drivers/ieee1394/raw1394.c

   1 /*
   2  * IEEE 1394 for Linux
   3  *
   4  * Raw interface to the bus
   5  *
   6  * Copyright (C) 1999, 2000 Andreas E. Bombe
   7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
   8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
   9  *
  10  * This code is licensed under the GPL.  See the file COPYING in the root
  11  * directory of the kernel sources for details.
  12  *
  13  *
  14  * Contributions:
  15  *
  16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
  17  *        configuration ROM manipulation
  18  *        address range mapping
  19  *        adaptation for new (transparent) loopback mechanism
  20  *        sending of arbitrary async packets
  21  * Christian Toegel <christian.toegel@gmx.at>
  22  *        address range mapping
  23  *        lock64 request
  24  *        transmit physical packet
  25  *        busreset notification control (switch on/off)
  26  *        busreset with selection of type (short/long)
  27  *        request_reply
  28  */
  29
  30 #include <linux/kernel.h>
  31 #include <linux/list.h>
  32 #include <linux/string.h>
  33 #include <linux/slab.h>
  34 #include <linux/fs.h>
  35 #include <linux/poll.h>
  36 #include <linux/module.h>
  37 #include <linux/init.h>
  38 #include <linux/smp_lock.h>
  39 #include <linux/interrupt.h>
  40 #include <linux/vmalloc.h>
  41 #include <linux/cdev.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/atomic.h>
  44 #include <linux/compat.h>
  45
  46 #include "csr1212.h"
  47 #include "highlevel.h"
  48 #include "hosts.h"
  49 #include "ieee1394.h"
  50 #include "ieee1394_core.h"
  51 #include "ieee1394_hotplug.h"
  52 #include "ieee1394_transactions.h"
  53 #include "ieee1394_types.h"
  54 #include "iso.h"
  55 #include "nodemgr.h"
  56 #include "raw1394.h"
  57 #include "raw1394-private.h"
  58
  59 #define int2ptr(x) ((void __user *)(unsigned long)x)
  60 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
  61
  62 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
  63 #define RAW1394_DEBUG
  64 #endif
  65
  66 #ifdef RAW1394_DEBUG
  67 #define DBGMSG(fmt, args...) \
  68 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
  69 #else
  70 #define DBGMSG(fmt, args...)
  71 #endif
  72
  73 static LIST_HEAD(host_info_list);
  74 static int host_count;
  75 static DEFINE_SPINLOCK(host_info_lock);
  76 static atomic_t internal_generation = ATOMIC_INIT(0);
  77
  78 static atomic_t iso_buffer_size;
  79 static const int iso_buffer_max = 4 * 1024 * 1024;      /* 4 MB */
  80
  81 static struct hpsb_highlevel raw1394_highlevel;
  82
  83 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
  84                     u64 addr, size_t length, u16 flags);
  85 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
  86                      quadlet_t * data, u64 addr, size_t length, u16 flags);
  87 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
  88                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
  89                     u16 flags);
  90 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
  91                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
  92                       u16 flags);
  93 static struct hpsb_address_ops arm_ops = {
  94         .read = arm_read,
  95         .write = arm_write,
  96         .lock = arm_lock,
  97         .lock64 = arm_lock64,
  98 };
  99
 100 static void queue_complete_cb(struct pending_request *req);
 101
 102 static struct pending_request *__alloc_pending_request(gfp_t flags)
 103 {
 104         struct pending_request *req;
 105
 106         req = kzalloc(sizeof(*req), flags);
 107         if (req)
 108                 INIT_LIST_HEAD(&req->list);
 109
 110         return req;
 111 }
 112
 113 static inline struct pending_request *alloc_pending_request(void)
 114 {
 115         return __alloc_pending_request(SLAB_KERNEL);
 116 }
 117
 118 static void free_pending_request(struct pending_request *req)
 119 {
 120         if (req->ibs) {
 121                 if (atomic_dec_and_test(&req->ibs->refcount)) {
 122                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
 123                         kfree(req->ibs);
 124                 }
 125         } else if (req->free_data) {
 126                 kfree(req->data);
 127         }
 128         hpsb_free_packet(req->packet);
 129         kfree(req);
 130 }
 131
 132 /* fi->reqlists_lock must be taken */
 133 static void __queue_complete_req(struct pending_request *req)
 134 {
 135         struct file_info *fi = req->file_info;
 136         list_move_tail(&req->list, &fi->req_complete);
 137
 138         up(&fi->complete_sem);
 139         wake_up_interruptible(&fi->poll_wait_complete);
 140 }
 141
 142 static void queue_complete_req(struct pending_request *req)
 143 {
 144         unsigned long flags;
 145         struct file_info *fi = req->file_info;
 146
 147         spin_lock_irqsave(&fi->reqlists_lock, flags);
 148         __queue_complete_req(req);
 149         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 150 }
 151
 152 static void queue_complete_cb(struct pending_request *req)
 153 {
 154         struct hpsb_packet *packet = req->packet;
 155         int rcode = (packet->header[1] >> 12) & 0xf;
 156
 157         switch (packet->ack_code) {
 158         case ACKX_NONE:
 159         case ACKX_SEND_ERROR:
 160                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 161                 break;
 162         case ACKX_ABORTED:
 163                 req->req.error = RAW1394_ERROR_ABORTED;
 164                 break;
 165         case ACKX_TIMEOUT:
 166                 req->req.error = RAW1394_ERROR_TIMEOUT;
 167                 break;
 168         default:
 169                 req->req.error = (packet->ack_code << 16) | rcode;
 170                 break;
 171         }
 172
 173         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
 174                 req->req.length = 0;
 175         }
 176
 177         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
 178             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
 179             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
 180             (req->req.type == RAW1394_REQ_LOCK) ||
 181             (req->req.type == RAW1394_REQ_LOCK64))
 182                 hpsb_free_tlabel(packet);
 183
 184         queue_complete_req(req);
 185 }
 186
 187 static void add_host(struct hpsb_host *host)
 188 {
 189         struct host_info *hi;
 190         unsigned long flags;
 191
 192         hi = kmalloc(sizeof(*hi), GFP_KERNEL);
 193
 194         if (hi) {
 195                 INIT_LIST_HEAD(&hi->list);
 196                 hi->host = host;
 197                 INIT_LIST_HEAD(&hi->file_info_list);
 198
 199                 spin_lock_irqsave(&host_info_lock, flags);
 200                 list_add_tail(&hi->list, &host_info_list);
 201                 host_count++;
 202                 spin_unlock_irqrestore(&host_info_lock, flags);
 203         }
 204
 205         atomic_inc(&internal_generation);
 206 }
 207
 208 static struct host_info *find_host_info(struct hpsb_host *host)
 209 {
 210         struct host_info *hi;
 211
 212         list_for_each_entry(hi, &host_info_list, list)
 213             if (hi->host == host)
 214                 return hi;
 215
 216         return NULL;
 217 }
 218
 219 static void remove_host(struct hpsb_host *host)
 220 {
 221         struct host_info *hi;
 222         unsigned long flags;
 223
 224         spin_lock_irqsave(&host_info_lock, flags);
 225         hi = find_host_info(host);
 226
 227         if (hi != NULL) {
 228                 list_del(&hi->list);
 229                 host_count--;
 230                 /*
 231                    FIXME: address ranges should be removed
 232                    and fileinfo states should be initialized
 233                    (including setting generation to
 234                    internal-generation ...)
 235                  */
 236         }
 237         spin_unlock_irqrestore(&host_info_lock, flags);
 238
 239         if (hi == NULL) {
 240                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
 241                        "0x%p\n", host);
 242                 return;
 243         }
 244
 245         kfree(hi);
 246
 247         atomic_inc(&internal_generation);
 248 }
 249
 250 static void host_reset(struct hpsb_host *host)
 251 {
 252         unsigned long flags;
 253         struct host_info *hi;
 254         struct file_info *fi;
 255         struct pending_request *req;
 256
 257         spin_lock_irqsave(&host_info_lock, flags);
 258         hi = find_host_info(host);
 259
 260         if (hi != NULL) {
 261                 list_for_each_entry(fi, &hi->file_info_list, list) {
 262                         if (fi->notification == RAW1394_NOTIFY_ON) {
 263                                 req = __alloc_pending_request(SLAB_ATOMIC);
 264
 265                                 if (req != NULL) {
 266                                         req->file_info = fi;
 267                                         req->req.type = RAW1394_REQ_BUS_RESET;
 268                                         req->req.generation =
 269                                             get_hpsb_generation(host);
 270                                         req->req.misc = (host->node_id << 16)
 271                                             | host->node_count;
 272                                         if (fi->protocol_version > 3) {
 273                                                 req->req.misc |=
 274                                                     (NODEID_TO_NODE
 275                                                      (host->irm_id)
 276                                                      << 8);
 277                                         }
 278
 279                                         queue_complete_req(req);
 280                                 }
 281                         }
 282                 }
 283         }
 284         spin_unlock_irqrestore(&host_info_lock, flags);
 285 }
 286
 287 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t * data,
 288                         size_t length)
 289 {
 290         unsigned long flags;
 291         struct host_info *hi;
 292         struct file_info *fi;
 293         struct pending_request *req, *req_next;
 294         struct iso_block_store *ibs = NULL;
 295         LIST_HEAD(reqs);
 296
 297         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 298                 HPSB_INFO("dropped iso packet");
 299                 return;
 300         }
 301
 302         spin_lock_irqsave(&host_info_lock, flags);
 303         hi = find_host_info(host);
 304
 305         if (hi != NULL) {
 306                 list_for_each_entry(fi, &hi->file_info_list, list) {
 307                         if (!(fi->listen_channels & (1ULL << channel)))
 308                                 continue;
 309
 310                         req = __alloc_pending_request(SLAB_ATOMIC);
 311                         if (!req)
 312                                 break;
 313
 314                         if (!ibs) {
 315                                 ibs = kmalloc(sizeof(*ibs) + length,
 316                                               SLAB_ATOMIC);
 317                                 if (!ibs) {
 318                                         kfree(req);
 319                                         break;
 320                                 }
 321
 322                                 atomic_add(length, &iso_buffer_size);
 323                                 atomic_set(&ibs->refcount, 0);
 324                                 ibs->data_size = length;
 325                                 memcpy(ibs->data, data, length);
 326                         }
 327
 328                         atomic_inc(&ibs->refcount);
 329
 330                         req->file_info = fi;
 331                         req->ibs = ibs;
 332                         req->data = ibs->data;
 333                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
 334                         req->req.generation = get_hpsb_generation(host);
 335                         req->req.misc = 0;
 336                         req->req.recvb = ptr2int(fi->iso_buffer);
 337                         req->req.length = min(length, fi->iso_buffer_length);
 338
 339                         list_add_tail(&req->list, &reqs);
 340                 }
 341         }
 342         spin_unlock_irqrestore(&host_info_lock, flags);
 343
 344         list_for_each_entry_safe(req, req_next, &reqs, list)
 345             queue_complete_req(req);
 346 }
 347
 348 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
 349                         int cts, u8 * data, size_t length)
 350 {
 351         unsigned long flags;
 352         struct host_info *hi;
 353         struct file_info *fi;
 354         struct pending_request *req, *req_next;
 355         struct iso_block_store *ibs = NULL;
 356         LIST_HEAD(reqs);
 357
 358         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 359                 HPSB_INFO("dropped fcp request");
 360                 return;
 361         }
 362
 363         spin_lock_irqsave(&host_info_lock, flags);
 364         hi = find_host_info(host);
 365
 366         if (hi != NULL) {
 367                 list_for_each_entry(fi, &hi->file_info_list, list) {
 368                         if (!fi->fcp_buffer)
 369                                 continue;
 370
 371                         req = __alloc_pending_request(SLAB_ATOMIC);
 372                         if (!req)
 373                                 break;
 374
 375                         if (!ibs) {
 376                                 ibs = kmalloc(sizeof(*ibs) + length,
 377                                               SLAB_ATOMIC);
 378                                 if (!ibs) {
 379                                         kfree(req);
 380                                         break;
 381                                 }
 382
 383                                 atomic_add(length, &iso_buffer_size);
 384                                 atomic_set(&ibs->refcount, 0);
 385                                 ibs->data_size = length;
 386                                 memcpy(ibs->data, data, length);
 387                         }
 388
 389                         atomic_inc(&ibs->refcount);
 390
 391                         req->file_info = fi;
 392                         req->ibs = ibs;
 393                         req->data = ibs->data;
 394                         req->req.type = RAW1394_REQ_FCP_REQUEST;
 395                         req->req.generation = get_hpsb_generation(host);
 396                         req->req.misc = nodeid | (direction << 16);
 397                         req->req.recvb = ptr2int(fi->fcp_buffer);
 398                         req->req.length = length;
 399
 400                         list_add_tail(&req->list, &reqs);
 401                 }
 402         }
 403         spin_unlock_irqrestore(&host_info_lock, flags);
 404
 405         list_for_each_entry_safe(req, req_next, &reqs, list)
 406             queue_complete_req(req);
 407 }
 408
 409 #ifdef CONFIG_COMPAT
 410 struct compat_raw1394_req {
 411         __u32 type;
 412         __s32 error;
 413         __u32 misc;
 414
 415         __u32 generation;
 416         __u32 length;
 417
 418         __u64 address;
 419
 420         __u64 tag;
 421
 422         __u64 sendb;
 423         __u64 recvb;
 424 } __attribute__((packed));
 425
 426 static const char __user *raw1394_compat_write(const char __user *buf)
 427 {
 428         struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
 429         struct raw1394_request __user *r;
 430         r = compat_alloc_user_space(sizeof(struct raw1394_request));
 431
 432 #define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x))
 433
 434         if (copy_in_user(r, cr, sizeof(struct compat_raw1394_req)) ||
 435             C(address) ||
 436             C(tag) ||
 437             C(sendb) ||
 438             C(recvb))
 439                 return ERR_PTR(-EFAULT);
 440         return (const char __user *)r;
 441 }
 442 #undef C
 443
 444 #define P(x) __put_user(r->x, &cr->x)
 445
 446 static int
 447 raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
 448 {
 449         struct compat_raw1394_req __user *cr = (typeof(cr)) r;
 450         if (!access_ok(VERIFY_WRITE, cr, sizeof(struct compat_raw1394_req)) ||
 451             P(type) ||
 452             P(error) ||
 453             P(misc) ||
 454             P(generation) ||
 455             P(length) ||
 456             P(address) ||
 457             P(tag) ||
 458             P(sendb) ||
 459             P(recvb))
 460                 return -EFAULT;
 461         return sizeof(struct compat_raw1394_req);
 462 }
 463 #undef P
 464
 465 #endif
 466
 467
 468 static ssize_t raw1394_read(struct file *file, char __user * buffer,
 469                             size_t count, loff_t * offset_is_ignored)
 470 {
 471         unsigned long flags;
 472         struct file_info *fi = (struct file_info *)file->private_data;
 473         struct list_head *lh;
 474         struct pending_request *req;
 475         ssize_t ret;
 476
