Merge master.kernel.org:/home/rmk/linux-2.6-serial
[linux-2.6] / drivers / ieee1394 / raw1394.c
1 /*
2  * IEEE 1394 for Linux
3  *
4  * Raw interface to the bus
5  *
6  * Copyright (C) 1999, 2000 Andreas E. Bombe
7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
9  *
10  * This code is licensed under the GPL.  See the file COPYING in the root
11  * directory of the kernel sources for details.
12  *
13  *
14  * Contributions:
15  *
16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
17  *        configuration ROM manipulation
18  *        address range mapping
19  *        adaptation for new (transparent) loopback mechanism
20  *        sending of arbitrary async packets
21  * Christian Toegel <christian.toegel@gmx.at>
22  *        address range mapping
23  *        lock64 request
24  *        transmit physical packet
25  *        busreset notification control (switch on/off)
26  *        busreset with selection of type (short/long)
27  *        request_reply
28  */
29
30 #include <linux/kernel.h>
31 #include <linux/list.h>
32 #include <linux/string.h>
33 #include <linux/slab.h>
34 #include <linux/fs.h>
35 #include <linux/poll.h>
36 #include <linux/module.h>
37 #include <linux/init.h>
38 #include <linux/smp_lock.h>
39 #include <linux/interrupt.h>
40 #include <linux/vmalloc.h>
41 #include <linux/cdev.h>
42 #include <asm/uaccess.h>
43 #include <asm/atomic.h>
44 #include <linux/devfs_fs_kernel.h>
45 #include <linux/compat.h>
46
47 #include "csr1212.h"
48 #include "ieee1394.h"
49 #include "ieee1394_types.h"
50 #include "ieee1394_core.h"
51 #include "nodemgr.h"
52 #include "hosts.h"
53 #include "highlevel.h"
54 #include "iso.h"
55 #include "ieee1394_transactions.h"
56 #include "raw1394.h"
57 #include "raw1394-private.h"
58
59 #define int2ptr(x) ((void __user *)(unsigned long)x)
60 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
61
62 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
63 #define RAW1394_DEBUG
64 #endif
65
66 #ifdef RAW1394_DEBUG
67 #define DBGMSG(fmt, args...) \
68 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
69 #else
70 #define DBGMSG(fmt, args...)
71 #endif
72
73 static LIST_HEAD(host_info_list);
74 static int host_count;
75 static DEFINE_SPINLOCK(host_info_lock);
76 static atomic_t internal_generation = ATOMIC_INIT(0);
77
78 static atomic_t iso_buffer_size;
79 static const int iso_buffer_max = 4 * 1024 * 1024;      /* 4 MB */
80
81 static struct hpsb_highlevel raw1394_highlevel;
82
83 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
84                     u64 addr, size_t length, u16 flags);
85 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
86                      quadlet_t * data, u64 addr, size_t length, u16 flags);
87 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
88                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
89                     u16 flags);
90 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
91                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
92                       u16 flags);
93 static struct hpsb_address_ops arm_ops = {
94         .read = arm_read,
95         .write = arm_write,
96         .lock = arm_lock,
97         .lock64 = arm_lock64,
98 };
99
100 static void queue_complete_cb(struct pending_request *req);
101
102 static struct pending_request *__alloc_pending_request(gfp_t flags)
103 {
104         struct pending_request *req;
105
106         req = kzalloc(sizeof(*req), flags);
107         if (req)
108                 INIT_LIST_HEAD(&req->list);
109
110         return req;
111 }
112
113 static inline struct pending_request *alloc_pending_request(void)
114 {
115         return __alloc_pending_request(SLAB_KERNEL);
116 }
117
118 static void free_pending_request(struct pending_request *req)
119 {
120         if (req->ibs) {
121                 if (atomic_dec_and_test(&req->ibs->refcount)) {
122                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
123                         kfree(req->ibs);
124                 }
125         } else if (req->free_data) {
126                 kfree(req->data);
127         }
128         hpsb_free_packet(req->packet);
129         kfree(req);
130 }
131
132 /* fi->reqlists_lock must be taken */
133 static void __queue_complete_req(struct pending_request *req)
134 {
135         struct file_info *fi = req->file_info;
136         list_del(&req->list);
137         list_add_tail(&req->list, &fi->req_complete);
138
139         up(&fi->complete_sem);
140         wake_up_interruptible(&fi->poll_wait_complete);
141 }
142
143 static void queue_complete_req(struct pending_request *req)
144 {
145         unsigned long flags;
146         struct file_info *fi = req->file_info;
147
148         spin_lock_irqsave(&fi->reqlists_lock, flags);
149         __queue_complete_req(req);
150         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
151 }
152
153 static void queue_complete_cb(struct pending_request *req)
154 {
155         struct hpsb_packet *packet = req->packet;
156         int rcode = (packet->header[1] >> 12) & 0xf;
157
158         switch (packet->ack_code) {
159         case ACKX_NONE:
160         case ACKX_SEND_ERROR:
161                 req->req.error = RAW1394_ERROR_SEND_ERROR;
162                 break;
163         case ACKX_ABORTED:
164                 req->req.error = RAW1394_ERROR_ABORTED;
165                 break;
166         case ACKX_TIMEOUT:
167                 req->req.error = RAW1394_ERROR_TIMEOUT;
168                 break;
169         default:
170                 req->req.error = (packet->ack_code << 16) | rcode;
171                 break;
172         }
173
174         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
175                 req->req.length = 0;
176         }
177
178         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
179             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
180             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
181             (req->req.type == RAW1394_REQ_LOCK) ||
182             (req->req.type == RAW1394_REQ_LOCK64))
183                 hpsb_free_tlabel(packet);
184
185         queue_complete_req(req);
186 }
187
188 static void add_host(struct hpsb_host *host)
189 {
190         struct host_info *hi;
191         unsigned long flags;
192
193         hi = kmalloc(sizeof(*hi), GFP_KERNEL);
194
195         if (hi) {
196                 INIT_LIST_HEAD(&hi->list);
197                 hi->host = host;
198                 INIT_LIST_HEAD(&hi->file_info_list);
199
200                 spin_lock_irqsave(&host_info_lock, flags);
201                 list_add_tail(&hi->list, &host_info_list);
202                 host_count++;
203                 spin_unlock_irqrestore(&host_info_lock, flags);
204         }
205
206         atomic_inc(&internal_generation);
207 }
208
209 static struct host_info *find_host_info(struct hpsb_host *host)
210 {
211         struct host_info *hi;
212
213         list_for_each_entry(hi, &host_info_list, list)
214             if (hi->host == host)
215                 return hi;
216
217         return NULL;
218 }
219
220 static void remove_host(struct hpsb_host *host)
221 {
222         struct host_info *hi;
223         unsigned long flags;
224
225         spin_lock_irqsave(&host_info_lock, flags);
226         hi = find_host_info(host);
227
228         if (hi != NULL) {
229                 list_del(&hi->list);
230                 host_count--;
231                 /*
232                    FIXME: address ranges should be removed
233                    and fileinfo states should be initialized
234                    (including setting generation to
235                    internal-generation ...)
236                  */
237         }
238         spin_unlock_irqrestore(&host_info_lock, flags);
239
240         if (hi == NULL) {
241                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
242                        "0x%p\n", host);
243                 return;
244         }
245
246         kfree(hi);
247
248         atomic_inc(&internal_generation);
249 }
250
251 static void host_reset(struct hpsb_host *host)
252 {
253         unsigned long flags;
254         struct host_info *hi;
255         struct file_info *fi;
256         struct pending_request *req;
257
258         spin_lock_irqsave(&host_info_lock, flags);
259         hi = find_host_info(host);
260
261         if (hi != NULL) {
262                 list_for_each_entry(fi, &hi->file_info_list, list) {
263                         if (fi->notification == RAW1394_NOTIFY_ON) {
264                                 req = __alloc_pending_request(SLAB_ATOMIC);
265
266                                 if (req != NULL) {
267                                         req->file_info = fi;
268                                         req->req.type = RAW1394_REQ_BUS_RESET;
269                                         req->req.generation =
270                                             get_hpsb_generation(host);
271                                         req->req.misc = (host->node_id << 16)
272                                             | host->node_count;
273                                         if (fi->protocol_version > 3) {
274                                                 req->req.misc |=
275                                                     (NODEID_TO_NODE
276                                                      (host->irm_id)
277                                                      << 8);
278                                         }
279
280                                         queue_complete_req(req);
281                                 }
282                         }
283                 }
284         }
285         spin_unlock_irqrestore(&host_info_lock, flags);
286 }
287
288 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t * data,
289                         size_t length)
290 {
291         unsigned long flags;
292         struct host_info *hi;
293         struct file_info *fi;
294         struct pending_request *req, *req_next;
295         struct iso_block_store *ibs = NULL;
296         LIST_HEAD(reqs);
297
298         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
299                 HPSB_INFO("dropped iso packet");
300                 return;
301         }
302
303         spin_lock_irqsave(&host_info_lock, flags);
304         hi = find_host_info(host);
305
306         if (hi != NULL) {
307                 list_for_each_entry(fi, &hi->file_info_list, list) {
308                         if (!(fi->listen_channels & (1ULL << channel)))
309                                 continue;
310
311                         req = __alloc_pending_request(SLAB_ATOMIC);
312                         if (!req)
313                                 break;
314
315                         if (!ibs) {
316                                 ibs = kmalloc(sizeof(*ibs) + length,
317                                               SLAB_ATOMIC);
318                                 if (!ibs) {
319                                         kfree(req);
320                                         break;
321                                 }
322
323                                 atomic_add(length, &iso_buffer_size);
324                                 atomic_set(&ibs->refcount, 0);
325                                 ibs->data_size = length;
326                                 memcpy(ibs->data, data, length);
327                         }
328
329                         atomic_inc(&ibs->refcount);
330
331                         req->file_info = fi;
332                         req->ibs = ibs;
333                         req->data = ibs->data;
334                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
335                         req->req.generation = get_hpsb_generation(host);
336                         req->req.misc = 0;
337                         req->req.recvb = ptr2int(fi->iso_buffer);
338                         req->req.length = min(length, fi->iso_buffer_length);
339
340                         list_add_tail(&req->list, &reqs);
341                 }
342         }
343         spin_unlock_irqrestore(&host_info_lock, flags);
344
345         list_for_each_entry_safe(req, req_next, &reqs, list)
346             queue_complete_req(req);
347 }
348
349 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
350                         int cts, u8 * data, size_t length)
351 {
352         unsigned long flags;
353         struct host_info *hi;
354         struct file_info *fi;
355         struct pending_request *req, *req_next;
356         struct iso_block_store *ibs = NULL;
357         LIST_HEAD(reqs);
358
359         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
360                 HPSB_INFO("dropped fcp request");
361                 return;
362         }
363
364         spin_lock_irqsave(&host_info_lock, flags);
365         hi = find_host_info(host);
366
367         if (hi != NULL) {
368                 list_for_each_entry(fi, &hi->file_info_list, list) {
369                         if (!fi->fcp_buffer)
370                                 continue;
371
372                         req = __alloc_pending_request(SLAB_ATOMIC);
373                         if (!req)
374                                 break;
375
376                         if (!ibs) {
377                                 ibs = kmalloc(sizeof(*ibs) + length,
378                                               SLAB_ATOMIC);
379                                 if (!ibs) {
380                                         kfree(req);
381                                         break;
382                                 }
383
384                                 atomic_add(length, &iso_buffer_size);
385                                 atomic_set(&ibs->refcount, 0);
386                                 ibs->data_size = length;
387                                 memcpy(ibs->data, data, length);
388                         }
389
390                         atomic_inc(&ibs->refcount);
391
392                         req->file_info = fi;
393                         req->ibs = ibs;
394                         req->data = ibs->data;
395                         req->req.type = RAW1394_REQ_FCP_REQUEST;
396                         req->req.generation = get_hpsb_generation(host);
397                         req->req.misc = nodeid | (direction << 16);
398                         req->req.recvb = ptr2int(fi->fcp_buffer);
399                         req->req.length = length;
400
401                         list_add_tail(&req->list, &reqs);
402                 }
403         }
404         spin_unlock_irqrestore(&host_info_lock, flags);
405
406         list_for_each_entry_safe(req, req_next, &reqs, list)
407             queue_complete_req(req);
408 }
409
410 #ifdef CONFIG_COMPAT
411 struct compat_raw1394_req {
412         __u32 type;
413         __s32 error;
414         __u32 misc;
415
416         __u32 generation;
417         __u32 length;
418
419         __u64 address;
420
421         __u64 tag;
422
423         __u64 sendb;
424         __u64 recvb;
425 }  __attribute__((packed));
426
427 static const char __user *raw1394_compat_write(const char __user *buf)
428 {
429         struct compat_raw1394_req __user *cr = (typeof(cr)) buf; 
430         struct raw1394_request __user *r;
431         r = compat_alloc_user_space(sizeof(struct raw1394_request));
432
433 #define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x))
434
435         if (copy_in_user(r, cr, sizeof(struct compat_raw1394_req)) ||
436                 C(address) ||
437                 C(tag) ||
438                 C(sendb) ||
439                 C(recvb))
440                 return ERR_PTR(-EFAULT);
441         return (const char __user *)r;
442 }
443 #undef C
444
445 #define P(x) __put_user(r->x, &cr->x)
446
447 static int 
448 raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
449 {
450         struct compat_raw1394_req __user *cr = (typeof(cr)) r; 
451         if (!access_ok(VERIFY_WRITE,cr,sizeof(struct compat_raw1394_req)) ||
452             P(type) ||
453             P(error) ||
454             P(misc) ||
455             P(generation) ||
456             P(length) ||
457             P(address) ||
458             P(tag) ||
459             P(sendb) ||
460             P(recvb))
461                 return -EFAULT;
462         return sizeof(struct compat_raw1394_req);
463 }
464 #undef P
465
466 #endif
467
468
469 static ssize_t raw1394_read(struct file *file, char __user * buffer,
470                             size_t count, loff_t * offset_is_ignored)
471 {
472         unsigned long flags;
473         struct file_info *fi = (struct file_info *)file->private_data;
474         struct list_head *lh;
475         struct pending_request *req;
476         ssize_t ret;
477
478 #ifdef CONFIG_COMPAT
479         if (count == sizeof(struct compat_raw1394_req)) {
480                 /* ok */
481         } else
482 #endif
483         if (count != sizeof(struct raw1394_request)) {
484                 return -EINVAL;
485         }
486
487         if (!access_ok(VERIFY_WRITE, buffer, count)) {
488                 return -EFAULT;
