include/linux/hp_sdc.h


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301

/*
 * HP i8042 System Device Controller -- header
 *
 * Copyright (c) 2001 Brian S. Julin
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions, and the following disclaimer,
 *    without modification.
 * 2. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * Alternatively, this software may be distributed under the terms of the
 * GNU General Public License ("GPL").
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 *
 * References:
 * 
 * HP-HIL Technical Reference Manual.  Hewlett Packard Product No. 45918A
 *
 * System Device Controller Microprocessor Firmware Theory of Operation
 * 	for Part Number 1820-4784 Revision B.  Dwg No. A-1820-4784-2
 *
 */

#ifndef _LINUX_HP_SDC_H
#define _LINUX_HP_SDC_H

#include <linux/interrupt.h>
#include <linux/types.h>
#include <linux/time.h>
#include <linux/timer.h>
#if defined(__hppa__)
#include <asm/hardware.h>
#endif


/* No 4X status reads take longer than this (in usec).
 */
#define HP_SDC_MAX_REG_DELAY 20000

typedef void (hp_sdc_irqhook) (int irq, void *dev_id, 
			       uint8_t status, uint8_t data);

int hp_sdc_request_timer_irq(hp_sdc_irqhook *callback);
int hp_sdc_request_hil_irq(hp_sdc_irqhook *callback);
int hp_sdc_request_cooked_irq(hp_sdc_irqhook *callback);
int hp_sdc_release_timer_irq(hp_sdc_irqhook *callback);
int hp_sdc_release_hil_irq(hp_sdc_irqhook *callback);
int hp_sdc_release_cooked_irq(hp_sdc_irqhook *callback);

typedef struct {
	int actidx;	/* Start of act.  Acts are atomic WRT I/O to SDC */
	int idx;	/* Index within the act */
	int endidx;	/* transaction is over and done if idx == endidx */
	uint8_t *seq;	/* commands/data for the transaction */
	union {
	  hp_sdc_irqhook   *irqhook;	/* Callback, isr or tasklet context */
	  struct semaphore *semaphore;	/* Semaphore to sleep on. */
	} act;
} hp_sdc_transaction;
int __hp_sdc_enqueue_transaction(hp_sdc_transaction *this);
int hp_sdc_enqueue_transaction(hp_sdc_transaction *this);
int hp_sdc_dequeue_transaction(hp_sdc_transaction *this);

/* The HP_SDC_ACT* values are peculiar to this driver.
 * Nuance: never HP_SDC_ACT_DATAIN | HP_SDC_ACT_DEALLOC, use another
 * act to perform the dealloc.
 */
#define HP_SDC_ACT_PRECMD	0x01		/* Send a command first */
#define HP_SDC_ACT_DATAREG	0x02		/* Set data registers */
#define HP_SDC_ACT_DATAOUT	0x04		/* Send data bytes */
#define HP_SDC_ACT_POSTCMD      0x08            /* Send command after */
#define HP_SDC_ACT_DATAIN	0x10		/* Collect data after */
#define HP_SDC_ACT_DURING	0x1f
#define HP_SDC_ACT_SEMAPHORE    0x20            /* Raise semaphore after */
#define HP_SDC_ACT_CALLBACK	0x40		/* Pass data to IRQ handler */
#define HP_SDC_ACT_DEALLOC	0x80		/* Destroy transaction after */
#define HP_SDC_ACT_AFTER	0xe0
#define HP_SDC_ACT_DEAD		0x60		/* Act timed out. */

/* Rest of the flags are straightforward representation of the SDC interface */
#define HP_SDC_STATUS_IBF	0x02	/* Input buffer full */

#define HP_SDC_STATUS_IRQMASK	0xf0	/* Bits containing "level 1" irq */
#define HP_SDC_STATUS_PERIODIC  0x10    /* Periodic 10ms timer */
#define HP_SDC_STATUS_USERTIMER 0x20    /* "Special purpose" timer */
#define HP_SDC_STATUS_TIMER     0x30    /* Both PERIODIC and USERTIMER */
#define HP_SDC_STATUS_REG	0x40	/* Data from an i8042 register */
#define HP_SDC_STATUS_HILCMD    0x50	/* Command from HIL MLC */
#define HP_SDC_STATUS_HILDATA   0x60	/* Data from HIL MLC */
#define HP_SDC_STATUS_PUP	0x70	/* Sucessful power-up self test */
#define HP_SDC_STATUS_KCOOKED	0x80	/* Key from cooked kbd */
#define HP_SDC_STATUS_KRPG	0xc0	/* Key from Repeat Gen */
#define HP_SDC_STATUS_KMOD_SUP	0x10	/* Shift key is up */
#define HP_SDC_STATUS_KMOD_CUP	0x20	/* Control key is up */

#define HP_SDC_NMISTATUS_FHS	0x40	/* NMI is a fast handshake irq */

/* Internal i8042 registers (there are more, but they are not too useful). */

#define HP_SDC_USE		0x02	/* Resource usage (including OB bit) */
#define HP_SDC_IM		0x04	/* Interrupt mask */
#define HP_SDC_CFG		0x11	/* Configuration register */
#define HP_SDC_KBLANGUAGE	0x12	/* Keyboard language */

