/home/lenb/src/to-linus branch 'acpi-2.6.12'
[linux-2.6] / drivers / ieee1394 / raw1394.c
1 /*
2  * IEEE 1394 for Linux
3  *
4  * Raw interface to the bus
5  *
6  * Copyright (C) 1999, 2000 Andreas E. Bombe
7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
9  *
10  * This code is licensed under the GPL.  See the file COPYING in the root
11  * directory of the kernel sources for details.
12  *
13  *
14  * Contributions:
15  *
16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
17  *        configuration ROM manipulation
18  *        address range mapping
19  *        adaptation for new (transparent) loopback mechanism
20  *        sending of arbitrary async packets
21  * Christian Toegel <christian.toegel@gmx.at>
22  *        address range mapping
23  *        lock64 request
24  *        transmit physical packet
25  *        busreset notification control (switch on/off)
26  *        busreset with selection of type (short/long)
27  *        request_reply
28  */
29
30 #include <linux/kernel.h>
31 #include <linux/list.h>
32 #include <linux/string.h>
33 #include <linux/slab.h>
34 #include <linux/fs.h>
35 #include <linux/poll.h>
36 #include <linux/module.h>
37 #include <linux/init.h>
38 #include <linux/smp_lock.h>
39 #include <linux/interrupt.h>
40 #include <linux/vmalloc.h>
41 #include <linux/cdev.h>
42 #include <asm/uaccess.h>
43 #include <asm/atomic.h>
44 #include <linux/devfs_fs_kernel.h>
45
46 #include "csr1212.h"
47 #include "ieee1394.h"
48 #include "ieee1394_types.h"
49 #include "ieee1394_core.h"
50 #include "nodemgr.h"
51 #include "hosts.h"
52 #include "highlevel.h"
53 #include "iso.h"
54 #include "ieee1394_transactions.h"
55 #include "raw1394.h"
56 #include "raw1394-private.h"
57
58 #define int2ptr(x) ((void __user *)(unsigned long)x)
59 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
60
61 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
62 #define RAW1394_DEBUG
63 #endif
64
65 #ifdef RAW1394_DEBUG
66 #define DBGMSG(fmt, args...) \
67 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
68 #else
69 #define DBGMSG(fmt, args...)
70 #endif
71
72 static LIST_HEAD(host_info_list);
73 static int host_count;
74 static DEFINE_SPINLOCK(host_info_lock);
75 static atomic_t internal_generation = ATOMIC_INIT(0);
76
77 static atomic_t iso_buffer_size;
78 static const int iso_buffer_max = 4 * 1024 * 1024;      /* 4 MB */
79
80 static struct hpsb_highlevel raw1394_highlevel;
81
82 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
83                     u64 addr, size_t length, u16 flags);
84 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
85                      quadlet_t * data, u64 addr, size_t length, u16 flags);
86 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
87                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
88                     u16 flags);
89 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
90                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
91                       u16 flags);
92 static struct hpsb_address_ops arm_ops = {
93         .read = arm_read,
94         .write = arm_write,
95         .lock = arm_lock,
96         .lock64 = arm_lock64,
97 };
98
99 static void queue_complete_cb(struct pending_request *req);
100
101 static struct pending_request *__alloc_pending_request(unsigned int __nocast flags)
102 {
103         struct pending_request *req;
104
105         req = (struct pending_request *)kmalloc(sizeof(struct pending_request),
106                                                 flags);
107         if (req != NULL) {
108                 memset(req, 0, sizeof(struct pending_request));
109                 INIT_LIST_HEAD(&req->list);
110         }
111
112         return req;
113 }
114
115 static inline struct pending_request *alloc_pending_request(void)
116 {
117         return __alloc_pending_request(SLAB_KERNEL);
118 }
119
120 static void free_pending_request(struct pending_request *req)
121 {
122         if (req->ibs) {
123                 if (atomic_dec_and_test(&req->ibs->refcount)) {
124                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
125                         kfree(req->ibs);
126                 }
127         } else if (req->free_data) {
128                 kfree(req->data);
129         }
130         hpsb_free_packet(req->packet);
131         kfree(req);
132 }
133
134 /* fi->reqlists_lock must be taken */
135 static void __queue_complete_req(struct pending_request *req)
136 {
137         struct file_info *fi = req->file_info;
138         list_del(&req->list);
139         list_add_tail(&req->list, &fi->req_complete);
140
141         up(&fi->complete_sem);
142         wake_up_interruptible(&fi->poll_wait_complete);
143 }
144
145 static void queue_complete_req(struct pending_request *req)
146 {
147         unsigned long flags;
148         struct file_info *fi = req->file_info;
149
150         spin_lock_irqsave(&fi->reqlists_lock, flags);
151         __queue_complete_req(req);
152         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
153 }
154
155 static void queue_complete_cb(struct pending_request *req)
156 {
157         struct hpsb_packet *packet = req->packet;
158         int rcode = (packet->header[1] >> 12) & 0xf;
159
160         switch (packet->ack_code) {
161         case ACKX_NONE:
162         case ACKX_SEND_ERROR:
163                 req->req.error = RAW1394_ERROR_SEND_ERROR;
164                 break;
165         case ACKX_ABORTED:
166                 req->req.error = RAW1394_ERROR_ABORTED;
167                 break;
168         case ACKX_TIMEOUT:
169                 req->req.error = RAW1394_ERROR_TIMEOUT;
170                 break;
171         default:
172                 req->req.error = (packet->ack_code << 16) | rcode;
173                 break;
174         }
175
176         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
177                 req->req.length = 0;
178         }
179
180         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
181             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
182             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
183             (req->req.type == RAW1394_REQ_LOCK) ||
184             (req->req.type == RAW1394_REQ_LOCK64))
185                 hpsb_free_tlabel(packet);
186
187         queue_complete_req(req);
188 }
189
190 static void add_host(struct hpsb_host *host)
191 {
192         struct host_info *hi;
193         unsigned long flags;
194
195         hi = (struct host_info *)kmalloc(sizeof(struct host_info), GFP_KERNEL);
196
197         if (hi != NULL) {
198                 INIT_LIST_HEAD(&hi->list);
199                 hi->host = host;
200                 INIT_LIST_HEAD(&hi->file_info_list);
201
202                 spin_lock_irqsave(&host_info_lock, flags);
203                 list_add_tail(&hi->list, &host_info_list);
204                 host_count++;
205                 spin_unlock_irqrestore(&host_info_lock, flags);
206         }
207
208         atomic_inc(&internal_generation);
209 }
210
211 static struct host_info *find_host_info(struct hpsb_host *host)
212 {
213         struct host_info *hi;
214
215         list_for_each_entry(hi, &host_info_list, list)
216             if (hi->host == host)
217                 return hi;
218
219         return NULL;
220 }
221
222 static void remove_host(struct hpsb_host *host)
223 {
224         struct host_info *hi;
225         unsigned long flags;
226
227         spin_lock_irqsave(&host_info_lock, flags);
228         hi = find_host_info(host);
229
230         if (hi != NULL) {
231                 list_del(&hi->list);
232                 host_count--;
233                 /*
234                    FIXME: address ranges should be removed
235                    and fileinfo states should be initialized
236                    (including setting generation to
237                    internal-generation ...)
238                  */
239         }
240         spin_unlock_irqrestore(&host_info_lock, flags);
241
242         if (hi == NULL) {
243                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
244                        "0x%p\n", host);
245                 return;
246         }
247
248         kfree(hi);
249
250         atomic_inc(&internal_generation);
251 }
252
253 static void host_reset(struct hpsb_host *host)
254 {
255         unsigned long flags;
256         struct host_info *hi;
257         struct file_info *fi;
258         struct pending_request *req;
259
260         spin_lock_irqsave(&host_info_lock, flags);
261         hi = find_host_info(host);
262
263         if (hi != NULL) {
264                 list_for_each_entry(fi, &hi->file_info_list, list) {
265                         if (fi->notification == RAW1394_NOTIFY_ON) {
266                                 req = __alloc_pending_request(SLAB_ATOMIC);
267
268                                 if (req != NULL) {
269                                         req->file_info = fi;
270                                         req->req.type = RAW1394_REQ_BUS_RESET;
271                                         req->req.generation =
272                                             get_hpsb_generation(host);
273                                         req->req.misc = (host->node_id << 16)
274                                             | host->node_count;
275                                         if (fi->protocol_version > 3) {
276                                                 req->req.misc |=
277                                                     (NODEID_TO_NODE
278                                                      (host->irm_id)
279                                                      << 8);
280                                         }
281
282                                         queue_complete_req(req);
283                                 }
284                         }
285                 }
286         }
287         spin_unlock_irqrestore(&host_info_lock, flags);
288 }
289
290 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t * data,
291                         size_t length)
292 {
293         unsigned long flags;
294         struct host_info *hi;
295         struct file_info *fi;
296         struct pending_request *req, *req_next;
297         struct iso_block_store *ibs = NULL;
298         LIST_HEAD(reqs);
299
300         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
301                 HPSB_INFO("dropped iso packet");
302                 return;
303         }
304
305         spin_lock_irqsave(&host_info_lock, flags);
306         hi = find_host_info(host);
307
308         if (hi != NULL) {
309                 list_for_each_entry(fi, &hi->file_info_list, list) {
310                         if (!(fi->listen_channels & (1ULL << channel)))
311                                 continue;
312
313                         req = __alloc_pending_request(SLAB_ATOMIC);
314                         if (!req)
315                                 break;
316
317                         if (!ibs) {
318                                 ibs = kmalloc(sizeof(struct iso_block_store)
319                                               + length, SLAB_ATOMIC);
320                                 if (!ibs) {
321                                         kfree(req);
322                                         break;
323                                 }
324
325                                 atomic_add(length, &iso_buffer_size);
326                                 atomic_set(&ibs->refcount, 0);
327                                 ibs->data_size = length;
328                                 memcpy(ibs->data, data, length);
329                         }
330
331                         atomic_inc(&ibs->refcount);
332
333                         req->file_info = fi;
334                         req->ibs = ibs;
335                         req->data = ibs->data;
336                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
337                         req->req.generation = get_hpsb_generation(host);
338                         req->req.misc = 0;
339                         req->req.recvb = ptr2int(fi->iso_buffer);
340                         req->req.length = min(length, fi->iso_buffer_length);
341
342                         list_add_tail(&req->list, &reqs);
343                 }
344         }
345         spin_unlock_irqrestore(&host_info_lock, flags);
346
347         list_for_each_entry_safe(req, req_next, &reqs, list)
348             queue_complete_req(req);
349 }
350
351 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
352                         int cts, u8 * data, size_t length)
353 {
354         unsigned long flags;
355         struct host_info *hi;
356         struct file_info *fi;
357         struct pending_request *req, *req_next;
358         struct iso_block_store *ibs = NULL;
359         LIST_HEAD(reqs);
360
361         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
362                 HPSB_INFO("dropped fcp request");
363                 return;
364         }
365
366         spin_lock_irqsave(&host_info_lock, flags);
367         hi = find_host_info(host);
368
369         if (hi != NULL) {
370                 list_for_each_entry(fi, &hi->file_info_list, list) {
371                         if (!fi->fcp_buffer)
372                                 continue;
373
374                         req = __alloc_pending_request(SLAB_ATOMIC);
375                         if (!req)
376                                 break;
377
378                         if (!ibs) {
379                                 ibs = kmalloc(sizeof(struct iso_block_store)
380                                               + length, SLAB_ATOMIC);
381                                 if (!ibs) {
382                                         kfree(req);
383                                         break;
384                                 }
385
386                                 atomic_add(length, &iso_buffer_size);
387                                 atomic_set(&ibs->refcount, 0);
388                                 ibs->data_size = length;
389                                 memcpy(ibs->data, data, length);
390                         }
391
392                         atomic_inc(&ibs->refcount);
393
394                         req->file_info = fi;
395                         req->ibs = ibs;
396                         req->data = ibs->data;
397                         req->req.type = RAW1394_REQ_FCP_REQUEST;
398                         req->req.generation = get_hpsb_generation(host);
399                         req->req.misc = nodeid | (direction << 16);
400                         req->req.recvb = ptr2int(fi->fcp_buffer);
401                         req->req.length = length;
402
403                         list_add_tail(&req->list, &reqs);
404                 }
405         }
406         spin_unlock_irqrestore(&host_info_lock, flags);
407
408         list_for_each_entry_safe(req, req_next, &reqs, list)
409             queue_complete_req(req);
410 }
411
412 static ssize_t raw1394_read(struct file *file, char __user * buffer,
413                             size_t count, loff_t * offset_is_ignored)
414 {
415         struct file_info *fi = (struct file_info *)file->private_data;
416         struct list_head *lh;
417         struct pending_request *req;
418         ssize_t ret;
419
420         if (count != sizeof(struct raw1394_request)) {
421                 return -EINVAL;
422         }
423
424         if (!access_ok(VERIFY_WRITE, buffer, count)) {
425                 return -EFAULT;
426         }
427
428         if (file->f_flags & O_NONBLOCK) {
429                 if (down_trylock(&fi->complete_sem)) {
430                         return -EAGAIN;
431                 }
432         } else {
433                 if (down_interruptible(&fi->complete_sem)) {
434                         return -ERESTARTSYS;
435                 }
436         }
437
438         spin_lock_irq(&fi->reqlists_lock);
439         lh = fi->req_complete.next;
440         list_del(lh);
441         spin_unlock_irq(&fi->reqlists_lock);
442
443         req = list_entry(lh, struct pending_request, list);
444
445         if (req->req.length) {
446                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
447                                  req->req.length)) {
448                         req->req.error = RAW1394_ERROR_MEMFAULT;
449                 }
450         }
451         if (copy_to_user(buffer, &req->req, sizeof(req->req))) {
452                 ret = -EFAULT;
453                 goto out;
454         }
455
456         ret = (ssize_t) sizeof(struct raw1394_request);
457       out:
458         free_pending_request(req);
