Linux-2.6.12-rc2

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!

1 files changed, 2053 insertions, 0 deletions

diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
new file mode 100644
index 000000000000..101f0cc33d10
--- /dev/null
+++ b/drivers/atm/firestream.c
@@ -0,0 +1,2053 @@
+
+/* drivers/atm/firestream.c - FireStream 155 (MB86697) and
+ *                            FireStream  50 (MB86695) device driver 
+ */
+ 
+/* Written & (C) 2000 by R.E.Wolff@BitWizard.nl 
+ * Copied snippets from zatm.c by Werner Almesberger, EPFL LRC/ICA 
+ * and ambassador.c Copyright (C) 1995-1999  Madge Networks Ltd 
+ */
+
+/*
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+  The GNU GPL is contained in /usr/doc/copyright/GPL on a Debian
+  system and in the file COPYING in the Linux kernel source.
+*/
+
+
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/pci.h>
+#include <linux/errno.h>
+#include <linux/atm.h>
+#include <linux/atmdev.h>
+#include <linux/sonet.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/delay.h>
+#include <linux/ioport.h> /* for request_region */
+#include <linux/uio.h>
+#include <linux/init.h>
+#include <linux/capability.h>
+#include <linux/bitops.h>
+#include <asm/byteorder.h>
+#include <asm/system.h>
+#include <asm/string.h>
+#include <asm/io.h>
+#include <asm/atomic.h>
+#include <asm/uaccess.h>
+#include <linux/wait.h>
+
+#include "firestream.h"
+
+static int loopback = 0;
+static int num=0x5a;
+
+/* According to measurements (but they look suspicious to me!) done in
+ * '97, 37% of the packets are one cell in size. So it pays to have
+ * buffers allocated at that size. A large jump in percentage of
+ * packets occurs at packets around 536 bytes in length. So it also
+ * pays to have those pre-allocated. Unfortunately, we can't fully
+ * take advantage of this as the majority of the packets is likely to
+ * be TCP/IP (As where obviously the measurement comes from) There the
+ * link would be opened with say a 1500 byte MTU, and we can't handle
+ * smaller buffers more efficiently than the larger ones. -- REW
+ */
+
+/* Due to the way Linux memory management works, specifying "576" as
+ * an allocation size here isn't going to help. They are allocated
+ * from 1024-byte regions anyway. With the size of the sk_buffs (quite
+ * large), it doesn't pay to allocate the smallest size (64) -- REW */
+
+/* This is all guesswork. Hard numbers to back this up or disprove this, 
+ * are appreciated. -- REW */
+
+/* The last entry should be about 64k. However, the "buffer size" is
+ * passed to the chip in a 16 bit field. I don't know how "65536"
+ * would be interpreted. -- REW */
+
+#define NP FS_NR_FREE_POOLS
+static int rx_buf_sizes[NP]  = {128,  256,  512, 1024, 2048, 4096, 16384, 65520};
+/* log2:                 7     8     9    10    11    12    14     16 */
+
+#if 0
+static int rx_pool_sizes[NP] = {1024, 1024, 512, 256,  128,  64,   32,    32};
+#else
+/* debug */
+static int rx_pool_sizes[NP] = {128,  128,  128, 64,   64,   64,   32,    32};
+#endif
+/* log2:                 10    10    9    8     7     6     5      5  */
+/* sumlog2:              17    18    18   18    18    18    19     21 */
+/* mem allocated:        128k  256k  256k 256k  256k  256k  512k   2M */
+/* tot mem: almost 4M */
+
+/* NP is shorter, so that it fits on a single line. */
+#undef NP
+
+
+/* Small hardware gotcha:
+
+   The FS50 CAM (VP/VC match registers) always take the lowest channel
+   number that matches. This is not a problem.
+
+   However, they also ignore whether the channel is enabled or
+   not. This means that if you allocate channel 0 to 1.2 and then
+   channel 1 to 0.0, then disabeling channel 0 and writing 0 to the
+   match channel for channel 0 will "steal" the traffic from channel
+   1, even if you correctly disable channel 0.
+
+   Workaround: 
+
+   - When disabling channels, write an invalid VP/VC value to the
+   match register. (We use 0xffffffff, which in the worst case 
+   matches VP/VC = <maxVP>/<maxVC>, but I expect it not to match
+   anything as some "when not in use, program to 0" bits are now
+   programmed to 1...)
+
+   - Don't initialize the match registers to 0, as 0.0 is a valid
+   channel.
+*/
+
+
+/* Optimization hints and tips.
+
+   The FireStream chips are very capable of reducing the amount of
+   "interrupt-traffic" for the CPU. This driver requests an interrupt on EVERY
+   action. You could try to minimize this a bit. 
+
+   Besides that, the userspace->kernel copy and the PCI bus are the
+   performance limiting issues for this driver.
+
+   You could queue up a bunch of outgoing packets without telling the
+   FireStream. I'm not sure that's going to win you much though. The
+   Linux layer won't tell us in advance when it's not going to give us
+   any more packets in a while. So this is tricky to implement right without
+   introducing extra delays. 
