drivers/ieee1394/raw1394.c

   1 /*
   2  * IEEE 1394 for Linux
   3  *
   4  * Raw interface to the bus
   5  *
   6  * Copyright (C) 1999, 2000 Andreas E. Bombe
   7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
   8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
   9  *
  10  * This code is licensed under the GPL.  See the file COPYING in the root
  11  * directory of the kernel sources for details.
  12  *
  13  *
  14  * Contributions:
  15  *
  16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
  17  *        configuration ROM manipulation
  18  *        address range mapping
  19  *        adaptation for new (transparent) loopback mechanism
  20  *        sending of arbitrary async packets
  21  * Christian Toegel <christian.toegel@gmx.at>
  22  *        address range mapping
  23  *        lock64 request
  24  *        transmit physical packet
  25  *        busreset notification control (switch on/off)
  26  *        busreset with selection of type (short/long)
  27  *        request_reply
  28  */
  29
  30 #include <linux/kernel.h>
  31 #include <linux/list.h>
  32 #include <linux/string.h>
  33 #include <linux/slab.h>
  34 #include <linux/fs.h>
  35 #include <linux/poll.h>
  36 #include <linux/module.h>
  37 #include <linux/init.h>
  38 #include <linux/smp_lock.h>
  39 #include <linux/interrupt.h>
  40 #include <linux/vmalloc.h>
  41 #include <linux/cdev.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/atomic.h>
  44 #include <linux/compat.h>
  45
  46 #include "csr1212.h"
  47 #include "ieee1394.h"
  48 #include "ieee1394_types.h"
  49 #include "ieee1394_core.h"
  50 #include "nodemgr.h"
  51 #include "hosts.h"
  52 #include "highlevel.h"
  53 #include "iso.h"
  54 #include "ieee1394_transactions.h"
  55 #include "raw1394.h"
  56 #include "raw1394-private.h"
  57
  58 #define int2ptr(x) ((void __user *)(unsigned long)x)
  59 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
  60
  61 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
  62 #define RAW1394_DEBUG
  63 #endif
  64
  65 #ifdef RAW1394_DEBUG
  66 #define DBGMSG(fmt, args...) \
  67 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
  68 #else
  69 #define DBGMSG(fmt, args...)
  70 #endif
  71
  72 static LIST_HEAD(host_info_list);
  73 static int host_count;
  74 static DEFINE_SPINLOCK(host_info_lock);
  75 static atomic_t internal_generation = ATOMIC_INIT(0);
  76
  77 static atomic_t iso_buffer_size;
  78 static const int iso_buffer_max = 4 * 1024 * 1024;      /* 4 MB */
  79
  80 static struct hpsb_highlevel raw1394_highlevel;
  81
  82 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
  83                     u64 addr, size_t length, u16 flags);
  84 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
  85                      quadlet_t * data, u64 addr, size_t length, u16 flags);
  86 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
  87                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
  88                     u16 flags);
  89 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
  90                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
  91                       u16 flags);
  92 static struct hpsb_address_ops arm_ops = {
  93         .read = arm_read,
  94         .write = arm_write,
  95         .lock = arm_lock,
  96         .lock64 = arm_lock64,
  97 };
  98
  99 static void queue_complete_cb(struct pending_request *req);
 100
 101 static struct pending_request *__alloc_pending_request(gfp_t flags)
 102 {
 103         struct pending_request *req;
 104
 105         req = kzalloc(sizeof(*req), flags);
 106         if (req)
 107                 INIT_LIST_HEAD(&req->list);
 108
 109         return req;
 110 }
 111
 112 static inline struct pending_request *alloc_pending_request(void)
 113 {
 114         return __alloc_pending_request(SLAB_KERNEL);
 115 }
 116
 117 static void free_pending_request(struct pending_request *req)
 118 {
 119         if (req->ibs) {
 120                 if (atomic_dec_and_test(&req->ibs->refcount)) {
 121                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
 122                         kfree(req->ibs);
 123                 }
 124         } else if (req->free_data) {
 125                 kfree(req->data);
 126         }
 127         hpsb_free_packet(req->packet);
 128         kfree(req);
 129 }
 130
 131 /* fi->reqlists_lock must be taken */
 132 static void __queue_complete_req(struct pending_request *req)
 133 {
 134         struct file_info *fi = req->file_info;
 135         list_del(&req->list);
 136         list_add_tail(&req->list, &fi->req_complete);
 137
 138         up(&fi->complete_sem);
 139         wake_up_interruptible(&fi->poll_wait_complete);
 140 }
 141
 142 static void queue_complete_req(struct pending_request *req)
 143 {
 144         unsigned long flags;
 145         struct file_info *fi = req->file_info;
 146
 147         spin_lock_irqsave(&fi->reqlists_lock, flags);
 148         __queue_complete_req(req);
 149         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 150 }
 151
 152 static void queue_complete_cb(struct pending_request *req)
 153 {
 154         struct hpsb_packet *packet = req->packet;
 155         int rcode = (packet->header[1] >> 12) & 0xf;
 156
 157         switch (packet->ack_code) {
 158         case ACKX_NONE:
 159         case ACKX_SEND_ERROR:
 160                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 161                 break;
 162         case ACKX_ABORTED:
 163                 req->req.error = RAW1394_ERROR_ABORTED;
 164                 break;
 165         case ACKX_TIMEOUT:
 166                 req->req.error = RAW1394_ERROR_TIMEOUT;
 167                 break;
 168         default:
 169                 req->req.error = (packet->ack_code << 16) | rcode;
 170                 break;
 171         }
 172
 173         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
 174                 req->req.length = 0;
 175         }
 176
 177         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
 178             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
 179             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
 180             (req->req.type == RAW1394_REQ_LOCK) ||
 181             (req->req.type == RAW1394_REQ_LOCK64))
 182                 hpsb_free_tlabel(packet);
 183
 184         queue_complete_req(req);
 185 }
 186
 187 static void add_host(struct hpsb_host *host)
 188 {
 189         struct host_info *hi;
 190         unsigned long flags;
 191
 192         hi = kmalloc(sizeof(*hi), GFP_KERNEL);
 193
 194         if (hi) {
 195                 INIT_LIST_HEAD(&hi->list);
 196                 hi->host = host;
 197                 INIT_LIST_HEAD(&hi->file_info_list);
 198
 199                 spin_lock_irqsave(&host_info_lock, flags);
 200                 list_add_tail(&hi->list, &host_info_list);
 201                 host_count++;
 202                 spin_unlock_irqrestore(&host_info_lock, flags);
 203         }
 204
 205         atomic_inc(&internal_generation);
 206 }
 207
 208 static struct host_info *find_host_info(struct hpsb_host *host)
 209 {
 210         struct host_info *hi;
 211
 212         list_for_each_entry(hi, &host_info_list, list)
 213             if (hi->host == host)
 214                 return hi;
 215
 216         return NULL;
 217 }
 218
 219 static void remove_host(struct hpsb_host *host)
 220 {
 221         struct host_info *hi;
 222         unsigned long flags;
 223
 224         spin_lock_irqsave(&host_info_lock, flags);
 225         hi = find_host_info(host);
 226
 227         if (hi != NULL) {
 228                 list_del(&hi->list);
 229                 host_count--;
 230                 /*
 231                    FIXME: address ranges should be removed
 232                    and fileinfo states should be initialized
 233                    (including setting generation to
 234                    internal-generation ...)
 235                  */
 236         }
 237         spin_unlock_irqrestore(&host_info_lock, flags);
 238
 239         if (hi == NULL) {
 240                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
 241                        "0x%p\n", host);
 242                 return;
 243         }
 244
 245         kfree(hi);
 246
 247         atomic_inc(&internal_generation);
 248 }
 249
 250 static void host_reset(struct hpsb_host *host)
 251 {
 252         unsigned long flags;
 253         struct host_info *hi;
 254         struct file_info *fi;
 255         struct pending_request *req;
 256
 257         spin_lock_irqsave(&host_info_lock, flags);
 258         hi = find_host_info(host);
 259
 260         if (hi != NULL) {
 261                 list_for_each_entry(fi, &hi->file_info_list, list) {
 262                         if (fi->notification == RAW1394_NOTIFY_ON) {
 263                                 req = __alloc_pending_request(SLAB_ATOMIC);
 264
 265                                 if (req != NULL) {
 266                                         req->file_info = fi;
 267                                         req->req.type = RAW1394_REQ_BUS_RESET;
 268                                         req->req.generation =
 269                                             get_hpsb_generation(host);
 270                                         req->req.misc = (host->node_id << 16)
 271                                             | host->node_count;
 272                                         if (fi->protocol_version > 3) {
 273                                                 req->req.misc |=
 274                                                     (NODEID_TO_NODE
 275                                                      (host->irm_id)
 276                                                      << 8);
 277                                         }
 278
 279                                         queue_complete_req(req);
 280                                 }
 281                         }
 282                 }
 283         }
 284         spin_unlock_irqrestore(&host_info_lock, flags);
 285 }
 286
 287 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t * data,
 288                         size_t length)
 289 {
 290         unsigned long flags;
 291         struct host_info *hi;
 292         struct file_info *fi;
 293         struct pending_request *req, *req_next;
 294         struct iso_block_store *ibs = NULL;
 295         LIST_HEAD(reqs);
 296
 297         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 298                 HPSB_INFO("dropped iso packet");
 299                 return;
 300         }
 301
 302         spin_lock_irqsave(&host_info_lock, flags);
 303         hi = find_host_info(host);
 304
 305         if (hi != NULL) {
 306                 list_for_each_entry(fi, &hi->file_info_list, list) {
 307                         if (!(fi->listen_channels & (1ULL << channel)))
 308                                 continue;
 309
 310                         req = __alloc_pending_request(SLAB_ATOMIC);
 311                         if (!req)
 312                                 break;
 313
 314                         if (!ibs) {
 315                                 ibs = kmalloc(sizeof(*ibs) + length,
 316                                               SLAB_ATOMIC);
 317                                 if (!ibs) {
 318                                         kfree(req);
 319                                         break;
 320                                 }
 321
 322                                 atomic_add(length, &iso_buffer_size);
 323                                 atomic_set(&ibs->refcount, 0);
 324                                 ibs->data_size = length;
 325                                 memcpy(ibs->data, data, length);
 326                         }
 327
 328                         atomic_inc(&ibs->refcount);
 329
 330                         req->file_info = fi;
 331                         req->ibs = ibs;
 332                         req->data = ibs->data;
 333                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
 334                         req->req.generation = get_hpsb_generation(host);
 335                         req->req.misc = 0;
 336                         req->req.recvb = ptr2int(fi->iso_buffer);
 337                         req->req.length = min(length, fi->iso_buffer_length);
 338
 339                         list_add_tail(&req->list, &reqs);
 340                 }
 341         }
 342         spin_unlock_irqrestore(&host_info_lock, flags);
 343
 344         list_for_each_entry_safe(req, req_next, &reqs, list)
 345             queue_complete_req(req);
 346 }
 347
 348 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
 349                         int cts, u8 * data, size_t length)
 350 {
 351         unsigned long flags;
 352         struct host_info *hi;
 353         struct file_info *fi;
 354         struct pending_request *req, *req_next;
 355         struct iso_block_store *ibs = NULL;
 356         LIST_HEAD(reqs);
 357
 358         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 359                 HPSB_INFO("dropped fcp request");
 360                 return;
 361         }
 362
 363         spin_lock_irqsave(&host_info_lock, flags);
 364         hi = find_host_info(host);
 365
 366         if (hi != NULL) {
 367                 list_for_each_entry(fi, &hi->file_info_list, list) {
 368                         if (!fi->fcp_buffer)
 369                                 continue;
 370
 371                         req = __alloc_pending_request(SLAB_ATOMIC);
 372                         if (!req)
 373                                 break;
 374
 375                         if (!ibs) {
 376                                 ibs = kmalloc(sizeof(*ibs) + length,
 377                                               SLAB_ATOMIC);
 378                                 if (!ibs) {
 379                                         kfree(req);
 380                                         break;
 381                                 }
 382
 383                                 atomic_add(length, &iso_buffer_size);
 384                                 atomic_set(&ibs->refcount, 0);
 385                                 ibs->data_size = length;
 386                                 memcpy(ibs->data, data, length);
 387                         }
 388
 389                         atomic_inc(&ibs->refcount);
 390
 391                         req->file_info = fi;
 392                         req->ibs = ibs;
 393                         req->data = ibs->data;
 394                         req->req.type = RAW1394_REQ_FCP_REQUEST;
 395                         req->req.generation = get_hpsb_generation(host);
 396                         req->req.misc = nodeid | (direction << 16);
 397                         req->req.recvb = ptr2int(fi->fcp_buffer);
 398                         req->req.length = length;
 399
 400                         list_add_tail(&req->list, &reqs);
 401                 }
 402         }
 403         spin_unlock_irqrestore(&host_info_lock, flags);
 404
 405         list_for_each_entry_safe(req, req_next, &reqs, list)
 406             queue_complete_req(req);
 407 }
 408
 409 #ifdef CONFIG_COMPAT
 410 struct compat_raw1394_req {
 411         __u32 type;
 412         __s32 error;
 413         __u32 misc;
 414
 415         __u32 generation;
 416         __u32 length;
 417
 418         __u64 address;
 419
 420         __u64 tag;
 421
 422         __u64 sendb;
 423         __u64 recvb;
 424 }  __attribute__((packed));
 425
 426 static const char __user *raw1394_compat_write(const char __user *buf)
 427 {
 428         struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
 429         struct raw1394_request __user *r;
 430         r = compat_alloc_user_space(sizeof(struct raw1394_request));
 431
 432 #define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x))
 433
 434         if (copy_in_user(r, cr, sizeof(struct compat_raw1394_req)) ||
 435                 C(address) ||
 436                 C(tag) ||
 437                 C(sendb) ||
 438                 C(recvb))
 439                 return ERR_PTR(-EFAULT);
 440         return (const char __user *)r;
 441 }
 442 #undef C
 443
 444 #define P(x) __put_user(r->x, &cr->x)
 445
 446 static int
 447 raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
 448 {
 449         struct compat_raw1394_req __user *cr = (typeof(cr)) r;
 450         if (!access_ok(VERIFY_WRITE,cr,sizeof(struct compat_raw1394_req)) ||
 451             P(type) ||
 452             P(error) ||
 453             P(misc) ||
 454             P(generation) ||
 455             P(length) ||
 456             P(address) ||
 457             P(tag) ||
 458             P(sendb) ||
 459             P(recvb))
 460                 return -EFAULT;
 461         return sizeof(struct compat_raw1394_req);
 462 }
 463 #undef P
 464
 465 #endif
 466
 467
 468 static ssize_t raw1394_read(struct file *file, char __user * buffer,
 469                             size_t count, loff_t * offset_is_ignored)
 470 {
 471         unsigned long flags;
 472         struct file_info *fi = (struct file_info *)file->private_data;
 473         struct list_head *lh;
 474         struct pending_request *req;
 475         ssize_t ret;