459         return ret;
460 }
461
462 static int state_opened(struct file_info *fi, struct pending_request *req)
463 {
464         if (req->req.type == RAW1394_REQ_INITIALIZE) {
465                 switch (req->req.misc) {
466                 case RAW1394_KERNELAPI_VERSION:
467                 case 3:
468                         fi->state = initialized;
469                         fi->protocol_version = req->req.misc;
470                         req->req.error = RAW1394_ERROR_NONE;
471                         req->req.generation = atomic_read(&internal_generation);
472                         break;
473
474                 default:
475                         req->req.error = RAW1394_ERROR_COMPAT;
476                         req->req.misc = RAW1394_KERNELAPI_VERSION;
477                 }
478         } else {
479                 req->req.error = RAW1394_ERROR_STATE_ORDER;
480         }
481
482         req->req.length = 0;
483         queue_complete_req(req);
484         return sizeof(struct raw1394_request);
485 }
486
487 static int state_initialized(struct file_info *fi, struct pending_request *req)
488 {
489         struct host_info *hi;
490         struct raw1394_khost_list *khl;
491
492         if (req->req.generation != atomic_read(&internal_generation)) {
493                 req->req.error = RAW1394_ERROR_GENERATION;
494                 req->req.generation = atomic_read(&internal_generation);
495                 req->req.length = 0;
496                 queue_complete_req(req);
497                 return sizeof(struct raw1394_request);
498         }
499
500         switch (req->req.type) {
501         case RAW1394_REQ_LIST_CARDS:
502                 spin_lock_irq(&host_info_lock);
503                 khl = kmalloc(sizeof(struct raw1394_khost_list) * host_count,
504                               SLAB_ATOMIC);
505
506                 if (khl != NULL) {
507                         req->req.misc = host_count;
508                         req->data = (quadlet_t *) khl;
509
510                         list_for_each_entry(hi, &host_info_list, list) {
511                                 khl->nodes = hi->host->node_count;
512                                 strcpy(khl->name, hi->host->driver->name);
513                                 khl++;
514                         }
515                 }
516                 spin_unlock_irq(&host_info_lock);
517
518                 if (khl != NULL) {
519                         req->req.error = RAW1394_ERROR_NONE;
520                         req->req.length = min(req->req.length,
521                                               (u32) (sizeof
522                                                      (struct raw1394_khost_list)
523                                                      * req->req.misc));
524                         req->free_data = 1;
525                 } else {
526                         return -ENOMEM;
527                 }
528                 break;
529
530         case RAW1394_REQ_SET_CARD:
531                 spin_lock_irq(&host_info_lock);
532                 if (req->req.misc < host_count) {
533                         list_for_each_entry(hi, &host_info_list, list) {
534                                 if (!req->req.misc--)
535                                         break;
536                         }
537                         get_device(&hi->host->device);  // XXX Need to handle failure case
538                         list_add_tail(&fi->list, &hi->file_info_list);
539                         fi->host = hi->host;
540                         fi->state = connected;
541
542                         req->req.error = RAW1394_ERROR_NONE;
543                         req->req.generation = get_hpsb_generation(fi->host);
544                         req->req.misc = (fi->host->node_id << 16)
545                             | fi->host->node_count;
546                         if (fi->protocol_version > 3) {
547                                 req->req.misc |=
548                                     NODEID_TO_NODE(fi->host->irm_id) << 8;
549                         }
550                 } else {
551                         req->req.error = RAW1394_ERROR_INVALID_ARG;
552                 }
553                 spin_unlock_irq(&host_info_lock);
554
555                 req->req.length = 0;
556                 break;
557
558         default:
559                 req->req.error = RAW1394_ERROR_STATE_ORDER;
560                 req->req.length = 0;
561                 break;
562         }
563
564         queue_complete_req(req);
565         return sizeof(struct raw1394_request);
566 }
567
568 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
569 {
570         int channel = req->req.misc;
571
572         spin_lock_irq(&host_info_lock);
573         if ((channel > 63) || (channel < -64)) {
574                 req->req.error = RAW1394_ERROR_INVALID_ARG;
575         } else if (channel >= 0) {
576                 /* allocate channel req.misc */
577                 if (fi->listen_channels & (1ULL << channel)) {
578                         req->req.error = RAW1394_ERROR_ALREADY;
579                 } else {
580                         if (hpsb_listen_channel
581                             (&raw1394_highlevel, fi->host, channel)) {
582                                 req->req.error = RAW1394_ERROR_ALREADY;
583                         } else {
584                                 fi->listen_channels |= 1ULL << channel;
585                                 fi->iso_buffer = int2ptr(req->req.recvb);
586                                 fi->iso_buffer_length = req->req.length;
587                         }
588                 }
589         } else {
590                 /* deallocate channel (one's complement neg) req.misc */
591                 channel = ~channel;
592
593                 if (fi->listen_channels & (1ULL << channel)) {
594                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host,
595                                               channel);
596                         fi->listen_channels &= ~(1ULL << channel);
597                 } else {
598                         req->req.error = RAW1394_ERROR_INVALID_ARG;
599                 }
600         }
601
602         req->req.length = 0;
603         queue_complete_req(req);
604         spin_unlock_irq(&host_info_lock);
605 }
606
607 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
608 {
609         if (req->req.misc) {
610                 if (fi->fcp_buffer) {
611                         req->req.error = RAW1394_ERROR_ALREADY;
612                 } else {
613                         fi->fcp_buffer = int2ptr(req->req.recvb);
614                 }
615         } else {
616                 if (!fi->fcp_buffer) {
617                         req->req.error = RAW1394_ERROR_ALREADY;
618                 } else {
619                         fi->fcp_buffer = NULL;
620                 }
621         }
622
623         req->req.length = 0;
624         queue_complete_req(req);
625 }
626
627 static int handle_async_request(struct file_info *fi,
628                                 struct pending_request *req, int node)
629 {
630         struct hpsb_packet *packet = NULL;
631         u64 addr = req->req.address & 0xffffffffffffULL;
632
633         switch (req->req.type) {
634         case RAW1394_REQ_ASYNC_READ:
635                 DBGMSG("read_request called");
636                 packet =
637                     hpsb_make_readpacket(fi->host, node, addr, req->req.length);
638
639                 if (!packet)
640                         return -ENOMEM;
641
642                 if (req->req.length == 4)
643                         req->data = &packet->header[3];
644                 else
645                         req->data = packet->data;
646
647                 break;
648
649         case RAW1394_REQ_ASYNC_WRITE:
650                 DBGMSG("write_request called");
651
652                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
653                                                req->req.length);
654                 if (!packet)
655                         return -ENOMEM;
656
657                 if (req->req.length == 4) {
658                         if (copy_from_user
659                             (&packet->header[3], int2ptr(req->req.sendb),
660                              req->req.length))
661                                 req->req.error = RAW1394_ERROR_MEMFAULT;
662                 } else {
663                         if (copy_from_user
664                             (packet->data, int2ptr(req->req.sendb),
665                              req->req.length))
666                                 req->req.error = RAW1394_ERROR_MEMFAULT;
667                 }
668
669                 req->req.length = 0;
670                 break;
671
672         case RAW1394_REQ_ASYNC_STREAM:
673                 DBGMSG("stream_request called");
674
675                 packet =
676                     hpsb_make_streampacket(fi->host, NULL, req->req.length,
677                                            node & 0x3f /*channel */ ,
678                                            (req->req.misc >> 16) & 0x3,
679                                            req->req.misc & 0xf);
680                 if (!packet)
681                         return -ENOMEM;
682
683                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
684                                    req->req.length))
685                         req->req.error = RAW1394_ERROR_MEMFAULT;
686
687                 req->req.length = 0;
688                 break;
689
690         case RAW1394_REQ_LOCK:
691                 DBGMSG("lock_request called");
692                 if ((req->req.misc == EXTCODE_FETCH_ADD)
693                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
694                         if (req->req.length != 4) {
695                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
696                                 break;
697                         }
698                 } else {
699                         if (req->req.length != 8) {
700                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
701                                 break;
702                         }
703                 }
704
705                 packet = hpsb_make_lockpacket(fi->host, node, addr,
706                                               req->req.misc, NULL, 0);
707                 if (!packet)
708                         return -ENOMEM;
709
710                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
711                                    req->req.length)) {
712                         req->req.error = RAW1394_ERROR_MEMFAULT;
713                         break;
714                 }
715
716                 req->data = packet->data;
717                 req->req.length = 4;
718                 break;
719
720         case RAW1394_REQ_LOCK64:
721                 DBGMSG("lock64_request called");
722                 if ((req->req.misc == EXTCODE_FETCH_ADD)
723                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
724                         if (req->req.length != 8) {
725                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
726                                 break;
727                         }
728                 } else {
729                         if (req->req.length != 16) {
730                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
731                                 break;
732                         }
733                 }
734                 packet = hpsb_make_lock64packet(fi->host, node, addr,
735                                                 req->req.misc, NULL, 0);
736                 if (!packet)
737                         return -ENOMEM;
738
739                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
740                                    req->req.length)) {
741                         req->req.error = RAW1394_ERROR_MEMFAULT;
742                         break;
743                 }
744
745                 req->data = packet->data;
746                 req->req.length = 8;
747                 break;
748
749         default:
750                 req->req.error = RAW1394_ERROR_STATE_ORDER;
751         }
752
753         req->packet = packet;
754
755         if (req->req.error) {
756                 req->req.length = 0;
757                 queue_complete_req(req);
758                 return sizeof(struct raw1394_request);
759         }
760
761         hpsb_set_packet_complete_task(packet,
762                                       (void (*)(void *))queue_complete_cb, req);
763
764         spin_lock_irq(&fi->reqlists_lock);
765         list_add_tail(&req->list, &fi->req_pending);
766         spin_unlock_irq(&fi->reqlists_lock);
767
768         packet->generation = req->req.generation;
769
770         if (hpsb_send_packet(packet) < 0) {
771                 req->req.error = RAW1394_ERROR_SEND_ERROR;
772                 req->req.length = 0;
773                 hpsb_free_tlabel(packet);
774                 queue_complete_req(req);
775         }
776         return sizeof(struct raw1394_request);
777 }
778
779 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
780                            int channel)
781 {
782         struct hpsb_packet *packet;
783
784         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
785                                      (req->req.misc >> 16) & 0x3,
786                                      req->req.misc & 0xf);
787         if (!packet)
788                 return -ENOMEM;
789
790         packet->speed_code = req->req.address & 0x3;
791
792         req->packet = packet;
793
794         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
795                            req->req.length)) {
796                 req->req.error = RAW1394_ERROR_MEMFAULT;
797                 req->req.length = 0;
798                 queue_complete_req(req);
799                 return sizeof(struct raw1394_request);
800         }
801
802         req->req.length = 0;
803         hpsb_set_packet_complete_task(packet,
804                                       (void (*)(void *))queue_complete_req,
805                                       req);
806
807         spin_lock_irq(&fi->reqlists_lock);
808         list_add_tail(&req->list, &fi->req_pending);
809         spin_unlock_irq(&fi->reqlists_lock);
810
811         /* Update the generation of the packet just before sending. */
812         packet->generation = req->req.generation;
813
814         if (hpsb_send_packet(packet) < 0) {
815                 req->req.error = RAW1394_ERROR_SEND_ERROR;
816                 queue_complete_req(req);
817         }
818
819         return sizeof(struct raw1394_request);
820 }
821
822 static int handle_async_send(struct file_info *fi, struct pending_request *req)
823 {
824         struct hpsb_packet *packet;
825         int header_length = req->req.misc & 0xffff;
826         int expect_response = req->req.misc >> 16;
827
828         if ((header_length > req->req.length) || (header_length < 12)) {
829                 req->req.error = RAW1394_ERROR_INVALID_ARG;
830                 req->req.length = 0;
831                 queue_complete_req(req);
832                 return sizeof(struct raw1394_request);
833         }
834
835         packet = hpsb_alloc_packet(req->req.length - header_length);
836         req->packet = packet;
837         if (!packet)
838                 return -ENOMEM;
839
840         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
841                            header_length)) {
842                 req->req.error = RAW1394_ERROR_MEMFAULT;
843                 req->req.length = 0;
844                 queue_complete_req(req);
845                 return sizeof(struct raw1394_request);
846         }
847
848         if (copy_from_user
849             (packet->data, int2ptr(req->req.sendb) + header_length,
850              packet->data_size)) {
851                 req->req.error = RAW1394_ERROR_MEMFAULT;
852                 req->req.length = 0;
853                 queue_complete_req(req);
854                 return sizeof(struct raw1394_request);
855         }
856
857         packet->type = hpsb_async;
858         packet->node_id = packet->header[0] >> 16;
859         packet->tcode = (packet->header[0] >> 4) & 0xf;
860         packet->tlabel = (packet->header[0] >> 10) & 0x3f;
861         packet->host = fi->host;
862         packet->expect_response = expect_response;
863         packet->header_size = header_length;
864         packet->data_size = req->req.length - header_length;
865
866         req->req.length = 0;
867         hpsb_set_packet_complete_task(packet,