+  
+   -- REW
+ */
+
+
+
+
+/* The strings that define what the RX queue entry is all about. */
+/* Fujitsu: Please tell me which ones can have a pointer to a 
+   freepool descriptor! */
+static char *res_strings[] = {
+	"RX OK: streaming not EOP", 
+	"RX OK: streaming EOP", 
+	"RX OK: Single buffer packet", 
+	"RX OK: packet mode", 
+	"RX OK: F4 OAM (end to end)", 
+	"RX OK: F4 OAM (Segment)", 
+	"RX OK: F5 OAM (end to end)", 
+	"RX OK: F5 OAM (Segment)", 
+	"RX OK: RM cell", 
+	"RX OK: TRANSP cell", 
+	"RX OK: TRANSPC cell", 
+	"Unmatched cell", 
+	"reserved 12", 
+	"reserved 13", 
+	"reserved 14", 
+	"Unrecognized cell", 
+	"reserved 16", 
+	"reassemby abort: AAL5 abort", 
+	"packet purged", 
+	"packet ageing timeout", 
+	"channel ageing timeout", 
+	"calculated lenght error", 
+	"programmed lenght limit error", 
+	"aal5 crc32 error", 
+	"oam transp or transpc crc10 error", 
+	"reserved 25", 
+	"reserved 26", 
+	"reserved 27", 
+	"reserved 28", 
+	"reserved 29", 
+	"reserved 30", 
+	"reassembly abort: no buffers", 
+	"receive buffer overflow", 
+	"change in GFC", 
+	"receive buffer full", 
+	"low priority discard - no receive descriptor", 
+	"low priority discard - missing end of packet", 
+	"reserved 41", 
+	"reserved 42", 
+	"reserved 43", 
+	"reserved 44", 
+	"reserved 45", 
+	"reserved 46", 
+	"reserved 47", 
+	"reserved 48", 
+	"reserved 49", 
+	"reserved 50", 
+	"reserved 51", 
+	"reserved 52", 
+	"reserved 53", 
+	"reserved 54", 
+	"reserved 55", 
+	"reserved 56", 
+	"reserved 57", 
+	"reserved 58", 
+	"reserved 59", 
+	"reserved 60", 
+	"reserved 61", 
+	"reserved 62", 
+	"reserved 63", 
+};  
+
+static char *irq_bitname[] = {
+	"LPCO",
+	"DPCO",
+	"RBRQ0_W",
+	"RBRQ1_W",
+	"RBRQ2_W",
+	"RBRQ3_W",
+	"RBRQ0_NF",
+	"RBRQ1_NF",
+	"RBRQ2_NF",
+	"RBRQ3_NF",
+	"BFP_SC",
+	"INIT",
+	"INIT_ERR",
+	"USCEO",
+	"UPEC0",
+	"VPFCO",
+	"CRCCO",
+	"HECO",
+	"TBRQ_W",
+	"TBRQ_NF",
+	"CTPQ_E",
+	"GFC_C0",
+	"PCI_FTL",
+	"CSQ_W",
+	"CSQ_NF",
+	"EXT_INT",
+	"RXDMA_S"
+};
+
+
+#define PHY_EOF -1
+#define PHY_CLEARALL -2
+
+struct reginit_item {
+	int reg, val;
+};
+
+
+static struct reginit_item PHY_NTC_INIT[] __devinitdata = {
+	{ PHY_CLEARALL, 0x40 }, 
+	{ 0x12,  0x0001 },
+	{ 0x13,  0x7605 },
+	{ 0x1A,  0x0001 },
+	{ 0x1B,  0x0005 },
+	{ 0x38,  0x0003 },
+	{ 0x39,  0x0006 },   /* changed here to make loopback */
+	{ 0x01,  0x5262 },
+	{ 0x15,  0x0213 },
+	{ 0x00,  0x0003 },
+	{ PHY_EOF, 0},    /* -1 signals end of list */
+};
+
+
+/* Safetyfeature: If the card interrupts more than this number of times
+   in a jiffy (1/100th of a second) then we just disable the interrupt and
+   print a message. This prevents the system from hanging. 
+
+   150000 packets per second is close to the limit a PC is going to have
+   anyway. We therefore have to disable this for production. -- REW */
+#undef IRQ_RATE_LIMIT // 100
+
+/* Interrupts work now. Unlike serial cards, ATM cards don't work all
+   that great without interrupts. -- REW */
+#undef FS_POLL_FREQ // 100
+
+/* 
+   This driver can spew a whole lot of debugging output at you. If you
+   need maximum performance, you should disable the DEBUG define. To
+   aid in debugging in the field, I'm leaving the compile-time debug
+   features enabled, and disable them "runtime". That allows me to
+   instruct people with problems to enable debugging without requiring
+   them to recompile... -- REW
+*/
+#define DEBUG
+
+#ifdef DEBUG
+#define fs_dprintk(f, str...) if (fs_debug & f) printk (str)
+#else
+#define fs_dprintk(f, str...) /* nothing */
+#endif
+
+
+static int fs_keystream = 0;
+
+#ifdef DEBUG
+/* I didn't forget to set this to zero before shipping. Hit me with a stick 
+   if you get this with the debug default not set to zero again. -- REW */
+static int fs_debug = 0;
+#else
+#define fs_debug 0
+#endif
+
+#ifdef MODULE
+#ifdef DEBUG 
+module_param(fs_debug, int, 0644);