489         }
490
491         if (file->f_flags & O_NONBLOCK) {
492                 if (down_trylock(&fi->complete_sem)) {
493                         return -EAGAIN;
494                 }
495         } else {
496                 if (down_interruptible(&fi->complete_sem)) {
497                         return -ERESTARTSYS;
498                 }
499         }
500
501         spin_lock_irqsave(&fi->reqlists_lock, flags);
502         lh = fi->req_complete.next;
503         list_del(lh);
504         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
505
506         req = list_entry(lh, struct pending_request, list);
507
508         if (req->req.length) {
509                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
510                                  req->req.length)) {
511                         req->req.error = RAW1394_ERROR_MEMFAULT;
512                 }
513         }
514
515 #ifdef CONFIG_COMPAT
516         if (count == sizeof(struct compat_raw1394_req) && 
517                 sizeof(struct compat_raw1394_req) != 
518                         sizeof(struct raw1394_request)) { 
519                 ret = raw1394_compat_read(buffer, &req->req);
520
521         } else  
522 #endif
523         {
524                 if (copy_to_user(buffer, &req->req, sizeof(req->req))) {
525                         ret = -EFAULT;
526                         goto out;
527                 }               
528                 ret = (ssize_t) sizeof(struct raw1394_request);
529         }
530       out:
531         free_pending_request(req);
532         return ret;
533 }
534
535 static int state_opened(struct file_info *fi, struct pending_request *req)
536 {
537         if (req->req.type == RAW1394_REQ_INITIALIZE) {
538                 switch (req->req.misc) {
539                 case RAW1394_KERNELAPI_VERSION:
540                 case 3:
541                         fi->state = initialized;
542                         fi->protocol_version = req->req.misc;
543                         req->req.error = RAW1394_ERROR_NONE;
544                         req->req.generation = atomic_read(&internal_generation);
545                         break;
546
547                 default:
548                         req->req.error = RAW1394_ERROR_COMPAT;
549                         req->req.misc = RAW1394_KERNELAPI_VERSION;
550                 }
551         } else {
552                 req->req.error = RAW1394_ERROR_STATE_ORDER;
553         }
554
555         req->req.length = 0;
556         queue_complete_req(req);
557         return sizeof(struct raw1394_request);
558 }
559
560 static int state_initialized(struct file_info *fi, struct pending_request *req)
561 {
562         unsigned long flags;
563         struct host_info *hi;
564         struct raw1394_khost_list *khl;
565
566         if (req->req.generation != atomic_read(&internal_generation)) {
567                 req->req.error = RAW1394_ERROR_GENERATION;
568                 req->req.generation = atomic_read(&internal_generation);
569                 req->req.length = 0;
570                 queue_complete_req(req);
571                 return sizeof(struct raw1394_request);
572         }
573
574         switch (req->req.type) {
575         case RAW1394_REQ_LIST_CARDS:
576                 spin_lock_irqsave(&host_info_lock, flags);
577                 khl = kmalloc(sizeof(*khl) * host_count, SLAB_ATOMIC);
578
579                 if (khl) {
580                         req->req.misc = host_count;
581                         req->data = (quadlet_t *) khl;
582
583                         list_for_each_entry(hi, &host_info_list, list) {
584                                 khl->nodes = hi->host->node_count;
585                                 strcpy(khl->name, hi->host->driver->name);
586                                 khl++;
587                         }
588                 }
589                 spin_unlock_irqrestore(&host_info_lock, flags);
590
591                 if (khl) {
592                         req->req.error = RAW1394_ERROR_NONE;
593                         req->req.length = min(req->req.length,
594                                               (u32) (sizeof
595                                                      (struct raw1394_khost_list)
596                                                      * req->req.misc));
597                         req->free_data = 1;
598                 } else {
599                         return -ENOMEM;
600                 }
601                 break;
602
603         case RAW1394_REQ_SET_CARD:
604                 spin_lock_irqsave(&host_info_lock, flags);
605                 if (req->req.misc < host_count) {
606                         list_for_each_entry(hi, &host_info_list, list) {
607                                 if (!req->req.misc--)
608                                         break;
609                         }
610                         get_device(&hi->host->device);  // XXX Need to handle failure case
611                         list_add_tail(&fi->list, &hi->file_info_list);
612                         fi->host = hi->host;
613                         fi->state = connected;
614
615                         req->req.error = RAW1394_ERROR_NONE;
616                         req->req.generation = get_hpsb_generation(fi->host);
617                         req->req.misc = (fi->host->node_id << 16)
618                             | fi->host->node_count;
619                         if (fi->protocol_version > 3) {
620                                 req->req.misc |=
621                                     NODEID_TO_NODE(fi->host->irm_id) << 8;
622                         }
623                 } else {
624                         req->req.error = RAW1394_ERROR_INVALID_ARG;
625                 }
626                 spin_unlock_irqrestore(&host_info_lock, flags);
627
628                 req->req.length = 0;
629                 break;
630
631         default:
632                 req->req.error = RAW1394_ERROR_STATE_ORDER;
633                 req->req.length = 0;
634                 break;
635         }
636
637         queue_complete_req(req);
638         return sizeof(struct raw1394_request);
639 }
640
641 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
642 {
643         int channel = req->req.misc;
644
645         if ((channel > 63) || (channel < -64)) {
646                 req->req.error = RAW1394_ERROR_INVALID_ARG;
647         } else if (channel >= 0) {
648                 /* allocate channel req.misc */
649                 if (fi->listen_channels & (1ULL << channel)) {
650                         req->req.error = RAW1394_ERROR_ALREADY;
651                 } else {
652                         if (hpsb_listen_channel
653                             (&raw1394_highlevel, fi->host, channel)) {
654                                 req->req.error = RAW1394_ERROR_ALREADY;
655                         } else {
656                                 fi->listen_channels |= 1ULL << channel;
657                                 fi->iso_buffer = int2ptr(req->req.recvb);
658                                 fi->iso_buffer_length = req->req.length;
659                         }
660                 }
661         } else {
662                 /* deallocate channel (one's complement neg) req.misc */
663                 channel = ~channel;
664
665                 if (fi->listen_channels & (1ULL << channel)) {
666                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host,
667                                               channel);
668                         fi->listen_channels &= ~(1ULL << channel);
669                 } else {
670                         req->req.error = RAW1394_ERROR_INVALID_ARG;
671                 }
672         }
673
674         req->req.length = 0;
675         queue_complete_req(req);
676 }
677
678 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
679 {
680         if (req->req.misc) {
681                 if (fi->fcp_buffer) {
682                         req->req.error = RAW1394_ERROR_ALREADY;
683                 } else {
684                         fi->fcp_buffer = int2ptr(req->req.recvb);
685                 }
686         } else {
687                 if (!fi->fcp_buffer) {
688                         req->req.error = RAW1394_ERROR_ALREADY;
689                 } else {
690                         fi->fcp_buffer = NULL;
691                 }
692         }
693
694         req->req.length = 0;
695         queue_complete_req(req);
696 }
697
698 static int handle_async_request(struct file_info *fi,
699                                 struct pending_request *req, int node)
700 {
701         unsigned long flags;
702         struct hpsb_packet *packet = NULL;
703         u64 addr = req->req.address & 0xffffffffffffULL;
704
705         switch (req->req.type) {
706         case RAW1394_REQ_ASYNC_READ:
707                 DBGMSG("read_request called");
708                 packet =
709                     hpsb_make_readpacket(fi->host, node, addr, req->req.length);
710
711                 if (!packet)
712                         return -ENOMEM;
713
714                 if (req->req.length == 4)
715                         req->data = &packet->header[3];
716                 else
717                         req->data = packet->data;
718
719                 break;
720
721         case RAW1394_REQ_ASYNC_WRITE:
722                 DBGMSG("write_request called");
723
724                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
725                                                req->req.length);
726                 if (!packet)
727                         return -ENOMEM;
728
729                 if (req->req.length == 4) {
730                         if (copy_from_user
731                             (&packet->header[3], int2ptr(req->req.sendb),
732                              req->req.length))
733                                 req->req.error = RAW1394_ERROR_MEMFAULT;
734                 } else {
735                         if (copy_from_user
736                             (packet->data, int2ptr(req->req.sendb),
737                              req->req.length))
738                                 req->req.error = RAW1394_ERROR_MEMFAULT;
739                 }
740
741                 req->req.length = 0;
742                 break;
743
744         case RAW1394_REQ_ASYNC_STREAM:
745                 DBGMSG("stream_request called");
746
747                 packet =
748                     hpsb_make_streampacket(fi->host, NULL, req->req.length,
749                                            node & 0x3f /*channel */ ,
750                                            (req->req.misc >> 16) & 0x3,
751                                            req->req.misc & 0xf);
752                 if (!packet)
753                         return -ENOMEM;
754
755                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
756                                    req->req.length))
757                         req->req.error = RAW1394_ERROR_MEMFAULT;
758
759                 req->req.length = 0;
760                 break;
761
762         case RAW1394_REQ_LOCK:
763                 DBGMSG("lock_request called");
764                 if ((req->req.misc == EXTCODE_FETCH_ADD)
765                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
766                         if (req->req.length != 4) {
767                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
768                                 break;
769                         }
770                 } else {
771                         if (req->req.length != 8) {
772                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
773                                 break;
774                         }
775                 }
776
777                 packet = hpsb_make_lockpacket(fi->host, node, addr,
778                                               req->req.misc, NULL, 0);
779                 if (!packet)
780                         return -ENOMEM;
781
782                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
783                                    req->req.length)) {
784                         req->req.error = RAW1394_ERROR_MEMFAULT;
785                         break;
786                 }
787
788                 req->data = packet->data;
789                 req->req.length = 4;
790                 break;
791
792         case RAW1394_REQ_LOCK64:
793                 DBGMSG("lock64_request called");
794                 if ((req->req.misc == EXTCODE_FETCH_ADD)
795                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
796                         if (req->req.length != 8) {
797                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
798                                 break;
799                         }
800                 } else {
801                         if (req->req.length != 16) {
802                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
803                                 break;
804                         }
805                 }
806                 packet = hpsb_make_lock64packet(fi->host, node, addr,
807                                                 req->req.misc, NULL, 0);
808                 if (!packet)
809                         return -ENOMEM;
810
811                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
812                                    req->req.length)) {
813                         req->req.error = RAW1394_ERROR_MEMFAULT;
814                         break;
815                 }
816
817                 req->data = packet->data;
818                 req->req.length = 8;
819                 break;
820
821         default:
822                 req->req.error = RAW1394_ERROR_STATE_ORDER;
823         }
824
825         req->packet = packet;
826
827         if (req->req.error) {
828                 req->req.length = 0;
829                 queue_complete_req(req);
830                 return sizeof(struct raw1394_request);
831         }
832
833         hpsb_set_packet_complete_task(packet,
834                                       (void (*)(void *))queue_complete_cb, req);
835
836         spin_lock_irqsave(&fi->reqlists_lock, flags);
837         list_add_tail(&req->list, &fi->req_pending);
838         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
839
840         packet->generation = req->req.generation;
841
842         if (hpsb_send_packet(packet) < 0) {
843                 req->req.error = RAW1394_ERROR_SEND_ERROR;
844                 req->req.length = 0;
845                 hpsb_free_tlabel(packet);
846                 queue_complete_req(req);
847         }
848         return sizeof(struct raw1394_request);
849 }
850
851 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
852                            int channel)
853 {
854         unsigned long flags;
855         struct hpsb_packet *packet;
856
857         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
858                                      (req->req.misc >> 16) & 0x3,
859                                      req->req.misc & 0xf);
860         if (!packet)
861                 return -ENOMEM;
862
863         packet->speed_code = req->req.address & 0x3;
864
865         req->packet = packet;
866
867         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
868                            req->req.length)) {
869                 req->req.error = RAW1394_ERROR_MEMFAULT;
870                 req->req.length = 0;
871                 queue_complete_req(req);
872                 return sizeof(struct raw1394_request);
873         }
874
875         req->req.length = 0;
876         hpsb_set_packet_complete_task(packet,
877                                       (void (*)(void *))queue_complete_req,
878                                       req);
879
880         spin_lock_irqsave(&fi->reqlists_lock, flags);
881         list_add_tail(&req->list, &fi->req_pending);
882         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
883
884         /* Update the generation of the packet just before sending. */
885         packet->generation = req->req.generation;
886
887         if (hpsb_send_packet(packet) < 0) {
888                 req->req.error = RAW1394_ERROR_SEND_ERROR;
889                 queue_complete_req(req);
890         }
891
892         return sizeof(struct raw1394_request);
893 }
894
895 static int handle_async_send(struct file_info *fi, struct pending_request *req)
896 {
897         unsigned long flags;
898         struct hpsb_packet *packet;
899         int header_length = req->req.misc & 0xffff;
900         int expect_response = req->req.misc >> 16;
901
902         if ((header_length > req->req.length) || (header_length < 12)) {
903                 req->req.error = RAW1394_ERROR_INVALID_ARG;
904                 req->req.length = 0;
905                 queue_complete_req(req);
906                 return sizeof(struct raw1394_request);
907         }
908
909         packet = hpsb_alloc_packet(req->req.length - header_length);
910         req->packet = packet;
911         if (!packet)
912                 return -ENOMEM;
913