868                                       (void (*)(void *))queue_complete_cb, req);
869
870         spin_lock_irq(&fi->reqlists_lock);
871         list_add_tail(&req->list, &fi->req_pending);
872         spin_unlock_irq(&fi->reqlists_lock);
873
874         /* Update the generation of the packet just before sending. */
875         packet->generation = req->req.generation;
876
877         if (hpsb_send_packet(packet) < 0) {
878                 req->req.error = RAW1394_ERROR_SEND_ERROR;
879                 queue_complete_req(req);
880         }
881
882         return sizeof(struct raw1394_request);
883 }
884
885 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
886                     u64 addr, size_t length, u16 flags)
887 {
888         struct pending_request *req;
889         struct host_info *hi;
890         struct file_info *fi = NULL;
891         struct list_head *entry;
892         struct arm_addr *arm_addr = NULL;
893         struct arm_request *arm_req = NULL;
894         struct arm_response *arm_resp = NULL;
895         int found = 0, size = 0, rcode = -1;
896         struct arm_request_response *arm_req_resp = NULL;
897
898         DBGMSG("arm_read  called by node: %X"
899                "addr: %4.4x %8.8x length: %Zu", nodeid,
900                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
901                length);
902         spin_lock(&host_info_lock);
903         hi = find_host_info(host);      /* search address-entry */
904         if (hi != NULL) {
905                 list_for_each_entry(fi, &hi->file_info_list, list) {
906                         entry = fi->addr_list.next;
907                         while (entry != &(fi->addr_list)) {
908                                 arm_addr =
909                                     list_entry(entry, struct arm_addr,
910                                                addr_list);
911                                 if (((arm_addr->start) <= (addr))
912                                     && ((arm_addr->end) >= (addr + length))) {
913                                         found = 1;
914                                         break;
915                                 }
916                                 entry = entry->next;
917                         }
918                         if (found) {
919                                 break;
920                         }
921                 }
922         }
923         rcode = -1;
924         if (!found) {
925                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
926                        " -> rcode_address_error\n");
927                 spin_unlock(&host_info_lock);
928                 return (RCODE_ADDRESS_ERROR);
929         } else {
930                 DBGMSG("arm_read addr_entry FOUND");
931         }
932         if (arm_addr->rec_length < length) {
933                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
934                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
935         }
936         if (rcode == -1) {
937                 if (arm_addr->access_rights & ARM_READ) {
938                         if (!(arm_addr->client_transactions & ARM_READ)) {
939                                 memcpy(buffer,
940                                        (arm_addr->addr_space_buffer) + (addr -
941                                                                         (arm_addr->
942                                                                          start)),
943                                        length);
944                                 DBGMSG("arm_read -> (rcode_complete)");
945                                 rcode = RCODE_COMPLETE;
946                         }
947                 } else {
948                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
949                         DBGMSG("arm_read -> rcode_type_error (access denied)");
950                 }
951         }
952         if (arm_addr->notification_options & ARM_READ) {
953                 DBGMSG("arm_read -> entering notification-section");
954                 req = __alloc_pending_request(SLAB_ATOMIC);
955                 if (!req) {
956                         DBGMSG("arm_read -> rcode_conflict_error");
957                         spin_unlock(&host_info_lock);
958                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
959                                                            The request may be retried */
960                 }
961                 if (rcode == RCODE_COMPLETE) {
962                         size =
963                             sizeof(struct arm_request) +
964                             sizeof(struct arm_response) +
965                             length * sizeof(byte_t) +
966                             sizeof(struct arm_request_response);
967                 } else {
968                         size =
969                             sizeof(struct arm_request) +
970                             sizeof(struct arm_response) +
971                             sizeof(struct arm_request_response);
972                 }
973                 req->data = kmalloc(size, SLAB_ATOMIC);
974                 if (!(req->data)) {
975                         free_pending_request(req);
976                         DBGMSG("arm_read -> rcode_conflict_error");
977                         spin_unlock(&host_info_lock);
978                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
979                                                            The request may be retried */
980                 }
981                 req->free_data = 1;
982                 req->file_info = fi;
983                 req->req.type = RAW1394_REQ_ARM;
984                 req->req.generation = get_hpsb_generation(host);
985                 req->req.misc =
986                     (((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
987                 req->req.tag = arm_addr->arm_tag;
988                 req->req.recvb = arm_addr->recvb;
989                 req->req.length = size;
990                 arm_req_resp = (struct arm_request_response *)(req->data);
991                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
992                                                  (sizeof
993                                                   (struct
994                                                    arm_request_response)));
995                 arm_resp =
996                     (struct arm_response *)((byte_t *) (arm_req) +
997                                             (sizeof(struct arm_request)));
998                 arm_req->buffer = NULL;
999                 arm_resp->buffer = NULL;
1000                 if (rcode == RCODE_COMPLETE) {
1001                         byte_t *buf =
1002                             (byte_t *) arm_resp + sizeof(struct arm_response);
1003                         memcpy(buf,
1004                                (arm_addr->addr_space_buffer) + (addr -
1005                                                                 (arm_addr->
1006                                                                  start)),
1007                                length);
1008                         arm_resp->buffer =
1009                             int2ptr((arm_addr->recvb) +
1010                                     sizeof(struct arm_request_response) +
1011                                     sizeof(struct arm_request) +
1012                                     sizeof(struct arm_response));
1013                 }
1014                 arm_resp->buffer_length =
1015                     (rcode == RCODE_COMPLETE) ? length : 0;
1016                 arm_resp->response_code = rcode;
1017                 arm_req->buffer_length = 0;
1018                 arm_req->generation = req->req.generation;
1019                 arm_req->extended_transaction_code = 0;
1020                 arm_req->destination_offset = addr;
1021                 arm_req->source_nodeid = nodeid;
1022                 arm_req->destination_nodeid = host->node_id;
1023                 arm_req->tlabel = (flags >> 10) & 0x3f;
1024                 arm_req->tcode = (flags >> 4) & 0x0f;
1025                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1026                                                 sizeof(struct
1027                                                        arm_request_response));
1028                 arm_req_resp->response =
1029                     int2ptr((arm_addr->recvb) +
1030                             sizeof(struct arm_request_response) +
1031                             sizeof(struct arm_request));
1032                 queue_complete_req(req);
1033         }
1034         spin_unlock(&host_info_lock);
1035         return (rcode);
1036 }
1037
1038 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
1039                      quadlet_t * data, u64 addr, size_t length, u16 flags)
1040 {
1041         struct pending_request *req;
1042         struct host_info *hi;
1043         struct file_info *fi = NULL;
1044         struct list_head *entry;
1045         struct arm_addr *arm_addr = NULL;
1046         struct arm_request *arm_req = NULL;
1047         struct arm_response *arm_resp = NULL;
1048         int found = 0, size = 0, rcode = -1, length_conflict = 0;
1049         struct arm_request_response *arm_req_resp = NULL;
1050
1051         DBGMSG("arm_write called by node: %X"
1052                "addr: %4.4x %8.8x length: %Zu", nodeid,
1053                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1054                length);
1055         spin_lock(&host_info_lock);
1056         hi = find_host_info(host);      /* search address-entry */
1057         if (hi != NULL) {
1058                 list_for_each_entry(fi, &hi->file_info_list, list) {
1059                         entry = fi->addr_list.next;
1060                         while (entry != &(fi->addr_list)) {
1061                                 arm_addr =
1062                                     list_entry(entry, struct arm_addr,
1063                                                addr_list);
1064                                 if (((arm_addr->start) <= (addr))
1065                                     && ((arm_addr->end) >= (addr + length))) {
1066                                         found = 1;
1067                                         break;
1068                                 }
1069                                 entry = entry->next;
1070                         }
1071                         if (found) {
1072                                 break;
1073                         }
1074                 }
1075         }
1076         rcode = -1;
1077         if (!found) {
1078                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1079                        " -> rcode_address_error\n");
1080                 spin_unlock(&host_info_lock);
1081                 return (RCODE_ADDRESS_ERROR);
1082         } else {
1083                 DBGMSG("arm_write addr_entry FOUND");
1084         }
1085         if (arm_addr->rec_length < length) {
1086                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1087                 length_conflict = 1;
1088                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1089         }
1090         if (rcode == -1) {
1091                 if (arm_addr->access_rights & ARM_WRITE) {
1092                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1093                                 memcpy((arm_addr->addr_space_buffer) +
1094                                        (addr - (arm_addr->start)), data,
1095                                        length);
1096                                 DBGMSG("arm_write -> (rcode_complete)");
1097                                 rcode = RCODE_COMPLETE;
1098                         }
1099                 } else {
1100                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1101                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1102                 }
1103         }
1104         if (arm_addr->notification_options & ARM_WRITE) {
1105                 DBGMSG("arm_write -> entering notification-section");
1106                 req = __alloc_pending_request(SLAB_ATOMIC);
1107                 if (!req) {
1108                         DBGMSG("arm_write -> rcode_conflict_error");
1109                         spin_unlock(&host_info_lock);
1110                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1111                                                            The request my be retried */
1112                 }
1113                 size =
1114                     sizeof(struct arm_request) + sizeof(struct arm_response) +
1115                     (length) * sizeof(byte_t) +
1116                     sizeof(struct arm_request_response);
1117                 req->data = kmalloc(size, SLAB_ATOMIC);
1118                 if (!(req->data)) {
1119                         free_pending_request(req);
1120                         DBGMSG("arm_write -> rcode_conflict_error");
1121                         spin_unlock(&host_info_lock);
1122                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1123                                                            The request may be retried */
1124                 }
1125                 req->free_data = 1;
1126                 req->file_info = fi;
1127                 req->req.type = RAW1394_REQ_ARM;
1128                 req->req.generation = get_hpsb_generation(host);
1129                 req->req.misc =
1130                     (((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1131                 req->req.tag = arm_addr->arm_tag;
1132                 req->req.recvb = arm_addr->recvb;
1133                 req->req.length = size;
1134                 arm_req_resp = (struct arm_request_response *)(req->data);
1135                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1136                                                  (sizeof
1137                                                   (struct
1138                                                    arm_request_response)));
1139                 arm_resp =
1140                     (struct arm_response *)((byte_t *) (arm_req) +
1141                                             (sizeof(struct arm_request)));
1142                 arm_resp->buffer = NULL;
1143                 memcpy((byte_t *) arm_resp + sizeof(struct arm_response),
1144                        data, length);
1145                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1146                                           sizeof(struct arm_request_response) +
1147                                           sizeof(struct arm_request) +
1148                                           sizeof(struct arm_response));
1149                 arm_req->buffer_length = length;
1150                 arm_req->generation = req->req.generation;
1151                 arm_req->extended_transaction_code = 0;
1152                 arm_req->destination_offset = addr;
1153                 arm_req->source_nodeid = nodeid;
1154                 arm_req->destination_nodeid = destid;
1155                 arm_req->tlabel = (flags >> 10) & 0x3f;
1156                 arm_req->tcode = (flags >> 4) & 0x0f;
1157                 arm_resp->buffer_length = 0;
1158                 arm_resp->response_code = rcode;
1159                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1160                                                 sizeof(struct
1161                                                        arm_request_response));
1162                 arm_req_resp->response =
1163                     int2ptr((arm_addr->recvb) +
1164                             sizeof(struct arm_request_response) +
1165                             sizeof(struct arm_request));
1166                 queue_complete_req(req);
1167         }
1168         spin_unlock(&host_info_lock);
1169         return (rcode);
1170 }
1171
1172 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
1173                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
1174                     u16 flags)
1175 {
1176         struct pending_request *req;
1177         struct host_info *hi;
1178         struct file_info *fi = NULL;
1179         struct list_head *entry;
1180         struct arm_addr *arm_addr = NULL;
1181         struct arm_request *arm_req = NULL;
1182         struct arm_response *arm_resp = NULL;
1183         int found = 0, size = 0, rcode = -1;
1184         quadlet_t old, new;
1185         struct arm_request_response *arm_req_resp = NULL;
1186
1187         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1188             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1189                 DBGMSG("arm_lock  called by node: %X "