+#endif
+module_param(loopback, int, 0);
+module_param(num, int, 0);
+module_param(fs_keystream, int, 0);
+/* XXX Add rx_buf_sizes, and rx_pool_sizes As per request Amar. -- REW */
+#endif
+
+
+#define FS_DEBUG_FLOW    0x00000001
+#define FS_DEBUG_OPEN    0x00000002
+#define FS_DEBUG_QUEUE   0x00000004
+#define FS_DEBUG_IRQ     0x00000008
+#define FS_DEBUG_INIT    0x00000010
+#define FS_DEBUG_SEND    0x00000020
+#define FS_DEBUG_PHY     0x00000040
+#define FS_DEBUG_CLEANUP 0x00000080
+#define FS_DEBUG_QOS     0x00000100
+#define FS_DEBUG_TXQ     0x00000200
+#define FS_DEBUG_ALLOC   0x00000400
+#define FS_DEBUG_TXMEM   0x00000800
+#define FS_DEBUG_QSIZE   0x00001000
+
+
+#define func_enter() fs_dprintk (FS_DEBUG_FLOW, "fs: enter %s\n", __FUNCTION__)
+#define func_exit()  fs_dprintk (FS_DEBUG_FLOW, "fs: exit  %s\n", __FUNCTION__)
+
+
+static struct fs_dev *fs_boards = NULL;
+
+#ifdef DEBUG
+
+static void my_hd (void *addr, int len)
+{
+	int j, ch;
+	unsigned char *ptr = addr;
+
+	while (len > 0) {
+		printk ("%p ", ptr);
+		for (j=0;j < ((len < 16)?len:16);j++) {
+			printk ("%02x %s", ptr[j], (j==7)?" ":"");
+		}
+		for (  ;j < 16;j++) {
+			printk ("   %s", (j==7)?" ":"");
+		}
+		for (j=0;j < ((len < 16)?len:16);j++) {
+			ch = ptr[j];
+			printk ("%c", (ch < 0x20)?'.':((ch > 0x7f)?'.':ch));
+		}
+		printk ("\n");
+		ptr += 16;
+		len -= 16;
+	}
+}
+#else /* DEBUG */
+static void my_hd (void *addr, int len){}
+#endif /* DEBUG */
+
+/********** free an skb (as per ATM device driver documentation) **********/
+
+/* Hmm. If this is ATM specific, why isn't there an ATM routine for this?
+ * I copied it over from the ambassador driver. -- REW */
+
+static inline void fs_kfree_skb (struct sk_buff * skb) 
+{
+	if (ATM_SKB(skb)->vcc->pop)
+		ATM_SKB(skb)->vcc->pop (ATM_SKB(skb)->vcc, skb);
+	else
+		dev_kfree_skb_any (skb);
+}
+
+
+
+
+/* It seems the ATM forum recommends this horribly complicated 16bit
+ * floating point format. Turns out the Ambassador uses the exact same
+ * encoding. I just copied it over. If Mitch agrees, I'll move it over
+ * to the atm_misc file or something like that. (and remove it from 
+ * here and the ambassador driver) -- REW
+ */
+
+/* The good thing about this format is that it is monotonic. So, 
+   a conversion routine need not be very complicated. To be able to
+   round "nearest" we need to take along a few extra bits. Lets
+   put these after 16 bits, so that we can just return the top 16
+   bits of the 32bit number as the result:
+
+   int mr (unsigned int rate, int r) 
+     {
+     int e = 16+9;
+     static int round[4]={0, 0, 0xffff, 0x8000};
+     if (!rate) return 0;
+     while (rate & 0xfc000000) {
+       rate >>= 1;
+       e++;
+     }
+     while (! (rate & 0xfe000000)) {
+       rate <<= 1;
+       e--;
+     }
+
+// Now the mantissa is in positions bit 16-25. Excepf for the "hidden 1" that's in bit 26.
+     rate &= ~0x02000000;
+// Next add in the exponent
+     rate |= e << (16+9);
+// And perform the rounding:
+     return (rate + round[r]) >> 16;
+   }
+
+   14 lines-of-code. Compare that with the 120 that the Ambassador
+   guys needed. (would be 8 lines shorter if I'd try to really reduce
+   the number of lines:
+
+   int mr (unsigned int rate, int r) 
+   {
+     int e = 16+9;
+     static int round[4]={0, 0, 0xffff, 0x8000};
+     if (!rate) return 0;
+     for (;  rate & 0xfc000000 ;rate >>= 1, e++);
+     for (;!(rate & 0xfe000000);rate <<= 1, e--);
+     return ((rate & ~0x02000000) | (e << (16+9)) + round[r]) >> 16;
+   }
+
+   Exercise for the reader: Remove one more line-of-code, without
+   cheating. (Just joining two lines is cheating). (I know it's
+   possible, don't think you've beat me if you found it... If you
+   manage to lose two lines or more, keep me updated! ;-)
+
+   -- REW */
+
+
+#define ROUND_UP      1
+#define ROUND_DOWN    2