 477 #ifdef CONFIG_COMPAT
 478         if (count == sizeof(struct compat_raw1394_req)) {
 479                 /* ok */
 480         } else
 481 #endif
 482         if (count != sizeof(struct raw1394_request)) {
 483                 return -EINVAL;
 484         }
 485
 486         if (!access_ok(VERIFY_WRITE, buffer, count)) {
 487                 return -EFAULT;
 488         }
 489
 490         if (file->f_flags & O_NONBLOCK) {
 491                 if (down_trylock(&fi->complete_sem)) {
 492                         return -EAGAIN;
 493                 }
 494         } else {
 495                 if (down_interruptible(&fi->complete_sem)) {
 496                         return -ERESTARTSYS;
 497                 }
 498         }
 499
 500         spin_lock_irqsave(&fi->reqlists_lock, flags);
 501         lh = fi->req_complete.next;
 502         list_del(lh);
 503         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 504
 505         req = list_entry(lh, struct pending_request, list);
 506
 507         if (req->req.length) {
 508                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
 509                                  req->req.length)) {
 510                         req->req.error = RAW1394_ERROR_MEMFAULT;
 511                 }
 512         }
 513
 514 #ifdef CONFIG_COMPAT
 515         if (count == sizeof(struct compat_raw1394_req) &&
 516             sizeof(struct compat_raw1394_req) !=
 517                         sizeof(struct raw1394_request)) {
 518                 ret = raw1394_compat_read(buffer, &req->req);
 519         } else
 520 #endif
 521         {
 522                 if (copy_to_user(buffer, &req->req, sizeof(req->req))) {
 523                         ret = -EFAULT;
 524                         goto out;
 525                 }
 526                 ret = (ssize_t) sizeof(struct raw1394_request);
 527         }
 528       out:
 529         free_pending_request(req);
 530         return ret;
 531 }
 532
 533 static int state_opened(struct file_info *fi, struct pending_request *req)
 534 {
 535         if (req->req.type == RAW1394_REQ_INITIALIZE) {
 536                 switch (req->req.misc) {
 537                 case RAW1394_KERNELAPI_VERSION:
 538                 case 3:
 539                         fi->state = initialized;
 540                         fi->protocol_version = req->req.misc;
 541                         req->req.error = RAW1394_ERROR_NONE;
 542                         req->req.generation = atomic_read(&internal_generation);
 543                         break;
 544
 545                 default:
 546                         req->req.error = RAW1394_ERROR_COMPAT;
 547                         req->req.misc = RAW1394_KERNELAPI_VERSION;
 548                 }
 549         } else {
 550                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 551         }
 552
 553         req->req.length = 0;
 554         queue_complete_req(req);
 555         return sizeof(struct raw1394_request);
 556 }
 557
 558 static int state_initialized(struct file_info *fi, struct pending_request *req)
 559 {
 560         unsigned long flags;
 561         struct host_info *hi;
 562         struct raw1394_khost_list *khl;
 563
 564         if (req->req.generation != atomic_read(&internal_generation)) {
 565                 req->req.error = RAW1394_ERROR_GENERATION;
 566                 req->req.generation = atomic_read(&internal_generation);
 567                 req->req.length = 0;
 568                 queue_complete_req(req);
 569                 return sizeof(struct raw1394_request);
 570         }
 571
 572         switch (req->req.type) {
 573         case RAW1394_REQ_LIST_CARDS:
 574                 spin_lock_irqsave(&host_info_lock, flags);
 575                 khl = kmalloc(sizeof(*khl) * host_count, SLAB_ATOMIC);
 576
 577                 if (khl) {
 578                         req->req.misc = host_count;
 579                         req->data = (quadlet_t *) khl;
 580
 581                         list_for_each_entry(hi, &host_info_list, list) {
 582                                 khl->nodes = hi->host->node_count;
 583                                 strcpy(khl->name, hi->host->driver->name);
 584                                 khl++;
 585                         }
 586                 }
 587                 spin_unlock_irqrestore(&host_info_lock, flags);
 588
 589                 if (khl) {
 590                         req->req.error = RAW1394_ERROR_NONE;
 591                         req->req.length = min(req->req.length,
 592                                               (u32) (sizeof
 593                                                      (struct raw1394_khost_list)
 594                                                      * req->req.misc));
 595                         req->free_data = 1;
 596                 } else {
 597                         return -ENOMEM;
 598                 }
 599                 break;
 600
 601         case RAW1394_REQ_SET_CARD:
 602                 spin_lock_irqsave(&host_info_lock, flags);
 603                 if (req->req.misc < host_count) {
 604                         list_for_each_entry(hi, &host_info_list, list) {
 605                                 if (!req->req.misc--)
 606                                         break;
 607                         }
 608                         get_device(&hi->host->device);  // XXX Need to handle failure case
 609                         list_add_tail(&fi->list, &hi->file_info_list);
 610                         fi->host = hi->host;
 611                         fi->state = connected;
 612
 613                         req->req.error = RAW1394_ERROR_NONE;
 614                         req->req.generation = get_hpsb_generation(fi->host);
 615                         req->req.misc = (fi->host->node_id << 16)
 616                             | fi->host->node_count;
 617                         if (fi->protocol_version > 3) {
 618                                 req->req.misc |=
 619                                     NODEID_TO_NODE(fi->host->irm_id) << 8;
 620                         }
 621                 } else {
 622                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 623                 }
 624                 spin_unlock_irqrestore(&host_info_lock, flags);
 625
 626                 req->req.length = 0;
 627                 break;
 628
 629         default:
 630                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 631                 req->req.length = 0;
 632                 break;
 633         }
 634
 635         queue_complete_req(req);
 636         return sizeof(struct raw1394_request);
 637 }
 638
 639 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
 640 {
 641         int channel = req->req.misc;
 642
 643         if ((channel > 63) || (channel < -64)) {
 644                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 645         } else if (channel >= 0) {
 646                 /* allocate channel req.misc */
 647                 if (fi->listen_channels & (1ULL << channel)) {
 648                         req->req.error = RAW1394_ERROR_ALREADY;
 649                 } else {
 650                         if (hpsb_listen_channel
 651                             (&raw1394_highlevel, fi->host, channel)) {
 652                                 req->req.error = RAW1394_ERROR_ALREADY;
 653                         } else {
 654                                 fi->listen_channels |= 1ULL << channel;
 655                                 fi->iso_buffer = int2ptr(req->req.recvb);
 656                                 fi->iso_buffer_length = req->req.length;
 657                         }
 658                 }
 659         } else {
 660                 /* deallocate channel (one's complement neg) req.misc */
 661                 channel = ~channel;
 662
 663                 if (fi->listen_channels & (1ULL << channel)) {
 664                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host,
 665                                               channel);
 666                         fi->listen_channels &= ~(1ULL << channel);
 667                 } else {
 668                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 669                 }
 670         }
 671
 672         req->req.length = 0;
 673         queue_complete_req(req);
 674 }
 675
 676 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
 677 {
 678         if (req->req.misc) {
 679                 if (fi->fcp_buffer) {
 680                         req->req.error = RAW1394_ERROR_ALREADY;
 681                 } else {
 682                         fi->fcp_buffer = int2ptr(req->req.recvb);
 683                 }
 684         } else {
 685                 if (!fi->fcp_buffer) {
 686                         req->req.error = RAW1394_ERROR_ALREADY;
 687                 } else {
 688                         fi->fcp_buffer = NULL;
 689                 }
 690         }
 691
 692         req->req.length = 0;
 693         queue_complete_req(req);
 694 }
 695
 696 static int handle_async_request(struct file_info *fi,
 697                                 struct pending_request *req, int node)
 698 {
 699         unsigned long flags;
 700         struct hpsb_packet *packet = NULL;
 701         u64 addr = req->req.address & 0xffffffffffffULL;
 702
 703         switch (req->req.type) {
 704         case RAW1394_REQ_ASYNC_READ:
 705                 DBGMSG("read_request called");
 706                 packet =
 707                     hpsb_make_readpacket(fi->host, node, addr, req->req.length);
 708
 709                 if (!packet)
 710                         return -ENOMEM;
 711
 712                 if (req->req.length == 4)
 713                         req->data = &packet->header[3];
 714                 else
 715                         req->data = packet->data;
 716
 717                 break;
 718
 719         case RAW1394_REQ_ASYNC_WRITE:
 720                 DBGMSG("write_request called");
 721
 722                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
 723                                                req->req.length);
 724                 if (!packet)
 725                         return -ENOMEM;
 726
 727                 if (req->req.length == 4) {
 728                         if (copy_from_user
 729                             (&packet->header[3], int2ptr(req->req.sendb),
 730                              req->req.length))
 731                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 732                 } else {
 733                         if (copy_from_user
 734                             (packet->data, int2ptr(req->req.sendb),
 735                              req->req.length))
 736                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 737                 }
 738
 739                 req->req.length = 0;
 740                 break;
 741
 742         case RAW1394_REQ_ASYNC_STREAM:
 743                 DBGMSG("stream_request called");
 744
 745                 packet =
 746                     hpsb_make_streampacket(fi->host, NULL, req->req.length,
 747                                            node & 0x3f /*channel */ ,
 748                                            (req->req.misc >> 16) & 0x3,
 749                                            req->req.misc & 0xf);
 750                 if (!packet)
 751                         return -ENOMEM;
 752
 753                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 754                                    req->req.length))
 755                         req->req.error = RAW1394_ERROR_MEMFAULT;
 756
 757                 req->req.length = 0;
 758                 break;
 759
 760         case RAW1394_REQ_LOCK:
 761                 DBGMSG("lock_request called");
 762                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 763                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 764                         if (req->req.length != 4) {
 765                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 766                                 break;
 767                         }
 768                 } else {
 769                         if (req->req.length != 8) {
 770                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 771                                 break;
 772                         }
 773                 }
 774
 775                 packet = hpsb_make_lockpacket(fi->host, node, addr,
 776                                               req->req.misc, NULL, 0);
 777                 if (!packet)
 778                         return -ENOMEM;
 779
 780                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 781                                    req->req.length)) {
 782                         req->req.error = RAW1394_ERROR_MEMFAULT;
 783                         break;
 784                 }
 785
 786                 req->data = packet->data;
 787                 req->req.length = 4;
 788                 break;
 789
 790         case RAW1394_REQ_LOCK64:
 791                 DBGMSG("lock64_request called");
 792                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 793                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 794                         if (req->req.length != 8) {
 795                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 796                                 break;
 797                         }
 798                 } else {
 799                         if (req->req.length != 16) {
 800                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 801                                 break;
 802                         }
 803                 }
 804                 packet = hpsb_make_lock64packet(fi->host, node, addr,
 805                                                 req->req.misc, NULL, 0);
 806                 if (!packet)
 807                         return -ENOMEM;
 808
 809                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 810                                    req->req.length)) {
 811                         req->req.error = RAW1394_ERROR_MEMFAULT;
 812                         break;
 813                 }
 814
 815                 req->data = packet->data;
 816                 req->req.length = 8;
 817                 break;
 818
 819         default:
 820                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 821         }
 822
 823         req->packet = packet;
 824
 825         if (req->req.error) {
 826                 req->req.length = 0;
 827                 queue_complete_req(req);
 828                 return sizeof(struct raw1394_request);
 829         }
 830
 831         hpsb_set_packet_complete_task(packet,
 832                                       (void (*)(void *))queue_complete_cb, req);
 833
 834         spin_lock_irqsave(&fi->reqlists_lock, flags);
 835         list_add_tail(&req->list, &fi->req_pending);
 836         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 837
 838         packet->generation = req->req.generation;
 839
 840         if (hpsb_send_packet(packet) < 0) {
 841                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 842                 req->req.length = 0;
 843                 hpsb_free_tlabel(packet);
 844                 queue_complete_req(req);
 845         }
 846         return sizeof(struct raw1394_request);
 847 }
 848
 849 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
 850                            int channel)
 851 {
 852         unsigned long flags;
 853         struct hpsb_packet *packet;
 854
 855         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
 856                                      (req->req.misc >> 16) & 0x3,
 857                                      req->req.misc & 0xf);
 858         if (!packet)
 859                 return -ENOMEM;
 860
 861         packet->speed_code = req->req.address & 0x3;
 862
 863         req->packet = packet;
 864
 865         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 866                            req->req.length)) {
 867                 req->req.error = RAW1394_ERROR_MEMFAULT;
 868                 req->req.length = 0;
 869                 queue_complete_req(req);
 870                 return sizeof(struct raw1394_request);
 871         }
 872
 873         req->req.length = 0;
 874         hpsb_set_packet_complete_task(packet,
 875                                       (void (*)(void *))queue_complete_req,
 876                                       req);
 877
 878         spin_lock_irqsave(&fi->reqlists_lock, flags);
 879         list_add_tail(&req->list, &fi->req_pending);
 880         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 881
 882         /* Update the generation of the packet just before sending. */
 883         packet->generation = req->req.generation;
 884
 885         if (hpsb_send_packet(packet) < 0) {
 886                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 887                 queue_complete_req(req);
 888         }
 889
 890         return sizeof(struct raw1394_request);
 891 }
 892
 893 static int handle_async_send(struct file_info *fi, struct pending_request *req)
 894 {
 895         unsigned long flags;
 896         struct hpsb_packet *packet;
