Linux-2.6.12-rc2v2.6.12-rc2

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!

1 files changed, 2463 insertions, 0 deletions

diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
new file mode 100644
index 00000000000..c46d9520c5a
--- /dev/null
+++ b/drivers/atm/ambassador.c
@@ -0,0 +1,2463 @@
+/*
+  Madge Ambassador ATM Adapter driver.
+  Copyright (C) 1995-1999  Madge Networks Ltd.
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+  The GNU GPL is contained in /usr/doc/copyright/GPL on a Debian
+  system and in the file COPYING in the Linux kernel source.
+*/
+
+/* * dedicated to the memory of Graham Gordon 1971-1998 * */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/atmdev.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+
+#include <asm/atomic.h>
+#include <asm/io.h>
+#include <asm/byteorder.h>
+
+#include "ambassador.h"
+
+#define maintainer_string "Giuliano Procida at Madge Networks <gprocida@madge.com>"
+#define description_string "Madge ATM Ambassador driver"
+#define version_string "1.2.4"
+
+static inline void __init show_version (void) {
+  printk ("%s version %s\n", description_string, version_string);
+}
+
+/*
+  
+  Theory of Operation
+  
+  I Hardware, detection, initialisation and shutdown.
+  
+  1. Supported Hardware
+  
+  This driver is for the PCI ATMizer-based Ambassador card (except
+  very early versions). It is not suitable for the similar EISA "TR7"
+  card. Commercially, both cards are known as Collage Server ATM
+  adapters.
+  
+  The loader supports image transfer to the card, image start and few
+  other miscellaneous commands.
+  
+  Only AAL5 is supported with vpi = 0 and vci in the range 0 to 1023.
+  
+  The cards are big-endian.
+  
+  2. Detection
+  
+  Standard PCI stuff, the early cards are detected and rejected.
+  
+  3. Initialisation
+  
+  The cards are reset and the self-test results are checked. The
+  microcode image is then transferred and started. This waits for a
+  pointer to a descriptor containing details of the host-based queues
+  and buffers and various parameters etc. Once they are processed
+  normal operations may begin. The BIA is read using a microcode
+  command.
+  
+  4. Shutdown
+  
+  This may be accomplished either by a card reset or via the microcode
+  shutdown command. Further investigation required.
+  
+  5. Persistent state
+  
+  The card reset does not affect PCI configuration (good) or the
+  contents of several other "shared run-time registers" (bad) which
+  include doorbell and interrupt control as well as EEPROM and PCI
+  control. The driver must be careful when modifying these registers
+  not to touch bits it does not use and to undo any changes at exit.
+  
+  II Driver software
+  
+  0. Generalities
+  
+  The adapter is quite intelligent (fast) and has a simple interface
+  (few features). VPI is always zero, 1024 VCIs are supported. There
+  is limited cell rate support. UBR channels can be capped and ABR
+  (explicit rate, but not EFCI) is supported. There is no CBR or VBR
+  support.
+  
+  1. Driver <-> Adapter Communication
+  
+  Apart from the basic loader commands, the driver communicates
+  through three entities: the command queue (CQ), the transmit queue
+  pair (TXQ) and the receive queue pairs (RXQ). These three entities
+  are set up by the host and passed to the microcode just after it has
+  been started.
+  
+  All queues are host-based circular queues. They are contiguous and
+  (due to hardware limitations) have some restrictions as to their
+  locations in (bus) memory. They are of the "full means the same as
+  empty so don't do that" variety since the adapter uses pointers
+  internally.
+  
+  The queue pairs work as follows: one queue is for supply to the
+  adapter, items in it are pending and are owned by the adapter; the
+  other is the queue for return from the adapter, items in it have
+  been dealt with by the adapter. The host adds items to the supply
+  (TX descriptors and free RX buffer descriptors) and removes items
+  from the return (TX and RX completions). The adapter deals with out
+  of order completions.
+  
+  Interrupts (card to host) and the doorbell (host to card) are used
+  for signalling.
+  
+  1. CQ
+  
+  This is to communicate "open VC", "close VC", "get stats" etc. to
+  the adapter. At most one command is retired every millisecond by the
+  card. There is no out of order completion or notification. The
+  driver needs to check the return code of the command, waiting as
+  appropriate.
+  
+  2. TXQ
+  
+  TX supply items are of variable length (scatter gather support) and
+  so the queue items are (more or less) pointers to the real thing.
+  Each TX supply item contains a unique, host-supplied handle (the skb
+  bus address seems most sensible as this works for Alphas as well,
+  there is no need to do any endian conversions on the handles).
+  
+  TX return items consist of just the handles above.
+  
+  3. RXQ (up to 4 of these with different lengths and buffer sizes)
+  
+  RX supply items consist of a unique, host-supplied handle (the skb
+  bus address again) and a pointer to the buffer data area.
+  
+  RX return items consist of the handle above, the VC, length and a
+  status word. This just screams "oh so easy" doesn't it?