#define HP_SDC_D0		0x70	/* General purpose data buffer 0 */
#define HP_SDC_D1		0x71	/* General purpose data buffer 1 */
#define HP_SDC_D2		0x72	/* General purpose data buffer 2 */
#define HP_SDC_D3		0x73	/* General purpose data buffer 3 */
#define HP_SDC_VT1		0x74	/* Timer for voice 1 */
#define HP_SDC_VT2		0x75	/* Timer for voice 2 */
#define HP_SDC_VT3		0x76	/* Timer for voice 3 */
#define HP_SDC_VT4		0x77	/* Timer for voice 4 */
#define HP_SDC_KBN		0x78	/* Which HIL devs are Nimitz */
#define HP_SDC_KBC		0x79	/* Which HIL devs are cooked kbds */
#define HP_SDC_LPS		0x7a	/* i8042's view of HIL status */
#define HP_SDC_LPC		0x7b	/* i8042's view of HIL "control" */
#define HP_SDC_RSV  		0x7c	/* Reserved "for testing" */
#define HP_SDC_LPR		0x7d    /* i8042 count of HIL reconfigs */
#define HP_SDC_XTD		0x7e    /* "Extended Configuration" register */
#define HP_SDC_STR		0x7f    /* i8042 self-test result */

/* Bitfields for above registers */
#define HP_SDC_USE_LOOP		0x04	/* Command is currently on the loop. */

#define HP_SDC_IM_MASK          0x1f    /* these bits not part of cmd/status */
#define HP_SDC_IM_FH		0x10	/* Mask the fast handshake irq */
#define HP_SDC_IM_PT		0x08	/* Mask the periodic timer irq */
#define HP_SDC_IM_TIMERS	0x04	/* Mask the MT/DT/CT irq */
#define HP_SDC_IM_RESET		0x02	/* Mask the reset key irq */
#define HP_SDC_IM_HIL		0x01	/* Mask the HIL MLC irq */

#define HP_SDC_CFG_ROLLOVER	0x08	/* WTF is "N-key rollover"? */
#define HP_SDC_CFG_KBD		0x10	/* There is a keyboard */
#define HP_SDC_CFG_NEW		0x20	/* Supports/uses HIL MLC */
#define HP_SDC_CFG_KBD_OLD	0x03	/* keyboard code for non-HIL */
#define HP_SDC_CFG_KBD_NEW	0x07	/* keyboard code from HIL autoconfig */
#define HP_SDC_CFG_REV		0x40	/* Code revision bit */
#define HP_SDC_CFG_IDPROM	0x80	/* IDPROM present in kbd (not HIL) */

#define HP_SDC_LPS_NDEV		0x07	/* # devices autoconfigured on HIL */
#define HP_SDC_LPS_ACSUCC	0x08	/* loop autoconfigured successfully */
#define HP_SDC_LPS_ACFAIL	0x80	/* last loop autoconfigure failed */

#define HP_SDC_LPC_APE_IPF	0x01	/* HIL MLC APE/IPF (autopoll) set */
#define HP_SDC_LPC_ARCONERR	0x02	/* i8042 autoreconfigs loop on err */
#define HP_SDC_LPC_ARCQUIET	0x03	/* i8042 doesn't report autoreconfigs*/
#define HP_SDC_LPC_COOK		0x10	/* i8042 cooks devices in _KBN */
#define HP_SDC_LPC_RC		0x80	/* causes autoreconfig */

#define HP_SDC_XTD_REV		0x07	/* contains revision code */
#define HP_SDC_XTD_REV_STRINGS(val, str) \
switch (val) {						\
	case 0x1: str = "1820-3712"; break;		\
	case 0x2: str = "1820-4379"; break;		\
	case 0x3: str = "1820-4784"; break;		\
	default: str = "unknown";			\
};
#define HP_SDC_XTD_BEEPER	0x08	/* TI SN76494 beeper available */
#define HP_SDC_XTD_BBRTC	0x20	/* OKI MSM-58321 BBRTC present */

#define HP_SDC_CMD_LOAD_RT	0x31	/* Load real time (from 8042) */
#define HP_SDC_CMD_LOAD_FHS	0x36	/* Load the fast handshake timer */
#define HP_SDC_CMD_LOAD_MT	0x38	/* Load the match timer */
#define HP_SDC_CMD_LOAD_DT	0x3B	/* Load the delay timer */
#define HP_SDC_CMD_LOAD_CT	0x3E	/* Load the cycle timer */