 476
 477 #ifdef CONFIG_COMPAT
 478         if (count == sizeof(struct compat_raw1394_req)) {
 479                 /* ok */
 480         } else
 481 #endif
 482         if (count != sizeof(struct raw1394_request)) {
 483                 return -EINVAL;
 484         }
 485
 486         if (!access_ok(VERIFY_WRITE, buffer, count)) {
 487                 return -EFAULT;
 488         }
 489
 490         if (file->f_flags & O_NONBLOCK) {
 491                 if (down_trylock(&fi->complete_sem)) {
 492                         return -EAGAIN;
 493                 }
 494         } else {
 495                 if (down_interruptible(&fi->complete_sem)) {
 496                         return -ERESTARTSYS;
 497                 }
 498         }
 499
 500         spin_lock_irqsave(&fi->reqlists_lock, flags);
 501         lh = fi->req_complete.next;
 502         list_del(lh);
 503         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 504
 505         req = list_entry(lh, struct pending_request, list);
 506
 507         if (req->req.length) {
 508                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
 509                                  req->req.length)) {
 510                         req->req.error = RAW1394_ERROR_MEMFAULT;
 511                 }
 512         }
 513
 514 #ifdef CONFIG_COMPAT
 515         if (count == sizeof(struct compat_raw1394_req) &&
 516                 sizeof(struct compat_raw1394_req) !=
 517                         sizeof(struct raw1394_request)) {
 518                 ret = raw1394_compat_read(buffer, &req->req);
 519
 520         } else
 521 #endif
 522         {
 523                 if (copy_to_user(buffer, &req->req, sizeof(req->req))) {
 524                         ret = -EFAULT;
 525                         goto out;
 526                 }
 527                 ret = (ssize_t) sizeof(struct raw1394_request);
 528         }
 529       out:
 530         free_pending_request(req);
 531         return ret;
 532 }
 533
 534 static int state_opened(struct file_info *fi, struct pending_request *req)
 535 {
 536         if (req->req.type == RAW1394_REQ_INITIALIZE) {
 537                 switch (req->req.misc) {
 538                 case RAW1394_KERNELAPI_VERSION:
 539                 case 3:
 540                         fi->state = initialized;
 541                         fi->protocol_version = req->req.misc;
 542                         req->req.error = RAW1394_ERROR_NONE;
 543                         req->req.generation = atomic_read(&internal_generation);
 544                         break;
 545
 546                 default:
 547                         req->req.error = RAW1394_ERROR_COMPAT;
 548                         req->req.misc = RAW1394_KERNELAPI_VERSION;
 549                 }
 550         } else {
 551                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 552         }
 553
 554         req->req.length = 0;
 555         queue_complete_req(req);
 556         return sizeof(struct raw1394_request);
 557 }
 558
 559 static int state_initialized(struct file_info *fi, struct pending_request *req)
 560 {
 561         unsigned long flags;
 562         struct host_info *hi;
 563         struct raw1394_khost_list *khl;
 564
 565         if (req->req.generation != atomic_read(&internal_generation)) {
 566                 req->req.error = RAW1394_ERROR_GENERATION;
 567                 req->req.generation = atomic_read(&internal_generation);
 568                 req->req.length = 0;
 569                 queue_complete_req(req);
 570                 return sizeof(struct raw1394_request);
 571         }
 572
 573         switch (req->req.type) {
 574         case RAW1394_REQ_LIST_CARDS:
 575                 spin_lock_irqsave(&host_info_lock, flags);
 576                 khl = kmalloc(sizeof(*khl) * host_count, SLAB_ATOMIC);
 577
 578                 if (khl) {
 579                         req->req.misc = host_count;
 580                         req->data = (quadlet_t *) khl;
 581
 582                         list_for_each_entry(hi, &host_info_list, list) {
 583                                 khl->nodes = hi->host->node_count;
 584                                 strcpy(khl->name, hi->host->driver->name);
 585                                 khl++;
 586                         }
 587                 }
 588                 spin_unlock_irqrestore(&host_info_lock, flags);
 589
 590                 if (khl) {
 591                         req->req.error = RAW1394_ERROR_NONE;
 592                         req->req.length = min(req->req.length,
 593                                               (u32) (sizeof
 594                                                      (struct raw1394_khost_list)
 595                                                      * req->req.misc));
 596                         req->free_data = 1;
 597                 } else {
 598                         return -ENOMEM;
 599                 }
 600                 break;
 601
 602         case RAW1394_REQ_SET_CARD:
 603                 spin_lock_irqsave(&host_info_lock, flags);
 604                 if (req->req.misc < host_count) {
 605                         list_for_each_entry(hi, &host_info_list, list) {
 606                                 if (!req->req.misc--)
 607                                         break;
 608                         }
 609                         get_device(&hi->host->device);  // XXX Need to handle failure case
 610                         list_add_tail(&fi->list, &hi->file_info_list);
 611                         fi->host = hi->host;
 612                         fi->state = connected;
 613
 614                         req->req.error = RAW1394_ERROR_NONE;
 615                         req->req.generation = get_hpsb_generation(fi->host);
 616                         req->req.misc = (fi->host->node_id << 16)
 617                             | fi->host->node_count;
 618                         if (fi->protocol_version > 3) {
 619                                 req->req.misc |=
 620                                     NODEID_TO_NODE(fi->host->irm_id) << 8;
 621                         }
 622                 } else {
 623                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 624                 }
 625                 spin_unlock_irqrestore(&host_info_lock, flags);
 626
 627                 req->req.length = 0;
 628                 break;
 629
 630         default:
 631                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 632                 req->req.length = 0;
 633                 break;
 634         }
 635
 636         queue_complete_req(req);
 637         return sizeof(struct raw1394_request);
 638 }
 639
 640 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
 641 {
 642         int channel = req->req.misc;
 643
 644         if ((channel > 63) || (channel < -64)) {
 645                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 646         } else if (channel >= 0) {
 647                 /* allocate channel req.misc */
 648                 if (fi->listen_channels & (1ULL << channel)) {
 649                         req->req.error = RAW1394_ERROR_ALREADY;
 650                 } else {
 651                         if (hpsb_listen_channel
 652                             (&raw1394_highlevel, fi->host, channel)) {
 653                                 req->req.error = RAW1394_ERROR_ALREADY;
 654                         } else {
 655                                 fi->listen_channels |= 1ULL << channel;
 656                                 fi->iso_buffer = int2ptr(req->req.recvb);
 657                                 fi->iso_buffer_length = req->req.length;
 658                         }
 659                 }
 660         } else {
 661                 /* deallocate channel (one's complement neg) req.misc */
 662                 channel = ~channel;
 663
 664                 if (fi->listen_channels & (1ULL << channel)) {
 665                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host,
 666                                               channel);
 667                         fi->listen_channels &= ~(1ULL << channel);
 668                 } else {
 669                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 670                 }
 671         }
 672
 673         req->req.length = 0;
 674         queue_complete_req(req);
 675 }
 676
 677 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
 678 {
 679         if (req->req.misc) {
 680                 if (fi->fcp_buffer) {
 681                         req->req.error = RAW1394_ERROR_ALREADY;
 682                 } else {
 683                         fi->fcp_buffer = int2ptr(req->req.recvb);
 684                 }
 685         } else {
 686                 if (!fi->fcp_buffer) {
 687                         req->req.error = RAW1394_ERROR_ALREADY;
 688                 } else {
 689                         fi->fcp_buffer = NULL;
 690                 }
 691         }
 692
 693         req->req.length = 0;
 694         queue_complete_req(req);
 695 }
 696
 697 static int handle_async_request(struct file_info *fi,
 698                                 struct pending_request *req, int node)
 699 {
 700         unsigned long flags;
 701         struct hpsb_packet *packet = NULL;
 702         u64 addr = req->req.address & 0xffffffffffffULL;
 703
 704         switch (req->req.type) {
 705         case RAW1394_REQ_ASYNC_READ:
 706                 DBGMSG("read_request called");
 707                 packet =
 708                     hpsb_make_readpacket(fi->host, node, addr, req->req.length);
 709
 710                 if (!packet)
 711                         return -ENOMEM;
 712
 713                 if (req->req.length == 4)
 714                         req->data = &packet->header[3];
 715                 else
 716                         req->data = packet->data;
 717
 718                 break;
 719
 720         case RAW1394_REQ_ASYNC_WRITE:
 721                 DBGMSG("write_request called");
 722
 723                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
 724                                                req->req.length);
 725                 if (!packet)
 726                         return -ENOMEM;
 727
 728                 if (req->req.length == 4) {
 729                         if (copy_from_user
 730                             (&packet->header[3], int2ptr(req->req.sendb),
 731                              req->req.length))
 732                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 733                 } else {
 734                         if (copy_from_user
 735                             (packet->data, int2ptr(req->req.sendb),
 736                              req->req.length))
 737                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 738                 }
 739
 740                 req->req.length = 0;
 741                 break;
 742
 743         case RAW1394_REQ_ASYNC_STREAM:
 744                 DBGMSG("stream_request called");
 745
 746                 packet =
 747                     hpsb_make_streampacket(fi->host, NULL, req->req.length,
 748                                            node & 0x3f /*channel */ ,
 749                                            (req->req.misc >> 16) & 0x3,
 750                                            req->req.misc & 0xf);
 751                 if (!packet)
 752                         return -ENOMEM;
 753
 754                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 755                                    req->req.length))
 756                         req->req.error = RAW1394_ERROR_MEMFAULT;
 757
 758                 req->req.length = 0;
 759                 break;
 760
 761         case RAW1394_REQ_LOCK:
 762                 DBGMSG("lock_request called");
 763                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 764                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 765                         if (req->req.length != 4) {
 766                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 767                                 break;
 768                         }
 769                 } else {
 770                         if (req->req.length != 8) {
 771                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 772                                 break;
 773                         }
 774                 }
 775
 776                 packet = hpsb_make_lockpacket(fi->host, node, addr,
 777                                               req->req.misc, NULL, 0);
 778                 if (!packet)
 779                         return -ENOMEM;
 780
 781                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 782                                    req->req.length)) {
 783                         req->req.error = RAW1394_ERROR_MEMFAULT;
 784                         break;
 785                 }
 786
 787                 req->data = packet->data;
 788                 req->req.length = 4;
 789                 break;
 790
 791         case RAW1394_REQ_LOCK64:
 792                 DBGMSG("lock64_request called");
 793                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 794                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 795                         if (req->req.length != 8) {
 796                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 797                                 break;
 798                         }
 799                 } else {
 800                         if (req->req.length != 16) {
 801                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 802                                 break;
 803                         }
 804                 }
 805                 packet = hpsb_make_lock64packet(fi->host, node, addr,
 806                                                 req->req.misc, NULL, 0);
 807                 if (!packet)
 808                         return -ENOMEM;
 809
 810                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 811                                    req->req.length)) {
 812                         req->req.error = RAW1394_ERROR_MEMFAULT;
 813                         break;
 814                 }
 815
 816                 req->data = packet->data;
 817                 req->req.length = 8;
 818                 break;
 819
 820         default:
 821                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 822         }
 823
 824         req->packet = packet;
 825
 826         if (req->req.error) {
 827                 req->req.length = 0;
 828                 queue_complete_req(req);
 829                 return sizeof(struct raw1394_request);
 830         }
 831
 832         hpsb_set_packet_complete_task(packet,
 833                                       (void (*)(void *))queue_complete_cb, req);
 834
 835         spin_lock_irqsave(&fi->reqlists_lock, flags);
 836         list_add_tail(&req->list, &fi->req_pending);
 837         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 838
 839         packet->generation = req->req.generation;
 840
 841         if (hpsb_send_packet(packet) < 0) {
 842                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 843                 req->req.length = 0;
 844                 hpsb_free_tlabel(packet);
 845                 queue_complete_req(req);
 846         }
 847         return sizeof(struct raw1394_request);
 848 }
 849
 850 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
 851                            int channel)
 852 {
 853         unsigned long flags;
 854         struct hpsb_packet *packet;
 855
 856         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
 857                                      (req->req.misc >> 16) & 0x3,
 858                                      req->req.misc & 0xf);
 859         if (!packet)
 860                 return -ENOMEM;
 861
 862         packet->speed_code = req->req.address & 0x3;
 863
 864         req->packet = packet;
 865
 866         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 867                            req->req.length)) {
 868                 req->req.error = RAW1394_ERROR_MEMFAULT;
 869                 req->req.length = 0;
 870                 queue_complete_req(req);
 871                 return sizeof(struct raw1394_request);
 872         }
 873
 874         req->req.length = 0;
 875         hpsb_set_packet_complete_task(packet,
 876                                       (void (*)(void *))queue_complete_req,
 877                                       req);
 878
 879         spin_lock_irqsave(&fi->reqlists_lock, flags);
 880         list_add_tail(&req->list, &fi->req_pending);
 881         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 882
 883         /* Update the generation of the packet just before sending. */
 884         packet->generation = req->req.generation;
 885
 886         if (hpsb_send_packet(packet) < 0) {
 887                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 888                 queue_complete_req(req);
 889         }
 890
 891         return sizeof(struct raw1394_request);
 892 }
 893
 894 static int handle_async_send(struct file_info *fi, struct pending_request *req)
 895 {
 896         unsigned long flags;
 897         struct hpsb_packet *packet;