1190                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1191                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1192                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1193                        be32_to_cpu(data));
1194         } else {
1195                 DBGMSG("arm_lock  called by node: %X "
1196                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1197                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1198                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1199                        be32_to_cpu(data), be32_to_cpu(arg));
1200         }
1201         spin_lock(&host_info_lock);
1202         hi = find_host_info(host);      /* search address-entry */
1203         if (hi != NULL) {
1204                 list_for_each_entry(fi, &hi->file_info_list, list) {
1205                         entry = fi->addr_list.next;
1206                         while (entry != &(fi->addr_list)) {
1207                                 arm_addr =
1208                                     list_entry(entry, struct arm_addr,
1209                                                addr_list);
1210                                 if (((arm_addr->start) <= (addr))
1211                                     && ((arm_addr->end) >=
1212                                         (addr + sizeof(*store)))) {
1213                                         found = 1;
1214                                         break;
1215                                 }
1216                                 entry = entry->next;
1217                         }
1218                         if (found) {
1219                                 break;
1220                         }
1221                 }
1222         }
1223         rcode = -1;
1224         if (!found) {
1225                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1226                        " -> rcode_address_error\n");
1227                 spin_unlock(&host_info_lock);
1228                 return (RCODE_ADDRESS_ERROR);
1229         } else {
1230                 DBGMSG("arm_lock addr_entry FOUND");
1231         }
1232         if (rcode == -1) {
1233                 if (arm_addr->access_rights & ARM_LOCK) {
1234                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1235                                 memcpy(&old,
1236                                        (arm_addr->addr_space_buffer) + (addr -
1237                                                                         (arm_addr->
1238                                                                          start)),
1239                                        sizeof(old));
1240                                 switch (ext_tcode) {
1241                                 case (EXTCODE_MASK_SWAP):
1242                                         new = data | (old & ~arg);
1243                                         break;
1244                                 case (EXTCODE_COMPARE_SWAP):
1245                                         if (old == arg) {
1246                                                 new = data;
1247                                         } else {
1248                                                 new = old;
1249                                         }
1250                                         break;
1251                                 case (EXTCODE_FETCH_ADD):
1252                                         new =
1253                                             cpu_to_be32(be32_to_cpu(data) +
1254                                                         be32_to_cpu(old));
1255                                         break;
1256                                 case (EXTCODE_LITTLE_ADD):
1257                                         new =
1258                                             cpu_to_le32(le32_to_cpu(data) +
1259                                                         le32_to_cpu(old));
1260                                         break;
1261                                 case (EXTCODE_BOUNDED_ADD):
1262                                         if (old != arg) {
1263                                                 new =
1264                                                     cpu_to_be32(be32_to_cpu
1265                                                                 (data) +
1266                                                                 be32_to_cpu
1267                                                                 (old));
1268                                         } else {
1269                                                 new = old;
1270                                         }
1271                                         break;
1272                                 case (EXTCODE_WRAP_ADD):
1273                                         if (old != arg) {
1274                                                 new =
1275                                                     cpu_to_be32(be32_to_cpu
1276                                                                 (data) +
1277                                                                 be32_to_cpu
1278                                                                 (old));
1279                                         } else {
1280                                                 new = data;
1281                                         }
1282                                         break;
1283                                 default:
1284                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1285                                         printk(KERN_ERR
1286                                                "raw1394: arm_lock FAILED "
1287                                                "ext_tcode not allowed -> rcode_type_error\n");
1288                                         break;
1289                                 }       /*switch */
1290                                 if (rcode == -1) {
1291                                         DBGMSG("arm_lock -> (rcode_complete)");
1292                                         rcode = RCODE_COMPLETE;
1293                                         memcpy(store, &old, sizeof(*store));
1294                                         memcpy((arm_addr->addr_space_buffer) +
1295                                                (addr - (arm_addr->start)),
1296                                                &new, sizeof(*store));
1297                                 }
1298                         }
1299                 } else {
1300                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1301                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1302                 }
1303         }
1304         if (arm_addr->notification_options & ARM_LOCK) {
1305                 byte_t *buf1, *buf2;
1306                 DBGMSG("arm_lock -> entering notification-section");
1307                 req = __alloc_pending_request(SLAB_ATOMIC);
1308                 if (!req) {
1309                         DBGMSG("arm_lock -> rcode_conflict_error");
1310                         spin_unlock(&host_info_lock);
1311                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1312                                                            The request may be retried */
1313                 }
1314                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1315                 req->data = kmalloc(size, SLAB_ATOMIC);
1316                 if (!(req->data)) {
1317                         free_pending_request(req);
1318                         DBGMSG("arm_lock -> rcode_conflict_error");
1319                         spin_unlock(&host_info_lock);
1320                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1321                                                            The request may be retried */
1322                 }
1323                 req->free_data = 1;
1324                 arm_req_resp = (struct arm_request_response *)(req->data);
1325                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1326                                                  (sizeof
1327                                                   (struct
1328                                                    arm_request_response)));
1329                 arm_resp =
1330                     (struct arm_response *)((byte_t *) (arm_req) +
1331                                             (sizeof(struct arm_request)));
1332                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1333                 buf2 = buf1 + 2 * sizeof(*store);
1334                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1335                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1336                         arm_req->buffer_length = sizeof(*store);
1337                         memcpy(buf1, &data, sizeof(*store));
1338
1339                 } else {
1340                         arm_req->buffer_length = 2 * sizeof(*store);
1341                         memcpy(buf1, &arg, sizeof(*store));
1342                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1343                 }
1344                 if (rcode == RCODE_COMPLETE) {
1345                         arm_resp->buffer_length = sizeof(*store);
1346                         memcpy(buf2, &old, sizeof(*store));
1347                 } else {
1348                         arm_resp->buffer_length = 0;
1349                 }
1350                 req->file_info = fi;
1351                 req->req.type = RAW1394_REQ_ARM;
1352                 req->req.generation = get_hpsb_generation(host);
1353                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1354                                  (ARM_LOCK & 0xFF));
1355                 req->req.tag = arm_addr->arm_tag;
1356                 req->req.recvb = arm_addr->recvb;
1357                 req->req.length = size;
1358                 arm_req->generation = req->req.generation;
1359                 arm_req->extended_transaction_code = ext_tcode;
1360                 arm_req->destination_offset = addr;
1361                 arm_req->source_nodeid = nodeid;
1362                 arm_req->destination_nodeid = host->node_id;
1363                 arm_req->tlabel = (flags >> 10) & 0x3f;
1364                 arm_req->tcode = (flags >> 4) & 0x0f;
1365                 arm_resp->response_code = rcode;
1366                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1367                                                 sizeof(struct
1368                                                        arm_request_response));
1369                 arm_req_resp->response =
1370                     int2ptr((arm_addr->recvb) +
1371                             sizeof(struct arm_request_response) +
1372                             sizeof(struct arm_request));
1373                 arm_req->buffer =
1374                     int2ptr((arm_addr->recvb) +
1375                             sizeof(struct arm_request_response) +
1376                             sizeof(struct arm_request) +
1377                             sizeof(struct arm_response));
1378                 arm_resp->buffer =
1379                     int2ptr((arm_addr->recvb) +
1380                             sizeof(struct arm_request_response) +
1381                             sizeof(struct arm_request) +
1382                             sizeof(struct arm_response) + 2 * sizeof(*store));
1383                 queue_complete_req(req);
1384         }
1385         spin_unlock(&host_info_lock);
1386         return (rcode);
1387 }
1388
1389 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
1390                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
1391                       u16 flags)
1392 {
1393         struct pending_request *req;
1394         struct host_info *hi;
1395         struct file_info *fi = NULL;
1396         struct list_head *entry;
1397         struct arm_addr *arm_addr = NULL;
1398         struct arm_request *arm_req = NULL;
1399         struct arm_response *arm_resp = NULL;
1400         int found = 0, size = 0, rcode = -1;
1401         octlet_t old, new;
1402         struct arm_request_response *arm_req_resp = NULL;
1403
1404         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1405             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1406                 DBGMSG("arm_lock64 called by node: %X "
1407                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1408                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1409                        (u32) (addr & 0xFFFFFFFF),
1410                        ext_tcode & 0xFF,
1411                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1412                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1413         } else {
1414                 DBGMSG("arm_lock64 called by node: %X "
1415                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1416                        "%8.8X %8.8X ",
1417                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1418                        (u32) (addr & 0xFFFFFFFF),
1419                        ext_tcode & 0xFF,
1420                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1421                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1422                        (u32) ((be64_to_cpu(arg) >> 32) & 0xFFFFFFFF),
1423                        (u32) (be64_to_cpu(arg) & 0xFFFFFFFF));
1424         }
1425         spin_lock(&host_info_lock);
1426         hi = find_host_info(host);      /* search addressentry in file_info's for host */
1427         if (hi != NULL) {
1428                 list_for_each_entry(fi, &hi->file_info_list, list) {
1429                         entry = fi->addr_list.next;
1430                         while (entry != &(fi->addr_list)) {
1431                                 arm_addr =
1432                                     list_entry(entry, struct arm_addr,
1433                                                addr_list);
1434                                 if (((arm_addr->start) <= (addr))
1435                                     && ((arm_addr->end) >=
1436                                         (addr + sizeof(*store)))) {
1437                                         found = 1;
1438                                         break;
1439                                 }
1440                                 entry = entry->next;
1441                         }
1442                         if (found) {
1443                                 break;
1444                         }
1445                 }
1446         }
1447         rcode = -1;
1448         if (!found) {
1449                 printk(KERN_ERR
1450                        "raw1394: arm_lock64 FAILED addr_entry not found"
1451                        " -> rcode_address_error\n");
1452                 spin_unlock(&host_info_lock);
1453                 return (RCODE_ADDRESS_ERROR);
1454         } else {
1455                 DBGMSG("arm_lock64 addr_entry FOUND");
1456         }
1457         if (rcode == -1) {
1458                 if (arm_addr->access_rights & ARM_LOCK) {
1459                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1460                                 memcpy(&old,
1461                                        (arm_addr->addr_space_buffer) + (addr -
1462                                                                         (arm_addr->
1463                                                                          start)),
1464                                        sizeof(old));
1465                                 switch (ext_tcode) {
1466                                 case (EXTCODE_MASK_SWAP):
1467                                         new = data | (old & ~arg);
1468                                         break;
1469                                 case (EXTCODE_COMPARE_SWAP):
1470                                         if (old == arg) {
1471                                                 new = data;
1472                                         } else {
1473                                                 new = old;
1474                                         }
1475                                         break;
1476                                 case (EXTCODE_FETCH_ADD):
1477                                         new =
1478                                             cpu_to_be64(be64_to_cpu(data) +
1479                                                         be64_to_cpu(old));
1480                                         break;
1481                                 case (EXTCODE_LITTLE_ADD):
