path: root/drivers/video/wmt/wmt-mb.c

/*++
 * WonderMedia Memory Block driver
 *
 * Copyright c 2010  WonderMedia  Technologies, Inc.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 * WonderMedia Technologies, Inc.
 * 10F, 529, Chung-Cheng Road, Hsin-Tien, Taipei 231, R.O.C
--*/
/*----------------------------------------------------------------------------
 * MODULE       : driver/video/wmt/memblock.c
 * DATE         : 2008/12/08
 * DESCRIPTION  : Physical memory management driver
 * HISTORY      :
 * Version 1.0.0.2 , 2013/11/12
*----------------------------------------------------------------------------*/
#ifndef MEMBLOCK_C
#define MEMBLOCK_C
#endif

#include <linux/version.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/fs.h>
#include <linux/kernel.h>
#include <linux/platform_device.h>
#include <linux/errno.h>
#include <linux/kdev_t.h>
#include <linux/cdev.h>
#include <linux/mman.h>
#include <linux/list.h>
#include <linux/proc_fs.h>
#include <asm/page.h>
#include <asm/uaccess.h>
#include <asm/cacheflush.h>
#include <linux/interrupt.h>
#include <linux/spinlock.h>
#include <linux/delay.h>
#include <linux/dma-mapping.h>
#include <linux/major.h>
#include <linux/sched.h>
#include <linux/swap.h>
#include <mach/wmt_env.h>

#include "com-mb.h"
#include <linux/wmt-mb.h>

#define THE_MB_USER "WMT-MB"
#define MB_VERSION_MAJOR 1
#define MB_VERSION_MINOR 0
#define MB_VERSION_MICRO 0
#define MB_VERSION_BUILD 3

#define MB_DEBUG
#define MB_INFO(fmt, args...)  \
	printk(KERN_INFO "["THE_MB_USER"] " fmt , ## args)
#define MB_WARN(fmt, args...)  \
	printk(KERN_WARNING "["THE_MB_USER" *W*] " fmt, ## args)
#define MB_ERROR(fmt, args...) \
	printk(KERN_ERR "["THE_MB_USER" *E*] " fmt , ## args)

#ifdef MB_DEBUG
#define MB_OPDBG(fmt, args...) { /* FILE OPERATION DBG */ \
	if (MBMSG_LEVEL) { \
		printk("\t" KERN_DEBUG "["THE_MB_USER"] %s: " fmt, \
			__func__ , ## args); \
	} \
}
#define MB_DBG(fmt, args...) { \
	if (MBMSG_LEVEL > 1) { \
		printk("\t" KERN_DEBUG "["THE_MB_USER"] %s: " fmt, \
			__func__ , ## args); \
	} \
}
#define MB_WDBG(fmt, args...) { \
	if (MBMSG_LEVEL > 2) { \
		printk("\t" KERN_DEBUG "["THE_MB_USER"] %s: " fmt, \
			__func__ , ## args); \
	} \
}
#else
#define MB_OPDBG(fmt, args...) do {} while (0)
#define MB_DBG(fmt, args...) do {} while (0)
#define MB_WDBG(fmt, args...) do {} while (0)
#endif

#ifdef CONFIG_WMT_MB_RESERVE_FROM_IO
#include <linux/fb.h>
#define MBIO_FSCREENINFO   FBIOGET_FSCREENINFO
#define MBA_MAX_ORDER      20 /* 2^20 pages = 4 GB */
#else
#define MBA_MAX_ORDER      (MAX_ORDER - 1) /* 2^10 pages = 4 MB */
#endif
#define MBA_MIN_ORDER      (MAX_ORDER - 5) /* 2^6  pages = 256 KB */

#define MBAFLAG_STATIC     0x80000000 /* static, without release if empty */

#define MBFLAG_CACHED      0x00000001 /* MB mapping as cachable */

#define MBFIND_VIRT        0x00000000 /* search virt address */
#define MBFIND_PHYS        0x00000001 /* search phys address */

#define MBUFIND_USER       0x00000001 /* search user address */
#define MBUFIND_VIRT       0x00000002 /* search kernel virt address */
#define MBUFIND_PHYS       0x00000004 /* search kernel phys address */
#define MBUFIND_ALL        0x00000010 /* search all mbu */
#define MBUFIND_CREATOR    0x00000020 /* search creator */
#define MBUFIND_MMAP       0x00000040 /* search mbu which mapping from user */
#define MBUFIND_GETPUT     0x00000080 /* search mbu which came from get/put */
#define MBUFIND_ADDRMASK   (MBUFIND_USER|MBUFIND_VIRT|MBUFIND_PHYS)

#define MBPROC_BUFSIZE     (16*1024)
#define MBA_SHOW_BUFSIZE   (8*1024)
#define MB_SHOW_BUFSIZE    (4*1024)

#define MB_COUNT(mb)       atomic_read(&(mb)->count)
#define MB_IN_USE(mb)      (MB_COUNT(mb)) /* count != 0 */
#define PAGE_KB(a)         ((a)*(PAGE_SIZE/1024))
#define MB_COMBIND_MBA(h, t) { \
	(h)->pgi.pfn_end = (t)->pgi.pfn_end; \
	(h)->pages += (t)->pages; \
	(h)->tot_free_pages += (t)->tot_free_pages; \
	(h)->max_available_pages += (t)->max_available_pages; \
	list_del(&((t)->mba_list)); \
	wmt_mbah->nr_mba--; \
	kmem_cache_free(wmt_mbah->mba_cachep, t); \
}

#define list_loop list_for_each_entry
struct mb_user;

struct page_info {
	unsigned long          pfn_start; /* start pfn of this block */
	unsigned long          pfn_end; /* end pfn of this block */
};

struct mba_host_struct {
	/* MB area link list link all MBAs */
	struct list_head       mba_list;

	/* page information of this MBA */
	unsigned int           nr_mba;

	/* total pages of all manager MBAs */
	unsigned long          tot_pages;

	/* total static pages of all manager MBAs */
	unsigned long          tot_static_pages;

	/* total free pages of all manager MBAs */
	unsigned long          tot_free_pages;

	/* max free pages of all manager MBAs */
	unsigned long          max_available_pages;

	/* allocator of MBA,
	   use slab to prevent memory from fragment. */
	struct kmem_cache      *mba_cachep;

	/* allocator of MB,
	   use slab to prevent memory from fragment. */
	struct kmem_cache      *mb_cachep;

	/* allocator of mb_user,
	   use slab to prevent memory from fragment. */
	struct kmem_cache      *mbu_cachep;

	/* allocator of mb_task_info,
	   use slab to prevent memory from fragment. */
	struct kmem_cache      *mbti_cachep;
};

struct mb_area_struct {
	/* MB area link list link all MBAs */
	struct list_head       mba_list;

	/* link list link to all MBs
	   belong to this MBA */
	struct list_head       mb_list;

	/* pointer point to dedicated MBAH */
	struct mba_host_struct *mbah;

	/* flags of MBA */
	unsigned int           flags;

	/* prefech record task id */
	pid_t                  tgid;

	/* start physical address of this MBA */
	unsigned long          phys;

	/* start virtual address of this MBA */
	void                   *virt;

	/* size of this MB area. Normally,
	   MAX kernel permitted size */
	unsigned long          pages;

	/* page information of this MBA */
	struct page_info       pgi;

	/* page information of this MBA */
	unsigned int           nr_mb;

	/* cur total free pages of this MBA */
	unsigned long          tot_free_pages;

	/* cur max free pages of this MBA */
	unsigned long          max_available_pages;
};

struct mb_struct {
	/* MB link list link all MBs
	   in dedicated MBA */
	struct list_head       mb_list;

	/* pointer point to dedicated MBA */
	struct mb_area_struct  *mba;

	/* MB kernel page information */
	struct page_info       pgi;

	/* start physical address of this MB */
	unsigned long          phys;

	/* start virtual address of this MB */
	void                   *virt;

	/* allocate size */
	unsigned long          size;

	/* current MB use count,
	   release until zero */
	atomic_t               count;

	/* flags of MB */
	unsigned int           flags;

	/* point to owner created the mb.
	   this enlisted in mbu_list */
	struct mb_user         *creator;

	/* use for trace the user of mb */
	struct list_head       mbu_list;
};

struct mb_user {
	/* user link list link all users
	   (include creator) of belonged MB */
	struct list_head       mbu_list;

	/* the mb to which this user belong */
	struct mb_struct       *mb;

	/* task id to which user belonged,
	   user space user only */
	pid_t                  tgid;

	/* mb_mmap and MBIO_GET   : user address
	   mb_get and mb->creator : physical address */
	unsigned long          addr;

	/* kernel space user:  mb size
	 * user space user:    mmap size
	 * zero:               owner - user space allocate but not mapped yet
	 *                     not owner -come from get/put */
	unsigned long          size;

	/* user name for recoder */
	char                   the_user[TASK_COMM_LEN+1];
};

struct mb_task_info {
	/* task link list link all tasks which use MBDev */
	struct list_head       mbti_list;
	pid_t                  tgid; /* task pid */
	atomic_t               count; /* multi open record */
	char                   task_name[TASK_COMM_LEN+1];
	struct task_struct     *task;
};

#ifdef CONFIG_WMT_MB_SIZE
static int MB_TOTAL_SIZE = CONFIG_WMT_MB_SIZE * 1024;
#else
static int MB_TOTAL_SIZE = 32 * 1024;
#endif
static struct mba_host_struct *wmt_mbah;
static struct mb_task_info wmt_mbti;
const struct file_operations mb_fops;
static unsigned char MBMSG_LEVEL;
static unsigned char MBMAX_ORDER;
static unsigned char MBMIN_ORDER;
static unsigned char USR2PRDT_METHOD;

/* read/write spinlock for multientry protection. */
static spinlock_t mb_do_lock;
static spinlock_t mb_search_lock;
static spinlock_t mb_ioctl_lock;
static spinlock_t mb_task_mm_lock;
static spinlock_t mb_task_lock;
static struct page *pg_user[12800]; /* 12800 pages = 50 MB */
static char show_mb_buffer[MB_SHOW_BUFSIZE];
static char show_mba_buffer[MBA_SHOW_BUFSIZE];

#define MMU_SEARCH_DONE 1
typedef int (*mb_page_proc)(void *, dma_addr_t, int);

static inline int mmu_search_pte(
	pte_t *pte,
	unsigned long boundary,
	unsigned long *addr,
	unsigned long *offset,
	mb_page_proc proc,
	void *priv)
{
	int ret = 0, index = 0;

	/* for each pte */
	while (pte && (*addr < boundary)) {
		unsigned long pfn = pte_pfn(*pte);
		struct page *pg = pfn_to_page(pfn);
		void *virt = page_address(pg);
		dma_addr_t phys = virt_to_phys(virt);

		MB_WDBG("\t\t[PTE%3d] PTE[%p]=%x n %lx V %p P %x U %lx[%lx]\n",
			index++, pte, pte_val(*pte), pfn,
			virt, phys, *addr, *offset);
		if (!pfn_valid(pfn)) {
			MB_WARN("invalid pfn %ld of addr %lx\n", pfn, *addr);
			return -1;
		}
		if (*offset < PAGE_SIZE) {
			ret = proc(priv, phys, *offset);
			if (ret)
				break;
			*offset = 0;
		} else
			*offset -= PAGE_SIZE;
		*addr += PAGE_SIZE;
		pte++;
#ifdef MB_WORDY
		msleep(30);
#endif
	};
	return ret;
}

static inline int mmu_search_pmd(
	pmd_t *pmd,
	unsigned long boundary,
	unsigned long *addr,
	unsigned long *offset,
	mb_page_proc proc,
	void *priv)
{
	int ret = 0, index = 0;
	unsigned long end;
	pte_t *pte;

	/* for each pmd */
	while (pmd && (*addr < boundary)) {
		/* from start to PMD alignment */
		end = (*addr + PMD_SIZE) & PMD_MASK;
		end = min(end, boundary);
		pte = pte_offset_map(pmd, *addr);
		if (pte == NULL) {
			MB_WARN("[%08lx] *pmd=%08llx unknown pte\n",
				*addr, (long long)pmd_val(*pmd));
			return -1;
		}
		MB_WDBG("\t[PMD%3d, %lx, %lx] *(%p)=%x addr %lx\n", index++,
			end - PMD_SIZE, end, pmd, pmd_val(*pmd), *addr);
		ret = mmu_search_pte(pte, end, addr, offset, proc, priv);
		if (ret)
			break;
		pmd++;
	};
	return ret;
}

static inline int mmu_search_pgd(
	pgd_t *pgd,
	unsigned long boundary,
	unsigned long *addr,
	unsigned long *offset,
	mb_page_proc proc,
	void *priv)
{
	int ret = 0, index = 0;
	unsigned long end;
	pmd_t *pmd;
	pud_t *pud;

	/* for each pgd */
	while (pgd && (*addr < boundary)) {
		/* from start to PGDIR alignment */
		end = (*addr + PGDIR_SIZE) & PGDIR_MASK;
		end = min(end, boundary);
		MB_WDBG("[PGD%3d, %lx, %lx] *(%p)=%x addr %lx\n", index++,
			end - PGDIR_SIZE, end, pgd, pgd_val(*pgd), *addr);
		pud = pud_offset(pgd, *addr);
		if (pud_none(*pud) || pud_bad(*pud)) {
			MB_WARN("[%08lx] *pgd=%08llx %s pud\n",
				*addr, (long long)pgd_val(*pgd),
				pud_none(*pud) ? "(None)" : "(Bad)");
			return -1;
		}
		pmd = pmd_offset(pud, *addr);
		if (pmd == NULL) {
			MB_WARN("[%08lx] *pgd=%08llx unknown pmd\n",
				*addr, (long long)pgd_val(*pgd));
			return -1;
		}
		ret = mmu_search_pmd(pmd, end, addr, offset, proc, priv);
		if (ret)
			break;
		pgd++;
	};

	return ret;
}

struct prdt_search_info {
	int index;
	int items;
	unsigned int size;
	struct prdt_struct *prev;
	struct prdt_struct *next;
};

static int __user_to_prdt_proc(void *priv, dma_addr_t phys, int offset)
{
	struct prdt_search_info *info = (struct prdt_search_info *)priv;
	struct prdt_struct *prev = info->prev, *next = info->next;
	int len = PAGE_SIZE - offset;

	if (len > info->size)
		len = info->size;