 898         int header_length = req->req.misc & 0xffff;
 899         int expect_response = req->req.misc >> 16;
 900
 901         if ((header_length > req->req.length) || (header_length < 12)) {
 902                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 903                 req->req.length = 0;
 904                 queue_complete_req(req);
 905                 return sizeof(struct raw1394_request);
 906         }
 907
 908         packet = hpsb_alloc_packet(req->req.length - header_length);
 909         req->packet = packet;
 910         if (!packet)
 911                 return -ENOMEM;
 912
 913         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
 914                            header_length)) {
 915                 req->req.error = RAW1394_ERROR_MEMFAULT;
 916                 req->req.length = 0;
 917                 queue_complete_req(req);
 918                 return sizeof(struct raw1394_request);
 919         }
 920
 921         if (copy_from_user
 922             (packet->data, int2ptr(req->req.sendb) + header_length,
 923              packet->data_size)) {
 924                 req->req.error = RAW1394_ERROR_MEMFAULT;
 925                 req->req.length = 0;
 926                 queue_complete_req(req);
 927                 return sizeof(struct raw1394_request);
 928         }
 929
 930         packet->type = hpsb_async;
 931         packet->node_id = packet->header[0] >> 16;
 932         packet->tcode = (packet->header[0] >> 4) & 0xf;
 933         packet->tlabel = (packet->header[0] >> 10) & 0x3f;
 934         packet->host = fi->host;
 935         packet->expect_response = expect_response;
 936         packet->header_size = header_length;
 937         packet->data_size = req->req.length - header_length;
 938
 939         req->req.length = 0;
 940         hpsb_set_packet_complete_task(packet,
 941                                       (void (*)(void *))queue_complete_cb, req);
 942
 943         spin_lock_irqsave(&fi->reqlists_lock, flags);
 944         list_add_tail(&req->list, &fi->req_pending);
 945         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 946
 947         /* Update the generation of the packet just before sending. */
 948         packet->generation = req->req.generation;
 949
 950         if (hpsb_send_packet(packet) < 0) {
 951                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 952                 queue_complete_req(req);
 953         }
 954
 955         return sizeof(struct raw1394_request);
 956 }
 957
 958 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
 959                     u64 addr, size_t length, u16 flags)
 960 {
 961         unsigned long irqflags;
 962         struct pending_request *req;
 963         struct host_info *hi;
 964         struct file_info *fi = NULL;
 965         struct list_head *entry;
 966         struct arm_addr *arm_addr = NULL;
 967         struct arm_request *arm_req = NULL;
 968         struct arm_response *arm_resp = NULL;
 969         int found = 0, size = 0, rcode = -1;
 970         struct arm_request_response *arm_req_resp = NULL;
 971
 972         DBGMSG("arm_read  called by node: %X"
 973                "addr: %4.4x %8.8x length: %Zu", nodeid,
 974                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
 975                length);
 976         spin_lock_irqsave(&host_info_lock, irqflags);
 977         hi = find_host_info(host);      /* search address-entry */
 978         if (hi != NULL) {
 979                 list_for_each_entry(fi, &hi->file_info_list, list) {
 980                         entry = fi->addr_list.next;
 981                         while (entry != &(fi->addr_list)) {
 982                                 arm_addr =
 983                                     list_entry(entry, struct arm_addr,
 984                                                addr_list);
 985                                 if (((arm_addr->start) <= (addr))
 986                                     && ((arm_addr->end) >= (addr + length))) {
 987                                         found = 1;
 988                                         break;
 989                                 }
 990                                 entry = entry->next;
 991                         }
 992                         if (found) {
 993                                 break;
 994                         }
 995                 }
 996         }
 997         rcode = -1;
 998         if (!found) {
 999                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
1000                        " -> rcode_address_error\n");
1001                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1002                 return (RCODE_ADDRESS_ERROR);
1003         } else {
1004                 DBGMSG("arm_read addr_entry FOUND");
1005         }
1006         if (arm_addr->rec_length < length) {
1007                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
1008                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1009         }
1010         if (rcode == -1) {
1011                 if (arm_addr->access_rights & ARM_READ) {
1012                         if (!(arm_addr->client_transactions & ARM_READ)) {
1013                                 memcpy(buffer,
1014                                        (arm_addr->addr_space_buffer) + (addr -
1015                                                                         (arm_addr->
1016                                                                          start)),
1017                                        length);
1018                                 DBGMSG("arm_read -> (rcode_complete)");
1019                                 rcode = RCODE_COMPLETE;
1020                         }
1021                 } else {
1022                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1023                         DBGMSG("arm_read -> rcode_type_error (access denied)");
1024                 }
1025         }
1026         if (arm_addr->notification_options & ARM_READ) {
1027                 DBGMSG("arm_read -> entering notification-section");
1028                 req = __alloc_pending_request(SLAB_ATOMIC);
1029                 if (!req) {
1030                         DBGMSG("arm_read -> rcode_conflict_error");
1031                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1032                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1033                                                            The request may be retried */
1034                 }
1035                 if (rcode == RCODE_COMPLETE) {
1036                         size =
1037                             sizeof(struct arm_request) +
1038                             sizeof(struct arm_response) +
1039                             length * sizeof(byte_t) +
1040                             sizeof(struct arm_request_response);
1041                 } else {
1042                         size =
1043                             sizeof(struct arm_request) +
1044                             sizeof(struct arm_response) +
1045                             sizeof(struct arm_request_response);
1046                 }
1047                 req->data = kmalloc(size, SLAB_ATOMIC);
1048                 if (!(req->data)) {
1049                         free_pending_request(req);
1050                         DBGMSG("arm_read -> rcode_conflict_error");
1051                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1052                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1053                                                            The request may be retried */
1054                 }
1055                 req->free_data = 1;
1056                 req->file_info = fi;
1057                 req->req.type = RAW1394_REQ_ARM;
1058                 req->req.generation = get_hpsb_generation(host);
1059                 req->req.misc =
1060                     (((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
1061                 req->req.tag = arm_addr->arm_tag;
1062                 req->req.recvb = arm_addr->recvb;
1063                 req->req.length = size;
1064                 arm_req_resp = (struct arm_request_response *)(req->data);
1065                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1066                                                  (sizeof
1067                                                   (struct
1068                                                    arm_request_response)));
1069                 arm_resp =
1070                     (struct arm_response *)((byte_t *) (arm_req) +
1071                                             (sizeof(struct arm_request)));
1072                 arm_req->buffer = NULL;
1073                 arm_resp->buffer = NULL;
1074                 if (rcode == RCODE_COMPLETE) {
1075                         byte_t *buf =
1076                             (byte_t *) arm_resp + sizeof(struct arm_response);
1077                         memcpy(buf,
1078                                (arm_addr->addr_space_buffer) + (addr -
1079                                                                 (arm_addr->
1080                                                                  start)),
1081                                length);
1082                         arm_resp->buffer =
1083                             int2ptr((arm_addr->recvb) +
1084                                     sizeof(struct arm_request_response) +
1085                                     sizeof(struct arm_request) +
1086                                     sizeof(struct arm_response));
1087                 }
1088                 arm_resp->buffer_length =
1089                     (rcode == RCODE_COMPLETE) ? length : 0;
1090                 arm_resp->response_code = rcode;
1091                 arm_req->buffer_length = 0;
1092                 arm_req->generation = req->req.generation;
1093                 arm_req->extended_transaction_code = 0;
1094                 arm_req->destination_offset = addr;
1095                 arm_req->source_nodeid = nodeid;
1096                 arm_req->destination_nodeid = host->node_id;
1097                 arm_req->tlabel = (flags >> 10) & 0x3f;
1098                 arm_req->tcode = (flags >> 4) & 0x0f;
1099                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1100                                                 sizeof(struct
1101                                                        arm_request_response));
1102                 arm_req_resp->response =
1103                     int2ptr((arm_addr->recvb) +
1104                             sizeof(struct arm_request_response) +
1105                             sizeof(struct arm_request));
1106                 queue_complete_req(req);
1107         }
1108         spin_unlock_irqrestore(&host_info_lock, irqflags);
1109         return (rcode);
1110 }
1111
1112 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
1113                      quadlet_t * data, u64 addr, size_t length, u16 flags)
1114 {
1115         unsigned long irqflags;
1116         struct pending_request *req;
1117         struct host_info *hi;
1118         struct file_info *fi = NULL;
1119         struct list_head *entry;
1120         struct arm_addr *arm_addr = NULL;
1121         struct arm_request *arm_req = NULL;
1122         struct arm_response *arm_resp = NULL;
1123         int found = 0, size = 0, rcode = -1, length_conflict = 0;
1124         struct arm_request_response *arm_req_resp = NULL;
1125
1126         DBGMSG("arm_write called by node: %X"
1127                "addr: %4.4x %8.8x length: %Zu", nodeid,
1128                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1129                length);
1130         spin_lock_irqsave(&host_info_lock, irqflags);
1131         hi = find_host_info(host);      /* search address-entry */
1132         if (hi != NULL) {
1133                 list_for_each_entry(fi, &hi->file_info_list, list) {
1134                         entry = fi->addr_list.next;
1135                         while (entry != &(fi->addr_list)) {
1136                                 arm_addr =
1137                                     list_entry(entry, struct arm_addr,
1138                                                addr_list);
1139                                 if (((arm_addr->start) <= (addr))
1140                                     && ((arm_addr->end) >= (addr + length))) {
1141                                         found = 1;
1142                                         break;
1143                                 }
1144                                 entry = entry->next;
1145                         }
1146                         if (found) {
1147                                 break;
1148                         }
1149                 }
1150         }
1151         rcode = -1;
1152         if (!found) {
1153                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1154                        " -> rcode_address_error\n");
1155                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1156                 return (RCODE_ADDRESS_ERROR);
1157         } else {
1158                 DBGMSG("arm_write addr_entry FOUND");
1159         }
1160         if (arm_addr->rec_length < length) {
1161                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1162                 length_conflict = 1;
1163                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1164         }
1165         if (rcode == -1) {
1166                 if (arm_addr->access_rights & ARM_WRITE) {
1167                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1168                                 memcpy((arm_addr->addr_space_buffer) +
1169                                        (addr - (arm_addr->start)), data,
1170                                        length);
1171                                 DBGMSG("arm_write -> (rcode_complete)");
1172                                 rcode = RCODE_COMPLETE;
1173                         }
1174                 } else {
1175                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1176                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1177                 }
1178         }
1179         if (arm_addr->notification_options & ARM_WRITE) {
1180                 DBGMSG("arm_write -> entering notification-section");
1181                 req = __alloc_pending_request(SLAB_ATOMIC);
1182                 if (!req) {
1183                         DBGMSG("arm_write -> rcode_conflict_error");
1184                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1185                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1186                                                            The request my be retried */
1187                 }
1188                 size =
1189                     sizeof(struct arm_request) + sizeof(struct arm_response) +
1190                     (length) * sizeof(byte_t) +
1191                     sizeof(struct arm_request_response);
1192                 req->data = kmalloc(size, SLAB_ATOMIC);
1193                 if (!(req->data)) {
1194                         free_pending_request(req);
1195                         DBGMSG("arm_write -> rcode_conflict_error");
1196                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1197                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1198                                                            The request may be retried */
1199                 }
1200                 req->free_data = 1;
1201                 req->file_info = fi;
1202                 req->req.type = RAW1394_REQ_ARM;
1203                 req->req.generation = get_hpsb_generation(host);
1204                 req->req.misc =
1205                     (((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1206                 req->req.tag = arm_addr->arm_tag;
1207                 req->req.recvb = arm_addr->recvb;
1208                 req->req.length = size;
1209                 arm_req_resp = (struct arm_request_response *)(req->data);
1210                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1211                                                  (sizeof
1212                                                   (struct
1213                                                    arm_request_response)));
1214                 arm_resp =
1215                     (struct arm_response *)((byte_t *) (arm_req) +
1216                                             (sizeof(struct arm_request)));
1217                 arm_resp->buffer = NULL;
1218                 memcpy((byte_t *) arm_resp + sizeof(struct arm_response),
1219                        data, length);
1220                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1221                                           sizeof(struct arm_request_response) +
1222                                           sizeof(struct arm_request) +
1223                                           sizeof(struct arm_response));
1224                 arm_req->buffer_length = length;
1225                 arm_req->generation = req->req.generation;
1226                 arm_req->extended_transaction_code = 0;
1227                 arm_req->destination_offset = addr;
1228                 arm_req->source_nodeid = nodeid;