#define HP_SDC_CMD_SET_IM	0x40    /* 010xxxxx == set irq mask */

/* The documents provided do not explicitly state that all registers betweem 
 * 0x01 and 0x1f inclusive can be read by sending their register index as a 
 * command, but this is implied and appears to be the case.
 */
#define HP_SDC_CMD_READ_RAM	0x00	/* Load from i8042 RAM (autoinc) */
#define HP_SDC_CMD_READ_USE	0x02	/* Undocumented! Load from usage reg */
#define HP_SDC_CMD_READ_IM	0x04	/* Load current interrupt mask */
#define HP_SDC_CMD_READ_KCC	0x11	/* Load primary kbd config code */
#define HP_SDC_CMD_READ_KLC	0x12	/* Load primary kbd language code */
#define HP_SDC_CMD_READ_T1	0x13	/* Load timer output buffer byte 1 */
#define HP_SDC_CMD_READ_T2	0x14	/* Load timer output buffer byte 1 */
#define HP_SDC_CMD_READ_T3	0x15	/* Load timer output buffer byte 1 */
#define HP_SDC_CMD_READ_T4	0x16	/* Load timer output buffer byte 1 */
#define HP_SDC_CMD_READ_T5	0x17	/* Load timer output buffer byte 1 */
#define HP_SDC_CMD_READ_D0	0xf0	/* Load from i8042 RAM location 0x70 */
#define HP_SDC_CMD_READ_D1	0xf1	/* Load from i8042 RAM location 0x71 */
#define HP_SDC_CMD_READ_D2	0xf2	/* Load from i8042 RAM location 0x72 */
#define HP_SDC_CMD_READ_D3	0xf3	/* Load from i8042 RAM location 0x73 */
#define HP_SDC_CMD_READ_VT1	0xf4	/* Load from i8042 RAM location 0x74 */
#define HP_SDC_CMD_READ_VT2	0xf5	/* Load from i8042 RAM location 0x75 */
#define HP_SDC_CMD_READ_VT3	0xf6	/* Load from i8042 RAM location 0x76 */
#define HP_SDC_CMD_READ_VT4	0xf7	/* Load from i8042 RAM location 0x77 */
#define HP_SDC_CMD_READ_KBN	0xf8	/* Load from i8042 RAM location 0x78 */
#define HP_SDC_CMD_READ_KBC	0xf9	/* Load from i8042 RAM location 0x79 */
#define HP_SDC_CMD_READ_LPS	0xfa	/* Load from i8042 RAM location 0x7a */
#define HP_SDC_CMD_READ_LPC	0xfb	/* Load from i8042 RAM location 0x7b */
#define HP_SDC_CMD_READ_RSV	0xfc	/* Load from i8042 RAM location 0x7c */
#define HP_SDC_CMD_READ_LPR	0xfd	/* Load from i8042 RAM location 0x7d */
#define HP_SDC_CMD_READ_XTD	0xfe	/* Load from i8042 RAM location 0x7e */
#define HP_SDC_CMD_READ_STR	0xff	/* Load from i8042 RAM location 0x7f */

#define HP_SDC_CMD_SET_ARD	0xA0	/* Set emulated autorepeat delay */
#define HP_SDC_CMD_SET_ARR	0xA2	/* Set emulated autorepeat rate */
#define HP_SDC_CMD_SET_BELL	0xA3	/* Set voice 3 params for "beep" cmd */
#define HP_SDC_CMD_SET_RPGR	0xA6	/* Set "RPG" irq rate (doesn't work) */
#define HP_SDC_CMD_SET_RTMS	0xAD	/* Set the RTC time (milliseconds) */
#define HP_SDC_CMD_SET_RTD	0xAF	/* Set the RTC time (days) */
#define HP_SDC_CMD_SET_FHS	0xB2	/* Set fast handshake timer */
#define HP_SDC_CMD_SET_MT	0xB4	/* Set match timer */
#define HP_SDC_CMD_SET_DT	0xB7	/* Set delay timer */
#define HP_SDC_CMD_SET_CT	0xBA	/* Set cycle timer */
#define HP_SDC_CMD_SET_RAMP	0xC1	/* Reset READ_RAM autoinc counter */
#define HP_SDC_CMD_SET_D0	0xe0	/* Load to i8042 RAM location 0x70 */
#define HP_SDC_CMD_SET_D1	0xe1	/* Load to i8042 RAM location 0x71 */
#define HP_SDC_CMD_SET_D2	0xe2	/* Load to i8042 RAM location 0x72 */
#define HP_SDC_CMD_SET_D3	0xe3	/* Load to i8042 RAM location 0x73 */
#define HP_SDC_CMD_SET_VT1	0xe4	/* Load to i8042 RAM location 0x74 */
#define HP_SDC_CMD_SET_VT2	0xe5	/* Load to i8042 RAM location 0x75 */
#define HP_SDC_CMD_SET_VT3	0xe6	/* Load to i8042 RAM location 0x76 */
#define HP_SDC_CMD_SET_VT4	0xe7	/* Load to i8042 RAM location 0x77 */
#define HP_SDC_CMD_SET_KBN	0xe8	/* Load to i8042 RAM location 0x78 */
#define HP_SDC_CMD_SET_KBC	0xe9	/* Load to i8042 RAM location 0x79 */
#define HP_SDC_CMD_SET_LPS	0xea	/* Load to i8042 RAM location 0x7a */
#define HP_SDC_CMD_SET_LPC	0xeb	/* Load to i8042 RAM location 0x7b */
#define HP_SDC_CMD_SET_RSV	0xec	/* Load to i8042 RAM location 0x7c */
#define HP_SDC_CMD_SET_LPR	0xed	/* Load to i8042 RAM location 0x7d */
#define HP_SDC_CMD_SET_XTD	0xee	/* Load to i8042 RAM location 0x7e */
#define HP_SDC_CMD_SET_STR	0xef	/* Load to i8042 RAM location 0x7f */