 897         int header_length = req->req.misc & 0xffff;
 898         int expect_response = req->req.misc >> 16;
 899
 900         if ((header_length > req->req.length) || (header_length < 12)) {
 901                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 902                 req->req.length = 0;
 903                 queue_complete_req(req);
 904                 return sizeof(struct raw1394_request);
 905         }
 906
 907         packet = hpsb_alloc_packet(req->req.length - header_length);
 908         req->packet = packet;
 909         if (!packet)
 910                 return -ENOMEM;
 911
 912         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
 913                            header_length)) {
 914                 req->req.error = RAW1394_ERROR_MEMFAULT;
 915                 req->req.length = 0;
 916                 queue_complete_req(req);
 917                 return sizeof(struct raw1394_request);
 918         }
 919
 920         if (copy_from_user
 921             (packet->data, int2ptr(req->req.sendb) + header_length,
 922              packet->data_size)) {
 923                 req->req.error = RAW1394_ERROR_MEMFAULT;
 924                 req->req.length = 0;
 925                 queue_complete_req(req);
 926                 return sizeof(struct raw1394_request);
 927         }
 928
 929         packet->type = hpsb_async;
 930         packet->node_id = packet->header[0] >> 16;
 931         packet->tcode = (packet->header[0] >> 4) & 0xf;
 932         packet->tlabel = (packet->header[0] >> 10) & 0x3f;
 933         packet->host = fi->host;
 934         packet->expect_response = expect_response;
 935         packet->header_size = header_length;
 936         packet->data_size = req->req.length - header_length;
 937
 938         req->req.length = 0;
 939         hpsb_set_packet_complete_task(packet,
 940                                       (void (*)(void *))queue_complete_cb, req);
 941
 942         spin_lock_irqsave(&fi->reqlists_lock, flags);
 943         list_add_tail(&req->list, &fi->req_pending);
 944         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 945
 946         /* Update the generation of the packet just before sending. */
 947         packet->generation = req->req.generation;
 948
 949         if (hpsb_send_packet(packet) < 0) {
 950                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 951                 queue_complete_req(req);
 952         }
 953
 954         return sizeof(struct raw1394_request);
 955 }
 956
 957 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
 958                     u64 addr, size_t length, u16 flags)
 959 {
 960         unsigned long irqflags;
 961         struct pending_request *req;
 962         struct host_info *hi;
 963         struct file_info *fi = NULL;
 964         struct list_head *entry;
 965         struct arm_addr *arm_addr = NULL;
 966         struct arm_request *arm_req = NULL;
 967         struct arm_response *arm_resp = NULL;
 968         int found = 0, size = 0, rcode = -1;
 969         struct arm_request_response *arm_req_resp = NULL;
 970
 971         DBGMSG("arm_read  called by node: %X"
 972                "addr: %4.4x %8.8x length: %Zu", nodeid,
 973                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
 974                length);
 975         spin_lock_irqsave(&host_info_lock, irqflags);
 976         hi = find_host_info(host);      /* search address-entry */
 977         if (hi != NULL) {
 978                 list_for_each_entry(fi, &hi->file_info_list, list) {
 979                         entry = fi->addr_list.next;
 980                         while (entry != &(fi->addr_list)) {
 981                                 arm_addr =
 982                                     list_entry(entry, struct arm_addr,
 983                                                addr_list);
 984                                 if (((arm_addr->start) <= (addr))
 985                                     && ((arm_addr->end) >= (addr + length))) {
 986                                         found = 1;
 987                                         break;
 988                                 }
 989                                 entry = entry->next;
 990                         }
 991                         if (found) {
 992                                 break;
 993                         }
 994                 }
 995         }
 996         rcode = -1;
 997         if (!found) {
 998                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
 999                        " -> rcode_address_error\n");
1000                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1001                 return (RCODE_ADDRESS_ERROR);
1002         } else {
1003                 DBGMSG("arm_read addr_entry FOUND");
1004         }
1005         if (arm_addr->rec_length < length) {
1006                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
1007                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1008         }
1009         if (rcode == -1) {
1010                 if (arm_addr->access_rights & ARM_READ) {
1011                         if (!(arm_addr->client_transactions & ARM_READ)) {
1012                                 memcpy(buffer,
1013                                        (arm_addr->addr_space_buffer) + (addr -
1014                                                                         (arm_addr->
1015                                                                          start)),
1016                                        length);
1017                                 DBGMSG("arm_read -> (rcode_complete)");
1018                                 rcode = RCODE_COMPLETE;
1019                         }
1020                 } else {
1021                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1022                         DBGMSG("arm_read -> rcode_type_error (access denied)");
1023                 }
1024         }
1025         if (arm_addr->notification_options & ARM_READ) {
1026                 DBGMSG("arm_read -> entering notification-section");
1027                 req = __alloc_pending_request(SLAB_ATOMIC);
1028                 if (!req) {
1029                         DBGMSG("arm_read -> rcode_conflict_error");
1030                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1031                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1032                                                            The request may be retried */
1033                 }
1034                 if (rcode == RCODE_COMPLETE) {
1035                         size =
1036                             sizeof(struct arm_request) +
1037                             sizeof(struct arm_response) +
1038                             length * sizeof(byte_t) +
1039                             sizeof(struct arm_request_response);
1040                 } else {
1041                         size =
1042                             sizeof(struct arm_request) +
1043                             sizeof(struct arm_response) +
1044                             sizeof(struct arm_request_response);
1045                 }
1046                 req->data = kmalloc(size, SLAB_ATOMIC);
1047                 if (!(req->data)) {
1048                         free_pending_request(req);
1049                         DBGMSG("arm_read -> rcode_conflict_error");
1050                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1051                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1052                                                            The request may be retried */
1053                 }
1054                 req->free_data = 1;
1055                 req->file_info = fi;
1056                 req->req.type = RAW1394_REQ_ARM;
1057                 req->req.generation = get_hpsb_generation(host);
1058                 req->req.misc =
1059                     (((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
1060                 req->req.tag = arm_addr->arm_tag;
1061                 req->req.recvb = arm_addr->recvb;
1062                 req->req.length = size;
1063                 arm_req_resp = (struct arm_request_response *)(req->data);
1064                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1065                                                  (sizeof
1066                                                   (struct
1067                                                    arm_request_response)));
1068                 arm_resp =
1069                     (struct arm_response *)((byte_t *) (arm_req) +
1070                                             (sizeof(struct arm_request)));
1071                 arm_req->buffer = NULL;
1072                 arm_resp->buffer = NULL;
1073                 if (rcode == RCODE_COMPLETE) {
1074                         byte_t *buf =
1075                             (byte_t *) arm_resp + sizeof(struct arm_response);
1076                         memcpy(buf,
1077                                (arm_addr->addr_space_buffer) + (addr -
1078                                                                 (arm_addr->
1079                                                                  start)),
1080                                length);
1081                         arm_resp->buffer =
1082                             int2ptr((arm_addr->recvb) +
1083                                     sizeof(struct arm_request_response) +
1084                                     sizeof(struct arm_request) +
1085                                     sizeof(struct arm_response));
1086                 }
1087                 arm_resp->buffer_length =
1088                     (rcode == RCODE_COMPLETE) ? length : 0;
1089                 arm_resp->response_code = rcode;
1090                 arm_req->buffer_length = 0;
1091                 arm_req->generation = req->req.generation;
1092                 arm_req->extended_transaction_code = 0;
1093                 arm_req->destination_offset = addr;
1094                 arm_req->source_nodeid = nodeid;
1095                 arm_req->destination_nodeid = host->node_id;
1096                 arm_req->tlabel = (flags >> 10) & 0x3f;
1097                 arm_req->tcode = (flags >> 4) & 0x0f;
1098                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1099                                                 sizeof(struct
1100                                                        arm_request_response));
1101                 arm_req_resp->response =
1102                     int2ptr((arm_addr->recvb) +
1103                             sizeof(struct arm_request_response) +
1104                             sizeof(struct arm_request));
1105                 queue_complete_req(req);
1106         }
1107         spin_unlock_irqrestore(&host_info_lock, irqflags);
1108         return (rcode);
1109 }
1110
1111 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
1112                      quadlet_t * data, u64 addr, size_t length, u16 flags)
1113 {
1114         unsigned long irqflags;
1115         struct pending_request *req;
1116         struct host_info *hi;
1117         struct file_info *fi = NULL;
1118         struct list_head *entry;
1119         struct arm_addr *arm_addr = NULL;
1120         struct arm_request *arm_req = NULL;
1121         struct arm_response *arm_resp = NULL;
1122         int found = 0, size = 0, rcode = -1, length_conflict = 0;
1123         struct arm_request_response *arm_req_resp = NULL;
1124
1125         DBGMSG("arm_write called by node: %X"
1126                "addr: %4.4x %8.8x length: %Zu", nodeid,
1127                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1128                length);
1129         spin_lock_irqsave(&host_info_lock, irqflags);
1130         hi = find_host_info(host);      /* search address-entry */
1131         if (hi != NULL) {
1132                 list_for_each_entry(fi, &hi->file_info_list, list) {
1133                         entry = fi->addr_list.next;
1134                         while (entry != &(fi->addr_list)) {
1135                                 arm_addr =
1136                                     list_entry(entry, struct arm_addr,
1137                                                addr_list);
1138                                 if (((arm_addr->start) <= (addr))
1139                                     && ((arm_addr->end) >= (addr + length))) {
1140                                         found = 1;
1141                                         break;
1142                                 }
1143                                 entry = entry->next;
1144                         }
1145                         if (found) {
1146                                 break;
1147                         }
1148                 }
1149         }
1150         rcode = -1;
1151         if (!found) {
1152                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1153                        " -> rcode_address_error\n");
1154                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1155                 return (RCODE_ADDRESS_ERROR);
1156         } else {
1157                 DBGMSG("arm_write addr_entry FOUND");
1158         }
1159         if (arm_addr->rec_length < length) {
1160                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1161                 length_conflict = 1;
1162                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1163         }
1164         if (rcode == -1) {
1165                 if (arm_addr->access_rights & ARM_WRITE) {
1166                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1167                                 memcpy((arm_addr->addr_space_buffer) +
1168                                        (addr - (arm_addr->start)), data,
1169                                        length);
1170                                 DBGMSG("arm_write -> (rcode_complete)");
1171                                 rcode = RCODE_COMPLETE;
1172                         }
1173                 } else {
1174                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1175                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1176                 }
1177         }
1178         if (arm_addr->notification_options & ARM_WRITE) {
1179                 DBGMSG("arm_write -> entering notification-section");
1180                 req = __alloc_pending_request(SLAB_ATOMIC);
1181                 if (!req) {
1182                         DBGMSG("arm_write -> rcode_conflict_error");
1183                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1184                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1185                                                            The request my be retried */
1186                 }
1187                 size =
1188                     sizeof(struct arm_request) + sizeof(struct arm_response) +
1189                     (length) * sizeof(byte_t) +
1190                     sizeof(struct arm_request_response);
1191                 req->data = kmalloc(size, SLAB_ATOMIC);
1192                 if (!(req->data)) {
1193                         free_pending_request(req);
1194                         DBGMSG("arm_write -> rcode_conflict_error");
1195                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1196                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1197                                                            The request may be retried */
1198                 }
1199                 req->free_data = 1;
1200                 req->file_info = fi;
1201                 req->req.type = RAW1394_REQ_ARM;
1202                 req->req.generation = get_hpsb_generation(host);
1203                 req->req.misc =
1204                     (((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1205                 req->req.tag = arm_addr->arm_tag;
1206                 req->req.recvb = arm_addr->recvb;
1207                 req->req.length = size;
1208                 arm_req_resp = (struct arm_request_response *)(req->data);
1209                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1210                                                  (sizeof
1211                                                   (struct
1212                                                    arm_request_response)));
1213                 arm_resp =
1214                     (struct arm_response *)((byte_t *) (arm_req) +
1215                                             (sizeof(struct arm_request)));
1216                 arm_resp->buffer = NULL;
1217                 memcpy((byte_t *) arm_resp + sizeof(struct arm_response),
1218                        data, length);
1219                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1220                                           sizeof(struct arm_request_response) +
1221                                           sizeof(struct arm_request) +
1222                                           sizeof(struct arm_response));
1223                 arm_req->buffer_length = length;
1224                 arm_req->generation = req->req.generation;
1225                 arm_req->extended_transaction_code = 0;
1226                 arm_req->destination_offset = addr;
1227                 arm_req->source_nodeid = nodeid;
