drivers/ieee1394/raw1394.c

   1 /*
   2  * IEEE 1394 for Linux
   3  *
   4  * Raw interface to the bus
   5  *
   6  * Copyright (C) 1999, 2000 Andreas E. Bombe
   7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
   8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
   9  *
  10  * This code is licensed under the GPL.  See the file COPYING in the root
  11  * directory of the kernel sources for details.
  12  *
  13  *
  14  * Contributions:
  15  *
  16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
  17  *        configuration ROM manipulation
  18  *        address range mapping
  19  *        adaptation for new (transparent) loopback mechanism
  20  *        sending of arbitrary async packets
  21  * Christian Toegel <christian.toegel@gmx.at>
  22  *        address range mapping
  23  *        lock64 request
  24  *        transmit physical packet
  25  *        busreset notification control (switch on/off)
  26  *        busreset with selection of type (short/long)
  27  *        request_reply
  28  */
  29
  30 #include <linux/kernel.h>
  31 #include <linux/list.h>
  32 #include <linux/string.h>
  33 #include <linux/slab.h>
  34 #include <linux/fs.h>
  35 #include <linux/poll.h>
  36 #include <linux/module.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/vmalloc.h>
  40 #include <linux/cdev.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/atomic.h>
  43 #include <linux/compat.h>
  44
  45 #include "csr1212.h"
  46 #include "highlevel.h"
  47 #include "hosts.h"
  48 #include "ieee1394.h"
  49 #include "ieee1394_core.h"
  50 #include "ieee1394_hotplug.h"
  51 #include "ieee1394_transactions.h"
  52 #include "ieee1394_types.h"
  53 #include "iso.h"
  54 #include "nodemgr.h"
  55 #include "raw1394.h"
  56 #include "raw1394-private.h"
  57
  58 #define int2ptr(x) ((void __user *)(unsigned long)x)
  59 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
  60
  61 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
  62 #define RAW1394_DEBUG
  63 #endif
  64
  65 #ifdef RAW1394_DEBUG
  66 #define DBGMSG(fmt, args...) \
  67 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
  68 #else
  69 #define DBGMSG(fmt, args...) do {} while (0)
  70 #endif
  71
  72 static LIST_HEAD(host_info_list);
  73 static int host_count;
  74 static DEFINE_SPINLOCK(host_info_lock);
  75 static atomic_t internal_generation = ATOMIC_INIT(0);
  76
  77 static atomic_t iso_buffer_size;
  78 static const int iso_buffer_max = 4 * 1024 * 1024;      /* 4 MB */
  79
  80 static struct hpsb_highlevel raw1394_highlevel;
  81
  82 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
  83                     u64 addr, size_t length, u16 flags);
  84 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
  85                      quadlet_t * data, u64 addr, size_t length, u16 flags);
  86 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
  87                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
  88                     u16 flags);
  89 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
  90                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
  91                       u16 flags);
  92 static struct hpsb_address_ops arm_ops = {
  93         .read = arm_read,
  94         .write = arm_write,
  95         .lock = arm_lock,
  96         .lock64 = arm_lock64,
  97 };
  98
  99 static void queue_complete_cb(struct pending_request *req);
 100
 101 #include <asm/current.h>
 102 static void print_old_iso_deprecation(void)
 103 {
 104         static pid_t p;
 105
 106         if (p == current->pid)
 107                 return;
 108         p = current->pid;
 109         printk(KERN_WARNING "raw1394: WARNING - Program \"%s\" uses unsupported"
 110                " isochronous request types which will be removed in a next"
 111                " kernel release\n", current->comm);
 112         printk(KERN_WARNING "raw1394: Update your software to use libraw1394's"
 113                " newer interface\n");
 114 }
 115
 116 static struct pending_request *__alloc_pending_request(gfp_t flags)
 117 {
 118         struct pending_request *req;
 119
 120         req = kzalloc(sizeof(*req), flags);
 121         if (req)
 122                 INIT_LIST_HEAD(&req->list);
 123
 124         return req;
 125 }
 126
 127 static inline struct pending_request *alloc_pending_request(void)
 128 {
 129         return __alloc_pending_request(GFP_KERNEL);
 130 }
 131
 132 static void free_pending_request(struct pending_request *req)
 133 {
 134         if (req->ibs) {
 135                 if (atomic_dec_and_test(&req->ibs->refcount)) {
 136                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
 137                         kfree(req->ibs);
 138                 }
 139         } else if (req->free_data) {
 140                 kfree(req->data);
 141         }
 142         hpsb_free_packet(req->packet);
 143         kfree(req);
 144 }
 145
 146 /* fi->reqlists_lock must be taken */
 147 static void __queue_complete_req(struct pending_request *req)
 148 {
 149         struct file_info *fi = req->file_info;
 150
 151         list_move_tail(&req->list, &fi->req_complete);
 152         wake_up(&fi->wait_complete);
 153 }
 154
 155 static void queue_complete_req(struct pending_request *req)
 156 {
 157         unsigned long flags;
 158         struct file_info *fi = req->file_info;
 159
 160         spin_lock_irqsave(&fi->reqlists_lock, flags);
 161         __queue_complete_req(req);
 162         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 163 }
 164
 165 static void queue_complete_cb(struct pending_request *req)
 166 {
 167         struct hpsb_packet *packet = req->packet;
 168         int rcode = (packet->header[1] >> 12) & 0xf;
 169
 170         switch (packet->ack_code) {
 171         case ACKX_NONE:
 172         case ACKX_SEND_ERROR:
 173                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 174                 break;
 175         case ACKX_ABORTED:
 176                 req->req.error = RAW1394_ERROR_ABORTED;
 177                 break;
 178         case ACKX_TIMEOUT:
 179                 req->req.error = RAW1394_ERROR_TIMEOUT;
 180                 break;
 181         default:
 182                 req->req.error = (packet->ack_code << 16) | rcode;
 183                 break;
 184         }
 185
 186         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
 187                 req->req.length = 0;
 188         }
 189
 190         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
 191             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
 192             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
 193             (req->req.type == RAW1394_REQ_LOCK) ||
 194             (req->req.type == RAW1394_REQ_LOCK64))
 195                 hpsb_free_tlabel(packet);
 196
 197         queue_complete_req(req);
 198 }
 199
 200 static void add_host(struct hpsb_host *host)
 201 {
 202         struct host_info *hi;
 203         unsigned long flags;
 204
 205         hi = kmalloc(sizeof(*hi), GFP_KERNEL);
 206
 207         if (hi) {
 208                 INIT_LIST_HEAD(&hi->list);
 209                 hi->host = host;
 210                 INIT_LIST_HEAD(&hi->file_info_list);
 211
 212                 spin_lock_irqsave(&host_info_lock, flags);
 213                 list_add_tail(&hi->list, &host_info_list);
 214                 host_count++;
 215                 spin_unlock_irqrestore(&host_info_lock, flags);
 216         }
 217
 218         atomic_inc(&internal_generation);
 219 }
 220
 221 static struct host_info *find_host_info(struct hpsb_host *host)
 222 {
 223         struct host_info *hi;
 224
 225         list_for_each_entry(hi, &host_info_list, list)
 226             if (hi->host == host)
 227                 return hi;
 228
 229         return NULL;
 230 }
 231
 232 static void remove_host(struct hpsb_host *host)
 233 {
 234         struct host_info *hi;
 235         unsigned long flags;
 236
 237         spin_lock_irqsave(&host_info_lock, flags);
 238         hi = find_host_info(host);
 239
 240         if (hi != NULL) {
 241                 list_del(&hi->list);
 242                 host_count--;
 243                 /*
 244                    FIXME: address ranges should be removed
 245                    and fileinfo states should be initialized
 246                    (including setting generation to
 247                    internal-generation ...)