1482                                         new =
1483                                             cpu_to_le64(le64_to_cpu(data) +
1484                                                         le64_to_cpu(old));
1485                                         break;
1486                                 case (EXTCODE_BOUNDED_ADD):
1487                                         if (old != arg) {
1488                                                 new =
1489                                                     cpu_to_be64(be64_to_cpu
1490                                                                 (data) +
1491                                                                 be64_to_cpu
1492                                                                 (old));
1493                                         } else {
1494                                                 new = old;
1495                                         }
1496                                         break;
1497                                 case (EXTCODE_WRAP_ADD):
1498                                         if (old != arg) {
1499                                                 new =
1500                                                     cpu_to_be64(be64_to_cpu
1501                                                                 (data) +
1502                                                                 be64_to_cpu
1503                                                                 (old));
1504                                         } else {
1505                                                 new = data;
1506                                         }
1507                                         break;
1508                                 default:
1509                                         printk(KERN_ERR
1510                                                "raw1394: arm_lock64 FAILED "
1511                                                "ext_tcode not allowed -> rcode_type_error\n");
1512                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1513                                         break;
1514                                 }       /*switch */
1515                                 if (rcode == -1) {
1516                                         DBGMSG
1517                                             ("arm_lock64 -> (rcode_complete)");
1518                                         rcode = RCODE_COMPLETE;
1519                                         memcpy(store, &old, sizeof(*store));
1520                                         memcpy((arm_addr->addr_space_buffer) +
1521                                                (addr - (arm_addr->start)),
1522                                                &new, sizeof(*store));
1523                                 }
1524                         }
1525                 } else {
1526                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1527                         DBGMSG
1528                             ("arm_lock64 -> rcode_type_error (access denied)");
1529                 }
1530         }
1531         if (arm_addr->notification_options & ARM_LOCK) {
1532                 byte_t *buf1, *buf2;
1533                 DBGMSG("arm_lock64 -> entering notification-section");
1534                 req = __alloc_pending_request(SLAB_ATOMIC);
1535                 if (!req) {
1536                         spin_unlock(&host_info_lock);
1537                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1538                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1539                                                            The request may be retried */
1540                 }
1541                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1542                 req->data = kmalloc(size, SLAB_ATOMIC);
1543                 if (!(req->data)) {
1544                         free_pending_request(req);
1545                         spin_unlock(&host_info_lock);
1546                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1547                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1548                                                            The request may be retried */
1549                 }
1550                 req->free_data = 1;
1551                 arm_req_resp = (struct arm_request_response *)(req->data);
1552                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1553                                                  (sizeof
1554                                                   (struct
1555                                                    arm_request_response)));
1556                 arm_resp =
1557                     (struct arm_response *)((byte_t *) (arm_req) +
1558                                             (sizeof(struct arm_request)));
1559                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1560                 buf2 = buf1 + 2 * sizeof(*store);
1561                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1562                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1563                         arm_req->buffer_length = sizeof(*store);
1564                         memcpy(buf1, &data, sizeof(*store));
1565
1566                 } else {
1567                         arm_req->buffer_length = 2 * sizeof(*store);
1568                         memcpy(buf1, &arg, sizeof(*store));
1569                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1570                 }
1571                 if (rcode == RCODE_COMPLETE) {
1572                         arm_resp->buffer_length = sizeof(*store);
1573                         memcpy(buf2, &old, sizeof(*store));
1574                 } else {
1575                         arm_resp->buffer_length = 0;
1576                 }
1577                 req->file_info = fi;
1578                 req->req.type = RAW1394_REQ_ARM;
1579                 req->req.generation = get_hpsb_generation(host);
1580                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1581                                  (ARM_LOCK & 0xFF));
1582                 req->req.tag = arm_addr->arm_tag;
1583                 req->req.recvb = arm_addr->recvb;
1584                 req->req.length = size;
1585                 arm_req->generation = req->req.generation;
1586                 arm_req->extended_transaction_code = ext_tcode;
1587                 arm_req->destination_offset = addr;
1588                 arm_req->source_nodeid = nodeid;
1589                 arm_req->destination_nodeid = host->node_id;
1590                 arm_req->tlabel = (flags >> 10) & 0x3f;
1591                 arm_req->tcode = (flags >> 4) & 0x0f;
1592                 arm_resp->response_code = rcode;
1593                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1594                                                 sizeof(struct
1595                                                        arm_request_response));
1596                 arm_req_resp->response =
1597                     int2ptr((arm_addr->recvb) +
1598                             sizeof(struct arm_request_response) +
1599                             sizeof(struct arm_request));
1600                 arm_req->buffer =
1601                     int2ptr((arm_addr->recvb) +
1602                             sizeof(struct arm_request_response) +
1603                             sizeof(struct arm_request) +
1604                             sizeof(struct arm_response));
1605                 arm_resp->buffer =
1606                     int2ptr((arm_addr->recvb) +
1607                             sizeof(struct arm_request_response) +
1608                             sizeof(struct arm_request) +
1609                             sizeof(struct arm_response) + 2 * sizeof(*store));
1610                 queue_complete_req(req);
1611         }
1612         spin_unlock(&host_info_lock);
1613         return (rcode);
1614 }
1615
1616 static int arm_register(struct file_info *fi, struct pending_request *req)
1617 {
1618         int retval;
1619         struct arm_addr *addr;
1620         struct host_info *hi;
1621         struct file_info *fi_hlp = NULL;
1622         struct list_head *entry;
1623         struct arm_addr *arm_addr = NULL;
1624         int same_host, another_host;
1625         unsigned long flags;
1626
1627         DBGMSG("arm_register called "
1628                "addr(Offset): %8.8x %8.8x length: %u "
1629                "rights: %2.2X notify: %2.2X "
1630                "max_blk_len: %4.4X",
1631                (u32) ((req->req.address >> 32) & 0xFFFF),
1632                (u32) (req->req.address & 0xFFFFFFFF),
1633                req->req.length, ((req->req.misc >> 8) & 0xFF),
1634                (req->req.misc & 0xFF), ((req->req.misc >> 16) & 0xFFFF));
1635         /* check addressrange */
1636         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1637             (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) !=
1638              0)) {
1639                 req->req.length = 0;
1640                 return (-EINVAL);
1641         }
1642         /* addr-list-entry for fileinfo */
1643         addr = (struct arm_addr *)kmalloc(sizeof(struct arm_addr), SLAB_KERNEL);
1644         if (!addr) {
1645                 req->req.length = 0;
1646                 return (-ENOMEM);
1647         }
1648         /* allocation of addr_space_buffer */
1649         addr->addr_space_buffer = (u8 *) vmalloc(req->req.length);
1650         if (!(addr->addr_space_buffer)) {
1651                 kfree(addr);
1652                 req->req.length = 0;
1653                 return (-ENOMEM);
1654         }
1655         /* initialization of addr_space_buffer */
1656         if ((req->req.sendb) == (unsigned long)NULL) {
1657                 /* init: set 0 */
1658                 memset(addr->addr_space_buffer, 0, req->req.length);
1659         } else {
1660                 /* init: user -> kernel */
1661                 if (copy_from_user
1662                     (addr->addr_space_buffer, int2ptr(req->req.sendb),
1663                      req->req.length)) {
1664                         vfree(addr->addr_space_buffer);
1665                         kfree(addr);
1666                         return (-EFAULT);
1667                 }
1668         }
1669         INIT_LIST_HEAD(&addr->addr_list);
1670         addr->arm_tag = req->req.tag;
1671         addr->start = req->req.address;
1672         addr->end = req->req.address + req->req.length;
1673         addr->access_rights = (u8) (req->req.misc & 0x0F);
1674         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1675         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1676         addr->access_rights |= addr->client_transactions;
1677         addr->notification_options |= addr->client_transactions;
1678         addr->recvb = req->req.recvb;
1679         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1680         spin_lock_irqsave(&host_info_lock, flags);
1681         hi = find_host_info(fi->host);
1682         same_host = 0;
1683         another_host = 0;
1684         /* same host with address-entry containing same addressrange ? */
1685         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1686                 entry = fi_hlp->addr_list.next;
1687                 while (entry != &(fi_hlp->addr_list)) {
1688                         arm_addr =
1689                             list_entry(entry, struct arm_addr, addr_list);
1690                         if ((arm_addr->start == addr->start)
1691                             && (arm_addr->end == addr->end)) {
1692                                 DBGMSG("same host ownes same "
1693                                        "addressrange -> EALREADY");
1694                                 same_host = 1;
1695                                 break;
1696                         }
1697                         entry = entry->next;
1698                 }
1699                 if (same_host) {
1700                         break;
1701                 }
1702         }
1703         if (same_host) {
1704                 /* addressrange occupied by same host */
1705                 vfree(addr->addr_space_buffer);
1706                 kfree(addr);
1707                 spin_unlock_irqrestore(&host_info_lock, flags);
1708                 return (-EALREADY);
1709         }
1710         /* another host with valid address-entry containing same addressrange */
1711         list_for_each_entry(hi, &host_info_list, list) {
1712                 if (hi->host != fi->host) {
1713                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1714                                 entry = fi_hlp->addr_list.next;
1715                                 while (entry != &(fi_hlp->addr_list)) {
1716                                         arm_addr =
1717                                             list_entry(entry, struct arm_addr,
1718                                                        addr_list);
1719                                         if ((arm_addr->start == addr->start)
1720                                             && (arm_addr->end == addr->end)) {
1721                                                 DBGMSG
1722                                                     ("another host ownes same "
1723                                                      "addressrange");
1724                                                 another_host = 1;
1725                                                 break;
1726                                         }
1727                                         entry = entry->next;
1728                                 }
1729                                 if (another_host) {
1730                                         break;
1731                                 }
1732                         }
1733                 }
1734         }
1735         if (another_host) {
1736                 DBGMSG("another hosts entry is valid -> SUCCESS");
1737                 if (copy_to_user(int2ptr(req->req.recvb),
1738                                  &addr->start, sizeof(u64))) {
1739                         printk(KERN_ERR "raw1394: arm_register failed "
1740                                " address-range-entry is invalid -> EFAULT !!!\n");
1741                         vfree(addr->addr_space_buffer);
1742                         kfree(addr);
1743                         spin_unlock_irqrestore(&host_info_lock, flags);
1744                         return (-EFAULT);
1745                 }
1746                 free_pending_request(req);      /* immediate success or fail */
1747                 /* INSERT ENTRY */
1748                 list_add_tail(&addr->addr_list, &fi->addr_list);
1749                 spin_unlock_irqrestore(&host_info_lock, flags);
1750                 return sizeof(struct raw1394_request);
1751         }
1752         retval =
1753             hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
1754                                     req->req.address,
1755                                     req->req.address + req->req.length);
1756         if (retval) {
1757                 /* INSERT ENTRY */
1758                 list_add_tail(&addr->addr_list, &fi->addr_list);
1759         } else {
1760                 DBGMSG("arm_register failed errno: %d \n", retval);
1761                 vfree(addr->addr_space_buffer);
1762                 kfree(addr);
1763                 spin_unlock_irqrestore(&host_info_lock, flags);
1764                 return (-EALREADY);
1765         }
1766         spin_unlock_irqrestore(&host_info_lock, flags);
1767         free_pending_request(req);      /* immediate success or fail */
1768         return sizeof(struct raw1394_request);
1769 }
1770
1771 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1772 {
1773         int found = 0;
1774         int retval = 0;
1775         struct list_head *entry;
1776         struct arm_addr *addr = NULL;
1777         struct host_info *hi;
1778         struct file_info *fi_hlp = NULL;
1779         struct arm_addr *arm_addr = NULL;
1780         int another_host;
1781         unsigned long flags;
1782
1783         DBGMSG("arm_Unregister called addr(Offset): "
1784                "%8.8x %8.8x",
1785                (u32) ((req->req.address >> 32) & 0xFFFF),
1786                (u32) (req->req.address & 0xFFFFFFFF));
1787         spin_lock_irqsave(&host_info_lock, flags);
1788         /* get addr */
1789         entry = fi->addr_list.next;
1790         while (entry != &(fi->addr_list)) {
1791                 addr = list_entry(entry, struct arm_addr, addr_list);
1792                 if (addr->start == req->req.address) {
1793                         found = 1;