1228                 arm_req->destination_nodeid = destid;
1229                 arm_req->tlabel = (flags >> 10) & 0x3f;
1230                 arm_req->tcode = (flags >> 4) & 0x0f;
1231                 arm_resp->buffer_length = 0;
1232                 arm_resp->response_code = rcode;
1233                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1234                                                 sizeof(struct
1235                                                        arm_request_response));
1236                 arm_req_resp->response =
1237                     int2ptr((arm_addr->recvb) +
1238                             sizeof(struct arm_request_response) +
1239                             sizeof(struct arm_request));
1240                 queue_complete_req(req);
1241         }
1242         spin_unlock_irqrestore(&host_info_lock, irqflags);
1243         return (rcode);
1244 }
1245
1246 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
1247                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
1248                     u16 flags)
1249 {
1250         unsigned long irqflags;
1251         struct pending_request *req;
1252         struct host_info *hi;
1253         struct file_info *fi = NULL;
1254         struct list_head *entry;
1255         struct arm_addr *arm_addr = NULL;
1256         struct arm_request *arm_req = NULL;
1257         struct arm_response *arm_resp = NULL;
1258         int found = 0, size = 0, rcode = -1;
1259         quadlet_t old, new;
1260         struct arm_request_response *arm_req_resp = NULL;
1261
1262         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1263             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1264                 DBGMSG("arm_lock  called by node: %X "
1265                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1266                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1267                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1268                        be32_to_cpu(data));
1269         } else {
1270                 DBGMSG("arm_lock  called by node: %X "
1271                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1272                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1273                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1274                        be32_to_cpu(data), be32_to_cpu(arg));
1275         }
1276         spin_lock_irqsave(&host_info_lock, irqflags);
1277         hi = find_host_info(host);      /* search address-entry */
1278         if (hi != NULL) {
1279                 list_for_each_entry(fi, &hi->file_info_list, list) {
1280                         entry = fi->addr_list.next;
1281                         while (entry != &(fi->addr_list)) {
1282                                 arm_addr =
1283                                     list_entry(entry, struct arm_addr,
1284                                                addr_list);
1285                                 if (((arm_addr->start) <= (addr))
1286                                     && ((arm_addr->end) >=
1287                                         (addr + sizeof(*store)))) {
1288                                         found = 1;
1289                                         break;
1290                                 }
1291                                 entry = entry->next;
1292                         }
1293                         if (found) {
1294                                 break;
1295                         }
1296                 }
1297         }
1298         rcode = -1;
1299         if (!found) {
1300                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1301                        " -> rcode_address_error\n");
1302                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1303                 return (RCODE_ADDRESS_ERROR);
1304         } else {
1305                 DBGMSG("arm_lock addr_entry FOUND");
1306         }
1307         if (rcode == -1) {
1308                 if (arm_addr->access_rights & ARM_LOCK) {
1309                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1310                                 memcpy(&old,
1311                                        (arm_addr->addr_space_buffer) + (addr -
1312                                                                         (arm_addr->
1313                                                                          start)),
1314                                        sizeof(old));
1315                                 switch (ext_tcode) {
1316                                 case (EXTCODE_MASK_SWAP):
1317                                         new = data | (old & ~arg);
1318                                         break;
1319                                 case (EXTCODE_COMPARE_SWAP):
1320                                         if (old == arg) {
1321                                                 new = data;
1322                                         } else {
1323                                                 new = old;
1324                                         }
1325                                         break;
1326                                 case (EXTCODE_FETCH_ADD):
1327                                         new =
1328                                             cpu_to_be32(be32_to_cpu(data) +
1329                                                         be32_to_cpu(old));
1330                                         break;
1331                                 case (EXTCODE_LITTLE_ADD):
1332                                         new =
1333                                             cpu_to_le32(le32_to_cpu(data) +
1334                                                         le32_to_cpu(old));
1335                                         break;
1336                                 case (EXTCODE_BOUNDED_ADD):
1337                                         if (old != arg) {
1338                                                 new =
1339                                                     cpu_to_be32(be32_to_cpu
1340                                                                 (data) +
1341                                                                 be32_to_cpu
1342                                                                 (old));
1343                                         } else {
1344                                                 new = old;
1345                                         }
1346                                         break;
1347                                 case (EXTCODE_WRAP_ADD):
1348                                         if (old != arg) {
1349                                                 new =
1350                                                     cpu_to_be32(be32_to_cpu
1351                                                                 (data) +
1352                                                                 be32_to_cpu
1353                                                                 (old));
1354                                         } else {
1355                                                 new = data;
1356                                         }
1357                                         break;
1358                                 default:
1359                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1360                                         printk(KERN_ERR
1361                                                "raw1394: arm_lock FAILED "
1362                                                "ext_tcode not allowed -> rcode_type_error\n");
1363                                         break;
1364                                 }       /*switch */
1365                                 if (rcode == -1) {
1366                                         DBGMSG("arm_lock -> (rcode_complete)");
1367                                         rcode = RCODE_COMPLETE;
1368                                         memcpy(store, &old, sizeof(*store));
1369                                         memcpy((arm_addr->addr_space_buffer) +
1370                                                (addr - (arm_addr->start)),
1371                                                &new, sizeof(*store));
1372                                 }
1373                         }
1374                 } else {
1375                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1376                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1377                 }
1378         }
1379         if (arm_addr->notification_options & ARM_LOCK) {
1380                 byte_t *buf1, *buf2;
1381                 DBGMSG("arm_lock -> entering notification-section");
1382                 req = __alloc_pending_request(SLAB_ATOMIC);
1383                 if (!req) {
1384                         DBGMSG("arm_lock -> rcode_conflict_error");
1385                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1386                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1387                                                            The request may be retried */
1388                 }
1389                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1390                 req->data = kmalloc(size, SLAB_ATOMIC);
1391                 if (!(req->data)) {
1392                         free_pending_request(req);
1393                         DBGMSG("arm_lock -> rcode_conflict_error");
1394                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1395                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1396                                                            The request may be retried */
1397                 }
1398                 req->free_data = 1;
1399                 arm_req_resp = (struct arm_request_response *)(req->data);
1400                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1401                                                  (sizeof
1402                                                   (struct
1403                                                    arm_request_response)));
1404                 arm_resp =
1405                     (struct arm_response *)((byte_t *) (arm_req) +
1406                                             (sizeof(struct arm_request)));
1407                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1408                 buf2 = buf1 + 2 * sizeof(*store);
1409                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1410                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1411                         arm_req->buffer_length = sizeof(*store);
1412                         memcpy(buf1, &data, sizeof(*store));
1413
1414                 } else {
1415                         arm_req->buffer_length = 2 * sizeof(*store);
1416                         memcpy(buf1, &arg, sizeof(*store));
1417                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1418                 }
1419                 if (rcode == RCODE_COMPLETE) {
1420                         arm_resp->buffer_length = sizeof(*store);
1421                         memcpy(buf2, &old, sizeof(*store));
1422                 } else {
1423                         arm_resp->buffer_length = 0;
1424                 }
1425                 req->file_info = fi;
1426                 req->req.type = RAW1394_REQ_ARM;
1427                 req->req.generation = get_hpsb_generation(host);
1428                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1429                                  (ARM_LOCK & 0xFF));
1430                 req->req.tag = arm_addr->arm_tag;
1431                 req->req.recvb = arm_addr->recvb;
1432                 req->req.length = size;
1433                 arm_req->generation = req->req.generation;
1434                 arm_req->extended_transaction_code = ext_tcode;
1435                 arm_req->destination_offset = addr;
1436                 arm_req->source_nodeid = nodeid;
1437                 arm_req->destination_nodeid = host->node_id;
1438                 arm_req->tlabel = (flags >> 10) & 0x3f;
1439                 arm_req->tcode = (flags >> 4) & 0x0f;
1440                 arm_resp->response_code = rcode;
1441                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1442                                                 sizeof(struct
1443                                                        arm_request_response));
1444                 arm_req_resp->response =
1445                     int2ptr((arm_addr->recvb) +
1446                             sizeof(struct arm_request_response) +
1447                             sizeof(struct arm_request));
1448                 arm_req->buffer =
1449                     int2ptr((arm_addr->recvb) +
1450                             sizeof(struct arm_request_response) +
1451                             sizeof(struct arm_request) +
1452                             sizeof(struct arm_response));
1453                 arm_resp->buffer =
1454                     int2ptr((arm_addr->recvb) +
1455                             sizeof(struct arm_request_response) +
1456                             sizeof(struct arm_request) +
1457                             sizeof(struct arm_response) + 2 * sizeof(*store));
1458                 queue_complete_req(req);
1459         }
1460         spin_unlock_irqrestore(&host_info_lock, irqflags);
1461         return (rcode);
1462 }
1463
1464 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
1465                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
1466                       u16 flags)
1467 {
1468         unsigned long irqflags;
1469         struct pending_request *req;
1470         struct host_info *hi;
1471         struct file_info *fi = NULL;
1472         struct list_head *entry;
1473         struct arm_addr *arm_addr = NULL;
1474         struct arm_request *arm_req = NULL;
1475         struct arm_response *arm_resp = NULL;
1476         int found = 0, size = 0, rcode = -1;
1477         octlet_t old, new;
1478         struct arm_request_response *arm_req_resp = NULL;
1479
1480         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1481             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1482                 DBGMSG("arm_lock64 called by node: %X "
1483                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1484                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1485                        (u32) (addr & 0xFFFFFFFF),
1486                        ext_tcode & 0xFF,
1487                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1488                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1489         } else {
1490                 DBGMSG("arm_lock64 called by node: %X "
1491                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1492                        "%8.8X %8.8X ",
1493                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1494                        (u32) (addr & 0xFFFFFFFF),
1495                        ext_tcode & 0xFF,
1496                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1497                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1498                        (u32) ((be64_to_cpu(arg) >> 32) & 0xFFFFFFFF),
1499                        (u32) (be64_to_cpu(arg) & 0xFFFFFFFF));
1500         }
1501         spin_lock_irqsave(&host_info_lock, irqflags);
1502         hi = find_host_info(host);      /* search addressentry in file_info's for host */
1503         if (hi != NULL) {
1504                 list_for_each_entry(fi, &hi->file_info_list, list) {
1505                         entry = fi->addr_list.next;
1506                         while (entry != &(fi->addr_list)) {
1507                                 arm_addr =
1508                                     list_entry(entry, struct arm_addr,
1509                                                addr_list);
1510                                 if (((arm_addr->start) <= (addr))
1511                                     && ((arm_addr->end) >=
1512                                         (addr + sizeof(*store)))) {
1513                                         found = 1;
1514                                         break;
1515                                 }
1516                                 entry = entry->next;
1517                         }
1518                         if (found) {
1519                                 break;
1520                         }
1521                 }
1522         }
1523         rcode = -1;
1524         if (!found) {
1525                 printk(KERN_ERR
1526                        "raw1394: arm_lock64 FAILED addr_entry not found"
1527                        " -> rcode_address_error\n");
1528                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1529                 return (RCODE_ADDRESS_ERROR);
1530         } else {
1531                 DBGMSG("arm_lock64 addr_entry FOUND");
1532         }
1533         if (rcode == -1) {
1534                 if (arm_addr->access_rights & ARM_LOCK) {
1535                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1536                                 memcpy(&old,
1537                                        (arm_addr->addr_space_buffer) + (addr -
1538                                                                         (arm_addr->