 248                  */
 249         }
 250         spin_unlock_irqrestore(&host_info_lock, flags);
 251
 252         if (hi == NULL) {
 253                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
 254                        "0x%p\n", host);
 255                 return;
 256         }
 257
 258         kfree(hi);
 259
 260         atomic_inc(&internal_generation);
 261 }
 262
 263 static void host_reset(struct hpsb_host *host)
 264 {
 265         unsigned long flags;
 266         struct host_info *hi;
 267         struct file_info *fi;
 268         struct pending_request *req;
 269
 270         spin_lock_irqsave(&host_info_lock, flags);
 271         hi = find_host_info(host);
 272
 273         if (hi != NULL) {
 274                 list_for_each_entry(fi, &hi->file_info_list, list) {
 275                         if (fi->notification == RAW1394_NOTIFY_ON) {
 276                                 req = __alloc_pending_request(GFP_ATOMIC);
 277
 278                                 if (req != NULL) {
 279                                         req->file_info = fi;
 280                                         req->req.type = RAW1394_REQ_BUS_RESET;
 281                                         req->req.generation =
 282                                             get_hpsb_generation(host);
 283                                         req->req.misc = (host->node_id << 16)
 284                                             | host->node_count;
 285                                         if (fi->protocol_version > 3) {
 286                                                 req->req.misc |=
 287                                                     (NODEID_TO_NODE
 288                                                      (host->irm_id)
 289                                                      << 8);
 290                                         }
 291
 292                                         queue_complete_req(req);
 293                                 }
 294                         }
 295                 }
 296         }
 297         spin_unlock_irqrestore(&host_info_lock, flags);
 298 }
 299
 300 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t * data,
 301                         size_t length)
 302 {
 303         unsigned long flags;
 304         struct host_info *hi;
 305         struct file_info *fi;
 306         struct pending_request *req, *req_next;
 307         struct iso_block_store *ibs = NULL;
 308         LIST_HEAD(reqs);
 309
 310         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 311                 HPSB_INFO("dropped iso packet");
 312                 return;
 313         }
 314
 315         spin_lock_irqsave(&host_info_lock, flags);
 316         hi = find_host_info(host);
 317
 318         if (hi != NULL) {
 319                 list_for_each_entry(fi, &hi->file_info_list, list) {
 320                         if (!(fi->listen_channels & (1ULL << channel)))
 321                                 continue;
 322
 323                         req = __alloc_pending_request(GFP_ATOMIC);
 324                         if (!req)
 325                                 break;
 326
 327                         if (!ibs) {
 328                                 ibs = kmalloc(sizeof(*ibs) + length,
 329                                               GFP_ATOMIC);
 330                                 if (!ibs) {
 331                                         kfree(req);
 332                                         break;
 333                                 }
 334
 335                                 atomic_add(length, &iso_buffer_size);
 336                                 atomic_set(&ibs->refcount, 0);
 337                                 ibs->data_size = length;
 338                                 memcpy(ibs->data, data, length);
 339                         }
 340
 341                         atomic_inc(&ibs->refcount);
 342
 343                         req->file_info = fi;
 344                         req->ibs = ibs;
 345                         req->data = ibs->data;
 346                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
 347                         req->req.generation = get_hpsb_generation(host);
 348                         req->req.misc = 0;
 349                         req->req.recvb = ptr2int(fi->iso_buffer);
 350                         req->req.length = min(length, fi->iso_buffer_length);
 351
 352                         list_add_tail(&req->list, &reqs);
 353                 }
 354         }
 355         spin_unlock_irqrestore(&host_info_lock, flags);
 356
 357         list_for_each_entry_safe(req, req_next, &reqs, list)
 358             queue_complete_req(req);
 359 }
 360
 361 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
 362                         int cts, u8 * data, size_t length)
 363 {
 364         unsigned long flags;
 365         struct host_info *hi;
 366         struct file_info *fi;
 367         struct pending_request *req, *req_next;
 368         struct iso_block_store *ibs = NULL;
 369         LIST_HEAD(reqs);
 370
 371         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 372                 HPSB_INFO("dropped fcp request");
 373                 return;
 374         }
 375
 376         spin_lock_irqsave(&host_info_lock, flags);
 377         hi = find_host_info(host);
 378
 379         if (hi != NULL) {
 380                 list_for_each_entry(fi, &hi->file_info_list, list) {
 381                         if (!fi->fcp_buffer)
 382                                 continue;
 383
 384                         req = __alloc_pending_request(GFP_ATOMIC);
 385                         if (!req)
 386                                 break;
 387
 388                         if (!ibs) {
 389                                 ibs = kmalloc(sizeof(*ibs) + length,
 390                                               GFP_ATOMIC);
 391                                 if (!ibs) {
 392                                         kfree(req);
 393                                         break;
 394                                 }
 395
 396                                 atomic_add(length, &iso_buffer_size);
 397                                 atomic_set(&ibs->refcount, 0);
 398                                 ibs->data_size = length;
 399                                 memcpy(ibs->data, data, length);
 400                         }
 401
 402                         atomic_inc(&ibs->refcount);
 403
 404                         req->file_info = fi;
 405                         req->ibs = ibs;
 406                         req->data = ibs->data;
 407                         req->req.type = RAW1394_REQ_FCP_REQUEST;
 408                         req->req.generation = get_hpsb_generation(host);
 409                         req->req.misc = nodeid | (direction << 16);
 410                         req->req.recvb = ptr2int(fi->fcp_buffer);
 411                         req->req.length = length;
 412
 413                         list_add_tail(&req->list, &reqs);
 414                 }
 415         }
 416         spin_unlock_irqrestore(&host_info_lock, flags);
 417
 418         list_for_each_entry_safe(req, req_next, &reqs, list)
 419             queue_complete_req(req);
 420 }
 421
 422 #ifdef CONFIG_COMPAT
 423 struct compat_raw1394_req {
 424         __u32 type;
 425         __s32 error;
 426         __u32 misc;
 427
 428         __u32 generation;
 429         __u32 length;
 430
 431         __u64 address;
 432
 433         __u64 tag;
 434
 435         __u64 sendb;
 436         __u64 recvb;
 437 }
 438 #if defined(CONFIG_X86_64) || defined(CONFIG_IA64)
 439 __attribute__((packed))
 440 #endif
 441 ;
 442
 443 static const char __user *raw1394_compat_write(const char __user *buf)
 444 {
 445         struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
 446         struct raw1394_request __user *r;
 447         r = compat_alloc_user_space(sizeof(struct raw1394_request));
 448
 449 #define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x))
 450
 451         if (copy_in_user(r, cr, sizeof(struct compat_raw1394_req)) ||
 452             C(address) ||
 453             C(tag) ||
 454             C(sendb) ||
 455             C(recvb))
 456                 return ERR_PTR(-EFAULT);
 457         return (const char __user *)r;
 458 }
 459 #undef C
 460
 461 #define P(x) __put_user(r->x, &cr->x)
 462
 463 static int
 464 raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
 465 {
 466         struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
 467         if (!access_ok(VERIFY_WRITE, cr, sizeof(struct compat_raw1394_req)) ||
 468             P(type) ||
 469             P(error) ||
 470             P(misc) ||
 471             P(generation) ||
 472             P(length) ||
 473             P(address) ||
 474             P(tag) ||
 475             P(sendb) ||
 476             P(recvb))
 477                 return -EFAULT;
 478         return sizeof(struct compat_raw1394_req);
 479 }
 480 #undef P
 481
 482 #endif
 483