	/* Check it could combind with previous one */
	if (prev &&
	    /* prd size boundary check, MAX 60K */
	    (prev->size <= ((1 << 16) - (2 * PAGE_SIZE))) &&
	    /* page continuity check */
	    ((prev->addr + prev->size) == phys))
		prev->size += len;
	else { /* create new one */
		info->prev = prev = next;
		info->next = next + 1;
		prev->addr = phys + offset;
		prev->size = len;
		info->index++;
		info->items--;
		if (!info->items) {
			MB_WARN("PRD table full (ptr %p # %d left %d).\n",
				next, info->index, info->size);
			prev->EDT = 1;
			return -1;
		}
	}
	info->size -= len;
	prev->reserve = 0;
	prev->EDT = (info->size) ? 0 : 1;
	MB_WDBG("\t\t\t[PRD %3d] %p start %x(%x + %d) size %x edt %x left %x\n",
		info->index, prev, prev->addr, phys, offset,
		prev->size, prev->EDT, info->size);

	if (prev->EDT)
		return MMU_SEARCH_DONE;

	return 0;
}

static int __user_to_prdt(
	unsigned long user,
	unsigned int size,
	struct prdt_struct *prdt,
	unsigned int items)
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma;
	unsigned long addr, end, offset;
	struct prdt_search_info info = {0};
	unsigned int idx;
	pgd_t *pgd;
	int ret;

	if (!prdt || ((size / PAGE_SIZE) + 2) > items) {
		MB_WARN("PRD table space not enough (ptr %p at least %lu).\n",
			prdt, (size/PAGE_SIZE)+2);
		return -EINVAL;
	}

	MB_DBG("Memory(%#lx,%d) PRDT(%p,%d)\n", user, size, prdt, items);
	info.size = size;
	info.next = prdt;
	info.items = items;
	addr = user;

	down_read(&mm->mmap_sem);
	while (info.size > 0) {
		vma = find_vma(mm, addr);
		if (vma == NULL) {
			MB_WARN("user addr %lx not found in task %s\n",
				addr, current->comm);
			info.next->EDT = 1;
			goto fault;
		}

		MB_WDBG("VMA found: mm %p start %lx end %lx flags %lx\n",
			mm, vma->vm_start, vma->vm_end, vma->vm_flags);
		end = PAGE_ALIGN(vma->vm_end);
		offset = addr - vma->vm_start;
		addr = vma->vm_start;
		pgd = pgd_offset(mm, vma->vm_start);
		ret = mmu_search_pgd(pgd, end, &addr, &offset,
			__user_to_prdt_proc, &info);
		if (ret == MMU_SEARCH_DONE)
			break;
		if (ret)
			goto fault;
	}

	MB_WDBG("PRDT %p, from %lx size %d\n", prdt, user, size);
	for (idx = 0;; idx++) {
		MB_WDBG("PRDT[%d] adddr %x size %d EDT %d\n",
			idx, prdt[idx].addr, prdt[idx].size, prdt[idx].EDT);
		dmac_flush_range(__va(prdt[idx].addr),
			__va(prdt[idx].addr + prdt[idx].size));
		outer_flush_range(prdt[idx].addr,
			prdt[idx].addr + prdt[idx].size);
		if (prdt[idx].EDT)
			break;
	}
	up_read(&mm->mmap_sem);
	return 0;
fault:
	MB_WARN("USER TO PRDT unfinished, remain size %d\n", info.size);
	up_read(&mm->mmap_sem);
	return -EFAULT;
}

static int __user_to_prdt1(
	unsigned long user,
	unsigned int size,
	struct prdt_struct *next,
	unsigned int items)
{
	void *ptr_start, *ptr_end, *ptr, *virt = NULL;
	int res, pg_size, pg_idx = 0, nr_pages = 0;
	struct vm_area_struct *vma;

	ptr_start = ptr = (void *)user;
	ptr_end = ptr_start + size;
	MB_DBG("Memory(%#lx,%d) PRDT(%p,%d)\n", user, size, next, items);

	down_read(&current->mm->mmap_sem);
	vma = find_vma(current->mm, user);
	up_read(&current->mm->mmap_sem);
	/* For kernel direct-mapped memory, take the easy way */
	if (vma && (vma->vm_flags & VM_IO) && (vma->vm_pgoff)) {
		unsigned long phys = 0;
		/* kernel-allocated, mmaped-to-usermode addresses */
		phys = (vma->vm_pgoff << PAGE_SHIFT) + (user - vma->vm_start);
		virt = __va(phys);
		MB_INFO("kernel-alloc, mmaped-to-user addr U %lx V %p P %lx",
			user, virt, phys);
		BUG_ON(1);
		return -EFAULT;
	}
	MB_WDBG("VMA found: mm %p start %lx end %lx flags %lx\n",
		current->mm, vma->vm_start, vma->vm_end, vma->vm_flags);

	nr_pages = (size + (PAGE_SIZE - 1)) / PAGE_SIZE;
	if (!next || ((size/PAGE_SIZE)+2) > items || nr_pages > 2560) {
		MB_WARN("PRD table space full (ptr %p pages %d prdt %d/%lu).\n",
			next, nr_pages, items, (size/PAGE_SIZE)+2);
		return -EINVAL;
	}

	memset(pg_user, 0x0, sizeof(struct page *)*2560);
	down_read(&current->mm->mmap_sem);
	res = get_user_pages(current, current->mm,
		(unsigned long)ptr, nr_pages, 1, 0, pg_user, NULL);
	while (res > 0 && size > 0) {
		pg_size = PAGE_SIZE - ((unsigned long)ptr & ~PAGE_MASK);
		virt = page_address(pg_user[pg_idx]) +
			((unsigned long)ptr & ~PAGE_MASK);
		if (pg_size > size)
			pg_size = size;
		MB_DBG("Get %d-th user page s %d/%d u %p v %p p %lx\n",
			pg_idx, pg_size, size, ptr, virt, __pa(virt));
		if ((next->addr + next->size) != __pa(virt) ||
		    (next->size + pg_size) >= 65536 || !pg_idx) {
			if (pg_idx) {
				next->EDT = 0;
				next++;
			}
			memset(next, 0x0, sizeof(struct prdt_struct));
			next->addr = __pa(virt);
		}
		next->size += pg_size;
		next->EDT = 1;
		size -= pg_size;
		ptr += pg_size;
		pg_idx++;
	}
	next->EDT = 1;
	up_read(&current->mm->mmap_sem);
	return size;
}

static int __user_to_prdt2(
	unsigned long user,
	unsigned int size,
	struct prdt_struct *next,
	unsigned int items)
{
	void *ptr_start, *ptr_end, *ptr, *virt = NULL;
	int res, pg_size, pg_idx = 0, ret = 0;
	struct vm_area_struct *vma;
	struct page *pages = NULL;

	ptr_start = ptr = (void *)user;
	ptr_end = ptr_start + size;
	MB_DBG("Memory(%#lx,%d) PRDT(%p,%d)\n", user, size, next, items);

	down_read(&current->mm->mmap_sem);
	vma = find_vma(current->mm, user);
	up_read(&current->mm->mmap_sem);
	/* For kernel direct-mapped memory, take the easy way */
	if (vma && (vma->vm_flags & VM_IO) && (vma->vm_pgoff)) {
		unsigned long phys = 0;
		/* kernel-allocated, mmaped-to-usermode addresses */
		phys = (vma->vm_pgoff << PAGE_SHIFT) + (user - vma->vm_start);
		virt = __va(phys);
		MB_INFO("kernel-alloc, user-mmaped addr U %lx V %p P %lx",
			user, virt, phys);
		BUG_ON(1);
		return -EFAULT;
	}

	if (!next || ((size/PAGE_SIZE)+2) > items) {
		MB_WARN("PRD table space full (ptr %p at least %lu)\n",
			next, (size/PAGE_SIZE)+2);
		return -EINVAL;
	}

	MB_WDBG("VMA found: mm %p start %lx end %lx flags %lx\n",
		current->mm, vma->vm_start, vma->vm_end, vma->vm_flags);

	while (size) {
		down_read(&current->mm->mmap_sem);
		res = get_user_pages(current, current->mm,
			(unsigned long)ptr, 1, 1, 0, &pages, NULL);
		up_read(&current->mm->mmap_sem);
		pg_size = PAGE_SIZE - ((unsigned long)ptr & ~PAGE_MASK);
		if (res != 1) {
			MB_ERROR("Get %d-th user pages (a %p s %d/%d) fail\n",
				pg_idx, ptr, pg_size, size);
			next->EDT = 1;
			ret = -EFAULT;
			break;
		}
		virt = page_address(&pages[0]) +
			((unsigned long)ptr & ~PAGE_MASK);
		pg_size = (pg_size > size) ? size : pg_size;
		MB_DBG("Get %d-th user page s %d/%d u %p v %p p %lx\n",
			pg_idx, pg_size, size, ptr, virt, __pa(virt));
		if ((next->addr + next->size) != __pa(virt) ||
		    (next->size + pg_size) >= 65536 || !pg_idx) {
			if (pg_idx) {
				next->EDT = 0;
				next++;
			}
			memset(next, 0x0, sizeof(struct prdt_struct));
			next->addr = __pa(virt);
		}
		next->size += pg_size;
		next->EDT = 1;
		size -= pg_size;
		ptr += pg_size;
		pg_idx++;
	}
	return ret;
}

static void show_prdt(struct prdt_struct *next)
{
	int idx = 1;
	while (!next->EDT) {
		MB_INFO("PRDT %d-th item: addr %x size %d EDT %d\n",
			idx, next->addr, next->size, next->EDT);
		idx++;
		next++;
	}
	MB_INFO("PRDT last(%d-th) item: addr %x size %d EDT %d\n",
		idx, next->addr, next->size, next->EDT);
}

/*!*************************************************************************
* wmt_mmu_table_size
*
* Public Function
*/
/*!
* \brief
*   estimate request mmu table size for input size
*
* \parameter
*   size  [IN] convert size
*
* \retval  size of needed mmu table
*/
unsigned int wmt_mmu_table_size(unsigned int size)
{
	unsigned int nPte, nPde, need;

	if (!size)
		return 0;

	nPte = ((PAGE_ALIGN(size)) / PAGE_SIZE) + 1;
	nPde = ALIGN(nPte, 1024) / 1024;

	need = (ALIGN(nPde, 1024) / 1024) * PAGE_SIZE;
	need += nPte * 4;

	printk(KERN_DEBUG "PDE %d PTE %d RequestSize %d\n", nPde, nPte, need);
	return need;
}
EXPORT_SYMBOL(wmt_mmu_table_size);

/*!*************************************************************************
* wmt_mmu_table_check
*
* Public Function
*/
/*!
* \brief
*   check pre-allocated mmu table is valid for input size
*
* \parameter
*   mmu_addr  [IN] mmu table address
*   mmu_size  [IN] mmu table size
*   size      [IN] convert size
*
* \retval  1 if success
*/
int wmt_mmu_table_check(
	unsigned int *mmu_addr,
	unsigned int mmu_size,
	unsigned int size)
{
	unsigned int nPte, nPde, request;

	if (!size) {
		printk(KERN_WARNING "mmu create failure. NULL size\n");
		return 0;
	}

	if (!mmu_size) {
		printk(KERN_WARNING "mmu create failure. NULL mmu size\n");
		return 0;
	}

	if ((unsigned int)mmu_addr % PAGE_SIZE) {
		printk(KERN_WARNING "mmu create fail. PDE Table not align\n");
		return 0;
	}

	nPte = ((PAGE_ALIGN(size)) / PAGE_SIZE) + 1;
	nPde = ALIGN(nPte, 1024) / 1024;

	request = (ALIGN(nPde, 1024) / 1024) * PAGE_SIZE;
	request += nPte * 4;

	if (mmu_size < request) {
		printk(KERN_WARNING "mmu create fail. out of mmu size\n");
		printk(KERN_WARNING "(pde %d pte %d request %d but %d)\n",
			nPde, nPte, request, mmu_size);
		return 0;
	}

	return 1;
}
EXPORT_SYMBOL(wmt_mmu_table_check);

/*!*************************************************************************
* wmt_mmu_table_dump
*
* Public Function
*/
/*!
* \brief
*   dump mmu table
*
* \parameter
*   mmu_addr   [IN] mmu table address
*   size       [IN] convert size
*   virBufAddr [IN] offset combination of PDE, PTE, and ADDRESS
*
* \retval none
*/
void wmt_mmu_table_dump(struct mmu_table_info *info)
{
	unsigned int *mmu_addr;
	unsigned int size;
	unsigned int virBufAddr;
	unsigned int *pte = NULL, *pde = NULL;
	unsigned int pdeOffset, pteOffset, addrOffset, i = 0;

	if (info == 0) {
		printk(KERN_ERR "[WMT_MMU_TABLE] Null input pointer\n");
		return;
	}

	mmu_addr = (unsigned int *)mb_phys_to_virt(info->addr);

	size = info->size;
	virBufAddr = info->offset;

	addrOffset = virBufAddr % PAGE_SIZE;
	pteOffset = (virBufAddr >> 12) % 1024;
	pdeOffset = (virBufAddr >> 22) % 1024;

	printk(KERN_INFO "MMU (%x): offset pde %x pte %x addr %x\n",
		virBufAddr, pdeOffset, pteOffset, addrOffset);

	pde = mmu_addr;
	pde += pdeOffset;
	pte = mb_phys_to_virt(*pde);
	pte += pteOffset;

	while (size > 0) {
		printk(KERN_INFO "[%5d] PDE(%p/%lx) -> PTE(%p/%lx) -> addr %x\n",
			i, pde, mb_virt_to_phys(pde), pte, mb_virt_to_phys(pte),
			*pte + addrOffset);
		if ((size + addrOffset) < PAGE_SIZE)
			break;
		size -= PAGE_SIZE - addrOffset;
		addrOffset = 0;
		i++;
		pte++;
		if (!(i % 1024))
			pde++;
	}
}
EXPORT_SYMBOL(wmt_mmu_table_dump);

/*!*************************************************************************
* wmt_mmu_table_from_phys
*
* Public Function
*/
/*!
* \brief
*   make up mmu table for physical memory
*
* \parameter
*   mmu_addr  [IN] mmu table address
*   mmu_size  [IN] mmu table size
*   addr      [IN] physical address of convert data
*   size      [IN] convert size
*
* \retval 0xFFFFFFFF if fail
*         offset combination of PDE, PTE, and ADDRESS if success
*/
unsigned int wmt_mmu_table_from_phys(
	unsigned int *mmu_addr,
	unsigned int mmu_size,
	unsigned int addr,
	unsigned int size)
{
	unsigned int iPte, nPte, nPde, gPde, virBufAddr;
	unsigned int *pte = NULL, *pde = NULL;

	iPte = gPde = nPte = nPde = 0;
	if (!wmt_mmu_table_check(mmu_addr, mmu_size, size)) {
		printk(KERN_WARNING
			"phys %x (size %d) to mmu fail\n", addr, size);
		return 0xFFFFFFFF;
	}

	virBufAddr = addr % PAGE_SIZE;
	nPte = ((PAGE_ALIGN(size)) / PAGE_SIZE);
	if (virBufAddr)
		nPte++;
	nPde = ALIGN(nPte, 1024) / 1024;
	gPde = ALIGN(nPde, 1024) / 1024;

	pde = mmu_addr;
	pte = pde + (gPde * PAGE_SIZE / sizeof(pte));
	*pde = mb_virt_to_phys(pte);
	pde++;

	size += virBufAddr;
	while (size > 0) {
		*pte = addr & PAGE_MASK;
		pte++; iPte++;
		if (!(iPte % 1024)) {
			*pde = mb_virt_to_phys(pte);
			pde++;
		}
		if (size < PAGE_SIZE)
			break;
		size -= PAGE_SIZE;
		addr += PAGE_SIZE;
	}

	return virBufAddr;
}
EXPORT_SYMBOL(wmt_mmu_table_from_phys);


struct mmu_search_info {
	int iPte;
	unsigned *pte;
	unsigned *pde;
	unsigned int size;
};

static int wmt_mmu_table_from_user_proc(
	void *priv, dma_addr_t phys, int offset)
{
	struct mmu_search_info *info = (struct mmu_search_info *)priv;