1794                         break;
1795                 }
1796                 entry = entry->next;
1797         }
1798         if (!found) {
1799                 DBGMSG("arm_Unregister addr not found");
1800                 spin_unlock_irqrestore(&host_info_lock, flags);
1801                 return (-EINVAL);
1802         }
1803         DBGMSG("arm_Unregister addr found");
1804         another_host = 0;
1805         /* another host with valid address-entry containing
1806            same addressrange */
1807         list_for_each_entry(hi, &host_info_list, list) {
1808                 if (hi->host != fi->host) {
1809                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1810                                 entry = fi_hlp->addr_list.next;
1811                                 while (entry != &(fi_hlp->addr_list)) {
1812                                         arm_addr = list_entry(entry,
1813                                                               struct arm_addr,
1814                                                               addr_list);
1815                                         if (arm_addr->start == addr->start) {
1816                                                 DBGMSG("another host ownes "
1817                                                        "same addressrange");
1818                                                 another_host = 1;
1819                                                 break;
1820                                         }
1821                                         entry = entry->next;
1822                                 }
1823                                 if (another_host) {
1824                                         break;
1825                                 }
1826                         }
1827                 }
1828         }
1829         if (another_host) {
1830                 DBGMSG("delete entry from list -> success");
1831                 list_del(&addr->addr_list);
1832                 vfree(addr->addr_space_buffer);
1833                 kfree(addr);
1834                 free_pending_request(req);      /* immediate success or fail */
1835                 spin_unlock_irqrestore(&host_info_lock, flags);
1836                 return sizeof(struct raw1394_request);
1837         }
1838         retval =
1839             hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
1840                                       addr->start);
1841         if (!retval) {
1842                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1843                 spin_unlock_irqrestore(&host_info_lock, flags);
1844                 return (-EINVAL);
1845         }
1846         DBGMSG("delete entry from list -> success");
1847         list_del(&addr->addr_list);
1848         spin_unlock_irqrestore(&host_info_lock, flags);
1849         vfree(addr->addr_space_buffer);
1850         kfree(addr);
1851         free_pending_request(req);      /* immediate success or fail */
1852         return sizeof(struct raw1394_request);
1853 }
1854
1855 /* Copy data from ARM buffer(s) to user buffer. */
1856 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1857 {
1858         struct arm_addr *arm_addr = NULL;
1859         unsigned long flags;
1860         unsigned long offset;
1861
1862         struct list_head *entry;
1863
1864         DBGMSG("arm_get_buf "
1865                "addr(Offset): %04X %08X length: %u",
1866                (u32) ((req->req.address >> 32) & 0xFFFF),
1867                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1868
1869         spin_lock_irqsave(&host_info_lock, flags);
1870         entry = fi->addr_list.next;
1871         while (entry != &(fi->addr_list)) {
1872                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1873                 if ((arm_addr->start <= req->req.address) &&
1874                     (arm_addr->end > req->req.address)) {
1875                         if (req->req.address + req->req.length <= arm_addr->end) {
1876                                 offset = req->req.address - arm_addr->start;
1877
1878                                 DBGMSG
1879                                     ("arm_get_buf copy_to_user( %08X, %p, %u )",
1880                                      (u32) req->req.recvb,
1881                                      arm_addr->addr_space_buffer + offset,
1882                                      (u32) req->req.length);
1883
1884                                 if (copy_to_user
1885                                     (int2ptr(req->req.recvb),
1886                                      arm_addr->addr_space_buffer + offset,
1887                                      req->req.length)) {
1888                                         spin_unlock_irqrestore(&host_info_lock,
1889                                                                flags);
1890                                         return (-EFAULT);
1891                                 }
1892
1893                                 spin_unlock_irqrestore(&host_info_lock, flags);
1894                                 /* We have to free the request, because we
1895                                  * queue no response, and therefore nobody
1896                                  * will free it. */
1897                                 free_pending_request(req);
1898                                 return sizeof(struct raw1394_request);
1899                         } else {
1900                                 DBGMSG("arm_get_buf request exceeded mapping");
1901                                 spin_unlock_irqrestore(&host_info_lock, flags);
1902                                 return (-EINVAL);
1903                         }
1904                 }
1905                 entry = entry->next;
1906         }
1907         spin_unlock_irqrestore(&host_info_lock, flags);
1908         return (-EINVAL);
1909 }
1910
1911 /* Copy data from user buffer to ARM buffer(s). */
1912 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
1913 {
1914         struct arm_addr *arm_addr = NULL;
1915         unsigned long flags;
1916         unsigned long offset;
1917
1918         struct list_head *entry;
1919
1920         DBGMSG("arm_set_buf "
1921                "addr(Offset): %04X %08X length: %u",
1922                (u32) ((req->req.address >> 32) & 0xFFFF),
1923                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1924
1925         spin_lock_irqsave(&host_info_lock, flags);
1926         entry = fi->addr_list.next;
1927         while (entry != &(fi->addr_list)) {
1928                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1929                 if ((arm_addr->start <= req->req.address) &&
1930                     (arm_addr->end > req->req.address)) {
1931                         if (req->req.address + req->req.length <= arm_addr->end) {
1932                                 offset = req->req.address - arm_addr->start;
1933
1934                                 DBGMSG
1935                                     ("arm_set_buf copy_from_user( %p, %08X, %u )",
1936                                      arm_addr->addr_space_buffer + offset,
1937                                      (u32) req->req.sendb,
1938                                      (u32) req->req.length);
1939
1940                                 if (copy_from_user
1941                                     (arm_addr->addr_space_buffer + offset,
1942                                      int2ptr(req->req.sendb),
1943                                      req->req.length)) {
1944                                         spin_unlock_irqrestore(&host_info_lock,
1945                                                                flags);
1946                                         return (-EFAULT);
1947                                 }
1948
1949                                 spin_unlock_irqrestore(&host_info_lock, flags);
1950                                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
1951                                 return sizeof(struct raw1394_request);
1952                         } else {
1953                                 DBGMSG("arm_set_buf request exceeded mapping");
1954                                 spin_unlock_irqrestore(&host_info_lock, flags);
1955                                 return (-EINVAL);
1956                         }
1957                 }
1958                 entry = entry->next;
1959         }
1960         spin_unlock_irqrestore(&host_info_lock, flags);
1961         return (-EINVAL);
1962 }
1963
1964 static int reset_notification(struct file_info *fi, struct pending_request *req)
1965 {
1966         DBGMSG("reset_notification called - switch %s ",
1967                (req->req.misc == RAW1394_NOTIFY_OFF) ? "OFF" : "ON");
1968         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
1969             (req->req.misc == RAW1394_NOTIFY_ON)) {
1970                 fi->notification = (u8) req->req.misc;
1971                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
1972                 return sizeof(struct raw1394_request);
1973         }
1974         /* error EINVAL (22) invalid argument */
1975         return (-EINVAL);
1976 }
1977
1978 static int write_phypacket(struct file_info *fi, struct pending_request *req)
1979 {
1980         struct hpsb_packet *packet = NULL;
1981         int retval = 0;
1982         quadlet_t data;
1983
1984         data = be32_to_cpu((u32) req->req.sendb);
1985         DBGMSG("write_phypacket called - quadlet 0x%8.8x ", data);
1986         packet = hpsb_make_phypacket(fi->host, data);
1987         if (!packet)
1988                 return -ENOMEM;
1989         req->req.length = 0;
1990         req->packet = packet;
1991         hpsb_set_packet_complete_task(packet,
1992                                       (void (*)(void *))queue_complete_cb, req);
1993         spin_lock_irq(&fi->reqlists_lock);
1994         list_add_tail(&req->list, &fi->req_pending);
1995         spin_unlock_irq(&fi->reqlists_lock);
1996         packet->generation = req->req.generation;
1997         retval = hpsb_send_packet(packet);
1998         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
1999         if (retval < 0) {
2000                 req->req.error = RAW1394_ERROR_SEND_ERROR;
2001                 req->req.length = 0;
2002                 queue_complete_req(req);
2003         }
2004         return sizeof(struct raw1394_request);
2005 }
2006
2007 static int get_config_rom(struct file_info *fi, struct pending_request *req)
2008 {
2009         int ret = sizeof(struct raw1394_request);
2010         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2011         int status;
2012
2013         if (!data)
2014                 return -ENOMEM;
2015
2016         status =
2017             csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
2018                          data, req->req.length);
2019         if (copy_to_user(int2ptr(req->req.recvb), data, req->req.length))
2020                 ret = -EFAULT;
2021         if (copy_to_user
2022             (int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
2023              sizeof(fi->host->csr.rom->cache_head->len)))
2024                 ret = -EFAULT;
2025         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
2026                          sizeof(fi->host->csr.generation)))
2027                 ret = -EFAULT;
2028         if (copy_to_user(int2ptr(req->req.sendb), &status, sizeof(status)))
2029                 ret = -EFAULT;
2030         kfree(data);
2031         if (ret >= 0) {
2032                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2033         }
2034         return ret;
2035 }
2036
2037 static int update_config_rom(struct file_info *fi, struct pending_request *req)
2038 {
2039         int ret = sizeof(struct raw1394_request);
2040         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2041         if (!data)
2042                 return -ENOMEM;
2043         if (copy_from_user(data, int2ptr(req->req.sendb), req->req.length)) {
2044                 ret = -EFAULT;
2045         } else {
2046                 int status = hpsb_update_config_rom(fi->host,
2047                                                     data, req->req.length,
2048                                                     (unsigned char)req->req.
2049                                                     misc);
2050                 if (copy_to_user
2051                     (int2ptr(req->req.recvb), &status, sizeof(status)))
2052                         ret = -ENOMEM;
2053         }
2054         kfree(data);
2055         if (ret >= 0) {
2056                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2057                 fi->cfgrom_upd = 1;
2058         }
2059         return ret;
2060 }
2061
2062 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
2063 {
2064         struct csr1212_keyval *kv;
2065         struct csr1212_csr_rom_cache *cache;
2066         struct csr1212_dentry *dentry;
2067         u32 dr;
2068         int ret = 0;
2069
2070         if (req->req.misc == ~0) {
2071                 if (req->req.length == 0)
2072                         return -EINVAL;
2073
2074                 /* Find an unused slot */
2075                 for (dr = 0;
2076                      dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr];
2077                      dr++) ;
2078
2079                 if (dr == RAW1394_MAX_USER_CSR_DIRS)
2080                         return -ENOMEM;
2081
2082                 fi->csr1212_dirs[dr] =
2083                     csr1212_new_directory(CSR1212_KV_ID_VENDOR);
2084                 if (!fi->csr1212_dirs[dr])
2085                         return -ENOMEM;
2086         } else {
2087                 dr = req->req.misc;
2088                 if (!fi->csr1212_dirs[dr])
2089                         return -EINVAL;
2090
2091                 /* Delete old stuff */
2092                 for (dentry =
2093                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2094                      dentry; dentry = dentry->next) {
2095                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2096                                                              root_kv,
2097                                                              dentry->kv);
2098                 }
2099
2100                 if (req->req.length == 0) {
2101                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
2102                         fi->csr1212_dirs[dr] = NULL;
2103
2104                         hpsb_update_config_rom_image(fi->host);
2105                         free_pending_request(req);
2106                         return sizeof(struct raw1394_request);
2107                 }
2108         }
2109
2110         cache = csr1212_rom_cache_malloc(0, req->req.length);
2111         if (!cache) {
2112                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2113                 fi->csr1212_dirs[dr] = NULL;
2114                 return -ENOMEM;
2115         }
2116
2117         cache->filled_head =
2118             kmalloc(sizeof(struct csr1212_cache_region), GFP_KERNEL);
2119         if (!cache->filled_head) {
2120                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2121                 fi->csr1212_dirs[dr] = NULL;
2122                 CSR1212_FREE(cache);
2123                 return -ENOMEM;
2124         }
2125         cache->filled_tail = cache->filled_head;
2126
2127         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
2128                            req->req.length)) {
2129                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2130                 fi->csr1212_dirs[dr] = NULL;
2131                 CSR1212_FREE(cache);
2132                 ret = -EFAULT;
2133         } else {
2134                 cache->len = req->req.length;
2135                 cache->filled_head->offset_start = 0;
2136                 cache->filled_head->offset_end = cache->size - 1;
2137
2138                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2139
2140                 ret = CSR1212_SUCCESS;
2141                 /* parse all the items */
2142                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2143                      kv = kv->next) {
2144                         ret = csr1212_parse_keyval(kv, cache);
2145                 }
2146
2147                 /* attach top level items to the root directory */
2148                 for (dentry =
2149                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2150                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2151                         ret =
2152                             csr1212_attach_keyval_to_directory(fi->host->csr.