 484 /* get next completed request  (caller must hold fi->reqlists_lock) */
 485 static inline struct pending_request *__next_complete_req(struct file_info *fi)
 486 {
 487         struct list_head *lh;
 488         struct pending_request *req = NULL;
 489
 490         if (!list_empty(&fi->req_complete)) {
 491                 lh = fi->req_complete.next;
 492                 list_del(lh);
 493                 req = list_entry(lh, struct pending_request, list);
 494         }
 495         return req;
 496 }
 497
 498 /* atomically get next completed request */
 499 static struct pending_request *next_complete_req(struct file_info *fi)
 500 {
 501         unsigned long flags;
 502         struct pending_request *req;
 503
 504         spin_lock_irqsave(&fi->reqlists_lock, flags);
 505         req = __next_complete_req(fi);
 506         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 507         return req;
 508 }
 509
 510 static ssize_t raw1394_read(struct file *file, char __user * buffer,
 511                             size_t count, loff_t * offset_is_ignored)
 512 {
 513         struct file_info *fi = (struct file_info *)file->private_data;
 514         struct pending_request *req;
 515         ssize_t ret;
 516
 517 #ifdef CONFIG_COMPAT
 518         if (count == sizeof(struct compat_raw1394_req)) {
 519                 /* ok */
 520         } else
 521 #endif
 522         if (count != sizeof(struct raw1394_request)) {
 523                 return -EINVAL;
 524         }
 525
 526         if (!access_ok(VERIFY_WRITE, buffer, count)) {
 527                 return -EFAULT;
 528         }
 529
 530         if (file->f_flags & O_NONBLOCK) {
 531                 if (!(req = next_complete_req(fi)))
 532                         return -EAGAIN;
 533         } else {
 534                 /*
 535                  * NB: We call the macro wait_event_interruptible() with a
 536                  * condition argument with side effect.  This is only possible
 537                  * because the side effect does not occur until the condition
 538                  * became true, and wait_event_interruptible() won't evaluate
 539                  * the condition again after that.
 540                  */
 541                 if (wait_event_interruptible(fi->wait_complete,
 542                                              (req = next_complete_req(fi))))
 543                         return -ERESTARTSYS;
 544         }
 545
 546         if (req->req.length) {
 547                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
 548                                  req->req.length)) {
 549                         req->req.error = RAW1394_ERROR_MEMFAULT;
 550                 }
 551         }
 552
 553 #ifdef CONFIG_COMPAT
 554         if (count == sizeof(struct compat_raw1394_req) &&
 555             sizeof(struct compat_raw1394_req) !=
 556                         sizeof(struct raw1394_request)) {
 557                 ret = raw1394_compat_read(buffer, &req->req);
 558         } else
 559 #endif
 560         {
 561                 if (copy_to_user(buffer, &req->req, sizeof(req->req))) {
 562                         ret = -EFAULT;
 563                         goto out;
 564                 }
 565                 ret = (ssize_t) sizeof(struct raw1394_request);
 566         }
 567       out:
 568         free_pending_request(req);
 569         return ret;
 570 }
 571
 572 static int state_opened(struct file_info *fi, struct pending_request *req)
 573 {
 574         if (req->req.type == RAW1394_REQ_INITIALIZE) {
 575                 switch (req->req.misc) {
 576                 case RAW1394_KERNELAPI_VERSION:
 577                 case 3:
 578                         fi->state = initialized;
 579                         fi->protocol_version = req->req.misc;
 580                         req->req.error = RAW1394_ERROR_NONE;
 581                         req->req.generation = atomic_read(&internal_generation);
 582                         break;
 583
 584                 default:
 585                         req->req.error = RAW1394_ERROR_COMPAT;
 586                         req->req.misc = RAW1394_KERNELAPI_VERSION;
 587                 }
 588         } else {
 589                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 590         }
 591
 592         req->req.length = 0;
 593         queue_complete_req(req);
 594         return 0;
 595 }
 596
 597 static int state_initialized(struct file_info *fi, struct pending_request *req)
 598 {
 599         unsigned long flags;
 600         struct host_info *hi;
 601         struct raw1394_khost_list *khl;
 602
 603         if (req->req.generation != atomic_read(&internal_generation)) {
 604                 req->req.error = RAW1394_ERROR_GENERATION;
 605                 req->req.generation = atomic_read(&internal_generation);
 606                 req->req.length = 0;
 607                 queue_complete_req(req);
 608                 return 0;
 609         }
 610
 611         switch (req->req.type) {
 612         case RAW1394_REQ_LIST_CARDS:
 613                 spin_lock_irqsave(&host_info_lock, flags);
 614                 khl = kmalloc(sizeof(*khl) * host_count, GFP_ATOMIC);
 615
 616                 if (khl) {
 617                         req->req.misc = host_count;
 618                         req->data = (quadlet_t *) khl;
 619
 620                         list_for_each_entry(hi, &host_info_list, list) {
 621                                 khl->nodes = hi->host->node_count;
 622                                 strcpy(khl->name, hi->host->driver->name);
 623                                 khl++;
 624                         }
 625                 }
 626                 spin_unlock_irqrestore(&host_info_lock, flags);
 627
 628                 if (khl) {
 629                         req->req.error = RAW1394_ERROR_NONE;
 630                         req->req.length = min(req->req.length,
 631                                               (u32) (sizeof
 632                                                      (struct raw1394_khost_list)
 633                                                      * req->req.misc));
 634                         req->free_data = 1;
 635                 } else {
 636                         return -ENOMEM;
 637                 }
 638                 break;
 639
 640         case RAW1394_REQ_SET_CARD:
 641                 spin_lock_irqsave(&host_info_lock, flags);
 642                 if (req->req.misc >= host_count) {
 643                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 644                         goto out_set_card;
 645                 }
 646                 list_for_each_entry(hi, &host_info_list, list)
 647                         if (!req->req.misc--)
 648                                 break;
 649                 get_device(&hi->host->device); /* FIXME handle failure case */
 650                 list_add_tail(&fi->list, &hi->file_info_list);
 651
 652                 /* prevent unloading of the host's low-level driver */
 653                 if (!try_module_get(hi->host->driver->owner)) {
 654                         req->req.error = RAW1394_ERROR_ABORTED;
 655                         goto out_set_card;
 656                 }
 657                 WARN_ON(fi->host);
 658                 fi->host = hi->host;
 659                 fi->state = connected;
 660
 661                 req->req.error = RAW1394_ERROR_NONE;
 662                 req->req.generation = get_hpsb_generation(fi->host);
 663                 req->req.misc = (fi->host->node_id << 16)
 664                                 | fi->host->node_count;
 665                 if (fi->protocol_version > 3)
 666                         req->req.misc |= NODEID_TO_NODE(fi->host->irm_id) << 8;
 667 out_set_card:
 668                 spin_unlock_irqrestore(&host_info_lock, flags);
 669
 670                 req->req.length = 0;
 671                 break;
 672
 673         default:
 674                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 675                 req->req.length = 0;
 676                 break;
 677         }
 678
 679         queue_complete_req(req);
 680         return 0;
 681 }
 682
 683 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
 684 {
 685         int channel = req->req.misc;
 686
 687         if ((channel > 63) || (channel < -64)) {
 688                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 689         } else if (channel >= 0) {
 690                 /* allocate channel req.misc */
 691                 if (fi->listen_channels & (1ULL << channel)) {
 692                         req->req.error = RAW1394_ERROR_ALREADY;
 693                 } else {
 694                         if (hpsb_listen_channel
 695                             (&raw1394_highlevel, fi->host, channel)) {
 696                                 req->req.error = RAW1394_ERROR_ALREADY;
 697                         } else {
 698                                 fi->listen_channels |= 1ULL << channel;
 699                                 fi->iso_buffer = int2ptr(req->req.recvb);
