drivers/ieee1394/raw1394.c

   1 /*
   2  * IEEE 1394 for Linux
   3  *
   4  * Raw interface to the bus
   5  *
   6  * Copyright (C) 1999, 2000 Andreas E. Bombe
   7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
   8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
   9  *
  10  * This code is licensed under the GPL.  See the file COPYING in the root
  11  * directory of the kernel sources for details.
  12  *
  13  *
  14  * Contributions:
  15  *
  16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
  17  *        configuration ROM manipulation
  18  *        address range mapping
  19  *        adaptation for new (transparent) loopback mechanism
  20  *        sending of arbitrary async packets
  21  * Christian Toegel <christian.toegel@gmx.at>
  22  *        address range mapping
  23  *        lock64 request
  24  *        transmit physical packet
  25  *        busreset notification control (switch on/off)
  26  *        busreset with selection of type (short/long)
  27  *        request_reply
  28  */
  29
  30 #include <linux/kernel.h>
  31 #include <linux/list.h>
  32 #include <linux/string.h>
  33 #include <linux/slab.h>
  34 #include <linux/fs.h>
  35 #include <linux/poll.h>
  36 #include <linux/module.h>
  37 #include <linux/init.h>
  38 #include <linux/smp_lock.h>
  39 #include <linux/interrupt.h>
  40 #include <linux/vmalloc.h>
  41 #include <linux/cdev.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/atomic.h>
  44 #include <linux/devfs_fs_kernel.h>
  45
  46 #include "csr1212.h"
  47 #include "ieee1394.h"
  48 #include "ieee1394_types.h"
  49 #include "ieee1394_core.h"
  50 #include "nodemgr.h"
  51 #include "hosts.h"
  52 #include "highlevel.h"
  53 #include "iso.h"
  54 #include "ieee1394_transactions.h"
  55 #include "raw1394.h"
  56 #include "raw1394-private.h"
  57
  58 #if BITS_PER_LONG == 64
  59 #define int2ptr(x) ((void __user *)x)
  60 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
  61 #else
  62 #define int2ptr(x) ((void __user *)(u32)x)
  63 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
  64 #endif
  65
  66 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
  67 #define RAW1394_DEBUG
  68 #endif
  69
  70 #ifdef RAW1394_DEBUG
  71 #define DBGMSG(fmt, args...) \
  72 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
  73 #else
  74 #define DBGMSG(fmt, args...)
  75 #endif
  76
  77 static LIST_HEAD(host_info_list);
  78 static int host_count;
  79 static spinlock_t host_info_lock = SPIN_LOCK_UNLOCKED;
  80 static atomic_t internal_generation = ATOMIC_INIT(0);
  81
  82 static atomic_t iso_buffer_size;
  83 static const int iso_buffer_max = 4 * 1024 * 1024; /* 4 MB */
  84
  85 static struct hpsb_highlevel raw1394_highlevel;
  86
  87 static int arm_read (struct hpsb_host *host, int nodeid, quadlet_t *buffer,
  88                      u64 addr, size_t length, u16 flags);
  89 static int arm_write (struct hpsb_host *host, int nodeid, int destid,
  90                       quadlet_t *data, u64 addr, size_t length, u16 flags);
  91 static int arm_lock (struct hpsb_host *host, int nodeid, quadlet_t *store,
  92              u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode, u16 flags);
  93 static int arm_lock64 (struct hpsb_host *host, int nodeid, octlet_t *store,
  94                u64 addr, octlet_t data, octlet_t arg, int ext_tcode, u16 flags);
  95 static struct hpsb_address_ops arm_ops = {
  96         .read   = arm_read,
  97         .write  = arm_write,
  98         .lock   = arm_lock,
  99         .lock64 = arm_lock64,
 100 };
 101
 102 static void queue_complete_cb(struct pending_request *req);
 103
 104 static struct pending_request *__alloc_pending_request(int flags)
 105 {
 106         struct pending_request *req;
 107
 108         req = (struct pending_request *)kmalloc(sizeof(struct pending_request),
 109                                                 flags);
 110         if (req != NULL) {
 111                 memset(req, 0, sizeof(struct pending_request));
 112                 INIT_LIST_HEAD(&req->list);
 113         }
 114
 115         return req;
 116 }
 117
 118 static inline struct pending_request *alloc_pending_request(void)
 119 {
 120         return __alloc_pending_request(SLAB_KERNEL);
 121 }
 122
 123 static void free_pending_request(struct pending_request *req)
 124 {
 125         if (req->ibs) {
 126                 if (atomic_dec_and_test(&req->ibs->refcount)) {
 127                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
 128                         kfree(req->ibs);
 129                 }
 130         } else if (req->free_data) {
 131                 kfree(req->data);
 132         }
 133         hpsb_free_packet(req->packet);
 134         kfree(req);
 135 }
 136
 137 /* fi->reqlists_lock must be taken */
 138 static void __queue_complete_req(struct pending_request *req)
 139 {
 140         struct file_info *fi = req->file_info;
 141         list_del(&req->list);
 142         list_add_tail(&req->list, &fi->req_complete);
 143
 144         up(&fi->complete_sem);
 145         wake_up_interruptible(&fi->poll_wait_complete);
 146 }
 147
 148 static void queue_complete_req(struct pending_request *req)
 149 {
 150         unsigned long flags;
 151         struct file_info *fi = req->file_info;
 152
 153         spin_lock_irqsave(&fi->reqlists_lock, flags);
 154         __queue_complete_req(req);
 155         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 156 }
 157
 158 static void queue_complete_cb(struct pending_request *req)
 159 {
 160         struct hpsb_packet *packet = req->packet;
 161         int rcode = (packet->header[1] >> 12) & 0xf;
 162
 163         switch (packet->ack_code) {
 164         case ACKX_NONE:
 165         case ACKX_SEND_ERROR:
 166                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 167                 break;
 168         case ACKX_ABORTED:
 169                 req->req.error = RAW1394_ERROR_ABORTED;
 170                 break;
 171         case ACKX_TIMEOUT:
 172                 req->req.error = RAW1394_ERROR_TIMEOUT;
 173                 break;
 174         default:
 175                 req->req.error = (packet->ack_code << 16) | rcode;
 176                 break;
 177         }
 178
 179         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
 180                 req->req.length = 0;
 181         }
 182
 183         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
 184             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
 185             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
 186             (req->req.type == RAW1394_REQ_LOCK) ||
 187             (req->req.type == RAW1394_REQ_LOCK64))
 188                 hpsb_free_tlabel(packet);
 189
 190         queue_complete_req(req);
 191 }
 192
 193
 194 static void add_host(struct hpsb_host *host)
 195 {
 196         struct host_info *hi;
 197         unsigned long flags;
 198
 199         hi = (struct host_info *)kmalloc(sizeof(struct host_info), GFP_KERNEL);
 200
 201         if (hi != NULL) {
 202                 INIT_LIST_HEAD(&hi->list);
 203                 hi->host = host;
 204                 INIT_LIST_HEAD(&hi->file_info_list);
 205
 206                 spin_lock_irqsave(&host_info_lock, flags);
 207                 list_add_tail(&hi->list, &host_info_list);
 208                 host_count++;
 209                 spin_unlock_irqrestore(&host_info_lock, flags);
 210         }
 211
 212         atomic_inc(&internal_generation);
 213 }
 214
 215
 216 static struct host_info *find_host_info(struct hpsb_host *host)
 217 {
 218         struct host_info *hi;
 219
 220         list_for_each_entry(hi, &host_info_list, list)
 221                 if (hi->host == host)
 222                         return hi;
 223
 224         return NULL;
 225 }
 226
 227 static void remove_host(struct hpsb_host *host)
 228 {
 229         struct host_info *hi;
 230         unsigned long flags;
 231
 232         spin_lock_irqsave(&host_info_lock, flags);
 233         hi = find_host_info(host);
 234
 235         if (hi != NULL) {
 236                 list_del(&hi->list);
 237                 host_count--;
 238                 /*
 239                    FIXME: address ranges should be removed
 240                    and fileinfo states should be initialized
 241                    (including setting generation to
 242                    internal-generation ...)
 243                 */
 244         }
 245         spin_unlock_irqrestore(&host_info_lock, flags);
 246
 247         if (hi == NULL) {
 248                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
 249                        "0x%p\n", host);
 250                 return;
 251         }
 252
 253         kfree(hi);
 254
 255         atomic_inc(&internal_generation);
 256 }
 257
 258 static void host_reset(struct hpsb_host *host)
 259 {
 260         unsigned long flags;
 261         struct host_info *hi;
 262         struct file_info *fi;
 263         struct pending_request *req;
 264
 265         spin_lock_irqsave(&host_info_lock, flags);
 266         hi = find_host_info(host);
 267
 268         if (hi != NULL) {
 269                 list_for_each_entry(fi, &hi->file_info_list, list) {
 270                         if (fi->notification == RAW1394_NOTIFY_ON) {
 271                                 req = __alloc_pending_request(SLAB_ATOMIC);
 272
 273                                 if (req != NULL) {
 274                                         req->file_info = fi;
 275                                         req->req.type = RAW1394_REQ_BUS_RESET;
 276                                         req->req.generation = get_hpsb_generation(host);
 277                                         req->req.misc = (host->node_id << 16)
 278                                                 | host->node_count;
 279                                         if (fi->protocol_version > 3) {
 280                                                 req->req.misc |= (NODEID_TO_NODE(host->irm_id)
 281                                                                   << 8);
 282                                         }
 283
 284                                         queue_complete_req(req);
 285                                 }
 286                         }
 287                 }
 288         }
 289         spin_unlock_irqrestore(&host_info_lock, flags);
 290 }
 291
 292 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t *data,
 293                         size_t length)
 294 {
 295         unsigned long flags;
 296         struct host_info *hi;
 297         struct file_info *fi;
 298         struct pending_request *req, *req_next;
 299         struct iso_block_store *ibs = NULL;
 300         LIST_HEAD(reqs);
 301
 302         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 303                 HPSB_INFO("dropped iso packet");
 304                 return;
 305         }
 306
 307         spin_lock_irqsave(&host_info_lock, flags);
 308         hi = find_host_info(host);
 309
 310         if (hi != NULL) {
 311                 list_for_each_entry(fi, &hi->file_info_list, list) {
 312                         if (!(fi->listen_channels & (1ULL << channel)))
 313                                 continue;
 314
 315                         req = __alloc_pending_request(SLAB_ATOMIC);
 316                         if (!req) break;
 317
 318                         if (!ibs) {
 319                                 ibs = kmalloc(sizeof(struct iso_block_store)
 320                                               + length, SLAB_ATOMIC);
 321                                 if (!ibs) {
 322                                         kfree(req);
 323                                         break;
 324                                 }
 325
 326                                 atomic_add(length, &iso_buffer_size);
 327                                 atomic_set(&ibs->refcount, 0);
 328                                 ibs->data_size = length;
 329                                 memcpy(ibs->data, data, length);
 330                         }
 331
 332                         atomic_inc(&ibs->refcount);
 333
 334                         req->file_info = fi;
 335                         req->ibs = ibs;
 336                         req->data = ibs->data;
 337                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
 338                         req->req.generation = get_hpsb_generation(host);
 339                         req->req.misc = 0;
 340                         req->req.recvb = ptr2int(fi->iso_buffer);
 341                         req->req.length = min(length, fi->iso_buffer_length);
 342
 343                         list_add_tail(&req->list, &reqs);
 344                 }
 345         }
 346         spin_unlock_irqrestore(&host_info_lock, flags);
 347
 348         list_for_each_entry_safe(req, req_next, &reqs, list)
 349                 queue_complete_req(req);
 350 }
 351
 352 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
 353                         int cts, u8 *data, size_t length)
 354 {
 355         unsigned long flags;
 356         struct host_info *hi;
 357         struct file_info *fi;
 358         struct pending_request *req, *req_next;
 359         struct iso_block_store *ibs = NULL;
 360         LIST_HEAD(reqs);
 361
 362         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 363                 HPSB_INFO("dropped fcp request");
 364                 return;
 365         }
 366
 367         spin_lock_irqsave(&host_info_lock, flags);
 368         hi = find_host_info(host);
 369
 370         if (hi != NULL) {
 371                 list_for_each_entry(fi, &hi->file_info_list, list) {
 372                         if (!fi->fcp_buffer)
 373                                 continue;
 374
 375                         req = __alloc_pending_request(SLAB_ATOMIC);
 376                         if (!req) break;
 377
 378                         if (!ibs) {
 379                                 ibs = kmalloc(sizeof(struct iso_block_store)
 380                                               + length, SLAB_ATOMIC);
 381                                 if (!ibs) {
 382                                         kfree(req);
 383                                         break;
 384                                 }
 385
 386                                 atomic_add(length, &iso_buffer_size);
 387                                 atomic_set(&ibs->refcount, 0);
 388                                 ibs->data_size = length;
 389                                 memcpy(ibs->data, data, length);
 390                         }
 391
 392                         atomic_inc(&ibs->refcount);
 393
 394                         req->file_info = fi;
 395                         req->ibs = ibs;
 396                         req->data = ibs->data;
 397                         req->req.type = RAW1394_REQ_FCP_REQUEST;
 398                         req->req.generation = get_hpsb_generation(host);
 399                         req->req.misc = nodeid | (direction << 16);
 400                         req->req.recvb = ptr2int(fi->fcp_buffer);
 401                         req->req.length = length;
 402
 403                         list_add_tail(&req->list, &reqs);
 404                 }
 405         }
 406         spin_unlock_irqrestore(&host_info_lock, flags);
 407
 408         list_for_each_entry_safe(req, req_next, &reqs, list)
 409                 queue_complete_req(req);
 410 }
 411
 412
 413 static ssize_t raw1394_read(struct file *file, char __user *buffer, size_t count,
 414                     loff_t *offset_is_ignored)
 415 {
 416         struct file_info *fi = (struct file_info *)file->private_data;
 417         struct list_head *lh;
 418         struct pending_request *req;
 419
 420         if (count != sizeof(struct raw1394_request)) {
 421                 return -EINVAL;
 422         }
 423
 424         if (!access_ok(VERIFY_WRITE, buffer, count)) {
 425                 return -EFAULT;
 426         }
 427
 428         if (file->f_flags & O_NONBLOCK) {
 429                 if (down_trylock(&fi->complete_sem)) {
 430                         return -EAGAIN;
 431                 }
 432         } else {
 433                 if (down_interruptible(&fi->complete_sem)) {
 434                         return -ERESTARTSYS;
 435                 }
 436         }
 437
 438         spin_lock_irq(&fi->reqlists_lock);
 439         lh = fi->req_complete.next;
 440         list_del(lh);
 441         spin_unlock_irq(&fi->reqlists_lock);
 442
 443         req = list_entry(lh, struct pending_request, list);
 444
 445         if (req->req.length) {
 446                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
 447                                  req->req.length)) {
 448                         req->req.error = RAW1394_ERROR_MEMFAULT;
 449                 }
 450         }
 451         __copy_to_user(buffer, &req->req, sizeof(req->req));
 452
 453         free_pending_request(req);