2153                                                                rom->root_kv,
2154                                                                dentry->kv);
2155                 }
2156
2157                 if (ret == CSR1212_SUCCESS) {
2158                         ret = hpsb_update_config_rom_image(fi->host);
2159
2160                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2161                                                      &dr, sizeof(dr))) {
2162                                 ret = -ENOMEM;
2163                         }
2164                 }
2165         }
2166         kfree(cache->filled_head);
2167         kfree(cache);
2168
2169         if (ret >= 0) {
2170                 /* we have to free the request, because we queue no response,
2171                  * and therefore nobody will free it */
2172                 free_pending_request(req);
2173                 return sizeof(struct raw1394_request);
2174         } else {
2175                 for (dentry =
2176                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2177                      dentry; dentry = dentry->next) {
2178                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2179                                                              root_kv,
2180                                                              dentry->kv);
2181                 }
2182                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2183                 fi->csr1212_dirs[dr] = NULL;
2184                 return ret;
2185         }
2186 }
2187
2188 static int state_connected(struct file_info *fi, struct pending_request *req)
2189 {
2190         int node = req->req.address >> 48;
2191
2192         req->req.error = RAW1394_ERROR_NONE;
2193
2194         switch (req->req.type) {
2195
2196         case RAW1394_REQ_ECHO:
2197                 queue_complete_req(req);
2198                 return sizeof(struct raw1394_request);
2199
2200         case RAW1394_REQ_ISO_SEND:
2201                 return handle_iso_send(fi, req, node);
2202
2203         case RAW1394_REQ_ARM_REGISTER:
2204                 return arm_register(fi, req);
2205
2206         case RAW1394_REQ_ARM_UNREGISTER:
2207                 return arm_unregister(fi, req);
2208
2209         case RAW1394_REQ_ARM_SET_BUF:
2210                 return arm_set_buf(fi, req);
2211
2212         case RAW1394_REQ_ARM_GET_BUF:
2213                 return arm_get_buf(fi, req);
2214
2215         case RAW1394_REQ_RESET_NOTIFY:
2216                 return reset_notification(fi, req);
2217
2218         case RAW1394_REQ_ISO_LISTEN:
2219                 handle_iso_listen(fi, req);
2220                 return sizeof(struct raw1394_request);
2221
2222         case RAW1394_REQ_FCP_LISTEN:
2223                 handle_fcp_listen(fi, req);
2224                 return sizeof(struct raw1394_request);
2225
2226         case RAW1394_REQ_RESET_BUS:
2227                 if (req->req.misc == RAW1394_LONG_RESET) {
2228                         DBGMSG("busreset called (type: LONG)");
2229                         hpsb_reset_bus(fi->host, LONG_RESET);
2230                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2231                         return sizeof(struct raw1394_request);
2232                 }
2233                 if (req->req.misc == RAW1394_SHORT_RESET) {
2234                         DBGMSG("busreset called (type: SHORT)");
2235                         hpsb_reset_bus(fi->host, SHORT_RESET);
2236                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2237                         return sizeof(struct raw1394_request);
2238                 }
2239                 /* error EINVAL (22) invalid argument */
2240                 return (-EINVAL);
2241         case RAW1394_REQ_GET_ROM:
2242                 return get_config_rom(fi, req);
2243
2244         case RAW1394_REQ_UPDATE_ROM:
2245                 return update_config_rom(fi, req);
2246
2247         case RAW1394_REQ_MODIFY_ROM:
2248                 return modify_config_rom(fi, req);
2249         }
2250
2251         if (req->req.generation != get_hpsb_generation(fi->host)) {
2252                 req->req.error = RAW1394_ERROR_GENERATION;
2253                 req->req.generation = get_hpsb_generation(fi->host);
2254                 req->req.length = 0;
2255                 queue_complete_req(req);
2256                 return sizeof(struct raw1394_request);
2257         }
2258
2259         switch (req->req.type) {
2260         case RAW1394_REQ_PHYPACKET:
2261                 return write_phypacket(fi, req);
2262         case RAW1394_REQ_ASYNC_SEND:
2263                 return handle_async_send(fi, req);
2264         }
2265
2266         if (req->req.length == 0) {
2267                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2268                 queue_complete_req(req);
2269                 return sizeof(struct raw1394_request);
2270         }
2271
2272         return handle_async_request(fi, req, node);
2273 }
2274
2275 static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2276                              size_t count, loff_t * offset_is_ignored)
2277 {
2278         struct file_info *fi = (struct file_info *)file->private_data;
2279         struct pending_request *req;
2280         ssize_t retval = 0;
2281
2282         if (count != sizeof(struct raw1394_request)) {
2283                 return -EINVAL;
2284         }
2285
2286         req = alloc_pending_request();
2287         if (req == NULL) {
2288                 return -ENOMEM;
2289         }
2290         req->file_info = fi;
2291
2292         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2293                 free_pending_request(req);
2294                 return -EFAULT;
2295         }
2296
2297         switch (fi->state) {
2298         case opened:
2299                 retval = state_opened(fi, req);
2300                 break;
2301
2302         case initialized:
2303                 retval = state_initialized(fi, req);
2304                 break;
2305
2306         case connected:
2307                 retval = state_connected(fi, req);
2308                 break;
2309         }
2310
2311         if (retval < 0) {
2312                 free_pending_request(req);
2313         }
2314
2315         return retval;
2316 }
2317
2318 /* rawiso operations */
2319
2320 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2321  * completion queue (reqlists_lock must be taken) */
2322 static inline int __rawiso_event_in_queue(struct file_info *fi)
2323 {
2324         struct pending_request *req;
2325
2326         list_for_each_entry(req, &fi->req_complete, list)
2327             if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2328                 return 1;
2329
2330         return 0;
2331 }
2332
2333 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2334 static void queue_rawiso_event(struct file_info *fi)
2335 {
2336         unsigned long flags;
2337
2338         spin_lock_irqsave(&fi->reqlists_lock, flags);
2339
2340         /* only one ISO activity event may be in the queue */
2341         if (!__rawiso_event_in_queue(fi)) {
2342                 struct pending_request *req =
2343                     __alloc_pending_request(SLAB_ATOMIC);
2344
2345                 if (req) {
2346                         req->file_info = fi;
2347                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2348                         req->req.generation = get_hpsb_generation(fi->host);
2349                         __queue_complete_req(req);
2350                 } else {
2351                         /* on allocation failure, signal an overflow */
2352                         if (fi->iso_handle) {
2353                                 atomic_inc(&fi->iso_handle->overflows);
2354                         }
2355                 }
2356         }
2357         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2358 }
2359
2360 static void rawiso_activity_cb(struct hpsb_iso *iso)
2361 {
2362         unsigned long flags;
2363         struct host_info *hi;
2364         struct file_info *fi;
2365
2366         spin_lock_irqsave(&host_info_lock, flags);
2367         hi = find_host_info(iso->host);
2368
2369         if (hi != NULL) {
2370                 list_for_each_entry(fi, &hi->file_info_list, list) {
2371                         if (fi->iso_handle == iso)
2372                                 queue_rawiso_event(fi);
2373                 }
2374         }
2375
2376         spin_unlock_irqrestore(&host_info_lock, flags);
2377 }
2378
2379 /* helper function - gather all the kernel iso status bits for returning to user-space */
2380 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
2381                                     struct raw1394_iso_status *stat)
2382 {
2383         stat->config.data_buf_size = iso->buf_size;
2384         stat->config.buf_packets = iso->buf_packets;
2385         stat->config.channel = iso->channel;
2386         stat->config.speed = iso->speed;
2387         stat->config.irq_interval = iso->irq_interval;
2388         stat->n_packets = hpsb_iso_n_ready(iso);
2389         stat->overflows = atomic_read(&iso->overflows);
2390         stat->xmit_cycle = iso->xmit_cycle;
2391 }
2392
2393 static int raw1394_iso_xmit_init(struct file_info *fi, void __user * uaddr)
2394 {
2395         struct raw1394_iso_status stat;
2396
2397         if (!fi->host)
2398                 return -EINVAL;
2399
2400         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2401                 return -EFAULT;
2402
2403         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2404                                             stat.config.data_buf_size,
2405                                             stat.config.buf_packets,
2406                                             stat.config.channel,
2407                                             stat.config.speed,
2408                                             stat.config.irq_interval,
2409                                             rawiso_activity_cb);
2410         if (!fi->iso_handle)
2411                 return -ENOMEM;
2412
2413         fi->iso_state = RAW1394_ISO_XMIT;
2414
2415         raw1394_iso_fill_status(fi->iso_handle, &stat);
2416         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2417                 return -EFAULT;
2418
2419         /* queue an event to get things started */
2420         rawiso_activity_cb(fi->iso_handle);
2421
2422         return 0;
2423 }
2424
2425 static int raw1394_iso_recv_init(struct file_info *fi, void __user * uaddr)
2426 {
2427         struct raw1394_iso_status stat;
2428
2429         if (!fi->host)
2430                 return -EINVAL;
2431
2432         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2433                 return -EFAULT;
2434
2435         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2436                                             stat.config.data_buf_size,
2437                                             stat.config.buf_packets,
2438                                             stat.config.channel,
2439                                             stat.config.dma_mode,
2440                                             stat.config.irq_interval,
2441                                             rawiso_activity_cb);
2442         if (!fi->iso_handle)
2443                 return -ENOMEM;
2444
2445         fi->iso_state = RAW1394_ISO_RECV;
2446
2447         raw1394_iso_fill_status(fi->iso_handle, &stat);
2448         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2449                 return -EFAULT;
2450         return 0;
2451 }
2452
2453 static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
2454 {
2455         struct raw1394_iso_status stat;
2456         struct hpsb_iso *iso = fi->iso_handle;
2457
2458         raw1394_iso_fill_status(fi->iso_handle, &stat);
2459         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2460                 return -EFAULT;
2461
2462         /* reset overflow counter */
2463         atomic_set(&iso->overflows, 0);
2464
2465         return 0;
2466 }
2467
2468 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2469 static int raw1394_iso_recv_packets(struct file_info *fi, void __user * uaddr)
2470 {
2471         struct raw1394_iso_packets upackets;
2472         unsigned int packet = fi->iso_handle->first_packet;
2473         int i;
2474
2475         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2476                 return -EFAULT;
2477
2478         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2479                 return -EINVAL;
2480
2481         /* ensure user-supplied buffer is accessible and big enough */
2482         if (!access_ok(VERIFY_WRITE, upackets.infos,
2483                         upackets.n_packets *
2484                         sizeof(struct raw1394_iso_packet_info)))
2485                 return -EFAULT;
2486
2487         /* copy the packet_infos out */
2488         for (i = 0; i < upackets.n_packets; i++) {
2489                 if (__copy_to_user(&upackets.infos[i],
2490                                    &fi->iso_handle->infos[packet],
2491                                    sizeof(struct raw1394_iso_packet_info)))
2492                         return -EFAULT;
2493
2494                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2495         }
2496
2497         return 0;
2498 }
2499
2500 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2501 static int raw1394_iso_send_packets(struct file_info *fi, void __user * uaddr)
2502 {
2503         struct raw1394_iso_packets upackets;
2504         int i, rv;
2505
2506         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2507                 return -EFAULT;
2508
2509         if (upackets.n_packets >= fi->iso_handle->buf_packets)
2510                 return -EINVAL;
2511
2512         if (upackets.n_packets >= hpsb_iso_n_ready(fi->iso_handle))
2513                 return -EAGAIN;
2514
2515         /* ensure user-supplied buffer is accessible and big enough */
2516         if (!access_ok(VERIFY_READ, upackets.infos,
2517                         upackets.n_packets *
2518                         sizeof(struct raw1394_iso_packet_info)))
2519                 return -EFAULT;
2520
2521         /* copy the infos structs in and queue the packets */
2522         for (i = 0; i < upackets.n_packets; i++) {
2523                 struct raw1394_iso_packet_info info;
2524
2525                 if (__copy_from_user(&info, &upackets.infos[i],
2526                                      sizeof(struct raw1394_iso_packet_info)))
2527                         return -EFAULT;
2528
2529                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2530                                                 info.len, info.tag, info.sy);
2531                 if (rv)
2532                         return rv;
2533         }
2534
2535         return 0;
2536 }
2537
2538 static void raw1394_iso_shutdown(struct file_info *fi)
2539 {
2540         if (fi->iso_handle)
2541                 hpsb_iso_shutdown(fi->iso_handle);
2542
2543         fi->iso_handle = NULL;
2544         fi->iso_state = RAW1394_ISO_INACTIVE;
2545 }
2546
2547 /* mmap the rawiso xmit/recv buffer */
2548 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2549 {
2550         struct file_info *fi = file->private_data;
2551
2552         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2553                 return -EINVAL;
2554
2555         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2556 }
2557
2558 /* ioctl is only used for rawiso operations */
2559 static int raw1394_ioctl(struct inode *inode, struct file *file,
2560                          unsigned int cmd, unsigned long arg)
2561 {
2562         struct file_info *fi = file->private_data;
2563         void __user *argp = (void __user *)arg;
2564
2565         switch (fi->iso_state) {
2566         case RAW1394_ISO_INACTIVE:
2567                 switch (cmd) {
2568                 case RAW1394_IOC_ISO_XMIT_INIT:
2569                         return raw1394_iso_xmit_init(fi, argp);
2570                 case RAW1394_IOC_ISO_RECV_INIT:
2571                         return raw1394_iso_recv_init(fi, argp);
2572                 default:
2573                         break;
2574                 }
2575                 break;
2576         case RAW1394_ISO_RECV:
2577                 switch (cmd) {
2578                 case RAW1394_IOC_ISO_RECV_START:{
2579                                 /* copy args from user-space */
2580                                 int args[3];
2581                                 if (copy_from_user
2582                                     (&args[0], argp, sizeof(args)))