1539                                                                          start)),
1540                                        sizeof(old));
1541                                 switch (ext_tcode) {
1542                                 case (EXTCODE_MASK_SWAP):
1543                                         new = data | (old & ~arg);
1544                                         break;
1545                                 case (EXTCODE_COMPARE_SWAP):
1546                                         if (old == arg) {
1547                                                 new = data;
1548                                         } else {
1549                                                 new = old;
1550                                         }
1551                                         break;
1552                                 case (EXTCODE_FETCH_ADD):
1553                                         new =
1554                                             cpu_to_be64(be64_to_cpu(data) +
1555                                                         be64_to_cpu(old));
1556                                         break;
1557                                 case (EXTCODE_LITTLE_ADD):
1558                                         new =
1559                                             cpu_to_le64(le64_to_cpu(data) +
1560                                                         le64_to_cpu(old));
1561                                         break;
1562                                 case (EXTCODE_BOUNDED_ADD):
1563                                         if (old != arg) {
1564                                                 new =
1565                                                     cpu_to_be64(be64_to_cpu
1566                                                                 (data) +
1567                                                                 be64_to_cpu
1568                                                                 (old));
1569                                         } else {
1570                                                 new = old;
1571                                         }
1572                                         break;
1573                                 case (EXTCODE_WRAP_ADD):
1574                                         if (old != arg) {
1575                                                 new =
1576                                                     cpu_to_be64(be64_to_cpu
1577                                                                 (data) +
1578                                                                 be64_to_cpu
1579                                                                 (old));
1580                                         } else {
1581                                                 new = data;
1582                                         }
1583                                         break;
1584                                 default:
1585                                         printk(KERN_ERR
1586                                                "raw1394: arm_lock64 FAILED "
1587                                                "ext_tcode not allowed -> rcode_type_error\n");
1588                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1589                                         break;
1590                                 }       /*switch */
1591                                 if (rcode == -1) {
1592                                         DBGMSG
1593                                             ("arm_lock64 -> (rcode_complete)");
1594                                         rcode = RCODE_COMPLETE;
1595                                         memcpy(store, &old, sizeof(*store));
1596                                         memcpy((arm_addr->addr_space_buffer) +
1597                                                (addr - (arm_addr->start)),
1598                                                &new, sizeof(*store));
1599                                 }
1600                         }
1601                 } else {
1602                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1603                         DBGMSG
1604                             ("arm_lock64 -> rcode_type_error (access denied)");
1605                 }
1606         }
1607         if (arm_addr->notification_options & ARM_LOCK) {
1608                 byte_t *buf1, *buf2;
1609                 DBGMSG("arm_lock64 -> entering notification-section");
1610                 req = __alloc_pending_request(SLAB_ATOMIC);
1611                 if (!req) {
1612                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1613                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1614                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1615                                                            The request may be retried */
1616                 }
1617                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1618                 req->data = kmalloc(size, SLAB_ATOMIC);
1619                 if (!(req->data)) {
1620                         free_pending_request(req);
1621                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1622                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1623                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1624                                                            The request may be retried */
1625                 }
1626                 req->free_data = 1;
1627                 arm_req_resp = (struct arm_request_response *)(req->data);
1628                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1629                                                  (sizeof
1630                                                   (struct
1631                                                    arm_request_response)));
1632                 arm_resp =
1633                     (struct arm_response *)((byte_t *) (arm_req) +
1634                                             (sizeof(struct arm_request)));
1635                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1636                 buf2 = buf1 + 2 * sizeof(*store);
1637                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1638                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1639                         arm_req->buffer_length = sizeof(*store);
1640                         memcpy(buf1, &data, sizeof(*store));
1641
1642                 } else {
1643                         arm_req->buffer_length = 2 * sizeof(*store);
1644                         memcpy(buf1, &arg, sizeof(*store));
1645                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1646                 }
1647                 if (rcode == RCODE_COMPLETE) {
1648                         arm_resp->buffer_length = sizeof(*store);
1649                         memcpy(buf2, &old, sizeof(*store));
1650                 } else {
1651                         arm_resp->buffer_length = 0;
1652                 }
1653                 req->file_info = fi;
1654                 req->req.type = RAW1394_REQ_ARM;
1655                 req->req.generation = get_hpsb_generation(host);
1656                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1657                                  (ARM_LOCK & 0xFF));
1658                 req->req.tag = arm_addr->arm_tag;
1659                 req->req.recvb = arm_addr->recvb;
1660                 req->req.length = size;
1661                 arm_req->generation = req->req.generation;
1662                 arm_req->extended_transaction_code = ext_tcode;
1663                 arm_req->destination_offset = addr;
1664                 arm_req->source_nodeid = nodeid;
1665                 arm_req->destination_nodeid = host->node_id;
1666                 arm_req->tlabel = (flags >> 10) & 0x3f;
1667                 arm_req->tcode = (flags >> 4) & 0x0f;
1668                 arm_resp->response_code = rcode;
1669                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1670                                                 sizeof(struct
1671                                                        arm_request_response));
1672                 arm_req_resp->response =
1673                     int2ptr((arm_addr->recvb) +
1674                             sizeof(struct arm_request_response) +
1675                             sizeof(struct arm_request));
1676                 arm_req->buffer =
1677                     int2ptr((arm_addr->recvb) +
1678                             sizeof(struct arm_request_response) +
1679                             sizeof(struct arm_request) +
1680                             sizeof(struct arm_response));
1681                 arm_resp->buffer =
1682                     int2ptr((arm_addr->recvb) +
1683                             sizeof(struct arm_request_response) +
1684                             sizeof(struct arm_request) +
1685                             sizeof(struct arm_response) + 2 * sizeof(*store));
1686                 queue_complete_req(req);
1687         }
1688         spin_unlock_irqrestore(&host_info_lock, irqflags);
1689         return (rcode);
1690 }
1691
1692 static int arm_register(struct file_info *fi, struct pending_request *req)
1693 {
1694         int retval;
1695         struct arm_addr *addr;
1696         struct host_info *hi;
1697         struct file_info *fi_hlp = NULL;
1698         struct list_head *entry;
1699         struct arm_addr *arm_addr = NULL;
1700         int same_host, another_host;
1701         unsigned long flags;
1702
1703         DBGMSG("arm_register called "
1704                "addr(Offset): %8.8x %8.8x length: %u "
1705                "rights: %2.2X notify: %2.2X "
1706                "max_blk_len: %4.4X",
1707                (u32) ((req->req.address >> 32) & 0xFFFF),
1708                (u32) (req->req.address & 0xFFFFFFFF),
1709                req->req.length, ((req->req.misc >> 8) & 0xFF),
1710                (req->req.misc & 0xFF), ((req->req.misc >> 16) & 0xFFFF));
1711         /* check addressrange */
1712         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1713             (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) !=
1714              0)) {
1715                 req->req.length = 0;
1716                 return (-EINVAL);
1717         }
1718         /* addr-list-entry for fileinfo */
1719         addr = kmalloc(sizeof(*addr), SLAB_KERNEL);
1720         if (!addr) {
1721                 req->req.length = 0;
1722                 return (-ENOMEM);
1723         }
1724         /* allocation of addr_space_buffer */
1725         addr->addr_space_buffer = vmalloc(req->req.length);
1726         if (!(addr->addr_space_buffer)) {
1727                 kfree(addr);
1728                 req->req.length = 0;
1729                 return (-ENOMEM);
1730         }
1731         /* initialization of addr_space_buffer */
1732         if ((req->req.sendb) == (unsigned long)NULL) {
1733                 /* init: set 0 */
1734                 memset(addr->addr_space_buffer, 0, req->req.length);
1735         } else {
1736                 /* init: user -> kernel */
1737                 if (copy_from_user
1738                     (addr->addr_space_buffer, int2ptr(req->req.sendb),
1739                      req->req.length)) {
1740                         vfree(addr->addr_space_buffer);
1741                         kfree(addr);
1742                         return (-EFAULT);
1743                 }
1744         }
1745         INIT_LIST_HEAD(&addr->addr_list);
1746         addr->arm_tag = req->req.tag;
1747         addr->start = req->req.address;
1748         addr->end = req->req.address + req->req.length;
1749         addr->access_rights = (u8) (req->req.misc & 0x0F);
1750         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1751         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1752         addr->access_rights |= addr->client_transactions;
1753         addr->notification_options |= addr->client_transactions;
1754         addr->recvb = req->req.recvb;
1755         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1756         spin_lock_irqsave(&host_info_lock, flags);
1757         hi = find_host_info(fi->host);
1758         same_host = 0;
1759         another_host = 0;
1760         /* same host with address-entry containing same addressrange ? */
1761         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1762                 entry = fi_hlp->addr_list.next;
1763                 while (entry != &(fi_hlp->addr_list)) {
1764                         arm_addr =
1765                             list_entry(entry, struct arm_addr, addr_list);
1766                         if ((arm_addr->start == addr->start)
1767                             && (arm_addr->end == addr->end)) {
1768                                 DBGMSG("same host ownes same "
1769                                        "addressrange -> EALREADY");
1770                                 same_host = 1;
1771                                 break;
1772                         }
1773                         entry = entry->next;
1774                 }
1775                 if (same_host) {
1776                         break;
1777                 }
1778         }
1779         if (same_host) {
1780                 /* addressrange occupied by same host */
1781                 vfree(addr->addr_space_buffer);
1782                 kfree(addr);
1783                 spin_unlock_irqrestore(&host_info_lock, flags);
1784                 return (-EALREADY);
1785         }
1786         /* another host with valid address-entry containing same addressrange */
1787         list_for_each_entry(hi, &host_info_list, list) {
1788                 if (hi->host != fi->host) {
1789                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1790                                 entry = fi_hlp->addr_list.next;
1791                                 while (entry != &(fi_hlp->addr_list)) {
1792                                         arm_addr =
1793                                             list_entry(entry, struct arm_addr,
1794                                                        addr_list);
1795                                         if ((arm_addr->start == addr->start)
1796                                             && (arm_addr->end == addr->end)) {
1797                                                 DBGMSG
1798                                                     ("another host ownes same "
1799                                                      "addressrange");
1800                                                 another_host = 1;
1801                                                 break;
1802                                         }
1803                                         entry = entry->next;
1804                                 }
1805                                 if (another_host) {
1806                                         break;
1807                                 }
1808                         }
1809                 }
1810         }
1811         if (another_host) {
1812                 DBGMSG("another hosts entry is valid -> SUCCESS");
1813                 if (copy_to_user(int2ptr(req->req.recvb),
1814                                  &addr->start, sizeof(u64))) {
1815                         printk(KERN_ERR "raw1394: arm_register failed "
1816                                " address-range-entry is invalid -> EFAULT !!!\n");
1817                         vfree(addr->addr_space_buffer);
1818                         kfree(addr);
1819                         spin_unlock_irqrestore(&host_info_lock, flags);
1820                         return (-EFAULT);
1821                 }
1822                 free_pending_request(req);      /* immediate success or fail */
1823                 /* INSERT ENTRY */
1824                 list_add_tail(&addr->addr_list, &fi->addr_list);
1825                 spin_unlock_irqrestore(&host_info_lock, flags);
1826                 return sizeof(struct raw1394_request);
1827         }
1828         retval =
1829             hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
1830                                     req->req.address,
1831                                     req->req.address + req->req.length);
1832         if (retval) {
1833                 /* INSERT ENTRY */
1834                 list_add_tail(&addr->addr_list, &fi->addr_list);
1835         } else {
1836                 DBGMSG("arm_register failed errno: %d \n", retval);
1837                 vfree(addr->addr_space_buffer);
1838                 kfree(addr);
1839                 spin_unlock_irqrestore(&host_info_lock, flags);
1840                 return (-EALREADY);
1841         }
1842         spin_unlock_irqrestore(&host_info_lock, flags);
1843         free_pending_request(req);      /* immediate success or fail */
1844         return sizeof(struct raw1394_request);
1845 }
1846
1847 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1848 {
1849         int found = 0;
1850         int retval = 0;
1851         struct list_head *entry;
1852         struct arm_addr *addr = NULL;
1853         struct host_info *hi;
1854         struct file_info *fi_hlp = NULL;
1855         struct arm_addr *arm_addr = NULL;