 454         return sizeof(struct raw1394_request);
 455 }
 456
 457
 458 static int state_opened(struct file_info *fi, struct pending_request *req)
 459 {
 460         if (req->req.type == RAW1394_REQ_INITIALIZE) {
 461                 switch (req->req.misc) {
 462                 case RAW1394_KERNELAPI_VERSION:
 463                 case 3:
 464                         fi->state = initialized;
 465                         fi->protocol_version = req->req.misc;
 466                         req->req.error = RAW1394_ERROR_NONE;
 467                         req->req.generation = atomic_read(&internal_generation);
 468                         break;
 469
 470                 default:
 471                         req->req.error = RAW1394_ERROR_COMPAT;
 472                         req->req.misc = RAW1394_KERNELAPI_VERSION;
 473                 }
 474         } else {
 475                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 476         }
 477
 478         req->req.length = 0;
 479         queue_complete_req(req);
 480         return sizeof(struct raw1394_request);
 481 }
 482
 483 static int state_initialized(struct file_info *fi, struct pending_request *req)
 484 {
 485         struct host_info *hi;
 486         struct raw1394_khost_list *khl;
 487
 488         if (req->req.generation != atomic_read(&internal_generation)) {
 489                 req->req.error = RAW1394_ERROR_GENERATION;
 490                 req->req.generation = atomic_read(&internal_generation);
 491                 req->req.length = 0;
 492                 queue_complete_req(req);
 493                 return sizeof(struct raw1394_request);
 494         }
 495
 496         switch (req->req.type) {
 497         case RAW1394_REQ_LIST_CARDS:
 498                 spin_lock_irq(&host_info_lock);
 499                 khl = kmalloc(sizeof(struct raw1394_khost_list) * host_count,
 500                               SLAB_ATOMIC);
 501
 502                 if (khl != NULL) {
 503                         req->req.misc = host_count;
 504                         req->data = (quadlet_t *)khl;
 505
 506                         list_for_each_entry(hi, &host_info_list, list) {
 507                                 khl->nodes = hi->host->node_count;
 508                                 strcpy(khl->name, hi->host->driver->name);
 509                                 khl++;
 510                         }
 511                 }
 512                 spin_unlock_irq(&host_info_lock);
 513
 514                 if (khl != NULL) {
 515                         req->req.error = RAW1394_ERROR_NONE;
 516                         req->req.length = min(req->req.length,
 517                                               (u32)(sizeof(struct raw1394_khost_list)
 518                                               * req->req.misc));
 519                         req->free_data = 1;
 520                 } else {
 521                         return -ENOMEM;
 522                 }
 523                 break;
 524
 525         case RAW1394_REQ_SET_CARD:
 526                 spin_lock_irq(&host_info_lock);
 527                 if (req->req.misc < host_count) {
 528                         list_for_each_entry(hi, &host_info_list, list) {
 529                                 if (!req->req.misc--)
 530                                         break;
 531                         }
 532                         get_device(&hi->host->device); // XXX Need to handle failure case
 533                         list_add_tail(&fi->list, &hi->file_info_list);
 534                         fi->host = hi->host;
 535                         fi->state = connected;
 536
 537                         req->req.error = RAW1394_ERROR_NONE;
 538                         req->req.generation = get_hpsb_generation(fi->host);
 539                         req->req.misc = (fi->host->node_id << 16)
 540                                 | fi->host->node_count;
 541                         if (fi->protocol_version > 3) {
 542                                 req->req.misc |= NODEID_TO_NODE(fi->host->irm_id) << 8;
 543                         }
 544                 } else {
 545                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 546                 }
 547                 spin_unlock_irq(&host_info_lock);
 548
 549                 req->req.length = 0;
 550                 break;
 551
 552         default:
 553                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 554                 req->req.length = 0;
 555                 break;
 556         }
 557
 558         queue_complete_req(req);
 559         return sizeof(struct raw1394_request);
 560 }
 561
 562 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
 563 {
 564         int channel = req->req.misc;
 565
 566         spin_lock_irq(&host_info_lock);
 567         if ((channel > 63) || (channel < -64)) {
 568                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 569         } else if (channel >= 0) {
 570                 /* allocate channel req.misc */
 571                 if (fi->listen_channels & (1ULL << channel)) {
 572                         req->req.error = RAW1394_ERROR_ALREADY;
 573                 } else {
 574                         if (hpsb_listen_channel(&raw1394_highlevel, fi->host, channel)) {
 575                                 req->req.error = RAW1394_ERROR_ALREADY;
 576                         } else {
 577                                 fi->listen_channels |= 1ULL << channel;
 578                                 fi->iso_buffer = int2ptr(req->req.recvb);
 579                                 fi->iso_buffer_length = req->req.length;
 580                         }
 581                 }
 582         } else {
 583                 /* deallocate channel (one's complement neg) req.misc */
 584                 channel = ~channel;
 585
 586                 if (fi->listen_channels & (1ULL << channel)) {
 587                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, channel);
 588                         fi->listen_channels &= ~(1ULL << channel);
 589                 } else {
 590                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 591                 }
 592         }
 593
 594         req->req.length = 0;
 595         queue_complete_req(req);
 596         spin_unlock_irq(&host_info_lock);
 597 }
 598
 599 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
 600 {
 601         if (req->req.misc) {
 602                 if (fi->fcp_buffer) {
 603                         req->req.error = RAW1394_ERROR_ALREADY;
 604                 } else {
 605                         fi->fcp_buffer = int2ptr(req->req.recvb);
 606                 }
 607         } else {
 608                 if (!fi->fcp_buffer) {
 609                         req->req.error = RAW1394_ERROR_ALREADY;
 610                 } else {
 611                         fi->fcp_buffer = NULL;
 612                 }
 613         }
 614
 615         req->req.length = 0;
 616         queue_complete_req(req);
 617 }
 618
 619
 620 static int handle_async_request(struct file_info *fi,
 621                                 struct pending_request *req, int node)
 622 {
 623         struct hpsb_packet *packet = NULL;
 624         u64 addr = req->req.address & 0xffffffffffffULL;
 625
 626         switch (req->req.type) {
 627         case RAW1394_REQ_ASYNC_READ:
 628                 DBGMSG("read_request called");
 629                 packet = hpsb_make_readpacket(fi->host, node, addr, req->req.length);
 630
 631                 if (!packet)
 632                         return -ENOMEM;
 633
 634                 if (req->req.length == 4)
 635                         req->data = &packet->header[3];
 636                 else
 637                         req->data = packet->data;
 638
 639                 break;
 640
 641         case RAW1394_REQ_ASYNC_WRITE:
 642                 DBGMSG("write_request called");
 643
 644                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
 645                                                req->req.length);
 646                 if (!packet)
 647                         return -ENOMEM;
 648
 649                 if (req->req.length == 4) {
 650                         if (copy_from_user(&packet->header[3], int2ptr(req->req.sendb),
 651                                         req->req.length))
 652                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 653                 } else {
 654                         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 655                                         req->req.length))
 656                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 657                 }
 658
 659                 req->req.length = 0;
 660             break;
 661
 662         case RAW1394_REQ_ASYNC_STREAM:
 663                 DBGMSG("stream_request called");
 664
 665                 packet = hpsb_make_streampacket(fi->host, NULL, req->req.length, node & 0x3f/*channel*/,
 666                                         (req->req.misc >> 16) & 0x3, req->req.misc & 0xf);
 667                 if (!packet)
 668                         return -ENOMEM;
 669
 670                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 671                                    req->req.length))
 672                         req->req.error = RAW1394_ERROR_MEMFAULT;
 673
 674                 req->req.length = 0;
 675                 break;
 676
 677         case RAW1394_REQ_LOCK:
 678                 DBGMSG("lock_request called");
 679                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 680                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 681                         if (req->req.length != 4) {
 682                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 683                                 break;
 684                         }
 685                 } else {
 686                         if (req->req.length != 8) {
 687                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 688                                 break;
 689                         }
 690                 }
 691
 692                 packet = hpsb_make_lockpacket(fi->host, node, addr,
 693                                               req->req.misc, NULL, 0);
 694                 if (!packet) return -ENOMEM;
 695
 696                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 697                                    req->req.length)) {
 698                         req->req.error = RAW1394_ERROR_MEMFAULT;
 699                         break;
 700                 }
 701
 702                 req->data = packet->data;
 703                 req->req.length = 4;
 704                 break;
 705
 706         case RAW1394_REQ_LOCK64:
 707                 DBGMSG("lock64_request called");
 708                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 709                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 710                         if (req->req.length != 8) {
 711                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 712                                 break;
 713                         }
 714                 } else {
 715                         if (req->req.length != 16) {
 716                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 717                                 break;
 718                         }
 719                 }
 720                 packet = hpsb_make_lock64packet(fi->host, node, addr,
 721                                                 req->req.misc, NULL, 0);
 722                 if (!packet) return -ENOMEM;
 723
 724                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 725                                    req->req.length)) {
 726                         req->req.error = RAW1394_ERROR_MEMFAULT;
 727                         break;
 728                 }
 729
 730                 req->data = packet->data;
 731                 req->req.length = 8;
 732                 break;
 733
 734         default:
 735                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 736         }
 737
 738         req->packet = packet;
 739
 740         if (req->req.error) {
 741                 req->req.length = 0;
 742                 queue_complete_req(req);
 743                 return sizeof(struct raw1394_request);
 744         }
 745
 746         hpsb_set_packet_complete_task(packet, (void(*)(void*))queue_complete_cb, req);
 747
 748         spin_lock_irq(&fi->reqlists_lock);
 749         list_add_tail(&req->list, &fi->req_pending);
 750         spin_unlock_irq(&fi->reqlists_lock);
 751
 752         packet->generation = req->req.generation;
 753
 754         if (hpsb_send_packet(packet) < 0) {
 755                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 756                 req->req.length = 0;
 757                 hpsb_free_tlabel(packet);
 758                 queue_complete_req(req);
 759         }
 760         return sizeof(struct raw1394_request);
 761 }
 762
 763 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
 764                            int channel)
 765 {
 766         struct hpsb_packet *packet;
 767
 768         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
 769                                      (req->req.misc >> 16) & 0x3, req->req.misc & 0xf);
 770         if (!packet)
 771                 return -ENOMEM;
 772
 773         packet->speed_code = req->req.address & 0x3;
 774
 775         req->packet = packet;
 776
 777         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 778                            req->req.length)) {
 779                 req->req.error = RAW1394_ERROR_MEMFAULT;
 780                 req->req.length = 0;
 781                 queue_complete_req(req);
 782                 return sizeof(struct raw1394_request);
 783         }
 784
 785         req->req.length = 0;
 786         hpsb_set_packet_complete_task(packet, (void (*)(void*))queue_complete_req, req);
 787
 788         spin_lock_irq(&fi->reqlists_lock);
 789         list_add_tail(&req->list, &fi->req_pending);
 790         spin_unlock_irq(&fi->reqlists_lock);
 791
 792         /* Update the generation of the packet just before sending. */
 793         packet->generation = req->req.generation;
 794
 795         if (hpsb_send_packet(packet) < 0) {
 796                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 797                 queue_complete_req(req);
 798         }
 799
 800         return sizeof(struct raw1394_request);
 801 }
 802
 803 static int handle_async_send(struct file_info *fi, struct pending_request *req)
 804 {
 805         struct hpsb_packet *packet;
 806         int header_length = req->req.misc & 0xffff;
 807         int expect_response = req->req.misc >> 16;
 808
 809         if ((header_length > req->req.length) ||
 810             (header_length  < 12)) {
 811                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 812                 req->req.length = 0;
 813                 queue_complete_req(req);
 814                 return sizeof(struct raw1394_request);
 815         }
 816
 817         packet = hpsb_alloc_packet(req->req.length-header_length);
 818         req->packet = packet;
 819         if (!packet) return -ENOMEM;
 820
 821         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
 822                            header_length)) {
 823                 req->req.error = RAW1394_ERROR_MEMFAULT;
 824                 req->req.length = 0;
 825                 queue_complete_req(req);
 826                 return sizeof(struct raw1394_request);
 827         }
 828
 829         if (copy_from_user(packet->data, int2ptr(req->req.sendb) + header_length,
 830                            packet->data_size)) {
 831                 req->req.error = RAW1394_ERROR_MEMFAULT;
 832                 req->req.length = 0;
 833                 queue_complete_req(req);
 834                 return sizeof(struct raw1394_request);
 835         }
 836
 837         packet->type = hpsb_async;
 838         packet->node_id = packet->header[0] >> 16;
 839         packet->tcode = (packet->header[0] >> 4) & 0xf;
 840         packet->tlabel = (packet->header[0] >> 10) &0x3f;
 841         packet->host = fi->host;
 842         packet->expect_response = expect_response;
 843         packet->header_size=header_length;
 844         packet->data_size=req->req.length-header_length;
 845
 846         req->req.length = 0;
 847         hpsb_set_packet_complete_task(packet, (void(*)(void*))queue_complete_cb, req);
 848
 849         spin_lock_irq(&fi->reqlists_lock);
 850         list_add_tail(&req->list, &fi->req_pending);
 851         spin_unlock_irq(&fi->reqlists_lock);
 852
 853         /* Update the generation of the packet just before sending. */
 854         packet->generation = req->req.generation;
 855
 856         if (hpsb_send_packet(packet) < 0) {
 857                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 858                 queue_complete_req(req);