#define HP_SDC_CMD_DO_RTCW	0xc2	/* i8042 RAM 0x70 --> RTC */
#define HP_SDC_CMD_DO_RTCR	0xc3	/* RTC[0x70 0:3] --> irq/status/data */
#define HP_SDC_CMD_DO_BEEP	0xc4	/* i8042 RAM 0x70-74  --> beeper,VT3 */
#define HP_SDC_CMD_DO_HIL	0xc5	/* i8042 RAM 0x70-73 --> 
					   HIL MLC R0,R1 i8042 HIL watchdog */

/* Values used to (de)mangle input/output to/from the HIL MLC */
#define HP_SDC_DATA		0x40	/* Data from an 8042 register */
#define HP_SDC_HIL_CMD		0x50	/* Data from HIL MLC R1/8042 */
#define HP_SDC_HIL_R1MASK	0x0f	/* Contents of HIL MLC R1 0:3 */
#define HP_SDC_HIL_AUTO		0x10	/* Set if POL results from i8042 */   
#define HP_SDC_HIL_ISERR	0x80	/* Has meaning as in next 4 values */
#define HP_SDC_HIL_RC_DONE	0x80	/* i8042 auto-configured loop */
#define HP_SDC_HIL_ERR		0x81	/* HIL MLC R2 had a bit set */
#define HP_SDC_HIL_TO		0x82	/* i8042 HIL watchdog expired */
#define HP_SDC_HIL_RC		0x84	/* i8042 is auto-configuring loop */
#define HP_SDC_HIL_DAT		0x60	/* Data from HIL MLC R0 */


typedef struct {
	rwlock_t	ibf_lock;
	rwlock_t	lock;		/* user/tasklet lock */
	rwlock_t	rtq_lock;	/* isr/tasklet lock */
	rwlock_t	hook_lock;	/* isr/user lock for handler add/del */

	unsigned int	irq, nmi;	/* Our IRQ lines */
	unsigned long	base_io, status_io, data_io; /* Our IO ports */

	uint8_t		im;		/* Interrupt mask */
	int		set_im; 	/* Interrupt mask needs to be set. */

	int		ibf;		/* Last known status of IBF flag */
	uint8_t		wi;		/* current i8042 write index */
	uint8_t		r7[4];          /* current i8042[0x70 - 0x74] values */
	uint8_t		r11, r7e;	/* Values from version/revision regs */

	hp_sdc_irqhook	*timer, *reg, *hil, *pup, *cooked;

#define HP_SDC_QUEUE_LEN 16
	hp_sdc_transaction *tq[HP_SDC_QUEUE_LEN]; /* All pending read/writes */

	int		rcurr, rqty;	/* Current read transact in process */
	struct timeval	rtv;		/* Time when current read started */
	int		wcurr;		/* Current write transact in process */

	int		dev_err;	/* carries status from registration */
#if defined(__hppa__)
	struct parisc_device	*dev;
#elif defined(__mc68000__)
	void		*dev;
#else
#error No support for device registration on this arch yet.
#endif

	struct timer_list kicker;	/* Keeps below task alive */
	struct tasklet_struct	task;

} hp_i8042_sdc;

#endif /* _LINUX_HP_SDC_H */
/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
 *                         Patrick Schaaf <bof@bof.de>
 * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module for IP set management */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include <linux/netlink.h>
#include <linux/rculist.h>
#include <linux/version.h>
#include <net/netlink.h>

#include <linux/netfilter.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/ipset/ip_set.h>

static LIST_HEAD(ip_set_type_list);		/* all registered set types */
static DEFINE_MUTEX(ip_set_type_mutex);		/* protects ip_set_type_list */
static DEFINE_RWLOCK(ip_set_ref_lock);		/* protects the set refs */

static struct ip_set **ip_set_list;		/* all individual sets */
static ip_set_id_t ip_set_max = CONFIG_IP_SET_MAX; /* max number of sets */

#define STREQ(a, b)	(strncmp(a, b, IPSET_MAXNAMELEN) == 0)

static unsigned int max_sets;

module_param(max_sets, int, 0600);
MODULE_PARM_DESC(max_sets, "maximal number of sets");
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
MODULE_DESCRIPTION("core IP set support");
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);

/*
 * The set types are implemented in modules and registered set types
 * can be found in ip_set_type_list. Adding/deleting types is
 * serialized by ip_set_type_mutex.
 */

static inline void
ip_set_type_lock(void)
{
	mutex_lock(&ip_set_type_mutex);
}

static inline void
ip_set_type_unlock(void)
{
	mutex_unlock(&ip_set_type_mutex);
}

/* Register and deregister settype */

static struct ip_set_type *
find_set_type(const char *name, u8 family, u8 revision)
{
	struct ip_set_type *type;

	list_for_each_entry_rcu(type, &ip_set_type_list, list)
		if (STREQ(type->name, name) &&
		    (type->family == family || type->family == AF_UNSPEC) &&
		    type->revision == revision)
			return type;
	return NULL;
}