+
+  Note on RX pool sizes:
+   
+  Each pool should have enough buffers to handle a back-to-back stream
+  of minimum sized frames on a single VC. For example:
+  
+    frame spacing = 3us (about right)
+    
+    delay = IRQ lat + RX handling + RX buffer replenish = 20 (us)  (a guess)
+    
+    min number of buffers for one VC = 1 + delay/spacing (buffers)
+
+    delay/spacing = latency = (20+2)/3 = 7 (buffers)  (rounding up)
+    
+  The 20us delay assumes that there is no need to sleep; if we need to
+  sleep to get buffers we are going to drop frames anyway.
+  
+  In fact, each pool should have enough buffers to support the
+  simultaneous reassembly of a separate frame on each VC and cope with
+  the case in which frames complete in round robin cell fashion on
+  each VC.
+  
+  Only one frame can complete at each cell arrival, so if "n" VCs are
+  open, the worst case is to have them all complete frames together
+  followed by all starting new frames together.
+  
+    desired number of buffers = n + delay/spacing
+    
+  These are the extreme requirements, however, they are "n+k" for some
+  "k" so we have only the constant to choose. This is the argument
+  rx_lats which current defaults to 7.
+  
+  Actually, "n ? n+k : 0" is better and this is what is implemented,
+  subject to the limit given by the pool size.
+  
+  4. Driver locking
+  
+  Simple spinlocks are used around the TX and RX queue mechanisms.
+  Anyone with a faster, working method is welcome to implement it.
+  
+  The adapter command queue is protected with a spinlock. We always
+  wait for commands to complete.
+  
+  A more complex form of locking is used around parts of the VC open
+  and close functions. There are three reasons for a lock: 1. we need
+  to do atomic rate reservation and release (not used yet), 2. Opening
+  sometimes involves two adapter commands which must not be separated
+  by another command on the same VC, 3. the changes to RX pool size
+  must be atomic. The lock needs to work over context switches, so we
+  use a semaphore.
+  
+  III Hardware Features and Microcode Bugs
+  
+  1. Byte Ordering
+  
+  *%^"$&%^$*&^"$(%^$#&^%$(&#%$*(&^#%!"!"!*!
+  
+  2. Memory access
+  
+  All structures that are not accessed using DMA must be 4-byte
+  aligned (not a problem) and must not cross 4MB boundaries.
+  
+  There is a DMA memory hole at E0000000-E00000FF (groan).
+  
+  TX fragments (DMA read) must not cross 4MB boundaries (would be 16MB
+  but for a hardware bug).
+  
+  RX buffers (DMA write) must not cross 16MB boundaries and must
+  include spare trailing bytes up to the next 4-byte boundary; they
+  will be written with rubbish.
+  
+  The PLX likes to prefetch; if reading up to 4 u32 past the end of
+  each TX fragment is not a problem, then TX can be made to go a
+  little faster by passing a flag at init that disables a prefetch
+  workaround. We do not pass this flag. (new microcode only)
+  
+  Now we:
+  . Note that alloc_skb rounds up size to a 16byte boundary.  
+  . Ensure all areas do not traverse 4MB boundaries.
+  . Ensure all areas do not start at a E00000xx bus address.
+  (I cannot be certain, but this may always hold with Linux)
+  . Make all failures cause a loud message.
+  . Discard non-conforming SKBs (causes TX failure or RX fill delay).
+  . Discard non-conforming TX fragment descriptors (the TX fails).
+  In the future we could:
+  . Allow RX areas that traverse 4MB (but not 16MB) boundaries.
+  . Segment TX areas into some/more fragments, when necessary.
+  . Relax checks for non-DMA items (ignore hole).
+  . Give scatter-gather (iovec) requirements using ???. (?)
+  
+  3. VC close is broken (only for new microcode)
+  
+  The VC close adapter microcode command fails to do anything if any
+  frames have been received on the VC but none have been transmitted.
+  Frames continue to be reassembled and passed (with IRQ) to the
+  driver.
+  
+  IV To Do List
+  
+  . Fix bugs!
+  
+  . Timer code may be broken.
+  
+  . Deal with buggy VC close (somehow) in microcode 12.
+  
+  . Handle interrupted and/or non-blocking writes - is this a job for
+    the protocol layer?
+  
+  . Add code to break up TX fragments when they span 4MB boundaries.
+  
+  . Add SUNI phy layer (need to know where SUNI lives on card).
+  
+  . Implement a tx_alloc fn to (a) satisfy TX alignment etc. and (b)
+    leave extra headroom space for Ambassador TX descriptors.
+  
+  . Understand these elements of struct atm_vcc: recvq (proto?),
+    sleep, callback, listenq, backlog_quota, reply and user_back.
+  
+  . Adjust TX/RX skb allocation to favour IP with LANE/CLIP (configurable).
+  
+  . Impose a TX-pending limit (2?) on each VC, help avoid TX q overflow.
+  
+  . Decide whether RX buffer recycling is or can be made completely safe;
+    turn it back on. It looks like Werner is going to axe this.