 700                                 fi->iso_buffer_length = req->req.length;
 701                         }
 702                 }
 703         } else {
 704                 /* deallocate channel (one's complement neg) req.misc */
 705                 channel = ~channel;
 706
 707                 if (fi->listen_channels & (1ULL << channel)) {
 708                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host,
 709                                               channel);
 710                         fi->listen_channels &= ~(1ULL << channel);
 711                 } else {
 712                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 713                 }
 714         }
 715
 716         req->req.length = 0;
 717         queue_complete_req(req);
 718 }
 719
 720 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
 721 {
 722         if (req->req.misc) {
 723                 if (fi->fcp_buffer) {
 724                         req->req.error = RAW1394_ERROR_ALREADY;
 725                 } else {
 726                         fi->fcp_buffer = int2ptr(req->req.recvb);
 727                 }
 728         } else {
 729                 if (!fi->fcp_buffer) {
 730                         req->req.error = RAW1394_ERROR_ALREADY;
 731                 } else {
 732                         fi->fcp_buffer = NULL;
 733                 }
 734         }
 735
 736         req->req.length = 0;
 737         queue_complete_req(req);
 738 }
 739
 740 static int handle_async_request(struct file_info *fi,
 741                                 struct pending_request *req, int node)
 742 {
 743         unsigned long flags;
 744         struct hpsb_packet *packet = NULL;
 745         u64 addr = req->req.address & 0xffffffffffffULL;
 746
 747         switch (req->req.type) {
 748         case RAW1394_REQ_ASYNC_READ:
 749                 DBGMSG("read_request called");
 750                 packet =
 751                     hpsb_make_readpacket(fi->host, node, addr, req->req.length);
 752
 753                 if (!packet)
 754                         return -ENOMEM;
 755
 756                 if (req->req.length == 4)
 757                         req->data = &packet->header[3];
 758                 else
 759                         req->data = packet->data;
 760
 761                 break;
 762
 763         case RAW1394_REQ_ASYNC_WRITE:
 764                 DBGMSG("write_request called");
 765
 766                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
 767                                                req->req.length);
 768                 if (!packet)
 769                         return -ENOMEM;
 770
 771                 if (req->req.length == 4) {
 772                         if (copy_from_user
 773                             (&packet->header[3], int2ptr(req->req.sendb),
 774                              req->req.length))
 775                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 776                 } else {
 777                         if (copy_from_user
 778                             (packet->data, int2ptr(req->req.sendb),
 779                              req->req.length))
 780                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 781                 }
 782
 783                 req->req.length = 0;
 784                 break;
 785
 786         case RAW1394_REQ_ASYNC_STREAM:
 787                 DBGMSG("stream_request called");
 788
 789                 packet =
 790                     hpsb_make_streampacket(fi->host, NULL, req->req.length,
 791                                            node & 0x3f /*channel */ ,
 792                                            (req->req.misc >> 16) & 0x3,
 793                                            req->req.misc & 0xf);
 794                 if (!packet)
 795                         return -ENOMEM;
 796
 797                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 798                                    req->req.length))
 799                         req->req.error = RAW1394_ERROR_MEMFAULT;
 800
 801                 req->req.length = 0;
 802                 break;
 803
 804         case RAW1394_REQ_LOCK:
 805                 DBGMSG("lock_request called");
 806                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 807                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 808                         if (req->req.length != 4) {
 809                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 810                                 break;
 811                         }
 812                 } else {
 813                         if (req->req.length != 8) {
 814                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 815                                 break;
 816                         }
 817                 }
 818
 819                 packet = hpsb_make_lockpacket(fi->host, node, addr,
 820                                               req->req.misc, NULL, 0);
 821                 if (!packet)
 822                         return -ENOMEM;
 823
 824                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 825                                    req->req.length)) {
 826                         req->req.error = RAW1394_ERROR_MEMFAULT;
 827                         break;
 828                 }
 829
 830                 req->data = packet->data;
 831                 req->req.length = 4;
 832                 break;
 833
 834         case RAW1394_REQ_LOCK64:
 835                 DBGMSG("lock64_request called");
 836                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 837                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 838                         if (req->req.length != 8) {
 839                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 840                                 break;
 841                         }
 842                 } else {
 843                         if (req->req.length != 16) {
 844                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 845                                 break;
 846                         }
 847                 }
 848                 packet = hpsb_make_lock64packet(fi->host, node, addr,
 849                                                 req->req.misc, NULL, 0);
 850                 if (!packet)
 851                         return -ENOMEM;
 852
 853                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 854                                    req->req.length)) {
 855                         req->req.error = RAW1394_ERROR_MEMFAULT;
 856                         break;
 857                 }
 858
 859                 req->data = packet->data;
 860                 req->req.length = 8;
 861                 break;
 862
 863         default:
 864                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 865         }
 866
 867         req->packet = packet;
 868
 869         if (req->req.error) {
 870                 req->req.length = 0;
 871                 queue_complete_req(req);
 872                 return 0;
 873         }
 874
 875         hpsb_set_packet_complete_task(packet,
 876                                       (void (*)(void *))queue_complete_cb, req);
 877
 878         spin_lock_irqsave(&fi->reqlists_lock, flags);
 879         list_add_tail(&req->list, &fi->req_pending);
 880         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 881
 882         packet->generation = req->req.generation;
 883
 884         if (hpsb_send_packet(packet) < 0) {
 885                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 886                 req->req.length = 0;
 887                 hpsb_free_tlabel(packet);
 888                 queue_complete_req(req);
 889         }
 890         return 0;
 891 }
 892
 893 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
 894                            int channel)
 895 {
 896         unsigned long flags;
 897         struct hpsb_packet *packet;
 898
 899         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
 900                                      (req->req.misc >> 16) & 0x3,
 901                                      req->req.misc & 0xf);
 902         if (!packet)
 903                 return -ENOMEM;
 904
 905         packet->speed_code = req->req.address & 0x3;
 906
 907         req->packet = packet;
 908
 909         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 910                            req->req.length)) {
 911                 req->req.error = RAW1394_ERROR_MEMFAULT;
 912                 req->req.length = 0;
 913                 queue_complete_req(req);
 914                 return 0;
 915         }
 916
 917         req->req.length = 0;
 918         hpsb_set_packet_complete_task(packet,
 919                                       (void (*)(void *))queue_complete_req,
 920                                       req);
 921
 922         spin_lock_irqsave(&fi->reqlists_lock, flags);
 923         list_add_tail(&req->list, &fi->req_pending);