 859         }
 860
 861         return sizeof(struct raw1394_request);
 862 }
 863
 864 static int arm_read (struct hpsb_host *host, int nodeid, quadlet_t *buffer,
 865                      u64 addr, size_t length, u16 flags)
 866 {
 867         struct pending_request *req;
 868         struct host_info *hi;
 869         struct file_info *fi = NULL;
 870         struct list_head *entry;
 871         struct arm_addr  *arm_addr = NULL;
 872         struct arm_request  *arm_req = NULL;
 873         struct arm_response *arm_resp = NULL;
 874         int found=0, size=0, rcode=-1;
 875         struct arm_request_response *arm_req_resp = NULL;
 876
 877         DBGMSG("arm_read  called by node: %X"
 878               "addr: %4.4x %8.8x length: %Zu", nodeid,
 879               (u16) ((addr >>32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
 880               length);
 881         spin_lock(&host_info_lock);
 882         hi = find_host_info(host); /* search address-entry */
 883         if (hi != NULL) {
 884                 list_for_each_entry(fi, &hi->file_info_list, list) {
 885                         entry = fi->addr_list.next;
 886                         while (entry != &(fi->addr_list)) {
 887                                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
 888                                 if (((arm_addr->start) <= (addr)) &&
 889                                         ((arm_addr->end) >= (addr+length))) {
 890                                         found = 1;
 891                                         break;
 892                                 }
 893                                 entry = entry->next;
 894                         }
 895                         if (found) {
 896                                 break;
 897                         }
 898                 }
 899         }
 900         rcode = -1;
 901         if (!found) {
 902                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
 903                 " -> rcode_address_error\n");
 904                 spin_unlock(&host_info_lock);
 905                 return (RCODE_ADDRESS_ERROR);
 906         } else {
 907                 DBGMSG("arm_read addr_entry FOUND");
 908         }
 909         if (arm_addr->rec_length < length) {
 910                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
 911                 rcode = RCODE_DATA_ERROR; /* hardware error, data is unavailable */
 912         }
 913         if (rcode == -1) {
 914                 if (arm_addr->access_rights & ARM_READ) {
 915                         if (!(arm_addr->client_transactions & ARM_READ)) {
 916                                 memcpy(buffer,(arm_addr->addr_space_buffer)+(addr-(arm_addr->start)),
 917                                        length);
 918                                 DBGMSG("arm_read -> (rcode_complete)");
 919                                 rcode = RCODE_COMPLETE;
 920                         }
 921                 } else {
 922                         rcode = RCODE_TYPE_ERROR; /* function not allowed */
 923                         DBGMSG("arm_read -> rcode_type_error (access denied)");
 924                 }
 925         }
 926         if (arm_addr->notification_options & ARM_READ) {
 927                 DBGMSG("arm_read -> entering notification-section");
 928                 req = __alloc_pending_request(SLAB_ATOMIC);
 929                 if (!req) {
 930                         DBGMSG("arm_read -> rcode_conflict_error");
 931                         spin_unlock(&host_info_lock);
 932                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
 933                                                         The request may be retried */
 934                 }
 935                 if (rcode == RCODE_COMPLETE) {
 936                         size =  sizeof(struct arm_request)+sizeof(struct arm_response) +
 937                                 length * sizeof(byte_t) +
 938                                 sizeof (struct arm_request_response);
 939                 } else {
 940                         size =  sizeof(struct arm_request)+sizeof(struct arm_response) +
 941                                 sizeof (struct arm_request_response);
 942                 }
 943                 req->data = kmalloc(size, SLAB_ATOMIC);
 944                 if (!(req->data)) {
 945                         free_pending_request(req);
 946                         DBGMSG("arm_read -> rcode_conflict_error");
 947                         spin_unlock(&host_info_lock);
 948                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
 949                                                         The request may be retried */
 950                 }
 951                 req->free_data=1;
 952                 req->file_info = fi;
 953                 req->req.type = RAW1394_REQ_ARM;
 954                 req->req.generation = get_hpsb_generation(host);
 955                 req->req.misc = ( ((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
 956                 req->req.tag  = arm_addr->arm_tag;
 957                 req->req.recvb = arm_addr->recvb;
 958                 req->req.length = size;
 959                 arm_req_resp = (struct arm_request_response *) (req->data);
 960                 arm_req  = (struct arm_request *) ((byte_t *)(req->data) +
 961                         (sizeof (struct arm_request_response)));
 962                 arm_resp = (struct arm_response *) ((byte_t *)(arm_req) +
 963                         (sizeof(struct arm_request)));
 964                 arm_req->buffer  = NULL;
 965                 arm_resp->buffer = NULL;
 966                 if (rcode == RCODE_COMPLETE) {
 967                         byte_t *buf = (byte_t *)arm_resp + sizeof(struct arm_response);
 968                         memcpy (buf,
 969                                 (arm_addr->addr_space_buffer)+(addr-(arm_addr->start)),
 970                                 length);
 971                         arm_resp->buffer = int2ptr((arm_addr->recvb) +
 972                                 sizeof (struct arm_request_response) +
 973                                 sizeof (struct arm_request) +
 974                                 sizeof (struct arm_response));
 975                 }
 976                 arm_resp->buffer_length = (rcode == RCODE_COMPLETE) ? length : 0;
 977                 arm_resp->response_code = rcode;
 978                 arm_req->buffer_length = 0;
 979                 arm_req->generation = req->req.generation;
 980                 arm_req->extended_transaction_code = 0;
 981                 arm_req->destination_offset = addr;
 982                 arm_req->source_nodeid = nodeid;
 983                 arm_req->destination_nodeid = host->node_id;
 984                 arm_req->tlabel = (flags >> 10) & 0x3f;
 985                 arm_req->tcode = (flags >> 4) & 0x0f;
 986                 arm_req_resp->request  = int2ptr((arm_addr->recvb) +
 987                         sizeof (struct arm_request_response));
 988                 arm_req_resp->response = int2ptr((arm_addr->recvb) +
 989                         sizeof (struct arm_request_response) +
 990                         sizeof (struct arm_request));
 991                 queue_complete_req(req);
 992         }
 993         spin_unlock(&host_info_lock);
 994         return(rcode);
 995 }
 996
 997 static int arm_write (struct hpsb_host *host, int nodeid, int destid,
 998                       quadlet_t *data, u64 addr, size_t length, u16 flags)
 999 {
1000         struct pending_request *req;
1001         struct host_info *hi;
1002         struct file_info *fi = NULL;
1003         struct list_head *entry;
1004         struct arm_addr  *arm_addr = NULL;
1005         struct arm_request  *arm_req = NULL;
1006         struct arm_response *arm_resp = NULL;
1007         int found=0, size=0, rcode=-1, length_conflict=0;
1008         struct arm_request_response *arm_req_resp = NULL;
1009
1010         DBGMSG("arm_write called by node: %X"
1011               "addr: %4.4x %8.8x length: %Zu", nodeid,
1012               (u16) ((addr >>32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1013               length);
1014         spin_lock(&host_info_lock);
1015         hi = find_host_info(host); /* search address-entry */
1016         if (hi != NULL) {
1017                 list_for_each_entry(fi, &hi->file_info_list, list) {
1018                         entry = fi->addr_list.next;
1019                         while (entry != &(fi->addr_list)) {
1020                                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1021                                 if (((arm_addr->start) <= (addr)) &&
1022                                         ((arm_addr->end) >= (addr+length))) {
1023                                         found = 1;
1024                                         break;
1025                                 }
1026                                 entry = entry->next;
1027                         }
1028                         if (found) {
1029                                 break;
1030                         }
1031                 }
1032         }
1033         rcode = -1;
1034         if (!found) {
1035                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1036                 " -> rcode_address_error\n");
1037                 spin_unlock(&host_info_lock);
1038                 return (RCODE_ADDRESS_ERROR);
1039         } else {
1040                 DBGMSG("arm_write addr_entry FOUND");
1041         }
1042         if (arm_addr->rec_length < length) {
1043                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1044                 length_conflict = 1;
1045                 rcode = RCODE_DATA_ERROR; /* hardware error, data is unavailable */
1046         }
1047         if (rcode == -1) {
1048                 if (arm_addr->access_rights & ARM_WRITE) {
1049                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1050                                 memcpy((arm_addr->addr_space_buffer)+(addr-(arm_addr->start)),
1051                                         data, length);
1052                                 DBGMSG("arm_write -> (rcode_complete)");
1053                                 rcode = RCODE_COMPLETE;
1054                         }
1055                 } else {
1056                         rcode = RCODE_TYPE_ERROR; /* function not allowed */
1057                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1058                 }
1059         }
1060         if (arm_addr->notification_options & ARM_WRITE) {
1061                 DBGMSG("arm_write -> entering notification-section");
1062                 req = __alloc_pending_request(SLAB_ATOMIC);
1063                 if (!req) {
1064                         DBGMSG("arm_write -> rcode_conflict_error");
1065                         spin_unlock(&host_info_lock);
1066                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
1067                                                         The request my be retried */
1068                 }
1069                 size =  sizeof(struct arm_request)+sizeof(struct arm_response) +
1070                         (length) * sizeof(byte_t) +
1071                         sizeof (struct arm_request_response);
1072                 req->data = kmalloc(size, SLAB_ATOMIC);
1073                 if (!(req->data)) {
1074                         free_pending_request(req);
1075                         DBGMSG("arm_write -> rcode_conflict_error");
1076                         spin_unlock(&host_info_lock);
1077                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
1078                                                         The request may be retried */
1079                 }
1080                 req->free_data=1;
1081                 req->file_info = fi;
1082                 req->req.type = RAW1394_REQ_ARM;
1083                 req->req.generation = get_hpsb_generation(host);
1084                 req->req.misc = ( ((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1085                 req->req.tag  = arm_addr->arm_tag;
1086                 req->req.recvb = arm_addr->recvb;
1087                 req->req.length = size;
1088                 arm_req_resp = (struct arm_request_response *) (req->data);
1089                 arm_req  = (struct arm_request *) ((byte_t *)(req->data) +
1090                         (sizeof (struct arm_request_response)));
1091                 arm_resp = (struct arm_response *) ((byte_t *)(arm_req) +
1092                         (sizeof(struct arm_request)));
1093                 arm_resp->buffer = NULL;
1094                 memcpy ((byte_t *)arm_resp + sizeof(struct arm_response),
1095                         data, length);
1096                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1097                         sizeof (struct arm_request_response) +
1098                         sizeof (struct arm_request) +
1099                         sizeof (struct arm_response));
1100                 arm_req->buffer_length = length;
1101                 arm_req->generation = req->req.generation;
1102                 arm_req->extended_transaction_code = 0;
1103                 arm_req->destination_offset = addr;
1104                 arm_req->source_nodeid = nodeid;
1105                 arm_req->destination_nodeid = destid;
1106                 arm_req->tlabel = (flags >> 10) & 0x3f;
1107                 arm_req->tcode = (flags >> 4) & 0x0f;
1108                 arm_resp->buffer_length = 0;
1109                 arm_resp->response_code = rcode;
1110                 arm_req_resp->request  = int2ptr((arm_addr->recvb) +
1111                         sizeof (struct arm_request_response));
1112                 arm_req_resp->response = int2ptr((arm_addr->recvb) +
1113                         sizeof (struct arm_request_response) +
1114                         sizeof (struct arm_request));
1115                 queue_complete_req(req);
1116         }
1117         spin_unlock(&host_info_lock);
1118         return(rcode);
1119 }
1120
1121 static int arm_lock (struct hpsb_host *host, int nodeid, quadlet_t *store,
1122              u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode, u16 flags)
1123 {
1124         struct pending_request *req;
1125         struct host_info *hi;
1126         struct file_info *fi = NULL;
1127         struct list_head *entry;
1128         struct arm_addr  *arm_addr = NULL;
1129         struct arm_request  *arm_req = NULL;
1130         struct arm_response *arm_resp = NULL;
1131         int found=0, size=0, rcode=-1;
1132         quadlet_t old, new;
1133         struct arm_request_response *arm_req_resp = NULL;
1134
1135         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1136                 ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1137                 DBGMSG("arm_lock  called by node: %X "
1138                       "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1139                       nodeid, (u16) ((addr >>32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1140                       ext_tcode & 0xFF , be32_to_cpu(data));
1141         } else {
1142                 DBGMSG("arm_lock  called by node: %X "
1143                       "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1144                       nodeid, (u16) ((addr >>32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1145                       ext_tcode & 0xFF , be32_to_cpu(data), be32_to_cpu(arg));
1146         }
1147         spin_lock(&host_info_lock);
1148         hi = find_host_info(host); /* search address-entry */
1149         if (hi != NULL) {
1150                 list_for_each_entry(fi, &hi->file_info_list, list) {
1151                         entry = fi->addr_list.next;
1152                         while (entry != &(fi->addr_list)) {
1153                                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1154                                 if (((arm_addr->start) <= (addr)) &&
1155                                         ((arm_addr->end) >= (addr+sizeof(*store)))) {
1156                                         found = 1;
1157                                         break;
1158                                 }
1159                                 entry = entry->next;
1160                         }
1161                         if (found) {
1162                                 break;
1163                         }
1164                 }
1165         }
1166         rcode = -1;
1167         if (!found) {
1168                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1169                 " -> rcode_address_error\n");
1170                 spin_unlock(&host_info_lock);
1171                 return (RCODE_ADDRESS_ERROR);
1172         } else {
1173                 DBGMSG("arm_lock addr_entry FOUND");
1174         }
1175         if (rcode == -1) {
1176                 if (arm_addr->access_rights & ARM_LOCK) {
