OSDN Git Service

ceph: fix use-after-free on symlink traversal
[uclinux-h8/linux.git] / drivers / s390 / crypto / ap_queue.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright IBM Corp. 2016
4  * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
5  *
6  * Adjunct processor bus, queue related code.
7  */
8
9 #define KMSG_COMPONENT "ap"
10 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
11
12 #include <linux/init.h>
13 #include <linux/slab.h>
14 #include <asm/facility.h>
15
16 #include "ap_bus.h"
17 #include "ap_debug.h"
18
19 static void __ap_flush_queue(struct ap_queue *aq);
20
21 /**
22  * ap_queue_enable_interruption(): Enable interruption on an AP queue.
23  * @qid: The AP queue number
24  * @ind: the notification indicator byte
25  *
26  * Enables interruption on AP queue via ap_aqic(). Based on the return
27  * value it waits a while and tests the AP queue if interrupts
28  * have been switched on using ap_test_queue().
29  */
30 static int ap_queue_enable_interruption(struct ap_queue *aq, void *ind)
31 {
32         struct ap_queue_status status;
33         struct ap_qirq_ctrl qirqctrl = { 0 };
34
35         qirqctrl.ir = 1;
36         qirqctrl.isc = AP_ISC;
37         status = ap_aqic(aq->qid, qirqctrl, ind);
38         switch (status.response_code) {
39         case AP_RESPONSE_NORMAL:
40         case AP_RESPONSE_OTHERWISE_CHANGED:
41                 return 0;
42         case AP_RESPONSE_Q_NOT_AVAIL:
43         case AP_RESPONSE_DECONFIGURED:
44         case AP_RESPONSE_CHECKSTOPPED:
45         case AP_RESPONSE_INVALID_ADDRESS:
46                 pr_err("Registering adapter interrupts for AP device %02x.%04x failed\n",
47                        AP_QID_CARD(aq->qid),
48                        AP_QID_QUEUE(aq->qid));
49                 return -EOPNOTSUPP;
50         case AP_RESPONSE_RESET_IN_PROGRESS:
51         case AP_RESPONSE_BUSY:
52         default:
53                 return -EBUSY;
54         }
55 }
56
57 /**
58  * __ap_send(): Send message to adjunct processor queue.
59  * @qid: The AP queue number
60  * @psmid: The program supplied message identifier
61  * @msg: The message text
62  * @length: The message length
63  * @special: Special Bit
64  *
65  * Returns AP queue status structure.
66  * Condition code 1 on NQAP can't happen because the L bit is 1.
67  * Condition code 2 on NQAP also means the send is incomplete,
68  * because a segment boundary was reached. The NQAP is repeated.
69  */
70 static inline struct ap_queue_status
71 __ap_send(ap_qid_t qid, unsigned long long psmid, void *msg, size_t length,
72           unsigned int special)
73 {
74         if (special == 1)
75                 qid |= 0x400000UL;
76         return ap_nqap(qid, psmid, msg, length);
77 }
78
79 int ap_send(ap_qid_t qid, unsigned long long psmid, void *msg, size_t length)
80 {
81         struct ap_queue_status status;
82
83         status = __ap_send(qid, psmid, msg, length, 0);
84         switch (status.response_code) {
85         case AP_RESPONSE_NORMAL:
86                 return 0;
87         case AP_RESPONSE_Q_FULL:
88         case AP_RESPONSE_RESET_IN_PROGRESS:
89                 return -EBUSY;
90         case AP_RESPONSE_REQ_FAC_NOT_INST:
91                 return -EINVAL;
92         default:        /* Device is gone. */
93                 return -ENODEV;
94         }
95 }
96 EXPORT_SYMBOL(ap_send);
97
98 int ap_recv(ap_qid_t qid, unsigned long long *psmid, void *msg, size_t length)
99 {
100         struct ap_queue_status status;
101
102         if (msg == NULL)
103                 return -EINVAL;
104         status = ap_dqap(qid, psmid, msg, length);
105         switch (status.response_code) {
106         case AP_RESPONSE_NORMAL:
107                 return 0;
108         case AP_RESPONSE_NO_PENDING_REPLY:
109                 if (status.queue_empty)
110                         return -ENOENT;
111                 return -EBUSY;
112         case AP_RESPONSE_RESET_IN_PROGRESS:
113                 return -EBUSY;
114         default:
115                 return -ENODEV;
116         }
117 }
118 EXPORT_SYMBOL(ap_recv);
119
120 /* State machine definitions and helpers */
121
122 static enum ap_wait ap_sm_nop(struct ap_queue *aq)
123 {
124         return AP_WAIT_NONE;
125 }
126
127 /**
128  * ap_sm_recv(): Receive pending reply messages from an AP queue but do
129  *      not change the state of the device.