1229                 arm_req->destination_nodeid = destid;
1230                 arm_req->tlabel = (flags >> 10) & 0x3f;
1231                 arm_req->tcode = (flags >> 4) & 0x0f;
1232                 arm_resp->buffer_length = 0;
1233                 arm_resp->response_code = rcode;
1234                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1235                                                 sizeof(struct
1236                                                        arm_request_response));
1237                 arm_req_resp->response =
1238                     int2ptr((arm_addr->recvb) +
1239                             sizeof(struct arm_request_response) +
1240                             sizeof(struct arm_request));
1241                 queue_complete_req(req);
1242         }
1243         spin_unlock_irqrestore(&host_info_lock, irqflags);
1244         return (rcode);
1245 }
1246
1247 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
1248                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
1249                     u16 flags)
1250 {
1251         unsigned long irqflags;
1252         struct pending_request *req;
1253         struct host_info *hi;
1254         struct file_info *fi = NULL;
1255         struct list_head *entry;
1256         struct arm_addr *arm_addr = NULL;
1257         struct arm_request *arm_req = NULL;
1258         struct arm_response *arm_resp = NULL;
1259         int found = 0, size = 0, rcode = -1;
1260         quadlet_t old, new;
1261         struct arm_request_response *arm_req_resp = NULL;
1262
1263         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1264             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1265                 DBGMSG("arm_lock  called by node: %X "
1266                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1267                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1268                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1269                        be32_to_cpu(data));
1270         } else {
1271                 DBGMSG("arm_lock  called by node: %X "
1272                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1273                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1274                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1275                        be32_to_cpu(data), be32_to_cpu(arg));
1276         }
1277         spin_lock_irqsave(&host_info_lock, irqflags);
1278         hi = find_host_info(host);      /* search address-entry */
1279         if (hi != NULL) {
1280                 list_for_each_entry(fi, &hi->file_info_list, list) {
1281                         entry = fi->addr_list.next;
1282                         while (entry != &(fi->addr_list)) {
1283                                 arm_addr =
1284                                     list_entry(entry, struct arm_addr,
1285                                                addr_list);
1286                                 if (((arm_addr->start) <= (addr))
1287                                     && ((arm_addr->end) >=
1288                                         (addr + sizeof(*store)))) {
1289                                         found = 1;
1290                                         break;
1291                                 }
1292                                 entry = entry->next;
1293                         }
1294                         if (found) {
1295                                 break;
1296                         }
1297                 }
1298         }
1299         rcode = -1;
1300         if (!found) {
1301                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1302                        " -> rcode_address_error\n");
1303                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1304                 return (RCODE_ADDRESS_ERROR);
1305         } else {
1306                 DBGMSG("arm_lock addr_entry FOUND");
1307         }
1308         if (rcode == -1) {
1309                 if (arm_addr->access_rights & ARM_LOCK) {
1310                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1311                                 memcpy(&old,
1312                                        (arm_addr->addr_space_buffer) + (addr -
1313                                                                         (arm_addr->
1314                                                                          start)),
1315                                        sizeof(old));
1316                                 switch (ext_tcode) {
1317                                 case (EXTCODE_MASK_SWAP):
1318                                         new = data | (old & ~arg);
1319                                         break;
1320                                 case (EXTCODE_COMPARE_SWAP):
1321                                         if (old == arg) {
1322                                                 new = data;
1323                                         } else {
1324                                                 new = old;
1325                                         }
1326                                         break;
1327                                 case (EXTCODE_FETCH_ADD):
1328                                         new =
1329                                             cpu_to_be32(be32_to_cpu(data) +
1330                                                         be32_to_cpu(old));
1331                                         break;
1332                                 case (EXTCODE_LITTLE_ADD):
1333                                         new =
1334                                             cpu_to_le32(le32_to_cpu(data) +
1335                                                         le32_to_cpu(old));
1336                                         break;
1337                                 case (EXTCODE_BOUNDED_ADD):
1338                                         if (old != arg) {
1339                                                 new =
1340                                                     cpu_to_be32(be32_to_cpu
1341                                                                 (data) +
1342                                                                 be32_to_cpu
1343                                                                 (old));
1344                                         } else {
1345                                                 new = old;
1346                                         }
1347                                         break;
1348                                 case (EXTCODE_WRAP_ADD):
1349                                         if (old != arg) {
1350                                                 new =
1351                                                     cpu_to_be32(be32_to_cpu
1352                                                                 (data) +
1353                                                                 be32_to_cpu
1354                                                                 (old));
1355                                         } else {
1356                                                 new = data;
1357                                         }
1358                                         break;
1359                                 default:
1360                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1361                                         printk(KERN_ERR
1362                                                "raw1394: arm_lock FAILED "
1363                                                "ext_tcode not allowed -> rcode_type_error\n");
1364                                         break;
1365                                 }       /*switch */
1366                                 if (rcode == -1) {
1367                                         DBGMSG("arm_lock -> (rcode_complete)");
1368                                         rcode = RCODE_COMPLETE;
1369                                         memcpy(store, &old, sizeof(*store));
1370                                         memcpy((arm_addr->addr_space_buffer) +
1371                                                (addr - (arm_addr->start)),
1372                                                &new, sizeof(*store));
1373                                 }
1374                         }
1375                 } else {
1376                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1377                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1378                 }
1379         }
1380         if (arm_addr->notification_options & ARM_LOCK) {
1381                 byte_t *buf1, *buf2;
1382                 DBGMSG("arm_lock -> entering notification-section");
1383                 req = __alloc_pending_request(SLAB_ATOMIC);
1384                 if (!req) {
1385                         DBGMSG("arm_lock -> rcode_conflict_error");
1386                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1387                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1388                                                            The request may be retried */
1389                 }
1390                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1391                 req->data = kmalloc(size, SLAB_ATOMIC);
1392                 if (!(req->data)) {
1393                         free_pending_request(req);
1394                         DBGMSG("arm_lock -> rcode_conflict_error");
1395                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1396                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1397                                                            The request may be retried */
1398                 }
1399                 req->free_data = 1;
1400                 arm_req_resp = (struct arm_request_response *)(req->data);
1401                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1402                                                  (sizeof
1403                                                   (struct
1404                                                    arm_request_response)));
1405                 arm_resp =
1406                     (struct arm_response *)((byte_t *) (arm_req) +
1407                                             (sizeof(struct arm_request)));
1408                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1409                 buf2 = buf1 + 2 * sizeof(*store);
1410                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1411                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1412                         arm_req->buffer_length = sizeof(*store);
1413                         memcpy(buf1, &data, sizeof(*store));
1414
1415                 } else {
1416                         arm_req->buffer_length = 2 * sizeof(*store);
1417                         memcpy(buf1, &arg, sizeof(*store));
1418                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1419                 }
1420                 if (rcode == RCODE_COMPLETE) {
1421                         arm_resp->buffer_length = sizeof(*store);
1422                         memcpy(buf2, &old, sizeof(*store));
1423                 } else {
1424                         arm_resp->buffer_length = 0;
1425                 }
1426                 req->file_info = fi;
1427                 req->req.type = RAW1394_REQ_ARM;
1428                 req->req.generation = get_hpsb_generation(host);
1429                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1430                                  (ARM_LOCK & 0xFF));
1431                 req->req.tag = arm_addr->arm_tag;
1432                 req->req.recvb = arm_addr->recvb;
1433                 req->req.length = size;
1434                 arm_req->generation = req->req.generation;
1435                 arm_req->extended_transaction_code = ext_tcode;
1436                 arm_req->destination_offset = addr;
1437                 arm_req->source_nodeid = nodeid;
1438                 arm_req->destination_nodeid = host->node_id;
1439                 arm_req->tlabel = (flags >> 10) & 0x3f;
1440                 arm_req->tcode = (flags >> 4) & 0x0f;
1441                 arm_resp->response_code = rcode;
1442                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1443                                                 sizeof(struct
1444                                                        arm_request_response));
1445                 arm_req_resp->response =
1446                     int2ptr((arm_addr->recvb) +
1447                             sizeof(struct arm_request_response) +
1448                             sizeof(struct arm_request));
1449                 arm_req->buffer =
1450                     int2ptr((arm_addr->recvb) +
1451                             sizeof(struct arm_request_response) +
1452                             sizeof(struct arm_request) +
1453                             sizeof(struct arm_response));
1454                 arm_resp->buffer =
1455                     int2ptr((arm_addr->recvb) +
1456                             sizeof(struct arm_request_response) +
1457                             sizeof(struct arm_request) +
1458                             sizeof(struct arm_response) + 2 * sizeof(*store));
1459                 queue_complete_req(req);
1460         }
1461         spin_unlock_irqrestore(&host_info_lock, irqflags);
1462         return (rcode);
1463 }
1464
1465 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
1466                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
1467                       u16 flags)
1468 {
1469         unsigned long irqflags;
1470         struct pending_request *req;
1471         struct host_info *hi;
1472         struct file_info *fi = NULL;
1473         struct list_head *entry;
1474         struct arm_addr *arm_addr = NULL;
1475         struct arm_request *arm_req = NULL;
1476         struct arm_response *arm_resp = NULL;
1477         int found = 0, size = 0, rcode = -1;
1478         octlet_t old, new;
1479         struct arm_request_response *arm_req_resp = NULL;
1480
1481         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1482             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1483                 DBGMSG("arm_lock64 called by node: %X "
1484                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1485                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1486                        (u32) (addr & 0xFFFFFFFF),
1487                        ext_tcode & 0xFF,
1488                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1489                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1490         } else {
1491                 DBGMSG("arm_lock64 called by node: %X "
1492                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1493                        "%8.8X %8.8X ",
1494                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1495                        (u32) (addr & 0xFFFFFFFF),
1496                        ext_tcode & 0xFF,
1497                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1498                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1499                        (u32) ((be64_to_cpu(arg) >> 32) & 0xFFFFFFFF),
1500                        (u32) (be64_to_cpu(arg) & 0xFFFFFFFF));
1501         }
1502         spin_lock_irqsave(&host_info_lock, irqflags);
1503         hi = find_host_info(host);      /* search addressentry in file_info's for host */
1504         if (hi != NULL) {
1505                 list_for_each_entry(fi, &hi->file_info_list, list) {
1506                         entry = fi->addr_list.next;
1507                         while (entry != &(fi->addr_list)) {
1508                                 arm_addr =
1509                                     list_entry(entry, struct arm_addr,
1510                                                addr_list);
1511                                 if (((arm_addr->start) <= (addr))
1512                                     && ((arm_addr->end) >=
1513                                         (addr + sizeof(*store)))) {
1514                                         found = 1;
1515                                         break;
1516                                 }
1517                                 entry = entry->next;
1518                         }
1519                         if (found) {
1520                                 break;
1521                         }
1522                 }
1523         }
1524         rcode = -1;
1525         if (!found) {
1526                 printk(KERN_ERR
1527                        "raw1394: arm_lock64 FAILED addr_entry not found"
1528                        " -> rcode_address_error\n");
1529                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1530                 return (RCODE_ADDRESS_ERROR);
1531         } else {
1532                 DBGMSG("arm_lock64 addr_entry FOUND");
1533         }
1534         if (rcode == -1) {
1535                 if (arm_addr->access_rights & ARM_LOCK) {
1536                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1537                                 memcpy(&old,
1538                                        (arm_addr->addr_space_buffer) + (addr -
1539                                                                         (arm_addr->