1177                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1178                                 memcpy(&old,(arm_addr->addr_space_buffer)+(addr-(arm_addr->start)),
1179                                         sizeof(old));
1180                                 switch (ext_tcode) {
1181                                         case (EXTCODE_MASK_SWAP):
1182                                                 new = data | (old & ~arg);
1183                                                 break;
1184                                         case (EXTCODE_COMPARE_SWAP):
1185                                                 if (old == arg) {
1186                                                         new = data;
1187                                                 } else {
1188                                                         new = old;
1189                                                 }
1190                                                 break;
1191                                         case (EXTCODE_FETCH_ADD):
1192                                                 new = cpu_to_be32(be32_to_cpu(data) + be32_to_cpu(old));
1193                                                 break;
1194                                         case (EXTCODE_LITTLE_ADD):
1195                                                 new = cpu_to_le32(le32_to_cpu(data) + le32_to_cpu(old));
1196                                                 break;
1197                                         case (EXTCODE_BOUNDED_ADD):
1198                                                 if (old != arg) {
1199                                                         new = cpu_to_be32(be32_to_cpu(data) +
1200                                                                 be32_to_cpu(old));
1201                                                 } else {
1202                                                         new = old;
1203                                                 }
1204                                                 break;
1205                                         case (EXTCODE_WRAP_ADD):
1206                                                 if (old != arg) {
1207                                                         new = cpu_to_be32(be32_to_cpu(data) +
1208                                                                 be32_to_cpu(old));
1209                                                 } else {
1210                                                         new = data;
1211                                                 }
1212                                                 break;
1213                                         default:
1214                                                 rcode = RCODE_TYPE_ERROR; /* function not allowed */
1215                                                 printk(KERN_ERR "raw1394: arm_lock FAILED "
1216                                                 "ext_tcode not allowed -> rcode_type_error\n");
1217                                                 break;
1218                                 } /*switch*/
1219                                 if (rcode == -1) {
1220                                         DBGMSG("arm_lock -> (rcode_complete)");
1221                                         rcode = RCODE_COMPLETE;
1222                                         memcpy (store, &old, sizeof(*store));
1223                                         memcpy ((arm_addr->addr_space_buffer)+
1224                                                 (addr-(arm_addr->start)),
1225                                                 &new, sizeof(*store));
1226                                 }
1227                         }
1228                 } else {
1229                         rcode = RCODE_TYPE_ERROR; /* function not allowed */
1230                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1231                 }
1232         }
1233         if (arm_addr->notification_options & ARM_LOCK) {
1234                 byte_t *buf1, *buf2;
1235                 DBGMSG("arm_lock -> entering notification-section");
1236                 req = __alloc_pending_request(SLAB_ATOMIC);
1237                 if (!req) {
1238                         DBGMSG("arm_lock -> rcode_conflict_error");
1239                         spin_unlock(&host_info_lock);
1240                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
1241                                                         The request may be retried */
1242                 }
1243                 size =  sizeof(struct arm_request)+sizeof(struct arm_response) +
1244                         3 * sizeof(*store) +
1245                         sizeof (struct arm_request_response);  /* maximum */
1246                 req->data = kmalloc(size, SLAB_ATOMIC);
1247                 if (!(req->data)) {
1248                         free_pending_request(req);
1249                         DBGMSG("arm_lock -> rcode_conflict_error");
1250                         spin_unlock(&host_info_lock);
1251                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
1252                                                         The request may be retried */
1253                 }
1254                 req->free_data=1;
1255                 arm_req_resp = (struct arm_request_response *) (req->data);
1256                 arm_req  = (struct arm_request *) ((byte_t *)(req->data) +
1257                         (sizeof (struct arm_request_response)));
1258                 arm_resp = (struct arm_response *) ((byte_t *)(arm_req) +
1259                         (sizeof(struct arm_request)));
1260                 buf1 = (byte_t *)arm_resp + sizeof(struct arm_response);
1261                 buf2 = buf1 + 2 * sizeof(*store);
1262                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1263                         (ext_tcode == EXTCODE_LITTLE_ADD)) {
1264                         arm_req->buffer_length = sizeof(*store);
1265                         memcpy (buf1, &data, sizeof(*store));
1266
1267                 } else {
1268                         arm_req->buffer_length = 2 * sizeof(*store);
1269                         memcpy (buf1, &arg,  sizeof(*store));
1270                         memcpy (buf1 + sizeof(*store), &data, sizeof(*store));
1271                 }
1272                 if (rcode == RCODE_COMPLETE) {
1273                         arm_resp->buffer_length = sizeof(*store);
1274                         memcpy (buf2, &old, sizeof(*store));
1275                 } else {
1276                         arm_resp->buffer_length = 0;
1277                 }
1278                 req->file_info = fi;
1279                 req->req.type = RAW1394_REQ_ARM;
1280                 req->req.generation = get_hpsb_generation(host);
1281                 req->req.misc = ( (((sizeof(*store)) << 16) & (0xFFFF0000)) |
1282                         (ARM_LOCK & 0xFF));
1283                 req->req.tag  = arm_addr->arm_tag;
1284                 req->req.recvb = arm_addr->recvb;
1285                 req->req.length = size;
1286                 arm_req->generation = req->req.generation;
1287                 arm_req->extended_transaction_code = ext_tcode;
1288                 arm_req->destination_offset = addr;
1289                 arm_req->source_nodeid = nodeid;
1290                 arm_req->destination_nodeid = host->node_id;
1291                 arm_req->tlabel = (flags >> 10) & 0x3f;
1292                 arm_req->tcode = (flags >> 4) & 0x0f;
1293                 arm_resp->response_code = rcode;
1294                 arm_req_resp->request  = int2ptr((arm_addr->recvb) +
1295                         sizeof (struct arm_request_response));
1296                 arm_req_resp->response = int2ptr((arm_addr->recvb) +
1297                         sizeof (struct arm_request_response) +
1298                         sizeof (struct arm_request));
1299                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1300                         sizeof (struct arm_request_response) +
1301                         sizeof (struct arm_request) +
1302                         sizeof (struct arm_response));
1303                 arm_resp->buffer = int2ptr((arm_addr->recvb) +
1304                         sizeof (struct arm_request_response) +
1305                         sizeof (struct arm_request) +
1306                         sizeof (struct arm_response) +
1307                         2* sizeof (*store));
1308                 queue_complete_req(req);
1309         }
1310         spin_unlock(&host_info_lock);
1311         return(rcode);
1312 }
1313
1314 static int arm_lock64 (struct hpsb_host *host, int nodeid, octlet_t *store,
1315                u64 addr, octlet_t data, octlet_t arg, int ext_tcode, u16 flags)
1316 {
1317         struct pending_request *req;
1318         struct host_info *hi;
1319         struct file_info *fi = NULL;
1320         struct list_head *entry;
1321         struct arm_addr  *arm_addr = NULL;
1322         struct arm_request  *arm_req = NULL;
1323         struct arm_response *arm_resp = NULL;
1324         int found=0, size=0, rcode=-1;
1325         octlet_t old, new;
1326         struct arm_request_response *arm_req_resp = NULL;
1327
1328         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1329                 ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1330                 DBGMSG("arm_lock64 called by node: %X "
1331                       "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1332                       nodeid, (u16) ((addr >>32) & 0xFFFF),
1333                       (u32) (addr & 0xFFFFFFFF),
1334                       ext_tcode & 0xFF ,
1335                       (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1336                       (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1337         } else {
1338                 DBGMSG("arm_lock64 called by node: %X "
1339                       "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1340                       "%8.8X %8.8X ",
1341                       nodeid, (u16) ((addr >>32) & 0xFFFF),
1342                       (u32) (addr & 0xFFFFFFFF),
1343                       ext_tcode & 0xFF ,
1344                       (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1345                       (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1346                       (u32) ((be64_to_cpu(arg)  >> 32) & 0xFFFFFFFF),
1347                       (u32) (be64_to_cpu(arg)  & 0xFFFFFFFF));
1348         }
1349         spin_lock(&host_info_lock);
1350         hi = find_host_info(host); /* search addressentry in file_info's for host */
1351         if (hi != NULL) {
1352                 list_for_each_entry(fi, &hi->file_info_list, list) {
1353                         entry = fi->addr_list.next;
1354                         while (entry != &(fi->addr_list)) {
1355                                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1356                                 if (((arm_addr->start) <= (addr)) &&
1357                                         ((arm_addr->end) >= (addr+sizeof(*store)))) {
1358                                         found = 1;
1359                                         break;
1360                                 }
1361                                 entry = entry->next;
1362                         }
1363                         if (found) {
1364                                 break;
1365                         }
1366                 }
1367         }
1368         rcode = -1;
1369         if (!found) {
1370                 printk(KERN_ERR "raw1394: arm_lock64 FAILED addr_entry not found"
1371                 " -> rcode_address_error\n");
1372                 spin_unlock(&host_info_lock);
1373                 return (RCODE_ADDRESS_ERROR);
1374         } else {
1375                 DBGMSG("arm_lock64 addr_entry FOUND");
1376         }
1377         if (rcode == -1) {
1378                 if (arm_addr->access_rights & ARM_LOCK) {
1379                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1380                                 memcpy(&old,(arm_addr->addr_space_buffer)+(addr-(arm_addr->start)),
1381                                         sizeof(old));
1382                                 switch (ext_tcode) {
1383                                         case (EXTCODE_MASK_SWAP):
1384                                                 new = data | (old & ~arg);
1385                                                 break;
1386                                         case (EXTCODE_COMPARE_SWAP):
1387                                                 if (old == arg) {
1388                                                         new = data;
1389                                                 } else {
1390                                                         new = old;
1391                                                 }
1392                                                 break;
1393                                         case (EXTCODE_FETCH_ADD):
1394                                                 new = cpu_to_be64(be64_to_cpu(data) + be64_to_cpu(old));
1395                                                 break;
1396                                         case (EXTCODE_LITTLE_ADD):
1397                                                 new = cpu_to_le64(le64_to_cpu(data) + le64_to_cpu(old));
1398                                                 break;
1399                                         case (EXTCODE_BOUNDED_ADD):
1400                                                 if (old != arg) {
1401                                                         new = cpu_to_be64(be64_to_cpu(data) +
1402                                                                 be64_to_cpu(old));
1403                                                 } else {
1404                                                         new = old;
1405                                                 }
1406                                                 break;
1407                                         case (EXTCODE_WRAP_ADD):
1408                                                 if (old != arg) {
1409                                                         new = cpu_to_be64(be64_to_cpu(data) +
1410                                                                 be64_to_cpu(old));
1411                                                 } else {
1412                                                         new = data;
1413                                                 }
1414                                                 break;
1415                                         default:
1416                                                 printk(KERN_ERR "raw1394: arm_lock64 FAILED "
1417                                                 "ext_tcode not allowed -> rcode_type_error\n");
1418                                                 rcode = RCODE_TYPE_ERROR; /* function not allowed */
1419                                                 break;
1420                                 } /*switch*/
1421                                 if (rcode == -1) {
1422                                         DBGMSG("arm_lock64 -> (rcode_complete)");
1423                                         rcode = RCODE_COMPLETE;
1424                                         memcpy (store, &old, sizeof(*store));
1425                                         memcpy ((arm_addr->addr_space_buffer)+
1426                                                 (addr-(arm_addr->start)),
1427                                                 &new, sizeof(*store));
1428                                 }
1429                         }
1430                 } else {
1431                         rcode = RCODE_TYPE_ERROR; /* function not allowed */
1432                         DBGMSG("arm_lock64 -> rcode_type_error (access denied)");
1433                 }
1434         }
1435         if (arm_addr->notification_options & ARM_LOCK) {
1436                 byte_t *buf1, *buf2;
1437                 DBGMSG("arm_lock64 -> entering notification-section");
1438                 req = __alloc_pending_request(SLAB_ATOMIC);
1439                 if (!req) {
1440                         spin_unlock(&host_info_lock);
1441                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1442                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
1443                                                         The request may be retried */
1444                 }
1445                 size =  sizeof(struct arm_request)+sizeof(struct arm_response) +
1446                         3 * sizeof(*store) +
1447                         sizeof (struct arm_request_response); /* maximum */
1448                 req->data = kmalloc(size, SLAB_ATOMIC);
1449                 if (!(req->data)) {
1450                         free_pending_request(req);
1451                         spin_unlock(&host_info_lock);
1452                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1453                         return(RCODE_CONFLICT_ERROR); /* A resource conflict was detected.