130  * @aq: pointer to the AP queue
131  *
132  * Returns AP_WAIT_NONE, AP_WAIT_AGAIN, or AP_WAIT_INTERRUPT
133  */
134 static struct ap_queue_status ap_sm_recv(struct ap_queue *aq)
135 {
136         struct ap_queue_status status;
137         struct ap_message *ap_msg;
138
139         status = ap_dqap(aq->qid, &aq->reply->psmid,
140                          aq->reply->message, aq->reply->length);
141         switch (status.response_code) {
142         case AP_RESPONSE_NORMAL:
143                 aq->queue_count--;
144                 if (aq->queue_count > 0)
145                         mod_timer(&aq->timeout,
146                                   jiffies + aq->request_timeout);
147                 list_for_each_entry(ap_msg, &aq->pendingq, list) {
148                         if (ap_msg->psmid != aq->reply->psmid)
149                                 continue;
150                         list_del_init(&ap_msg->list);
151                         aq->pendingq_count--;
152                         ap_msg->receive(aq, ap_msg, aq->reply);
153                         break;
154                 }
155         case AP_RESPONSE_NO_PENDING_REPLY:
156                 if (!status.queue_empty || aq->queue_count <= 0)
157                         break;
158                 /* The card shouldn't forget requests but who knows. */
159                 aq->queue_count = 0;
160                 list_splice_init(&aq->pendingq, &aq->requestq);
161                 aq->requestq_count += aq->pendingq_count;
162                 aq->pendingq_count = 0;
163                 break;
164         default:
165                 break;
166         }
167         return status;
168 }
169
170 /**
171  * ap_sm_read(): Receive pending reply messages from an AP queue.
172  * @aq: pointer to the AP queue
173  *
174  * Returns AP_WAIT_NONE, AP_WAIT_AGAIN, or AP_WAIT_INTERRUPT
175  */
176 static enum ap_wait ap_sm_read(struct ap_queue *aq)
177 {
178         struct ap_queue_status status;
179
180         if (!aq->reply)
181                 return AP_WAIT_NONE;
182         status = ap_sm_recv(aq);
183         switch (status.response_code) {
184         case AP_RESPONSE_NORMAL:
185                 if (aq->queue_count > 0) {
186                         aq->state = AP_STATE_WORKING;
187                         return AP_WAIT_AGAIN;
188                 }
189                 aq->state = AP_STATE_IDLE;
190                 return AP_WAIT_NONE;
191         case AP_RESPONSE_NO_PENDING_REPLY:
192                 if (aq->queue_count > 0)
193                         return AP_WAIT_INTERRUPT;
194                 aq->state = AP_STATE_IDLE;
195                 return AP_WAIT_NONE;
196         default:
197                 aq->state = AP_STATE_BORKED;
198                 return AP_WAIT_NONE;
199         }
200 }
201
202 /**
203  * ap_sm_suspend_read(): Receive pending reply messages from an AP queue
204  * without changing the device state in between. In suspend mode we don't
205  * allow sending new requests, therefore just fetch pending replies.
206  * @aq: pointer to the AP queue
207  *
208  * Returns AP_WAIT_NONE or AP_WAIT_AGAIN
209  */
210 static enum ap_wait ap_sm_suspend_read(struct ap_queue *aq)
211 {
212         struct ap_queue_status status;
213
214         if (!aq->reply)
215                 return AP_WAIT_NONE;
216         status = ap_sm_recv(aq);
217         switch (status.response_code) {
218         case AP_RESPONSE_NORMAL:
219                 if (aq->queue_count > 0)
220                         return AP_WAIT_AGAIN;
221                 /* fall through */
222         default:
223                 return AP_WAIT_NONE;
224         }
225 }
226
227 /**
228  * ap_sm_write(): Send messages from the request queue to an AP queue.