+#define ROUND_NEAREST 3
+/********** make rate (not quite as much fun as Horizon) **********/
+
+static unsigned int make_rate (unsigned int rate, int r,
+			       u16 * bits, unsigned int * actual) 
+{
+	unsigned char exp = -1; /* hush gcc */
+	unsigned int man = -1;  /* hush gcc */
+  
+	fs_dprintk (FS_DEBUG_QOS, "make_rate %u", rate);
+  
+	/* rates in cells per second, ITU format (nasty 16-bit floating-point)
+	   given 5-bit e and 9-bit m:
+	   rate = EITHER (1+m/2^9)*2^e    OR 0
+	   bits = EITHER 1<<14 | e<<9 | m OR 0
+	   (bit 15 is "reserved", bit 14 "non-zero")
+	   smallest rate is 0 (special representation)
+	   largest rate is (1+511/512)*2^31 = 4290772992 (< 2^32-1)
+	   smallest non-zero rate is (1+0/512)*2^0 = 1 (> 0)
+	   simple algorithm:
+	   find position of top bit, this gives e
+	   remove top bit and shift (rounding if feeling clever) by 9-e
+	*/
+	/* Ambassador ucode bug: please don't set bit 14! so 0 rate not
+	   representable. // This should move into the ambassador driver
+	   when properly merged. -- REW */
+  
+	if (rate > 0xffc00000U) {
+		/* larger than largest representable rate */
+    
+		if (r == ROUND_UP) {
+			return -EINVAL;
+		} else {
+			exp = 31;
+			man = 511;
+		}
+    
+	} else if (rate) {
+		/* representable rate */
+    
+		exp = 31;
+		man = rate;
+    
+		/* invariant: rate = man*2^(exp-31) */
+		while (!(man & (1<<31))) {
+			exp = exp - 1;
+			man = man<<1;
+		}
+    
+		/* man has top bit set
+		   rate = (2^31+(man-2^31))*2^(exp-31)
+		   rate = (1+(man-2^31)/2^31)*2^exp 
+		*/
+		man = man<<1;
+		man &= 0xffffffffU; /* a nop on 32-bit systems */
+		/* rate = (1+man/2^32)*2^exp
+    
+		   exp is in the range 0 to 31, man is in the range 0 to 2^32-1
+		   time to lose significance... we want m in the range 0 to 2^9-1
+		   rounding presents a minor problem... we first decide which way
+		   we are rounding (based on given rounding direction and possibly
+		   the bits of the mantissa that are to be discarded).
+		*/
+
+		switch (r) {
+		case ROUND_DOWN: {
+			/* just truncate */
+			man = man>>(32-9);
+			break;
+		}
+		case ROUND_UP: {
+			/* check all bits that we are discarding */
+			if (man & (-1>>9)) {
+				man = (man>>(32-9)) + 1;
+				if (man == (1<<9)) {
+					/* no need to check for round up outside of range */
+					man = 0;
+					exp += 1;
+				}
+			} else {
+				man = (man>>(32-9));
+			}
+			break;
+		}
+		case ROUND_NEAREST: {
+			/* check msb that we are discarding */
+			if (man & (1<<(32-9-1))) {
+				man = (man>>(32-9)) + 1;
+				if (man == (1<<9)) {
+					/* no need to check for round up outside of range */
+					man = 0;
+					exp += 1;
+				}
+			} else {
+				man = (man>>(32-9));
+			}
+			break;
+		}
+		}
+    
+	} else {
+		/* zero rate - not representable */
+    
+		if (r == ROUND_DOWN) {
+			return -EINVAL;
+		} else {
+			exp = 0;
+			man = 0;
+		}
+	}
+  
+	fs_dprintk (FS_DEBUG_QOS, "rate: man=%u, exp=%hu", man, exp);
+  
+	if (bits)
+		*bits = /* (1<<14) | */ (exp<<9) | man;
+  
+	if (actual)
+		*actual = (exp >= 9)
+			? (1 << exp) + (man << (exp-9))
+			: (1 << exp) + ((man + (1<<(9-exp-1))) >> (9-exp));
+  
+	return 0;
+}
+
+
+
+
+/* FireStream access routines */
+/* For DEEP-DOWN debugging these can be rigged to intercept accesses to
+   certain registers or to just log all accesses. */
+
+static inline void write_fs (struct fs_dev *dev, int offset, u32 val)
+{
+	writel (val, dev->base + offset);
+}
+
+
+static inline u32  read_fs (struct fs_dev *dev, int offset)
+{
+	return readl (dev->base + offset);
+}
+
+
+
+static inline struct FS_QENTRY *get_qentry (struct fs_dev *dev, struct queue *q)
+{
+	return bus_to_virt (read_fs (dev, Q_WP(q->offset)) & Q_ADDR_MASK);
+}
+
+
+static void submit_qentry (struct fs_dev *dev, struct queue *q, struct FS_QENTRY *qe)
+{
+	u32 wp;
+	struct FS_QENTRY *cqe;
+
+	/* XXX Sanity check: the write pointer can be checked to be 