	*info->pte = phys & PAGE_MASK;

	printk(KERN_DEBUG
		"\t\t\t[PTE] PDE[%d](%p)=%x PTE[%d](%p)=%x left %d\n",
		info->iPte/1024, info->pde, *info->pde,
		info->iPte, info->pte, *info->pte, info->size);
	info->size -= PAGE_SIZE;
	if (info->size < PAGE_SIZE)
		return MMU_SEARCH_DONE;
	info->iPte++;
	info->pte++;
	if (!(info->iPte % 1024)) {
		*info->pde = mb_virt_to_phys(info->pte);
		info->pde++;
	}
	return 0;
}

/*!*************************************************************************
* wmt_mmu_table_from_user
*
* Public Function
*/
/*!
* \brief
*   make up mmu table for user memory
*
* \parameter
*   mmu_addr  [IN] mmu table address
*   mmu_size  [IN] mmu table size
*   addr      [IN] physical address of convert data
*   size      [IN] convert size
*
* \retval 0xFFFFFFFF if fail
*         offset combination of PDE, PTE, and ADDRESS if success
*/
unsigned int wmt_mmu_table_from_user(
	unsigned int *mmu_addr,
	unsigned int mmu_size,
	unsigned int user,
	unsigned int size)
{
#ifndef __KERNEL__
	return wmt_mmu_table_from_phys(mmu_addr, mmu_size, user, size);
#else
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma;
	unsigned long addr, end, offset;
	unsigned int nPte, nPde, virBufAddr;
	struct mmu_search_info info = {0};
	pgd_t *pgd;
	int ret;

	nPte = nPde = 0;
	if (!wmt_mmu_table_check(mmu_addr, mmu_size, size)) {
		printk(KERN_WARNING "phys %x (size %d) to mmu fail\n",
			user, size);
		return 0xFFFFFFFF;
	}

	virBufAddr = user % PAGE_SIZE;
	nPte = ((PAGE_ALIGN(size)) / PAGE_SIZE);
	if (virBufAddr)
		nPte++;
	nPde = ALIGN(ALIGN(nPte, 1024) / 1024, 1024) / 1024;

	info.pde = mmu_addr;
	info.pte = info.pde + (nPde * PAGE_SIZE / sizeof(info.pte));
	*info.pde = mb_virt_to_phys(info.pte);
	info.pde++;

	printk(KERN_DEBUG "Memory(%#x,%d)\n", user, size);
	down_read(&mm->mmap_sem);
	info.size = size + virBufAddr;
	addr = (unsigned long)user;
	while (info.size > 0) {
		vma = find_vma(mm, addr);
		if (vma == NULL) {
			printk(KERN_WARNING
				"user addr %lx not found in task %s\n",
				addr, current->comm);
			goto fault;
		}
		printk(KERN_DEBUG
			"VMA found: start %lx end %lx\n",
			vma->vm_start, vma->vm_end);
		offset = addr - vma->vm_start;
		addr = vma->vm_start;
		end = PAGE_ALIGN(vma->vm_end);
		pgd = pgd_offset(mm, vma->vm_start);
		ret = mmu_search_pgd(pgd, end, &addr, &offset,
			wmt_mmu_table_from_user_proc, &info);
		if (ret == MMU_SEARCH_DONE)
			break;
		if (ret)
			goto fault;
	}
	up_read(&mm->mmap_sem);
	return virBufAddr;
fault:
	printk(KERN_WARNING "USER TO PRDT unfinished, remain size %d\n", size);
	up_read(&mm->mmap_sem);
	return 0xFFFFFFFF;
#endif
}
EXPORT_SYMBOL(wmt_mmu_table_from_user);

/*!*************************************************************************
* wmt_mmu_table_create
*
* Public Function
*/
/*!
* \brief
*   automatically make up mmu table from giving address
*
* \parameter
*   addr      [IN] start address (user of phys depends on addr_type)
*   size      [IN] size of memory
*   addr_type [IN] address type (0: phys 1: user)
*   info      [out] pointer of mmu table info
*
* \retval  0 if success, otherwise error code
*/
unsigned int wmt_mmu_table_create(
	unsigned int addr,
	unsigned int size,
	unsigned int addr_type,
	struct mmu_table_info *info)
{
	unsigned int mmuSize = 0;
	unsigned int *mmuAddr = NULL;

	if (!addr || !size || !info || addr_type > 1) {
		printk(KERN_ERR "[WMT_MMU_TABLE] invalid args:\n");
		printk(KERN_ERR "\t addr %x # %x type %x info %p\n",
			addr, size, addr_type, info);
		return -EINVAL;
	}

	mmuSize = wmt_mmu_table_size(size);

	info->addr = mb_alloc(mmuSize);
	if (!info->addr) {
		printk(KERN_ERR "[WMT_MMU_TABLE] create fail. Out of MB (%d)\n",
			mmuSize);
		return -ENOMEM;
	}
	info->size = size;
	mmuAddr = (unsigned int *)mb_phys_to_virt(info->addr);

	info->offset = (addr_type) ?
		wmt_mmu_table_from_user(mmuAddr, mmuSize, addr, size) :
		wmt_mmu_table_from_phys(mmuAddr, mmuSize, addr, size);

	if (info->offset == 0xFFFFFFFF) {
		printk(KERN_ERR "[WMT_MMU_TABLE] create fail:");
		printk(KERN_ERR "\ttype %x addr %x # %x mmuAddr %p/%x # %d\n",
			addr_type, addr, size, mmuAddr, info->addr, mmuSize);
		return -EFAULT;
	}

	return 0;
}
EXPORT_SYMBOL(wmt_mmu_table_create);

/*!*************************************************************************
* wmt_mmu_table_destroy
*
* Public Function
*/
/*!
* \brief
*   automatically make up mmu table from giving address
*
* \parameter
*   info [IN] start address (user of phys depends on addr_type)
*
* \retval  1 if success
*/
unsigned int wmt_mmu_table_destroy(struct mmu_table_info *info)
{
	if (!info) {
		printk(KERN_ERR "[WMT_MMU_TABLE] destroy fail. NULL mmu table info");
		return -EINVAL;
	}
	mb_free(info->addr);
	return 0;
}
EXPORT_SYMBOL(wmt_mmu_table_destroy);

/* return address is guaranteeed only under page alignment */
void *user_to_virt(unsigned long user)
{
	struct vm_area_struct *vma;
	unsigned long flags;
	void *virt = NULL;

	spin_lock_irqsave(&mb_task_mm_lock, flags);
	vma = find_vma(current->mm, user);
	/* For kernel direct-mapped memory, take the easy way */
	if (vma && (vma->vm_flags & VM_IO) && (vma->vm_pgoff)) {
		unsigned long phys = 0;
		/* kernel-allocated, mmaped-to-usermode addresses */
		phys = (vma->vm_pgoff << PAGE_SHIFT) + (user - vma->vm_start);
		virt = __va(phys);
		MB_INFO("%s kernel-alloc, user-mmaped addr U %lx V %p P %lx",
			__func__, user, virt, phys);
	} else {
		/* otherwise, use get_user_pages() for general userland pages */
		int res, nr_pages = 1;
		struct page *pages;
		down_read(&current->mm->mmap_sem);
		res = get_user_pages(current, current->mm,
			user, nr_pages, 1, 0, &pages, NULL);
		up_read(&current->mm->mmap_sem);
		if (res == nr_pages)
			virt = page_address(&pages[0]) + (user & ~PAGE_MASK);
		MB_INFO("%s userland addr U %lx V %p", __func__, user, virt);
	}
	spin_unlock_irqrestore(&mb_task_mm_lock, flags);

	return virt;
}
EXPORT_SYMBOL(user_to_virt);

int user_to_prdt(
	unsigned long user,
	unsigned int size,
	struct prdt_struct *next,
	unsigned int items)
{
	int ret;

	switch (USR2PRDT_METHOD) {
	case 1:
		ret = __user_to_prdt1(user, size, next, items);
		break;
	case 2:
		ret = __user_to_prdt2(user, size, next, items);
		break;
	default:
		ret = __user_to_prdt(user, size, next, items);
		break;
	}

	if (MBMSG_LEVEL > 1)
		show_prdt(next);

	return ret;
}
EXPORT_SYMBOL(user_to_prdt);

static int mb_show_mb(
	struct mb_struct *mb,
	char *msg,
	char *str,
	int size
)
{
	struct mb_user *mbu;
	char *p;

	if (!str && MBMSG_LEVEL <= 1)
		return 0;

	if (!mb)
		return 0;

	memset(show_mb_buffer, 0x0, MB_SHOW_BUFSIZE);
	p = show_mb_buffer;
	p += sprintf(p, "%s%s[MB,%p] %p %08lx %4ldKB [%4lx,%4lx] %3x\n",
		msg ? msg : "", msg ? " " : "", mb, mb->virt, mb->phys,
		mb->size/1024, mb->pgi.pfn_start, mb->pgi.pfn_end,
		MB_COUNT(mb));

	if (!list_empty(&mb->mbu_list)) {
		list_loop(mbu, &mb->mbu_list, mbu_list) {
			char tmp[256], *p1 = tmp;
			int expectLen = (int)(p - show_mb_buffer);
			p1 += sprintf(tmp, "            [%s%s,%p] %08lx ",
				(mbu == mb->creator) ? "O" : " ",
				(mbu->tgid == MB_DEF_TGID) ? "K" : "U",
				mbu, mbu->addr);
			p1 += sprintf(p1, "# %4ldKB By %s(%d)\n",
				mbu->size/1024, mbu->the_user, mbu->tgid);
			expectLen += strlen(tmp) + 1;
			if (expectLen > MB_SHOW_BUFSIZE) {
				p += sprintf(p, "\n\n               .......\n");
				break;
			}
			p += sprintf(p, "%s", tmp);
		}
	}
	if (str) {
		if (strlen(show_mb_buffer) < size)
			size = strlen(show_mb_buffer);
		strncpy(str, show_mb_buffer, size);
	} else {
		size = strlen(show_mb_buffer);
		MB_DBG("%s", show_mb_buffer);
	}

	return size;
}

static int mb_show_mba(
	struct mb_area_struct *mba,
	char *msg,
	char *str,
	int size,
	int follow
)
{
	struct mb_struct *mb;
	char *p;
	int idx = 1;

	if (!str && MBMSG_LEVEL <= 1)
		return 0;

	if (!mba)
		return 0;

	memset(show_mba_buffer, 0x0, MBA_SHOW_BUFSIZE);

	p = show_mba_buffer;
	if (msg)
		p += sprintf(p, "%s ", msg);
	p += sprintf(p, "[%p] %p %08lx %3ldMB [%5lx,%5lx] ",
		mba, mba->virt, mba->phys, PAGE_KB(mba->pages)/1024,
		mba->pgi.pfn_start, mba->pgi.pfn_end);
	p += sprintf(p, "%3x %6ldKB/%6ldKB   %s\n", mba->nr_mb,
		PAGE_KB(mba->max_available_pages),
		PAGE_KB(mba->tot_free_pages),
		(mba->flags | MBAFLAG_STATIC) ? "S" : "D");
	if (follow) {
		p += sprintf(p, "    index -    [MemBlock] VirtAddr PhysAddr");
		p += sprintf(p, "    size [  zs,  ze] cnt\n");
		list_loop(mb, &mba->mb_list, mb_list) {
			if ((MBA_SHOW_BUFSIZE - (p - show_mba_buffer)) < 22) {
				p += sprintf(p, "\n\n        more ...\n");
				break;
			}
			p += sprintf(p, "    %5d - ", idx++);
			/* -2 is for \n and zero */
			p += mb_show_mb(mb, NULL, p,
				MBA_SHOW_BUFSIZE - (p - show_mba_buffer) - 2);
		}
	}

	p += sprintf(p, "\n");

	if (str) {
		if (strlen(show_mba_buffer) < size)
			size = strlen(show_mba_buffer);
		strncpy(str, show_mba_buffer, size);
	} else {
		size = strlen(show_mba_buffer);
		MB_DBG("%s", show_mba_buffer);
	}

	return size;
}

/* return physical address */
#ifdef CONFIG_WMT_MB_RESERVE_FROM_IO
/* mb_do_lock locked */
static void *mb_alloc_pages(unsigned long *phys, unsigned long *nr_pages)
{
	unsigned int order = get_order(num_physpages << PAGE_SHIFT);
	unsigned int size = *nr_pages << PAGE_SHIFT;
	unsigned long addr = ((1 << order) - *nr_pages) << PAGE_SHIFT;
	void *virt = NULL;

	if (!nr_pages || !phys) {
		MB_WARN("mb_alloc_pages fail. unknown argument\n");
		return NULL;
	}

	*phys = 0;
	if (*nr_pages == 0) {
		MB_WARN("mb_alloc_pages zero size\n");
		return NULL;
	}

	if (!request_mem_region(addr, size, "memblock")) {
		MB_WARN("request memory region fail. addr %#lx size %d(KB).\n",
			addr, size/1024);
		return NULL;
	}

	virt = ioremap(addr, size);
	if (!virt) {
		MB_WARN("cannot ioremap memory. addr %#lx size %d(KB).\n",
			addr, size/1024);
		release_mem_region(addr, size);
		return NULL;
	}

	*phys = addr;
	MB_DBG("allocate mem region. addr V %p P %#lx size %d(KB)\n",
		virt, addr, size/1024);

	return virt;
}

/* mb_do_lock locked */
static void mb_free_pages(void *virt, unsigned long phys, unsigned int nr_pages)
{
	iounmap(virt);
	MB_DBG("release mem region. addr V %p P %#lx size %d(KB)\n",
		virt, phys, 4*nr_pages);
	return release_mem_region(phys, nr_pages << PAGE_SHIFT);
}