229  * @aq: pointer to the AP queue
230  *
231  * Returns AP_WAIT_NONE, AP_WAIT_AGAIN, or AP_WAIT_INTERRUPT
232  */
233 static enum ap_wait ap_sm_write(struct ap_queue *aq)
234 {
235         struct ap_queue_status status;
236         struct ap_message *ap_msg;
237
238         if (aq->requestq_count <= 0)
239                 return AP_WAIT_NONE;
240         /* Start the next request on the queue. */
241         ap_msg = list_entry(aq->requestq.next, struct ap_message, list);
242         status = __ap_send(aq->qid, ap_msg->psmid,
243                            ap_msg->message, ap_msg->length, ap_msg->special);
244         switch (status.response_code) {
245         case AP_RESPONSE_NORMAL:
246                 aq->queue_count++;
247                 if (aq->queue_count == 1)
248                         mod_timer(&aq->timeout, jiffies + aq->request_timeout);
249                 list_move_tail(&ap_msg->list, &aq->pendingq);
250                 aq->requestq_count--;
251                 aq->pendingq_count++;
252                 if (aq->queue_count < aq->card->queue_depth) {
253                         aq->state = AP_STATE_WORKING;
254                         return AP_WAIT_AGAIN;
255                 }
256                 /* fall through */
257         case AP_RESPONSE_Q_FULL:
258                 aq->state = AP_STATE_QUEUE_FULL;
259                 return AP_WAIT_INTERRUPT;
260         case AP_RESPONSE_RESET_IN_PROGRESS:
261                 aq->state = AP_STATE_RESET_WAIT;
262                 return AP_WAIT_TIMEOUT;
263         case AP_RESPONSE_MESSAGE_TOO_BIG:
264         case AP_RESPONSE_REQ_FAC_NOT_INST:
265                 list_del_init(&ap_msg->list);
266                 aq->requestq_count--;
267                 ap_msg->rc = -EINVAL;
268                 ap_msg->receive(aq, ap_msg, NULL);
269                 return AP_WAIT_AGAIN;
270         default:
271                 aq->state = AP_STATE_BORKED;
272                 return AP_WAIT_NONE;
273         }
274 }
275
276 /**
277  * ap_sm_read_write(): Send and receive messages to/from an AP queue.
278  * @aq: pointer to the AP queue
279  *
280  * Returns AP_WAIT_NONE, AP_WAIT_AGAIN, or AP_WAIT_INTERRUPT
281  */
282 static enum ap_wait ap_sm_read_write(struct ap_queue *aq)
283 {
284         return min(ap_sm_read(aq), ap_sm_write(aq));
285 }
286
287 /**
288  * ap_sm_reset(): Reset an AP queue.
289  * @qid: The AP queue number
290  *
291  * Submit the Reset command to an AP queue.
292  */
293 static enum ap_wait ap_sm_reset(struct ap_queue *aq)
294 {
295         struct ap_queue_status status;
296
297         status = ap_rapq(aq->qid);
298         switch (status.response_code) {
299         case AP_RESPONSE_NORMAL:
300         case AP_RESPONSE_RESET_IN_PROGRESS:
301                 aq->state = AP_STATE_RESET_WAIT;
302                 aq->interrupt = AP_INTR_DISABLED;
303                 return AP_WAIT_TIMEOUT;
304         case AP_RESPONSE_BUSY:
305                 return AP_WAIT_TIMEOUT;
306         case AP_RESPONSE_Q_NOT_AVAIL:
307         case AP_RESPONSE_DECONFIGURED:
308         case AP_RESPONSE_CHECKSTOPPED:
309         default:
310                 aq->state = AP_STATE_BORKED;
311                 return AP_WAIT_NONE;
312         }
313 }
314
315 /**
316  * ap_sm_reset_wait(): Test queue for completion of the reset operation
317  * @aq: pointer to the AP queue
318  *
319  * Returns AP_POLL_IMMEDIATELY, AP_POLL_AFTER_TIMEROUT or 0.