/* Unlock, try to load a set type module and lock again */
static int
try_to_load_type(const char *name)
{
	nfnl_unlock();
	pr_debug("try to load ip_set_%s\n", name);
	if (request_module("ip_set_%s", name) < 0) {
		pr_warning("Can't find ip_set type %s\n", name);
		nfnl_lock();
		return -IPSET_ERR_FIND_TYPE;
	}
	nfnl_lock();
	return -EAGAIN;
}

/* Find a set type and reference it */
static int
find_set_type_get(const char *name, u8 family, u8 revision,
		  struct ip_set_type **found)
{
	struct ip_set_type *type;
	int err;

	rcu_read_lock();
	*found = find_set_type(name, family, revision);
	if (*found) {
		err = !try_module_get((*found)->me) ? -EFAULT : 0;
		goto unlock;
	}
	/* Make sure the type is loaded but we don't support the revision */
	list_for_each_entry_rcu(type, &ip_set_type_list, list)
		if (STREQ(type->name, name)) {
			err = -IPSET_ERR_FIND_TYPE;
			goto unlock;
		}
	rcu_read_unlock();

	return try_to_load_type(name);

unlock:
	rcu_read_unlock();
	return err;
}

/* Find a given set type by name and family.
 * If we succeeded, the supported minimal and maximum revisions are
 * filled out.
 */
static int
find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max)
{
	struct ip_set_type *type;
	bool found = false;

	*min = 255; *max = 0;
	rcu_read_lock();
	list_for_each_entry_rcu(type, &ip_set_type_list, list)
		if (STREQ(type->name, name) &&
		    (type->family == family || type->family == AF_UNSPEC)) {
			found = true;
			if (type->revision < *min)
				*min = type->revision;
			if (type->revision > *max)
				*max = type->revision;
		}
	rcu_read_unlock();
	if (found)
		return 0;

	return try_to_load_type(name);
}

#define family_name(f)	((f) == AF_INET ? "inet" : \
			 (f) == AF_INET6 ? "inet6" : "any")

/* Register a set type structure. The type is identified by
 * the unique triple of name, family and revision.
 */
int
ip_set_type_register(struct ip_set_type *type)
{
	int ret = 0;

	if (type->protocol != IPSET_PROTOCOL) {
		pr_warning("ip_set type %s, family %s, revision %u uses "
			   "wrong protocol version %u (want %u)\n",
			   type->name, family_name(type->family),
			   type->revision, type->protocol, IPSET_PROTOCOL);
		return -EINVAL;
	}

	ip_set_type_lock();
	if (find_set_type(type->name, type->family, type->revision)) {
		/* Duplicate! */
		pr_warning("ip_set type %s, family %s, revision %u "
			   "already registered!\n", type->name,
			   family_name(type->family), type->revision);
		ret = -EINVAL;
		goto unlock;
	}
	list_add_rcu(&type->list, &ip_set_type_list);
	pr_debug("type %s, family %s, revision %u registered.\n",
		 type->name, family_name(type->family), type->revision);
unlock:
	ip_set_type_unlock();
	return ret;
}
EXPORT_SYMBOL_GPL(ip_set_type_register);

/* Unregister a set type. There's a small race with ip_set_create */
void
ip_set_type_unregister(struct ip_set_type *type)
{
	ip_set_type_lock();
	if (!find_set_type(type->name, type->family, type->revision)) {
		pr_warning("ip_set type %s, family %s, revision %u "
			   "not registered\n", type->name,
			   family_name(type->family), type->revision);
		goto unlock;
	}
	list_del_rcu(&type->list);
	pr_debug("type %s, family %s, revision %u unregistered.\n",
		 type->name, family_name(type->family), type->revision);
unlock:
	ip_set_type_unlock();

	synchronize_rcu();
}
EXPORT_SYMBOL_GPL(ip_set_type_unregister);

/* Utility functions */
void *
ip_set_alloc(size_t size)
{
	void *members = NULL;

	if (size < KMALLOC_MAX_SIZE)
		members = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);

	if (members) {
		pr_debug("%p: allocated with kmalloc\n", members);
		return members;
	}

	members = vzalloc(size);
	if (!members)
		return NULL;
	pr_debug("%p: allocated with vmalloc\n", members);

	return members;
}
EXPORT_SYMBOL_GPL(ip_set_alloc);

void
ip_set_free(void *members)
{
	pr_debug("%p: free with %s\n", members,
		 is_vmalloc_addr(members) ? "vfree" : "kfree");
	if (is_vmalloc_addr(members))
		vfree(members);
	else
		kfree(members);
}
EXPORT_SYMBOL_GPL(ip_set_free);

static inline bool
flag_nested(const struct nlattr *nla)
{
	return nla->nla_type & NLA_F_NESTED;
}

static const struct nla_policy ipaddr_policy[IPSET_ATTR_IPADDR_MAX + 1] = {
	[IPSET_ATTR_IPADDR_IPV4]	= { .type = NLA_U32 },
	[IPSET_ATTR_IPADDR_IPV6]	= { .type = NLA_BINARY,
					    .len = sizeof(struct in6_addr) },
};

int
ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr)
{
	struct nlattr *tb[IPSET_ATTR_IPADDR_MAX+1];

	if (unlikely(!flag_nested(nla)))
		return -IPSET_ERR_PROTOCOL;
	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy))
		return -IPSET_ERR_PROTOCOL;
	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
		return -IPSET_ERR_PROTOCOL;