#else
/* mb_do_lock locked */
static void *mb_alloc_pages(unsigned long *phys, unsigned long *nr_pages)
{
	unsigned int i, order;
	unsigned long virt = 0;
	struct zone *zone;

	if (!nr_pages || !phys) {
		MB_WARN("mb_alloc_pages fail. unknown argument\n");
		return NULL;
	}

	*phys = 0;
	if (*nr_pages == 0) {
		MB_WARN("mb_alloc_pages zero size\n");
		return NULL;
	}

	order = get_order(*nr_pages * PAGE_SIZE);
	order = max(order, (unsigned int)(MBA_MIN_ORDER));
	MB_DBG(" %ld/%d pages, order %d\n", *nr_pages, 1 << order, order);
	if (order > MBMAX_ORDER) {
		MB_WARN("mb_alloc_mba fail. page out of size, %ld/%d/%d\n",
			*nr_pages, (1<<order), (1<<MBMAX_ORDER));
		return NULL;
	}

	zone = (first_online_pgdat())->node_zones;
	for (i = order; i < MAX_ORDER; i++) {
		if (zone->free_area[i].nr_free) {
			virt = __get_free_pages(GFP_ATOMIC | GFP_DMA, order);
			break;
		}
	}

	if (virt) {
		*nr_pages = 1 << order;
		*phys = __pa(virt);
		for (i = 0; i < *nr_pages; i++)
			SetPageReserved(virt_to_page(virt + i * PAGE_SIZE));
		MB_DBG("allocate mem region. addr V %#lx P %#lx size %ld(KB)\n",
			virt, *phys, PAGE_KB(*nr_pages));
	} else {
		struct free_area *fa;
		char msg[256], *p = msg;
		MB_WARN("__get_free_pages fail! (pages: %d free %lu)\n",
			1 << order, (unsigned long)nr_free_pages());
		zone = (first_online_pgdat())->node_zones;
		fa = zone->free_area;
		p += sprintf(msg, "DMA ZONE:");
		for (i = 0; i < MAX_ORDER; i++)
			p += sprintf(p, " %ld*%dKB", fa[i].nr_free, 4 << i);
		MB_WARN("%s= %ldkB\n", msg, PAGE_KB(nr_free_pages()));
	}

	return (void *)virt;
}

/* mb_do_lock locked */
static void mb_free_pages(void *virt, unsigned long phys, unsigned int nr_pages)
{
	unsigned int index;

	if (!phys || !nr_pages) {
		MB_WARN("mb_free_pages unknow addr V %p P %#lx size %d pages\n",
			virt, phys, nr_pages);
		return;
	}

	for (index = 0; index < nr_pages; index++) {
		unsigned long addr = (unsigned long)virt + index * PAGE_SIZE;
		ClearPageReserved(virt_to_page(addr));
	}

	free_pages((unsigned long)virt, get_order(nr_pages * PAGE_SIZE));
}
#endif

/* mb_do_lock locked */
static struct mb_area_struct *mb_alloc_mba(unsigned int pages)
{
	struct mba_host_struct *mbah = wmt_mbah;
	struct mb_area_struct *mba;

	if (!mbah || !pages) {
		MB_WARN("mb_alloc_mba fail. mbah %p, pages %d\n", mbah, pages);
		return NULL;
	}

	mba = kmem_cache_alloc(mbah->mba_cachep, GFP_ATOMIC);
	if (!mba) {
		MB_WARN("mb_alloc_mba fail. out of memory\n");
		return NULL;
	}

	memset(mba, 0x0, sizeof(struct mb_area_struct));
	mba->pages = pages;
	mba->virt = mb_alloc_pages(&mba->phys, &mba->pages);
	if (!mba->virt) {
		MB_WARN("mb_alloc_mba fail. no available space\n");
		kmem_cache_free(mbah->mba_cachep, mba);
		return NULL;
	}

	/* initialization */
	INIT_LIST_HEAD(&mba->mb_list);
	INIT_LIST_HEAD(&mba->mba_list);
	mba->mbah = mbah;
	mba->tot_free_pages = mba->max_available_pages = mba->pages;
	mba->pgi.pfn_start = mba->phys >> PAGE_SHIFT;
	mba->pgi.pfn_end = mba->pgi.pfn_start + mba->pages;
	list_add_tail(&mba->mba_list, &mbah->mba_list);

	/* update MBA host */
	mbah->nr_mba++;
	mbah->tot_pages += mba->pages;
	mbah->tot_free_pages += mba->tot_free_pages;
	if (mbah->max_available_pages < mba->max_available_pages)
		mbah->max_available_pages = mba->max_available_pages;
	mb_show_mba(mba, "alloc", NULL, 0, 0);

	return mba;
}

/* mb_do_lock locked */
static int mb_free_mba(struct mb_area_struct *mba)
{
	struct mba_host_struct *mbah;
	struct mb_area_struct *entry;

	if (!mba || !mba->mbah || mba->nr_mb) {
		MB_WARN("mb_free_mba fail. unknow arg.(%p,%p,%x)\n",
			mba, mba ? mba->mbah : NULL, mba ? mba->nr_mb : 0);
		return -EFAULT;
	}

	mbah = mba->mbah;
	list_loop(entry, &mbah->mba_list, mba_list) {
		if (entry == mba)
			break;
	}

	if (entry != mba) {
		MB_WARN("mb_free_mba fail. unknow MBA %p\n", mba);
		return -EFAULT;
	}
	if (mba->flags & MBAFLAG_STATIC)
		return 0;

	mb_show_mba(mba, "ReleaseMBA", NULL, 0, 0);

	/* free mba */
	list_del(&mba->mba_list);
	mb_free_pages(mba->virt, mba->phys, mba->pages);
	mbah->nr_mba--;
	mbah->tot_free_pages -= mba->tot_free_pages;
	mbah->tot_pages -= mba->pages;
	kmem_cache_free(mbah->mba_cachep, mba);
	mba = NULL;

	/* update max mb size */
	mbah->max_available_pages = 0;
	list_loop(entry, &mbah->mba_list, mba_list) {
		if (mbah->max_available_pages < entry->max_available_pages)
			mbah->max_available_pages = entry->max_available_pages;
	}

	return 0;
}

/* mb_do_lock locked */
static struct mb_struct *mb_alloc_mb(
	struct mb_area_struct *mba,
	unsigned long size)
{
	struct mba_host_struct *mbah;
	struct mb_struct *mb, *entry;
	struct list_head *next;
	unsigned long pages, zs, ze;

	if (!mba || !mba->mbah || !size) {
		MB_WARN("mb_alloc_mb fail. unknow arg.(%p,%p,%lx)\n",
			mba, mba ? mba->mbah : NULL, size);
		return NULL;
	}

	mbah = mba->mbah;
	size = PAGE_ALIGN(size);
	pages = size >> PAGE_SHIFT;

	/* mb free size is not enough */
	if (mba->max_available_pages < pages) {
		MB_WARN("mb_alloc_mb fail. no space in MBA (%lx<%lx)\n",
			pages, mba->max_available_pages);
		return NULL;
	}

	/* search available zone
	zone start from mba start */
	ze = zs = mba->pgi.pfn_start;
	next = &mba->mb_list;
	list_loop(entry, &mba->mb_list, mb_list) {
		next = &entry->mb_list;
		ze = entry->pgi.pfn_start;
		if ((ze - zs) >= pages)
			break;
		zs = entry->pgi.pfn_end;
	}

	if (zs >= ze) {
		next = &mba->mb_list;
		ze = mba->pgi.pfn_end;
	}

	/* impossible, something wrong */
	if ((ze - zs) < pages) {
		MB_WARN("something wrong in MBA %p when allocate MB.\n", mba);
		return NULL;
	}

	MB_DBG("Zone finding start %lx end %lx size %lx for size %lx\n",
		zs, ze, ze - zs, pages);

	mb = kmem_cache_alloc(mbah->mb_cachep, GFP_ATOMIC);
	if (!mb) {
		MB_WARN("mb_alloc_mb mb_cachep out of memory\n");
		return NULL;
	}

	memset(mb, 0x0, sizeof(struct mb_struct));
	INIT_LIST_HEAD(&mb->mb_list);
	INIT_LIST_HEAD(&mb->mbu_list);
	mb->mba = mba;
	mb->pgi.pfn_start = zs;
	mb->pgi.pfn_end = mb->pgi.pfn_start + pages;
	mb->size = size;
	mb->phys = mba->phys + ((zs - mba->pgi.pfn_start) << PAGE_SHIFT);
	mb->virt = mba->virt + (mb->phys - mba->phys);
	list_add_tail(&mb->mb_list, next);

	mba->nr_mb++;
	mba->tot_free_pages -= pages;
	mbah->tot_free_pages -= pages;

	/* update mba */
	zs = mba->pgi.pfn_start;
	mba->max_available_pages = 0;
	list_loop(entry, &mba->mb_list, mb_list) {
		mba->max_available_pages =
		max(entry->pgi.pfn_start - zs, mba->max_available_pages);
		zs = entry->pgi.pfn_end;
	}
	mba->max_available_pages =
	max(mba->pgi.pfn_end - zs, mba->max_available_pages);

	/* update mbah */
	mbah->max_available_pages = 0;
	list_loop(mba, &mbah->mba_list, mba_list) {
		if (mbah->max_available_pages < mba->max_available_pages)
			mbah->max_available_pages = mba->max_available_pages;
	}

	mb_show_mb(mb, "alloc", NULL, 0);

	return mb;
}

/* mb_do_lock locked */
static int mb_free_mb(struct mb_struct *mb)
{
	unsigned long zs, nr_pages;
	struct mba_host_struct *mbah;
	struct mb_area_struct *mba;
	struct mb_struct *entry;

	if (!mb) {
		MB_WARN("mb_free_mb fail. unknow MB %p.\n", mb);
		return -EFAULT;
	}

	if (MB_IN_USE(mb)) {
		MB_WARN("mb_free_mb fail. invalid arg.(%p,%x,%lx,%ldKB)\n",
			mb, MB_COUNT(mb), mb->phys, mb->size/1024);
		return -EINVAL;
	}

	mba = mb->mba;
	if (!mba || !mba->mbah) {
		MB_WARN("mb_free_mb fail. unknow para.(%p,%p)\n",
			mba, mba ? mba->mbah : NULL);
		return -EFAULT;
	}

	list_loop(entry, &mba->mb_list, mb_list) {
		if (entry == mb)
			break;
	}

	if (entry != mb) {
		MB_WARN("mb_free_mb fail. unknow MB %p\n", mb);
		return -EFAULT;
	}

	mbah = mba->mbah;

	mb_show_mb(mb, "Retrieve unused MB", NULL, 0);

	/* free mb */
	list_del(&mb->mb_list);
	kmem_cache_free(mbah->mb_cachep, mb);
	mba->nr_mb--;
	mb = NULL;

	/* unused mba, release it */
	if (!mba->nr_mb && !(mba->flags & MBAFLAG_STATIC))
		return mb_free_mba(mba);

	/* update max mb size and free mb size */
	/* reduce old one and then increase new one */
	mbah->tot_free_pages -= mba->tot_free_pages;
	zs = mba->pgi.pfn_start;
	mba->tot_free_pages = mba->max_available_pages = nr_pages = 0;
	list_loop(entry, &mba->mb_list, mb_list) {
		nr_pages = max(entry->pgi.pfn_start - zs, nr_pages);
		mba->tot_free_pages += entry->pgi.pfn_start - zs;
		zs = entry->pgi.pfn_end;
	}
	mba->tot_free_pages += mba->pgi.pfn_end - zs;
	mba->max_available_pages = max(mba->pgi.pfn_end - zs, nr_pages);
	mbah->tot_free_pages += mba->tot_free_pages; /* add new one */
	mbah->max_available_pages =
		max(mbah->max_available_pages, mba->max_available_pages);

	return 0;
}

/* type 0 - virtual address
 *      1 - physical address */
static struct mb_struct *mb_find_mb(void *addr, int type)
{
	struct mba_host_struct *mbah = wmt_mbah;
	struct mb_area_struct *mba;
	struct mb_struct *mb;
	unsigned long flags;

	if (!addr || (type != MBFIND_PHYS && type != MBFIND_VIRT)) {
		MB_WARN("mb_find_mb fail. unknow type %d addr %p\n",
			type, addr);
		return NULL;
	}

	MB_DBG("IN, type %x addr %p\n", type, addr);

	spin_lock_irqsave(&mb_search_lock, flags);

	list_loop(mba, &mbah->mba_list, mba_list) {
		void *eaddr, *saddr = (void *)(mba->phys);
		if (type != MBFIND_PHYS)
			saddr = mba->virt;
		eaddr = saddr + mba->pages*PAGE_SIZE;
		if (addr < saddr || addr > eaddr)
			continue; /* address out of mba range */
		list_loop(mb, &mba->mb_list, mb_list) {
			void *mbaddr = (void *)(mb->phys);
			if (type != MBFIND_PHYS)
				mbaddr = mb->virt;
			if (addr >= mbaddr && addr < (mbaddr + mb->size)) {
				spin_unlock_irqrestore(&mb_search_lock, flags);
				MB_DBG("OUT, va %p pa %lx s %ld(KB) cnt %d\n",
					mb->virt, mb->phys, mb->size/1024,
					MB_COUNT(mb));
				return mb;
			}
		}
	}

	spin_unlock_irqrestore(&mb_search_lock, flags);

	MB_DBG("OUT, NULL mb\n");

	return NULL;
}

/*
 * addr - search address
 * tgid - task pid
 * st   - search type (MBUFIND_XXX)
 *     MBUFIND_USER: user address
 *     MBUFIND_VIRT: kernel virt address
 *     MBUFIND_PHYS: kernel phys address
 *     MBUFIND_ALL:
 *         1. mbu->tgid == tgid
 *         2. tgid == MB_DEF_TGID, address and
 *                 one of MBUFIND_VIRT and MBUFIND_PHYS must be set
 *            tgid != MB_DEF_TGID, address and MBUFIND_USER must be set
 *     MBUFIND_CREATOR:
 *         1. mbu->tgid == tgid
 *         2. tgid == MB_DEF_TGID, address and
 *                 one of MBUFIND_VIRT and MBUFIND_PHYS must be set
 *            tgid != MB_DEF_TGID, address and MBUFIND_USER must be set
 *         3. mbu == mb->creator
 *         4. mbu->size == mb->size
 *     MBUFIND_GETPUT:
 *         1. mbu->tgid == tgid
 *         2. tgid == MB_DEF_TGID, address and
 *                 MBUFIND_PHYS must be set (mbu->addr == mb->phys)
 *            tgid != MB_DEF_TGID, address and
 *                 MBUFIND_USER must be set (mbu->addr == user address)
 *         3. mbu->size == 0
 *     MBUFIND_MMAP:
 *         1. mbu->tgid == tgid
 *         2. address and MBUFIND_USER must be set
 *         3. mbu->size != 0
 */
static struct mb_user *mb_find_mbu(void *addr, pid_t tgid, int st)
{
	struct mba_host_struct *mbah = wmt_mbah;
	struct mb_area_struct *mba = NULL;
	struct mb_struct *mb = NULL;
	struct mb_user *mbu = NULL;
	unsigned long flags;

	if (!addr || !(st & MBUFIND_ADDRMASK)) {
		MB_WARN("mb_find_mbu fail. unknow addr %p\n", addr);
		return NULL;
	}