914         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
915                            header_length)) {
916                 req->req.error = RAW1394_ERROR_MEMFAULT;
917                 req->req.length = 0;
918                 queue_complete_req(req);
919                 return sizeof(struct raw1394_request);
920         }
921
922         if (copy_from_user
923             (packet->data, int2ptr(req->req.sendb) + header_length,
924              packet->data_size)) {
925                 req->req.error = RAW1394_ERROR_MEMFAULT;
926                 req->req.length = 0;
927                 queue_complete_req(req);
928                 return sizeof(struct raw1394_request);
929         }
930
931         packet->type = hpsb_async;
932         packet->node_id = packet->header[0] >> 16;
933         packet->tcode = (packet->header[0] >> 4) & 0xf;
934         packet->tlabel = (packet->header[0] >> 10) & 0x3f;
935         packet->host = fi->host;
936         packet->expect_response = expect_response;
937         packet->header_size = header_length;
938         packet->data_size = req->req.length - header_length;
939
940         req->req.length = 0;
941         hpsb_set_packet_complete_task(packet,
942                                       (void (*)(void *))queue_complete_cb, req);
943
944         spin_lock_irqsave(&fi->reqlists_lock, flags);
945         list_add_tail(&req->list, &fi->req_pending);
946         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
947
948         /* Update the generation of the packet just before sending. */
949         packet->generation = req->req.generation;
950
951         if (hpsb_send_packet(packet) < 0) {
952                 req->req.error = RAW1394_ERROR_SEND_ERROR;
953                 queue_complete_req(req);
954         }
955
956         return sizeof(struct raw1394_request);
957 }
958
959 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
960                     u64 addr, size_t length, u16 flags)
961 {
962         unsigned long irqflags;
963         struct pending_request *req;
964         struct host_info *hi;
965         struct file_info *fi = NULL;
966         struct list_head *entry;
967         struct arm_addr *arm_addr = NULL;
968         struct arm_request *arm_req = NULL;
969         struct arm_response *arm_resp = NULL;
970         int found = 0, size = 0, rcode = -1;
971         struct arm_request_response *arm_req_resp = NULL;
972
973         DBGMSG("arm_read  called by node: %X"
974                "addr: %4.4x %8.8x length: %Zu", nodeid,
975                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
976                length);
977         spin_lock_irqsave(&host_info_lock, irqflags);
978         hi = find_host_info(host);      /* search address-entry */
979         if (hi != NULL) {
980                 list_for_each_entry(fi, &hi->file_info_list, list) {
981                         entry = fi->addr_list.next;
982                         while (entry != &(fi->addr_list)) {
983                                 arm_addr =
984                                     list_entry(entry, struct arm_addr,
985                                                addr_list);
986                                 if (((arm_addr->start) <= (addr))
987                                     && ((arm_addr->end) >= (addr + length))) {
988                                         found = 1;
989                                         break;
990                                 }
991                                 entry = entry->next;
992                         }
993                         if (found) {
994                                 break;
995                         }
996                 }
997         }
998         rcode = -1;
999         if (!found) {
1000                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
1001                        " -> rcode_address_error\n");
1002                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1003                 return (RCODE_ADDRESS_ERROR);
1004         } else {
1005                 DBGMSG("arm_read addr_entry FOUND");
1006         }
1007         if (arm_addr->rec_length < length) {
1008                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
1009                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1010         }
1011         if (rcode == -1) {
1012                 if (arm_addr->access_rights & ARM_READ) {
1013                         if (!(arm_addr->client_transactions & ARM_READ)) {
1014                                 memcpy(buffer,
1015                                        (arm_addr->addr_space_buffer) + (addr -
1016                                                                         (arm_addr->
1017                                                                          start)),
1018                                        length);
1019                                 DBGMSG("arm_read -> (rcode_complete)");
1020                                 rcode = RCODE_COMPLETE;
1021                         }
1022                 } else {
1023                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1024                         DBGMSG("arm_read -> rcode_type_error (access denied)");
1025                 }
1026         }
1027         if (arm_addr->notification_options & ARM_READ) {
1028                 DBGMSG("arm_read -> entering notification-section");
1029                 req = __alloc_pending_request(SLAB_ATOMIC);
1030                 if (!req) {
1031                         DBGMSG("arm_read -> rcode_conflict_error");
1032                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1033                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1034                                                            The request may be retried */
1035                 }
1036                 if (rcode == RCODE_COMPLETE) {
1037                         size =
1038                             sizeof(struct arm_request) +
1039                             sizeof(struct arm_response) +
1040                             length * sizeof(byte_t) +
1041                             sizeof(struct arm_request_response);
1042                 } else {
1043                         size =
1044                             sizeof(struct arm_request) +
1045                             sizeof(struct arm_response) +
1046                             sizeof(struct arm_request_response);
1047                 }
1048                 req->data = kmalloc(size, SLAB_ATOMIC);
1049                 if (!(req->data)) {
1050                         free_pending_request(req);
1051                         DBGMSG("arm_read -> rcode_conflict_error");
1052                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1053                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1054                                                            The request may be retried */
1055                 }
1056                 req->free_data = 1;
1057                 req->file_info = fi;
1058                 req->req.type = RAW1394_REQ_ARM;
1059                 req->req.generation = get_hpsb_generation(host);
1060                 req->req.misc =
1061                     (((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
1062                 req->req.tag = arm_addr->arm_tag;
1063                 req->req.recvb = arm_addr->recvb;
1064                 req->req.length = size;
1065                 arm_req_resp = (struct arm_request_response *)(req->data);
1066                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1067                                                  (sizeof
1068                                                   (struct
1069                                                    arm_request_response)));
1070                 arm_resp =
1071                     (struct arm_response *)((byte_t *) (arm_req) +
1072                                             (sizeof(struct arm_request)));
1073                 arm_req->buffer = NULL;
1074                 arm_resp->buffer = NULL;
1075                 if (rcode == RCODE_COMPLETE) {
1076                         byte_t *buf =
1077                             (byte_t *) arm_resp + sizeof(struct arm_response);
1078                         memcpy(buf,
1079                                (arm_addr->addr_space_buffer) + (addr -
1080                                                                 (arm_addr->
1081                                                                  start)),
1082                                length);
1083                         arm_resp->buffer =
1084                             int2ptr((arm_addr->recvb) +
1085                                     sizeof(struct arm_request_response) +
1086                                     sizeof(struct arm_request) +
1087                                     sizeof(struct arm_response));
1088                 }
1089                 arm_resp->buffer_length =
1090                     (rcode == RCODE_COMPLETE) ? length : 0;
1091                 arm_resp->response_code = rcode;
1092                 arm_req->buffer_length = 0;
1093                 arm_req->generation = req->req.generation;
1094                 arm_req->extended_transaction_code = 0;
1095                 arm_req->destination_offset = addr;
1096                 arm_req->source_nodeid = nodeid;
1097                 arm_req->destination_nodeid = host->node_id;
1098                 arm_req->tlabel = (flags >> 10) & 0x3f;
1099                 arm_req->tcode = (flags >> 4) & 0x0f;
1100                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1101                                                 sizeof(struct
1102                                                        arm_request_response));
1103                 arm_req_resp->response =
1104                     int2ptr((arm_addr->recvb) +
1105                             sizeof(struct arm_request_response) +
1106                             sizeof(struct arm_request));
1107                 queue_complete_req(req);
1108         }
1109         spin_unlock_irqrestore(&host_info_lock, irqflags);
1110         return (rcode);
1111 }
1112
1113 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
1114                      quadlet_t * data, u64 addr, size_t length, u16 flags)
1115 {
1116         unsigned long irqflags;
1117         struct pending_request *req;
1118         struct host_info *hi;
1119         struct file_info *fi = NULL;
1120         struct list_head *entry;
1121         struct arm_addr *arm_addr = NULL;
1122         struct arm_request *arm_req = NULL;
1123         struct arm_response *arm_resp = NULL;
1124         int found = 0, size = 0, rcode = -1, length_conflict = 0;
1125         struct arm_request_response *arm_req_resp = NULL;
1126
1127         DBGMSG("arm_write called by node: %X"
1128                "addr: %4.4x %8.8x length: %Zu", nodeid,
1129                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1130                length);
1131         spin_lock_irqsave(&host_info_lock, irqflags);
1132         hi = find_host_info(host);      /* search address-entry */
1133         if (hi != NULL) {
1134                 list_for_each_entry(fi, &hi->file_info_list, list) {
1135                         entry = fi->addr_list.next;
1136                         while (entry != &(fi->addr_list)) {
1137                                 arm_addr =
1138                                     list_entry(entry, struct arm_addr,
1139                                                addr_list);
1140                                 if (((arm_addr->start) <= (addr))
1141                                     && ((arm_addr->end) >= (addr + length))) {
1142                                         found = 1;
1143                                         break;
1144                                 }
1145                                 entry = entry->next;
1146                         }
1147                         if (found) {
1148                                 break;
1149                         }
1150                 }
1151         }
1152         rcode = -1;
1153         if (!found) {
1154                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1155                        " -> rcode_address_error\n");
1156                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1157                 return (RCODE_ADDRESS_ERROR);
1158         } else {
1159                 DBGMSG("arm_write addr_entry FOUND");
1160         }
1161         if (arm_addr->rec_length < length) {
1162                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1163                 length_conflict = 1;
1164                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1165         }
1166         if (rcode == -1) {
1167                 if (arm_addr->access_rights & ARM_WRITE) {
1168                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1169                                 memcpy((arm_addr->addr_space_buffer) +
1170                                        (addr - (arm_addr->start)), data,
1171                                        length);
1172                                 DBGMSG("arm_write -> (rcode_complete)");
1173                                 rcode = RCODE_COMPLETE;
1174                         }
1175                 } else {
1176                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1177                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1178                 }
1179         }
1180         if (arm_addr->notification_options & ARM_WRITE) {
1181                 DBGMSG("arm_write -> entering notification-section");
1182                 req = __alloc_pending_request(SLAB_ATOMIC);
1183                 if (!req) {
1184                         DBGMSG("arm_write -> rcode_conflict_error");
1185                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1186                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1187                                                            The request my be retried */
1188                 }
1189                 size =
1190                     sizeof(struct arm_request) + sizeof(struct arm_response) +
1191                     (length) * sizeof(byte_t) +
1192                     sizeof(struct arm_request_response);
1193                 req->data = kmalloc(size, SLAB_ATOMIC);
1194                 if (!(req->data)) {
1195                         free_pending_request(req);
1196                         DBGMSG("arm_write -> rcode_conflict_error");
1197                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1198                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1199                                                            The request may be retried */
1200                 }
1201                 req->free_data = 1;
1202                 req->file_info = fi;
1203                 req->req.type = RAW1394_REQ_ARM;
1204                 req->req.generation = get_hpsb_generation(host);
1205                 req->req.misc =
1206                     (((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1207                 req->req.tag = arm_addr->arm_tag;
1208                 req->req.recvb = arm_addr->recvb;
1209                 req->req.length = size;
1210                 arm_req_resp = (struct arm_request_response *)(req->data);
1211                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1212                                                  (sizeof
1213                                                   (struct
1214                                                    arm_request_response)));
1215                 arm_resp =
1216                     (struct arm_response *)((byte_t *) (arm_req) +
1217                                             (sizeof(struct arm_request)));
1218                 arm_resp->buffer = NULL;
1219                 memcpy((byte_t *) arm_resp + sizeof(struct arm_response),
1220                        data, length);
1221                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1222                                           sizeof(struct arm_request_response) +
1223                                           sizeof(struct arm_request) +
1224                                           sizeof(struct arm_response));
1225                 arm_req->buffer_length = length;
1226                 arm_req->generation = req->req.generation;
1227                 arm_req->extended_transaction_code = 0;
1228                 arm_req->destination_offset = addr;
1229                 arm_req->source_nodeid = nodeid;
1230                 arm_req->destination_nodeid = destid;
1231                 arm_req->tlabel = (flags >> 10) & 0x3f;
1232                 arm_req->tcode = (flags >> 4) & 0x0f;
1233                 arm_resp->buffer_length = 0;
1234                 arm_resp->response_code = rcode;
1235                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1236                                                 sizeof(struct
1237                                                        arm_request_response));
1238                 arm_req_resp->response =