 924         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 925
 926         /* Update the generation of the packet just before sending. */
 927         packet->generation = req->req.generation;
 928
 929         if (hpsb_send_packet(packet) < 0) {
 930                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 931                 queue_complete_req(req);
 932         }
 933
 934         return 0;
 935 }
 936
 937 static int handle_async_send(struct file_info *fi, struct pending_request *req)
 938 {
 939         unsigned long flags;
 940         struct hpsb_packet *packet;
 941         int header_length = req->req.misc & 0xffff;
 942         int expect_response = req->req.misc >> 16;
 943         size_t data_size;
 944
 945         if (header_length > req->req.length || header_length < 12 ||
 946             header_length > FIELD_SIZEOF(struct hpsb_packet, header)) {
 947                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 948                 req->req.length = 0;
 949                 queue_complete_req(req);
 950                 return 0;
 951         }
 952
 953         data_size = req->req.length - header_length;
 954         packet = hpsb_alloc_packet(data_size);
 955         req->packet = packet;
 956         if (!packet)
 957                 return -ENOMEM;
 958
 959         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
 960                            header_length)) {
 961                 req->req.error = RAW1394_ERROR_MEMFAULT;
 962                 req->req.length = 0;
 963                 queue_complete_req(req);
 964                 return 0;
 965         }
 966
 967         if (copy_from_user
 968             (packet->data, int2ptr(req->req.sendb) + header_length,
 969              data_size)) {
 970                 req->req.error = RAW1394_ERROR_MEMFAULT;
 971                 req->req.length = 0;
 972                 queue_complete_req(req);
 973                 return 0;
 974         }
 975
 976         packet->type = hpsb_async;
 977         packet->node_id = packet->header[0] >> 16;
 978         packet->tcode = (packet->header[0] >> 4) & 0xf;
 979         packet->tlabel = (packet->header[0] >> 10) & 0x3f;
 980         packet->host = fi->host;
 981         packet->expect_response = expect_response;
 982         packet->header_size = header_length;
 983         packet->data_size = data_size;
 984
 985         req->req.length = 0;
 986         hpsb_set_packet_complete_task(packet,
 987                                       (void (*)(void *))queue_complete_cb, req);
 988
 989         spin_lock_irqsave(&fi->reqlists_lock, flags);
 990         list_add_tail(&req->list, &fi->req_pending);
 991         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 992
 993         /* Update the generation of the packet just before sending. */
 994         packet->generation = req->req.generation;
 995
 996         if (hpsb_send_packet(packet) < 0) {
 997                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 998                 queue_complete_req(req);
 999         }
1000
1001         return 0;
1002 }
1003
1004 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
1005                     u64 addr, size_t length, u16 flags)
1006 {
1007         unsigned long irqflags;
1008         struct pending_request *req;
1009         struct host_info *hi;
1010         struct file_info *fi = NULL;
1011         struct list_head *entry;
1012         struct arm_addr *arm_addr = NULL;
1013         struct arm_request *arm_req = NULL;
1014         struct arm_response *arm_resp = NULL;
1015         int found = 0, size = 0, rcode = -1;
1016         struct arm_request_response *arm_req_resp = NULL;
1017
1018         DBGMSG("arm_read  called by node: %X"
1019                "addr: %4.4x %8.8x length: %Zu", nodeid,
1020                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1021                length);
1022         spin_lock_irqsave(&host_info_lock, irqflags);
1023         hi = find_host_info(host);      /* search address-entry */
1024         if (hi != NULL) {
1025                 list_for_each_entry(fi, &hi->file_info_list, list) {
1026                         entry = fi->addr_list.next;
1027                         while (entry != &(fi->addr_list)) {
1028                                 arm_addr =
1029                                     list_entry(entry, struct arm_addr,
1030                                                addr_list);
1031                                 if (((arm_addr->start) <= (addr))
1032                                     && ((arm_addr->end) >= (addr + length))) {
1033                                         found = 1;
1034                                         break;
1035                                 }
1036                                 entry = entry->next;
1037                         }
1038                         if (found) {
1039                                 break;
1040                         }
1041                 }
1042         }
1043         rcode = -1;
1044         if (!found) {
1045                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
1046                        " -> rcode_address_error\n");
1047                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1048                 return (RCODE_ADDRESS_ERROR);
1049         } else {
1050                 DBGMSG("arm_read addr_entry FOUND");
1051         }
1052         if (arm_addr->rec_length < length) {
1053                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
1054                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1055         }
1056         if (rcode == -1) {
1057                 if (arm_addr->access_rights & ARM_READ) {
1058                         if (!(arm_addr->client_transactions & ARM_READ)) {
1059                                 memcpy(buffer,
1060                                        (arm_addr->addr_space_buffer) + (addr -
1061                                                                         (arm_addr->
1062                                                                          start)),
1063                                        length);
1064                                 DBGMSG("arm_read -> (rcode_complete)");
1065                                 rcode = RCODE_COMPLETE;
1066                         }
1067                 } else {
1068                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1069                         DBGMSG("arm_read -> rcode_type_error (access denied)");
1070                 }
1071         }
1072         if (arm_addr->notification_options & ARM_READ) {
1073                 DBGMSG("arm_read -> entering notification-section");
1074                 req = __alloc_pending_request(GFP_ATOMIC);
1075                 if (!req) {
1076                         DBGMSG("arm_read -> rcode_conflict_error");
1077                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1078                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1079                                                            The request may be retried */
1080                 }
1081                 if (rcode == RCODE_COMPLETE) {
1082                         size =
1083                             sizeof(struct arm_request) +
1084                             sizeof(struct arm_response) +
1085                             length * sizeof(byte_t) +
1086                             sizeof(struct arm_request_response);
1087                 } else {
1088                         size =
1089                             sizeof(struct arm_request) +
1090                             sizeof(struct arm_response) +
1091                             sizeof(struct arm_request_response);
1092                 }
1093                 req->data = kmalloc(size, GFP_ATOMIC);
1094                 if (!(req->data)) {
1095                         free_pending_request(req);
1096                         DBGMSG("arm_read -> rcode_conflict_error");
1097                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1098                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1099                                                            The request may be retried */
1100                 }
1101                 req->free_data = 1;
1102                 req->file_info = fi;
1103                 req->req.type = RAW1394_REQ_ARM;
1104                 req->req.generation = get_hpsb_generation(host);
1105                 req->req.misc =
1106                     (((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
1107                 req->req.tag = arm_addr->arm_tag;
1108                 req->req.recvb = arm_addr->recvb;
1109                 req->req.length = size;
1110                 arm_req_resp = (struct arm_request_response *)(req->data);
1111                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1112                                                  (sizeof
1113                                                   (struct
1114                                                    arm_request_response)));