	MB_DBG("IN, addr %p search type %x TGID %x CurTask %s\n",
		addr, st, tgid, current->comm);

	spin_lock_irqsave(&mb_search_lock, flags);
	list_loop(mba, &mbah->mba_list, mba_list) {
		if (st & (MBUFIND_VIRT | MBUFIND_PHYS)) {
			void *eaddr, *saddr = (void *)mba->phys;
			if (st & MBUFIND_VIRT)
				saddr = mba->virt;
			eaddr = saddr + mba->pages*PAGE_SIZE;
			if (addr < saddr || addr > eaddr)
				continue; /* address out of mba range */
		}
		list_loop(mb, &mba->mb_list, mb_list) {
			if ((st & MBUFIND_PHYS) && (addr != (void *)mb->phys))
				continue; /* physical address not match */
			if ((st & MBUFIND_VIRT) && (addr != mb->virt))
				continue; /* virtual address not match */
			list_loop(mbu, &mb->mbu_list, mbu_list) {
				if (mbu->tgid != tgid && tgid != MB_DEF_TGID)
					continue; /* tgid not match */
				if ((st & MBUFIND_USER) &&
				    (addr != (void *)mbu->addr))
					continue; /* user address not match */
				if (st & MBUFIND_ALL)
					goto leave; /* found */
				if (st & MBUFIND_CREATOR) {
					mbu = mb->creator;
					goto leave; /* found */
				}
				/* found (if mmap, mbu->size has map size) */
				if (st & MBUFIND_MMAP && mbu->size)
					goto leave;
				/* found (if get/put, mbu->size should be 0) */
				if (st & MBUFIND_GETPUT &&
				    mbu->addr && !mbu->size)
					goto leave;
			}
		}
	}
	mbu = NULL;

leave:
	if (mbu == NULL)
		MB_DBG("OUT, NULL mbu\n");

	if (mbu)
		MB_DBG("OUT, mbu %p (%p TGID %x a %#lx s %ld(KB) by %s)\n",
			mbu, mbu->mb, mbu->tgid, mbu->addr,
			mbu->size/1024, mbu->the_user);

	spin_unlock_irqrestore(&mb_search_lock, flags);

	return mbu;
}

static void mb_update_mbah(void)
{
	unsigned long mbah_free = 0, mbah_max = 0;
	struct mba_host_struct *mbah = wmt_mbah;
	struct mb_area_struct *mba = NULL;
	struct mb_struct *mb = NULL;

	if (!mbah) {
		MB_WARN("mb_update_mbah fail. unknow mbah\n");
		return;
	}

	list_loop(mba, &mbah->mba_list, mba_list) {
		unsigned long mba_free = 0, mba_max = 0, nr_pages = 0;
		unsigned long zs = mba->pgi.pfn_start; /* zone start */
		list_loop(mb, &mba->mb_list, mb_list) {
			nr_pages = max(mb->pgi.pfn_start - zs, nr_pages);
			mba_free += mb->pgi.pfn_start - zs;
			zs = mb->pgi.pfn_end;
		}
		mba_free += mba->pgi.pfn_end - zs;
		mbah_free += mba_free;
		mba_max = max(mba->pgi.pfn_end - zs, nr_pages);
		mbah_max = max(mbah_max, mba_max);
	}

	mbah->tot_free_pages = mbah_free;
	mbah->max_available_pages = mbah_max;

	return;
}

/* called from kernel only, mb_do_lock isn't needed */
void *mb_do_phys_to_virt(unsigned long phys, pid_t tgid, char *name)
{
	struct mb_struct *mb = NULL;
	void *virt = NULL;

	MB_DBG("IN, Phys %lx TGID %x NAME %s\n", phys, tgid, name);
	mb = mb_find_mb((void *)phys, MBFIND_PHYS);
	if (mb)
		virt = mb->virt + (phys - mb->phys);
	else {
		virt = __va(phys);
		MB_WARN("%s do phys to virt fail. addr %lx not found\n",
			name, phys);
	}

	MB_DBG("OUT, Virt %p\n", virt);

	return virt;
}
EXPORT_SYMBOL(mb_do_phys_to_virt);

/* called from kernel only, mb_do_lock isn't needed */
unsigned long mb_do_virt_to_phys(void *virt, pid_t tgid, char *name)
{
	struct mb_struct *mb = NULL;
	unsigned long phys = 0x0;

	MB_DBG("IN, Virt %p TGID %x NAME %s\n", virt, tgid, name);
	mb = mb_find_mb(virt, MBFIND_VIRT);
	if (mb)
		phys = mb->phys + (virt - mb->virt);
	else {
		phys = __pa(virt);
		MB_WARN("%s do virt to phys fail. addr %p not found\n",
			name, virt);
	}

	MB_DBG("OUT, Phys %lx\n", phys);

	return phys;
}
EXPORT_SYMBOL(mb_do_virt_to_phys);

unsigned long mb_do_user_to_phys(unsigned long user, pid_t tgid, char *name)
{
	unsigned long flags, phys = 0;
	struct mb_user *mbu = NULL;

	MB_DBG("IN, usr %lx TGID %x name %s\n", user, tgid, name);

	spin_lock_irqsave(&mb_do_lock, flags);
	mbu = mb_find_mbu((void *)user, tgid, MBUFIND_USER|MBUFIND_ALL);
	if (!mbu) {
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_WARN("%s do user to phys. unknow addr %lx\n", name, user);
		return 0;
	}

	if (!mbu->mb)
		MB_WARN("%s do user to phys fail. unknow block (addr %lx)\n",
			name, user);
	else
		phys = mbu->mb->phys;

	spin_unlock_irqrestore(&mb_do_lock, flags);

	MB_DBG("OUT, Phys %#lx\n", phys);

	return phys;
}
EXPORT_SYMBOL(mb_do_user_to_phys);

unsigned long mb_do_user_to_virt(unsigned long user, pid_t tgid, char *name)
{
	struct mb_user *mbu = NULL;
	unsigned long flags;
	void *virt = NULL;

	MB_DBG("IN, usr %lx TGID %x name %s\n", user, tgid, name);

	spin_lock_irqsave(&mb_do_lock, flags);
	mbu = mb_find_mbu((void *)user, tgid, MBUFIND_USER|MBUFIND_ALL);
	if (!mbu) {
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_WARN("%s user to virt fail. unknow addr %lx\n", name, user);
		return 0;
	}

	if (!mbu->mb)
		MB_WARN("%s user to virt fail. unknow block (addr %lx)\n",
			name, user);
	else
		virt = mbu->mb->virt;

	spin_unlock_irqrestore(&mb_do_lock, flags);

	MB_DBG("OUT, Virt %p\n", virt);

	return (unsigned long)virt;
}
EXPORT_SYMBOL(mb_do_user_to_virt);

/* physical address */
int mb_do_counter(unsigned long addr, char *name)
{
	struct mb_struct *mb;
	unsigned long flags;
	int counter = -1;

	MB_DBG("IN, addr %#lx name %s\n", addr, name);

	if (!addr || !wmt_mbah) {
		MB_WARN("%s do counter fail. invalid args %p/%lx\n",
			name, wmt_mbah, addr);
		return -EINVAL;
	}
	spin_lock_irqsave(&mb_do_lock, flags);
	mb = mb_find_mb((void *)addr, MBFIND_PHYS);
	counter = (mb) ? MB_COUNT(mb) : -1;
	spin_unlock_irqrestore(&mb_do_lock, flags);

	MB_DBG("OUT, addr %#lx count %d\n", addr, counter);

	return counter;
}
EXPORT_SYMBOL(mb_do_counter);

unsigned long mb_do_alloc(unsigned long size, pid_t tgid, char *name)
{
	struct mb_area_struct *entry, *mba = NULL;
	struct mb_struct *mb = NULL;
	struct mb_user *mbu = NULL;
	unsigned long flags, addr;
	unsigned int pages;
	size_t ns; /* name size */

	if (!name) {
		MB_WARN("mb_alloc fail. null user tgid %x\n", tgid);
		return 0;
	}

	size = PAGE_ALIGN(size);
	pages = size >> PAGE_SHIFT;

	if (!pages) {
		MB_WARN("%s alloc fail. unavailable size %x(KB)\n",
			name, 4*pages);
		return 0;
	}

	mbu = kmem_cache_alloc(wmt_mbah->mbu_cachep, GFP_ATOMIC);
	if (!mbu) {
		MB_WARN("%s alloc fail. mbu_cachep out of memory.\n", name);
		return 0;
	}
	memset(mbu, 0x0, sizeof(struct mb_user));

	MB_DBG("IN, TGID %x size %ld(KB) name %s\n", tgid, size/1024, name);

	spin_lock_irqsave(&mb_do_lock, flags);

	if (pages > wmt_mbah->max_available_pages) {
#ifdef CONFIG_WMT_MB_DYNAMIC_ALLOCATE_SUPPORT
		mba = mb_alloc_mba(pages);
		if (mba == NULL)
			MB_WARN("%s alloc %u page fail. [MBA %lu/%lu/%lu]\n",
				name, pages, wmt_mbah->max_available_pages,
				wmt_mbah->tot_free_pages, wmt_mbah->tot_pages);
#else
		MB_DBG("DYNAMIC ALLOCATED(%u) unsuported. [MBA %lu/%lu/%lu]\n",
			pages, wmt_mbah->max_available_pages,
			wmt_mbah->tot_free_pages, wmt_mbah->tot_pages);
		goto error;
#endif
	} else {
		list_loop(entry, &wmt_mbah->mba_list, mba_list) {
			if (entry->max_available_pages >= pages) {
				mba = entry;
				break;
			}
		}
	}

	if (!mba) {
		MB_WARN("%s alloc fail. dedicated MBA not found\n", name);
		goto error;
	}

	mb = mb_alloc_mb(mba, size);
	if (mb == NULL) {
		MB_WARN("%s alloc fail. create MB\n", name);
		goto error;
	}

	INIT_LIST_HEAD(&mbu->mbu_list);
	mbu->mb = mb;
	mbu->tgid = tgid;
	mbu->size = mb->size;
	/* mbu->addr = 0; // address of creator is 0 */
	ns = strlen(name);
	if (ns > TASK_COMM_LEN)
		ns = TASK_COMM_LEN;
	strncpy(mbu->the_user, name, ns);
	mbu->the_user[ns] = 0;
	list_add_tail(&mbu->mbu_list, &mb->mbu_list);
	atomic_inc(&mb->count);
	mb->creator = mbu;
	addr = mb->phys;
	spin_unlock_irqrestore(&mb_do_lock, flags);

	MB_DBG("OUT, Addr %lx TGID %x size %ld(KB) name %s\n",
		addr, tgid, size/1024, name);

	return addr;

error:

	kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
	spin_unlock_irqrestore(&mb_do_lock, flags);
	return 0;
}
EXPORT_SYMBOL(mb_do_alloc);

/* physical address */
int mb_do_free(unsigned long addr, pid_t tgid, char *name)
{
	struct mb_struct *mb;
	struct mb_user *mbu;
	unsigned long flags;
	size_t ns; /* name size */
	int ret;

	if (!addr || !name) {
		MB_WARN("mb_free fail. invalid args %lx/%s\n",
			addr, name);
		return -EINVAL;
	}

	MB_DBG("IN, TGID %x addr %#lx name %s\n", tgid, addr, name);

	spin_lock_irqsave(&mb_do_lock, flags);
	mbu = mb_find_mbu((void *)addr, tgid, MBUFIND_PHYS|MBUFIND_CREATOR);
	if (!mbu || !mbu->mb) {
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_WARN("%s free fail. unknow addr %lx\n", name, addr);
		return -EINVAL;
	}

	ns = strlen(name);
	if (ns > TASK_COMM_LEN)
		ns = TASK_COMM_LEN;
	if (strncmp(mbu->the_user, name, ns))
		MB_DBG("Owner no match. (%s/%s)\n", mbu->the_user, name);

	mb = mbu->mb;

	list_del(&mbu->mbu_list);
	kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
	mb->creator = NULL;
	atomic_dec(&mb->count);
	if (MB_IN_USE(mb)) {
		MB_DBG("<mb_free, MB %8lx still in use. Cnt %d>\n",
			mb->phys, MB_COUNT(mb));
		spin_unlock_irqrestore(&mb_do_lock, flags);
		return 0;
	}

	ret = mb_free_mb(mb);
	spin_unlock_irqrestore(&mb_do_lock, flags);

	MB_DBG("OUT\n");

	return ret;
}
EXPORT_SYMBOL(mb_do_free);

int mb_do_get(unsigned long addr, pid_t tgid, char *name)
{
	struct mb_user *mbu = NULL, *newmbu;
	struct mb_struct *mb = NULL;
	unsigned long flags;
	size_t ns; /* name size */
	void *virt = (void *)addr;

	if (!addr || !name) {
		MB_WARN("mb_do_get fail. invalid args %lx/%s\n",
			addr, name);
		return -EINVAL;
	}

	newmbu = kmem_cache_alloc(wmt_mbah->mbu_cachep, GFP_ATOMIC);
	if (!newmbu) {
		MB_DBG("<mbu_cachep out of memory.>\n");
		return -ENOMEM;
	}

	MB_DBG("IN, TGID %x addr %#lx name %s\n", tgid, addr, name);

	spin_lock_irqsave(&mb_do_lock, flags);
	if (tgid != MB_DEF_TGID) { /* find user address, only exist on MMAP */
		mbu = mb_find_mbu(virt, tgid, MBUFIND_USER|MBUFIND_MMAP);
		mb = (mbu) ? mbu->mb : NULL;
	} else
		mb = mb_find_mb(virt, MBFIND_PHYS);

	if (!mb) {
		spin_unlock_irqrestore(&mb_do_lock, flags);
		kmem_cache_free(wmt_mbah->mbu_cachep, newmbu);
		MB_WARN("%s mb_get fail. unknown addr %8lx\n", name, addr);
		return -EFAULT;
	}

	memset(newmbu, 0x0, sizeof(struct mb_user));
	INIT_LIST_HEAD(&newmbu->mbu_list);
	newmbu->addr = addr;
	newmbu->mb = mb;
	newmbu->tgid = tgid;
	ns = strlen(name);
	if (ns > TASK_COMM_LEN)
		ns = TASK_COMM_LEN;
	strncpy(newmbu->the_user, name, ns);
	newmbu->the_user[ns] = 0;
	atomic_inc(&mb->count);
	list_add_tail(&newmbu->mbu_list, &mb->mbu_list);

	spin_unlock_irqrestore(&mb_do_lock, flags);