320  */
321 static enum ap_wait ap_sm_reset_wait(struct ap_queue *aq)
322 {
323         struct ap_queue_status status;
324         void *lsi_ptr;
325
326         if (aq->queue_count > 0 && aq->reply)
327                 /* Try to read a completed message and get the status */
328                 status = ap_sm_recv(aq);
329         else
330                 /* Get the status with TAPQ */
331                 status = ap_tapq(aq->qid, NULL);
332
333         switch (status.response_code) {
334         case AP_RESPONSE_NORMAL:
335                 lsi_ptr = ap_airq_ptr();
336                 if (lsi_ptr && ap_queue_enable_interruption(aq, lsi_ptr) == 0)
337                         aq->state = AP_STATE_SETIRQ_WAIT;
338                 else
339                         aq->state = (aq->queue_count > 0) ?
340                                 AP_STATE_WORKING : AP_STATE_IDLE;
341                 return AP_WAIT_AGAIN;
342         case AP_RESPONSE_BUSY:
343         case AP_RESPONSE_RESET_IN_PROGRESS:
344                 return AP_WAIT_TIMEOUT;
345         case AP_RESPONSE_Q_NOT_AVAIL:
346         case AP_RESPONSE_DECONFIGURED:
347         case AP_RESPONSE_CHECKSTOPPED:
348         default:
349                 aq->state = AP_STATE_BORKED;
350                 return AP_WAIT_NONE;
351         }
352 }
353
354 /**
355  * ap_sm_setirq_wait(): Test queue for completion of the irq enablement
356  * @aq: pointer to the AP queue
357  *
358  * Returns AP_POLL_IMMEDIATELY, AP_POLL_AFTER_TIMEROUT or 0.
359  */
360 static enum ap_wait ap_sm_setirq_wait(struct ap_queue *aq)
361 {
362         struct ap_queue_status status;
363
364         if (aq->queue_count > 0 && aq->reply)
365                 /* Try to read a completed message and get the status */
366                 status = ap_sm_recv(aq);
367         else
368                 /* Get the status with TAPQ */
369                 status = ap_tapq(aq->qid, NULL);
370
371         if (status.irq_enabled == 1) {
372                 /* Irqs are now enabled */
373                 aq->interrupt = AP_INTR_ENABLED;
374                 aq->state = (aq->queue_count > 0) ?
375                         AP_STATE_WORKING : AP_STATE_IDLE;
376         }
377
378         switch (status.response_code) {
379         case AP_RESPONSE_NORMAL:
380                 if (aq->queue_count > 0)
381                         return AP_WAIT_AGAIN;
382                 /* fallthrough */
383         case AP_RESPONSE_NO_PENDING_REPLY:
384                 return AP_WAIT_TIMEOUT;
385         default:
386                 aq->state = AP_STATE_BORKED;
387                 return AP_WAIT_NONE;
388         }
389 }
390
391 /*
392  * AP state machine jump table
393  */
394 static ap_func_t *ap_jumptable[NR_AP_STATES][NR_AP_EVENTS] = {
395         [AP_STATE_RESET_START] = {
396                 [AP_EVENT_POLL] = ap_sm_reset,
397                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
398         },
399         [AP_STATE_RESET_WAIT] = {
400                 [AP_EVENT_POLL] = ap_sm_reset_wait,
401                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
402         },
403         [AP_STATE_SETIRQ_WAIT] = {
404                 [AP_EVENT_POLL] = ap_sm_setirq_wait,
405                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
406         },
407         [AP_STATE_IDLE] = {
408                 [AP_EVENT_POLL] = ap_sm_write,
409                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
410         },
411         [AP_STATE_WORKING] = {
412                 [AP_EVENT_POLL] = ap_sm_read_write,
413                 [AP_EVENT_TIMEOUT] = ap_sm_reset,
414         },
415         [AP_STATE_QUEUE_FULL] = {
416                 [AP_EVENT_POLL] = ap_sm_read,
417                 [AP_EVENT_TIMEOUT] = ap_sm_reset,
418         },
419         [AP_STATE_SUSPEND_WAIT] = {
420                 [AP_EVENT_POLL] = ap_sm_suspend_read,