	*ipaddr = nla_get_be32(tb[IPSET_ATTR_IPADDR_IPV4]);
	return 0;
}
EXPORT_SYMBOL_GPL(ip_set_get_ipaddr4);

int
ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
{
	struct nlattr *tb[IPSET_ATTR_IPADDR_MAX+1];

	if (unlikely(!flag_nested(nla)))
		return -IPSET_ERR_PROTOCOL;

	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy))
		return -IPSET_ERR_PROTOCOL;
	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
		return -IPSET_ERR_PROTOCOL;

	memcpy(ipaddr, nla_data(tb[IPSET_ATTR_IPADDR_IPV6]),
		sizeof(struct in6_addr));
	return 0;
}
EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);

/*
 * Creating/destroying/renaming/swapping affect the existence and
 * the properties of a set. All of these can be executed from userspace
 * only and serialized by the nfnl mutex indirectly from nfnetlink.
 *
 * Sets are identified by their index in ip_set_list and the index
 * is used by the external references (set/SET netfilter modules).
 *
 * The set behind an index may change by swapping only, from userspace.
 */

static inline void
__ip_set_get(ip_set_id_t index)
{
	write_lock_bh(&ip_set_ref_lock);
	ip_set_list[index]->ref++;
	write_unlock_bh(&ip_set_ref_lock);
}

static inline void
__ip_set_put(ip_set_id_t index)
{
	write_lock_bh(&ip_set_ref_lock);
	BUG_ON(ip_set_list[index]->ref == 0);
	ip_set_list[index]->ref--;
	write_unlock_bh(&ip_set_ref_lock);
}

/*
 * Add, del and test set entries from kernel.
 *
 * The set behind the index must exist and must be referenced
 * so it can't be destroyed (or changed) under our foot.
 */

int
ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
	    const struct ip_set_adt_opt *opt)
{
	struct ip_set *set = ip_set_list[index];
	int ret = 0;

	BUG_ON(set == NULL);
	pr_debug("set %s, index %u\n", set->name, index);

	if (opt->dim < set->type->dimension ||
	    !(opt->family == set->family || set->family == AF_UNSPEC))
		return 0;

	read_lock_bh(&set->lock);
	ret = set->variant->kadt(set, skb, IPSET_TEST, opt);
	read_unlock_bh(&set->lock);

	if (ret == -EAGAIN) {
		/* Type requests element to be completed */
		pr_debug("element must be competed, ADD is triggered\n");
		write_lock_bh(&set->lock);
		set->variant->kadt(set, skb, IPSET_ADD, opt);
		write_unlock_bh(&set->lock);
		ret = 1;
	}

	/* Convert error codes to nomatch */
	return (ret < 0 ? 0 : ret);
}
EXPORT_SYMBOL_GPL(ip_set_test);

int
ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
	   const struct ip_set_adt_opt *opt)
{
	struct ip_set *set = ip_set_list[index];
	int ret;

	BUG_ON(set == NULL);
	pr_debug("set %s, index %u\n", set->name, index);

	if (opt->dim < set->type->dimension ||
	    !(opt->family == set->family || set->family == AF_UNSPEC))
		return 0;

	write_lock_bh(&set->lock);
	ret = set->variant->kadt(set, skb, IPSET_ADD, opt);
	write_unlock_bh(&set->lock);

	return ret;
}
EXPORT_SYMBOL_GPL(ip_set_add);

int
ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
	   const struct ip_set_adt_opt *opt)
{
	struct ip_set *set = ip_set_list[index];
	int ret = 0;

	BUG_ON(set == NULL);
	pr_debug("set %s, index %u\n", set->name, index);

	if (opt->dim < set->type->dimension ||
	    !(opt->family == set->family || set->family == AF_UNSPEC))
		return 0;

	write_lock_bh(&set->lock);
	ret = set->variant->kadt(set, skb, IPSET_DEL, opt);
	write_unlock_bh(&set->lock);

	return ret;
}
EXPORT_SYMBOL_GPL(ip_set_del);

/*
 * Find set by name, reference it once. The reference makes sure the
 * thing pointed to, does not go away under our feet.
 *
 */
ip_set_id_t
ip_set_get_byname(const char *name, struct ip_set **set)
{
	ip_set_id_t i, index = IPSET_INVALID_ID;
	struct ip_set *s;

	for (i = 0; i < ip_set_max; i++) {
		s = ip_set_list[i];
		if (s != NULL && STREQ(s->name, name)) {
			__ip_set_get(i);
			index = i;
			*set = s;
		}
	}

	return index;
}
EXPORT_SYMBOL_GPL(ip_set_get_byname);

/*
 * If the given set pointer points to a valid set, decrement
 * reference count by 1. The caller shall not assume the index
 * to be valid, after calling this function.
 *
 */
void
ip_set_put_byindex(ip_set_id_t index)
{
	if (ip_set_list[index] != NULL)
		__ip_set_put(index);
}
EXPORT_SYMBOL_GPL(ip_set_put_byindex);