1856         int another_host;
1857         unsigned long flags;
1858
1859         DBGMSG("arm_Unregister called addr(Offset): "
1860                "%8.8x %8.8x",
1861                (u32) ((req->req.address >> 32) & 0xFFFF),
1862                (u32) (req->req.address & 0xFFFFFFFF));
1863         spin_lock_irqsave(&host_info_lock, flags);
1864         /* get addr */
1865         entry = fi->addr_list.next;
1866         while (entry != &(fi->addr_list)) {
1867                 addr = list_entry(entry, struct arm_addr, addr_list);
1868                 if (addr->start == req->req.address) {
1869                         found = 1;
1870                         break;
1871                 }
1872                 entry = entry->next;
1873         }
1874         if (!found) {
1875                 DBGMSG("arm_Unregister addr not found");
1876                 spin_unlock_irqrestore(&host_info_lock, flags);
1877                 return (-EINVAL);
1878         }
1879         DBGMSG("arm_Unregister addr found");
1880         another_host = 0;
1881         /* another host with valid address-entry containing
1882            same addressrange */
1883         list_for_each_entry(hi, &host_info_list, list) {
1884                 if (hi->host != fi->host) {
1885                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1886                                 entry = fi_hlp->addr_list.next;
1887                                 while (entry != &(fi_hlp->addr_list)) {
1888                                         arm_addr = list_entry(entry,
1889                                                               struct arm_addr,
1890                                                               addr_list);
1891                                         if (arm_addr->start == addr->start) {
1892                                                 DBGMSG("another host ownes "
1893                                                        "same addressrange");
1894                                                 another_host = 1;
1895                                                 break;
1896                                         }
1897                                         entry = entry->next;
1898                                 }
1899                                 if (another_host) {
1900                                         break;
1901                                 }
1902                         }
1903                 }
1904         }
1905         if (another_host) {
1906                 DBGMSG("delete entry from list -> success");
1907                 list_del(&addr->addr_list);
1908                 vfree(addr->addr_space_buffer);
1909                 kfree(addr);
1910                 free_pending_request(req);      /* immediate success or fail */
1911                 spin_unlock_irqrestore(&host_info_lock, flags);
1912                 return sizeof(struct raw1394_request);
1913         }
1914         retval =
1915             hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
1916                                       addr->start);
1917         if (!retval) {
1918                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1919                 spin_unlock_irqrestore(&host_info_lock, flags);
1920                 return (-EINVAL);
1921         }
1922         DBGMSG("delete entry from list -> success");
1923         list_del(&addr->addr_list);
1924         spin_unlock_irqrestore(&host_info_lock, flags);
1925         vfree(addr->addr_space_buffer);
1926         kfree(addr);
1927         free_pending_request(req);      /* immediate success or fail */
1928         return sizeof(struct raw1394_request);
1929 }
1930
1931 /* Copy data from ARM buffer(s) to user buffer. */
1932 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1933 {
1934         struct arm_addr *arm_addr = NULL;
1935         unsigned long flags;
1936         unsigned long offset;
1937
1938         struct list_head *entry;
1939
1940         DBGMSG("arm_get_buf "
1941                "addr(Offset): %04X %08X length: %u",
1942                (u32) ((req->req.address >> 32) & 0xFFFF),
1943                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1944
1945         spin_lock_irqsave(&host_info_lock, flags);
1946         entry = fi->addr_list.next;
1947         while (entry != &(fi->addr_list)) {
1948                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1949                 if ((arm_addr->start <= req->req.address) &&
1950                     (arm_addr->end > req->req.address)) {
1951                         if (req->req.address + req->req.length <= arm_addr->end) {
1952                                 offset = req->req.address - arm_addr->start;
1953
1954                                 DBGMSG
1955                                     ("arm_get_buf copy_to_user( %08X, %p, %u )",
1956                                      (u32) req->req.recvb,
1957                                      arm_addr->addr_space_buffer + offset,
1958                                      (u32) req->req.length);
1959
1960                                 if (copy_to_user
1961                                     (int2ptr(req->req.recvb),
1962                                      arm_addr->addr_space_buffer + offset,
1963                                      req->req.length)) {
1964                                         spin_unlock_irqrestore(&host_info_lock,
1965                                                                flags);
1966                                         return (-EFAULT);
1967                                 }
1968
1969                                 spin_unlock_irqrestore(&host_info_lock, flags);
1970                                 /* We have to free the request, because we
1971                                  * queue no response, and therefore nobody
1972                                  * will free it. */
1973                                 free_pending_request(req);
1974                                 return sizeof(struct raw1394_request);
1975                         } else {
1976                                 DBGMSG("arm_get_buf request exceeded mapping");
1977                                 spin_unlock_irqrestore(&host_info_lock, flags);
1978                                 return (-EINVAL);
1979                         }
1980                 }
1981                 entry = entry->next;
1982         }
1983         spin_unlock_irqrestore(&host_info_lock, flags);
1984         return (-EINVAL);
1985 }
1986
1987 /* Copy data from user buffer to ARM buffer(s). */
1988 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
1989 {
1990         struct arm_addr *arm_addr = NULL;
1991         unsigned long flags;
1992         unsigned long offset;
1993
1994         struct list_head *entry;
1995
1996         DBGMSG("arm_set_buf "
1997                "addr(Offset): %04X %08X length: %u",
1998                (u32) ((req->req.address >> 32) & 0xFFFF),
1999                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
2000
2001         spin_lock_irqsave(&host_info_lock, flags);
2002         entry = fi->addr_list.next;
2003         while (entry != &(fi->addr_list)) {
2004                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
2005                 if ((arm_addr->start <= req->req.address) &&
2006                     (arm_addr->end > req->req.address)) {
2007                         if (req->req.address + req->req.length <= arm_addr->end) {
2008                                 offset = req->req.address - arm_addr->start;
2009
2010                                 DBGMSG
2011                                     ("arm_set_buf copy_from_user( %p, %08X, %u )",
2012                                      arm_addr->addr_space_buffer + offset,
2013                                      (u32) req->req.sendb,
2014                                      (u32) req->req.length);
2015
2016                                 if (copy_from_user
2017                                     (arm_addr->addr_space_buffer + offset,
2018                                      int2ptr(req->req.sendb),
2019                                      req->req.length)) {
2020                                         spin_unlock_irqrestore(&host_info_lock,
2021                                                                flags);
2022                                         return (-EFAULT);
2023                                 }
2024
2025                                 spin_unlock_irqrestore(&host_info_lock, flags);
2026                                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2027                                 return sizeof(struct raw1394_request);
2028                         } else {
2029                                 DBGMSG("arm_set_buf request exceeded mapping");
2030                                 spin_unlock_irqrestore(&host_info_lock, flags);
2031                                 return (-EINVAL);
2032                         }
2033                 }
2034                 entry = entry->next;
2035         }
2036         spin_unlock_irqrestore(&host_info_lock, flags);
2037         return (-EINVAL);
2038 }
2039
2040 static int reset_notification(struct file_info *fi, struct pending_request *req)
2041 {
2042         DBGMSG("reset_notification called - switch %s ",
2043                (req->req.misc == RAW1394_NOTIFY_OFF) ? "OFF" : "ON");
2044         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
2045             (req->req.misc == RAW1394_NOTIFY_ON)) {
2046                 fi->notification = (u8) req->req.misc;
2047                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2048                 return sizeof(struct raw1394_request);
2049         }
2050         /* error EINVAL (22) invalid argument */
2051         return (-EINVAL);
2052 }
2053
2054 static int write_phypacket(struct file_info *fi, struct pending_request *req)
2055 {
2056         struct hpsb_packet *packet = NULL;
2057         int retval = 0;
2058         quadlet_t data;
2059         unsigned long flags;
2060
2061         data = be32_to_cpu((u32) req->req.sendb);
2062         DBGMSG("write_phypacket called - quadlet 0x%8.8x ", data);
2063         packet = hpsb_make_phypacket(fi->host, data);
2064         if (!packet)
2065                 return -ENOMEM;
2066         req->req.length = 0;
2067         req->packet = packet;
2068         hpsb_set_packet_complete_task(packet,
2069                                       (void (*)(void *))queue_complete_cb, req);
2070         spin_lock_irqsave(&fi->reqlists_lock, flags);
2071         list_add_tail(&req->list, &fi->req_pending);
2072         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2073         packet->generation = req->req.generation;
2074         retval = hpsb_send_packet(packet);
2075         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
2076         if (retval < 0) {
2077                 req->req.error = RAW1394_ERROR_SEND_ERROR;
2078                 req->req.length = 0;
2079                 queue_complete_req(req);
2080         }
2081         return sizeof(struct raw1394_request);
2082 }
2083
2084 static int get_config_rom(struct file_info *fi, struct pending_request *req)
2085 {
2086         int ret = sizeof(struct raw1394_request);
2087         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2088         int status;
2089
2090         if (!data)
2091                 return -ENOMEM;
2092
2093         status =
2094             csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
2095                          data, req->req.length);
2096         if (copy_to_user(int2ptr(req->req.recvb), data, req->req.length))
2097                 ret = -EFAULT;
2098         if (copy_to_user
2099             (int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
2100              sizeof(fi->host->csr.rom->cache_head->len)))
2101                 ret = -EFAULT;
2102         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
2103                          sizeof(fi->host->csr.generation)))
2104                 ret = -EFAULT;
2105         if (copy_to_user(int2ptr(req->req.sendb), &status, sizeof(status)))
2106                 ret = -EFAULT;
2107         kfree(data);
2108         if (ret >= 0) {
2109                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2110         }
2111         return ret;
2112 }
2113
2114 static int update_config_rom(struct file_info *fi, struct pending_request *req)
2115 {
2116         int ret = sizeof(struct raw1394_request);
2117         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2118         if (!data)
2119                 return -ENOMEM;
2120         if (copy_from_user(data, int2ptr(req->req.sendb), req->req.length)) {
2121                 ret = -EFAULT;
2122         } else {
2123                 int status = hpsb_update_config_rom(fi->host,
2124                                                     data, req->req.length,
2125                                                     (unsigned char)req->req.
2126                                                     misc);
2127                 if (copy_to_user
2128                     (int2ptr(req->req.recvb), &status, sizeof(status)))
2129                         ret = -ENOMEM;
2130         }
2131         kfree(data);
2132         if (ret >= 0) {
2133                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2134                 fi->cfgrom_upd = 1;
2135         }
2136         return ret;
2137 }
2138
2139 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
2140 {
2141         struct csr1212_keyval *kv;
2142         struct csr1212_csr_rom_cache *cache;
2143         struct csr1212_dentry *dentry;
2144         u32 dr;
2145         int ret = 0;
2146
2147         if (req->req.misc == ~0) {
2148                 if (req->req.length == 0)
2149                         return -EINVAL;
2150
2151                 /* Find an unused slot */
2152                 for (dr = 0;
2153                      dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr];
2154                      dr++) ;
2155
2156                 if (dr == RAW1394_MAX_USER_CSR_DIRS)
2157                         return -ENOMEM;
2158
2159                 fi->csr1212_dirs[dr] =
2160                     csr1212_new_directory(CSR1212_KV_ID_VENDOR);
2161                 if (!fi->csr1212_dirs[dr])
2162                         return -ENOMEM;
2163         } else {
2164                 dr = req->req.misc;
2165                 if (!fi->csr1212_dirs[dr])
2166                         return -EINVAL;
2167
2168                 /* Delete old stuff */
2169                 for (dentry =
2170                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2171                      dentry; dentry = dentry->next) {
2172                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2173                                                              root_kv,
2174                                                              dentry->kv);
2175                 }
2176
2177                 if (req->req.length == 0) {
2178                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
2179                         fi->csr1212_dirs[dr] = NULL;
2180
2181                         hpsb_update_config_rom_image(fi->host);
2182                         free_pending_request(req);
2183                         return sizeof(struct raw1394_request);
2184                 }
2185         }
2186
2187         cache = csr1212_rom_cache_malloc(0, req->req.length);
2188         if (!cache) {
2189                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2190                 fi->csr1212_dirs[dr] = NULL;
2191                 return -ENOMEM;
2192         }
2193
2194         cache->filled_head = kmalloc(sizeof(*cache->filled_head), GFP_KERNEL);
2195         if (!cache->filled_head) {
2196                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2197                 fi->csr1212_dirs[dr] = NULL;
2198                 CSR1212_FREE(cache);
2199                 return -ENOMEM;
2200         }
2201         cache->filled_tail = cache->filled_head;
2202
2203         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
2204                            req->req.length)) {
2205                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2206                 fi->csr1212_dirs[dr] = NULL;
2207                 ret = -EFAULT;
2208         } else {
2209                 cache->len = req->req.length;
2210                 cache->filled_head->offset_start = 0;
2211                 cache->filled_head->offset_end = cache->size - 1;
2212
2213                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2214
2215                 ret = CSR1212_SUCCESS;
2216                 /* parse all the items */
2217                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2218                      kv = kv->next) {
2219                         ret = csr1212_parse_keyval(kv, cache);
2220                 }
2221
2222                 /* attach top level items to the root directory */
2223                 for (dentry =
2224                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2225                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2226                         ret =
2227                             csr1212_attach_keyval_to_directory(fi->host->csr.