+  
+  . Implement QoS changes on open VCs (involves extracting parts of VC open
+    and close into separate functions and using them to make changes).
+  
+  . Hack on command queue so that someone can issue multiple commands and wait
+    on the last one (OR only "no-op" or "wait" commands are waited for).
+  
+  . Eliminate need for while-schedule around do_command.
+  
+*/
+
+/********** microcode **********/
+
+#ifdef AMB_NEW_MICROCODE
+#define UCODE(x) UCODE2(atmsar12.x)
+#else
+#define UCODE(x) UCODE2(atmsar11.x)
+#endif
+#define UCODE2(x) #x
+
+static u32 __devinitdata ucode_start =
+#include UCODE(start)
+;
+
+static region __devinitdata ucode_regions[] = {
+#include UCODE(regions)
+  { 0, 0 }
+};
+
+static u32 __devinitdata ucode_data[] = {
+#include UCODE(data)
+  0xdeadbeef
+};
+
+static void do_housekeeping (unsigned long arg);
+/********** globals **********/
+
+static unsigned short debug = 0;
+static unsigned int cmds = 8;
+static unsigned int txs = 32;
+static unsigned int rxs[NUM_RX_POOLS] = { 64, 64, 64, 64 };
+static unsigned int rxs_bs[NUM_RX_POOLS] = { 4080, 12240, 36720, 65535 };
+static unsigned int rx_lats = 7;
+static unsigned char pci_lat = 0;
+
+static const unsigned long onegigmask = -1 << 30;
+
+/********** access to adapter **********/
+
+static inline void wr_plain (const amb_dev * dev, size_t addr, u32 data) {
+  PRINTD (DBG_FLOW|DBG_REGS, "wr: %08zx <- %08x", addr, data);
+#ifdef AMB_MMIO
+  dev->membase[addr / sizeof(u32)] = data;
+#else
+  outl (data, dev->iobase + addr);
+#endif
+}
+
+static inline u32 rd_plain (const amb_dev * dev, size_t addr) {
+#ifdef AMB_MMIO
+  u32 data = dev->membase[addr / sizeof(u32)];
+#else
+  u32 data = inl (dev->iobase + addr);
+#endif
+  PRINTD (DBG_FLOW|DBG_REGS, "rd: %08zx -> %08x", addr, data);
+  return data;
+}
+
+static inline void wr_mem (const amb_dev * dev, size_t addr, u32 data) {
+  __be32 be = cpu_to_be32 (data);
+  PRINTD (DBG_FLOW|DBG_REGS, "wr: %08zx <- %08x b[%08x]", addr, data, be);
+#ifdef AMB_MMIO
+  dev->membase[addr / sizeof(u32)] = be;
+#else
+  outl (be, dev->iobase + addr);
+#endif
+}
+
+static inline u32 rd_mem (const amb_dev * dev, size_t addr) {
+#ifdef AMB_MMIO
+  __be32 be = dev->membase[addr / sizeof(u32)];
+#else
+  __be32 be = inl (dev->iobase + addr);
+#endif
+  u32 data = be32_to_cpu (be);
+  PRINTD (DBG_FLOW|DBG_REGS, "rd: %08zx -> %08x b[%08x]", addr, data, be);
+  return data;
+}
+
+/********** dump routines **********/
+
+static inline void dump_registers (const amb_dev * dev) {
+#ifdef DEBUG_AMBASSADOR
+  if (debug & DBG_REGS) {
+    size_t i;
+    PRINTD (DBG_REGS, "reading PLX control: ");
+    for (i = 0x00; i < 0x30; i += sizeof(u32))
+      rd_mem (dev, i);
+    PRINTD (DBG_REGS, "reading mailboxes: ");
+    for (i = 0x40; i < 0x60; i += sizeof(u32))
+      rd_mem (dev, i);
+    PRINTD (DBG_REGS, "reading doorb irqev irqen reset:");
+    for (i = 0x60; i < 0x70; i += sizeof(u32))
+      rd_mem (dev, i);
+  }
+#else
+  (void) dev;
+#endif
+  return;
+}
+
+static inline void dump_loader_block (volatile loader_block * lb) {
+#ifdef DEBUG_AMBASSADOR
+  unsigned int i;
+  PRINTDB (DBG_LOAD, "lb @ %p; res: %d, cmd: %d, pay:",
+	   lb, be32_to_cpu (lb->result), be32_to_cpu (lb->command));
+  for (i = 0; i < MAX_COMMAND_DATA; ++i)
+    PRINTDM (DBG_LOAD, " %08x", be32_to_cpu (lb->payload.data[i]));
+  PRINTDE (DBG_LOAD, ", vld: %08x", be32_to_cpu (lb->valid));
+#else
+  (void) lb;
+#endif
+  return;
+}
+
+static inline void dump_command (command * cmd) {
+#ifdef DEBUG_AMBASSADOR
+  unsigned int i;
+  PRINTDB (DBG_CMD, "cmd @ %p, req: %08x, pars:",
+	   cmd, /*be32_to_cpu*/ (cmd->request));
+  for (i = 0; i < 3; ++i)
+    PRINTDM (DBG_CMD, " %08x", /*be32_to_cpu*/ (cmd->args.par[i]));
+  PRINTDE (DBG_CMD, "");