1454                                                         The request may be retried */
1455                 }
1456                 req->free_data=1;
1457                 arm_req_resp = (struct arm_request_response *) (req->data);
1458                 arm_req  = (struct arm_request *) ((byte_t *)(req->data) +
1459                         (sizeof (struct arm_request_response)));
1460                 arm_resp = (struct arm_response *) ((byte_t *)(arm_req) +
1461                         (sizeof(struct arm_request)));
1462                 buf1 = (byte_t *)arm_resp + sizeof(struct arm_response);
1463                 buf2 = buf1 + 2 * sizeof(*store);
1464                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1465                         (ext_tcode == EXTCODE_LITTLE_ADD)) {
1466                         arm_req->buffer_length = sizeof(*store);
1467                         memcpy (buf1, &data, sizeof(*store));
1468
1469                 } else {
1470                         arm_req->buffer_length = 2 * sizeof(*store);
1471                         memcpy (buf1, &arg,  sizeof(*store));
1472                         memcpy (buf1 + sizeof(*store), &data, sizeof(*store));
1473                 }
1474                 if (rcode == RCODE_COMPLETE) {
1475                         arm_resp->buffer_length = sizeof(*store);
1476                         memcpy (buf2, &old, sizeof(*store));
1477                 } else {
1478                         arm_resp->buffer_length = 0;
1479                 }
1480                 req->file_info = fi;
1481                 req->req.type = RAW1394_REQ_ARM;
1482                 req->req.generation = get_hpsb_generation(host);
1483                 req->req.misc = ( (((sizeof(*store)) << 16) & (0xFFFF0000)) |
1484                         (ARM_LOCK & 0xFF));
1485                 req->req.tag  = arm_addr->arm_tag;
1486                 req->req.recvb = arm_addr->recvb;
1487                 req->req.length = size;
1488                 arm_req->generation = req->req.generation;
1489                 arm_req->extended_transaction_code = ext_tcode;
1490                 arm_req->destination_offset = addr;
1491                 arm_req->source_nodeid = nodeid;
1492                 arm_req->destination_nodeid = host->node_id;
1493                 arm_req->tlabel = (flags >> 10) & 0x3f;
1494                 arm_req->tcode = (flags >> 4) & 0x0f;
1495                 arm_resp->response_code = rcode;
1496                 arm_req_resp->request  = int2ptr((arm_addr->recvb) +
1497                         sizeof (struct arm_request_response));
1498                 arm_req_resp->response = int2ptr((arm_addr->recvb) +
1499                         sizeof (struct arm_request_response) +
1500                         sizeof (struct arm_request));
1501                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1502                         sizeof (struct arm_request_response) +
1503                         sizeof (struct arm_request) +
1504                         sizeof (struct arm_response));
1505                 arm_resp->buffer = int2ptr((arm_addr->recvb) +
1506                         sizeof (struct arm_request_response) +
1507                         sizeof (struct arm_request) +
1508                         sizeof (struct arm_response) +
1509                         2* sizeof (*store));
1510                 queue_complete_req(req);
1511         }
1512         spin_unlock(&host_info_lock);
1513         return(rcode);
1514 }
1515
1516 static int arm_register(struct file_info *fi, struct pending_request *req)
1517 {
1518         int retval;
1519         struct arm_addr *addr;
1520         struct host_info *hi;
1521         struct file_info *fi_hlp = NULL;
1522         struct list_head *entry;
1523         struct arm_addr  *arm_addr = NULL;
1524         int same_host, another_host;
1525         unsigned long flags;
1526
1527         DBGMSG("arm_register called "
1528               "addr(Offset): %8.8x %8.8x length: %u "
1529               "rights: %2.2X notify: %2.2X "
1530               "max_blk_len: %4.4X",
1531               (u32) ((req->req.address >>32) & 0xFFFF),
1532               (u32) (req->req.address & 0xFFFFFFFF),
1533               req->req.length, ((req->req.misc >> 8) & 0xFF),
1534               (req->req.misc & 0xFF),((req->req.misc >> 16) & 0xFFFF));
1535         /* check addressrange */
1536         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1537                 (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) != 0)) {
1538                 req->req.length = 0;
1539                 return (-EINVAL);
1540         }
1541         /* addr-list-entry for fileinfo */
1542         addr = (struct arm_addr *)kmalloc(sizeof(struct arm_addr), SLAB_KERNEL);
1543         if (!addr) {
1544                 req->req.length = 0;
1545                 return (-ENOMEM);
1546         }
1547         /* allocation of addr_space_buffer */
1548         addr->addr_space_buffer = (u8 *)vmalloc(req->req.length);
1549         if (!(addr->addr_space_buffer)) {
1550                 kfree(addr);
1551                 req->req.length = 0;
1552                 return (-ENOMEM);
1553         }
1554         /* initialization of addr_space_buffer */
1555         if ((req->req.sendb)== (unsigned long)NULL) {
1556                 /* init: set 0 */
1557                 memset(addr->addr_space_buffer, 0,req->req.length);
1558         } else {
1559                 /* init: user -> kernel */
1560                 if (copy_from_user(addr->addr_space_buffer,int2ptr(req->req.sendb),
1561                         req->req.length)) {
1562                         vfree(addr->addr_space_buffer);
1563                         kfree(addr);
1564                         return (-EFAULT);
1565                 }
1566         }
1567         INIT_LIST_HEAD(&addr->addr_list);
1568         addr->arm_tag   = req->req.tag;
1569         addr->start     = req->req.address;
1570         addr->end       = req->req.address + req->req.length;
1571         addr->access_rights = (u8) (req->req.misc & 0x0F);
1572         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1573         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1574         addr->access_rights |= addr->client_transactions;
1575         addr->notification_options |= addr->client_transactions;
1576         addr->recvb     = req->req.recvb;
1577         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1578         spin_lock_irqsave(&host_info_lock, flags);
1579         hi = find_host_info(fi->host);
1580         same_host = 0;
1581         another_host = 0;
1582         /* same host with address-entry containing same addressrange ? */
1583         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1584                 entry = fi_hlp->addr_list.next;
1585                 while (entry != &(fi_hlp->addr_list)) {
1586                         arm_addr = list_entry(entry, struct arm_addr, addr_list);
1587                         if ( (arm_addr->start == addr->start) &&
1588                                 (arm_addr->end == addr->end)) {
1589                                 DBGMSG("same host ownes same "
1590                                         "addressrange -> EALREADY");
1591                                 same_host = 1;
1592                                 break;
1593                         }
1594                         entry = entry->next;
1595                 }
1596                 if (same_host) {
1597                         break;
1598                 }
1599         }
1600         if (same_host) {
1601                 /* addressrange occupied by same host */
1602                 vfree(addr->addr_space_buffer);
1603                 kfree(addr);
1604                 spin_unlock_irqrestore(&host_info_lock, flags);
1605                 return (-EALREADY);
1606         }
1607         /* another host with valid address-entry containing same addressrange */
1608         list_for_each_entry(hi, &host_info_list, list) {
1609                 if (hi->host != fi->host) {
1610                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1611                                 entry = fi_hlp->addr_list.next;
1612                                 while (entry != &(fi_hlp->addr_list)) {
1613                                         arm_addr = list_entry(entry, struct arm_addr, addr_list);
1614                                         if ( (arm_addr->start == addr->start) &&
1615                                                 (arm_addr->end == addr->end)) {
1616                                                 DBGMSG("another host ownes same "
1617                                                 "addressrange");
1618                                                 another_host = 1;
1619                                                 break;
1620                                         }
1621                                         entry = entry->next;
1622                                 }
1623                                 if (another_host) {
1624                                         break;
1625                                 }
1626                         }
1627                 }
1628         }
1629         if (another_host) {
1630                 DBGMSG("another hosts entry is valid -> SUCCESS");
1631                 if (copy_to_user(int2ptr(req->req.recvb),
1632                         int2ptr(&addr->start),sizeof(u64))) {
1633                         printk(KERN_ERR "raw1394: arm_register failed "
1634                               " address-range-entry is invalid -> EFAULT !!!\n");
1635                         vfree(addr->addr_space_buffer);
1636                         kfree(addr);
1637                         spin_unlock_irqrestore(&host_info_lock, flags);
1638                         return (-EFAULT);
1639                 }
1640                 free_pending_request(req); /* immediate success or fail */
1641                 /* INSERT ENTRY */
1642                 list_add_tail(&addr->addr_list, &fi->addr_list);
1643                 spin_unlock_irqrestore(&host_info_lock, flags);
1644                 return sizeof(struct raw1394_request);
1645         }
1646         retval = hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops, req->req.address,
1647                 req->req.address + req->req.length);
1648         if (retval) {
1649                /* INSERT ENTRY */
1650                list_add_tail(&addr->addr_list, &fi->addr_list);
1651         } else {
1652                 DBGMSG("arm_register failed errno: %d \n",retval);
1653                 vfree(addr->addr_space_buffer);
1654                 kfree(addr);
1655                 spin_unlock_irqrestore(&host_info_lock, flags);
1656                 return (-EALREADY);
1657         }
1658         spin_unlock_irqrestore(&host_info_lock, flags);
1659         free_pending_request(req); /* immediate success or fail */
1660         return sizeof(struct raw1394_request);
1661 }
1662
1663 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1664 {
1665         int found  = 0;
1666         int retval = 0;
1667         struct list_head *entry;
1668         struct arm_addr  *addr = NULL;
1669         struct host_info *hi;
1670         struct file_info *fi_hlp = NULL;
1671         struct arm_addr  *arm_addr = NULL;
1672         int another_host;
1673         unsigned long flags;
1674
1675         DBGMSG("arm_Unregister called addr(Offset): "
1676               "%8.8x %8.8x",
1677               (u32) ((req->req.address >>32) & 0xFFFF),
1678               (u32) (req->req.address & 0xFFFFFFFF));
1679         spin_lock_irqsave(&host_info_lock, flags);
1680         /* get addr */
1681         entry = fi->addr_list.next;
1682         while (entry != &(fi->addr_list)) {
1683                 addr = list_entry(entry, struct arm_addr, addr_list);
1684                 if (addr->start == req->req.address) {
1685                         found = 1;
1686                         break;
1687                 }
1688                 entry = entry->next;
1689         }
1690         if (!found) {
1691                 DBGMSG("arm_Unregister addr not found");
1692                 spin_unlock_irqrestore(&host_info_lock, flags);
1693                 return (-EINVAL);
1694         }
1695         DBGMSG("arm_Unregister addr found");
1696         another_host = 0;
1697         /* another host with valid address-entry containing
1698            same addressrange */
1699         list_for_each_entry(hi, &host_info_list, list) {
1700                 if (hi->host != fi->host) {
1701                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1702                                 entry = fi_hlp->addr_list.next;
1703                                 while (entry != &(fi_hlp->addr_list)) {
1704                                         arm_addr = list_entry(entry,
1705                                                 struct arm_addr, addr_list);
1706                                         if (arm_addr->start ==
1707                                                 addr->start) {
1708                                                 DBGMSG("another host ownes "
1709                                                 "same addressrange");
1710                                                 another_host = 1;
1711                                                 break;
1712                                         }
1713                                         entry = entry->next;
1714                                 }
1715                                 if (another_host) {
1716                                         break;
1717                                 }
1718                         }
1719                 }
1720         }
1721         if (another_host) {
1722                 DBGMSG("delete entry from list -> success");
1723                 list_del(&addr->addr_list);
1724                 vfree(addr->addr_space_buffer);
1725                 kfree(addr);
1726                 free_pending_request(req); /* immediate success or fail */
1727                 spin_unlock_irqrestore(&host_info_lock, flags);
1728                 return sizeof(struct raw1394_request);
1729         }
1730         retval = hpsb_unregister_addrspace(&raw1394_highlevel, fi->host, addr->start);
1731         if (!retval) {
1732                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1733                 spin_unlock_irqrestore(&host_info_lock, flags);
1734                 return (-EINVAL);
1735         }
1736         DBGMSG("delete entry from list -> success");