2228                                                                rom->root_kv,
2229                                                                dentry->kv);
2230                 }
2231
2232                 if (ret == CSR1212_SUCCESS) {
2233                         ret = hpsb_update_config_rom_image(fi->host);
2234
2235                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2236                                                      &dr, sizeof(dr))) {
2237                                 ret = -ENOMEM;
2238                         }
2239                 }
2240         }
2241         kfree(cache->filled_head);
2242         CSR1212_FREE(cache);
2243
2244         if (ret >= 0) {
2245                 /* we have to free the request, because we queue no response,
2246                  * and therefore nobody will free it */
2247                 free_pending_request(req);
2248                 return sizeof(struct raw1394_request);
2249         } else {
2250                 for (dentry =
2251                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2252                      dentry; dentry = dentry->next) {
2253                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2254                                                              root_kv,
2255                                                              dentry->kv);
2256                 }
2257                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2258                 fi->csr1212_dirs[dr] = NULL;
2259                 return ret;
2260         }
2261 }
2262
2263 static int state_connected(struct file_info *fi, struct pending_request *req)
2264 {
2265         int node = req->req.address >> 48;
2266
2267         req->req.error = RAW1394_ERROR_NONE;
2268
2269         switch (req->req.type) {
2270
2271         case RAW1394_REQ_ECHO:
2272                 queue_complete_req(req);
2273                 return sizeof(struct raw1394_request);
2274
2275         case RAW1394_REQ_ISO_SEND:
2276                 return handle_iso_send(fi, req, node);
2277
2278         case RAW1394_REQ_ARM_REGISTER:
2279                 return arm_register(fi, req);
2280
2281         case RAW1394_REQ_ARM_UNREGISTER:
2282                 return arm_unregister(fi, req);
2283
2284         case RAW1394_REQ_ARM_SET_BUF:
2285                 return arm_set_buf(fi, req);
2286
2287         case RAW1394_REQ_ARM_GET_BUF:
2288                 return arm_get_buf(fi, req);
2289
2290         case RAW1394_REQ_RESET_NOTIFY:
2291                 return reset_notification(fi, req);
2292
2293         case RAW1394_REQ_ISO_LISTEN:
2294                 handle_iso_listen(fi, req);
2295                 return sizeof(struct raw1394_request);
2296
2297         case RAW1394_REQ_FCP_LISTEN:
2298                 handle_fcp_listen(fi, req);
2299                 return sizeof(struct raw1394_request);
2300
2301         case RAW1394_REQ_RESET_BUS:
2302                 if (req->req.misc == RAW1394_LONG_RESET) {
2303                         DBGMSG("busreset called (type: LONG)");
2304                         hpsb_reset_bus(fi->host, LONG_RESET);
2305                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2306                         return sizeof(struct raw1394_request);
2307                 }
2308                 if (req->req.misc == RAW1394_SHORT_RESET) {
2309                         DBGMSG("busreset called (type: SHORT)");
2310                         hpsb_reset_bus(fi->host, SHORT_RESET);
2311                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2312                         return sizeof(struct raw1394_request);
2313                 }
2314                 /* error EINVAL (22) invalid argument */
2315                 return (-EINVAL);
2316         case RAW1394_REQ_GET_ROM:
2317                 return get_config_rom(fi, req);
2318
2319         case RAW1394_REQ_UPDATE_ROM:
2320                 return update_config_rom(fi, req);
2321
2322         case RAW1394_REQ_MODIFY_ROM:
2323                 return modify_config_rom(fi, req);
2324         }
2325
2326         if (req->req.generation != get_hpsb_generation(fi->host)) {
2327                 req->req.error = RAW1394_ERROR_GENERATION;
2328                 req->req.generation = get_hpsb_generation(fi->host);
2329                 req->req.length = 0;
2330                 queue_complete_req(req);
2331                 return sizeof(struct raw1394_request);
2332         }
2333
2334         switch (req->req.type) {
2335         case RAW1394_REQ_PHYPACKET:
2336                 return write_phypacket(fi, req);
2337         case RAW1394_REQ_ASYNC_SEND:
2338                 return handle_async_send(fi, req);
2339         }
2340
2341         if (req->req.length == 0) {
2342                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2343                 queue_complete_req(req);
2344                 return sizeof(struct raw1394_request);
2345         }
2346
2347         return handle_async_request(fi, req, node);
2348 }
2349
2350 static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2351                              size_t count, loff_t * offset_is_ignored)
2352 {
2353         struct file_info *fi = (struct file_info *)file->private_data;
2354         struct pending_request *req;
2355         ssize_t retval = 0;
2356
2357 #ifdef CONFIG_COMPAT
2358         if (count == sizeof(struct compat_raw1394_req) &&
2359             sizeof(struct compat_raw1394_req) !=
2360                         sizeof(struct raw1394_request)) {
2361                 buffer = raw1394_compat_write(buffer);
2362                 if (IS_ERR(buffer))
2363                         return PTR_ERR(buffer);
2364         } else
2365 #endif
2366         if (count != sizeof(struct raw1394_request)) {
2367                 return -EINVAL;
2368         }
2369
2370         req = alloc_pending_request();
2371         if (req == NULL) {
2372                 return -ENOMEM;
2373         }
2374         req->file_info = fi;
2375
2376         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2377                 free_pending_request(req);
2378                 return -EFAULT;
2379         }
2380
2381         switch (fi->state) {
2382         case opened:
2383                 retval = state_opened(fi, req);
2384                 break;
2385
2386         case initialized:
2387                 retval = state_initialized(fi, req);
2388                 break;
2389
2390         case connected:
2391                 retval = state_connected(fi, req);
2392                 break;
2393         }
2394
2395         if (retval < 0) {
2396                 free_pending_request(req);
2397         }
2398
2399         return retval;
2400 }
2401
2402 /* rawiso operations */
2403
2404 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2405  * completion queue (reqlists_lock must be taken) */
2406 static inline int __rawiso_event_in_queue(struct file_info *fi)
2407 {
2408         struct pending_request *req;
2409
2410         list_for_each_entry(req, &fi->req_complete, list)
2411             if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2412                 return 1;
2413
2414         return 0;
2415 }
2416
2417 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2418 static void queue_rawiso_event(struct file_info *fi)
2419 {
2420         unsigned long flags;
2421
2422         spin_lock_irqsave(&fi->reqlists_lock, flags);
2423
2424         /* only one ISO activity event may be in the queue */
2425         if (!__rawiso_event_in_queue(fi)) {
2426                 struct pending_request *req =
2427                     __alloc_pending_request(SLAB_ATOMIC);
2428
2429                 if (req) {
2430                         req->file_info = fi;
2431                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2432                         req->req.generation = get_hpsb_generation(fi->host);
2433                         __queue_complete_req(req);
2434                 } else {
2435                         /* on allocation failure, signal an overflow */
2436                         if (fi->iso_handle) {
2437                                 atomic_inc(&fi->iso_handle->overflows);
2438                         }
2439                 }
2440         }
2441         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2442 }
2443
2444 static void rawiso_activity_cb(struct hpsb_iso *iso)
2445 {
2446         unsigned long flags;
2447         struct host_info *hi;
2448         struct file_info *fi;
2449
2450         spin_lock_irqsave(&host_info_lock, flags);
2451         hi = find_host_info(iso->host);
2452
2453         if (hi != NULL) {
2454                 list_for_each_entry(fi, &hi->file_info_list, list) {
2455                         if (fi->iso_handle == iso)
2456                                 queue_rawiso_event(fi);
2457                 }
2458         }
2459
2460         spin_unlock_irqrestore(&host_info_lock, flags);
2461 }
2462
2463 /* helper function - gather all the kernel iso status bits for returning to user-space */
2464 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
2465                                     struct raw1394_iso_status *stat)
2466 {
2467         stat->config.data_buf_size = iso->buf_size;
2468         stat->config.buf_packets = iso->buf_packets;
2469         stat->config.channel = iso->channel;
2470         stat->config.speed = iso->speed;
2471         stat->config.irq_interval = iso->irq_interval;
2472         stat->n_packets = hpsb_iso_n_ready(iso);
2473         stat->overflows = atomic_read(&iso->overflows);
2474         stat->xmit_cycle = iso->xmit_cycle;
2475 }
2476
2477 static int raw1394_iso_xmit_init(struct file_info *fi, void __user * uaddr)
2478 {
2479         struct raw1394_iso_status stat;
2480
2481         if (!fi->host)
2482                 return -EINVAL;
2483
2484         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2485                 return -EFAULT;
2486
2487         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2488                                             stat.config.data_buf_size,
2489                                             stat.config.buf_packets,
2490                                             stat.config.channel,
2491                                             stat.config.speed,
2492                                             stat.config.irq_interval,
2493                                             rawiso_activity_cb);
2494         if (!fi->iso_handle)
2495                 return -ENOMEM;
2496
2497         fi->iso_state = RAW1394_ISO_XMIT;
2498
2499         raw1394_iso_fill_status(fi->iso_handle, &stat);
2500         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2501                 return -EFAULT;
2502
2503         /* queue an event to get things started */
2504         rawiso_activity_cb(fi->iso_handle);
2505
2506         return 0;
2507 }
2508
2509 static int raw1394_iso_recv_init(struct file_info *fi, void __user * uaddr)
2510 {
2511         struct raw1394_iso_status stat;
2512
2513         if (!fi->host)
2514                 return -EINVAL;
2515
2516         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2517                 return -EFAULT;
2518
2519         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2520                                             stat.config.data_buf_size,
2521                                             stat.config.buf_packets,
2522                                             stat.config.channel,
2523                                             stat.config.dma_mode,
2524                                             stat.config.irq_interval,
2525                                             rawiso_activity_cb);
2526         if (!fi->iso_handle)
2527                 return -ENOMEM;
2528
2529         fi->iso_state = RAW1394_ISO_RECV;
2530
2531         raw1394_iso_fill_status(fi->iso_handle, &stat);
2532         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2533                 return -EFAULT;
2534         return 0;
2535 }
2536
2537 static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
2538 {
2539         struct raw1394_iso_status stat;
2540         struct hpsb_iso *iso = fi->iso_handle;
2541
2542         raw1394_iso_fill_status(fi->iso_handle, &stat);
2543         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2544                 return -EFAULT;
2545
2546         /* reset overflow counter */
2547         atomic_set(&iso->overflows, 0);
2548
2549         return 0;
2550 }
2551
2552 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2553 static int raw1394_iso_recv_packets(struct file_info *fi, void __user * uaddr)
2554 {
2555         struct raw1394_iso_packets upackets;
2556         unsigned int packet = fi->iso_handle->first_packet;
2557         int i;
2558
2559         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2560                 return -EFAULT;
2561
2562         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2563                 return -EINVAL;
2564
2565         /* ensure user-supplied buffer is accessible and big enough */
2566         if (!access_ok(VERIFY_WRITE, upackets.infos,
2567                        upackets.n_packets *
2568                        sizeof(struct raw1394_iso_packet_info)))
2569                 return -EFAULT;
2570
2571         /* copy the packet_infos out */
2572         for (i = 0; i < upackets.n_packets; i++) {
2573                 if (__copy_to_user(&upackets.infos[i],
2574                                    &fi->iso_handle->infos[packet],
2575                                    sizeof(struct raw1394_iso_packet_info)))
2576                         return -EFAULT;
2577
2578                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2579         }
2580
2581         return 0;
2582 }
2583
2584 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2585 static int raw1394_iso_send_packets(struct file_info *fi, void __user * uaddr)
2586 {
2587         struct raw1394_iso_packets upackets;
2588         int i, rv;
2589
2590         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2591                 return -EFAULT;
2592
2593         if (upackets.n_packets >= fi->iso_handle->buf_packets)
2594                 return -EINVAL;
2595
2596         if (upackets.n_packets >= hpsb_iso_n_ready(fi->iso_handle))
2597                 return -EAGAIN;
2598
2599         /* ensure user-supplied buffer is accessible and big enough */
2600         if (!access_ok(VERIFY_READ, upackets.infos,
2601                        upackets.n_packets *
2602                        sizeof(struct raw1394_iso_packet_info)))
2603                 return -EFAULT;
2604
2605         /* copy the infos structs in and queue the packets */
2606         for (i = 0; i < upackets.n_packets; i++) {
2607                 struct raw1394_iso_packet_info info;
2608
2609                 if (__copy_from_user(&info, &upackets.infos[i],
2610                                      sizeof(struct raw1394_iso_packet_info)))
2611                         return -EFAULT;
2612
2613                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2614                                                 info.len, info.tag, info.sy);
2615                 if (rv)
2616                         return rv;
2617         }
2618
2619         return 0;
2620 }
2621
2622 static void raw1394_iso_shutdown(struct file_info *fi)
2623 {
2624         if (fi->iso_handle)
2625                 hpsb_iso_shutdown(fi->iso_handle);
2626
2627         fi->iso_handle = NULL;
2628         fi->iso_state = RAW1394_ISO_INACTIVE;
2629 }
2630
2631 /* mmap the rawiso xmit/recv buffer */
2632 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2633 {
2634         struct file_info *fi = file->private_data;
2635
2636         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2637                 return -EINVAL;
2638
2639         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2640 }
2641
2642 /* ioctl is only used for rawiso operations */
2643 static int raw1394_ioctl(struct inode *inode, struct file *file,
2644                          unsigned int cmd, unsigned long arg)
2645 {
2646         struct file_info *fi = file->private_data;
2647         void __user *argp = (void __user *)arg;
2648
2649         switch (fi->iso_state) {
2650         case RAW1394_ISO_INACTIVE:
2651                 switch (cmd) {
2652                 case RAW1394_IOC_ISO_XMIT_INIT:
2653                         return raw1394_iso_xmit_init(fi, argp);
2654                 case RAW1394_IOC_ISO_RECV_INIT:
2655                         return raw1394_iso_recv_init(fi, argp);
2656                 default:
2657                         break;
2658                 }
2659                 break;
2660         case RAW1394_ISO_RECV:
2661                 switch (cmd) {