+	   still the same as the value passed as qe... -- REW */
+	/*  udelay (5); */
+	while ((wp = read_fs (dev, Q_WP (q->offset))) & Q_FULL) {
+		fs_dprintk (FS_DEBUG_TXQ, "Found queue at %x full. Waiting.\n", 
+			    q->offset);
+		schedule ();
+	}
+
+	wp &= ~0xf;
+	cqe = bus_to_virt (wp);
+	if (qe != cqe) {
+		fs_dprintk (FS_DEBUG_TXQ, "q mismatch! %p %p\n", qe, cqe);
+	}
+
+	write_fs (dev, Q_WP(q->offset), Q_INCWRAP);
+
+	{
+		static int c;
+		if (!(c++ % 100))
+			{
+				int rp, wp;
+				rp =  read_fs (dev, Q_RP(q->offset));
+				wp =  read_fs (dev, Q_WP(q->offset));
+				fs_dprintk (FS_DEBUG_TXQ, "q at %d: %x-%x: %x entries.\n", 
+					    q->offset, rp, wp, wp-rp);
+			}
+	}
+}
+
+#ifdef DEBUG_EXTRA
+static struct FS_QENTRY pq[60];
+static int qp;
+
+static struct FS_BPENTRY dq[60];
+static int qd;
+static void *da[60];
+#endif 
+
+static void submit_queue (struct fs_dev *dev, struct queue *q, 
+			  u32 cmd, u32 p1, u32 p2, u32 p3)
+{
+	struct FS_QENTRY *qe;
+
+	qe = get_qentry (dev, q);
+	qe->cmd = cmd;
+	qe->p0 = p1;
+	qe->p1 = p2;
+	qe->p2 = p3;
+	submit_qentry (dev,  q, qe);
+
+#ifdef DEBUG_EXTRA
+	pq[qp].cmd = cmd;
+	pq[qp].p0 = p1;
+	pq[qp].p1 = p2;
+	pq[qp].p2 = p3;
+	qp++;
+	if (qp >= 60) qp = 0;
+#endif
+}
+
+/* Test the "other" way one day... -- REW */
+#if 1
+#define submit_command submit_queue
+#else
+
+static void submit_command (struct fs_dev *dev, struct queue *q, 
+			    u32 cmd, u32 p1, u32 p2, u32 p3)
+{
+	write_fs (dev, CMDR0, cmd);
+	write_fs (dev, CMDR1, p1);
+	write_fs (dev, CMDR2, p2);
+	write_fs (dev, CMDR3, p3);
+}
+#endif
+
+
+
+static void process_return_queue (struct fs_dev *dev, struct queue *q)
+{
+	long rq;
+	struct FS_QENTRY *qe;
+	void *tc;
+  
+	while (!((rq = read_fs (dev, Q_RP(q->offset))) & Q_EMPTY)) {
+		fs_dprintk (FS_DEBUG_QUEUE, "reaping return queue entry at %lx\n", rq); 
+		qe = bus_to_virt (rq);
+    
+		fs_dprintk (FS_DEBUG_QUEUE, "queue entry: %08x %08x %08x %08x. (%d)\n", 
+			    qe->cmd, qe->p0, qe->p1, qe->p2, STATUS_CODE (qe));
+
+		switch (STATUS_CODE (qe)) {
+		case 5:
+			tc = bus_to_virt (qe->p0);
+			fs_dprintk (FS_DEBUG_ALLOC, "Free tc: %p\n", tc);
+			kfree (tc);
+			break;
+		}
+    
+		write_fs (dev, Q_RP(q->offset), Q_INCWRAP);
+	}
+}
+
+
+static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
+{
+	long rq;
+	long tmp;
+	struct FS_QENTRY *qe;
+	struct sk_buff *skb;
+	struct FS_BPENTRY *td;
+
+	while (!((rq = read_fs (dev, Q_RP(q->offset))) & Q_EMPTY)) {
+		fs_dprintk (FS_DEBUG_QUEUE, "reaping txdone entry at %lx\n", rq); 
+		qe = bus_to_virt (rq);
+    
+		fs_dprintk (FS_DEBUG_QUEUE, "queue entry: %08x %08x %08x %08x: %d\n", 
+			    qe->cmd, qe->p0, qe->p1, qe->p2, STATUS_CODE (qe));
+
+		if (STATUS_CODE (qe) != 2)
+			fs_dprintk (FS_DEBUG_TXMEM, "queue entry: %08x %08x %08x %08x: %d\n", 
+				    qe->cmd, qe->p0, qe->p1, qe->p2, STATUS_CODE (qe));
+
+
+		switch (STATUS_CODE (qe)) {
+		case 0x01: /* This is for AAL0 where we put the chip in streaming mode */
+			/* Fall through */
+		case 0x02:
+			/* Process a real txdone entry. */
+			tmp = qe->p0;
+			if (tmp & 0x0f)
+				printk (KERN_WARNING "td not aligned: %ld\n", tmp);
+			tmp &= ~0x0f;
+			td = bus_to_virt (tmp);
+
+			fs_dprintk (FS_DEBUG_QUEUE, "Pool entry: %08x %08x %08x %08x %p.\n", 
+				    td->flags, td->next, td->bsa, td->aal_bufsize, td->skb );
+      
+			skb = td->skb;
+			if (skb == FS_VCC (ATM_SKB(skb)->vcc)->last_skb) {
+				wake_up_interruptible (& FS_VCC (ATM_SKB(skb)->vcc)->close_wait);
+				FS_VCC (ATM_SKB(skb)->vcc)->last_skb = NULL;
+			}
+			td->dev->ntxpckts--;
+
+			{
+				static int c=0;
+	
+				if (!(c++ % 100)) {
+					fs_dprintk (FS_DEBUG_QSIZE, "[%d]", td->dev->ntxpckts);
+				}
+			}
+
+			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
+
+			fs_dprintk (FS_DEBUG_TXMEM, "i");
+			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