+#else
+  (void) cmd;
+#endif
+  return;
+}
+
+static inline void dump_skb (char * prefix, unsigned int vc, struct sk_buff * skb) {
+#ifdef DEBUG_AMBASSADOR
+  unsigned int i;
+  unsigned char * data = skb->data;
+  PRINTDB (DBG_DATA, "%s(%u) ", prefix, vc);
+  for (i=0; i<skb->len && i < 256;i++)
+    PRINTDM (DBG_DATA, "%02x ", data[i]);
+  PRINTDE (DBG_DATA,"");
+#else
+  (void) prefix;
+  (void) vc;
+  (void) skb;
+#endif
+  return;
+}
+
+/********** check memory areas for use by Ambassador **********/
+
+/* see limitations under Hardware Features */
+
+static inline int check_area (void * start, size_t length) {
+  // assumes length > 0
+  const u32 fourmegmask = -1 << 22;
+  const u32 twofivesixmask = -1 << 8;
+  const u32 starthole = 0xE0000000;
+  u32 startaddress = virt_to_bus (start);
+  u32 lastaddress = startaddress+length-1;
+  if ((startaddress ^ lastaddress) & fourmegmask ||
+      (startaddress & twofivesixmask) == starthole) {
+    PRINTK (KERN_ERR, "check_area failure: [%x,%x] - mail maintainer!",
+	    startaddress, lastaddress);
+    return -1;
+  } else {
+    return 0;
+  }
+}
+
+/********** free an skb (as per ATM device driver documentation) **********/
+
+static inline void amb_kfree_skb (struct sk_buff * skb) {
+  if (ATM_SKB(skb)->vcc->pop) {
+    ATM_SKB(skb)->vcc->pop (ATM_SKB(skb)->vcc, skb);
+  } else {
+    dev_kfree_skb_any (skb);
+  }
+}
+
+/********** TX completion **********/
+
+static inline void tx_complete (amb_dev * dev, tx_out * tx) {
+  tx_simple * tx_descr = bus_to_virt (tx->handle);
+  struct sk_buff * skb = tx_descr->skb;
+  
+  PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
+  
+  // VC layer stats
+  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
+  
+  // free the descriptor
+  kfree (tx_descr);
+  
+  // free the skb
+  amb_kfree_skb (skb);
+  
+  dev->stats.tx_ok++;
+  return;
+}
+
+/********** RX completion **********/
+
+static void rx_complete (amb_dev * dev, rx_out * rx) {
+  struct sk_buff * skb = bus_to_virt (rx->handle);
+  u16 vc = be16_to_cpu (rx->vc);
+  // unused: u16 lec_id = be16_to_cpu (rx->lec_id);
+  u16 status = be16_to_cpu (rx->status);
+  u16 rx_len = be16_to_cpu (rx->length);
+  
+  PRINTD (DBG_FLOW|DBG_RX, "rx_complete %p %p (len=%hu)", dev, rx, rx_len);
+  
+  // XXX move this in and add to VC stats ???
+  if (!status) {
+    struct atm_vcc * atm_vcc = dev->rxer[vc];
+    dev->stats.rx.ok++;
+    
+    if (atm_vcc) {
+      
+      if (rx_len <= atm_vcc->qos.rxtp.max_sdu) {
+	
+	if (atm_charge (atm_vcc, skb->truesize)) {
+	  
+	  // prepare socket buffer
+	  ATM_SKB(skb)->vcc = atm_vcc;
+	  skb_put (skb, rx_len);
+	  
+	  dump_skb ("<<<", vc, skb);
+	  
+	  // VC layer stats
+	  atomic_inc(&atm_vcc->stats->rx);
+	  do_gettimeofday(&skb->stamp);
+	  // end of our responsability
+	  atm_vcc->push (atm_vcc, skb);
+	  return;
+	  
+	} else {
+	  // someone fix this (message), please!
+	  PRINTD (DBG_INFO|DBG_RX, "dropped thanks to atm_charge (vc %hu, truesize %u)", vc, skb->truesize);
+	  // drop stats incremented in atm_charge
+	}
+	
+      } else {
+      	PRINTK (KERN_INFO, "dropped over-size frame");
+	// should we count this?
+	atomic_inc(&atm_vcc->stats->rx_drop);
+      }
+      
+    } else {
+      PRINTD (DBG_WARN|DBG_RX, "got frame but RX closed for channel %hu", vc);
+      // this is an adapter bug, only in new version of microcode
+    }
+    
+  } else {
+    dev->stats.rx.error++;
+    if (status & CRC_ERR)
+      dev->stats.rx.badcrc++;
+    if (status & LEN_ERR)
+      dev->stats.rx.toolong++;
+    if (status & ABORT_ERR)
+      dev->stats.rx.aborted++;
+    if (status & UNUSED_ERR)
+      dev->stats.rx.unused++;
+  }
+  
+  dev_kfree_skb_any (skb);
+  return;
+}
+
+/*
+  
+  Note on queue handling.