1239                     int2ptr((arm_addr->recvb) +
1240                             sizeof(struct arm_request_response) +
1241                             sizeof(struct arm_request));
1242                 queue_complete_req(req);
1243         }
1244         spin_unlock_irqrestore(&host_info_lock, irqflags);
1245         return (rcode);
1246 }
1247
1248 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
1249                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
1250                     u16 flags)
1251 {
1252         unsigned long irqflags;
1253         struct pending_request *req;
1254         struct host_info *hi;
1255         struct file_info *fi = NULL;
1256         struct list_head *entry;
1257         struct arm_addr *arm_addr = NULL;
1258         struct arm_request *arm_req = NULL;
1259         struct arm_response *arm_resp = NULL;
1260         int found = 0, size = 0, rcode = -1;
1261         quadlet_t old, new;
1262         struct arm_request_response *arm_req_resp = NULL;
1263
1264         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1265             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1266                 DBGMSG("arm_lock  called by node: %X "
1267                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1268                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1269                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1270                        be32_to_cpu(data));
1271         } else {
1272                 DBGMSG("arm_lock  called by node: %X "
1273                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1274                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1275                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1276                        be32_to_cpu(data), be32_to_cpu(arg));
1277         }
1278         spin_lock_irqsave(&host_info_lock, irqflags);
1279         hi = find_host_info(host);      /* search address-entry */
1280         if (hi != NULL) {
1281                 list_for_each_entry(fi, &hi->file_info_list, list) {
1282                         entry = fi->addr_list.next;
1283                         while (entry != &(fi->addr_list)) {
1284                                 arm_addr =
1285                                     list_entry(entry, struct arm_addr,
1286                                                addr_list);
1287                                 if (((arm_addr->start) <= (addr))
1288                                     && ((arm_addr->end) >=
1289                                         (addr + sizeof(*store)))) {
1290                                         found = 1;
1291                                         break;
1292                                 }
1293                                 entry = entry->next;
1294                         }
1295                         if (found) {
1296                                 break;
1297                         }
1298                 }
1299         }
1300         rcode = -1;
1301         if (!found) {
1302                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1303                        " -> rcode_address_error\n");
1304                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1305                 return (RCODE_ADDRESS_ERROR);
1306         } else {
1307                 DBGMSG("arm_lock addr_entry FOUND");
1308         }
1309         if (rcode == -1) {
1310                 if (arm_addr->access_rights & ARM_LOCK) {
1311                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1312                                 memcpy(&old,
1313                                        (arm_addr->addr_space_buffer) + (addr -
1314                                                                         (arm_addr->
1315                                                                          start)),
1316                                        sizeof(old));
1317                                 switch (ext_tcode) {
1318                                 case (EXTCODE_MASK_SWAP):
1319                                         new = data | (old & ~arg);
1320                                         break;
1321                                 case (EXTCODE_COMPARE_SWAP):
1322                                         if (old == arg) {
1323                                                 new = data;
1324                                         } else {
1325                                                 new = old;
1326                                         }
1327                                         break;
1328                                 case (EXTCODE_FETCH_ADD):
1329                                         new =
1330                                             cpu_to_be32(be32_to_cpu(data) +
1331                                                         be32_to_cpu(old));
1332                                         break;
1333                                 case (EXTCODE_LITTLE_ADD):
1334                                         new =
1335                                             cpu_to_le32(le32_to_cpu(data) +
1336                                                         le32_to_cpu(old));
1337                                         break;
1338                                 case (EXTCODE_BOUNDED_ADD):
1339                                         if (old != arg) {
1340                                                 new =
1341                                                     cpu_to_be32(be32_to_cpu
1342                                                                 (data) +
1343                                                                 be32_to_cpu
1344                                                                 (old));
1345                                         } else {
1346                                                 new = old;
1347                                         }
1348                                         break;
1349                                 case (EXTCODE_WRAP_ADD):
1350                                         if (old != arg) {
1351                                                 new =
1352                                                     cpu_to_be32(be32_to_cpu
1353                                                                 (data) +
1354                                                                 be32_to_cpu
1355                                                                 (old));
1356                                         } else {
1357                                                 new = data;
1358                                         }
1359                                         break;
1360                                 default:
1361                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1362                                         printk(KERN_ERR
1363                                                "raw1394: arm_lock FAILED "
1364                                                "ext_tcode not allowed -> rcode_type_error\n");
1365                                         break;
1366                                 }       /*switch */
1367                                 if (rcode == -1) {
1368                                         DBGMSG("arm_lock -> (rcode_complete)");
1369                                         rcode = RCODE_COMPLETE;
1370                                         memcpy(store, &old, sizeof(*store));
1371                                         memcpy((arm_addr->addr_space_buffer) +
1372                                                (addr - (arm_addr->start)),
1373                                                &new, sizeof(*store));
1374                                 }
1375                         }
1376                 } else {
1377                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1378                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1379                 }
1380         }
1381         if (arm_addr->notification_options & ARM_LOCK) {
1382                 byte_t *buf1, *buf2;
1383                 DBGMSG("arm_lock -> entering notification-section");
1384                 req = __alloc_pending_request(SLAB_ATOMIC);
1385                 if (!req) {
1386                         DBGMSG("arm_lock -> rcode_conflict_error");
1387                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1388                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1389                                                            The request may be retried */
1390                 }
1391                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1392                 req->data = kmalloc(size, SLAB_ATOMIC);
1393                 if (!(req->data)) {
1394                         free_pending_request(req);
1395                         DBGMSG("arm_lock -> rcode_conflict_error");
1396                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1397                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1398                                                            The request may be retried */
1399                 }
1400                 req->free_data = 1;
1401                 arm_req_resp = (struct arm_request_response *)(req->data);
1402                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1403                                                  (sizeof
1404                                                   (struct
1405                                                    arm_request_response)));
1406                 arm_resp =
1407                     (struct arm_response *)((byte_t *) (arm_req) +
1408                                             (sizeof(struct arm_request)));
1409                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1410                 buf2 = buf1 + 2 * sizeof(*store);
1411                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1412                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1413                         arm_req->buffer_length = sizeof(*store);
1414                         memcpy(buf1, &data, sizeof(*store));
1415
1416                 } else {
1417                         arm_req->buffer_length = 2 * sizeof(*store);
1418                         memcpy(buf1, &arg, sizeof(*store));
1419                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1420                 }
1421                 if (rcode == RCODE_COMPLETE) {
1422                         arm_resp->buffer_length = sizeof(*store);
1423                         memcpy(buf2, &old, sizeof(*store));
1424                 } else {
1425                         arm_resp->buffer_length = 0;
1426                 }
1427                 req->file_info = fi;
1428                 req->req.type = RAW1394_REQ_ARM;
1429                 req->req.generation = get_hpsb_generation(host);
1430                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1431                                  (ARM_LOCK & 0xFF));
1432                 req->req.tag = arm_addr->arm_tag;
1433                 req->req.recvb = arm_addr->recvb;
1434                 req->req.length = size;
1435                 arm_req->generation = req->req.generation;
1436                 arm_req->extended_transaction_code = ext_tcode;
1437                 arm_req->destination_offset = addr;
1438                 arm_req->source_nodeid = nodeid;
1439                 arm_req->destination_nodeid = host->node_id;
1440                 arm_req->tlabel = (flags >> 10) & 0x3f;
1441                 arm_req->tcode = (flags >> 4) & 0x0f;
1442                 arm_resp->response_code = rcode;
1443                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1444                                                 sizeof(struct
1445                                                        arm_request_response));
1446                 arm_req_resp->response =
1447                     int2ptr((arm_addr->recvb) +
1448                             sizeof(struct arm_request_response) +
1449                             sizeof(struct arm_request));
1450                 arm_req->buffer =
1451                     int2ptr((arm_addr->recvb) +
1452                             sizeof(struct arm_request_response) +
1453                             sizeof(struct arm_request) +
1454                             sizeof(struct arm_response));
1455                 arm_resp->buffer =
1456                     int2ptr((arm_addr->recvb) +
1457                             sizeof(struct arm_request_response) +
1458                             sizeof(struct arm_request) +
1459                             sizeof(struct arm_response) + 2 * sizeof(*store));
1460                 queue_complete_req(req);
1461         }
1462         spin_unlock_irqrestore(&host_info_lock, irqflags);
1463         return (rcode);
1464 }
1465
1466 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
1467                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
1468                       u16 flags)
1469 {
1470         unsigned long irqflags;
1471         struct pending_request *req;
1472         struct host_info *hi;
1473         struct file_info *fi = NULL;
1474         struct list_head *entry;
1475         struct arm_addr *arm_addr = NULL;
1476         struct arm_request *arm_req = NULL;
1477         struct arm_response *arm_resp = NULL;
1478         int found = 0, size = 0, rcode = -1;
1479         octlet_t old, new;
1480         struct arm_request_response *arm_req_resp = NULL;
1481
1482         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1483             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1484                 DBGMSG("arm_lock64 called by node: %X "
1485                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1486                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1487                        (u32) (addr & 0xFFFFFFFF),
1488                        ext_tcode & 0xFF,
1489                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1490                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1491         } else {
1492                 DBGMSG("arm_lock64 called by node: %X "
1493                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1494                        "%8.8X %8.8X ",
1495                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1496                        (u32) (addr & 0xFFFFFFFF),
1497                        ext_tcode & 0xFF,
1498                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1499                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1500                        (u32) ((be64_to_cpu(arg) >> 32) & 0xFFFFFFFF),
1501                        (u32) (be64_to_cpu(arg) & 0xFFFFFFFF));
1502         }
1503         spin_lock_irqsave(&host_info_lock, irqflags);
1504         hi = find_host_info(host);      /* search addressentry in file_info's for host */
1505         if (hi != NULL) {
1506                 list_for_each_entry(fi, &hi->file_info_list, list) {
1507                         entry = fi->addr_list.next;
1508                         while (entry != &(fi->addr_list)) {
1509                                 arm_addr =
1510                                     list_entry(entry, struct arm_addr,
1511                                                addr_list);
1512                                 if (((arm_addr->start) <= (addr))
1513                                     && ((arm_addr->end) >=
1514                                         (addr + sizeof(*store)))) {
1515                                         found = 1;
1516                                         break;
1517                                 }
1518                                 entry = entry->next;
1519                         }
1520                         if (found) {
1521                                 break;
1522                         }
1523                 }
1524         }
1525         rcode = -1;
1526         if (!found) {
1527                 printk(KERN_ERR
1528                        "raw1394: arm_lock64 FAILED addr_entry not found"
1529                        " -> rcode_address_error\n");
1530                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1531                 return (RCODE_ADDRESS_ERROR);
1532         } else {
1533                 DBGMSG("arm_lock64 addr_entry FOUND");
1534         }
1535         if (rcode == -1) {
1536                 if (arm_addr->access_rights & ARM_LOCK) {
1537                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1538                                 memcpy(&old,
1539                                        (arm_addr->addr_space_buffer) + (addr -
1540                                                                         (arm_addr->
1541                                                                          start)),
1542                                        sizeof(old));
1543                                 switch (ext_tcode) {
1544                                 case (EXTCODE_MASK_SWAP):
1545                                         new = data | (old & ~arg);