	MB_DBG("out, [mbu] addr %lx %s [mb] addr %lx cnt %d\n",
		addr, newmbu->the_user, mb->phys, MB_COUNT(mb));

	return 0;
}
EXPORT_SYMBOL(mb_do_get);

int mb_do_put(unsigned long addr, pid_t tgid, char *name)
{
	struct mb_struct *mb;
	struct mb_user *mbu;
	unsigned long flags;
	void *virt = (void *)addr;

	if (!addr || !name) {
		MB_WARN("mb_do_put fail. invalid args %lx/%s\n", addr, name);
		return -EINVAL;
	}

	MB_DBG("IN, TGID %x addr %#lx name %s\n", tgid, addr, name);

	spin_lock_irqsave(&mb_do_lock, flags);
	if (tgid == MB_DEF_TGID)
		mbu = mb_find_mbu(virt, tgid, MBUFIND_PHYS|MBUFIND_GETPUT);
	else
		mbu = mb_find_mbu(virt, tgid, MBUFIND_USER|MBUFIND_GETPUT);

	if (!mbu) {
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_WARN("%s mb_put fail. unknow addr %8lx\n", name, addr);
		return -EINVAL;
	}

	mb = mbu->mb;
	if (!MB_IN_USE(mb)) {
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_WARN("%s mb_put fail. block %p unbalance.\n", name, mb);
		return -EPERM;
	}

	list_del_init(&mbu->mbu_list);
	atomic_dec(&mb->count);
	/* retrieve unused block */
	if (!MB_IN_USE(mb))
		mb_free_mb(mb);

	spin_unlock_irqrestore(&mb_do_lock, flags);
	kmem_cache_free(wmt_mbah->mbu_cachep, mbu);

	MB_DBG("out, [mbu] addr %lx %s [mb] addr %lx cnt %d\n",
		addr, mbu->the_user, mb->phys, MB_COUNT(mb));

	return 0;
}
EXPORT_SYMBOL(mb_do_put);

#define DEVICE_NAME "Memory Block"

static int mb_dev_major;
static int mb_dev_minor;
static int mb_dev_nr;
static struct cdev *mb_cdev;
static struct class *mb_dev_class;

static int mb_open(struct inode *inode, struct file *filp)
{
	struct mb_task_info *mbti = NULL;
	unsigned long flags;
	int task_exist = 0;
	size_t ns;

	if (filp->private_data) {
		MB_ERROR("none empty private data.\n");
		return -EFAULT;
	}

	spin_lock_irqsave(&mb_task_lock, flags);
	list_loop(mbti, &wmt_mbti.mbti_list, mbti_list) {
		if (mbti->task && mbti->tgid == current->tgid) {
			task_exist = 1;
			break;
		}
	}
	if (!task_exist) {
		mbti = kmem_cache_alloc(wmt_mbah->mbti_cachep, GFP_ATOMIC);
		if (!mbti) {
			spin_unlock_irqrestore(&mb_task_lock, flags);
			MB_ERROR("out of memory (mb_task_info).\n");
			return -EFAULT;
		}
		memset(mbti, 0x0, sizeof(struct mb_task_info));
		INIT_LIST_HEAD(&mbti->mbti_list);
		mbti->task = current;
		mbti->tgid = current->tgid;
		ns = strlen(current->comm);
		if (ns > TASK_COMM_LEN)
			ns = TASK_COMM_LEN;
		strncpy(mbti->task_name, current->comm, ns);
		mbti->task_name[ns] = 0;
		atomic_set(&mbti->count, 0);
		list_add_tail(&mbti->mbti_list, &wmt_mbti.mbti_list);
	}
	atomic_inc(&mbti->count);
	MB_DBG("mb driver is opened by task(%p) %s TGID %x count %d.\n",
		current, current->comm, current->tgid,
		atomic_read(&(mbti->count)));
	filp->private_data = (void *)mbti;
	spin_unlock_irqrestore(&mb_task_lock, flags);

	return 0;
}

static int mb_release(struct inode *inode, struct file *filp)
{
	struct mb_area_struct *mba;
	struct mb_struct *mb;
	struct mb_user *mbu;
	struct mb_task_info *cmbti = NULL, *mbti = NULL;
	unsigned long flags, tflags;
	int task_exist = 0;

	cmbti = (struct mb_task_info *)(filp->private_data);
	if (!cmbti) {
		MB_ERROR("none empty private data.\n");
		return -EFAULT;
	}

	spin_lock_irqsave(&mb_task_lock, tflags);
	list_loop(mbti, &wmt_mbti.mbti_list, mbti_list) {
		if (mbti->task && mbti->tgid == cmbti->tgid) {
			atomic_dec(&mbti->count);
			task_exist = 1;
			break;
		}
	}
	if (!task_exist) {
		spin_unlock_irqrestore(&mb_task_lock, tflags);
		MB_INFO("mb driver is closed by unknown task %s TGID %x.\n",
		current->comm, current->tgid);
		return 0;
	}

	MB_DBG("mb driver is closed by task %s TGID %x cnt %d.\n",
		mbti->task_name, mbti->tgid, atomic_read(&mbti->count));
	if (atomic_read(&mbti->count)) {
		spin_unlock_irqrestore(&mb_task_lock, tflags);
		return 0;
	}

	spin_lock_irqsave(&mb_ioctl_lock, flags);
RESCAN_MBA:
	/* munmap virtual memroy and retrieve unused MB */
	list_loop(mba, &wmt_mbah->mba_list, mba_list) {
#ifdef CONFIG_WMT_MB_DYNAMIC_ALLOCATE_SUPPORT
		if (mba->tgid == mbti->tgid) { /* free prefetched mba marker */
			wmt_mbah->tot_static_pages -= mba->pages;
			mba->flags &= ~(MBAFLAG_STATIC);
			mba->tgid = MB_DEF_TGID;
			if (!mba->nr_mb) {
				mb_free_mba(mba);
				goto RESCAN_MBA;
			}
		}
#endif
		list_loop(mb, &mba->mb_list, mb_list) {
RESCAN_MBU:
			list_loop(mbu, &mb->mbu_list, mbu_list) {
				if (mbu->tgid == mbti->tgid) {
					char msg[128], *p = msg;
					const char *opStr[3] = {
						"\"ALLOC\"",
						"\"MAP\"",
						"\"GET\""};
					int op = (mbu->size) ? 1 : 2;
					if (mb->creator == mbu) {
						op = 0;
						mb->creator = NULL;
					}
					p += sprintf(p, "Stop mb operation %s",
						opStr[op]);
					p += sprintf(p, "(addr %lx # %lu(KB) ",
						mb->phys, mbu->size/1024);
					p += sprintf(p, "by %s) (Cnt %d)\n",
						 mbu->the_user, MB_COUNT(mb)-1);
					MB_INFO("%s", msg);
					atomic_dec(&mb->count);
					list_del_init(&mbu->mbu_list);
					kmem_cache_free(
						wmt_mbah->mbu_cachep, mbu);
					if (MB_COUNT(mb))
						goto RESCAN_MBU;
					MB_INFO("Recycle mb addr %lx # %lu\n",
						mb->phys, mb->size);
					mb_free_mb(mb);
					goto RESCAN_MBA;
				}
			}
		}
	}

	mb_update_mbah();
	list_del(&mbti->mbti_list);
	kmem_cache_free(wmt_mbah->mbti_cachep, mbti);
	filp->private_data = NULL;
	spin_unlock_irqrestore(&mb_ioctl_lock, flags);
	spin_unlock_irqrestore(&mb_task_lock, tflags);

	return 0;
}

static long mb_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
	struct mb_task_info *mbti = NULL;
	struct mb_area_struct *mba = NULL;
	struct mb_struct *mb = NULL;
	struct mb_user *mbu = NULL;
	unsigned long value, flags, phys, virt, size;
	pid_t tgid = MB_DEF_TGID;
	int count, ret = 0, cmdSize;
	size_t len;

	/* check type and number, if fail return ENOTTY */
#ifdef CONFIG_WMT_MB_RESERVE_FROM_IO
	if (_IOC_TYPE(cmd) != MB_IOC_MAGIC && cmd != FBIOGET_FSCREENINFO)
		return -ENOTTY;
#else
	if (_IOC_TYPE(cmd) != MB_IOC_MAGIC)
		return -ENOTTY;
#endif

	/* check argument area */
	cmdSize = _IOC_SIZE(cmd);
	if (_IOC_DIR(cmd) & _IOC_READ)
		ret = !access_ok(VERIFY_WRITE, (void __user *) arg, cmdSize);
	else if (_IOC_DIR(cmd) & _IOC_WRITE)
		ret = !access_ok(VERIFY_READ, (void __user *) arg, cmdSize);

	if (ret)
		return -EFAULT;

	/* check task validation */
	if (!filp || !filp->private_data) {
		MB_ERROR("mmap with null file info or task.\n");
		return -EFAULT;
	}

	mbti = (struct mb_task_info *)(filp->private_data);
	tgid = mbti->tgid;
	if (tgid != current->tgid) {
		MB_WARN("ioctl within diff task.\n");
		MB_WARN("Open: task %s TGID %x VS Curr: task %s TGID %x\n",
			mbti->task_name, tgid, current->comm, current->tgid);
	}

	switch (cmd) {
	/* _IOR (MB_IOC_MAGIC, 16, unsigned long) O: mb driver version */
	case MBIO_GET_VERSION:
		value = MB_VERSION_MAJOR << 24 |
			MB_VERSION_MINOR << 16 |
			MB_VERSION_MICRO << 8  |
			MB_VERSION_BUILD;
		put_user(value, (unsigned long *)arg);
		break;

	/* _IOWR(MB_IOC_MAGIC, 0, unsigned long)
	 *  I: size
	 *  O: physical address */
	case MBIO_MALLOC:
		get_user(value, (unsigned long *)arg);
		phys = mb_do_alloc(value, tgid, mbti->task_name);
		if (!phys) {
			MB_WARN("MALLOC: size %ld fail.\n\n", value);
			return -EFAULT;
		}
		MB_OPDBG("MALLOC: addr %lx size %ld\n\n", phys, value);
		put_user(phys, (unsigned long *)arg);
		break;

	/* _IOW (MB_IOC_MAGIC, 17, unsigned long) O: property of MB */
	case MBIO_SET_CACHABLE:
		get_user(value, (unsigned long *)arg);
		spin_lock_irqsave(&mb_do_lock, flags);
		mb = mb_find_mb((void *)value, MBFIND_PHYS);
		if (!mb) {
			spin_unlock_irqrestore(&mb_do_lock, flags);
			MB_WARN("SET_CACHABLE: phys %8lx (name %s) fail\n",
				value, mbti->task_name);
			return -EFAULT;
		}
		mb->flags |= MBFLAG_CACHED;
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_OPDBG("SET_CACHABLE: phys %8lx\n\n", value);
		break;

	/* _IOW (MB_IOC_MAGIC,18, unsigned long) O: property of MB */
	case MBIO_CLR_CACHABLE:
		get_user(value, (unsigned long *)arg);
		spin_lock_irqsave(&mb_do_lock, flags);
		mb = mb_find_mb((void *)value, MBFIND_PHYS);
		if (!mb) {
			spin_unlock_irqrestore(&mb_do_lock, flags);
			MB_WARN("CLR_CACHABLE: phys %8lx (name %s) fail\n",
				value, mbti->task_name);
			return -EFAULT;
		}
		mb->flags &= ~MBFLAG_CACHED;
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_OPDBG("CLR_CACHABLE: phys %8lx\n\n", value);
		break;

	/* _IOWR(MB_IOC_MAGIC, 1, unsigned long)
	 *  I: user address if map, physical address if not map
	 *  O: ummap size */
	case MBIO_FREE: /* if not unmap, unmap first */
		get_user(value, (unsigned long *)arg);
		spin_lock_irqsave(&mb_ioctl_lock, flags);
		size = value;
		mbu = mb_find_mbu((void *)value, tgid,
			MBUFIND_USER|MBUFIND_MMAP);
		if (mbu != NULL) {
			size = mbu->size;
			value = mbu->mb->phys;
			list_del(&mbu->mbu_list);
			atomic_dec(&mbu->mb->count);
			kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
		} else
			MB_DBG("FREE: unknown MMAP addr %lx\n", value);
		ret = mb_do_free(value, tgid, mbti->task_name);
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		if (ret < 0)
			MB_WARN("FREE: addr %lx fail\n", value);
		/* return mmap size for ummap */
		put_user(size, (unsigned long *)arg);
		MB_OPDBG("FREE: addr %lx out %ld\n\n", value, size);
		break;

	/* _IOWR(MB_IOC_MAGIC, 2, unsigned long)
	 *  I: user address
	 *  O: ummap size */
	case MBIO_UNMAP:
		get_user(value, (unsigned long *)arg);
		spin_lock_irqsave(&mb_ioctl_lock, flags);
		mbu = mb_find_mbu((void *)value, tgid,
			MBUFIND_USER|MBUFIND_MMAP);
		if (mbu == NULL) {
			spin_unlock_irqrestore(&mb_ioctl_lock, flags);
			MB_WARN("UNMAP: addr %lx fail\n\n", value);
			return -EFAULT;
		}
		mb = mbu->mb;
		size = mbu->size;
		list_del(&mbu->mbu_list);
		kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
		atomic_dec(&mb->count);
		count = MB_COUNT(mb);
		if (count <= 0)
			MB_WARN("UNMAP: MB %8lx count %d weird\n\n",
				mb->phys, count);
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		 /* return mmap size for ummap */
		put_user(size, (unsigned long *)arg);
		return 0;

	/* _IOWR(MB_IOC_MAGIC, 3, unsigned long)
	 *  I: phys address
	 *  O: mb size */
	case MBIO_MBSIZE:
		get_user(value, (unsigned long *)arg);
		spin_lock_irqsave(&mb_ioctl_lock, flags);
		mb = mb_find_mb((void *)value, MBFIND_PHYS);
		if (mb == NULL) {
			spin_unlock_irqrestore(&mb_ioctl_lock, flags);
			MB_WARN("MBSIZE: user %lx fail.\n\n", value);
			return -EFAULT;
		}
		size = mb->size;
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		MB_OPDBG("MBSIZE: addr %lx size %ld\n\n", value, size);
		put_user(size, (unsigned long *)arg);
		break;

	/* _IOR (MB_IOC_MAGIC, 4, unsigned long)
	 *  O: max free mba size */
	case MBIO_MAX_AVAILABLE_SIZE:
		put_user(wmt_mbah->max_available_pages*PAGE_SIZE,
			(unsigned long *)arg);
		MB_OPDBG("MAX_MB_SIZE: size %ld KB\n\n",
			PAGE_KB(wmt_mbah->max_available_pages));
		break;