/*
 * Get the name of a set behind a set index.
 * We assume the set is referenced, so it does exist and
 * can't be destroyed. The set cannot be renamed due to
 * the referencing either.
 *
 */
const char *
ip_set_name_byindex(ip_set_id_t index)
{
	const struct ip_set *set = ip_set_list[index];

	BUG_ON(set == NULL);
	BUG_ON(set->ref == 0);

	/* Referenced, so it's safe */
	return set->name;
}
EXPORT_SYMBOL_GPL(ip_set_name_byindex);

/*
 * Routines to call by external subsystems, which do not
 * call nfnl_lock for us.
 */

/*
 * Find set by name, reference it once. The reference makes sure the
 * thing pointed to, does not go away under our feet.
 *
 * The nfnl mutex is used in the function.
 */
ip_set_id_t
ip_set_nfnl_get(const char *name)
{
	struct ip_set *s;
	ip_set_id_t index;

	nfnl_lock();
	index = ip_set_get_byname(name, &s);
	nfnl_unlock();

	return index;
}
EXPORT_SYMBOL_GPL(ip_set_nfnl_get);

/*
 * Find set by index, reference it once. The reference makes sure the
 * thing pointed to, does not go away under our feet.
 *
 * The nfnl mutex is used in the function.
 */
ip_set_id_t
ip_set_nfnl_get_byindex(ip_set_id_t index)
{
	if (index > ip_set_max)
		return IPSET_INVALID_ID;

	nfnl_lock();
	if (ip_set_list[index])
		__ip_set_get(index);
	else
		index = IPSET_INVALID_ID;
	nfnl_unlock();

	return index;
}
EXPORT_SYMBOL_GPL(ip_set_nfnl_get_byindex);

/*
 * If the given set pointer points to a valid set, decrement
 * reference count by 1. The caller shall not assume the index
 * to be valid, after calling this function.
 *
 * The nfnl mutex is used in the function.
 */
void
ip_set_nfnl_put(ip_set_id_t index)
{
	nfnl_lock();
	ip_set_put_byindex(index);
	nfnl_unlock();
}
EXPORT_SYMBOL_GPL(ip_set_nfnl_put);

/*
 * Communication protocol with userspace over netlink.
 *
 * The commands are serialized by the nfnl mutex.
 */

static inline bool
protocol_failed(const struct nlattr * const tb[])
{
	return !tb[IPSET_ATTR_PROTOCOL] ||
	       nla_get_u8(tb[IPSET_ATTR_PROTOCOL]) != IPSET_PROTOCOL;
}

static inline u32
flag_exist(const struct nlmsghdr *nlh)
{
	return nlh->nlmsg_flags & NLM_F_EXCL ? 0 : IPSET_FLAG_EXIST;
}

static struct nlmsghdr *
start_msg(struct sk_buff *skb, u32 pid, u32 seq, unsigned int flags,
	  enum ipset_cmd cmd)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;

	nlh = nlmsg_put(skb, pid, seq, cmd | (NFNL_SUBSYS_IPSET << 8),
			sizeof(*nfmsg), flags);
	if (nlh == NULL)
		return NULL;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_INET;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	return nlh;
}

/* Create a set */

static const struct nla_policy ip_set_create_policy[IPSET_ATTR_CMD_MAX + 1] = {
	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
				    .len = IPSET_MAXNAMELEN - 1 },
	[IPSET_ATTR_TYPENAME]	= { .type = NLA_NUL_STRING,
				    .len = IPSET_MAXNAMELEN - 1},
	[IPSET_ATTR_REVISION]	= { .type = NLA_U8 },
	[IPSET_ATTR_FAMILY]	= { .type = NLA_U8 },
	[IPSET_ATTR_DATA]	= { .type = NLA_NESTED },
};

static ip_set_id_t
find_set_id(const char *name)
{
	ip_set_id_t i, index = IPSET_INVALID_ID;
	const struct ip_set *set;

	for (i = 0; index == IPSET_INVALID_ID && i < ip_set_max; i++) {
		set = ip_set_list[i];
		if (set != NULL && STREQ(set->name, name))
			index = i;
	}
	return index;
}

static inline struct ip_set *
find_set(const char *name)
{
	ip_set_id_t index = find_set_id(name);

	return index == IPSET_INVALID_ID ? NULL : ip_set_list[index];
}

static int
find_free_id(const char *name, ip_set_id_t *index, struct ip_set **set)
{
	ip_set_id_t i;