1540                                                                          start)),
1541                                        sizeof(old));
1542                                 switch (ext_tcode) {
1543                                 case (EXTCODE_MASK_SWAP):
1544                                         new = data | (old & ~arg);
1545                                         break;
1546                                 case (EXTCODE_COMPARE_SWAP):
1547                                         if (old == arg) {
1548                                                 new = data;
1549                                         } else {
1550                                                 new = old;
1551                                         }
1552                                         break;
1553                                 case (EXTCODE_FETCH_ADD):
1554                                         new =
1555                                             cpu_to_be64(be64_to_cpu(data) +
1556                                                         be64_to_cpu(old));
1557                                         break;
1558                                 case (EXTCODE_LITTLE_ADD):
1559                                         new =
1560                                             cpu_to_le64(le64_to_cpu(data) +
1561                                                         le64_to_cpu(old));
1562                                         break;
1563                                 case (EXTCODE_BOUNDED_ADD):
1564                                         if (old != arg) {
1565                                                 new =
1566                                                     cpu_to_be64(be64_to_cpu
1567                                                                 (data) +
1568                                                                 be64_to_cpu
1569                                                                 (old));
1570                                         } else {
1571                                                 new = old;
1572                                         }
1573                                         break;
1574                                 case (EXTCODE_WRAP_ADD):
1575                                         if (old != arg) {
1576                                                 new =
1577                                                     cpu_to_be64(be64_to_cpu
1578                                                                 (data) +
1579                                                                 be64_to_cpu
1580                                                                 (old));
1581                                         } else {
1582                                                 new = data;
1583                                         }
1584                                         break;
1585                                 default:
1586                                         printk(KERN_ERR
1587                                                "raw1394: arm_lock64 FAILED "
1588                                                "ext_tcode not allowed -> rcode_type_error\n");
1589                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1590                                         break;
1591                                 }       /*switch */
1592                                 if (rcode == -1) {
1593                                         DBGMSG
1594                                             ("arm_lock64 -> (rcode_complete)");
1595                                         rcode = RCODE_COMPLETE;
1596                                         memcpy(store, &old, sizeof(*store));
1597                                         memcpy((arm_addr->addr_space_buffer) +
1598                                                (addr - (arm_addr->start)),
1599                                                &new, sizeof(*store));
1600                                 }
1601                         }
1602                 } else {
1603                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1604                         DBGMSG
1605                             ("arm_lock64 -> rcode_type_error (access denied)");
1606                 }
1607         }
1608         if (arm_addr->notification_options & ARM_LOCK) {
1609                 byte_t *buf1, *buf2;
1610                 DBGMSG("arm_lock64 -> entering notification-section");
1611                 req = __alloc_pending_request(SLAB_ATOMIC);
1612                 if (!req) {
1613                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1614                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1615                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1616                                                            The request may be retried */
1617                 }
1618                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1619                 req->data = kmalloc(size, SLAB_ATOMIC);
1620                 if (!(req->data)) {
1621                         free_pending_request(req);
1622                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1623                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1624                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1625                                                            The request may be retried */
1626                 }
1627                 req->free_data = 1;
1628                 arm_req_resp = (struct arm_request_response *)(req->data);
1629                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1630                                                  (sizeof
1631                                                   (struct
1632                                                    arm_request_response)));
1633                 arm_resp =
1634                     (struct arm_response *)((byte_t *) (arm_req) +
1635                                             (sizeof(struct arm_request)));
1636                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1637                 buf2 = buf1 + 2 * sizeof(*store);
1638                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1639                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1640                         arm_req->buffer_length = sizeof(*store);
1641                         memcpy(buf1, &data, sizeof(*store));
1642
1643                 } else {
1644                         arm_req->buffer_length = 2 * sizeof(*store);
1645                         memcpy(buf1, &arg, sizeof(*store));
1646                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1647                 }
1648                 if (rcode == RCODE_COMPLETE) {
1649                         arm_resp->buffer_length = sizeof(*store);
1650                         memcpy(buf2, &old, sizeof(*store));
1651                 } else {
1652                         arm_resp->buffer_length = 0;
1653                 }
1654                 req->file_info = fi;
1655                 req->req.type = RAW1394_REQ_ARM;
1656                 req->req.generation = get_hpsb_generation(host);
1657                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1658                                  (ARM_LOCK & 0xFF));
1659                 req->req.tag = arm_addr->arm_tag;
1660                 req->req.recvb = arm_addr->recvb;
1661                 req->req.length = size;
1662                 arm_req->generation = req->req.generation;
1663                 arm_req->extended_transaction_code = ext_tcode;
1664                 arm_req->destination_offset = addr;
1665                 arm_req->source_nodeid = nodeid;
1666                 arm_req->destination_nodeid = host->node_id;
1667                 arm_req->tlabel = (flags >> 10) & 0x3f;
1668                 arm_req->tcode = (flags >> 4) & 0x0f;
1669                 arm_resp->response_code = rcode;
1670                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1671                                                 sizeof(struct
1672                                                        arm_request_response));
1673                 arm_req_resp->response =
1674                     int2ptr((arm_addr->recvb) +
1675                             sizeof(struct arm_request_response) +
1676                             sizeof(struct arm_request));
1677                 arm_req->buffer =
1678                     int2ptr((arm_addr->recvb) +
1679                             sizeof(struct arm_request_response) +
1680                             sizeof(struct arm_request) +
1681                             sizeof(struct arm_response));
1682                 arm_resp->buffer =
1683                     int2ptr((arm_addr->recvb) +
1684                             sizeof(struct arm_request_response) +
1685                             sizeof(struct arm_request) +
1686                             sizeof(struct arm_response) + 2 * sizeof(*store));
1687                 queue_complete_req(req);
1688         }
1689         spin_unlock_irqrestore(&host_info_lock, irqflags);
1690         return (rcode);
1691 }
1692
1693 static int arm_register(struct file_info *fi, struct pending_request *req)
1694 {
1695         int retval;
1696         struct arm_addr *addr;
1697         struct host_info *hi;
1698         struct file_info *fi_hlp = NULL;
1699         struct list_head *entry;
1700         struct arm_addr *arm_addr = NULL;
1701         int same_host, another_host;
1702         unsigned long flags;
1703
1704         DBGMSG("arm_register called "
1705                "addr(Offset): %8.8x %8.8x length: %u "
1706                "rights: %2.2X notify: %2.2X "
1707                "max_blk_len: %4.4X",
1708                (u32) ((req->req.address >> 32) & 0xFFFF),
1709                (u32) (req->req.address & 0xFFFFFFFF),
1710                req->req.length, ((req->req.misc >> 8) & 0xFF),
1711                (req->req.misc & 0xFF), ((req->req.misc >> 16) & 0xFFFF));
1712         /* check addressrange */
1713         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1714             (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) !=
1715              0)) {
1716                 req->req.length = 0;
1717                 return (-EINVAL);
1718         }
1719         /* addr-list-entry for fileinfo */
1720         addr = kmalloc(sizeof(*addr), SLAB_KERNEL);
1721         if (!addr) {
1722                 req->req.length = 0;
1723                 return (-ENOMEM);
1724         }
1725         /* allocation of addr_space_buffer */
1726         addr->addr_space_buffer = vmalloc(req->req.length);
1727         if (!(addr->addr_space_buffer)) {
1728                 kfree(addr);
1729                 req->req.length = 0;
1730                 return (-ENOMEM);
1731         }
1732         /* initialization of addr_space_buffer */
1733         if ((req->req.sendb) == (unsigned long)NULL) {
1734                 /* init: set 0 */
1735                 memset(addr->addr_space_buffer, 0, req->req.length);
1736         } else {
1737                 /* init: user -> kernel */
1738                 if (copy_from_user
1739                     (addr->addr_space_buffer, int2ptr(req->req.sendb),
1740                      req->req.length)) {
1741                         vfree(addr->addr_space_buffer);
1742                         kfree(addr);
1743                         return (-EFAULT);
1744                 }
1745         }
1746         INIT_LIST_HEAD(&addr->addr_list);
1747         addr->arm_tag = req->req.tag;
1748         addr->start = req->req.address;
1749         addr->end = req->req.address + req->req.length;
1750         addr->access_rights = (u8) (req->req.misc & 0x0F);
1751         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1752         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1753         addr->access_rights |= addr->client_transactions;
1754         addr->notification_options |= addr->client_transactions;
1755         addr->recvb = req->req.recvb;
1756         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1757         spin_lock_irqsave(&host_info_lock, flags);
1758         hi = find_host_info(fi->host);
1759         same_host = 0;
1760         another_host = 0;
1761         /* same host with address-entry containing same addressrange ? */
1762         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1763                 entry = fi_hlp->addr_list.next;
1764                 while (entry != &(fi_hlp->addr_list)) {
1765                         arm_addr =
1766                             list_entry(entry, struct arm_addr, addr_list);
1767                         if ((arm_addr->start == addr->start)
1768                             && (arm_addr->end == addr->end)) {
1769                                 DBGMSG("same host ownes same "
1770                                        "addressrange -> EALREADY");
1771                                 same_host = 1;
1772                                 break;
1773                         }
1774                         entry = entry->next;
1775                 }
1776                 if (same_host) {
1777                         break;
1778                 }
1779         }
1780         if (same_host) {
1781                 /* addressrange occupied by same host */
1782                 vfree(addr->addr_space_buffer);
1783                 kfree(addr);
1784                 spin_unlock_irqrestore(&host_info_lock, flags);
1785                 return (-EALREADY);
1786         }
1787         /* another host with valid address-entry containing same addressrange */
1788         list_for_each_entry(hi, &host_info_list, list) {
1789                 if (hi->host != fi->host) {
1790                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1791                                 entry = fi_hlp->addr_list.next;
1792                                 while (entry != &(fi_hlp->addr_list)) {
1793                                         arm_addr =
1794                                             list_entry(entry, struct arm_addr,
1795                                                        addr_list);
1796                                         if ((arm_addr->start == addr->start)
1797                                             && (arm_addr->end == addr->end)) {
1798                                                 DBGMSG
1799                                                     ("another host ownes same "
1800                                                      "addressrange");
1801                                                 another_host = 1;
1802                                                 break;
1803                                         }
1804                                         entry = entry->next;
1805                                 }
1806                                 if (another_host) {
1807                                         break;
1808                                 }
1809                         }
1810                 }
1811         }
1812         if (another_host) {
1813                 DBGMSG("another hosts entry is valid -> SUCCESS");
1814                 if (copy_to_user(int2ptr(req->req.recvb),
1815                                  &addr->start, sizeof(u64))) {
1816                         printk(KERN_ERR "raw1394: arm_register failed "
1817                                " address-range-entry is invalid -> EFAULT !!!\n");
1818                         vfree(addr->addr_space_buffer);
1819                         kfree(addr);
1820                         spin_unlock_irqrestore(&host_info_lock, flags);
1821                         return (-EFAULT);
1822                 }
1823                 free_pending_request(req);      /* immediate success or fail */
1824                 /* INSERT ENTRY */
1825                 list_add_tail(&addr->addr_list, &fi->addr_list);
1826                 spin_unlock_irqrestore(&host_info_lock, flags);
1827                 return sizeof(struct raw1394_request);
1828         }
1829         retval =
1830             hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
1831                                     req->req.address,
1832                                     req->req.address + req->req.length);
1833         if (retval) {
1834                 /* INSERT ENTRY */
1835                 list_add_tail(&addr->addr_list, &fi->addr_list);
1836         } else {
1837                 DBGMSG("arm_register failed errno: %d \n", retval);
1838                 vfree(addr->addr_space_buffer);
1839                 kfree(addr);
1840                 spin_unlock_irqrestore(&host_info_lock, flags);
1841                 return (-EALREADY);
1842         }
1843         spin_unlock_irqrestore(&host_info_lock, flags);
1844         free_pending_request(req);      /* immediate success or fail */
1845         return sizeof(struct raw1394_request);
1846 }
1847
1848 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1849 {
1850         int found = 0;
1851         int retval = 0;
1852         struct list_head *entry;
1853         struct arm_addr *addr = NULL;
1854         struct host_info *hi;
1855         struct file_info *fi_hlp = NULL;
1856         struct arm_addr *arm_addr = NULL;