+			fs_kfree_skb (skb);
+
+			fs_dprintk (FS_DEBUG_ALLOC, "Free trans-d: %p\n", td); 
+			memset (td, 0x12, sizeof (struct FS_BPENTRY));
+			kfree (td);
+			break;
+		default:
+			/* Here we get the tx purge inhibit command ... */
+			/* Action, I believe, is "don't do anything". -- REW */
+			;
+		}
+    
+		write_fs (dev, Q_RP(q->offset), Q_INCWRAP);
+	}
+}
+
+
+static void process_incoming (struct fs_dev *dev, struct queue *q)
+{
+	long rq;
+	struct FS_QENTRY *qe;
+	struct FS_BPENTRY *pe;    
+	struct sk_buff *skb;
+	unsigned int channo;
+	struct atm_vcc *atm_vcc;
+
+	while (!((rq = read_fs (dev, Q_RP(q->offset))) & Q_EMPTY)) {
+		fs_dprintk (FS_DEBUG_QUEUE, "reaping incoming queue entry at %lx\n", rq); 
+		qe = bus_to_virt (rq);
+    
+		fs_dprintk (FS_DEBUG_QUEUE, "queue entry: %08x %08x %08x %08x.  ", 
+			    qe->cmd, qe->p0, qe->p1, qe->p2);
+
+		fs_dprintk (FS_DEBUG_QUEUE, "-> %x: %s\n", 
+			    STATUS_CODE (qe), 
+			    res_strings[STATUS_CODE(qe)]);
+
+		pe = bus_to_virt (qe->p0);
+		fs_dprintk (FS_DEBUG_QUEUE, "Pool entry: %08x %08x %08x %08x %p %p.\n", 
+			    pe->flags, pe->next, pe->bsa, pe->aal_bufsize, 
+			    pe->skb, pe->fp);
+      
+		channo = qe->cmd & 0xffff;
+
+		if (channo < dev->nchannels)
+			atm_vcc = dev->atm_vccs[channo];
+		else
+			atm_vcc = NULL;
+
+		/* Single buffer packet */
+		switch (STATUS_CODE (qe)) {
+		case 0x1:
+			/* Fall through for streaming mode */
+		case 0x2:/* Packet received OK.... */
+			if (atm_vcc) {
+				skb = pe->skb;
+				pe->fp->n--;
+#if 0
+				fs_dprintk (FS_DEBUG_QUEUE, "Got skb: %p\n", skb);
+				if (FS_DEBUG_QUEUE & fs_debug) my_hd (bus_to_virt (pe->bsa), 0x20);
+#endif
+				skb_put (skb, qe->p1 & 0xffff); 
+				ATM_SKB(skb)->vcc = atm_vcc;
+				atomic_inc(&atm_vcc->stats->rx);
+				do_gettimeofday(&skb->stamp);
+				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
+				atm_vcc->push (atm_vcc, skb);
+				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-d: %p\n", pe);
+				kfree (pe);
+			} else {
+				printk (KERN_ERR "Got a receive on a non-open channel %d.\n", channo);
+			}
+			break;
+		case 0x17:/* AAL 5 CRC32 error. IFF the length field is nonzero, a buffer
+			     has been consumed and needs to be processed. -- REW */
+			if (qe->p1 & 0xffff) {
+				pe = bus_to_virt (qe->p0);
+				pe->fp->n--;
+				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p\n", pe->skb);
+				dev_kfree_skb_any (pe->skb);
+				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-d: %p\n", pe);
+				kfree (pe);
+			}
+			if (atm_vcc)
+				atomic_inc(&atm_vcc->stats->rx_drop);
+			break;
+		case 0x1f: /*  Reassembly abort: no buffers. */
+			/* Silently increment error counter. */
+			if (atm_vcc)
+				atomic_inc(&atm_vcc->stats->rx_drop);
+			break;
+		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
+			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
+				STATUS_CODE(qe), res_strings[STATUS_CODE (qe)]);
+		}
+		write_fs (dev, Q_RP(q->offset), Q_INCWRAP);
+	}
+}
+
+
+
+#define DO_DIRECTION(tp) ((tp)->traffic_class != ATM_NONE)
+
+static int fs_open(struct atm_vcc *atm_vcc)
+{
+	struct fs_dev *dev;
+	struct fs_vcc *vcc;
+	struct fs_transmit_config *tc;
+	struct atm_trafprm * txtp;
+	struct atm_trafprm * rxtp;
+	/*  struct fs_receive_config *rc;*/
+	/*  struct FS_QENTRY *qe; */
+	int error;
+	int bfp;
+	int to;
+	unsigned short tmc0;
+	short vpi = atm_vcc->vpi;
+	int vci = atm_vcc->vci;
+
+	func_enter ();
+
+	dev = FS_DEV(atm_vcc->dev);
+	fs_dprintk (FS_DEBUG_OPEN, "fs: open on dev: %p, vcc at %p\n", 
+		    dev, atm_vcc);
+
+	if (vci != ATM_VPI_UNSPEC && vpi != ATM_VCI_UNSPEC)
+		set_bit(ATM_VF_ADDR, &atm_vcc->flags);
+
+	if ((atm_vcc->qos.aal != ATM_AAL5) &&
+	    (atm_vcc->qos.aal != ATM_AAL2))
+	  return -EINVAL; /* XXX AAL0 */
+
+	fs_dprintk (FS_DEBUG_OPEN, "fs: (itf %d): open %d.%d\n", 
+		    atm_vcc->dev->number, atm_vcc->vpi, atm_vcc->vci);	