421                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
422         },
423         [AP_STATE_UNBOUND] = {
424                 [AP_EVENT_POLL] = ap_sm_nop,
425                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
426         },
427         [AP_STATE_BORKED] = {
428                 [AP_EVENT_POLL] = ap_sm_nop,
429                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
430         },
431 };
432
433 enum ap_wait ap_sm_event(struct ap_queue *aq, enum ap_event event)
434 {
435         return ap_jumptable[aq->state][event](aq);
436 }
437
438 enum ap_wait ap_sm_event_loop(struct ap_queue *aq, enum ap_event event)
439 {
440         enum ap_wait wait;
441
442         while ((wait = ap_sm_event(aq, event)) == AP_WAIT_AGAIN)
443                 ;
444         return wait;
445 }
446
447 /*
448  * Power management for queue devices
449  */
450 void ap_queue_suspend(struct ap_device *ap_dev)
451 {
452         struct ap_queue *aq = to_ap_queue(&ap_dev->device);
453
454         /* Poll on the device until all requests are finished. */
455         spin_lock_bh(&aq->lock);
456         aq->state = AP_STATE_SUSPEND_WAIT;
457         while (ap_sm_event(aq, AP_EVENT_POLL) != AP_WAIT_NONE)
458                 ;
459         aq->state = AP_STATE_BORKED;
460         spin_unlock_bh(&aq->lock);
461 }
462 EXPORT_SYMBOL(ap_queue_suspend);
463
464 void ap_queue_resume(struct ap_device *ap_dev)
465 {
466 }
467 EXPORT_SYMBOL(ap_queue_resume);
468
469 /*
470  * AP queue related attributes.
471  */
472 static ssize_t request_count_show(struct device *dev,
473                                   struct device_attribute *attr,
474                                   char *buf)
475 {
476         struct ap_queue *aq = to_ap_queue(dev);
477         unsigned int req_cnt;
478
479         spin_lock_bh(&aq->lock);
480         req_cnt = aq->total_request_count;
481         spin_unlock_bh(&aq->lock);
482         return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
483 }
484
485 static ssize_t request_count_store(struct device *dev,
486                                    struct device_attribute *attr,
487                                    const char *buf, size_t count)
488 {
489         struct ap_queue *aq = to_ap_queue(dev);
490
491         spin_lock_bh(&aq->lock);
492         aq->total_request_count = 0;
493         spin_unlock_bh(&aq->lock);
494
495         return count;
496 }
497
498 static DEVICE_ATTR_RW(request_count);
499
500 static ssize_t requestq_count_show(struct device *dev,
501                                    struct device_attribute *attr, char *buf)
502 {
503         struct ap_queue *aq = to_ap_queue(dev);
504         unsigned int reqq_cnt = 0;
505
506         spin_lock_bh(&aq->lock);
507         reqq_cnt = aq->requestq_count;
508         spin_unlock_bh(&aq->lock);
509         return snprintf(buf, PAGE_SIZE, "%d\n", reqq_cnt);
510 }
511
512 static DEVICE_ATTR_RO(requestq_count);
513
514 static ssize_t pendingq_count_show(struct device *dev,
515                                    struct device_attribute *attr, char *buf)
516 {
517         struct ap_queue *aq = to_ap_queue(dev);
518         unsigned int penq_cnt = 0;
519
520         spin_lock_bh(&aq->lock);
521         penq_cnt = aq->pendingq_count;
522         spin_unlock_bh(&aq->lock);
523         return snprintf(buf, PAGE_SIZE, "%d\n", penq_cnt);
524 }
525
526 static DEVICE_ATTR_RO(pendingq_count);
527
528 static ssize_t reset_show(struct device *dev,
529                           struct device_attribute *attr, char *buf)
530 {
531         struct ap_queue *aq = to_ap_queue(dev);
532         int rc = 0;
533
534         spin_lock_bh(&aq->lock);
535         switch (aq->state) {
536         case AP_STATE_RESET_START:
537         case AP_STATE_RESET_WAIT:
538                 rc = snprintf(buf, PAGE_SIZE, "Reset in progress.\n");
539                 break;
540         case AP_STATE_WORKING:
541         case AP_STATE_QUEUE_FULL:
542                 rc = snprintf(buf, PAGE_SIZE, "Reset Timer armed.\n");
543                 break;
544         default:
545                 rc = snprintf(buf, PAGE_SIZE, "No Reset Timer set.\n");
546         }
547         spin_unlock_bh(&aq->lock);
548         return rc;
549 }
550
551 static ssize_t reset_store(struct device *dev,
552                            struct device_attribute *attr,
553                            const char *buf, size_t count)
554 {
555         struct ap_queue *aq = to_ap_queue(dev);
556
557         spin_lock_bh(&aq->lock);
558         __ap_flush_queue(aq);
559         aq->state = AP_STATE_RESET_START;
560         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
561         spin_unlock_bh(&aq->lock);
562
563         AP_DBF(DBF_INFO, "reset queue=%02x.%04x triggered by user\n",
564                AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
565
566         return count;
567 }
568
569 static DEVICE_ATTR_RW(reset);
570
571 static ssize_t interrupt_show(struct device *dev,
572                               struct device_attribute *attr, char *buf)
573 {
574         struct ap_queue *aq = to_ap_queue(dev);
575         int rc = 0;
576
577         spin_lock_bh(&aq->lock);
578         if (aq->state == AP_STATE_SETIRQ_WAIT)
579                 rc = snprintf(buf, PAGE_SIZE, "Enable Interrupt pending.\n");
580         else if (aq->interrupt == AP_INTR_ENABLED)
581                 rc = snprintf(buf, PAGE_SIZE, "Interrupts enabled.\n");
582         else
583                 rc = snprintf(buf, PAGE_SIZE, "Interrupts disabled.\n");
584         spin_unlock_bh(&aq->lock);
585         return rc;
586 }
587
588 static DEVICE_ATTR_RO(interrupt);
589
590 static struct attribute *ap_queue_dev_attrs[] = {
591         &dev_attr_request_count.attr,
592         &dev_attr_requestq_count.attr,
593         &dev_attr_pendingq_count.attr,
594         &dev_attr_reset.attr,
595         &dev_attr_interrupt.attr,
596         NULL
597 };
598
599 static struct attribute_group ap_queue_dev_attr_group = {
600         .attrs = ap_queue_dev_attrs
601 };
602
603 static const struct attribute_group *ap_queue_dev_attr_groups[] = {
604         &ap_queue_dev_attr_group,
605         NULL
606 };
607
608 static struct device_type ap_queue_type = {
609         .name = "ap_queue",
610         .groups = ap_queue_dev_attr_groups,
611 };
612
613 static void ap_queue_device_release(struct device *dev)
614 {
615         struct ap_queue *aq = to_ap_queue(dev);
616
617         if (!list_empty(&aq->list)) {
618                 spin_lock_bh(&ap_list_lock);
619                 list_del_init(&aq->list);
620                 spin_unlock_bh(&ap_list_lock);
621         }
622         kfree(aq);
623 }
624
625 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
626 {
627         struct ap_queue *aq;
628
629         aq = kzalloc(sizeof(*aq), GFP_KERNEL);
630         if (!aq)
631                 return NULL;
632         aq->ap_dev.device.release = ap_queue_device_release;
633         aq->ap_dev.device.type = &ap_queue_type;
634         aq->ap_dev.device_type = device_type;
635         aq->qid = qid;
636         aq->state = AP_STATE_RESET_START;
637         aq->interrupt = AP_INTR_DISABLED;
638         spin_lock_init(&aq->lock);
639         INIT_LIST_HEAD(&aq->list);
640         INIT_LIST_HEAD(&aq->pendingq);
641         INIT_LIST_HEAD(&aq->requestq);
642         timer_setup(&aq->timeout, ap_request_timeout, 0);
643
644         return aq;
645 }
646
647 void ap_queue_init_reply(struct ap_queue *aq, struct ap_message *reply)
648 {
649         aq->reply = reply;
650
651         spin_lock_bh(&aq->lock);
652         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
653         spin_unlock_bh(&aq->lock);
654 }
655 EXPORT_SYMBOL(ap_queue_init_reply);
656
657 /**
658  * ap_queue_message(): Queue a request to an AP device.
