->sbd.core, "%s:%u: registered misc device %d\n",
                  __func__, __LINE__, ps3flash_misc.minor);
+
+        ps3_os_area_flash_register(&ps3flash_kernel_ops);
         return 0;
 
 fail_teardown:
         ps3stor_teardown(dev);
 fail_free_priv:
         kfree(priv);
-        dev->sbd.core.driver_data = NULL;
+        ps3_system_bus_set_drvdata(&dev->sbd, NULL);
 fail:
         ps3flash_dev = NULL;
         return error;
@@ -402,10 +433,11 @@ static int ps3flash_remove(struct ps3_system_bus_device *_dev)
 {
         struct ps3_storage_device *dev = to_ps3_storage_device(&_dev->core);
 
+        ps3_os_area_flash_register(NULL);
         misc_deregister(&ps3flash_misc);
         ps3stor_teardown(dev);
-        kfree(dev->sbd.core.driver_data);
-        dev->sbd.core.driver_data = NULL;
+        kfree(ps3_system_bus_get_drvdata(&dev->sbd));
+        ps3_system_bus_set_drvdata(&dev->sbd, NULL);
         ps3flash_dev = NULL;
         return 0;
 }