+
+	/* XXX handle qos parameters (rate limiting) ? */
+
+	vcc = kmalloc(sizeof(struct fs_vcc), GFP_KERNEL);
+	fs_dprintk (FS_DEBUG_ALLOC, "Alloc VCC: %p(%Zd)\n", vcc, sizeof(struct fs_vcc));
+	if (!vcc) {
+		clear_bit(ATM_VF_ADDR, &atm_vcc->flags);
+		return -ENOMEM;
+	}
+  
+	atm_vcc->dev_data = vcc;
+	vcc->last_skb = NULL;
+
+	init_waitqueue_head (&vcc->close_wait);
+
+	txtp = &atm_vcc->qos.txtp;
+	rxtp = &atm_vcc->qos.rxtp;
+
+	if (!test_bit(ATM_VF_PARTIAL, &atm_vcc->flags)) {
+		if (IS_FS50(dev)) {
+			/* Increment the channel numer: take a free one next time.  */
+			for (to=33;to;to--, dev->channo++) {
+				/* We only have 32 channels */
+				if (dev->channo >= 32)
+					dev->channo = 0;
+				/* If we need to do RX, AND the RX is inuse, try the next */
+				if (DO_DIRECTION(rxtp) && dev->atm_vccs[dev->channo])
+					continue;
+				/* If we need to do TX, AND the TX is inuse, try the next */
+				if (DO_DIRECTION(txtp) && test_bit (dev->channo, dev->tx_inuse))
+					continue;
+				/* Ok, both are free! (or not needed) */
+				break;
+			}
+			if (!to) {
+				printk ("No more free channels for FS50..\n");
+				return -EBUSY;
+			}
+			vcc->channo = dev->channo;
+			dev->channo &= dev->channel_mask;
+      
+		} else {
+			vcc->channo = (vpi << FS155_VCI_BITS) | (vci);
+			if (((DO_DIRECTION(rxtp) && dev->atm_vccs[vcc->channo])) ||
+			    ( DO_DIRECTION(txtp) && test_bit (vcc->channo, dev->tx_inuse))) {
+				printk ("Channel is in use for FS155.\n");
+				return -EBUSY;
+			}
+		}
+		fs_dprintk (FS_DEBUG_OPEN, "OK. Allocated channel %x(%d).\n", 
+			    vcc->channo, vcc->channo);
+	}
+
+	if (DO_DIRECTION (txtp)) {
+		tc = kmalloc (sizeof (struct fs_transmit_config), GFP_KERNEL);
+		fs_dprintk (FS_DEBUG_ALLOC, "Alloc tc: %p(%Zd)\n",
+			    tc, sizeof (struct fs_transmit_config));
+		if (!tc) {
+			fs_dprintk (FS_DEBUG_OPEN, "fs: can't alloc transmit_config.\n");
+			return -ENOMEM;
+		}
+
+		/* Allocate the "open" entry from the high priority txq. This makes
+		   it most likely that the chip will notice it. It also prevents us
+		   from having to wait for completion. On the other hand, we may
+		   need to wait for completion anyway, to see if it completed
+		   succesfully. */
+
+		switch (atm_vcc->qos.aal) {
+		case ATM_AAL2:
+		case ATM_AAL0:
+		  tc->flags = 0
+		    | TC_FLAGS_TRANSPARENT_PAYLOAD
+		    | TC_FLAGS_PACKET
+		    | (1 << 28)
+		    | TC_FLAGS_TYPE_UBR /* XXX Change to VBR -- PVDL */
+		    | TC_FLAGS_CAL0;
+		  break;
+		case ATM_AAL5:
+		  tc->flags = 0
+			| TC_FLAGS_AAL5
+			| TC_FLAGS_PACKET  /* ??? */
+			| TC_FLAGS_TYPE_CBR
+			| TC_FLAGS_CAL0;
+		  break;
+		default:
+			printk ("Unknown aal: %d\n", atm_vcc->qos.aal);
+			tc->flags = 0;
+		}
+		/* Docs are vague about this atm_hdr field. By the way, the FS
+		 * chip makes odd errors if lower bits are set.... -- REW */
+		tc->atm_hdr =  (vpi << 20) | (vci << 4); 
+		{
+			int pcr = atm_pcr_goal (txtp);
+
+			fs_dprintk (FS_DEBUG_OPEN, "pcr = %d.\n", pcr);
+
+			/* XXX Hmm. officially we're only allowed to do this if rounding 
+			   is round_down -- REW */
+			if (IS_FS50(dev)) {
+				if (pcr > 51840000/53/8)  pcr = 51840000/53/8;
+			} else {
+				if (pcr > 155520000/53/8) pcr = 155520000/53/8;
+			}
+			if (!pcr) {
+				/* no rate cap */
+				tmc0 = IS_FS50(dev)?0x61BE:0x64c9; /* Just copied over the bits from Fujitsu -- REW */
+			} else {
+				int r;
+				if (pcr < 0) {
+					r = ROUND_DOWN;
+					pcr = -pcr;
+				} else {
+					r = ROUND_UP;
+				}
+				error = make_rate (pcr, r, &tmc0, NULL);
+			}
+			fs_dprintk (FS_DEBUG_OPEN, "pcr = %d.\n", pcr);
+		}
+      
+		tc->TMC[0] = tmc0 | 0x4000;
+		tc->TMC[1] = 0; /* Unused */
+		tc->TMC[2] = 0; /* Unused */
+		tc->TMC[3] = 0; /* Unused */
+    
+		tc->spec = 0;    /* UTOPIA address, UDF, HEC: Unused -> 0 */
+		tc->rtag[0] = 0; /* What should I do with routing tags??? 