1857         int another_host;
1858         unsigned long flags;
1859
1860         DBGMSG("arm_Unregister called addr(Offset): "
1861                "%8.8x %8.8x",
1862                (u32) ((req->req.address >> 32) & 0xFFFF),
1863                (u32) (req->req.address & 0xFFFFFFFF));
1864         spin_lock_irqsave(&host_info_lock, flags);
1865         /* get addr */
1866         entry = fi->addr_list.next;
1867         while (entry != &(fi->addr_list)) {
1868                 addr = list_entry(entry, struct arm_addr, addr_list);
1869                 if (addr->start == req->req.address) {
1870                         found = 1;
1871                         break;
1872                 }
1873                 entry = entry->next;
1874         }
1875         if (!found) {
1876                 DBGMSG("arm_Unregister addr not found");
1877                 spin_unlock_irqrestore(&host_info_lock, flags);
1878                 return (-EINVAL);
1879         }
1880         DBGMSG("arm_Unregister addr found");
1881         another_host = 0;
1882         /* another host with valid address-entry containing
1883            same addressrange */
1884         list_for_each_entry(hi, &host_info_list, list) {
1885                 if (hi->host != fi->host) {
1886                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1887                                 entry = fi_hlp->addr_list.next;
1888                                 while (entry != &(fi_hlp->addr_list)) {
1889                                         arm_addr = list_entry(entry,
1890                                                               struct arm_addr,
1891                                                               addr_list);
1892                                         if (arm_addr->start == addr->start) {
1893                                                 DBGMSG("another host ownes "
1894                                                        "same addressrange");
1895                                                 another_host = 1;
1896                                                 break;
1897                                         }
1898                                         entry = entry->next;
1899                                 }
1900                                 if (another_host) {
1901                                         break;
1902                                 }
1903                         }
1904                 }
1905         }
1906         if (another_host) {
1907                 DBGMSG("delete entry from list -> success");
1908                 list_del(&addr->addr_list);
1909                 vfree(addr->addr_space_buffer);
1910                 kfree(addr);
1911                 free_pending_request(req);      /* immediate success or fail */
1912                 spin_unlock_irqrestore(&host_info_lock, flags);
1913                 return sizeof(struct raw1394_request);
1914         }
1915         retval =
1916             hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
1917                                       addr->start);
1918         if (!retval) {
1919                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1920                 spin_unlock_irqrestore(&host_info_lock, flags);
1921                 return (-EINVAL);
1922         }
1923         DBGMSG("delete entry from list -> success");
1924         list_del(&addr->addr_list);
1925         spin_unlock_irqrestore(&host_info_lock, flags);
1926         vfree(addr->addr_space_buffer);
1927         kfree(addr);
1928         free_pending_request(req);      /* immediate success or fail */
1929         return sizeof(struct raw1394_request);
1930 }
1931
1932 /* Copy data from ARM buffer(s) to user buffer. */
1933 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1934 {
1935         struct arm_addr *arm_addr = NULL;
1936         unsigned long flags;
1937         unsigned long offset;
1938
1939         struct list_head *entry;
1940
1941         DBGMSG("arm_get_buf "
1942                "addr(Offset): %04X %08X length: %u",
1943                (u32) ((req->req.address >> 32) & 0xFFFF),
1944                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1945
1946         spin_lock_irqsave(&host_info_lock, flags);
1947         entry = fi->addr_list.next;
1948         while (entry != &(fi->addr_list)) {
1949                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1950                 if ((arm_addr->start <= req->req.address) &&
1951                     (arm_addr->end > req->req.address)) {
1952                         if (req->req.address + req->req.length <= arm_addr->end) {
1953                                 offset = req->req.address - arm_addr->start;
1954
1955                                 DBGMSG
1956                                     ("arm_get_buf copy_to_user( %08X, %p, %u )",
1957                                      (u32) req->req.recvb,
1958                                      arm_addr->addr_space_buffer + offset,
1959                                      (u32) req->req.length);
1960
1961                                 if (copy_to_user
1962                                     (int2ptr(req->req.recvb),
1963                                      arm_addr->addr_space_buffer + offset,
1964                                      req->req.length)) {
1965                                         spin_unlock_irqrestore(&host_info_lock,
1966                                                                flags);
1967                                         return (-EFAULT);
1968                                 }
1969
1970                                 spin_unlock_irqrestore(&host_info_lock, flags);
1971                                 /* We have to free the request, because we
1972                                  * queue no response, and therefore nobody
1973                                  * will free it. */
1974                                 free_pending_request(req);
1975                                 return sizeof(struct raw1394_request);
1976                         } else {
1977                                 DBGMSG("arm_get_buf request exceeded mapping");
1978                                 spin_unlock_irqrestore(&host_info_lock, flags);
1979                                 return (-EINVAL);
1980                         }
1981                 }
1982                 entry = entry->next;
1983         }
1984         spin_unlock_irqrestore(&host_info_lock, flags);
1985         return (-EINVAL);
1986 }
1987
1988 /* Copy data from user buffer to ARM buffer(s). */
1989 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
1990 {
1991         struct arm_addr *arm_addr = NULL;
1992         unsigned long flags;
1993         unsigned long offset;
1994
1995         struct list_head *entry;
1996
1997         DBGMSG("arm_set_buf "
1998                "addr(Offset): %04X %08X length: %u",
1999                (u32) ((req->req.address >> 32) & 0xFFFF),
2000                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
2001
2002         spin_lock_irqsave(&host_info_lock, flags);
2003         entry = fi->addr_list.next;
2004         while (entry != &(fi->addr_list)) {
2005                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
2006                 if ((arm_addr->start <= req->req.address) &&
2007                     (arm_addr->end > req->req.address)) {
2008                         if (req->req.address + req->req.length <= arm_addr->end) {
2009                                 offset = req->req.address - arm_addr->start;
2010
2011                                 DBGMSG
2012                                     ("arm_set_buf copy_from_user( %p, %08X, %u )",
2013                                      arm_addr->addr_space_buffer + offset,
2014                                      (u32) req->req.sendb,
2015                                      (u32) req->req.length);
2016
2017                                 if (copy_from_user
2018                                     (arm_addr->addr_space_buffer + offset,
2019                                      int2ptr(req->req.sendb),
2020                                      req->req.length)) {
2021                                         spin_unlock_irqrestore(&host_info_lock,
2022                                                                flags);
2023                                         return (-EFAULT);
2024                                 }
2025
2026                                 spin_unlock_irqrestore(&host_info_lock, flags);
2027                                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2028                                 return sizeof(struct raw1394_request);
2029                         } else {
2030                                 DBGMSG("arm_set_buf request exceeded mapping");
2031                                 spin_unlock_irqrestore(&host_info_lock, flags);
2032                                 return (-EINVAL);
2033                         }
2034                 }
2035                 entry = entry->next;
2036         }
2037         spin_unlock_irqrestore(&host_info_lock, flags);
2038         return (-EINVAL);
2039 }
2040
2041 static int reset_notification(struct file_info *fi, struct pending_request *req)
2042 {
2043         DBGMSG("reset_notification called - switch %s ",
2044                (req->req.misc == RAW1394_NOTIFY_OFF) ? "OFF" : "ON");
2045         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
2046             (req->req.misc == RAW1394_NOTIFY_ON)) {
2047                 fi->notification = (u8) req->req.misc;
2048                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2049                 return sizeof(struct raw1394_request);
2050         }
2051         /* error EINVAL (22) invalid argument */
2052         return (-EINVAL);
2053 }
2054
2055 static int write_phypacket(struct file_info *fi, struct pending_request *req)
2056 {
2057         struct hpsb_packet *packet = NULL;
2058         int retval = 0;
2059         quadlet_t data;
2060         unsigned long flags;
2061
2062         data = be32_to_cpu((u32) req->req.sendb);
2063         DBGMSG("write_phypacket called - quadlet 0x%8.8x ", data);
2064         packet = hpsb_make_phypacket(fi->host, data);
2065         if (!packet)
2066                 return -ENOMEM;
2067         req->req.length = 0;
2068         req->packet = packet;
2069         hpsb_set_packet_complete_task(packet,
2070                                       (void (*)(void *))queue_complete_cb, req);
2071         spin_lock_irqsave(&fi->reqlists_lock, flags);
2072         list_add_tail(&req->list, &fi->req_pending);
2073         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2074         packet->generation = req->req.generation;
2075         retval = hpsb_send_packet(packet);
2076         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
2077         if (retval < 0) {
2078                 req->req.error = RAW1394_ERROR_SEND_ERROR;
2079                 req->req.length = 0;
2080                 queue_complete_req(req);
2081         }
2082         return sizeof(struct raw1394_request);
2083 }
2084
2085 static int get_config_rom(struct file_info *fi, struct pending_request *req)
2086 {
2087         int ret = sizeof(struct raw1394_request);
2088         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2089         int status;
2090
2091         if (!data)
2092                 return -ENOMEM;
2093
2094         status =
2095             csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
2096                          data, req->req.length);
2097         if (copy_to_user(int2ptr(req->req.recvb), data, req->req.length))
2098                 ret = -EFAULT;
2099         if (copy_to_user
2100             (int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
2101              sizeof(fi->host->csr.rom->cache_head->len)))
2102                 ret = -EFAULT;
2103         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
2104                          sizeof(fi->host->csr.generation)))
2105                 ret = -EFAULT;
2106         if (copy_to_user(int2ptr(req->req.sendb), &status, sizeof(status)))
2107                 ret = -EFAULT;
2108         kfree(data);
2109         if (ret >= 0) {
2110                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2111         }
2112         return ret;
2113 }
2114
2115 static int update_config_rom(struct file_info *fi, struct pending_request *req)
2116 {
2117         int ret = sizeof(struct raw1394_request);
2118         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2119         if (!data)
2120                 return -ENOMEM;
2121         if (copy_from_user(data, int2ptr(req->req.sendb), req->req.length)) {
2122                 ret = -EFAULT;
2123         } else {
2124                 int status = hpsb_update_config_rom(fi->host,
2125                                                     data, req->req.length,
2126                                                     (unsigned char)req->req.
2127                                                     misc);
2128                 if (copy_to_user
2129                     (int2ptr(req->req.recvb), &status, sizeof(status)))
2130                         ret = -ENOMEM;
2131         }
2132         kfree(data);
2133         if (ret >= 0) {
2134                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2135                 fi->cfgrom_upd = 1;
2136         }
2137         return ret;
2138 }
2139
2140 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
2141 {
2142         struct csr1212_keyval *kv;
2143         struct csr1212_csr_rom_cache *cache;
2144         struct csr1212_dentry *dentry;
2145         u32 dr;
2146         int ret = 0;
2147
2148         if (req->req.misc == ~0) {
2149                 if (req->req.length == 0)
2150                         return -EINVAL;
2151
2152                 /* Find an unused slot */
2153                 for (dr = 0;
2154                      dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr];
2155                      dr++) ;
2156
2157                 if (dr == RAW1394_MAX_USER_CSR_DIRS)
2158                         return -ENOMEM;
2159
2160                 fi->csr1212_dirs[dr] =
2161                     csr1212_new_directory(CSR1212_KV_ID_VENDOR);
2162                 if (!fi->csr1212_dirs[dr])
2163                         return -ENOMEM;
2164         } else {
2165                 dr = req->req.misc;
2166                 if (!fi->csr1212_dirs[dr])
2167                         return -EINVAL;
2168
2169                 /* Delete old stuff */
2170                 for (dentry =
2171                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2172                      dentry; dentry = dentry->next) {
2173                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2174                                                              root_kv,
2175                                                              dentry->kv);
2176                 }
2177
2178                 if (req->req.length == 0) {
2179                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
2180                         fi->csr1212_dirs[dr] = NULL;
2181
2182                         hpsb_update_config_rom_image(fi->host);
2183                         free_pending_request(req);
2184                         return sizeof(struct raw1394_request);
2185                 }
2186         }
2187
2188         cache = csr1212_rom_cache_malloc(0, req->req.length);
2189         if (!cache) {
2190                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2191                 fi->csr1212_dirs[dr] = NULL;
2192                 return -ENOMEM;
2193         }
2194
2195         cache->filled_head = kmalloc(sizeof(*cache->filled_head), GFP_KERNEL);
2196         if (!cache->filled_head) {
2197                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2198                 fi->csr1212_dirs[dr] = NULL;
2199                 CSR1212_FREE(cache);
2200                 return -ENOMEM;
2201         }
2202         cache->filled_tail = cache->filled_head;
2203
2204         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
2205                            req->req.length)) {
2206                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2207                 fi->csr1212_dirs[dr] = NULL;
2208                 ret = -EFAULT;
2209         } else {
2210                 cache->len = req->req.length;
2211                 cache->filled_head->offset_start = 0;
2212                 cache->filled_head->offset_end = cache->size - 1;
2213
2214                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2215
2216                 ret = CSR1212_SUCCESS;
2217                 /* parse all the items */
2218                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2219                      kv = kv->next) {
2220                         ret = csr1212_parse_keyval(kv, cache);
2221                 }
2222
2223                 /* attach top level items to the root directory */
2224                 for (dentry =
2225                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2226                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2227                         ret =
2228                             csr1212_attach_keyval_to_directory(fi->host->csr.