+  
+  Here "give" and "take" refer to queue entries and a queue (pair)
+  rather than frames to or from the host or adapter. Empty frame
+  buffers are given to the RX queue pair and returned unused or
+  containing RX frames. TX frames (well, pointers to TX fragment
+  lists) are given to the TX queue pair, completions are returned.
+  
+*/
+
+/********** command queue **********/
+
+// I really don't like this, but it's the best I can do at the moment
+
+// also, the callers are responsible for byte order as the microcode
+// sometimes does 16-bit accesses (yuk yuk yuk)
+
+static int command_do (amb_dev * dev, command * cmd) {
+  amb_cq * cq = &dev->cq;
+  volatile amb_cq_ptrs * ptrs = &cq->ptrs;
+  command * my_slot;
+  
+  PRINTD (DBG_FLOW|DBG_CMD, "command_do %p", dev);
+  
+  if (test_bit (dead, &dev->flags))
+    return 0;
+  
+  spin_lock (&cq->lock);
+  
+  // if not full...
+  if (cq->pending < cq->maximum) {
+    // remember my slot for later
+    my_slot = ptrs->in;
+    PRINTD (DBG_CMD, "command in slot %p", my_slot);
+    
+    dump_command (cmd);
+    
+    // copy command in
+    *ptrs->in = *cmd;
+    cq->pending++;
+    ptrs->in = NEXTQ (ptrs->in, ptrs->start, ptrs->limit);
+    
+    // mail the command
+    wr_mem (dev, offsetof(amb_mem, mb.adapter.cmd_address), virt_to_bus (ptrs->in));
+    
+    if (cq->pending > cq->high)
+      cq->high = cq->pending;
+    spin_unlock (&cq->lock);
+    
+    // these comments were in a while-loop before, msleep removes the loop
+    // go to sleep
+    // PRINTD (DBG_CMD, "wait: sleeping %lu for command", timeout);
+    msleep(cq->pending);
+    
+    // wait for my slot to be reached (all waiters are here or above, until...)
+    while (ptrs->out != my_slot) {
+      PRINTD (DBG_CMD, "wait: command slot (now at %p)", ptrs->out);
+      set_current_state(TASK_UNINTERRUPTIBLE);
+      schedule();
+    }
+    
+    // wait on my slot (... one gets to its slot, and... )
+    while (ptrs->out->request != cpu_to_be32 (SRB_COMPLETE)) {
+      PRINTD (DBG_CMD, "wait: command slot completion");
+      set_current_state(TASK_UNINTERRUPTIBLE);
+      schedule();
+    }
+    
+    PRINTD (DBG_CMD, "command complete");
+    // update queue (... moves the queue along to the next slot)
+    spin_lock (&cq->lock);
+    cq->pending--;
+    // copy command out
+    *cmd = *ptrs->out;
+    ptrs->out = NEXTQ (ptrs->out, ptrs->start, ptrs->limit);
+    spin_unlock (&cq->lock);
+    
+    return 0;
+  } else {
+    cq->filled++;
+    spin_unlock (&cq->lock);
+    return -EAGAIN;
+  }
+  
+}
+
+/********** TX queue pair **********/
+
+static inline int tx_give (amb_dev * dev, tx_in * tx) {
+  amb_txq * txq = &dev->txq;
+  unsigned long flags;
+  
+  PRINTD (DBG_FLOW|DBG_TX, "tx_give %p", dev);
+
+  if (test_bit (dead, &dev->flags))
+    return 0;
+  
+  spin_lock_irqsave (&txq->lock, flags);
+  
+  if (txq->pending < txq->maximum) {
+    PRINTD (DBG_TX, "TX in slot %p", txq->in.ptr);
+
+    *txq->in.ptr = *tx;
+    txq->pending++;
+    txq->in.ptr = NEXTQ (txq->in.ptr, txq->in.start, txq->in.limit);
+    // hand over the TX and ring the bell
+    wr_mem (dev, offsetof(amb_mem, mb.adapter.tx_address), virt_to_bus (txq->in.ptr));
+    wr_mem (dev, offsetof(amb_mem, doorbell), TX_FRAME);
+    
+    if (txq->pending > txq->high)
+      txq->high = txq->pending;
+    spin_unlock_irqrestore (&txq->lock, flags);
+    return 0;
+  } else {
+    txq->filled++;
+    spin_unlock_irqrestore (&txq->lock, flags);
+    return -EAGAIN;
+  }
+}
+
+static inline int tx_take (amb_dev * dev) {
+  amb_txq * txq = &dev->txq;
+  unsigned long flags;
+  
+  PRINTD (DBG_FLOW|DBG_TX, "tx_take %p", dev);
+  
+  spin_lock_irqsave (&txq->lock, flags);
+  
+  if (txq->pending && txq->out.ptr->handle) {
+    // deal with TX completion
+    tx_complete (dev, txq->out.ptr);
+    // mark unused again
+    txq->out.ptr->handle = 0;
+    // remove item
+    txq->pending--;
+    txq->out.ptr = NEXTQ (txq->out.ptr, txq->out.start, txq->out.limit);
+    