1115                 arm_resp =
1116                     (struct arm_response *)((byte_t *) (arm_req) +
1117                                             (sizeof(struct arm_request)));
1118                 arm_req->buffer = NULL;
1119                 arm_resp->buffer = NULL;
1120                 if (rcode == RCODE_COMPLETE) {
1121                         byte_t *buf =
1122                             (byte_t *) arm_resp + sizeof(struct arm_response);
1123                         memcpy(buf,
1124                                (arm_addr->addr_space_buffer) + (addr -
1125                                                                 (arm_addr->
1126                                                                  start)),
1127                                length);
1128                         arm_resp->buffer =
1129                             int2ptr((arm_addr->recvb) +
1130                                     sizeof(struct arm_request_response) +
1131                                     sizeof(struct arm_request) +
1132                                     sizeof(struct arm_response));
1133                 }
1134                 arm_resp->buffer_length =
1135                     (rcode == RCODE_COMPLETE) ? length : 0;
1136                 arm_resp->response_code = rcode;
1137                 arm_req->buffer_length = 0;
1138                 arm_req->generation = req->req.generation;
1139                 arm_req->extended_transaction_code = 0;
1140                 arm_req->destination_offset = addr;
1141                 arm_req->source_nodeid = nodeid;
1142                 arm_req->destination_nodeid = host->node_id;
1143                 arm_req->tlabel = (flags >> 10) & 0x3f;
1144                 arm_req->tcode = (flags >> 4) & 0x0f;
1145                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1146                                                 sizeof(struct
1147                                                        arm_request_response));
1148                 arm_req_resp->response =
1149                     int2ptr((arm_addr->recvb) +
1150                             sizeof(struct arm_request_response) +
1151                             sizeof(struct arm_request));
1152                 queue_complete_req(req);
1153         }
1154         spin_unlock_irqrestore(&host_info_lock, irqflags);
1155         return (rcode);
1156 }
1157
1158 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
1159                      quadlet_t * data, u64 addr, size_t length, u16 flags)
1160 {
1161         unsigned long irqflags;
1162         struct pending_request *req;
1163         struct host_info *hi;
1164         struct file_info *fi = NULL;
1165         struct list_head *entry;
1166         struct arm_addr *arm_addr = NULL;
1167         struct arm_request *arm_req = NULL;
1168         struct arm_response *arm_resp = NULL;
1169         int found = 0, size = 0, rcode = -1, length_conflict = 0;
1170         struct arm_request_response *arm_req_resp = NULL;
1171
1172         DBGMSG("arm_write called by node: %X"
1173                "addr: %4.4x %8.8x length: %Zu", nodeid,
1174                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1175                length);
1176         spin_lock_irqsave(&host_info_lock, irqflags);
1177         hi = find_host_info(host);      /* search address-entry */
1178         if (hi != NULL) {
1179                 list_for_each_entry(fi, &hi->file_info_list, list) {
1180                         entry = fi->addr_list.next;
1181                         while (entry != &(fi->addr_list)) {
1182                                 arm_addr =
1183                                     list_entry(entry, struct arm_addr,
1184                                                addr_list);
1185                                 if (((arm_addr->start) <= (addr))
1186                                     && ((arm_addr->end) >= (addr + length))) {
1187                                         found = 1;
1188                                         break;
1189                                 }
1190                                 entry = entry->next;
1191                         }
1192                         if (found) {
1193                                 break;
1194                         }
1195                 }
1196         }
1197         rcode = -1;
1198         if (!found) {
1199                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1200                        " -> rcode_address_error\n");
1201                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1202                 return (RCODE_ADDRESS_ERROR);
1203         } else {
1204                 DBGMSG("arm_write addr_entry FOUND");
1205         }
1206         if (arm_addr->rec_length < length) {
1207                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1208                 length_conflict = 1;
1209                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1210         }
1211         if (rcode == -1) {
1212                 if (arm_addr->access_rights & ARM_WRITE) {
1213                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1214                                 memcpy((arm_addr->addr_space_buffer) +
1215                                        (addr - (arm_addr->start)), data,
1216                                        length);
1217                                 DBGMSG("arm_write -> (rcode_complete)");
1218                                 rcode = RCODE_COMPLETE;
1219                         }
1220                 } else {
1221                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1222                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1223                 }
1224         }
1225         if (arm_addr->notification_options & ARM_WRITE) {
1226                 DBGMSG("arm_write -> entering notification-section");
1227                 req = __alloc_pending_request(GFP_ATOMIC);
1228                 if (!req) {
1229                         DBGMSG("arm_write -> rcode_conflict_error");
1230                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1231                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1232                                                            The request my be retried */
1233                 }
1234                 size =
1235                     sizeof(struct arm_request) + sizeof(struct arm_response) +
1236                     (length) * sizeof(byte_t) +
1237                     sizeof(struct arm_request_response);
1238                 req->data = kmalloc(size, GFP_ATOMIC);
1239                 if (!(req->data)) {
1240                         free_pending_request(req);
1241                         DBGMSG("arm_write -> rcode_conflict_error");
1242                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1243                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1244                                                            The request may be retried */
1245                 }
1246                 req->free_data = 1;
1247                 req->file_info = fi;
1248                 req->req.type = RAW1394_REQ_ARM;
1249                 req->req.generation = get_hpsb_generation(host);
1250                 req->req.misc =
1251                     (((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1252                 req->req.tag = arm_addr->arm_tag;
1253                 req->req.recvb = arm_addr->recvb;
1254                 req->req.length = size;
1255                 arm_req_resp = (struct arm_request_response *)(req->data);
1256                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1257                                                  (sizeof
1258                                                   (struct
1259                                                    arm_request_response)));
1260                 arm_resp =
1261                     (struct arm_response *)((byte_t *) (arm_req) +
1262                                             (sizeof(struct arm_request)));
1263                 arm_resp->buffer = NULL;
1264                 memcpy((byte_t *) arm_resp + sizeof(struct arm_response),
1265                        data, length);
1266                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1267                                           sizeof(struct arm_request_response) +
1268                                           sizeof(struct arm_request) +
1269                                           sizeof(struct arm_response));
1270                 arm_req->buffer_length = length;
1271                 arm_req->generation = req->req.generation;
1272                 arm_req->extended_transaction_code = 0;
1273                 arm_req->destination_offset = addr;
1274                 arm_req->source_nodeid = nodeid;
1275                 arm_req->destination_nodeid = destid;
1276                 arm_req->tlabel = (flags >> 10) & 0x3f;
1277                 arm_req->tcode = (flags >> 4) & 0x0f;
1278                 arm_resp->buffer_length = 0;
1279                 arm_resp->response_code = rcode;