2583                                         return -EFAULT;
2584                                 return hpsb_iso_recv_start(fi->iso_handle,
2585                                                            args[0], args[1],
2586                                                            args[2]);
2587                         }
2588                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2589                         hpsb_iso_stop(fi->iso_handle);
2590                         return 0;
2591                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2592                         return hpsb_iso_recv_listen_channel(fi->iso_handle,
2593                                                             arg);
2594                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2595                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle,
2596                                                               arg);
2597                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:{
2598                                 /* copy the u64 from user-space */
2599                                 u64 mask;
2600                                 if (copy_from_user(&mask, argp, sizeof(mask)))
2601                                         return -EFAULT;
2602                                 return hpsb_iso_recv_set_channel_mask(fi->
2603                                                                       iso_handle,
2604                                                                       mask);
2605                         }
2606                 case RAW1394_IOC_ISO_GET_STATUS:
2607                         return raw1394_iso_get_status(fi, argp);
2608                 case RAW1394_IOC_ISO_RECV_PACKETS:
2609                         return raw1394_iso_recv_packets(fi, argp);
2610                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2611                         return hpsb_iso_recv_release_packets(fi->iso_handle,
2612                                                              arg);
2613                 case RAW1394_IOC_ISO_RECV_FLUSH:
2614                         return hpsb_iso_recv_flush(fi->iso_handle);
2615                 case RAW1394_IOC_ISO_SHUTDOWN:
2616                         raw1394_iso_shutdown(fi);
2617                         return 0;
2618                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2619                         queue_rawiso_event(fi);
2620                         return 0;
2621                 }
2622                 break;
2623         case RAW1394_ISO_XMIT:
2624                 switch (cmd) {
2625                 case RAW1394_IOC_ISO_XMIT_START:{
2626                                 /* copy two ints from user-space */
2627                                 int args[2];
2628                                 if (copy_from_user
2629                                     (&args[0], argp, sizeof(args)))
2630                                         return -EFAULT;
2631                                 return hpsb_iso_xmit_start(fi->iso_handle,
2632                                                            args[0], args[1]);
2633                         }
2634                 case RAW1394_IOC_ISO_XMIT_SYNC:
2635                         return hpsb_iso_xmit_sync(fi->iso_handle);
2636                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2637                         hpsb_iso_stop(fi->iso_handle);
2638                         return 0;
2639                 case RAW1394_IOC_ISO_GET_STATUS:
2640                         return raw1394_iso_get_status(fi, argp);
2641                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2642                         return raw1394_iso_send_packets(fi, argp);
2643                 case RAW1394_IOC_ISO_SHUTDOWN:
2644                         raw1394_iso_shutdown(fi);
2645                         return 0;
2646                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2647                         queue_rawiso_event(fi);
2648                         return 0;
2649                 }
2650                 break;
2651         default:
2652                 break;
2653         }
2654
2655         return -EINVAL;
2656 }
2657
2658 static unsigned int raw1394_poll(struct file *file, poll_table * pt)
2659 {
2660         struct file_info *fi = file->private_data;
2661         unsigned int mask = POLLOUT | POLLWRNORM;
2662
2663         poll_wait(file, &fi->poll_wait_complete, pt);
2664
2665         spin_lock_irq(&fi->reqlists_lock);
2666         if (!list_empty(&fi->req_complete)) {
2667                 mask |= POLLIN | POLLRDNORM;
2668         }
2669         spin_unlock_irq(&fi->reqlists_lock);
2670
2671         return mask;
2672 }
2673
2674 static int raw1394_open(struct inode *inode, struct file *file)
2675 {
2676         struct file_info *fi;
2677
2678         fi = kmalloc(sizeof(struct file_info), SLAB_KERNEL);
2679         if (fi == NULL)
2680                 return -ENOMEM;
2681
2682         memset(fi, 0, sizeof(struct file_info));
2683         fi->notification = (u8) RAW1394_NOTIFY_ON;      /* busreset notification */
2684
2685         INIT_LIST_HEAD(&fi->list);
2686         fi->state = opened;
2687         INIT_LIST_HEAD(&fi->req_pending);
2688         INIT_LIST_HEAD(&fi->req_complete);
2689         sema_init(&fi->complete_sem, 0);
2690         spin_lock_init(&fi->reqlists_lock);
2691         init_waitqueue_head(&fi->poll_wait_complete);
2692         INIT_LIST_HEAD(&fi->addr_list);
2693
2694         file->private_data = fi;
2695
2696         return 0;
2697 }
2698
2699 static int raw1394_release(struct inode *inode, struct file *file)
2700 {
2701         struct file_info *fi = file->private_data;
2702         struct list_head *lh;
2703         struct pending_request *req;
2704         int done = 0, i, fail = 0;
2705         int retval = 0;
2706         struct list_head *entry;
2707         struct arm_addr *addr = NULL;
2708         struct host_info *hi;
2709         struct file_info *fi_hlp = NULL;
2710         struct arm_addr *arm_addr = NULL;
2711         int another_host;
2712         int csr_mod = 0;
2713
2714         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2715                 raw1394_iso_shutdown(fi);
2716
2717         for (i = 0; i < 64; i++) {
2718                 if (fi->listen_channels & (1ULL << i)) {
2719                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2720                 }
2721         }
2722
2723         spin_lock_irq(&host_info_lock);
2724         fi->listen_channels = 0;
2725         spin_unlock_irq(&host_info_lock);
2726
2727         fail = 0;
2728         /* set address-entries invalid */
2729         spin_lock_irq(&host_info_lock);
2730
2731         while (!list_empty(&fi->addr_list)) {
2732                 another_host = 0;
2733                 lh = fi->addr_list.next;
2734                 addr = list_entry(lh, struct arm_addr, addr_list);
2735                 /* another host with valid address-entry containing
2736                    same addressrange? */
2737                 list_for_each_entry(hi, &host_info_list, list) {
2738                         if (hi->host != fi->host) {
2739                                 list_for_each_entry(fi_hlp, &hi->file_info_list,
2740                                                     list) {
2741                                         entry = fi_hlp->addr_list.next;
2742                                         while (entry != &(fi_hlp->addr_list)) {
2743                                                 arm_addr = list_entry(entry,
2744                                                                       struct
2745                                                                       arm_addr,
2746                                                                       addr_list);
2747                                                 if (arm_addr->start ==
2748                                                     addr->start) {
2749                                                         DBGMSG
2750                                                             ("raw1394_release: "
2751                                                              "another host ownes "
2752                                                              "same addressrange");
2753                                                         another_host = 1;
2754                                                         break;
2755                                                 }
2756                                                 entry = entry->next;
2757                                         }
2758                                         if (another_host) {
2759                                                 break;
2760                                         }
2761                                 }
2762                         }
2763                 }
2764                 if (!another_host) {
2765                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
2766                         retval =
2767                             hpsb_unregister_addrspace(&raw1394_highlevel,
2768                                                       fi->host, addr->start);
2769                         if (!retval) {
2770                                 ++fail;
2771                                 printk(KERN_ERR
2772                                        "raw1394_release arm_Unregister failed\n");
2773                         }
2774                 }
2775                 DBGMSG("raw1394_release: delete addr_entry from list");
2776                 list_del(&addr->addr_list);
2777                 vfree(addr->addr_space_buffer);
2778                 kfree(addr);
2779         }                       /* while */
2780         spin_unlock_irq(&host_info_lock);
2781         if (fail > 0) {
2782                 printk(KERN_ERR "raw1394: during addr_list-release "
2783                        "error(s) occurred \n");
2784         }
2785
2786         while (!done) {
2787                 spin_lock_irq(&fi->reqlists_lock);
2788
2789                 while (!list_empty(&fi->req_complete)) {
2790                         lh = fi->req_complete.next;
2791                         list_del(lh);
2792
2793                         req = list_entry(lh, struct pending_request, list);
2794
2795                         free_pending_request(req);
2796                 }
2797
2798                 if (list_empty(&fi->req_pending))
2799                         done = 1;
2800
2801                 spin_unlock_irq(&fi->reqlists_lock);
2802
2803                 if (!done)
2804                         down_interruptible(&fi->complete_sem);
2805         }
2806
2807         /* Remove any sub-trees left by user space programs */
2808         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
2809                 struct csr1212_dentry *dentry;
2810                 if (!fi->csr1212_dirs[i])
2811                         continue;
2812                 for (dentry =
2813                      fi->csr1212_dirs[i]->value.directory.dentries_head; dentry;
2814                      dentry = dentry->next) {
2815                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2816                                                              root_kv,
2817                                                              dentry->kv);
2818                 }
2819                 csr1212_release_keyval(fi->csr1212_dirs[i]);
2820                 fi->csr1212_dirs[i] = NULL;
2821                 csr_mod = 1;
2822         }
2823
2824         if ((csr_mod || fi->cfgrom_upd)
2825             && hpsb_update_config_rom_image(fi->host) < 0)
2826                 HPSB_ERR
2827                     ("Failed to generate Configuration ROM image for host %d",
2828                      fi->host->id);
2829
2830         if (fi->state == connected) {
2831                 spin_lock_irq(&host_info_lock);
2832                 list_del(&fi->list);
2833                 spin_unlock_irq(&host_info_lock);
2834
2835                 put_device(&fi->host->device);
2836         }
2837
2838         kfree(fi);
2839
2840         return 0;
2841 }
2842
2843 /*** HOTPLUG STUFF **********************************************************/
2844 /*
2845  * Export information about protocols/devices supported by this driver.
2846  */
2847 static struct ieee1394_device_id raw1394_id_table[] = {
2848         {
2849          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2850          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
2851          .version = AVC_SW_VERSION_ENTRY & 0xffffff},
2852         {
2853          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2854          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2855          .version = CAMERA_SW_VERSION_ENTRY & 0xffffff},
2856         {
2857          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2858          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2859          .version = (CAMERA_SW_VERSION_ENTRY + 1) & 0xffffff},
2860         {
2861          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2862          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2863          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
2864         {}
2865 };
2866
2867 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
2868
2869 static struct hpsb_protocol_driver raw1394_driver = {
2870         .name = "raw1394 Driver",
2871         .id_table = raw1394_id_table,
2872         .driver = {
2873                    .name = "raw1394",
2874                    .bus = &ieee1394_bus_type,
2875                    },
2876 };
2877
2878 /******************************************************************************/
2879
2880 static struct hpsb_highlevel raw1394_highlevel = {
2881         .name = RAW1394_DEVICE_NAME,
2882         .add_host = add_host,
2883         .remove_host = remove_host,
2884         .host_reset = host_reset,
2885         .iso_receive = iso_receive,
2886         .fcp_request = fcp_request,
2887 };
2888
2889 static struct cdev raw1394_cdev;
2890 static struct file_operations raw1394_fops = {
2891         .owner = THIS_MODULE,
2892         .read = raw1394_read,
2893         .write = raw1394_write,
2894         .mmap = raw1394_mmap,
2895         .ioctl = raw1394_ioctl,
2896         .poll = raw1394_poll,
2897         .open = raw1394_open,
2898         .release = raw1394_release,
2899 };
2900
2901 static int __init init_raw1394(void)
2902 {
2903         int ret = 0;
2904
2905         hpsb_register_highlevel(&raw1394_highlevel);
2906
2907         if (IS_ERR(class_device_create(hpsb_protocol_class, MKDEV(
2908                 IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16), 
2909                 NULL, RAW1394_DEVICE_NAME))) {
2910                 ret = -EFAULT;
2911                 goto out_unreg;
2912         }
2913         
2914         devfs_mk_cdev(MKDEV(
2915                 IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16),
2916                 S_IFCHR | S_IRUSR | S_IWUSR, RAW1394_DEVICE_NAME);
2917
2918         cdev_init(&raw1394_cdev, &raw1394_fops);
2919         raw1394_cdev.owner = THIS_MODULE;
2920         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
2921         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
2922         if (ret) {
2923                 HPSB_ERR("raw1394 failed to register minor device block");
2924                 goto out_dev;
2925         }
2926
2927         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
2928
2929         ret = hpsb_register_protocol(&raw1394_driver);
2930         if (ret) {
2931                 HPSB_ERR("raw1394: failed to register protocol");
2932                 cdev_del(&raw1394_cdev);
2933                 goto out_dev;
2934         }
2935
2936         goto out;
2937
2938 out_dev:
2939         devfs_remove(RAW1394_DEVICE_NAME);
2940         class_device_destroy(hpsb_protocol_class,
2941                 MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16));
2942 out_unreg:
2943         hpsb_unregister_highlevel(&raw1394_highlevel);
2944 out:
2945         return ret;
2946 }
2947
2948 static void __exit cleanup_raw1394(void)
2949 {
2950         class_device_destroy(hpsb_protocol_class,
2951                 MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16));
2952         cdev_del(&raw1394_cdev);
2953         devfs_remove(RAW1394_DEVICE_NAME);
2954         hpsb_unregister_highlevel(&raw1394_highlevel);
2955         hpsb_unregister_protocol(&raw1394_driver);
2956 }
2957
2958 module_init(init_raw1394);
2959 module_exit(cleanup_raw1394);
2960 MODULE_LICENSE("GPL");
2961 MODULE_ALIAS_CHARDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16);