1737         list_del(&addr->addr_list);
1738         spin_unlock_irqrestore(&host_info_lock, flags);
1739         vfree(addr->addr_space_buffer);
1740         kfree(addr);
1741         free_pending_request(req); /* immediate success or fail */
1742         return sizeof(struct raw1394_request);
1743 }
1744
1745 /* Copy data from ARM buffer(s) to user buffer. */
1746 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1747 {
1748         struct arm_addr  *arm_addr = NULL;
1749         unsigned long flags;
1750         unsigned long offset;
1751
1752         struct list_head *entry;
1753
1754         DBGMSG("arm_get_buf "
1755                "addr(Offset): %04X %08X length: %u",
1756                (u32) ((req->req.address >> 32) & 0xFFFF),
1757                (u32) (req->req.address & 0xFFFFFFFF),
1758                (u32) req->req.length);
1759
1760         spin_lock_irqsave(&host_info_lock, flags);
1761         entry = fi->addr_list.next;
1762         while (entry != &(fi->addr_list)) {
1763                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1764                 if ((arm_addr->start <= req->req.address) &&
1765                     (arm_addr->end > req->req.address)) {
1766                         if (req->req.address + req->req.length <= arm_addr->end) {
1767                                 offset = req->req.address - arm_addr->start;
1768
1769                                 DBGMSG("arm_get_buf copy_to_user( %08X, %p, %u )",
1770                                        (u32) req->req.recvb,
1771                                        arm_addr->addr_space_buffer+offset,
1772                                        (u32) req->req.length);
1773
1774                                 if (copy_to_user(int2ptr(req->req.recvb), arm_addr->addr_space_buffer+offset, req->req.length)) {
1775                                         spin_unlock_irqrestore(&host_info_lock, flags);
1776                                         return (-EFAULT);
1777                                 }
1778
1779                                 spin_unlock_irqrestore(&host_info_lock, flags);
1780                                 /* We have to free the request, because we
1781                                  * queue no response, and therefore nobody
1782                                  * will free it. */
1783                                 free_pending_request(req);
1784                                 return sizeof(struct raw1394_request);
1785                         } else {
1786                                 DBGMSG("arm_get_buf request exceeded mapping");
1787                                 spin_unlock_irqrestore(&host_info_lock, flags);
1788                                 return (-EINVAL);
1789                         }
1790                 }
1791                 entry = entry->next;
1792         }
1793         spin_unlock_irqrestore(&host_info_lock, flags);
1794         return (-EINVAL);
1795 }
1796
1797
1798 /* Copy data from user buffer to ARM buffer(s). */
1799 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
1800 {
1801         struct arm_addr  *arm_addr = NULL;
1802         unsigned long flags;
1803         unsigned long offset;
1804
1805         struct list_head *entry;
1806
1807         DBGMSG("arm_set_buf "
1808                "addr(Offset): %04X %08X length: %u",
1809                (u32) ((req->req.address >> 32) & 0xFFFF),
1810                (u32) (req->req.address & 0xFFFFFFFF),
1811                (u32) req->req.length);
1812
1813
1814         spin_lock_irqsave(&host_info_lock, flags);
1815         entry = fi->addr_list.next;
1816         while (entry != &(fi->addr_list)) {
1817                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1818                 if ((arm_addr->start <= req->req.address) &&
1819                     (arm_addr->end > req->req.address)) {
1820                         if (req->req.address + req->req.length <= arm_addr->end) {
1821                                 offset = req->req.address - arm_addr->start;
1822
1823                                 DBGMSG("arm_set_buf copy_from_user( %p, %08X, %u )",
1824                                        arm_addr->addr_space_buffer+offset,
1825                                        (u32) req->req.sendb,
1826                                        (u32) req->req.length);
1827
1828                                 if (copy_from_user(arm_addr->addr_space_buffer+offset, int2ptr(req->req.sendb), req->req.length)) {
1829                                         spin_unlock_irqrestore(&host_info_lock, flags);
1830                                         return (-EFAULT);
1831                                 }
1832
1833                                 spin_unlock_irqrestore(&host_info_lock, flags);
1834                                 free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
1835                                 return sizeof(struct raw1394_request);
1836                         } else {
1837                                 DBGMSG("arm_set_buf request exceeded mapping");
1838                                 spin_unlock_irqrestore(&host_info_lock, flags);
1839                                 return (-EINVAL);
1840                         }
1841                 }
1842                 entry = entry->next;
1843         }
1844         spin_unlock_irqrestore(&host_info_lock, flags);
1845         return (-EINVAL);
1846 }
1847
1848 static int reset_notification(struct file_info *fi, struct pending_request *req)
1849 {
1850         DBGMSG("reset_notification called - switch %s ",
1851                 (req->req.misc == RAW1394_NOTIFY_OFF)?"OFF":"ON");
1852         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
1853                 (req->req.misc == RAW1394_NOTIFY_ON)) {
1854                 fi->notification=(u8)req->req.misc;
1855                 free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
1856                 return sizeof(struct raw1394_request);
1857         }
1858         /* error EINVAL (22) invalid argument */
1859         return (-EINVAL);
1860 }
1861
1862 static int write_phypacket(struct file_info *fi, struct pending_request *req)
1863 {
1864         struct hpsb_packet *packet = NULL;
1865         int retval=0;
1866         quadlet_t data;
1867
1868         data = be32_to_cpu((u32)req->req.sendb);
1869         DBGMSG("write_phypacket called - quadlet 0x%8.8x ",data);
1870         packet = hpsb_make_phypacket (fi->host, data);
1871         if (!packet) return -ENOMEM;
1872         req->req.length=0;
1873         req->packet=packet;
1874         hpsb_set_packet_complete_task(packet, (void(*)(void*))queue_complete_cb, req);
1875         spin_lock_irq(&fi->reqlists_lock);
1876         list_add_tail(&req->list, &fi->req_pending);
1877         spin_unlock_irq(&fi->reqlists_lock);
1878         packet->generation = req->req.generation;
1879         retval = hpsb_send_packet(packet);
1880         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
1881         if (retval < 0) {
1882                 req->req.error = RAW1394_ERROR_SEND_ERROR;
1883                 req->req.length = 0;
1884                 queue_complete_req(req);
1885         }
1886         return sizeof(struct raw1394_request);
1887 }
1888
1889 static int get_config_rom(struct file_info *fi, struct pending_request *req)
1890 {
1891         int ret=sizeof(struct raw1394_request);
1892         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
1893         int status;
1894
1895         if (!data) return -ENOMEM;
1896
1897         status = csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
1898                               data, req->req.length);
1899         if (copy_to_user(int2ptr(req->req.recvb), data,
1900                 req->req.length))
1901                 ret = -EFAULT;
1902         if (copy_to_user(int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
1903                          sizeof(fi->host->csr.rom->cache_head->len)))
1904                 ret = -EFAULT;
1905         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
1906                          sizeof(fi->host->csr.generation)))
1907                 ret = -EFAULT;
1908         if (copy_to_user(int2ptr(req->req.sendb), &status,
1909                 sizeof(status)))
1910                 ret = -EFAULT;
1911         kfree(data);
1912         if (ret >= 0) {
1913                 free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
1914         }
1915         return ret;
1916 }
1917
1918 static int update_config_rom(struct file_info *fi, struct pending_request *req)
1919 {
1920         int ret=sizeof(struct raw1394_request);
1921         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
1922         if (!data) return -ENOMEM;
1923         if (copy_from_user(data,int2ptr(req->req.sendb),
1924                 req->req.length)) {
1925                 ret= -EFAULT;
1926         } else {
1927                 int status = hpsb_update_config_rom(fi->host,
1928                         data, req->req.length,
1929                         (unsigned char) req->req.misc);
1930                 if (copy_to_user(int2ptr(req->req.recvb),
1931                         &status, sizeof(status)))
1932                         ret = -ENOMEM;
1933         }
1934         kfree(data);
1935         if (ret >= 0) {
1936                 free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
1937                 fi->cfgrom_upd = 1;
1938         }
1939         return ret;
1940 }
1941
1942 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
1943 {
1944         struct csr1212_keyval *kv;
1945         struct csr1212_csr_rom_cache *cache;
1946         struct csr1212_dentry *dentry;
1947         u32 dr;
1948         int ret = 0;
1949
1950         if (req->req.misc == ~0) {
1951                 if (req->req.length == 0) return -EINVAL;
1952
1953                 /* Find an unused slot */
1954                 for (dr = 0; dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr]; dr++);
1955
1956                 if (dr == RAW1394_MAX_USER_CSR_DIRS) return -ENOMEM;
1957
1958                 fi->csr1212_dirs[dr] = csr1212_new_directory(CSR1212_KV_ID_VENDOR);
1959                 if (!fi->csr1212_dirs[dr]) return -ENOMEM;
1960         } else {
1961                 dr = req->req.misc;
1962                 if (!fi->csr1212_dirs[dr]) return -EINVAL;
1963
1964                 /* Delete old stuff */
1965                 for (dentry = fi->csr1212_dirs[dr]->value.directory.dentries_head;
1966                      dentry; dentry = dentry->next) {
1967                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->root_kv,
1968                                                              dentry->kv);
1969                 }
1970
1971                 if (req->req.length == 0) {
1972                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
1973                         fi->csr1212_dirs[dr] = NULL;
1974
1975                         hpsb_update_config_rom_image(fi->host);
1976                         free_pending_request(req);
1977                         return sizeof(struct raw1394_request);
1978                 }
1979         }
1980
1981         cache = csr1212_rom_cache_malloc(0, req->req.length);
1982         if (!cache) {
1983                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
1984                 fi->csr1212_dirs[dr] = NULL;
1985                 return -ENOMEM;
1986         }
1987
1988         cache->filled_head = kmalloc(sizeof(struct csr1212_cache_region), GFP_KERNEL);
1989         if (!cache->filled_head) {
1990                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
1991                 fi->csr1212_dirs[dr] = NULL;
1992                 CSR1212_FREE(cache);
1993                 return -ENOMEM;
1994         }
1995         cache->filled_tail = cache->filled_head;
1996
1997         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
1998                            req->req.length)) {
1999                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2000                 fi->csr1212_dirs[dr] = NULL;
2001                 CSR1212_FREE(cache);
2002                 ret= -EFAULT;
2003         } else {
2004                 cache->len = req->req.length;
2005                 cache->filled_head->offset_start = 0;
2006                 cache->filled_head->offset_end = cache->size -1;
2007
2008                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2009
2010                 ret = CSR1212_SUCCESS;
2011                 /* parse all the items */
2012                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2013                      kv = kv->next) {
2014                         ret = csr1212_parse_keyval(kv, cache);
2015                 }
2016
2017                 /* attach top level items to the root directory */
2018                 for (dentry = fi->csr1212_dirs[dr]->value.directory.dentries_head;
2019                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2020                         ret = csr1212_attach_keyval_to_directory(fi->host->csr.rom->root_kv,
2021                                                                  dentry->kv);
2022                 }
2023
2024                 if (ret == CSR1212_SUCCESS) {
2025                         ret = hpsb_update_config_rom_image(fi->host);
2026
2027                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2028                                                     &dr, sizeof(dr))) {
2029                                 ret = -ENOMEM;
2030                         }
2031                 }
2032         }
2033         kfree(cache->filled_head);
2034         kfree(cache);
2035
2036         if (ret >= 0) {
2037                 /* we have to free the request, because we queue no response,
2038                  * and therefore nobody will free it */
2039                 free_pending_request(req);
2040                 return sizeof(struct raw1394_request);
2041         } else {
2042                 for (dentry = fi->csr1212_dirs[dr]->value.directory.dentries_head;
2043                      dentry; dentry = dentry->next) {
2044                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->root_kv,
2045                                                              dentry->kv);
2046                 }
2047                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2048                 fi->csr1212_dirs[dr] = NULL;
2049                 return ret;
2050         }
2051 }
2052
2053 static int state_connected(struct file_info *fi, struct pending_request *req)
2054 {
2055         int node = req->req.address >> 48;