1546                                         break;
1547                                 case (EXTCODE_COMPARE_SWAP):
1548                                         if (old == arg) {
1549                                                 new = data;
1550                                         } else {
1551                                                 new = old;
1552                                         }
1553                                         break;
1554                                 case (EXTCODE_FETCH_ADD):
1555                                         new =
1556                                             cpu_to_be64(be64_to_cpu(data) +
1557                                                         be64_to_cpu(old));
1558                                         break;
1559                                 case (EXTCODE_LITTLE_ADD):
1560                                         new =
1561                                             cpu_to_le64(le64_to_cpu(data) +
1562                                                         le64_to_cpu(old));
1563                                         break;
1564                                 case (EXTCODE_BOUNDED_ADD):
1565                                         if (old != arg) {
1566                                                 new =
1567                                                     cpu_to_be64(be64_to_cpu
1568                                                                 (data) +
1569                                                                 be64_to_cpu
1570                                                                 (old));
1571                                         } else {
1572                                                 new = old;
1573                                         }
1574                                         break;
1575                                 case (EXTCODE_WRAP_ADD):
1576                                         if (old != arg) {
1577                                                 new =
1578                                                     cpu_to_be64(be64_to_cpu
1579                                                                 (data) +
1580                                                                 be64_to_cpu
1581                                                                 (old));
1582                                         } else {
1583                                                 new = data;
1584                                         }
1585                                         break;
1586                                 default:
1587                                         printk(KERN_ERR
1588                                                "raw1394: arm_lock64 FAILED "
1589                                                "ext_tcode not allowed -> rcode_type_error\n");
1590                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1591                                         break;
1592                                 }       /*switch */
1593                                 if (rcode == -1) {
1594                                         DBGMSG
1595                                             ("arm_lock64 -> (rcode_complete)");
1596                                         rcode = RCODE_COMPLETE;
1597                                         memcpy(store, &old, sizeof(*store));
1598                                         memcpy((arm_addr->addr_space_buffer) +
1599                                                (addr - (arm_addr->start)),
1600                                                &new, sizeof(*store));
1601                                 }
1602                         }
1603                 } else {
1604                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1605                         DBGMSG
1606                             ("arm_lock64 -> rcode_type_error (access denied)");
1607                 }
1608         }
1609         if (arm_addr->notification_options & ARM_LOCK) {
1610                 byte_t *buf1, *buf2;
1611                 DBGMSG("arm_lock64 -> entering notification-section");
1612                 req = __alloc_pending_request(SLAB_ATOMIC);
1613                 if (!req) {
1614                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1615                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1616                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1617                                                            The request may be retried */
1618                 }
1619                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1620                 req->data = kmalloc(size, SLAB_ATOMIC);
1621                 if (!(req->data)) {
1622                         free_pending_request(req);
1623                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1624                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1625                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1626                                                            The request may be retried */
1627                 }
1628                 req->free_data = 1;
1629                 arm_req_resp = (struct arm_request_response *)(req->data);
1630                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1631                                                  (sizeof
1632                                                   (struct
1633                                                    arm_request_response)));
1634                 arm_resp =
1635                     (struct arm_response *)((byte_t *) (arm_req) +
1636                                             (sizeof(struct arm_request)));
1637                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1638                 buf2 = buf1 + 2 * sizeof(*store);
1639                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1640                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1641                         arm_req->buffer_length = sizeof(*store);
1642                         memcpy(buf1, &data, sizeof(*store));
1643
1644                 } else {
1645                         arm_req->buffer_length = 2 * sizeof(*store);
1646                         memcpy(buf1, &arg, sizeof(*store));
1647                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1648                 }
1649                 if (rcode == RCODE_COMPLETE) {
1650                         arm_resp->buffer_length = sizeof(*store);
1651                         memcpy(buf2, &old, sizeof(*store));
1652                 } else {
1653                         arm_resp->buffer_length = 0;
1654                 }
1655                 req->file_info = fi;
1656                 req->req.type = RAW1394_REQ_ARM;
1657                 req->req.generation = get_hpsb_generation(host);
1658                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1659                                  (ARM_LOCK & 0xFF));
1660                 req->req.tag = arm_addr->arm_tag;
1661                 req->req.recvb = arm_addr->recvb;
1662                 req->req.length = size;
1663                 arm_req->generation = req->req.generation;
1664                 arm_req->extended_transaction_code = ext_tcode;
1665                 arm_req->destination_offset = addr;
1666                 arm_req->source_nodeid = nodeid;
1667                 arm_req->destination_nodeid = host->node_id;
1668                 arm_req->tlabel = (flags >> 10) & 0x3f;
1669                 arm_req->tcode = (flags >> 4) & 0x0f;
1670                 arm_resp->response_code = rcode;
1671                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1672                                                 sizeof(struct
1673                                                        arm_request_response));
1674                 arm_req_resp->response =
1675                     int2ptr((arm_addr->recvb) +
1676                             sizeof(struct arm_request_response) +
1677                             sizeof(struct arm_request));
1678                 arm_req->buffer =
1679                     int2ptr((arm_addr->recvb) +
1680                             sizeof(struct arm_request_response) +
1681                             sizeof(struct arm_request) +
1682                             sizeof(struct arm_response));
1683                 arm_resp->buffer =
1684                     int2ptr((arm_addr->recvb) +
1685                             sizeof(struct arm_request_response) +
1686                             sizeof(struct arm_request) +
1687                             sizeof(struct arm_response) + 2 * sizeof(*store));
1688                 queue_complete_req(req);
1689         }
1690         spin_unlock_irqrestore(&host_info_lock, irqflags);
1691         return (rcode);
1692 }
1693
1694 static int arm_register(struct file_info *fi, struct pending_request *req)
1695 {
1696         int retval;
1697         struct arm_addr *addr;
1698         struct host_info *hi;
1699         struct file_info *fi_hlp = NULL;
1700         struct list_head *entry;
1701         struct arm_addr *arm_addr = NULL;
1702         int same_host, another_host;
1703         unsigned long flags;
1704
1705         DBGMSG("arm_register called "
1706                "addr(Offset): %8.8x %8.8x length: %u "
1707                "rights: %2.2X notify: %2.2X "
1708                "max_blk_len: %4.4X",
1709                (u32) ((req->req.address >> 32) & 0xFFFF),
1710                (u32) (req->req.address & 0xFFFFFFFF),
1711                req->req.length, ((req->req.misc >> 8) & 0xFF),
1712                (req->req.misc & 0xFF), ((req->req.misc >> 16) & 0xFFFF));
1713         /* check addressrange */
1714         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1715             (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) !=
1716              0)) {
1717                 req->req.length = 0;
1718                 return (-EINVAL);
1719         }
1720         /* addr-list-entry for fileinfo */
1721         addr = kmalloc(sizeof(*addr), SLAB_KERNEL);
1722         if (!addr) {
1723                 req->req.length = 0;
1724                 return (-ENOMEM);
1725         }
1726         /* allocation of addr_space_buffer */
1727         addr->addr_space_buffer = vmalloc(req->req.length);
1728         if (!(addr->addr_space_buffer)) {
1729                 kfree(addr);
1730                 req->req.length = 0;
1731                 return (-ENOMEM);
1732         }
1733         /* initialization of addr_space_buffer */
1734         if ((req->req.sendb) == (unsigned long)NULL) {
1735                 /* init: set 0 */
1736                 memset(addr->addr_space_buffer, 0, req->req.length);
1737         } else {
1738                 /* init: user -> kernel */
1739                 if (copy_from_user
1740                     (addr->addr_space_buffer, int2ptr(req->req.sendb),
1741                      req->req.length)) {
1742                         vfree(addr->addr_space_buffer);
1743                         kfree(addr);
1744                         return (-EFAULT);
1745                 }
1746         }
1747         INIT_LIST_HEAD(&addr->addr_list);
1748         addr->arm_tag = req->req.tag;
1749         addr->start = req->req.address;
1750         addr->end = req->req.address + req->req.length;
1751         addr->access_rights = (u8) (req->req.misc & 0x0F);
1752         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1753         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1754         addr->access_rights |= addr->client_transactions;
1755         addr->notification_options |= addr->client_transactions;
1756         addr->recvb = req->req.recvb;
1757         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1758         spin_lock_irqsave(&host_info_lock, flags);
1759         hi = find_host_info(fi->host);
1760         same_host = 0;
1761         another_host = 0;
1762         /* same host with address-entry containing same addressrange ? */
1763         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1764                 entry = fi_hlp->addr_list.next;
1765                 while (entry != &(fi_hlp->addr_list)) {
1766                         arm_addr =
1767                             list_entry(entry, struct arm_addr, addr_list);
1768                         if ((arm_addr->start == addr->start)
1769                             && (arm_addr->end == addr->end)) {
1770                                 DBGMSG("same host ownes same "
1771                                        "addressrange -> EALREADY");
1772                                 same_host = 1;
1773                                 break;
1774                         }
1775                         entry = entry->next;
1776                 }
1777                 if (same_host) {
1778                         break;
1779                 }
1780         }
1781         if (same_host) {
1782                 /* addressrange occupied by same host */
1783                 vfree(addr->addr_space_buffer);
1784                 kfree(addr);
1785                 spin_unlock_irqrestore(&host_info_lock, flags);
1786                 return (-EALREADY);
1787         }
1788         /* another host with valid address-entry containing same addressrange */
1789         list_for_each_entry(hi, &host_info_list, list) {
1790                 if (hi->host != fi->host) {
1791                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1792                                 entry = fi_hlp->addr_list.next;
1793                                 while (entry != &(fi_hlp->addr_list)) {
1794                                         arm_addr =
1795                                             list_entry(entry, struct arm_addr,
1796                                                        addr_list);
1797                                         if ((arm_addr->start == addr->start)
1798                                             && (arm_addr->end == addr->end)) {
1799                                                 DBGMSG
1800                                                     ("another host ownes same "
1801                                                      "addressrange");
1802                                                 another_host = 1;
1803                                                 break;
1804                                         }
1805                                         entry = entry->next;
1806                                 }
1807                                 if (another_host) {
1808                                         break;
1809                                 }
1810                         }
1811                 }
1812         }
1813         if (another_host) {
1814                 DBGMSG("another hosts entry is valid -> SUCCESS");
1815                 if (copy_to_user(int2ptr(req->req.recvb),
1816                                  &addr->start, sizeof(u64))) {
1817                         printk(KERN_ERR "raw1394: arm_register failed "
1818                                " address-range-entry is invalid -> EFAULT !!!\n");
1819                         vfree(addr->addr_space_buffer);
1820                         kfree(addr);
1821                         spin_unlock_irqrestore(&host_info_lock, flags);
1822                         return (-EFAULT);
1823                 }
1824                 free_pending_request(req);      /* immediate success or fail */
1825                 /* INSERT ENTRY */
1826                 list_add_tail(&addr->addr_list, &fi->addr_list);
1827                 spin_unlock_irqrestore(&host_info_lock, flags);
1828                 return sizeof(struct raw1394_request);
1829         }
1830         retval =
1831             hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
1832                                     req->req.address,
1833                                     req->req.address + req->req.length);
1834         if (retval) {
1835                 /* INSERT ENTRY */
1836                 list_add_tail(&addr->addr_list, &fi->addr_list);
1837         } else {
1838                 DBGMSG("arm_register failed errno: %d \n", retval);
1839                 vfree(addr->addr_space_buffer);
1840                 kfree(addr);
1841                 spin_unlock_irqrestore(&host_info_lock, flags);
1842                 return (-EALREADY);
1843         }
1844         spin_unlock_irqrestore(&host_info_lock, flags);
1845         free_pending_request(req);      /* immediate success or fail */
1846         return sizeof(struct raw1394_request);
1847 }
1848
1849 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1850 {
1851         int found = 0;
1852         int retval = 0;
1853         struct list_head *entry;
1854         struct arm_addr *addr = NULL;
1855         struct host_info *hi;
1856         struct file_info *fi_hlp = NULL;
1857         struct arm_addr *arm_addr = NULL;
1858         int another_host;
1859         unsigned long flags;
1860
1861         DBGMSG("arm_Unregister called addr(Offset): "
1862                "%8.8x %8.8x",