	*index = IPSET_INVALID_ID;
	for (i = 0;  i < ip_set_max; i++) {
		if (ip_set_list[i] == NULL) {
			if (*index == IPSET_INVALID_ID)
				*index = i;
		} else if (STREQ(name, ip_set_list[i]->name)) {
			/* Name clash */
			*set = ip_set_list[i];
			return -EEXIST;
		}
	}
	if (*index == IPSET_INVALID_ID)
		/* No free slot remained */
		return -IPSET_ERR_MAX_SETS;
	return 0;
}

static int
ip_set_create(struct sock *ctnl, struct sk_buff *skb,
	      const struct nlmsghdr *nlh,
	      const struct nlattr * const attr[])
{
	struct ip_set *set, *clash = NULL;
	ip_set_id_t index = IPSET_INVALID_ID;
	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1] = {};
	const char *name, *typename;
	u8 family, revision;
	u32 flags = flag_exist(nlh);
	int ret = 0;

	if (unlikely(protocol_failed(attr) ||
		     attr[IPSET_ATTR_SETNAME] == NULL ||
		     attr[IPSET_ATTR_TYPENAME] == NULL ||
		     attr[IPSET_ATTR_REVISION] == NULL ||
		     attr[IPSET_ATTR_FAMILY] == NULL ||
		     (attr[IPSET_ATTR_DATA] != NULL &&
		      !flag_nested(attr[IPSET_ATTR_DATA]))))
		return -IPSET_ERR_PROTOCOL;

	name = nla_data(attr[IPSET_ATTR_SETNAME]);
	typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
	family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
	revision = nla_get_u8(attr[IPSET_ATTR_REVISION]);
	pr_debug("setname: %s, typename: %s, family: %s, revision: %u\n",
		 name, typename, family_name(family), revision);

	/*
	 * First, and without any locks, allocate and initialize
	 * a normal base set structure.
	 */
	set = kzalloc(sizeof(struct ip_set), GFP_KERNEL);
	if (!set)
		return -ENOMEM;
	rwlock_init(&set->lock);
	strlcpy(set->name, name, IPSET_MAXNAMELEN);
	set->family = family;

	/*
	 * Next, check that we know the type, and take
	 * a reference on the type, to make sure it stays available
	 * while constructing our new set.
	 *
	 * After referencing the type, we try to create the type
	 * specific part of the set without holding any locks.
	 */
	ret = find_set_type_get(typename, family, revision, &(set->type));
	if (ret)
		goto out;

	/*
	 * Without holding any locks, create private part.
	 */
	if (attr[IPSET_ATTR_DATA] &&
	    nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
			     set->type->create_policy)) {
	    	ret = -IPSET_ERR_PROTOCOL;
	    	goto put_out;
	}

	ret = set->type->create(set, tb, flags);
	if (ret != 0)
		goto put_out;

	/* BTW, ret==0 here. */

	/*
	 * Here, we have a valid, constructed set and we are protected
	 * by the nfnl mutex. Find the first free index in ip_set_list
	 * and check clashing.
	 */
	if ((ret = find_free_id(set->name, &index, &clash)) != 0) {
		/* If this is the same set and requested, ignore error */
		if (ret == -EEXIST &&
		    (flags & IPSET_FLAG_EXIST) &&
		    STREQ(set->type->name, clash->type->name) &&
		    set->type->family == clash->type->family &&
		    set->type->revision == clash->type->revision &&
		    set->variant->same_set(set, clash))
			ret = 0;
		goto cleanup;
	}

	/*
	 * Finally! Add our shiny new set to the list, and be done.
	 */
	pr_debug("create: '%s' created with index %u!\n", set->name, index);
	ip_set_list[index] = set;

	return ret;

cleanup:
	set->variant->destroy(set);
put_out:
	module_put(set->type->me);
out:
	kfree(set);
	return ret;
}

/* Destroy sets */

static const struct nla_policy
ip_set_setname_policy[IPSET_ATTR_CMD_MAX + 1] = {
	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
				    .len = IPSET_MAXNAMELEN - 1 },
};

static void
ip_set_destroy_set(ip_set_id_t index)
{
	struct ip_set *set = ip_set_list[index];

	pr_debug("set: %s\n",  set->name);
	ip_set_list[index] = NULL;

	/* Must call it without holding any lock */
	set->variant->destroy(set);
	module_put(set->type->me);
	kfree(set);
}

static int
ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
	       const struct nlmsghdr *nlh,
	       const struct nlattr * const attr[])
{
	ip_set_id_t i;
	int ret = 0;

	if (unlikely(protocol_failed(attr)))
		return -IPSET_ERR_PROTOCOL;

	/* Commands are serialized and references are
	 * protected by the ip_set_ref_lock.
	 * External systems (i.e. xt_set) must call
	 * ip_set_put|get_nfnl_* functions, that way we
	 * can safely check references here.
	 *
	 * list:set timer can only decrement the reference
	 * counter, so if it's already zero, we can proceed
	 * without holding the lock.
	 */
	read_lock_bh(&ip_set_ref_lock);
	if (!attr[IPSET_ATTR_SETNAME]) {
		for (i = 0; i < ip_set_max; i++) {
			if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
				ret = IPSET_ERR_BUSY;
				goto out;
			}
		}
		read_unlock_bh(&ip_set_ref_lock);
		for (i = 0; i < ip_set_max; i++) {
			if (ip_set_list[i] != NULL)
				ip_set_destroy_set(i);
		}
	} else {
		i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
		if (i == IPSET_INVALID_ID) {
			ret = -ENOENT;
			goto out;
		} else if (ip_set_list[i]->ref) {
			ret = -IPSET_ERR_BUSY;
			goto out;
		}
		read_unlock_bh(&ip_set_ref_lock);

		ip_set_destroy_set(i);
	}
	return 0;
out:
	read_unlock_bh(&ip_set_ref_lock);