+    spin_unlock_irqrestore (&txq->lock, flags);
+    return 0;
+  } else {
+    
+    spin_unlock_irqrestore (&txq->lock, flags);
+    return -1;
+  }
+}
+
+/********** RX queue pairs **********/
+
+static inline int rx_give (amb_dev * dev, rx_in * rx, unsigned char pool) {
+  amb_rxq * rxq = &dev->rxq[pool];
+  unsigned long flags;
+  
+  PRINTD (DBG_FLOW|DBG_RX, "rx_give %p[%hu]", dev, pool);
+  
+  spin_lock_irqsave (&rxq->lock, flags);
+  
+  if (rxq->pending < rxq->maximum) {
+    PRINTD (DBG_RX, "RX in slot %p", rxq->in.ptr);
+
+    *rxq->in.ptr = *rx;
+    rxq->pending++;
+    rxq->in.ptr = NEXTQ (rxq->in.ptr, rxq->in.start, rxq->in.limit);
+    // hand over the RX buffer
+    wr_mem (dev, offsetof(amb_mem, mb.adapter.rx_address[pool]), virt_to_bus (rxq->in.ptr));
+    
+    spin_unlock_irqrestore (&rxq->lock, flags);
+    return 0;
+  } else {
+    spin_unlock_irqrestore (&rxq->lock, flags);
+    return -1;
+  }
+}
+
+static inline int rx_take (amb_dev * dev, unsigned char pool) {
+  amb_rxq * rxq = &dev->rxq[pool];
+  unsigned long flags;
+  
+  PRINTD (DBG_FLOW|DBG_RX, "rx_take %p[%hu]", dev, pool);
+  
+  spin_lock_irqsave (&rxq->lock, flags);
+  
+  if (rxq->pending && (rxq->out.ptr->status || rxq->out.ptr->length)) {
+    // deal with RX completion
+    rx_complete (dev, rxq->out.ptr);
+    // mark unused again
+    rxq->out.ptr->status = 0;
+    rxq->out.ptr->length = 0;
+    // remove item
+    rxq->pending--;
+    rxq->out.ptr = NEXTQ (rxq->out.ptr, rxq->out.start, rxq->out.limit);
+    
+    if (rxq->pending < rxq->low)
+      rxq->low = rxq->pending;
+    spin_unlock_irqrestore (&rxq->lock, flags);
+    return 0;
+  } else {
+    if (!rxq->pending && rxq->buffers_wanted)
+      rxq->emptied++;
+    spin_unlock_irqrestore (&rxq->lock, flags);
+    return -1;
+  }
+}
+
+/********** RX Pool handling **********/
+
+/* pre: buffers_wanted = 0, post: pending = 0 */
+static inline void drain_rx_pool (amb_dev * dev, unsigned char pool) {
+  amb_rxq * rxq = &dev->rxq[pool];
+  
+  PRINTD (DBG_FLOW|DBG_POOL, "drain_rx_pool %p %hu", dev, pool);
+  
+  if (test_bit (dead, &dev->flags))
+    return;
+  
+  /* we are not quite like the fill pool routines as we cannot just
+     remove one buffer, we have to remove all of them, but we might as
+     well pretend... */
+  if (rxq->pending > rxq->buffers_wanted) {
+    command cmd;
+    cmd.request = cpu_to_be32 (SRB_FLUSH_BUFFER_Q);
+    cmd.args.flush.flags = cpu_to_be32 (pool << SRB_POOL_SHIFT);
+    while (command_do (dev, &cmd))
+      schedule();
+    /* the pool may also be emptied via the interrupt handler */
+    while (rxq->pending > rxq->buffers_wanted)
+      if (rx_take (dev, pool))
+	schedule();
+  }
+  
+  return;
+}
+
+static void drain_rx_pools (amb_dev * dev) {
+  unsigned char pool;
+  
+  PRINTD (DBG_FLOW|DBG_POOL, "drain_rx_pools %p", dev);
+  
+  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
+    drain_rx_pool (dev, pool);
+}
+
+static inline void fill_rx_pool (amb_dev * dev, unsigned char pool, int priority) {
+  rx_in rx;
+  amb_rxq * rxq;
+  
+  PRINTD (DBG_FLOW|DBG_POOL, "fill_rx_pool %p %hu %x", dev, pool, priority);
+  
+  if (test_bit (dead, &dev->flags))
+    return;
+  
+  rxq = &dev->rxq[pool];
+  while (rxq->pending < rxq->maximum && rxq->pending < rxq->buffers_wanted) {
+    
+    struct sk_buff * skb = alloc_skb (rxq->buffer_size, priority);
+    if (!skb) {
+      PRINTD (DBG_SKB|DBG_POOL, "failed to allocate skb for RX pool %hu", pool);
+      return;
+    }
+    if (check_area (skb->data, skb->truesize)) {
+      dev_kfree_skb_any (skb);
+      return;
+    }
+    // cast needed as there is no %? for pointer differences
+    PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
+	    skb, skb->head, (long) (skb->end - skb->head));
+    rx.handle = virt_to_bus (skb);
+    rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
+    if (rx_give (dev, &rx, pool))
+      dev_kfree_skb_any (skb);
+    
+  }
+  
+  return;
+}
+
+// top up all RX pools (can also be called as a bottom half)