2662                 case RAW1394_IOC_ISO_RECV_START:{
2663                                 /* copy args from user-space */
2664                                 int args[3];
2665                                 if (copy_from_user
2666                                     (&args[0], argp, sizeof(args)))
2667                                         return -EFAULT;
2668                                 return hpsb_iso_recv_start(fi->iso_handle,
2669                                                            args[0], args[1],
2670                                                            args[2]);
2671                         }
2672                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2673                         hpsb_iso_stop(fi->iso_handle);
2674                         return 0;
2675                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2676                         return hpsb_iso_recv_listen_channel(fi->iso_handle,
2677                                                             arg);
2678                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2679                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle,
2680                                                               arg);
2681                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:{
2682                                 /* copy the u64 from user-space */
2683                                 u64 mask;
2684                                 if (copy_from_user(&mask, argp, sizeof(mask)))
2685                                         return -EFAULT;
2686                                 return hpsb_iso_recv_set_channel_mask(fi->
2687                                                                       iso_handle,
2688                                                                       mask);
2689                         }
2690                 case RAW1394_IOC_ISO_GET_STATUS:
2691                         return raw1394_iso_get_status(fi, argp);
2692                 case RAW1394_IOC_ISO_RECV_PACKETS:
2693                         return raw1394_iso_recv_packets(fi, argp);
2694                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2695                         return hpsb_iso_recv_release_packets(fi->iso_handle,
2696                                                              arg);
2697                 case RAW1394_IOC_ISO_RECV_FLUSH:
2698                         return hpsb_iso_recv_flush(fi->iso_handle);
2699                 case RAW1394_IOC_ISO_SHUTDOWN:
2700                         raw1394_iso_shutdown(fi);
2701                         return 0;
2702                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2703                         queue_rawiso_event(fi);
2704                         return 0;
2705                 }
2706                 break;
2707         case RAW1394_ISO_XMIT:
2708                 switch (cmd) {
2709                 case RAW1394_IOC_ISO_XMIT_START:{
2710                                 /* copy two ints from user-space */
2711                                 int args[2];
2712                                 if (copy_from_user
2713                                     (&args[0], argp, sizeof(args)))
2714                                         return -EFAULT;
2715                                 return hpsb_iso_xmit_start(fi->iso_handle,
2716                                                            args[0], args[1]);
2717                         }
2718                 case RAW1394_IOC_ISO_XMIT_SYNC:
2719                         return hpsb_iso_xmit_sync(fi->iso_handle);
2720                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2721                         hpsb_iso_stop(fi->iso_handle);
2722                         return 0;
2723                 case RAW1394_IOC_ISO_GET_STATUS:
2724                         return raw1394_iso_get_status(fi, argp);
2725                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2726                         return raw1394_iso_send_packets(fi, argp);
2727                 case RAW1394_IOC_ISO_SHUTDOWN:
2728                         raw1394_iso_shutdown(fi);
2729                         return 0;
2730                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2731                         queue_rawiso_event(fi);
2732                         return 0;
2733                 }
2734                 break;
2735         default:
2736                 break;
2737         }
2738
2739         return -EINVAL;
2740 }
2741
2742 static unsigned int raw1394_poll(struct file *file, poll_table * pt)
2743 {
2744         struct file_info *fi = file->private_data;
2745         unsigned int mask = POLLOUT | POLLWRNORM;
2746         unsigned long flags;
2747
2748         poll_wait(file, &fi->poll_wait_complete, pt);
2749
2750         spin_lock_irqsave(&fi->reqlists_lock, flags);
2751         if (!list_empty(&fi->req_complete)) {
2752                 mask |= POLLIN | POLLRDNORM;
2753         }
2754         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2755
2756         return mask;
2757 }
2758
2759 static int raw1394_open(struct inode *inode, struct file *file)
2760 {
2761         struct file_info *fi;
2762
2763         fi = kzalloc(sizeof(*fi), SLAB_KERNEL);
2764         if (!fi)
2765                 return -ENOMEM;
2766
2767         fi->notification = (u8) RAW1394_NOTIFY_ON;      /* busreset notification */
2768
2769         INIT_LIST_HEAD(&fi->list);
2770         fi->state = opened;
2771         INIT_LIST_HEAD(&fi->req_pending);
2772         INIT_LIST_HEAD(&fi->req_complete);
2773         sema_init(&fi->complete_sem, 0);
2774         spin_lock_init(&fi->reqlists_lock);
2775         init_waitqueue_head(&fi->poll_wait_complete);
2776         INIT_LIST_HEAD(&fi->addr_list);
2777
2778         file->private_data = fi;
2779
2780         return 0;
2781 }
2782
2783 static int raw1394_release(struct inode *inode, struct file *file)
2784 {
2785         struct file_info *fi = file->private_data;
2786         struct list_head *lh;
2787         struct pending_request *req;
2788         int done = 0, i, fail = 0;
2789         int retval = 0;
2790         struct list_head *entry;
2791         struct arm_addr *addr = NULL;
2792         struct host_info *hi;
2793         struct file_info *fi_hlp = NULL;
2794         struct arm_addr *arm_addr = NULL;
2795         int another_host;
2796         int csr_mod = 0;
2797         unsigned long flags;
2798
2799         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2800                 raw1394_iso_shutdown(fi);
2801
2802         for (i = 0; i < 64; i++) {
2803                 if (fi->listen_channels & (1ULL << i)) {
2804                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2805                 }
2806         }
2807
2808         spin_lock_irqsave(&host_info_lock, flags);
2809         fi->listen_channels = 0;
2810
2811         fail = 0;
2812         /* set address-entries invalid */
2813
2814         while (!list_empty(&fi->addr_list)) {
2815                 another_host = 0;
2816                 lh = fi->addr_list.next;
2817                 addr = list_entry(lh, struct arm_addr, addr_list);
2818                 /* another host with valid address-entry containing
2819                    same addressrange? */
2820                 list_for_each_entry(hi, &host_info_list, list) {
2821                         if (hi->host != fi->host) {
2822                                 list_for_each_entry(fi_hlp, &hi->file_info_list,
2823                                                     list) {
2824                                         entry = fi_hlp->addr_list.next;
2825                                         while (entry != &(fi_hlp->addr_list)) {
2826                                                 arm_addr = list_entry(entry, struct
2827                                                                       arm_addr,
2828                                                                       addr_list);
2829                                                 if (arm_addr->start ==
2830                                                     addr->start) {
2831                                                         DBGMSG
2832                                                             ("raw1394_release: "
2833                                                              "another host ownes "
2834                                                              "same addressrange");
2835                                                         another_host = 1;
2836                                                         break;
2837                                                 }
2838                                                 entry = entry->next;
2839                                         }
2840                                         if (another_host) {
2841                                                 break;
2842                                         }
2843                                 }
2844                         }
2845                 }
2846                 if (!another_host) {
2847                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
2848                         retval =
2849                             hpsb_unregister_addrspace(&raw1394_highlevel,
2850                                                       fi->host, addr->start);
2851                         if (!retval) {
2852                                 ++fail;
2853                                 printk(KERN_ERR
2854                                        "raw1394_release arm_Unregister failed\n");
2855                         }
2856                 }
2857                 DBGMSG("raw1394_release: delete addr_entry from list");
2858                 list_del(&addr->addr_list);
2859                 vfree(addr->addr_space_buffer);
2860                 kfree(addr);
2861         }                       /* while */
2862         spin_unlock_irqrestore(&host_info_lock, flags);
2863         if (fail > 0) {
2864                 printk(KERN_ERR "raw1394: during addr_list-release "
2865                        "error(s) occurred \n");
2866         }
2867
2868         while (!done) {
2869                 spin_lock_irqsave(&fi->reqlists_lock, flags);
2870
2871                 while (!list_empty(&fi->req_complete)) {
2872                         lh = fi->req_complete.next;
2873                         list_del(lh);
2874
2875                         req = list_entry(lh, struct pending_request, list);
2876
2877                         free_pending_request(req);
2878                 }
2879
2880                 if (list_empty(&fi->req_pending))
2881                         done = 1;
2882
2883                 spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2884
2885                 if (!done)
2886                         down_interruptible(&fi->complete_sem);
2887         }
2888
2889         /* Remove any sub-trees left by user space programs */
2890         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
2891                 struct csr1212_dentry *dentry;
2892                 if (!fi->csr1212_dirs[i])
2893                         continue;
2894                 for (dentry =
2895                      fi->csr1212_dirs[i]->value.directory.dentries_head; dentry;
2896                      dentry = dentry->next) {
2897                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2898                                                              root_kv,
2899                                                              dentry->kv);
2900                 }
2901                 csr1212_release_keyval(fi->csr1212_dirs[i]);
2902                 fi->csr1212_dirs[i] = NULL;
2903                 csr_mod = 1;
2904         }
2905
2906         if ((csr_mod || fi->cfgrom_upd)
2907             && hpsb_update_config_rom_image(fi->host) < 0)
2908                 HPSB_ERR
2909                     ("Failed to generate Configuration ROM image for host %d",
2910                      fi->host->id);
2911
2912         if (fi->state == connected) {
2913                 spin_lock_irqsave(&host_info_lock, flags);
2914                 list_del(&fi->list);
2915                 spin_unlock_irqrestore(&host_info_lock, flags);
2916
2917                 put_device(&fi->host->device);
2918         }
2919
2920         kfree(fi);
2921
2922         return 0;
2923 }
2924
2925 /*** HOTPLUG STUFF **********************************************************/
2926 /*
2927  * Export information about protocols/devices supported by this driver.
2928  */
2929 static struct ieee1394_device_id raw1394_id_table[] = {
2930         {
2931          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2932          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
2933          .version = AVC_SW_VERSION_ENTRY & 0xffffff},
2934         {
2935          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2936          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2937          .version = CAMERA_SW_VERSION_ENTRY & 0xffffff},
2938         {
2939          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2940          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2941          .version = (CAMERA_SW_VERSION_ENTRY + 1) & 0xffffff},
2942         {
2943          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2944          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2945          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
2946         {}
2947 };
2948
2949 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
2950
2951 static struct hpsb_protocol_driver raw1394_driver = {
2952         .name = "raw1394 Driver",
2953         .id_table = raw1394_id_table,
2954         .driver = {
2955                    .name = "raw1394",
2956                    .bus = &ieee1394_bus_type,
2957                    },
2958 };
2959
2960 /******************************************************************************/
2961
2962 static struct hpsb_highlevel raw1394_highlevel = {
2963         .name = RAW1394_DEVICE_NAME,
2964         .add_host = add_host,
2965         .remove_host = remove_host,
2966         .host_reset = host_reset,
2967         .iso_receive = iso_receive,
2968         .fcp_request = fcp_request,
2969 };
2970
2971 static struct cdev raw1394_cdev;
2972 static struct file_operations raw1394_fops = {
2973         .owner = THIS_MODULE,
2974         .read = raw1394_read,
2975         .write = raw1394_write,
2976         .mmap = raw1394_mmap,
2977         .ioctl = raw1394_ioctl,
2978         // .compat_ioctl = ... someone needs to do this
2979         .poll = raw1394_poll,
2980         .open = raw1394_open,
2981         .release = raw1394_release,
2982 };
2983
2984 static int __init init_raw1394(void)
2985 {
2986         int ret = 0;
2987
2988         hpsb_register_highlevel(&raw1394_highlevel);
2989
2990         if (IS_ERR
2991             (class_device_create
2992              (hpsb_protocol_class, NULL,
2993               MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16), NULL,
2994               RAW1394_DEVICE_NAME))) {
2995                 ret = -EFAULT;
2996                 goto out_unreg;
2997         }
2998
2999         cdev_init(&raw1394_cdev, &raw1394_fops);
3000         raw1394_cdev.owner = THIS_MODULE;
3001         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
3002         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
3003         if (ret) {
3004                 HPSB_ERR("raw1394 failed to register minor device block");
3005                 goto out_dev;
3006         }
3007
3008         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
3009
3010         ret = hpsb_register_protocol(&raw1394_driver);
3011         if (ret) {
3012                 HPSB_ERR("raw1394: failed to register protocol");
3013                 cdev_del(&raw1394_cdev);
3014                 goto out_dev;
3015         }
3016
3017         goto out;
3018
3019       out_dev:
3020         class_device_destroy(hpsb_protocol_class,
3021                              MKDEV(IEEE1394_MAJOR,
3022                                    IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3023       out_unreg:
3024         hpsb_unregister_highlevel(&raw1394_highlevel);
3025       out:
3026         return ret;
3027 }
3028
3029 static void __exit cleanup_raw1394(void)
3030 {
3031         class_device_destroy(hpsb_protocol_class,
3032                              MKDEV(IEEE1394_MAJOR,
3033                                    IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3034         cdev_del(&raw1394_cdev);
3035         hpsb_unregister_highlevel(&raw1394_highlevel);
3036         hpsb_unregister_protocol(&raw1394_driver);
3037 }
3038
3039 module_init(init_raw1394);
3040 module_exit(cleanup_raw1394);
3041 MODULE_LICENSE("GPL");