2056
2057         req->req.error = RAW1394_ERROR_NONE;
2058
2059         switch (req->req.type) {
2060
2061         case RAW1394_REQ_ECHO:
2062                 queue_complete_req(req);
2063                 return sizeof(struct raw1394_request);
2064
2065         case RAW1394_REQ_ISO_SEND:
2066                 return handle_iso_send(fi, req, node);
2067
2068         case RAW1394_REQ_ARM_REGISTER:
2069                 return arm_register(fi, req);
2070
2071         case RAW1394_REQ_ARM_UNREGISTER:
2072                 return arm_unregister(fi, req);
2073
2074         case RAW1394_REQ_ARM_SET_BUF:
2075                 return arm_set_buf(fi, req);
2076
2077         case RAW1394_REQ_ARM_GET_BUF:
2078                 return arm_get_buf(fi, req);
2079
2080         case RAW1394_REQ_RESET_NOTIFY:
2081                 return reset_notification(fi, req);
2082
2083         case RAW1394_REQ_ISO_LISTEN:
2084                 handle_iso_listen(fi, req);
2085                 return sizeof(struct raw1394_request);
2086
2087         case RAW1394_REQ_FCP_LISTEN:
2088                 handle_fcp_listen(fi, req);
2089                 return sizeof(struct raw1394_request);
2090
2091         case RAW1394_REQ_RESET_BUS:
2092                 if (req->req.misc == RAW1394_LONG_RESET) {
2093                         DBGMSG("busreset called (type: LONG)");
2094                         hpsb_reset_bus(fi->host, LONG_RESET);
2095                         free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
2096                         return sizeof(struct raw1394_request);
2097                 }
2098                 if (req->req.misc == RAW1394_SHORT_RESET) {
2099                         DBGMSG("busreset called (type: SHORT)");
2100                         hpsb_reset_bus(fi->host, SHORT_RESET);
2101                         free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
2102                         return sizeof(struct raw1394_request);
2103                 }
2104                 /* error EINVAL (22) invalid argument */
2105                 return (-EINVAL);
2106         case RAW1394_REQ_GET_ROM:
2107                 return get_config_rom(fi, req);
2108
2109         case RAW1394_REQ_UPDATE_ROM:
2110                 return update_config_rom(fi, req);
2111
2112         case RAW1394_REQ_MODIFY_ROM:
2113                 return modify_config_rom(fi, req);
2114         }
2115
2116         if (req->req.generation != get_hpsb_generation(fi->host)) {
2117                 req->req.error = RAW1394_ERROR_GENERATION;
2118                 req->req.generation = get_hpsb_generation(fi->host);
2119                 req->req.length = 0;
2120                 queue_complete_req(req);
2121                 return sizeof(struct raw1394_request);
2122         }
2123
2124         switch (req->req.type) {
2125         case RAW1394_REQ_PHYPACKET:
2126                 return write_phypacket(fi, req);
2127         case RAW1394_REQ_ASYNC_SEND:
2128                 return handle_async_send(fi, req);
2129         }
2130
2131         if (req->req.length == 0) {
2132                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2133                 queue_complete_req(req);
2134                 return sizeof(struct raw1394_request);
2135         }
2136
2137         return handle_async_request(fi, req, node);
2138 }
2139
2140
2141 static ssize_t raw1394_write(struct file *file, const char __user *buffer, size_t count,
2142                      loff_t *offset_is_ignored)
2143 {
2144         struct file_info *fi = (struct file_info *)file->private_data;
2145         struct pending_request *req;
2146         ssize_t retval = 0;
2147
2148         if (count != sizeof(struct raw1394_request)) {
2149                 return -EINVAL;
2150         }
2151
2152         req = alloc_pending_request();
2153         if (req == NULL) {
2154                 return -ENOMEM;
2155         }
2156         req->file_info = fi;
2157
2158         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2159                 free_pending_request(req);
2160                 return -EFAULT;
2161         }
2162
2163         switch (fi->state) {
2164         case opened:
2165                 retval = state_opened(fi, req);
2166                 break;
2167
2168         case initialized:
2169                 retval = state_initialized(fi, req);
2170                 break;
2171
2172         case connected:
2173                 retval = state_connected(fi, req);
2174                 break;
2175         }
2176
2177         if (retval < 0) {
2178                 free_pending_request(req);
2179         }
2180
2181         return retval;
2182 }
2183
2184 /* rawiso operations */
2185
2186 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2187  * completion queue (reqlists_lock must be taken) */
2188 static inline int __rawiso_event_in_queue(struct file_info *fi)
2189 {
2190         struct pending_request *req;
2191
2192         list_for_each_entry(req, &fi->req_complete, list)
2193                 if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2194                         return 1;
2195
2196         return 0;
2197 }
2198
2199 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2200 static void queue_rawiso_event(struct file_info *fi)
2201 {
2202         unsigned long flags;
2203
2204         spin_lock_irqsave(&fi->reqlists_lock, flags);
2205
2206         /* only one ISO activity event may be in the queue */
2207         if (!__rawiso_event_in_queue(fi)) {
2208                 struct pending_request *req = __alloc_pending_request(SLAB_ATOMIC);
2209
2210                 if (req) {
2211                         req->file_info = fi;
2212                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2213                         req->req.generation = get_hpsb_generation(fi->host);
2214                         __queue_complete_req(req);
2215                 } else {
2216                         /* on allocation failure, signal an overflow */
2217                         if (fi->iso_handle) {
2218                                 atomic_inc(&fi->iso_handle->overflows);
2219                         }
2220                 }
2221         }
2222         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2223 }
2224
2225 static void rawiso_activity_cb(struct hpsb_iso *iso)
2226 {
2227         unsigned long flags;
2228         struct host_info *hi;
2229         struct file_info *fi;
2230
2231         spin_lock_irqsave(&host_info_lock, flags);
2232         hi = find_host_info(iso->host);
2233
2234         if (hi != NULL) {
2235                 list_for_each_entry(fi, &hi->file_info_list, list) {
2236                         if (fi->iso_handle == iso)
2237                                 queue_rawiso_event(fi);
2238                 }
2239         }
2240
2241         spin_unlock_irqrestore(&host_info_lock, flags);
2242 }
2243
2244 /* helper function - gather all the kernel iso status bits for returning to user-space */
2245 static void raw1394_iso_fill_status(struct hpsb_iso *iso, struct raw1394_iso_status *stat)
2246 {
2247         stat->config.data_buf_size = iso->buf_size;
2248         stat->config.buf_packets = iso->buf_packets;
2249         stat->config.channel = iso->channel;
2250         stat->config.speed = iso->speed;
2251         stat->config.irq_interval = iso->irq_interval;
2252         stat->n_packets = hpsb_iso_n_ready(iso);
2253         stat->overflows = atomic_read(&iso->overflows);
2254         stat->xmit_cycle = iso->xmit_cycle;
2255 }
2256
2257 static int raw1394_iso_xmit_init(struct file_info *fi, void __user *uaddr)
2258 {
2259         struct raw1394_iso_status stat;
2260
2261         if (!fi->host)
2262                 return -EINVAL;
2263
2264         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2265                 return -EFAULT;
2266
2267         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2268                                             stat.config.data_buf_size,
2269                                             stat.config.buf_packets,
2270                                             stat.config.channel,
2271                                             stat.config.speed,
2272                                             stat.config.irq_interval,
2273                                             rawiso_activity_cb);
2274         if (!fi->iso_handle)
2275                 return -ENOMEM;
2276
2277         fi->iso_state = RAW1394_ISO_XMIT;
2278
2279         raw1394_iso_fill_status(fi->iso_handle, &stat);
2280         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2281                 return -EFAULT;
2282
2283         /* queue an event to get things started */
2284         rawiso_activity_cb(fi->iso_handle);
2285
2286         return 0;
2287 }
2288
2289 static int raw1394_iso_recv_init(struct file_info *fi, void __user *uaddr)
2290 {
2291         struct raw1394_iso_status stat;
2292
2293         if (!fi->host)
2294                 return -EINVAL;
2295
2296         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2297                 return -EFAULT;
2298
2299         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2300                                             stat.config.data_buf_size,
2301                                             stat.config.buf_packets,
2302                                             stat.config.channel,
2303                                             stat.config.dma_mode,
2304                                             stat.config.irq_interval,
2305                                             rawiso_activity_cb);
2306         if (!fi->iso_handle)
2307                 return -ENOMEM;
2308
2309         fi->iso_state = RAW1394_ISO_RECV;
2310
2311         raw1394_iso_fill_status(fi->iso_handle, &stat);
2312         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2313                 return -EFAULT;
2314         return 0;
2315 }
2316
2317 static int raw1394_iso_get_status(struct file_info *fi, void __user *uaddr)
2318 {
2319         struct raw1394_iso_status stat;
2320         struct hpsb_iso *iso = fi->iso_handle;
2321
2322         raw1394_iso_fill_status(fi->iso_handle, &stat);
2323         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2324                 return -EFAULT;
2325
2326         /* reset overflow counter */
2327         atomic_set(&iso->overflows, 0);
2328
2329         return 0;
2330 }
2331
2332 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2333 static int raw1394_iso_recv_packets(struct file_info *fi, void __user *uaddr)
2334 {
2335         struct raw1394_iso_packets upackets;
2336         unsigned int packet = fi->iso_handle->first_packet;
2337         int i;
2338
2339         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2340                 return -EFAULT;
2341
2342         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2343                 return -EINVAL;
2344
2345         /* ensure user-supplied buffer is accessible and big enough */
2346         if (verify_area(VERIFY_WRITE, upackets.infos,
2347                        upackets.n_packets * sizeof(struct raw1394_iso_packet_info)))
2348                 return -EFAULT;
2349
2350         /* copy the packet_infos out */
2351         for (i = 0; i < upackets.n_packets; i++) {
2352                 if (__copy_to_user(&upackets.infos[i],
2353                                   &fi->iso_handle->infos[packet],
2354                                   sizeof(struct raw1394_iso_packet_info)))
2355                         return -EFAULT;
2356
2357                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2358         }
2359
2360         return 0;
2361 }
2362
2363 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2364 static int raw1394_iso_send_packets(struct file_info *fi, void __user *uaddr)
2365 {
2366         struct raw1394_iso_packets upackets;
2367         int i, rv;
2368
2369         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2370                 return -EFAULT;
2371
2372         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2373                 return -EINVAL;
2374
2375         /* ensure user-supplied buffer is accessible and big enough */
2376         if (verify_area(VERIFY_READ, upackets.infos,
2377                        upackets.n_packets * sizeof(struct raw1394_iso_packet_info)))
2378                 return -EFAULT;
2379
2380         /* copy the infos structs in and queue the packets */
2381         for (i = 0; i < upackets.n_packets; i++) {
2382                 struct raw1394_iso_packet_info info;
2383
2384                 if (__copy_from_user(&info, &upackets.infos[i],
2385                                     sizeof(struct raw1394_iso_packet_info)))
2386                         return -EFAULT;
2387
2388                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2389                                                 info.len, info.tag, info.sy);
2390                 if (rv)
2391                         return rv;
2392         }
2393
2394         return 0;
2395 }
2396
2397 static void raw1394_iso_shutdown(struct file_info *fi)
2398 {
2399         if (fi->iso_handle)
2400                 hpsb_iso_shutdown(fi->iso_handle);
2401
2402         fi->iso_handle = NULL;
2403         fi->iso_state = RAW1394_ISO_INACTIVE;
2404 }
2405
2406 /* mmap the rawiso xmit/recv buffer */
2407 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2408 {
2409         struct file_info *fi = file->private_data;
2410
2411         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2412                 return -EINVAL;
2413
2414         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2415 }
2416
2417 /* ioctl is only used for rawiso operations */
2418 static int raw1394_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
2419 {
2420         struct file_info *fi = file->private_data;
2421         void __user *argp = (void __user *)arg;
2422
2423         switch(fi->iso_state) {
2424         case RAW1394_ISO_INACTIVE:
2425                 switch(cmd) {
2426                 case RAW1394_IOC_ISO_XMIT_INIT:
2427                         return raw1394_iso_xmit_init(fi, argp);
2428                 case RAW1394_IOC_ISO_RECV_INIT:
2429                         return raw1394_iso_recv_init(fi, argp);
2430                 default:
2431                         break;
2432                 }
2433                 break;
2434         case RAW1394_ISO_RECV:
2435                 switch(cmd) {
2436                 case RAW1394_IOC_ISO_RECV_START: {
2437                         /* copy args from user-space */
2438                         int args[3];