+static void fill_rx_pools (amb_dev * dev) {
+  unsigned char pool;
+  
+  PRINTD (DBG_FLOW|DBG_POOL, "fill_rx_pools %p", dev);
+  
+  for (pool = 0; pool < NUM_RX_POOLS; ++pool)
+    fill_rx_pool (dev, pool, GFP_ATOMIC);
+  
+  return;
+}
+
+/********** enable host interrupts **********/
+
+static inline void interrupts_on (amb_dev * dev) {
+  wr_plain (dev, offsetof(amb_mem, interrupt_control),
+	    rd_plain (dev, offsetof(amb_mem, interrupt_control))
+	    | AMB_INTERRUPT_BITS);
+}
+
+/********** disable host interrupts **********/
+
+static inline void interrupts_off (amb_dev * dev) {
+  wr_plain (dev, offsetof(amb_mem, interrupt_control),
+	    rd_plain (dev, offsetof(amb_mem, interrupt_control))
+	    &~ AMB_INTERRUPT_BITS);
+}
+
+/********** interrupt handling **********/
+
+static irqreturn_t interrupt_handler(int irq, void *dev_id,
+					struct pt_regs *pt_regs) {
+  amb_dev * dev = (amb_dev *) dev_id;
+  (void) pt_regs;
+  
+  PRINTD (DBG_IRQ|DBG_FLOW, "interrupt_handler: %p", dev_id);
+  
+  if (!dev_id) {
+    PRINTD (DBG_IRQ|DBG_ERR, "irq with NULL dev_id: %d", irq);
+    return IRQ_NONE;
+  }
+  
+  {
+    u32 interrupt = rd_plain (dev, offsetof(amb_mem, interrupt));
+  
+    // for us or someone else sharing the same interrupt
+    if (!interrupt) {
+      PRINTD (DBG_IRQ, "irq not for me: %d", irq);
+      return IRQ_NONE;
+    }
+    
+    // definitely for us
+    PRINTD (DBG_IRQ, "FYI: interrupt was %08x", interrupt);
+    wr_plain (dev, offsetof(amb_mem, interrupt), -1);
+  }
+  
+  {
+    unsigned int irq_work = 0;
+    unsigned char pool;
+    for (pool = 0; pool < NUM_RX_POOLS; ++pool)
+      while (!rx_take (dev, pool))
+	++irq_work;
+    while (!tx_take (dev))
+      ++irq_work;
+  
+    if (irq_work) {
+#ifdef FILL_RX_POOLS_IN_BH
+      schedule_work (&dev->bh);
+#else
+      fill_rx_pools (dev);
+#endif
+
+      PRINTD (DBG_IRQ, "work done: %u", irq_work);
+    } else {
+      PRINTD (DBG_IRQ|DBG_WARN, "no work done");
+    }
+  }
+  
+  PRINTD (DBG_IRQ|DBG_FLOW, "interrupt_handler done: %p", dev_id);
+  return IRQ_HANDLED;
+}
+
+/********** make rate (not quite as much fun as Horizon) **********/
+
+static unsigned int make_rate (unsigned int rate, rounding r,
+			       u16 * bits, unsigned int * actual) {
+  unsigned char exp = -1; // hush gcc
+  unsigned int man = -1;  // hush gcc
+  
+  PRINTD (DBG_FLOW|DBG_QOS, "make_rate %u", rate);
+  
+  // rates in cells per second, ITU format (nasty 16-bit floating-point)
+  // given 5-bit e and 9-bit m:
+  // rate = EITHER (1+m/2^9)*2^e    OR 0
+  // bits = EITHER 1<<14 | e<<9 | m OR 0
+  // (bit 15 is "reserved", bit 14 "non-zero")
+  // smallest rate is 0 (special representation)
+  // largest rate is (1+511/512)*2^31 = 4290772992 (< 2^32-1)
+  // smallest non-zero rate is (1+0/512)*2^0 = 1 (> 0)
+  // simple algorithm:
+  // find position of top bit, this gives e
+  // remove top bit and shift (rounding if feeling clever) by 9-e
+  
+  // ucode bug: please don't set bit 14! so 0 rate not representable
+  
+  if (rate > 0xffc00000U) {
+    // larger than largest representable rate
+    
+    if (r == round_up) {
+	return -EINVAL;
+    } else {
+      exp = 31;
+      man = 511;
+    }
+    
+  } else if (rate) {
+    // representable rate
+    
+    exp = 31;
+    man = rate;
+    
+    // invariant: rate = man*2^(exp-31)
+    while (!(man & (1<<31))) {
+      exp = exp - 1;
+      man = man<<1;
+    }
+    
+    // man has top bit set
+    // rate = (2^31+(man-2^31))*2^(exp-31)
+    // rate = (1+(man-2^31)/2^31)*2^exp
+    man = man<<1;
+    man &= 0xffffffffU; // a nop on 32-bit systems
+    // rate = (1+man/2^32)*2^exp
+    
+    // exp is in the range 0 to 31, man is in the range 0 to 2^32-1
+    // time to lose significance... we want m in the range 0 to 2^9-1
+    // rounding presents a minor problem... we first decide which way
+    // we are rounding (based on given rounding direction and possibly
+    // the bits of the mantissa that are to be discarded).