659  * @aq: The AP device to queue the message to
660  * @ap_msg: The message that is to be added
661  */
662 void ap_queue_message(struct ap_queue *aq, struct ap_message *ap_msg)
663 {
664         /* For asynchronous message handling a valid receive-callback
665          * is required.
666          */
667         BUG_ON(!ap_msg->receive);
668
669         spin_lock_bh(&aq->lock);
670         /* Queue the message. */
671         list_add_tail(&ap_msg->list, &aq->requestq);
672         aq->requestq_count++;
673         aq->total_request_count++;
674         atomic_inc(&aq->card->total_request_count);
675         /* Send/receive as many request from the queue as possible. */
676         ap_wait(ap_sm_event_loop(aq, AP_EVENT_POLL));
677         spin_unlock_bh(&aq->lock);
678 }
679 EXPORT_SYMBOL(ap_queue_message);
680
681 /**
682  * ap_cancel_message(): Cancel a crypto request.
683  * @aq: The AP device that has the message queued
684  * @ap_msg: The message that is to be removed
685  *
686  * Cancel a crypto request. This is done by removing the request
687  * from the device pending or request queue. Note that the
688  * request stays on the AP queue. When it finishes the message
689  * reply will be discarded because the psmid can't be found.
690  */
691 void ap_cancel_message(struct ap_queue *aq, struct ap_message *ap_msg)
692 {
693         struct ap_message *tmp;
694
695         spin_lock_bh(&aq->lock);
696         if (!list_empty(&ap_msg->list)) {
697                 list_for_each_entry(tmp, &aq->pendingq, list)
698                         if (tmp->psmid == ap_msg->psmid) {
699                                 aq->pendingq_count--;
700                                 goto found;
701                         }
702                 aq->requestq_count--;
703 found:
704                 list_del_init(&ap_msg->list);
705         }
706         spin_unlock_bh(&aq->lock);
707 }
708 EXPORT_SYMBOL(ap_cancel_message);
709
710 /**
711  * __ap_flush_queue(): Flush requests.
712  * @aq: Pointer to the AP queue
713  *
714  * Flush all requests from the request/pending queue of an AP device.
715  */
716 static void __ap_flush_queue(struct ap_queue *aq)
717 {
718         struct ap_message *ap_msg, *next;
719
720         list_for_each_entry_safe(ap_msg, next, &aq->pendingq, list) {
721                 list_del_init(&ap_msg->list);
722                 aq->pendingq_count--;
723                 ap_msg->rc = -EAGAIN;
724                 ap_msg->receive(aq, ap_msg, NULL);
725         }
726         list_for_each_entry_safe(ap_msg, next, &aq->requestq, list) {
727                 list_del_init(&ap_msg->list);
728                 aq->requestq_count--;
729                 ap_msg->rc = -EAGAIN;
730                 ap_msg->receive(aq, ap_msg, NULL);
731         }
732         aq->queue_count = 0;
733 }
734
735 void ap_flush_queue(struct ap_queue *aq)
736 {
737         spin_lock_bh(&aq->lock);
738         __ap_flush_queue(aq);
739         spin_unlock_bh(&aq->lock);
740 }
741 EXPORT_SYMBOL(ap_flush_queue);
742
743 void ap_queue_remove(struct ap_queue *aq)
744 {
745         ap_flush_queue(aq);
746         del_timer_sync(&aq->timeout);
747
748         /* reset with zero, also clears irq registration */
749         spin_lock_bh(&aq->lock);
750         ap_zapq(aq->qid);
751         aq->state = AP_STATE_UNBOUND;
752         spin_unlock_bh(&aq->lock);
753 }
754 EXPORT_SYMBOL(ap_queue_remove);
755
756 void ap_queue_reinit_state(struct ap_queue *aq)
757 {
758         spin_lock_bh(&aq->lock);
759         aq->state = AP_STATE_RESET_START;
760         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
761         spin_unlock_bh(&aq->lock);
762 }
763 EXPORT_SYMBOL(ap_queue_reinit_state);