2439                         if (copy_from_user(&args[0], argp, sizeof(args)))
2440                                 return -EFAULT;
2441                         return hpsb_iso_recv_start(fi->iso_handle, args[0], args[1], args[2]);
2442                 }
2443                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2444                         hpsb_iso_stop(fi->iso_handle);
2445                         return 0;
2446                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2447                         return hpsb_iso_recv_listen_channel(fi->iso_handle, arg);
2448                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2449                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle, arg);
2450                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK: {
2451                         /* copy the u64 from user-space */
2452                         u64 mask;
2453                         if (copy_from_user(&mask, argp, sizeof(mask)))
2454                                 return -EFAULT;
2455                         return hpsb_iso_recv_set_channel_mask(fi->iso_handle, mask);
2456                 }
2457                 case RAW1394_IOC_ISO_GET_STATUS:
2458                         return raw1394_iso_get_status(fi, argp);
2459                 case RAW1394_IOC_ISO_RECV_PACKETS:
2460                         return raw1394_iso_recv_packets(fi, argp);
2461                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2462                         return hpsb_iso_recv_release_packets(fi->iso_handle, arg);
2463                 case RAW1394_IOC_ISO_RECV_FLUSH:
2464                         return hpsb_iso_recv_flush(fi->iso_handle);
2465                 case RAW1394_IOC_ISO_SHUTDOWN:
2466                         raw1394_iso_shutdown(fi);
2467                         return 0;
2468                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2469                         queue_rawiso_event(fi);
2470                         return 0;
2471                 }
2472                 break;
2473         case RAW1394_ISO_XMIT:
2474                 switch(cmd) {
2475                 case RAW1394_IOC_ISO_XMIT_START: {
2476                         /* copy two ints from user-space */
2477                         int args[2];
2478                         if (copy_from_user(&args[0], argp, sizeof(args)))
2479                                 return -EFAULT;
2480                         return hpsb_iso_xmit_start(fi->iso_handle, args[0], args[1]);
2481                 }
2482                 case RAW1394_IOC_ISO_XMIT_SYNC:
2483                         return hpsb_iso_xmit_sync(fi->iso_handle);
2484                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2485                         hpsb_iso_stop(fi->iso_handle);
2486                         return 0;
2487                 case RAW1394_IOC_ISO_GET_STATUS:
2488                         return raw1394_iso_get_status(fi, argp);
2489                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2490                         return raw1394_iso_send_packets(fi, argp);
2491                 case RAW1394_IOC_ISO_SHUTDOWN:
2492                         raw1394_iso_shutdown(fi);
2493                         return 0;
2494                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2495                         queue_rawiso_event(fi);
2496                         return 0;
2497                 }
2498                 break;
2499         default:
2500                 break;
2501         }
2502
2503         return -EINVAL;
2504 }
2505
2506 static unsigned int raw1394_poll(struct file *file, poll_table *pt)
2507 {
2508         struct file_info *fi = file->private_data;
2509         unsigned int mask = POLLOUT | POLLWRNORM;
2510
2511         poll_wait(file, &fi->poll_wait_complete, pt);
2512
2513         spin_lock_irq(&fi->reqlists_lock);
2514         if (!list_empty(&fi->req_complete)) {
2515                 mask |= POLLIN | POLLRDNORM;
2516         }
2517         spin_unlock_irq(&fi->reqlists_lock);
2518
2519         return mask;
2520 }
2521
2522 static int raw1394_open(struct inode *inode, struct file *file)
2523 {
2524         struct file_info *fi;
2525
2526         fi = kmalloc(sizeof(struct file_info), SLAB_KERNEL);
2527         if (fi == NULL)
2528                 return -ENOMEM;
2529
2530         memset(fi, 0, sizeof(struct file_info));
2531         fi->notification = (u8) RAW1394_NOTIFY_ON; /* busreset notification */
2532
2533         INIT_LIST_HEAD(&fi->list);
2534         fi->state = opened;
2535         INIT_LIST_HEAD(&fi->req_pending);
2536         INIT_LIST_HEAD(&fi->req_complete);
2537         sema_init(&fi->complete_sem, 0);
2538         spin_lock_init(&fi->reqlists_lock);
2539         init_waitqueue_head(&fi->poll_wait_complete);
2540         INIT_LIST_HEAD(&fi->addr_list);
2541
2542         file->private_data = fi;
2543
2544         return 0;
2545 }
2546
2547 static int raw1394_release(struct inode *inode, struct file *file)
2548 {
2549         struct file_info *fi = file->private_data;
2550         struct list_head *lh;
2551         struct pending_request *req;
2552         int done = 0, i, fail = 0;
2553         int retval = 0;
2554         struct list_head *entry;
2555         struct arm_addr  *addr = NULL;
2556         struct host_info *hi;
2557         struct file_info *fi_hlp = NULL;
2558         struct arm_addr  *arm_addr = NULL;
2559         int another_host;
2560         int csr_mod = 0;
2561
2562         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2563                 raw1394_iso_shutdown(fi);
2564
2565         for (i = 0; i < 64; i++) {
2566                 if (fi->listen_channels & (1ULL << i)) {
2567                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2568                 }
2569         }
2570
2571         spin_lock_irq(&host_info_lock);
2572         fi->listen_channels = 0;
2573         spin_unlock_irq(&host_info_lock);
2574
2575         fail = 0;
2576         /* set address-entries invalid */
2577         spin_lock_irq(&host_info_lock);
2578
2579         while (!list_empty(&fi->addr_list)) {
2580                 another_host = 0;
2581                 lh = fi->addr_list.next;
2582                 addr = list_entry(lh, struct arm_addr, addr_list);
2583                 /* another host with valid address-entry containing
2584                    same addressrange? */
2585                 list_for_each_entry(hi, &host_info_list, list) {
2586                         if (hi->host != fi->host) {
2587                                 list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
2588                                         entry = fi_hlp->addr_list.next;
2589                                         while (entry != &(fi_hlp->addr_list)) {
2590                                                 arm_addr = list_entry(entry,
2591                                                         struct arm_addr, addr_list);
2592                                                 if (arm_addr->start ==
2593                                                         addr->start) {
2594                                                         DBGMSG("raw1394_release: "
2595                                                         "another host ownes "
2596                                                         "same addressrange");
2597                                                         another_host = 1;
2598                                                         break;
2599                                                 }
2600                                                 entry = entry->next;
2601                                         }
2602                                         if (another_host) {
2603                                                 break;
2604                                         }
2605                                 }
2606                         }
2607                 }
2608                 if (!another_host) {
2609                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
2610                         retval = hpsb_unregister_addrspace(&raw1394_highlevel, fi->host, addr->start);
2611                         if (!retval) {
2612                                 ++fail;
2613                                 printk(KERN_ERR "raw1394_release arm_Unregister failed\n");
2614                         }
2615                 }
2616                 DBGMSG("raw1394_release: delete addr_entry from list");
2617                 list_del(&addr->addr_list);
2618                 vfree(addr->addr_space_buffer);
2619                 kfree(addr);
2620         } /* while */
2621         spin_unlock_irq(&host_info_lock);
2622         if (fail > 0) {
2623                 printk(KERN_ERR "raw1394: during addr_list-release "
2624                         "error(s) occurred \n");
2625         }
2626
2627         while (!done) {
2628                 spin_lock_irq(&fi->reqlists_lock);
2629
2630                 while (!list_empty(&fi->req_complete)) {
2631                         lh = fi->req_complete.next;
2632                         list_del(lh);
2633
2634                         req = list_entry(lh, struct pending_request, list);
2635
2636                         free_pending_request(req);
2637                 }
2638
2639                 if (list_empty(&fi->req_pending)) done = 1;
2640
2641                 spin_unlock_irq(&fi->reqlists_lock);
2642
2643                 if (!done) down_interruptible(&fi->complete_sem);
2644         }
2645
2646         /* Remove any sub-trees left by user space programs */
2647         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
2648                 struct csr1212_dentry *dentry;
2649                 if (!fi->csr1212_dirs[i]) continue;
2650                 for (dentry = fi->csr1212_dirs[i]->value.directory.dentries_head;
2651                      dentry; dentry = dentry->next) {
2652                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->root_kv, dentry->kv);
2653                 }
2654                 csr1212_release_keyval(fi->csr1212_dirs[i]);
2655                 fi->csr1212_dirs[i] = NULL;
2656                 csr_mod = 1;
2657         }
2658
2659         if ((csr_mod || fi->cfgrom_upd) && hpsb_update_config_rom_image(fi->host) < 0)
2660                 HPSB_ERR("Failed to generate Configuration ROM image for host %d", fi->host->id);
2661
2662         if (fi->state == connected) {
2663                 spin_lock_irq(&host_info_lock);
2664                 list_del(&fi->list);
2665                 spin_unlock_irq(&host_info_lock);
2666
2667                 put_device(&fi->host->device);
2668         }
2669
2670         kfree(fi);
2671
2672         return 0;
2673 }
2674
2675
2676 /*** HOTPLUG STUFF **********************************************************/
2677 /*
2678  * Export information about protocols/devices supported by this driver.
2679  */
2680 static struct ieee1394_device_id raw1394_id_table[] = {
2681         {
2682                 .match_flags    = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2683                 .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
2684                 .version        = AVC_SW_VERSION_ENTRY & 0xffffff
2685         },
2686         {
2687                 .match_flags    = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2688                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2689                 .version        = CAMERA_SW_VERSION_ENTRY & 0xffffff
2690         },
2691         { }
2692 };
2693
2694 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
2695
2696 static struct hpsb_protocol_driver raw1394_driver = {
2697         .name           = "raw1394 Driver",
2698         .id_table       = raw1394_id_table,
2699         .driver         = {
2700                 .name   = "raw1394",
2701                 .bus    = &ieee1394_bus_type,
2702         },
2703 };
2704
2705
2706 /******************************************************************************/
2707
2708
2709 static struct hpsb_highlevel raw1394_highlevel = {
2710         .name =         RAW1394_DEVICE_NAME,
2711         .add_host =    add_host,
2712         .remove_host = remove_host,
2713         .host_reset =  host_reset,
2714         .iso_receive = iso_receive,
2715         .fcp_request = fcp_request,
2716 };
2717
2718 static struct cdev raw1394_cdev;
2719 static struct file_operations raw1394_fops = {
2720         .owner =        THIS_MODULE,
2721         .read =         raw1394_read,
2722         .write =        raw1394_write,
2723         .mmap =         raw1394_mmap,
2724         .ioctl =        raw1394_ioctl,
2725         .poll =         raw1394_poll,
2726         .open =         raw1394_open,
2727         .release =      raw1394_release,
2728 };
2729
2730 static int __init init_raw1394(void)
2731 {
2732         int ret;
2733
2734         hpsb_register_highlevel(&raw1394_highlevel);
2735
2736         devfs_mk_cdev(MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16),
2737                         S_IFCHR | S_IRUSR | S_IWUSR, RAW1394_DEVICE_NAME);
2738
2739         cdev_init(&raw1394_cdev, &raw1394_fops);
2740         raw1394_cdev.owner = THIS_MODULE;
2741         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
2742         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
2743         if (ret) {
2744                 HPSB_ERR("raw1394 failed to register minor device block");
2745                 devfs_remove(RAW1394_DEVICE_NAME);
2746                 hpsb_unregister_highlevel(&raw1394_highlevel);
2747                 return ret;
2748         }
2749
2750         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
2751
2752         ret = hpsb_register_protocol(&raw1394_driver);
2753         if (ret) {
2754                 HPSB_ERR("raw1394: failed to register protocol");
2755                 cdev_del(&raw1394_cdev);
2756                 devfs_remove(RAW1394_DEVICE_NAME);
2757                 hpsb_unregister_highlevel(&raw1394_highlevel);
2758                 return ret;
2759         }
2760
2761         return 0;
2762 }
2763
2764 static void __exit cleanup_raw1394(void)
2765 {
2766         hpsb_unregister_protocol(&raw1394_driver);
2767         cdev_del(&raw1394_cdev);
2768         devfs_remove(RAW1394_DEVICE_NAME);
2769         hpsb_unregister_highlevel(&raw1394_highlevel);
2770 }
2771
2772 module_init(init_raw1394);
2773 module_exit(cleanup_raw1394);
2774 MODULE_LICENSE("GPL");
2775 MODULE_ALIAS_CHARDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16);