+				    -- Not used -- AS -- Thanks -- REW*/
+		tc->rtag[1] = 0;
+		tc->rtag[2] = 0;
+
+		if (fs_debug & FS_DEBUG_OPEN) {
+			fs_dprintk (FS_DEBUG_OPEN, "TX config record:\n");
+			my_hd (tc, sizeof (*tc));
+		}
+
+		/* We now use the "submit_command" function to submit commands to
+		   the firestream. There is a define up near the definition of
+		   that routine that switches this routine between immediate write
+		   to the immediate comamnd registers and queuing the commands in
+		   the HPTXQ for execution. This last technique might be more
+		   efficient if we know we're going to submit a whole lot of
+		   commands in one go, but this driver is not setup to be able to
+		   use such a construct. So it probably doen't matter much right
+		   now. -- REW */
+    
+		/* The command is IMMediate and INQueue. The parameters are out-of-line.. */
+		submit_command (dev, &dev->hp_txq, 
+				QE_CMD_CONFIG_TX | QE_CMD_IMM_INQ | vcc->channo,
+				virt_to_bus (tc), 0, 0);
+
+		submit_command (dev, &dev->hp_txq, 
+				QE_CMD_TX_EN | QE_CMD_IMM_INQ | vcc->channo,
+				0, 0, 0);
+		set_bit (vcc->channo, dev->tx_inuse);
+	}
+
+	if (DO_DIRECTION (rxtp)) {
+		dev->atm_vccs[vcc->channo] = atm_vcc;
+
+		for (bfp = 0;bfp < FS_NR_FREE_POOLS; bfp++)
+			if (atm_vcc->qos.rxtp.max_sdu <= dev->rx_fp[bfp].bufsize) break;
+		if (bfp >= FS_NR_FREE_POOLS) {
+			fs_dprintk (FS_DEBUG_OPEN, "No free pool fits sdu: %d.\n", 
+				    atm_vcc->qos.rxtp.max_sdu);
+			/* XXX Cleanup? -- Would just calling fs_close work??? -- REW */
+
+			/* XXX clear tx inuse. Close TX part? */
+			dev->atm_vccs[vcc->channo] = NULL;
+			kfree (vcc);
+			return -EINVAL;
+		}
+
+		switch (atm_vcc->qos.aal) {
+		case ATM_AAL0:
+		case ATM_AAL2:
+			submit_command (dev, &dev->hp_txq,
+					QE_CMD_CONFIG_RX | QE_CMD_IMM_INQ | vcc->channo,
+					RC_FLAGS_TRANSP |
+					RC_FLAGS_BFPS_BFP * bfp |
+					RC_FLAGS_RXBM_PSB, 0, 0);
+			break;
+		case ATM_AAL5:
+			submit_command (dev, &dev->hp_txq,
+					QE_CMD_CONFIG_RX | QE_CMD_IMM_INQ | vcc->channo,
+					RC_FLAGS_AAL5 |
+					RC_FLAGS_BFPS_BFP * bfp |
+					RC_FLAGS_RXBM_PSB, 0, 0);
+			break;
+		};
+		if (IS_FS50 (dev)) {
+			submit_command (dev, &dev->hp_txq, 
+					QE_CMD_REG_WR | QE_CMD_IMM_INQ,
+					0x80 + vcc->channo,
+					(vpi << 16) | vci, 0 ); /* XXX -- Use defines. */
+		}
+		submit_command (dev, &dev->hp_txq, 
+				QE_CMD_RX_EN | QE_CMD_IMM_INQ | vcc->channo,
+				0, 0, 0);
+	}
+    
+	/* Indicate we're done! */
+	set_bit(ATM_VF_READY, &atm_vcc->flags);
+
+	func_exit ();
+	return 0;
+}
+
+
+static void fs_close(struct atm_vcc *atm_vcc)
+{
+	struct fs_dev *dev = FS_DEV (atm_vcc->dev);
+	struct fs_vcc *vcc = FS_VCC (atm_vcc);
+	struct atm_trafprm * txtp;
+	struct atm_trafprm * rxtp;
+
+	func_enter ();
+
+	clear_bit(ATM_VF_READY, &atm_vcc->flags);
+
+	fs_dprintk (FS_DEBUG_QSIZE, "--==**[%d]**==--", dev->ntxpckts);
+	if (vcc->last_skb) {
+		fs_dprintk (FS_DEBUG_QUEUE, "Waiting for skb %p to be sent.\n", 
+			    vcc->last_skb);
+		/* We're going to wait for the last packet to get sent on this VC. It would
+		   be impolite not to send them don't you think? 
+		   XXX
+		   We don't know which packets didn't get sent. So if we get interrupted in 
+		   this sleep_on, we'll lose any reference to these packets. Memory leak!
+		   On the other hand, it's awfully convenient that we can abort a "close" that
+		   is taking too long. Maybe just use non-interruptible sleep on? -- REW */
+		interruptible_sleep_on (& vcc->close_wait);
+	}
+
+	txtp = &atm_vcc->qos.txtp;
+	rxtp = &atm_vcc->qos.rxtp;
+  
+
+	/* See App note XXX (Unpublished as of now) for the reason for the 
+	   removal of the "CMD_IMM_INQ" part of the TX_PURGE_INH... -- REW */
+
+	if (DO_DIRECTION (txtp)) {
+		submit_command (dev,  &dev->hp_txq,
+				QE_CMD_TX_PURGE_INH | /*QE_CMD_IMM_INQ|*/ vcc-&g