1280                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1281                                                 sizeof(struct
1282                                                        arm_request_response));
1283                 arm_req_resp->response =
1284                     int2ptr((arm_addr->recvb) +
1285                             sizeof(struct arm_request_response) +
1286                             sizeof(struct arm_request));
1287                 queue_complete_req(req);
1288         }
1289         spin_unlock_irqrestore(&host_info_lock, irqflags);
1290         return (rcode);
1291 }
1292
1293 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
1294                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
1295                     u16 flags)
1296 {
1297         unsigned long irqflags;
1298         struct pending_request *req;
1299         struct host_info *hi;
1300         struct file_info *fi = NULL;
1301         struct list_head *entry;
1302         struct arm_addr *arm_addr = NULL;
1303         struct arm_request *arm_req = NULL;
1304         struct arm_response *arm_resp = NULL;
1305         int found = 0, size = 0, rcode = -1;
1306         quadlet_t old, new;
1307         struct arm_request_response *arm_req_resp = NULL;
1308
1309         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1310             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1311                 DBGMSG("arm_lock  called by node: %X "
1312                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1313                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1314                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1315                        be32_to_cpu(data));
1316         } else {
1317                 DBGMSG("arm_lock  called by node: %X "
1318                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1319                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1320                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1321                        be32_to_cpu(data), be32_to_cpu(arg));
1322         }
1323         spin_lock_irqsave(&host_info_lock, irqflags);
1324         hi = find_host_info(host);      /* search address-entry */
1325         if (hi != NULL) {
1326                 list_for_each_entry(fi, &hi->file_info_list, list) {
1327                         entry = fi->addr_list.next;
1328                         while (entry != &(fi->addr_list)) {
1329                                 arm_addr =
1330                                     list_entry(entry, struct arm_addr,
1331                                                addr_list);
1332                                 if (((arm_addr->start) <= (addr))
1333                                     && ((arm_addr->end) >=
1334                                         (addr + sizeof(*store)))) {
1335                                         found = 1;
1336                                         break;
1337                                 }
1338                                 entry = entry->next;
1339                         }
1340                         if (found) {
1341                                 break;
1342                         }
1343                 }
1344         }
1345         rcode = -1;
1346         if (!found) {
1347                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1348                        " -> rcode_address_error\n");
1349                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1350                 return (RCODE_ADDRESS_ERROR);
1351         } else {
1352                 DBGMSG("arm_lock addr_entry FOUND");
1353         }
1354         if (rcode == -1) {
1355                 if (arm_addr->access_rights & ARM_LOCK) {
1356                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1357                                 memcpy(&old,
1358                                        (arm_addr->addr_space_buffer) + (addr -
1359                                                                         (arm_addr->
1360                                                                          start)),
1361                                        sizeof(old));
1362                                 switch (ext_tcode) {
1363                                 case (EXTCODE_MASK_SWAP):
1364                                         new = data | (old & ~arg);
1365                                         break;
1366                                 case (EXTCODE_COMPARE_SWAP):
1367                                         if (old == arg) {
1368                                                 new = data;
1369                                         } else {
1370                                                 new = old;
1371                                         }
1372                                         break;
1373                                 case (EXTCODE_FETCH_ADD):
1374                                         new =
1375                                             cpu_to_be32(be32_to_cpu(data) +
1376                                                         be32_to_cpu(old));
1377                                         break;
1378                                 case (EXTCODE_LITTLE_ADD):
1379                                         new =
1380                                             cpu_to_le32(le32_to_cpu(data) +
1381                                                         le32_to_cpu(old));
1382                                         break;
1383                                 case (EXTCODE_BOUNDED_ADD):
1384                                         if (old != arg) {
1385                                                 new =
1386                                                     cpu_to_be32(be32_to_cpu
1387                                                                 (data) +
1388                                                                 be32_to_cpu
1389                                                                 (old));
1390                                         } else {
1391                                                 new = old;
1392                                         }
1393                                         break;
1394                                 case (EXTCODE_WRAP_ADD):
1395                                         if (old != arg) {
1396                                                 new =
1397                                                     cpu_to_be32(be32_to_cpu
1398                                                                 (data) +
1399                                                                 be32_to_cpu
1400                                                                 (old));
1401                                         } else {
1402                                                 new = data;
1403                                         }
1404                                         break;
1405                                 default:
1406                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1407                                         printk(KERN_ERR
1408                                                "raw1394: arm_lock FAILED "
1409                                                "ext_tcode not allowed -> rcode_type_error\n");
1410                                         break;
1411                                 }       /*switch */
1412                                 if (rcode == -1) {
1413                                         DBGMSG("arm_lock -> (rcode_complete)");
1414                                         rcode = RCODE_COMPLETE;
1415                                         memcpy(store, &old, sizeof(*store));
1416                                         memcpy((arm_addr->addr_space_buffer) +
1417                                                (addr - (arm_addr->start)),
1418                                                &new, sizeof(*store));
1419                                 }
1420                         }
1421                 } else {
1422                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1423                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1424                 }
1425         }
1426         if (arm_addr->notification_options & ARM_LOCK) {
1427                 byte_t *buf1, *buf2;
1428                 DBGMSG("arm_lock -> entering notification-section");
1429                 req = __alloc_pending_request(GFP_ATOMIC);
1430                 if (!req) {
1431                         DBGMSG("arm_lock -> rcode_conflict_error");
1432                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1433                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1434                                                            The request may be retried */
1435                 }
1436                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1437                 req->data = kmalloc(size, GFP_ATOMIC);
1438                 if (!(req->data)) {