	/* _IOW (MB_IOC_MAGIC, 5, unsigned long)
	 *  I: user address */
	case MBIO_GET:
		get_user(value, (unsigned long *)arg);
		ret = mb_do_get(value, tgid, mbti->task_name);
		if (MBMSG_LEVEL) {
			spin_lock_irqsave(&mb_ioctl_lock, flags);
			mbu = mb_find_mbu((void *)value, tgid,
				MBUFIND_USER|MBUFIND_GETPUT);
			count = mbu ? MB_COUNT(mbu->mb) : 0xffffffff;
			MB_OPDBG("GET: addr %lx cnt %x\n\n", value, count);
			spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		}
		break;

	/* _IOW (MB_IOC_MAGIC, 6, unsigned long)
	 *  I: user address */
	case MBIO_PUT:
		get_user(value, (unsigned long *)arg);
		if (MBMSG_LEVEL) {
			spin_lock_irqsave(&mb_ioctl_lock, flags);
			mbu = mb_find_mbu((void *)value, tgid,
				MBUFIND_USER|MBUFIND_GETPUT);
			count = mbu ? MB_COUNT(mbu->mb) - 1 : 0xffffffff;
			MB_OPDBG("PUT: addr %lx cnt %x\n\n", value, count);
			spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		}
		ret = mb_do_put(value, tgid, mbti->task_name);
		break;

	/* _IOWR(MB_IOC_MAGIC, 7, unsigned long)
	 *  I: user address
	 *  O: virt address */
	case MBIO_USER_TO_VIRT:
		get_user(value, (unsigned long *)arg);
		virt = mb_do_user_to_virt(value, tgid, mbti->task_name);
		put_user(virt, (unsigned long *)arg);
		MB_OPDBG("USER_TO_VERT: user %8lx virt %lx\n\n", value, virt);
		break;

	/* _IOWR(MB_IOC_MAGIC, 8, unsigned long)
	 *  I: user address
	 *  O: phys address */
	case MBIO_USER_TO_PHYS:
		get_user(value, (unsigned long *)arg);
		phys = mb_do_user_to_phys(value, tgid, mbti->task_name);
		put_user(phys, (unsigned long *)arg);
		MB_OPDBG("USER_TO_PHYS: user %8lx phys %lx\n\n", value, phys);
		break;

#ifdef CONFIG_WMT_MB_RESERVE_FROM_IO
	/* This IOCTRL is provide AP to recognize MB region as framebuffer,
	then can access mb memory directly. */
	case MBIO_FSCREENINFO:
	{
		struct fb_fix_screeninfo ffs;

		if (!wmt_mbah || list_empty(&wmt_mbah->mba_list)) {
			MB_WARN("MBIO_FSCREENINFO: MB driver does not init.\n");
			return -EFAULT;
		}

		mba = (struct mb_area_struct *)wmt_mbah->mba_list.next;
		ffs.smem_start = mba->phys;
		ffs.smem_len = wmt_mbah->tot_static_pages * PAGE_SIZE;
		if (copy_to_user((void __user *)arg, &ffs, sizeof(ffs)))
			ret = -EFAULT;
		MB_OPDBG("FSCREENINFO: phys %lx len %x\n\n",
			ffs.smem_start, ffs.smem_len);
		break;
	}
#endif

	/* _IOW (MB_IOC_MAGIC, 9, unsigned long)
	 *  I: size */
	case MBIO_PREFETCH:
	{
		unsigned long fetch_size = 0;
		get_user(value, (unsigned long *)arg);
#ifdef CONFIG_WMT_MB_DYNAMIC_ALLOCATE_SUPPORT
{
		unsigned long try_size = 0;

		MB_OPDBG("PREFETCH: size %ld KB\n\n", value/1024);
		spin_lock_irqsave(&mb_ioctl_lock, flags);
		while (try_size < value) {
			int order;
			order = get_order(value-fetch_size);
			if (order > MBMAX_ORDER)
				order = MBMAX_ORDER;
			try_size += (1 << order) * PAGE_SIZE;
			mba = mb_alloc_mba(1 << order);
			if (mba) {
				mba->flags |= MBAFLAG_STATIC;
				mba->tgid = current->tgid;
				wmt_mbah->tot_static_pages += mba->pages;
				fetch_size += mba->pages * PAGE_SIZE;
			}
		}
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		MB_INFO("PREFETCH: SIZE %ld / %ld kB by %s\n",
			fetch_size/1024, value/1024, current->comm);
}
#else
		MB_WARN("PREFETCH: SIZE %ld / %ld kB by %s fail\n",
			fetch_size/1024, value/1024, current->comm);
		MB_WARN("PREFETCH: Dynamic Allocated Not Support\n");
		ret = -ENOTTY;
#endif
		break;
	}

	/* _IOW (MB_IOC_MAGIC, 10, unsigned long)
	 *  O: static mba size */
	case MBIO_STATIC_SIZE:
		put_user(wmt_mbah->tot_static_pages * PAGE_SIZE,
			(unsigned long *)arg);
		MB_OPDBG("STATIC_SIZE: size %ld KB\n\n",
			PAGE_KB(wmt_mbah->tot_static_pages));
		break;

	/* _IOWR(MB_IOC_MAGIC,11, unsigned long)
	 *  I: physical address
	 *  O: use counter */
	case MBIO_MB_USER_COUNT:
		get_user(value, (unsigned long *)arg);

		spin_lock_irqsave(&mb_ioctl_lock, flags);
		mb = mb_find_mb((void *)value, MBFIND_PHYS);
		if (mb == NULL)
			size = 0;
		else
			size = MB_COUNT(mb);
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);

		put_user(size, (unsigned long *)arg);
		MB_OPDBG("USER_COUNT: addr %lx count %ld\n\n", value, size);
		break;

	/* _IO  (MB_IOC_MAGIC,12) */
	case MBIO_FORCE_RESET:
		spin_lock_irqsave(&mb_ioctl_lock, flags);
RESCAN_MBA:
		list_loop(mba, &wmt_mbah->mba_list, mba_list) {
			list_loop(mb, &mba->mb_list, mb_list) {
				list_loop(
					mbu, &mb->mbu_list, mbu_list) {
					list_del(&mbu->mbu_list);
					kmem_cache_free(
						wmt_mbah->mbu_cachep, mbu);
				}
				mb->creator = NULL;
				atomic_set(&mb->count, 0);
				mb_free_mb(mb);
				/* because mba link maybe breaken */
				goto RESCAN_MBA;
			}
		}
		mb_update_mbah();
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		MB_OPDBG("RESET: OK\n\n");
		break;

	/* _IOW (MB_IOC_MAGIC,13, unsigned long) // I: phys address */
	case MBIO_GET_BY_PHYS:
		get_user(value, (unsigned long *)arg);
		if (!value || !mbti->task_name || tgid == MB_DEF_TGID) {
			MB_WARN("GET(phys): invalid args %lx/%d/%s\n",
				value, tgid, mbti->task_name);
			return -EINVAL;
		}

		mbu = kmem_cache_alloc(wmt_mbah->mbu_cachep, GFP_ATOMIC);
		if (!mbu) {
			MB_WARN("GET(phys): mbu_cachep out of memory\n");
			return -ENOMEM;
		}

		spin_lock_irqsave(&mb_do_lock, flags);
		mb = mb_find_mb((void *)value, MBFIND_PHYS);
		if (!mb) {
			spin_unlock_irqrestore(&mb_do_lock, flags);
			kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
			MB_WARN("GET(phys): unknown phys %8lx name %s\n",
				value, mbti->task_name);
			return -EFAULT;
		}

		memset(mbu, 0x0, sizeof(struct mb_user));
		INIT_LIST_HEAD(&mbu->mbu_list);
		mbu->addr = value;
		mbu->mb = mb;
		mbu->tgid = tgid;
		len = strlen(mbti->task_name);
		if (len > TASK_COMM_LEN)
			len = TASK_COMM_LEN;
		strncpy(mbu->the_user, mbti->task_name, len);
		mbu->the_user[len] = 0;
		atomic_inc(&mb->count);
		list_add_tail(&mbu->mbu_list, &mb->mbu_list);
		spin_unlock_irqrestore(&mb_do_lock, flags);
		MB_OPDBG("GET(phys): phys %8lx cnt %x\n\n",
			value, MB_COUNT(mb));
		break;

	/* _IOW (MB_IOC_MAGIC,14, unsigned long) // I: phys address */
	case MBIO_PUT_BY_PHYS:
		get_user(value, (unsigned long *)arg);
		if (!value || !mbti->task_name || tgid == MB_DEF_TGID) {
			MB_WARN("PUT(phys): invalid args %lx/%d/%s\n",
				value, tgid, mbti->task_name);
			return -EINVAL;
		}

		spin_lock_irqsave(&mb_do_lock, flags);
		mbu = mb_find_mbu((void *)value, tgid,
			MBUFIND_PHYS|MBUFIND_GETPUT);
		if (!mbu) {
			spin_unlock_irqrestore(&mb_do_lock, flags);
			MB_WARN("PUT(phys): unknow phys %8lx name %s\n",
				value, mbti->task_name);
			return -EINVAL;
		}

		mb = mbu->mb;
		if (!MB_IN_USE(mb)) {
			spin_unlock_irqrestore(&mb_do_lock, flags);
			MB_WARN("PUT(phys): phys %8lx unbalance.\n", value);
			return -EPERM;
		}

		list_del_init(&mbu->mbu_list);
		atomic_dec(&mb->count);
		size = MB_COUNT(mb);
		/* retrieve unused block */
		if (!size)
			mb_free_mb(mb);

		spin_unlock_irqrestore(&mb_do_lock, flags);
		kmem_cache_free(wmt_mbah->mbu_cachep, mbu);

		MB_OPDBG("PUT(phys): phys %8lx cnt %lx\n\n", value, size);

		break;

	/* _IOW (MB_IOC_MAGIC,15, unsigned long) // I: user address */
	case MBIO_SYNC_CACHE:
		get_user(value, (unsigned long *)arg);
		spin_lock_irqsave(&mb_ioctl_lock, flags);
		mbu = mb_find_mbu((void *)value, tgid,
			MBUFIND_USER|MBUFIND_MMAP);
		if (mbu == NULL) {
			spin_unlock_irqrestore(&mb_ioctl_lock, flags);
			MB_WARN("SYNC_CACHE: invalid addr %lx\n\n", value);
			return -EFAULT;
		}
		mb = mbu->mb;
		size = mbu->size;
		dmac_flush_range(mb->virt, mb->virt + size);
		outer_flush_range(mb->phys, mb->phys + size);
		MB_OPDBG("SYNC_CACHE: (%lx # %lx) V %p ~ %p P %lx ~ %lx\n\n",
			value, size, mb->virt, mb->virt + size,
			mb->phys, mb->phys + size);
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		return 0;

	default:
		ret = -ENOTTY;
		break;
	}

	return ret;
}

static int mb_mmap(struct file *filp, struct vm_area_struct *vma)
{
	struct mb_user *mbu = NULL;
	struct mb_task_info *mbti;
	struct mb_struct *mb;
	unsigned long off, flags;
	unsigned int len;
	pid_t tgid;
	size_t ns;

	if (!filp || !filp->private_data) {
		MB_ERROR("mmap with null file info or task.\n");
		return -EFAULT;
	}

	mbti = (struct mb_task_info *)(filp->private_data);
	tgid = mbti->tgid;
	if (tgid != current->tgid) {
		MB_WARN("mmap within diff task.\n");
		MB_WARN("Open: task %s TGID %x VS Curr: task %s TGID %x\n",
			mbti->task_name, tgid, current->comm, current->tgid);
	}

	off = vma->vm_pgoff << PAGE_SHIFT;
	MB_DBG("IN, offset %lx TGID %x name %s\n", off, tgid, mbti->task_name);
#ifdef CONFIG_WMT_MB_RESERVE_FROM_IO
	/* if page offset under MB total size, it means page offset
	 * is not physical address from MB_alloc and then map function
	 * works like framebuffer.
	 * Suppose MB total size will not cross MBAH phys start address */
	if (vma->vm_pgoff <= wmt_mbah->tot_static_pages) {
		struct mb_area_struct *mba = NULL;
		unsigned long mbtotal =
			wmt_mbah->tot_static_pages << PAGE_SHIFT;
		if ((vma->vm_end - vma->vm_start + off) > mbtotal) {
			MB_ERROR("mmap io fail. range %lx @ [%lx, %lx] s %lx\n",
				off, vma->vm_start, vma->vm_end, mbtotal);
			return -EINVAL;
		}
		mba = (struct mb_area_struct *)wmt_mbah->mba_list.next;
		vma->vm_pgoff += mba->phys >> PAGE_SHIFT;
		vma->vm_flags |= VM_IO | VM_RESERVED;
		if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
			vma->vm_end - vma->vm_start, vma->vm_page_prot)) {
			MB_ERROR("mmap io fail. (io_remap pfn %lx len %lx)\n",
				vma->vm_pgoff, vma->vm_end - vma->vm_start);
			return -EAGAIN;
		}
		MB_OPDBG("MAP: IO from %lx to %lx/%lx size %ld\n\n",
			vma->vm_pgoff << PAGE_SHIFT,
			vma->vm_start, vma->vm_end,
			vma->vm_end - vma->vm_start);
		return 0;
	}
#endif

	mbu = kmem_cache_alloc(wmt_mbah->mbu_cachep, GFP_ATOMIC);
	if (!mbu) {
		MB_ERROR("mbu_cachep out of memory.\n");
		return -ENOMEM;
	}

	spin_lock_irqsave(&mb_ioctl_lock, flags);
	mb = mb_find_mb((void *)off, MBFIND_PHYS);
	if (!mb) {
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
		MB_ERROR("map addr %lx not exist in MB.\n", off);
		return -EINVAL;
	}

	len = PAGE_ALIGN(mb->phys + mb->size);
	if ((vma->vm_end - vma->vm_start + off) > len) {
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
		return -EINVAL;
	}

	memset(mbu, 0x0, sizeof(struct mb_user));
	INIT_LIST_HEAD(&mbu->mbu_list);
	mbu->tgid = tgid;
	mbu->mb = mb;
	mbu->addr = vma->vm_start;
	mbu->size = vma->vm_end - vma->vm_start;
	ns = strlen(mbti->task_name);
	if (ns > TASK_COMM_LEN)
		ns = TASK_COMM_LEN;
	strncpy(mbu->the_user, mbti->task_name, ns);
	mbu->the_user[ns] = 0;
	list_add_tail(&mbu->mbu_list, &mb->mbu_list);
	atomic_inc(&mb->count);

	off = mb->phys;
	spin_unlock_irqrestore(&mb_ioctl_lock, flags);

	vma->vm_flags |= VM_IO | VM_RESERVED;
	if (!(mb->flags & MBFLAG_CACHED))
		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
	if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
		vma->vm_end - vma->vm_start, vma->vm_page_prot)) {
		spin_lock_irqsave(&mb_ioctl_lock, flags);
		list_del(&mbu->mbu_list);
		atomic_dec(&mb->count);
		kmem_cache_free(wmt_mbah->mbu_cachep, mbu);
		spin_unlock_irqrestore(&mb_ioctl_lock, flags);
		MB_ERROR("virtual address memory map fail.\n");
		return -EAGAIN;
	}