+    
+    switch (r) {
+      case round_down: {
+	// just truncate
+	man = man>>(32-9);
+	break;
+      }
+      case round_up: {
+	// check all bits that we are discarding
+	if (man & (-1>>9)) {
+	  man = (man>>(32-9)) + 1;
+	  if (man == (1<<9)) {
+	    // no need to check for round up outside of range
+	    man = 0;
+	    exp += 1;
+	  }
+	} else {
+	  man = (man>>(32-9));
+	}
+	break;
+      }
+      case round_nearest: {
+	// check msb that we are discarding
+	if (man & (1<<(32-9-1))) {
+	  man = (man>>(32-9)) + 1;
+	  if (man == (1<<9)) {
+	    // no need to check for round up outside of range
+	    man = 0;
+	    exp += 1;
+	  }
+	} else {
+	  man = (man>>(32-9));
+	}
+	break;
+      }
+    }
+    
+  } else {
+    // zero rate - not representable
+    
+    if (r == round_down) {
+      return -EINVAL;
+    } else {
+      exp = 0;
+      man = 0;
+    }
+    
+  }
+  
+  PRINTD (DBG_QOS, "rate: man=%u, exp=%hu", man, exp);
+  
+  if (bits)
+    *bits = /* (1<<14) | */ (exp<<9) | man;
+  
+  if (actual)
+    *actual = (exp >= 9)
+      ? (1 << exp) + (man << (exp-9))
+      : (1 << exp) + ((man + (1<<(9-exp-1))) >> (9-exp));
+  
+  return 0;
+}
+
+/********** Linux ATM Operations **********/
+
+// some are not yet implemented while others do not make sense for
+// this device
+
+/********** Open a VC **********/
+
+static int amb_open (struct atm_vcc * atm_vcc)
+{
+  int error;
+  
+  struct atm_qos * qos;
+  struct atm_trafprm * txtp;
+  struct atm_trafprm * rxtp;
+  u16 tx_rate_bits;
+  u16 tx_vc_bits = -1; // hush gcc
+  u16 tx_frame_bits = -1; // hush gcc
+  
+  amb_dev * dev = AMB_DEV(atm_vcc->dev);
+  amb_vcc * vcc;
+  unsigned char pool = -1; // hush gcc
+  short vpi = atm_vcc->vpi;
+  int vci = atm_vcc->vci;
+  
+  PRINTD (DBG_FLOW|DBG_VCC, "amb_open %x %x", vpi, vci);
+  
+#ifdef ATM_VPI_UNSPEC
+  // UNSPEC is deprecated, remove this code eventually
+  if (vpi == ATM_VPI_UNSPEC || vci == ATM_VCI_UNSPEC) {
+    PRINTK (KERN_WARNING, "rejecting open with unspecified VPI/VCI (deprecated)");
+    return -EINVAL;
+  }
+#endif
+  
+  if (!(0 <= vpi && vpi < (1<<NUM_VPI_BITS) &&
+	0 <= vci && vci < (1<<NUM_VCI_BITS))) {
+    PRINTD (DBG_WARN|DBG_VCC, "VPI/VCI out of range: %hd/%d", vpi, vci);
+    return -EINVAL;
+  }
+  
+  qos = &atm_vcc->qos;
+  
+  if (qos->aal != ATM_AAL5) {
+    PRINTD (DBG_QOS, "AAL not supported");
+    return -EINVAL;
+  }
+  
+  // traffic parameters
+  
+  PRINTD (DBG_QOS, "TX:");
+  txtp = &qos->txtp;
+  if (txtp->traffic_class != ATM_NONE) {
+    switch (txtp->traffic_class) {
+      case ATM_UBR: {
+	// we take "the PCR" as a rate-cap
+	int pcr = atm_pcr_goal (txtp);
+	if (!pcr) {
+	  // no rate cap
+	  tx_rate_bits = 0;
+	  tx_vc_bits = TX_UBR;
+	  tx_frame_bits = TX_FRAME_NOTCAP;
+	} else {
+	  rounding r;
+	  if (pcr < 0) {