2229                                                                rom->root_kv,
2230                                                                dentry->kv);
2231                 }
2232
2233                 if (ret == CSR1212_SUCCESS) {
2234                         ret = hpsb_update_config_rom_image(fi->host);
2235
2236                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2237                                                      &dr, sizeof(dr))) {
2238                                 ret = -ENOMEM;
2239                         }
2240                 }
2241         }
2242         kfree(cache->filled_head);
2243         CSR1212_FREE(cache);
2244
2245         if (ret >= 0) {
2246                 /* we have to free the request, because we queue no response,
2247                  * and therefore nobody will free it */
2248                 free_pending_request(req);
2249                 return sizeof(struct raw1394_request);
2250         } else {
2251                 for (dentry =
2252                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2253                      dentry; dentry = dentry->next) {
2254                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2255                                                              root_kv,
2256                                                              dentry->kv);
2257                 }
2258                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2259                 fi->csr1212_dirs[dr] = NULL;
2260                 return ret;
2261         }
2262 }
2263
2264 static int state_connected(struct file_info *fi, struct pending_request *req)
2265 {
2266         int node = req->req.address >> 48;
2267
2268         req->req.error = RAW1394_ERROR_NONE;
2269
2270         switch (req->req.type) {
2271
2272         case RAW1394_REQ_ECHO:
2273                 queue_complete_req(req);
2274                 return sizeof(struct raw1394_request);
2275
2276         case RAW1394_REQ_ISO_SEND:
2277                 return handle_iso_send(fi, req, node);
2278
2279         case RAW1394_REQ_ARM_REGISTER:
2280                 return arm_register(fi, req);
2281
2282         case RAW1394_REQ_ARM_UNREGISTER:
2283                 return arm_unregister(fi, req);
2284
2285         case RAW1394_REQ_ARM_SET_BUF:
2286                 return arm_set_buf(fi, req);
2287
2288         case RAW1394_REQ_ARM_GET_BUF:
2289                 return arm_get_buf(fi, req);
2290
2291         case RAW1394_REQ_RESET_NOTIFY:
2292                 return reset_notification(fi, req);
2293
2294         case RAW1394_REQ_ISO_LISTEN:
2295                 handle_iso_listen(fi, req);
2296                 return sizeof(struct raw1394_request);
2297
2298         case RAW1394_REQ_FCP_LISTEN:
2299                 handle_fcp_listen(fi, req);
2300                 return sizeof(struct raw1394_request);
2301
2302         case RAW1394_REQ_RESET_BUS:
2303                 if (req->req.misc == RAW1394_LONG_RESET) {
2304                         DBGMSG("busreset called (type: LONG)");
2305                         hpsb_reset_bus(fi->host, LONG_RESET);
2306                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2307                         return sizeof(struct raw1394_request);
2308                 }
2309                 if (req->req.misc == RAW1394_SHORT_RESET) {
2310                         DBGMSG("busreset called (type: SHORT)");
2311                         hpsb_reset_bus(fi->host, SHORT_RESET);
2312                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2313                         return sizeof(struct raw1394_request);
2314                 }
2315                 /* error EINVAL (22) invalid argument */
2316                 return (-EINVAL);
2317         case RAW1394_REQ_GET_ROM:
2318                 return get_config_rom(fi, req);
2319
2320         case RAW1394_REQ_UPDATE_ROM:
2321                 return update_config_rom(fi, req);
2322
2323         case RAW1394_REQ_MODIFY_ROM:
2324                 return modify_config_rom(fi, req);
2325         }
2326
2327         if (req->req.generation != get_hpsb_generation(fi->host)) {
2328                 req->req.error = RAW1394_ERROR_GENERATION;
2329                 req->req.generation = get_hpsb_generation(fi->host);
2330                 req->req.length = 0;
2331                 queue_complete_req(req);
2332                 return sizeof(struct raw1394_request);
2333         }
2334
2335         switch (req->req.type) {
2336         case RAW1394_REQ_PHYPACKET:
2337                 return write_phypacket(fi, req);
2338         case RAW1394_REQ_ASYNC_SEND:
2339                 return handle_async_send(fi, req);
2340         }
2341
2342         if (req->req.length == 0) {
2343                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2344                 queue_complete_req(req);
2345                 return sizeof(struct raw1394_request);
2346         }
2347
2348         return handle_async_request(fi, req, node);
2349 }
2350
2351
2352 static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2353                              size_t count, loff_t * offset_is_ignored)
2354 {
2355         struct file_info *fi = (struct file_info *)file->private_data;
2356         struct pending_request *req;
2357         ssize_t retval = 0;
2358
2359 #ifdef CONFIG_COMPAT
2360         if (count == sizeof(struct compat_raw1394_req) &&
2361                 sizeof(struct compat_raw1394_req) !=
2362                         sizeof(struct raw1394_request)) {
2363                 buffer = raw1394_compat_write(buffer);
2364                 if (IS_ERR(buffer))
2365                         return PTR_ERR(buffer);
2366         } else
2367 #endif
2368         if (count != sizeof(struct raw1394_request)) {
2369                 return -EINVAL;
2370         }
2371
2372         req = alloc_pending_request();
2373         if (req == NULL) {
2374                 return -ENOMEM;
2375         }
2376         req->file_info = fi;
2377
2378         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2379                 free_pending_request(req);
2380                 return -EFAULT;
2381         }
2382
2383         switch (fi->state) {
2384         case opened:
2385                 retval = state_opened(fi, req);
2386                 break;
2387
2388         case initialized:
2389                 retval = state_initialized(fi, req);
2390                 break;
2391
2392         case connected:
2393                 retval = state_connected(fi, req);
2394                 break;
2395         }
2396
2397         if (retval < 0) {
2398                 free_pending_request(req);
2399         }
2400
2401         return retval;
2402 }
2403
2404 /* rawiso operations */
2405
2406 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2407  * completion queue (reqlists_lock must be taken) */
2408 static inline int __rawiso_event_in_queue(struct file_info *fi)
2409 {
2410         struct pending_request *req;
2411
2412         list_for_each_entry(req, &fi->req_complete, list)
2413             if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2414                 return 1;
2415
2416         return 0;
2417 }
2418
2419 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2420 static void queue_rawiso_event(struct file_info *fi)
2421 {
2422         unsigned long flags;
2423
2424         spin_lock_irqsave(&fi->reqlists_lock, flags);
2425
2426         /* only one ISO activity event may be in the queue */
2427         if (!__rawiso_event_in_queue(fi)) {
2428                 struct pending_request *req =
2429                     __alloc_pending_request(SLAB_ATOMIC);
2430
2431                 if (req) {
2432                         req->file_info = fi;
2433                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2434                         req->req.generation = get_hpsb_generation(fi->host);
2435                         __queue_complete_req(req);
2436                 } else {
2437                         /* on allocation failure, signal an overflow */
2438                         if (fi->iso_handle) {
2439                                 atomic_inc(&fi->iso_handle->overflows);
2440                         }
2441                 }
2442         }
2443         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2444 }
2445
2446 static void rawiso_activity_cb(struct hpsb_iso *iso)
2447 {
2448         unsigned long flags;
2449         struct host_info *hi;
2450         struct file_info *fi;
2451
2452         spin_lock_irqsave(&host_info_lock, flags);
2453         hi = find_host_info(iso->host);
2454
2455         if (hi != NULL) {
2456                 list_for_each_entry(fi, &hi->file_info_list, list) {
2457                         if (fi->iso_handle == iso)
2458                                 queue_rawiso_event(fi);
2459                 }
2460         }
2461
2462         spin_unlock_irqrestore(&host_info_lock, flags);
2463 }
2464
2465 /* helper function - gather all the kernel iso status bits for returning to user-space */
2466 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
2467                                     struct raw1394_iso_status *stat)
2468 {
2469         stat->config.data_buf_size = iso->buf_size;
2470         stat->config.buf_packets = iso->buf_packets;
2471         stat->config.channel = iso->channel;
2472         stat->config.speed = iso->speed;
2473         stat->config.irq_interval = iso->irq_interval;
2474         stat->n_packets = hpsb_iso_n_ready(iso);
2475         stat->overflows = atomic_read(&iso->overflows);
2476         stat->xmit_cycle = iso->xmit_cycle;
2477 }
2478
2479 static int raw1394_iso_xmit_init(struct file_info *fi, void __user * uaddr)
2480 {
2481         struct raw1394_iso_status stat;
2482
2483         if (!fi->host)
2484                 return -EINVAL;
2485
2486         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2487                 return -EFAULT;
2488
2489         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2490                                             stat.config.data_buf_size,
2491                                             stat.config.buf_packets,
2492                                             stat.config.channel,
2493                                             stat.config.speed,
2494                                             stat.config.irq_interval,
2495                                             rawiso_activity_cb);
2496         if (!fi->iso_handle)
2497                 return -ENOMEM;
2498
2499         fi->iso_state = RAW1394_ISO_XMIT;
2500
2501         raw1394_iso_fill_status(fi->iso_handle, &stat);
2502         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2503                 return -EFAULT;
2504
2505         /* queue an event to get things started */
2506         rawiso_activity_cb(fi->iso_handle);
2507
2508         return 0;
2509 }
2510
2511 static int raw1394_iso_recv_init(struct file_info *fi, void __user * uaddr)
2512 {
2513         struct raw1394_iso_status stat;
2514
2515         if (!fi->host)
2516                 return -EINVAL;
2517
2518         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2519                 return -EFAULT;
2520
2521         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2522                                             stat.config.data_buf_size,
2523                                             stat.config.buf_packets,
2524                                             stat.config.channel,
2525                                             stat.config.dma_mode,
2526                                             stat.config.irq_interval,
2527                                             rawiso_activity_cb);
2528         if (!fi->iso_handle)
2529                 return -ENOMEM;
2530
2531         fi->iso_state = RAW1394_ISO_RECV;
2532
2533         raw1394_iso_fill_status(fi->iso_handle, &stat);
2534         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2535                 return -EFAULT;
2536         return 0;
2537 }
2538
2539 static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
2540 {
2541         struct raw1394_iso_status stat;
2542         struct hpsb_iso *iso = fi->iso_handle;
2543
2544         raw1394_iso_fill_status(fi->iso_handle, &stat);
2545         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2546                 return -EFAULT;
2547
2548         /* reset overflow counter */
2549         atomic_set(&iso->overflows, 0);
2550
2551         return 0;
2552 }
2553
2554 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2555 static int raw1394_iso_recv_packets(struct file_info *fi, void __user * uaddr)
2556 {
2557         struct raw1394_iso_packets upackets;
2558         unsigned int packet = fi->iso_handle->first_packet;
2559         int i;
2560
2561         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2562                 return -EFAULT;
2563
2564         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2565                 return -EINVAL;
2566
2567         /* ensure user-supplied buffer is accessible and big enough */
2568         if (!access_ok(VERIFY_WRITE, upackets.infos,
2569                        upackets.n_packets *
2570                        sizeof(struct raw1394_iso_packet_info)))
2571                 return -EFAULT;
2572
2573         /* copy the packet_infos out */
2574         for (i = 0; i < upackets.n_packets; i++) {
2575                 if (__copy_to_user(&upackets.infos[i],
2576                                    &fi->iso_handle->infos[packet],
2577                                    sizeof(struct raw1394_iso_packet_info)))
2578                         return -EFAULT;
2579
2580                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2581         }
2582
2583         return 0;
2584 }
2585
2586 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2587 static int raw1394_iso_send_packets(struct file_info *fi, void __user * uaddr)
2588 {
2589         struct raw1394_iso_packets upackets;
2590         int i, rv;
2591
2592         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2593                 return -EFAULT;
2594
2595         if (upackets.n_packets >= fi->iso_handle->buf_packets)
2596                 return -EINVAL;
2597
2598         if (upackets.n_packets >= hpsb_iso_n_ready(fi->iso_handle))
2599                 return -EAGAIN;
2600
2601         /* ensure user-supplied buffer is accessible and big enough */
2602         if (!access_ok(VERIFY_READ, upackets.infos,
2603                        upackets.n_packets *
2604                        sizeof(struct raw1394_iso_packet_info)))
2605                 return -EFAULT;
2606
2607         /* copy the infos structs in and queue the packets */
2608         for (i = 0; i < upackets.n_packets; i++) {
2609                 struct raw1394_iso_packet_info info;
2610
2611                 if (__copy_from_user(&info, &upackets.infos[i],
2612                                      sizeof(struct raw1394_iso_packet_info)))
2613                         return -EFAULT;
2614
2615                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2616                                                 info.len, info.tag, info.sy);
2617                 if (rv)
2618                         return rv;
2619         }
2620
2621         return 0;
2622 }
2623
2624 static void raw1394_iso_shutdown(struct file_info *fi)
2625 {
2626         if (fi->iso_handle)
2627                 hpsb_iso_shutdown(fi->iso_handle);
2628
2629         fi->iso_handle = NULL;
2630         fi->iso_state = RAW1394_ISO_INACTIVE;
2631 }
2632
2633 /* mmap the rawiso xmit/recv buffer */
2634 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2635 {
2636         struct file_info *fi = file->private_data;
2637
2638         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2639                 return -EINVAL;
2640
2641         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2642 }
2643
2644 /* ioctl is only used for rawiso operations */
2645 static int raw1394_ioctl(struct inode *inode, struct file *file,
2646                          unsigned int cmd, unsigned long arg)
2647 {
2648         struct file_info *fi = file->private_data;
2649         void __user *argp = (void __user *)arg;
2650
2651         switch (fi->iso_state) {
2652         case RAW1394_ISO_INACTIVE:
2653                 switch (cmd) {
2654                 case RAW1394_IOC_ISO_XMIT_INIT:
2655                         return raw1394_iso_xmit_init(fi, argp);
2656                 case RAW1394_IOC_ISO_RECV_INIT:
2657                         return raw1394_iso_recv_init(fi, argp);
2658                 default:
2659                         break;
2660                 }
2661                 break;
2662         case RAW1394_ISO_RECV:
2663                 switch (cmd) {