1863                (u32) ((req->req.address >> 32) & 0xFFFF),
1864                (u32) (req->req.address & 0xFFFFFFFF));
1865         spin_lock_irqsave(&host_info_lock, flags);
1866         /* get addr */
1867         entry = fi->addr_list.next;
1868         while (entry != &(fi->addr_list)) {
1869                 addr = list_entry(entry, struct arm_addr, addr_list);
1870                 if (addr->start == req->req.address) {
1871                         found = 1;
1872                         break;
1873                 }
1874                 entry = entry->next;
1875         }
1876         if (!found) {
1877                 DBGMSG("arm_Unregister addr not found");
1878                 spin_unlock_irqrestore(&host_info_lock, flags);
1879                 return (-EINVAL);
1880         }
1881         DBGMSG("arm_Unregister addr found");
1882         another_host = 0;
1883         /* another host with valid address-entry containing
1884            same addressrange */
1885         list_for_each_entry(hi, &host_info_list, list) {
1886                 if (hi->host != fi->host) {
1887                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1888                                 entry = fi_hlp->addr_list.next;
1889                                 while (entry != &(fi_hlp->addr_list)) {
1890                                         arm_addr = list_entry(entry,
1891                                                               struct arm_addr,
1892                                                               addr_list);
1893                                         if (arm_addr->start == addr->start) {
1894                                                 DBGMSG("another host ownes "
1895                                                        "same addressrange");
1896                                                 another_host = 1;
1897                                                 break;
1898                                         }
1899                                         entry = entry->next;
1900                                 }
1901                                 if (another_host) {
1902                                         break;
1903                                 }
1904                         }
1905                 }
1906         }
1907         if (another_host) {
1908                 DBGMSG("delete entry from list -> success");
1909                 list_del(&addr->addr_list);
1910                 vfree(addr->addr_space_buffer);
1911                 kfree(addr);
1912                 free_pending_request(req);      /* immediate success or fail */
1913                 spin_unlock_irqrestore(&host_info_lock, flags);
1914                 return sizeof(struct raw1394_request);
1915         }
1916         retval =
1917             hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
1918                                       addr->start);
1919         if (!retval) {
1920                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1921                 spin_unlock_irqrestore(&host_info_lock, flags);
1922                 return (-EINVAL);
1923         }
1924         DBGMSG("delete entry from list -> success");
1925         list_del(&addr->addr_list);
1926         spin_unlock_irqrestore(&host_info_lock, flags);
1927         vfree(addr->addr_space_buffer);
1928         kfree(addr);
1929         free_pending_request(req);      /* immediate success or fail */
1930         return sizeof(struct raw1394_request);
1931 }
1932
1933 /* Copy data from ARM buffer(s) to user buffer. */
1934 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1935 {
1936         struct arm_addr *arm_addr = NULL;
1937         unsigned long flags;
1938         unsigned long offset;
1939
1940         struct list_head *entry;
1941
1942         DBGMSG("arm_get_buf "
1943                "addr(Offset): %04X %08X length: %u",
1944                (u32) ((req->req.address >> 32) & 0xFFFF),
1945                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1946
1947         spin_lock_irqsave(&host_info_lock, flags);
1948         entry = fi->addr_list.next;
1949         while (entry != &(fi->addr_list)) {
1950                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1951                 if ((arm_addr->start <= req->req.address) &&
1952                     (arm_addr->end > req->req.address)) {
1953                         if (req->req.address + req->req.length <= arm_addr->end) {
1954                                 offset = req->req.address - arm_addr->start;
1955
1956                                 DBGMSG
1957                                     ("arm_get_buf copy_to_user( %08X, %p, %u )",
1958                                      (u32) req->req.recvb,
1959                                      arm_addr->addr_space_buffer + offset,
1960                                      (u32) req->req.length);
1961
1962                                 if (copy_to_user
1963                                     (int2ptr(req->req.recvb),
1964                                      arm_addr->addr_space_buffer + offset,
1965                                      req->req.length)) {
1966                                         spin_unlock_irqrestore(&host_info_lock,
1967                                                                flags);
1968                                         return (-EFAULT);
1969                                 }
1970
1971                                 spin_unlock_irqrestore(&host_info_lock, flags);
1972                                 /* We have to free the request, because we
1973                                  * queue no response, and therefore nobody
1974                                  * will free it. */
1975                                 free_pending_request(req);
1976                                 return sizeof(struct raw1394_request);
1977                         } else {
1978                                 DBGMSG("arm_get_buf request exceeded mapping");
1979                                 spin_unlock_irqrestore(&host_info_lock, flags);
1980                                 return (-EINVAL);
1981                         }
1982                 }
1983                 entry = entry->next;
1984         }
1985         spin_unlock_irqrestore(&host_info_lock, flags);
1986         return (-EINVAL);
1987 }
1988
1989 /* Copy data from user buffer to ARM buffer(s). */
1990 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
1991 {
1992         struct arm_addr *arm_addr = NULL;
1993         unsigned long flags;
1994         unsigned long offset;
1995
1996         struct list_head *entry;
1997
1998         DBGMSG("arm_set_buf "
1999                "addr(Offset): %04X %08X length: %u",
2000                (u32) ((req->req.address >> 32) & 0xFFFF),
2001                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
2002
2003         spin_lock_irqsave(&host_info_lock, flags);
2004         entry = fi->addr_list.next;
2005         while (entry != &(fi->addr_list)) {
2006                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
2007                 if ((arm_addr->start <= req->req.address) &&
2008                     (arm_addr->end > req->req.address)) {
2009                         if (req->req.address + req->req.length <= arm_addr->end) {
2010                                 offset = req->req.address - arm_addr->start;
2011
2012                                 DBGMSG
2013                                     ("arm_set_buf copy_from_user( %p, %08X, %u )",
2014                                      arm_addr->addr_space_buffer + offset,
2015                                      (u32) req->req.sendb,
2016                                      (u32) req->req.length);
2017
2018                                 if (copy_from_user
2019                                     (arm_addr->addr_space_buffer + offset,
2020                                      int2ptr(req->req.sendb),
2021                                      req->req.length)) {
2022                                         spin_unlock_irqrestore(&host_info_lock,
2023                                                                flags);
2024                                         return (-EFAULT);
2025                                 }
2026
2027                                 spin_unlock_irqrestore(&host_info_lock, flags);
2028                                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2029                                 return sizeof(struct raw1394_request);
2030                         } else {
2031                                 DBGMSG("arm_set_buf request exceeded mapping");
2032                                 spin_unlock_irqrestore(&host_info_lock, flags);
2033                                 return (-EINVAL);
2034                         }
2035                 }
2036                 entry = entry->next;
2037         }
2038         spin_unlock_irqrestore(&host_info_lock, flags);
2039         return (-EINVAL);
2040 }
2041
2042 static int reset_notification(struct file_info *fi, struct pending_request *req)
2043 {
2044         DBGMSG("reset_notification called - switch %s ",
2045                (req->req.misc == RAW1394_NOTIFY_OFF) ? "OFF" : "ON");
2046         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
2047             (req->req.misc == RAW1394_NOTIFY_ON)) {
2048                 fi->notification = (u8) req->req.misc;
2049                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2050                 return sizeof(struct raw1394_request);
2051         }
2052         /* error EINVAL (22) invalid argument */
2053         return (-EINVAL);
2054 }
2055
2056 static int write_phypacket(struct file_info *fi, struct pending_request *req)
2057 {
2058         struct hpsb_packet *packet = NULL;
2059         int retval = 0;
2060         quadlet_t data;
2061         unsigned long flags;
2062
2063         data = be32_to_cpu((u32) req->req.sendb);
2064         DBGMSG("write_phypacket called - quadlet 0x%8.8x ", data);
2065         packet = hpsb_make_phypacket(fi->host, data);
2066         if (!packet)
2067                 return -ENOMEM;
2068         req->req.length = 0;
2069         req->packet = packet;
2070         hpsb_set_packet_complete_task(packet,
2071                                       (void (*)(void *))queue_complete_cb, req);
2072         spin_lock_irqsave(&fi->reqlists_lock, flags);
2073         list_add_tail(&req->list, &fi->req_pending);
2074         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2075         packet->generation = req->req.generation;
2076         retval = hpsb_send_packet(packet);
2077         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
2078         if (retval < 0) {
2079                 req->req.error = RAW1394_ERROR_SEND_ERROR;
2080                 req->req.length = 0;
2081                 queue_complete_req(req);
2082         }
2083         return sizeof(struct raw1394_request);
2084 }
2085
2086 static int get_config_rom(struct file_info *fi, struct pending_request *req)
2087 {
2088         int ret = sizeof(struct raw1394_request);
2089         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2090         int status;
2091
2092         if (!data)
2093                 return -ENOMEM;
2094
2095         status =
2096             csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
2097                          data, req->req.length);
2098         if (copy_to_user(int2ptr(req->req.recvb), data, req->req.length))
2099                 ret = -EFAULT;
2100         if (copy_to_user
2101             (int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
2102              sizeof(fi->host->csr.rom->cache_head->len)))
2103                 ret = -EFAULT;
2104         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
2105                          sizeof(fi->host->csr.generation)))
2106                 ret = -EFAULT;
2107         if (copy_to_user(int2ptr(req->req.sendb), &status, sizeof(status)))
2108                 ret = -EFAULT;
2109         kfree(data);
2110         if (ret >= 0) {
2111                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2112         }
2113         return ret;
2114 }
2115
2116 static int update_config_rom(struct file_info *fi, struct pending_request *req)
2117 {
2118         int ret = sizeof(struct raw1394_request);
2119         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2120         if (!data)
2121                 return -ENOMEM;
2122         if (copy_from_user(data, int2ptr(req->req.sendb), req->req.length)) {
2123                 ret = -EFAULT;
2124         } else {
2125                 int status = hpsb_update_config_rom(fi->host,
2126                                                     data, req->req.length,
2127                                                     (unsigned char)req->req.
2128                                                     misc);
2129                 if (copy_to_user
2130                     (int2ptr(req->req.recvb), &status, sizeof(status)))
2131                         ret = -ENOMEM;
2132         }
2133         kfree(data);
2134         if (ret >= 0) {
2135                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2136                 fi->cfgrom_upd = 1;
2137         }
2138         return ret;
2139 }
2140
2141 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
2142 {
2143         struct csr1212_keyval *kv;
2144         struct csr1212_csr_rom_cache *cache;
2145         struct csr1212_dentry *dentry;
2146         u32 dr;
2147         int ret = 0;
2148
2149         if (req->req.misc == ~0) {
2150                 if (req->req.length == 0)
2151                         return -EINVAL;
2152
2153                 /* Find an unused slot */
2154                 for (dr = 0;
2155                      dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr];
2156                      dr++) ;
2157
2158                 if (dr == RAW1394_MAX_USER_CSR_DIRS)
2159                         return -ENOMEM;
2160
2161                 fi->csr1212_dirs[dr] =
2162                     csr1212_new_directory(CSR1212_KV_ID_VENDOR);
2163                 if (!fi->csr1212_dirs[dr])
2164                         return -ENOMEM;
2165         } else {
2166                 dr = req->req.misc;
2167                 if (!fi->csr1212_dirs[dr])
2168                         return -EINVAL;
2169
2170                 /* Delete old stuff */
2171                 for (dentry =
2172                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2173                      dentry; dentry = dentry->next) {
2174                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2175                                                              root_kv,
2176                                                              dentry->kv);
2177                 }
2178
2179                 if (req->req.length == 0) {
2180                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
2181                         fi->csr1212_dirs[dr] = NULL;
2182
2183                         hpsb_update_config_rom_image(fi->host);
2184                         free_pending_request(req);
2185                         return sizeof(struct raw1394_request);
2186                 }
2187         }
2188
2189         cache = csr1212_rom_cache_malloc(0, req->req.length);
2190         if (!cache) {
2191                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2192                 fi->csr1212_dirs[dr] = NULL;
2193                 return -ENOMEM;
2194         }
2195
2196         cache->filled_head = kmalloc(sizeof(*cache->filled_head), GFP_KERNEL);
2197         if (!cache->filled_head) {
2198                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2199                 fi->csr1212_dirs[dr] = NULL;
2200                 CSR1212_FREE(cache);
2201                 return -ENOMEM;
2202         }
2203         cache->filled_tail = cache->filled_head;
2204
2205         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
2206                            req->req.length)) {
2207                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2208                 fi->csr1212_dirs[dr] = NULL;
2209                 ret = -EFAULT;
2210         } else {
2211                 cache->len = req->req.length;
2212                 cache->filled_head->offset_start = 0;
2213                 cache->filled_head->offset_end = cache->size - 1;
2214
2215                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2216
2217                 ret = CSR1212_SUCCESS;
2218                 /* parse all the items */
2219                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2220                      kv = kv->next) {
2221                         ret = csr1212_parse_keyval(kv, cache);
2222                 }
2223
2224                 /* attach top level items to the root directory */
2225                 for (dentry =
2226                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2227                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2228                         ret =
2229                             csr1212_attach_keyval_to_directory(fi->host->csr.