	MB_OPDBG("MAP: IO from %lx to %lx/%lx size %ld mbcnt %d\n\n",
		off, vma->vm_start, vma->vm_end,
		(vma->vm_end - vma->vm_start), MB_COUNT(mb));

	return 0;
}

/*!*************************************************************************
    driver file operations struct define
****************************************************************************/
const struct file_operations mb_fops = {
	.owner = THIS_MODULE,
	.open = mb_open,
	.release = mb_release,
	.unlocked_ioctl = mb_ioctl,
	.mmap = mb_mmap,
};

static int mb_probe(struct platform_device *dev)
{
	struct mb_area_struct *mba = NULL, *bind = NULL;
	unsigned long flags;
	int ret = 0;
	dev_t dev_no;

	dev_no = MKDEV(mb_dev_major, mb_dev_minor);

	if (wmt_mbah) {
		MB_ERROR("%s dirty.\n", DEVICE_NAME);
		return -EINVAL;
	}

	/* register char device */
	mb_cdev = cdev_alloc();
	if (!mb_cdev) {
		MB_ERROR("alloc dev error.\n");
		return -ENOMEM;
	}

	cdev_init(mb_cdev, &mb_fops);
	ret = cdev_add(mb_cdev, dev_no, 1);

	if (ret) {
		MB_ERROR("reg char dev error(%d).\n", ret);
		cdev_del(mb_cdev);
		return ret;
	}

	wmt_mbah = kmalloc(sizeof(struct mba_host_struct), GFP_ATOMIC);
	if (!wmt_mbah) {
		MB_ERROR("out of memory (mb_area_struct).\n");
		cdev_del(mb_cdev);
		return -ENOMEM;
	}
	memset(wmt_mbah, 0x0, sizeof(struct mba_host_struct));

	wmt_mbah->mba_cachep = kmem_cache_create("mb_area_struct",
		sizeof(struct mb_area_struct),
		0,
		SLAB_HWCACHE_ALIGN,
		NULL);
	if (!wmt_mbah->mba_cachep) {
		MB_ERROR("out of memory (mba_cachep).\n");
		kfree(wmt_mbah);
		cdev_del(mb_cdev);
		return -ENOMEM;
	}

	wmt_mbah->mb_cachep = kmem_cache_create("mb_struct",
		sizeof(struct mb_struct),
		0,
		SLAB_HWCACHE_ALIGN,
		NULL);
	if (!wmt_mbah->mb_cachep) {
		MB_ERROR("out of memory (mb_cachep).\n");
		kmem_cache_destroy(wmt_mbah->mba_cachep);
		kfree(wmt_mbah);
		cdev_del(mb_cdev);
		return -ENOMEM;
	}

	wmt_mbah->mbu_cachep = kmem_cache_create("mb_user",
		sizeof(struct mb_user),
		0,
		SLAB_HWCACHE_ALIGN,
		NULL);
	if (!wmt_mbah->mbu_cachep) {
		MB_ERROR("out of memory (mbu_cachep).\n");
		kmem_cache_destroy(wmt_mbah->mb_cachep);
		kmem_cache_destroy(wmt_mbah->mba_cachep);
		kfree(wmt_mbah);
		cdev_del(mb_cdev);
		return -ENOMEM;
	}

	wmt_mbah->mbti_cachep = kmem_cache_create("mb_task_info",
		sizeof(struct mb_task_info),
		0,
		SLAB_HWCACHE_ALIGN,
		NULL);
	if (!wmt_mbah->mbti_cachep) {
		MB_ERROR("out of memory (mbti_cachep).\n");
		kmem_cache_destroy(wmt_mbah->mbu_cachep);
		kmem_cache_destroy(wmt_mbah->mb_cachep);
		kmem_cache_destroy(wmt_mbah->mba_cachep);
		kfree(wmt_mbah);
		cdev_del(mb_cdev);
		return -ENOMEM;
	}

	MBMAX_ORDER = MBA_MAX_ORDER;
	MBMIN_ORDER = MBA_MIN_ORDER;
	INIT_LIST_HEAD(&wmt_mbah->mba_list);
	INIT_LIST_HEAD(&wmt_mbti.mbti_list);

	spin_lock_init(&mb_do_lock);
	spin_lock_init(&mb_search_lock);
	spin_lock_init(&mb_ioctl_lock);
	spin_lock_init(&mb_task_mm_lock);
	spin_lock_init(&mb_task_lock);

	MB_INFO("Preparing VIDEO BUFFER (SIZE %d kB) ...\n", MB_TOTAL_SIZE);
	spin_lock_irqsave(&mb_do_lock, flags);
	while (PAGE_KB(wmt_mbah->tot_static_pages) < MB_TOTAL_SIZE) {
		int pages = MB_TOTAL_SIZE*1024 -
			wmt_mbah->tot_static_pages * PAGE_SIZE;
		pages = min((pages >> PAGE_SHIFT), (int)(1 << MBMAX_ORDER));
		mba = mb_alloc_mba(pages);
		if (mba) {
			mba->flags |= MBAFLAG_STATIC;
			mba->tgid = MB_DEF_TGID;
			wmt_mbah->tot_static_pages += mba->pages;
			/* conbine to continue mba if possible */
			if (bind && bind->pgi.pfn_end == mba->pgi.pfn_start) {
				MB_COMBIND_MBA(bind, mba);
				continue;
			}
			if (bind && bind->pgi.pfn_start == mba->pgi.pfn_end)
				MB_COMBIND_MBA(mba, bind);
			bind = mba;
		}
	}
	spin_unlock_irqrestore(&mb_do_lock, flags);

	mb_update_mbah();
	MB_INFO("MB version: %d.%d.%d.%d\n",
		MB_VERSION_MAJOR, MB_VERSION_MINOR,
		MB_VERSION_MICRO, MB_VERSION_BUILD);
	MB_INFO("MAX MB Area size: Max %ld Kb Min %ld Kb\n",
		PAGE_KB(1 << MBMAX_ORDER), PAGE_KB(1 << MBMIN_ORDER));
	MB_INFO("prob /dev/%s major %d, minor %d\n",
		DEVICE_NAME, mb_dev_major, mb_dev_minor);

	return ret;
}

static int mb_remove(struct platform_device *dev)
{
	if (mb_cdev)
		cdev_del(mb_cdev);

	if (wmt_mbah) {
		if (wmt_mbah->mba_cachep)
			kmem_cache_destroy(wmt_mbah->mba_cachep);
		if (wmt_mbah->mb_cachep)
			kmem_cache_destroy(wmt_mbah->mb_cachep);
		if (wmt_mbah->mbu_cachep)
			kmem_cache_destroy(wmt_mbah->mbu_cachep);
		if (wmt_mbah->mbti_cachep)
			kmem_cache_destroy(wmt_mbah->mbti_cachep);
		kfree(wmt_mbah);
	}

	MB_INFO("MB dev remove\n");
	return 0;
}

static int mb_suspend(struct platform_device *dev, pm_message_t state)
{
	MB_DBG("MB get suspend, Event %d.\n", state.event);
	return 0;
}

static int mb_resume(struct platform_device *dev)
{
	MB_DBG("MB get resume.\n");
	return 0;
}

int mb_area_read_proc(
	char *buf, char **start, off_t off,
	int count, int *eof, void *data
)
{
	struct mb_area_struct *mba;
	struct free_area *fa;
	struct zone *zone;
	unsigned long flags;
	unsigned int idx = 1;
	char *p = buf, *base = (char *)data;
	int datalen = 0, len;

	if (!data || !count) {
		p += sprintf(p, "no resource for mb_area read proc. (%p,%d)\n",
			data, count);
		return p-buf;
	}

	if (!wmt_mbah) {
		p += sprintf(p, "no MB area host existed.\n");
		return p-buf;
	}

	spin_lock_irqsave(&mb_ioctl_lock, flags);
	if (!off) { /* re read mb area information */
		p = base;
		memset(p, 0x0, MBPROC_BUFSIZE);

		/* show block information */
		p += sprintf(p, "VERSION:                  %3d.%3d.%3d.%3d\n",
			MB_VERSION_MAJOR, MB_VERSION_MINOR,
			MB_VERSION_MICRO, MB_VERSION_BUILD);
		p += sprintf(p, "MESSAGE LEVEL:       %8d   /%8lx\n",
			MBMSG_LEVEL, __pa(&MBMSG_LEVEL));
		p += sprintf(p, "STATIC MB SIZE:   %8ld MB   /%5d MB\n",
			PAGE_KB(wmt_mbah->tot_static_pages)/1024,
			MB_TOTAL_SIZE/1024);
		p += sprintf(p, "MAX MBA ORDER:       %8d   /%8lx\n",
			MBMAX_ORDER, __pa(&MBMAX_ORDER));
		p += sprintf(p, "MIN MBA ORDER:       %8d   /%8lx\n\n",
			MBMIN_ORDER, __pa(&MBMIN_ORDER));
		p += sprintf(p, "USER TO PRDT METHOD: %8d   /%8lx\n\n",
			USR2PRDT_METHOD, __pa(&USR2PRDT_METHOD));
		p += sprintf(p, "total MB areas:      %8d\n",
			wmt_mbah->nr_mba);
		p += sprintf(p, "total size:          %8ld kB\n",
			PAGE_KB(wmt_mbah->tot_pages));
		p += sprintf(p, "total free size:     %8ld kB\n",
			PAGE_KB(wmt_mbah->tot_free_pages));
		p += sprintf(p, "max MB size:         %8ld kB\n\n",
			PAGE_KB(wmt_mbah->max_available_pages));

		list_loop(mba, &wmt_mbah->mba_list, mba_list) {
			p += sprintf(p, "(ID) [MB Area] VirtAddr PhysAddr  ");
			p += sprintf(p, "size [   zs,   ze] MBs      Max/");
			p += sprintf(p, "    Free Ste\n");
			len = (int)(p-base);
			if ((MBPROC_BUFSIZE - len) < 12) {
				p += sprintf(p, " more ...\n");
				break;
			}
			p += sprintf(p, "(%2d)", idx++);
			len = (int)(p-base);
			/* show all MBs */
			/* -2 is for \n and zero */
			p += mb_show_mba(mba, NULL, p,
				MBPROC_BUFSIZE - len - 2, 1);
			p += sprintf(p, "\n");
		}
		/* show memory fragment */
		zone = (first_online_pgdat())->node_zones;
		fa = zone->free_area;
		p += sprintf(p, "DMA ZONE:\n");
		for (idx = 0; idx < MAX_ORDER; idx++)
			p += sprintf(p, " %5ld * %5ldkB = %5ld kB\n",
				fa[idx].nr_free, PAGE_KB((1<<idx)),
				fa[idx].nr_free * PAGE_KB((1<<idx)));
		p += sprintf(p, " ------------------------------\n");
		p += sprintf(p, "               + = %ld kB\n\n",
			PAGE_KB((unsigned long)nr_free_pages()));
	}
	spin_unlock_irqrestore(&mb_ioctl_lock, flags);
	datalen = strlen(base);
	if (off >= datalen) {
		*eof = 1;
		return 0;
	}
	len = min((int)(datalen - off), count);
	memcpy(buf, &base[off], len);
	*start = (char *)len; /* for case1: *start < page, mass read data */

	return len;
}

static struct platform_driver mb_driver = {
	.driver.name    = "wmt_mb",
	.probe          = mb_probe,
	.remove         = mb_remove,
	.suspend        = mb_suspend,
	.resume         = mb_resume
};

static void mb_platform_release(struct device *device)
{
	return;
}

static struct platform_device mb_device = {
	.name          = "wmt_mb",
	.id            = 0,
	.dev           = { .release =  mb_platform_release, },
	.num_resources = 0,
	.resource      = NULL,
};

static int __init mb_init(void)
{
	int varlen = 32, ret = -1, mbtotal = 0;
	unsigned char buf[32];
	dev_t dev_no;

	mb_dev_major = MB_MAJOR;
	mb_dev_minor = 0;
	mb_dev_nr = 1;

	dev_no = MKDEV(mb_dev_major, mb_dev_minor);
	ret = register_chrdev_region(dev_no, mb_dev_nr, "wmt_mb");
	if (ret < 0) {
		MB_ERROR("can't get %s device major %d\n",
			DEVICE_NAME, mb_dev_major);
		return ret;
	}

	if (wmt_getsyspara("mbsize", buf, &varlen) == 0) {
		sscanf(buf, "%dM", &mbtotal);
		mbtotal *= 1024;
		MB_INFO("Set MB total size %d KB\n", mbtotal);
		if (mbtotal > 0)
			MB_TOTAL_SIZE = mbtotal;
	}

	wmt_mbah = NULL;
	MBMSG_LEVEL = MBMAX_ORDER = MBMIN_ORDER = USR2PRDT_METHOD = 0;
	mb_dev_class = class_create(THIS_MODULE, "mbdev");
	device_create(mb_dev_class, NULL, dev_no, NULL, "mbdev");

#ifdef CONFIG_PROC_FS
	{
		void *proc_buffer = kmalloc(MBPROC_BUFSIZE, GFP_KERNEL);
		struct proc_dir_entry *res = NULL;
		if (proc_buffer) {
			memset(proc_buffer, 0x0, MBPROC_BUFSIZE);
			res = create_proc_entry("mbinfo", 0, NULL);
			if (res) {
				res->read_proc = mb_area_read_proc;
				res->data = proc_buffer;
				MB_DBG("create MB proc\n");
			} else
				kfree(proc_buffer);
		}
	}
#endif

	ret = platform_driver_register(&mb_driver);
	if (!ret) {
		ret = platform_device_register(&mb_device);
		if (ret)
			platform_driver_unregister(&mb_driver);
	}

	return ret;
}

/* because mb will not exit from system, not need to release proc resource */
static void __exit mb_exit(void)
{
	dev_t dev_no;

	platform_driver_unregister(&mb_driver);
	platform_device_unregister(&mb_device);
	dev_no = MKDEV(mb_dev_major, mb_dev_minor);
	device_destroy(mb_dev_class, dev_no);
	class_destroy(mb_dev_class);
	unregister_chrdev_region(dev_no, mb_dev_nr);

	return;
}

fs_initcall(mb_init);
module_exit(mb_exit);

MODULE_AUTHOR("WonderMedia Technologies, Inc.");
MODULE_DESCRIPTION("memory block driver");
MODULE_LICENSE("GPL");