2664                 case RAW1394_IOC_ISO_RECV_START:{
2665                                 /* copy args from user-space */
2666                                 int args[3];
2667                                 if (copy_from_user
2668                                     (&args[0], argp, sizeof(args)))
2669                                         return -EFAULT;
2670                                 return hpsb_iso_recv_start(fi->iso_handle,
2671                                                            args[0], args[1],
2672                                                            args[2]);
2673                         }
2674                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2675                         hpsb_iso_stop(fi->iso_handle);
2676                         return 0;
2677                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2678                         return hpsb_iso_recv_listen_channel(fi->iso_handle,
2679                                                             arg);
2680                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2681                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle,
2682                                                               arg);
2683                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:{
2684                                 /* copy the u64 from user-space */
2685                                 u64 mask;
2686                                 if (copy_from_user(&mask, argp, sizeof(mask)))
2687                                         return -EFAULT;
2688                                 return hpsb_iso_recv_set_channel_mask(fi->
2689                                                                       iso_handle,
2690                                                                       mask);
2691                         }
2692                 case RAW1394_IOC_ISO_GET_STATUS:
2693                         return raw1394_iso_get_status(fi, argp);
2694                 case RAW1394_IOC_ISO_RECV_PACKETS:
2695                         return raw1394_iso_recv_packets(fi, argp);
2696                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2697                         return hpsb_iso_recv_release_packets(fi->iso_handle,
2698                                                              arg);
2699                 case RAW1394_IOC_ISO_RECV_FLUSH:
2700                         return hpsb_iso_recv_flush(fi->iso_handle);
2701                 case RAW1394_IOC_ISO_SHUTDOWN:
2702                         raw1394_iso_shutdown(fi);
2703                         return 0;
2704                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2705                         queue_rawiso_event(fi);
2706                         return 0;
2707                 }
2708                 break;
2709         case RAW1394_ISO_XMIT:
2710                 switch (cmd) {
2711                 case RAW1394_IOC_ISO_XMIT_START:{
2712                                 /* copy two ints from user-space */
2713                                 int args[2];
2714                                 if (copy_from_user
2715                                     (&args[0], argp, sizeof(args)))
2716                                         return -EFAULT;
2717                                 return hpsb_iso_xmit_start(fi->iso_handle,
2718                                                            args[0], args[1]);
2719                         }
2720                 case RAW1394_IOC_ISO_XMIT_SYNC:
2721                         return hpsb_iso_xmit_sync(fi->iso_handle);
2722                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2723                         hpsb_iso_stop(fi->iso_handle);
2724                         return 0;
2725                 case RAW1394_IOC_ISO_GET_STATUS:
2726                         return raw1394_iso_get_status(fi, argp);
2727                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2728                         return raw1394_iso_send_packets(fi, argp);
2729                 case RAW1394_IOC_ISO_SHUTDOWN:
2730                         raw1394_iso_shutdown(fi);
2731                         return 0;
2732                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2733                         queue_rawiso_event(fi);
2734                         return 0;
2735                 }
2736                 break;
2737         default:
2738                 break;
2739         }
2740
2741         return -EINVAL;
2742 }
2743
2744 static unsigned int raw1394_poll(struct file *file, poll_table * pt)
2745 {
2746         struct file_info *fi = file->private_data;
2747         unsigned int mask = POLLOUT | POLLWRNORM;
2748         unsigned long flags;
2749
2750         poll_wait(file, &fi->poll_wait_complete, pt);
2751
2752         spin_lock_irqsave(&fi->reqlists_lock, flags);
2753         if (!list_empty(&fi->req_complete)) {
2754                 mask |= POLLIN | POLLRDNORM;
2755         }
2756         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2757
2758         return mask;
2759 }
2760
2761 static int raw1394_open(struct inode *inode, struct file *file)
2762 {
2763         struct file_info *fi;
2764
2765         fi = kzalloc(sizeof(*fi), SLAB_KERNEL);
2766         if (!fi)
2767                 return -ENOMEM;
2768
2769         fi->notification = (u8) RAW1394_NOTIFY_ON;      /* busreset notification */
2770
2771         INIT_LIST_HEAD(&fi->list);
2772         fi->state = opened;
2773         INIT_LIST_HEAD(&fi->req_pending);
2774         INIT_LIST_HEAD(&fi->req_complete);
2775         sema_init(&fi->complete_sem, 0);
2776         spin_lock_init(&fi->reqlists_lock);
2777         init_waitqueue_head(&fi->poll_wait_complete);
2778         INIT_LIST_HEAD(&fi->addr_list);
2779
2780         file->private_data = fi;
2781
2782         return 0;
2783 }
2784
2785 static int raw1394_release(struct inode *inode, struct file *file)
2786 {
2787         struct file_info *fi = file->private_data;
2788         struct list_head *lh;
2789         struct pending_request *req;
2790         int done = 0, i, fail = 0;
2791         int retval = 0;
2792         struct list_head *entry;
2793         struct arm_addr *addr = NULL;
2794         struct host_info *hi;
2795         struct file_info *fi_hlp = NULL;
2796         struct arm_addr *arm_addr = NULL;
2797         int another_host;
2798         int csr_mod = 0;
2799         unsigned long flags;
2800
2801         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2802                 raw1394_iso_shutdown(fi);
2803
2804         for (i = 0; i < 64; i++) {
2805                 if (fi->listen_channels & (1ULL << i)) {
2806                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2807                 }
2808         }
2809
2810         spin_lock_irqsave(&host_info_lock, flags);
2811         fi->listen_channels = 0;
2812
2813         fail = 0;
2814         /* set address-entries invalid */
2815
2816         while (!list_empty(&fi->addr_list)) {
2817                 another_host = 0;
2818                 lh = fi->addr_list.next;
2819                 addr = list_entry(lh, struct arm_addr, addr_list);
2820                 /* another host with valid address-entry containing
2821                    same addressrange? */
2822                 list_for_each_entry(hi, &host_info_list, list) {
2823                         if (hi->host != fi->host) {
2824                                 list_for_each_entry(fi_hlp, &hi->file_info_list,
2825                                                     list) {
2826                                         entry = fi_hlp->addr_list.next;
2827                                         while (entry != &(fi_hlp->addr_list)) {
2828                                                 arm_addr = list_entry(entry, struct
2829                                                                       arm_addr,
2830                                                                       addr_list);
2831                                                 if (arm_addr->start ==
2832                                                     addr->start) {
2833                                                         DBGMSG
2834                                                             ("raw1394_release: "
2835                                                              "another host ownes "
2836                                                              "same addressrange");
2837                                                         another_host = 1;
2838                                                         break;
2839                                                 }
2840                                                 entry = entry->next;
2841                                         }
2842                                         if (another_host) {
2843                                                 break;
2844                                         }
2845                                 }
2846                         }
2847                 }
2848                 if (!another_host) {
2849                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
2850                         retval =
2851                             hpsb_unregister_addrspace(&raw1394_highlevel,
2852                                                       fi->host, addr->start);
2853                         if (!retval) {
2854                                 ++fail;
2855                                 printk(KERN_ERR
2856                                        "raw1394_release arm_Unregister failed\n");
2857                         }
2858                 }
2859                 DBGMSG("raw1394_release: delete addr_entry from list");
2860                 list_del(&addr->addr_list);
2861                 vfree(addr->addr_space_buffer);
2862                 kfree(addr);
2863         }                       /* while */
2864         spin_unlock_irqrestore(&host_info_lock, flags);
2865         if (fail > 0) {
2866                 printk(KERN_ERR "raw1394: during addr_list-release "
2867                        "error(s) occurred \n");
2868         }
2869
2870         while (!done) {
2871                 spin_lock_irqsave(&fi->reqlists_lock, flags);
2872
2873                 while (!list_empty(&fi->req_complete)) {
2874                         lh = fi->req_complete.next;
2875                         list_del(lh);
2876
2877                         req = list_entry(lh, struct pending_request, list);
2878
2879                         free_pending_request(req);
2880                 }
2881
2882                 if (list_empty(&fi->req_pending))
2883                         done = 1;
2884
2885                 spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2886
2887                 if (!done)
2888                         down_interruptible(&fi->complete_sem);
2889         }
2890
2891         /* Remove any sub-trees left by user space programs */
2892         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
2893                 struct csr1212_dentry *dentry;
2894                 if (!fi->csr1212_dirs[i])
2895                         continue;
2896                 for (dentry =
2897                      fi->csr1212_dirs[i]->value.directory.dentries_head; dentry;
2898                      dentry = dentry->next) {
2899                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2900                                                              root_kv,
2901                                                              dentry->kv);
2902                 }
2903                 csr1212_release_keyval(fi->csr1212_dirs[i]);
2904                 fi->csr1212_dirs[i] = NULL;
2905                 csr_mod = 1;
2906         }
2907
2908         if ((csr_mod || fi->cfgrom_upd)
2909             && hpsb_update_config_rom_image(fi->host) < 0)
2910                 HPSB_ERR
2911                     ("Failed to generate Configuration ROM image for host %d",
2912                      fi->host->id);
2913
2914         if (fi->state == connected) {
2915                 spin_lock_irqsave(&host_info_lock, flags);
2916                 list_del(&fi->list);
2917                 spin_unlock_irqrestore(&host_info_lock, flags);
2918
2919                 put_device(&fi->host->device);
2920         }
2921
2922         kfree(fi);
2923
2924         return 0;
2925 }
2926
2927 /*** HOTPLUG STUFF **********************************************************/
2928 /*
2929  * Export information about protocols/devices supported by this driver.
2930  */
2931 static struct ieee1394_device_id raw1394_id_table[] = {
2932         {
2933          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2934          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
2935          .version = AVC_SW_VERSION_ENTRY & 0xffffff},
2936         {
2937          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2938          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2939          .version = CAMERA_SW_VERSION_ENTRY & 0xffffff},
2940         {
2941          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2942          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2943          .version = (CAMERA_SW_VERSION_ENTRY + 1) & 0xffffff},
2944         {
2945          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2946          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2947          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
2948         {}
2949 };
2950
2951 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
2952
2953 static struct hpsb_protocol_driver raw1394_driver = {
2954         .name = "raw1394 Driver",
2955         .id_table = raw1394_id_table,
2956         .driver = {
2957                    .name = "raw1394",
2958                    .bus = &ieee1394_bus_type,
2959                    },
2960 };
2961
2962 /******************************************************************************/
2963
2964 static struct hpsb_highlevel raw1394_highlevel = {
2965         .name = RAW1394_DEVICE_NAME,
2966         .add_host = add_host,
2967         .remove_host = remove_host,
2968         .host_reset = host_reset,
2969         .iso_receive = iso_receive,
2970         .fcp_request = fcp_request,
2971 };
2972
2973 static struct cdev raw1394_cdev;
2974 static struct file_operations raw1394_fops = {
2975         .owner = THIS_MODULE,
2976         .read = raw1394_read,
2977         .write = raw1394_write,
2978         .mmap = raw1394_mmap,
2979         .ioctl = raw1394_ioctl,
2980         // .compat_ioctl = ... someone needs to do this
2981         .poll = raw1394_poll,
2982         .open = raw1394_open,
2983         .release = raw1394_release,
2984 };
2985
2986 static int __init init_raw1394(void)
2987 {
2988         int ret = 0;
2989
2990         hpsb_register_highlevel(&raw1394_highlevel);
2991
2992         if (IS_ERR
2993             (class_device_create
2994              (hpsb_protocol_class, NULL,
2995               MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16), NULL,
2996               RAW1394_DEVICE_NAME))) {
2997                 ret = -EFAULT;
2998                 goto out_unreg;
2999         }
3000
3001         cdev_init(&raw1394_cdev, &raw1394_fops);
3002         raw1394_cdev.owner = THIS_MODULE;
3003         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
3004         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
3005         if (ret) {
3006                 HPSB_ERR("raw1394 failed to register minor device block");
3007                 goto out_dev;
3008         }
3009
3010         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
3011
3012         ret = hpsb_register_protocol(&raw1394_driver);
3013         if (ret) {
3014                 HPSB_ERR("raw1394: failed to register protocol");
3015                 cdev_del(&raw1394_cdev);
3016                 goto out_dev;
3017         }
3018
3019         goto out;
3020
3021       out_dev:
3022         class_device_destroy(hpsb_protocol_class,
3023                              MKDEV(IEEE1394_MAJOR,
3024                                    IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3025       out_unreg:
3026         hpsb_unregister_highlevel(&raw1394_highlevel);
3027       out:
3028         return ret;
3029 }
3030
3031 static void __exit cleanup_raw1394(void)
3032 {
3033         class_device_destroy(hpsb_protocol_class,
3034                              MKDEV(IEEE1394_MAJOR,
3035                                    IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3036         cdev_del(&raw1394_cdev);
3037         hpsb_unregister_highlevel(&raw1394_highlevel);
3038         hpsb_unregister_protocol(&raw1394_driver);
3039 }
3040
3041 module_init(init_raw1394);
3042 module_exit(cleanup_raw1394);
3043 MODULE_LICENSE("GPL");