2230                                                                rom->root_kv,
2231                                                                dentry->kv);
2232                 }
2233
2234                 if (ret == CSR1212_SUCCESS) {
2235                         ret = hpsb_update_config_rom_image(fi->host);
2236
2237                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2238                                                      &dr, sizeof(dr))) {
2239                                 ret = -ENOMEM;
2240                         }
2241                 }
2242         }
2243         kfree(cache->filled_head);
2244         CSR1212_FREE(cache);
2245
2246         if (ret >= 0) {
2247                 /* we have to free the request, because we queue no response,
2248                  * and therefore nobody will free it */
2249                 free_pending_request(req);
2250                 return sizeof(struct raw1394_request);
2251         } else {
2252                 for (dentry =
2253                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2254                      dentry; dentry = dentry->next) {
2255                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2256                                                              root_kv,
2257                                                              dentry->kv);
2258                 }
2259                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2260                 fi->csr1212_dirs[dr] = NULL;
2261                 return ret;
2262         }
2263 }
2264
2265 static int state_connected(struct file_info *fi, struct pending_request *req)
2266 {
2267         int node = req->req.address >> 48;
2268
2269         req->req.error = RAW1394_ERROR_NONE;
2270
2271         switch (req->req.type) {
2272
2273         case RAW1394_REQ_ECHO:
2274                 queue_complete_req(req);
2275                 return sizeof(struct raw1394_request);
2276
2277         case RAW1394_REQ_ISO_SEND:
2278                 return handle_iso_send(fi, req, node);
2279
2280         case RAW1394_REQ_ARM_REGISTER:
2281                 return arm_register(fi, req);
2282
2283         case RAW1394_REQ_ARM_UNREGISTER:
2284                 return arm_unregister(fi, req);
2285
2286         case RAW1394_REQ_ARM_SET_BUF:
2287                 return arm_set_buf(fi, req);
2288
2289         case RAW1394_REQ_ARM_GET_BUF:
2290                 return arm_get_buf(fi, req);
2291
2292         case RAW1394_REQ_RESET_NOTIFY:
2293                 return reset_notification(fi, req);
2294
2295         case RAW1394_REQ_ISO_LISTEN:
2296                 handle_iso_listen(fi, req);
2297                 return sizeof(struct raw1394_request);
2298
2299         case RAW1394_REQ_FCP_LISTEN:
2300                 handle_fcp_listen(fi, req);
2301                 return sizeof(struct raw1394_request);
2302
2303         case RAW1394_REQ_RESET_BUS:
2304                 if (req->req.misc == RAW1394_LONG_RESET) {
2305                         DBGMSG("busreset called (type: LONG)");
2306                         hpsb_reset_bus(fi->host, LONG_RESET);
2307                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2308                         return sizeof(struct raw1394_request);
2309                 }
2310                 if (req->req.misc == RAW1394_SHORT_RESET) {
2311                         DBGMSG("busreset called (type: SHORT)");
2312                         hpsb_reset_bus(fi->host, SHORT_RESET);
2313                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2314                         return sizeof(struct raw1394_request);
2315                 }
2316                 /* error EINVAL (22) invalid argument */
2317                 return (-EINVAL);
2318         case RAW1394_REQ_GET_ROM:
2319                 return get_config_rom(fi, req);
2320
2321         case RAW1394_REQ_UPDATE_ROM:
2322                 return update_config_rom(fi, req);
2323
2324         case RAW1394_REQ_MODIFY_ROM:
2325                 return modify_config_rom(fi, req);
2326         }
2327
2328         if (req->req.generation != get_hpsb_generation(fi->host)) {
2329                 req->req.error = RAW1394_ERROR_GENERATION;
2330                 req->req.generation = get_hpsb_generation(fi->host);
2331                 req->req.length = 0;
2332                 queue_complete_req(req);
2333                 return sizeof(struct raw1394_request);
2334         }
2335
2336         switch (req->req.type) {
2337         case RAW1394_REQ_PHYPACKET:
2338                 return write_phypacket(fi, req);
2339         case RAW1394_REQ_ASYNC_SEND:
2340                 return handle_async_send(fi, req);
2341         }
2342
2343         if (req->req.length == 0) {
2344                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2345                 queue_complete_req(req);
2346                 return sizeof(struct raw1394_request);
2347         }
2348
2349         return handle_async_request(fi, req, node);
2350 }
2351
2352
2353 static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2354                              size_t count, loff_t * offset_is_ignored)
2355 {
2356         struct file_info *fi = (struct file_info *)file->private_data;
2357         struct pending_request *req;
2358         ssize_t retval = 0;
2359
2360 #ifdef CONFIG_COMPAT
2361         if (count == sizeof(struct compat_raw1394_req) && 
2362                 sizeof(struct compat_raw1394_req) != 
2363                         sizeof(struct raw1394_request)) { 
2364                 buffer = raw1394_compat_write(buffer);
2365                 if (IS_ERR(buffer))
2366                         return PTR_ERR(buffer);
2367         } else
2368 #endif
2369         if (count != sizeof(struct raw1394_request)) {
2370                 return -EINVAL;
2371         }
2372
2373         req = alloc_pending_request();
2374         if (req == NULL) {
2375                 return -ENOMEM;
2376         }
2377         req->file_info = fi;
2378
2379         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2380                 free_pending_request(req);
2381                 return -EFAULT;
2382         }
2383
2384         switch (fi->state) {
2385         case opened:
2386                 retval = state_opened(fi, req);
2387                 break;
2388
2389         case initialized:
2390                 retval = state_initialized(fi, req);
2391                 break;
2392
2393         case connected:
2394                 retval = state_connected(fi, req);
2395                 break;
2396         }
2397
2398         if (retval < 0) {
2399                 free_pending_request(req);
2400         }
2401
2402         return retval;
2403 }
2404
2405 /* rawiso operations */
2406
2407 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2408  * completion queue (reqlists_lock must be taken) */
2409 static inline int __rawiso_event_in_queue(struct file_info *fi)
2410 {
2411         struct pending_request *req;
2412
2413         list_for_each_entry(req, &fi->req_complete, list)
2414             if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2415                 return 1;
2416
2417         return 0;
2418 }
2419
2420 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2421 static void queue_rawiso_event(struct file_info *fi)
2422 {
2423         unsigned long flags;
2424
2425         spin_lock_irqsave(&fi->reqlists_lock, flags);
2426
2427         /* only one ISO activity event may be in the queue */
2428         if (!__rawiso_event_in_queue(fi)) {
2429                 struct pending_request *req =
2430                     __alloc_pending_request(SLAB_ATOMIC);
2431
2432                 if (req) {
2433                         req->file_info = fi;
2434                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2435                         req->req.generation = get_hpsb_generation(fi->host);
2436                         __queue_complete_req(req);
2437                 } else {
2438                         /* on allocation failure, signal an overflow */
2439                         if (fi->iso_handle) {
2440                                 atomic_inc(&fi->iso_handle->overflows);
2441                         }
2442                 }
2443         }
2444         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2445 }
2446
2447 static void rawiso_activity_cb(struct hpsb_iso *iso)
2448 {
2449         unsigned long flags;
2450         struct host_info *hi;
2451         struct file_info *fi;
2452
2453         spin_lock_irqsave(&host_info_lock, flags);
2454         hi = find_host_info(iso->host);
2455
2456         if (hi != NULL) {
2457                 list_for_each_entry(fi, &hi->file_info_list, list) {
2458                         if (fi->iso_handle == iso)
2459                                 queue_rawiso_event(fi);
2460                 }
2461         }
2462
2463         spin_unlock_irqrestore(&host_info_lock, flags);
2464 }
2465
2466 /* helper function - gather all the kernel iso status bits for returning to user-space */
2467 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
2468                                     struct raw1394_iso_status *stat)
2469 {
2470         stat->config.data_buf_size = iso->buf_size;
2471         stat->config.buf_packets = iso->buf_packets;
2472         stat->config.channel = iso->channel;
2473         stat->config.speed = iso->speed;
2474         stat->config.irq_interval = iso->irq_interval;
2475         stat->n_packets = hpsb_iso_n_ready(iso);
2476         stat->overflows = atomic_read(&iso->overflows);
2477         stat->xmit_cycle = iso->xmit_cycle;
2478 }
2479
2480 static int raw1394_iso_xmit_init(struct file_info *fi, void __user * uaddr)
2481 {
2482         struct raw1394_iso_status stat;
2483
2484         if (!fi->host)
2485                 return -EINVAL;
2486
2487         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2488                 return -EFAULT;
2489
2490         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2491                                             stat.config.data_buf_size,
2492                                             stat.config.buf_packets,
2493                                             stat.config.channel,
2494                                             stat.config.speed,
2495                                             stat.config.irq_interval,
2496                                             rawiso_activity_cb);
2497         if (!fi->iso_handle)
2498                 return -ENOMEM;
2499
2500         fi->iso_state = RAW1394_ISO_XMIT;
2501
2502         raw1394_iso_fill_status(fi->iso_handle, &stat);
2503         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2504                 return -EFAULT;
2505
2506         /* queue an event to get things started */
2507         rawiso_activity_cb(fi->iso_handle);
2508
2509         return 0;
2510 }
2511
2512 static int raw1394_iso_recv_init(struct file_info *fi, void __user * uaddr)
2513 {
2514         struct raw1394_iso_status stat;
2515
2516         if (!fi->host)
2517                 return -EINVAL;
2518
2519         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2520                 return -EFAULT;
2521
2522         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2523                                             stat.config.data_buf_size,
2524                                             stat.config.buf_packets,
2525                                             stat.config.channel,
2526                                             stat.config.dma_mode,
2527                                             stat.config.irq_interval,
2528                                             rawiso_activity_cb);
2529         if (!fi->iso_handle)
2530                 return -ENOMEM;
2531
2532         fi->iso_state = RAW1394_ISO_RECV;
2533
2534         raw1394_iso_fill_status(fi->iso_handle, &stat);
2535         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2536                 return -EFAULT;
2537         return 0;
2538 }
2539
2540 static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
2541 {
2542         struct raw1394_iso_status stat;
2543         struct hpsb_iso *iso = fi->iso_handle;
2544
2545         raw1394_iso_fill_status(fi->iso_handle, &stat);
2546         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2547                 return -EFAULT;
2548
2549         /* reset overflow counter */
2550         atomic_set(&iso->overflows, 0);
2551
2552         return 0;
2553 }
2554
2555 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2556 static int raw1394_iso_recv_packets(struct file_info *fi, void __user * uaddr)
2557 {
2558         struct raw1394_iso_packets upackets;
2559         unsigned int packet = fi->iso_handle->first_packet;
2560         int i;
2561
2562         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2563                 return -EFAULT;
2564
2565         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2566                 return -EINVAL;
2567
2568         /* ensure user-supplied buffer is accessible and big enough */
2569         if (!access_ok(VERIFY_WRITE, upackets.infos,
2570                        upackets.n_packets *
2571                        sizeof(struct raw1394_iso_packet_info)))
2572                 return -EFAULT;
2573
2574         /* copy the packet_infos out */
2575         for (i = 0; i < upackets.n_packets; i++) {
2576                 if (__copy_to_user(&upackets.infos[i],
2577                                    &fi->iso_handle->infos[packet],
2578                                    sizeof(struct raw1394_iso_packet_info)))
2579                         return -EFAULT;
2580
2581                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2582         }
2583
2584         return 0;
2585 }
2586
2587 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2588 static int raw1394_iso_send_packets(struct file_info *fi, void __user * uaddr)
2589 {
2590         struct raw1394_iso_packets upackets;
2591         int i, rv;
2592
2593         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2594                 return -EFAULT;
2595
2596         if (upackets.n_packets >= fi->iso_handle->buf_packets)
2597                 return -EINVAL;
2598
2599         if (upackets.n_packets >= hpsb_iso_n_ready(fi->iso_handle))
2600                 return -EAGAIN;
2601
2602         /* ensure user-supplied buffer is accessible and big enough */
2603         if (!access_ok(VERIFY_READ, upackets.infos,
2604                        upackets.n_packets *
2605                        sizeof(struct raw1394_iso_packet_info)))
2606                 return -EFAULT;
2607
2608         /* copy the infos structs in and queue the packets */
2609         for (i = 0; i < upackets.n_packets; i++) {
2610                 struct raw1394_iso_packet_info info;
2611
2612                 if (__copy_from_user(&info, &upackets.infos[i],
2613                                      sizeof(struct raw1394_iso_packet_info)))
2614                         return -EFAULT;
2615
2616                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2617                                                 info.len, info.tag, info.sy);
2618                 if (rv)
2619                         return rv;
2620         }
2621
2622         return 0;
2623 }
2624
2625 static void raw1394_iso_shutdown(struct file_info *fi)
2626 {
2627         if (fi->iso_handle)
2628                 hpsb_iso_shutdown(fi->iso_handle);
2629
2630         fi->iso_handle = NULL;
2631         fi->iso_state = RAW1394_ISO_INACTIVE;
2632 }
2633
2634 /* mmap the rawiso xmit/recv buffer */
2635 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2636 {
2637         struct file_info *fi = file->private_data;
2638
2639         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2640                 return -EINVAL;
2641
2642         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2643 }
2644
2645 /* ioctl is only used for rawiso operations */
2646 static int raw1394_ioctl(struct inode *inode, struct file *file,
2647                          unsigned int cmd, unsigned long arg)
2648 {
2649         struct file_info *fi = file->private_data;
2650         void __user *argp = (void __user *)arg;
2651
2652         switch (fi->iso_state) {
2653         case RAW1394_ISO_INACTIVE:
2654                 switch (cmd) {
2655                 case RAW1394_IOC_ISO_XMIT_INIT:
2656                         return raw1394_iso_xmit_init(fi, argp);
2657                 case RAW1394_IOC_ISO_RECV_INIT:
2658                         return raw1394_iso_recv_init(fi, argp);
2659                 default:
2660                         break;
2661                 }
2662                 break;
2663         case RAW1394_ISO_RECV:
2664                 switch (cmd) {
2665                 case RAW1394_IOC_ISO_RECV_START:{
2666                                 /* copy args from user-space */
2667                                 int args[3];
2668                                 if (copy_from_user
2669                                     (&args[0], argp, sizeof(args)))
2670                                         return -EFAULT;
2671                                 return hpsb_iso_recv_start(fi->iso_handle,
2672                                                            args[0], args[1],
2673                                                            args[2]);
2674                         }
2675                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2676                         hpsb_iso_stop(fi->iso_handle);
2677                         return 0;
2678                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2679                         return hpsb_iso_recv_listen_channel(fi->iso_handle,
2680                                                             arg);
2681                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2682                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle,
2683                                                               arg);
2684                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:{
2685                                 /* copy the u64 from user-space */
2686                                 u64 mask;
2687                                 if (copy_from_user(&mask, argp, sizeof(mask)))
2688                                         return -EFAULT;
2689                                 return hpsb_iso_recv_set_channel_mask(fi->
2690                                                                       iso_handle,
2691                                                                       mask);
2692                         }
2693                 case RAW1394_IOC_ISO_GET_STATUS:
2694                         return raw1394_iso_get_status(fi, argp);
2695                 case RAW1394_IOC_ISO_RECV_PACKETS:
2696                         return raw1394_iso_recv_packets(fi, argp);
2697                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2698                         return hpsb_iso_recv_release_packets(fi->iso_handle,
2699                                                              arg);
2700                 case RAW1394_IOC_ISO_RECV_FLUSH:
2701                         return hpsb_iso_recv_flush(fi->iso_handle);
2702                 case RAW1394_IOC_ISO_SHUTDOWN:
2703                         raw1394_iso_shutdown(fi);
2704                         return 0;
2705                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2706                         queue_rawiso_event(fi);
2707                         return 0;
2708                 }
2709                 break;
2710         case RAW1394_ISO_XMIT:
2711                 switch (cmd) {
2712                 case RAW1394_IOC_ISO_XMIT_START:{
2713                                 /* copy two ints from user-space */
2714                                 int args[2];
2715                                 if (copy_from_user
2716                                     (&args[0], argp, sizeof(args)))
2717                                         return -EFAULT;
2718                                 return hpsb_iso_xmit_start(fi->iso_handle,
2719                                                            args[0], args[1]);
2720                         }
2721                 case RAW1394_IOC_ISO_XMIT_SYNC:
2722                         return hpsb_iso_xmit_sync(fi->iso_handle);
2723                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2724                         hpsb_iso_stop(fi->iso_handle);
2725                         return 0;
2726                 case RAW1394_IOC_ISO_GET_STATUS:
2727                         return raw1394_iso_get_status(fi, argp);
2728                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2729                         return raw1394_iso_send_packets(fi, argp);
2730                 case RAW1394_IOC_ISO_SHUTDOWN:
2731                         raw1394_iso_shutdown(fi);
2732                         return 0;
2733                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2734                         queue_rawiso_event(fi);
2735                         return 0;
2736                 }
2737                 break;
2738         default:
2739                 break;
2740         }
2741
2742         return -EINVAL;
2743 }
2744
2745 static unsigned int raw1394_poll(struct file *file, poll_table * pt)
2746 {
2747         struct file_info *fi = file->private_data;
2748         unsigned int mask = POLLOUT | POLLWRNORM;
2749         unsigned long flags;
2750
2751         poll_wait(file, &fi->poll_wait_complete, pt);
2752
2753         spin_lock_irqsave(&fi->reqlists_lock, flags);
2754         if (!list_empty(&fi->req_complete)) {
2755                 mask |= POLLIN | POLLRDNORM;
2756         }
2757         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2758
2759         return mask;
2760 }
2761
2762 static int raw1394_open(struct inode *inode, struct file *file)
2763 {
2764         struct file_info *fi;
2765
2766         fi = kzalloc(sizeof(*fi), SLAB_KERNEL);
2767         if (!fi)
2768                 return -ENOMEM;
2769
2770         fi->notification = (u8) RAW1394_NOTIFY_ON;      /* busreset notification */
2771
2772         INIT_LIST_HEAD(&fi->list);
2773         fi->state = opened;
2774         INIT_LIST_HEAD(&fi->req_pending);
2775         INIT_LIST_HEAD(&fi->req_complete);
2776         sema_init(&fi->complete_sem, 0);
2777         spin_lock_init(&fi->reqlists_lock);
2778         init_waitqueue_head(&fi->poll_wait_complete);
2779         INIT_LIST_HEAD(&fi->addr_list);
2780
2781         file->private_data = fi;
2782
2783         return 0;
2784 }
2785
2786 static int raw1394_release(struct inode *inode, struct file *file)
2787 {
2788         struct file_info *fi = file->private_data;
2789         struct list_head *lh;
2790         struct pending_request *req;
2791         int done = 0, i, fail = 0;
2792         int retval = 0;
2793         struct list_head *entry;
2794         struct arm_addr *addr = NULL;
2795         struct host_info *hi;
2796         struct file_info *fi_hlp = NULL;
2797         struct arm_addr *arm_addr = NULL;
2798         int another_host;
2799         int csr_mod = 0;
2800         unsigned long flags;
2801
2802         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2803                 raw1394_iso_shutdown(fi);
2804
2805         for (i = 0; i < 64; i++) {
2806                 if (fi->listen_channels & (1ULL << i)) {
2807                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2808                 }
2809         }
2810
2811         spin_lock_irqsave(&host_info_lock, flags);
2812         fi->listen_channels = 0;
2813
2814         fail = 0;
2815         /* set address-entries invalid */
2816
2817         while (!list_empty(&fi->addr_list)) {
2818                 another_host = 0;
2819                 lh = fi->addr_list.next;
2820                 addr = list_entry(lh, struct arm_addr, addr_list);
2821                 /* another host with valid address-entry containing
2822                    same addressrange? */
2823                 list_for_each_entry(hi, &host_info_list, list) {
2824                         if (hi->host != fi->host) {
2825                                 list_for_each_entry(fi_hlp, &hi->file_info_list,
2826                                                     list) {
2827                                         entry = fi_hlp->addr_list.next;
2828                                         while (entry != &(fi_hlp->addr_list)) {
2829                                                 arm_addr = list_entry(entry, struct
2830                                                                       arm_addr,
2831                                                                       addr_list);
2832                                                 if (arm_addr->start ==
2833                                                     addr->start) {
2834                                                         DBGMSG
2835                                                             ("raw1394_release: "
2836                                                              "another host ownes "
2837                                                              "same addressrange");
2838                                                         another_host = 1;
2839                                                         break;
2840                                                 }
2841                                                 entry = entry->next;
2842                                         }
2843                                         if (another_host) {
2844                                                 break;
2845                                         }
2846                                 }
2847                         }
2848                 }
2849                 if (!another_host) {
2850                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
2851                         retval =
2852                             hpsb_unregister_addrspace(&raw1394_highlevel,
2853                                                       fi->host, addr->start);
2854                         if (!retval) {
2855                                 ++fail;
2856                                 printk(KERN_ERR
2857                                        "raw1394_release arm_Unregister failed\n");
2858                         }
2859                 }
2860                 DBGMSG("raw1394_release: delete addr_entry from list");
2861                 list_del(&addr->addr_list);
2862                 vfree(addr->addr_space_buffer);
2863                 kfree(addr);
2864         }                       /* while */
2865         spin_unlock_irqrestore(&host_info_lock, flags);
2866         if (fail > 0) {
2867                 printk(KERN_ERR "raw1394: during addr_list-release "
2868                        "error(s) occurred \n");
2869         }
2870
2871         while (!done) {
2872                 spin_lock_irqsave(&fi->reqlists_lock, flags);
2873
2874                 while (!list_empty(&fi->req_complete)) {
2875                         lh = fi->req_complete.next;
2876                         list_del(lh);
2877
2878                         req = list_entry(lh, struct pending_request, list);
2879
2880                         free_pending_request(req);
2881                 }
2882
2883                 if (list_empty(&fi->req_pending))
2884                         done = 1;
2885
2886                 spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2887
2888                 if (!done)
2889                         down_interruptible(&fi->complete_sem);
2890         }
2891
2892         /* Remove any sub-trees left by user space programs */
2893         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
2894                 struct csr1212_dentry *dentry;
2895                 if (!fi->csr1212_dirs[i])
2896                         continue;
2897                 for (dentry =
2898                      fi->csr1212_dirs[i]->value.directory.dentries_head; dentry;
2899                      dentry = dentry->next) {
2900                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2901                                                              root_kv,
2902                                                              dentry->kv);
2903                 }
2904                 csr1212_release_keyval(fi->csr1212_dirs[i]);
2905                 fi->csr1212_dirs[i] = NULL;
2906                 csr_mod = 1;
2907         }
2908
2909         if ((csr_mod || fi->cfgrom_upd)
2910             && hpsb_update_config_rom_image(fi->host) < 0)
2911                 HPSB_ERR
2912                     ("Failed to generate Configuration ROM image for host %d",
2913                      fi->host->id);
2914
2915         if (fi->state == connected) {
2916                 spin_lock_irqsave(&host_info_lock, flags);
2917                 list_del(&fi->list);
2918                 spin_unlock_irqrestore(&host_info_lock, flags);
2919
2920                 put_device(&fi->host->device);
2921         }
2922
2923         kfree(fi);
2924
2925         return 0;
2926 }
2927
2928 /*** HOTPLUG STUFF **********************************************************/
2929 /*
2930  * Export information about protocols/devices supported by this driver.
2931  */
2932 static struct ieee1394_device_id raw1394_id_table[] = {
2933         {
2934          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2935          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
2936          .version = AVC_SW_VERSION_ENTRY & 0xffffff},
2937         {
2938          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2939          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2940          .version = CAMERA_SW_VERSION_ENTRY & 0xffffff},
2941         {
2942          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2943          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2944          .version = (CAMERA_SW_VERSION_ENTRY + 1) & 0xffffff},
2945         {
2946          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2947          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2948          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
2949         {}
2950 };
2951
2952 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
2953
2954 static struct hpsb_protocol_driver raw1394_driver = {
2955         .name = "raw1394 Driver",
2956         .id_table = raw1394_id_table,
2957         .driver = {
2958                    .name = "raw1394",
2959                    .bus = &ieee1394_bus_type,
2960                    },
2961 };
2962
2963 /******************************************************************************/
2964
2965 static struct hpsb_highlevel raw1394_highlevel = {
2966         .name = RAW1394_DEVICE_NAME,
2967         .add_host = add_host,
2968         .remove_host = remove_host,
2969         .host_reset = host_reset,
2970         .iso_receive = iso_receive,
2971         .fcp_request = fcp_request,
2972 };
2973
2974 static struct cdev raw1394_cdev;
2975 static struct file_operations raw1394_fops = {
2976         .owner = THIS_MODULE,
2977         .read = raw1394_read,
2978         .write = raw1394_write,
2979         .mmap = raw1394_mmap,
2980         .ioctl = raw1394_ioctl,
2981         // .compat_ioctl = ... someone needs to do this
2982         .poll = raw1394_poll,
2983         .open = raw1394_open,
2984         .release = raw1394_release,
2985 };
2986
2987 static int __init init_raw1394(void)
2988 {
2989         int ret = 0;
2990
2991         hpsb_register_highlevel(&raw1394_highlevel);
2992
2993         if (IS_ERR
2994             (class_device_create
2995              (hpsb_protocol_class, NULL,
2996               MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16), NULL,
2997               RAW1394_DEVICE_NAME))) {
2998                 ret = -EFAULT;
2999                 goto out_unreg;
3000         }
3001
3002         devfs_mk_cdev(MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16),
3003                       S_IFCHR | S_IRUSR | S_IWUSR, RAW1394_DEVICE_NAME);
3004
3005         cdev_init(&raw1394_cdev, &raw1394_fops);
3006         raw1394_cdev.owner = THIS_MODULE;
3007         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
3008         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
3009         if (ret) {
3010                 HPSB_ERR("raw1394 failed to register minor device block");
3011                 goto out_dev;
3012         }
3013
3014         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
3015
3016         ret = hpsb_register_protocol(&raw1394_driver);
3017         if (ret) {
3018                 HPSB_ERR("raw1394: failed to register protocol");
3019                 cdev_del(&raw1394_cdev);
3020                 goto out_dev;
3021         }
3022
3023         goto out;
3024
3025       out_dev:
3026         devfs_remove(RAW1394_DEVICE_NAME);
3027         class_device_destroy(hpsb_protocol_class,
3028                              MKDEV(IEEE1394_MAJOR,
3029                                    IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3030       out_unreg:
3031         hpsb_unregister_highlevel(&raw1394_highlevel);
3032       out:
3033         return ret;
3034 }
3035
3036 static void __exit cleanup_raw1394(void)
3037 {
3038         class_device_destroy(hpsb_protocol_class,
3039                              MKDEV(IEEE1394_MAJOR,
3040                                    IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3041         cdev_del(&raw1394_cdev);
3042         devfs_remove(RAW1394_DEVICE_NAME);
3043         hpsb_unregister_highlevel(&raw1394_highlevel);
3044         hpsb_unregister_protocol(&raw1394_driver);
3045 }
3046
3047 module_init(init_raw1394);
3048 module_exit(cleanup_raw1394);
3049 MODULE_LICENSE("GPL");