1439                         free_pending_request(req);
1440                         DBGMSG("arm_lock -> rcode_conflict_error");
1441                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1442                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1443                                                            The request may be retried */
1444                 }
1445                 req->free_data = 1;
1446                 arm_req_resp = (struct arm_request_response *)(req->data);
1447                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1448                                                  (sizeof
1449                                                   (struct
1450                                                    arm_request_response)));
1451                 arm_resp =
1452                     (struct arm_response *)((byte_t *) (arm_req) +
1453                                             (sizeof(struct arm_request)));
1454                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1455                 buf2 = buf1 + 2 * sizeof(*store);
1456                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1457                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1458                         arm_req->buffer_length = sizeof(*store);
1459                         memcpy(buf1, &data, sizeof(*store));
1460
1461                 } else {
1462                         arm_req->buffer_length = 2 * sizeof(*store);
1463                         memcpy(buf1, &arg, sizeof(*store));
1464                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1465                 }
1466                 if (rcode == RCODE_COMPLETE) {
1467                         arm_resp->buffer_length = sizeof(*store);
1468                         memcpy(buf2, &old, sizeof(*store));
1469                 } else {
1470                         arm_resp->buffer_length = 0;
1471                 }
1472                 req->file_info = fi;
1473                 req->req.type = RAW1394_REQ_ARM;
1474                 req->req.generation = get_hpsb_generation(host);
1475                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1476                                  (ARM_LOCK & 0xFF));
1477                 req->req.tag = arm_addr->arm_tag;
1478                 req->req.recvb = arm_addr->recvb;
1479                 req->req.length = size;
1480                 arm_req->generation = req->req.generation;
1481                 arm_req->extended_transaction_code = ext_tcode;
1482                 arm_req->destination_offset = addr;
1483                 arm_req->source_nodeid = nodeid;
1484                 arm_req->destination_nodeid = host->node_id;
1485                 arm_req->tlabel = (flags >> 10) & 0x3f;
1486                 arm_req->tcode = (flags >> 4) & 0x0f;
1487                 arm_resp->response_code = rcode;
1488                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1489                                                 sizeof(struct
1490                                                        arm_request_response));
1491                 arm_req_resp->response =
1492                     int2ptr((arm_addr->recvb) +
1493                             sizeof(struct arm_request_response) +
1494                             sizeof(struct arm_request));
1495                 arm_req->buffer =
1496                     int2ptr((arm_addr->recvb) +
1497                             sizeof(struct arm_request_response) +
1498                             sizeof(struct arm_request) +
1499                             sizeof(struct arm_response));
1500                 arm_resp->buffer =
1501                     int2ptr((arm_addr->recvb) +
1502                             sizeof(struct arm_request_response) +
1503                             sizeof(struct arm_request) +
1504                             sizeof(struct arm_response) + 2 * sizeof(*store));
1505                 queue_complete_req(req);
1506         }
1507         spin_unlock_irqrestore(&host_info_lock, irqflags);
1508         return (rcode);
1509 }
1510
1511 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
1512                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
1513                       u16 flags)
1514 {
1515         unsigned long irqflags;
1516         struct pending_request *req;
1517         struct host_info *hi;
1518         struct file_info *fi = NULL;
1519         struct list_head *entry;
1520         struct arm_addr *arm_addr = NULL;
1521         struct arm_request *arm_req = NULL;
1522         struct arm_response *arm_resp = NULL;
1523         int found = 0, size = 0, rcode = -1;
1524         octlet_t old, new;
1525         struct arm_request_response *arm_req_resp = NULL;
1526
1527         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1528             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1529                 DBGMSG("arm_lock64 called by node: %X "
1530                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1531                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1532                        (u32) (addr & 0xFFFFFFFF),
1533                        ext_tcode & 0xFF,
1534                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1535                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1536         } else {
1537                 DBGMSG("arm_lock64 called by node: %X "
1538                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1539                        "%8.8X %8.8X ",
1540                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1541                        (u32) (addr & 0xFFFFFFFF),
1542                        ext_tcode & 0xFF,
1543                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1544                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1545                        (u32) ((be64_to_cpu(arg) >> 32) & 0xFFFFFFFF),
1546                        (u32) (be64_to_cpu(arg) & 0xFFFFFFFF));
1547         }
1548         spin_lock_irqsave(&host_info_lock, irqflags);
1549         hi = find_host_info(host);      /* search addressentry in file_info's for host */
1550         if (hi != NULL) {
1551                 list_for_each_entry(fi, &hi->file_info_list, list) {
1552                         entry = fi->addr_list.next;
1553                         while (entry != &(fi->addr_list)) {
1554                                 arm_addr =
1555                                     list_entry(entry, struct arm_addr,
1556                                                addr_list);
1557                                 if (((arm_addr->start) <= (addr))
1558                                     && ((arm_addr->end) >=
1559                                         (addr + sizeof(*store)))) {
1560                                         found = 1;
1561                                         break;
1562                                 }
1563                                 entry = entry->next;
1564                         }
1565                         if (found) {
1566                                 break;
1567                         }
1568                 }
1569         }
1570         rcode = -1;
1571         if (!found) {
1572                 printk(KERN_ERR
1573                        "raw1394: arm_lock64 FAILED addr_entry not found"
1574                        " -> rcode_address_error\n");
1575                 spin_unlock_irqrestore(&host_info_lock, irqflags);
1576                 return (RCODE_ADDRESS_ERROR);
1577         } else {
1578                 DBGMSG("arm_lock64 addr_entry FOUND");
1579         }
1580         if (rcode == -1) {
1581                 if (arm_addr->access_rights & ARM_LOCK) {
1582                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1583                                 memcpy(&old,
1584                                        (arm_addr->addr_space_buffer) + (addr -
1585                                                                         (arm_addr->
1586                                                                          start)),
1587                                        sizeof(old));
1588                                 switch (ext_tcode) {
1589                                 case (EXTCODE_MASK_SWAP):
1590                                         new = data | (old & ~arg);
1591                                         break;
1592                                 case (EXTCODE_COMPARE_SWAP):
1593                                         if (old == arg) {
1594                                                 new = data;
1595                                         } else {
1596                                                 new = old;
1597                                         }
1598                                         break;
1599                                 case (EXTCODE_FETCH_ADD):
1600                                         new =
1601                                             cpu_to_be64(be64_to_cpu(data) +
1602                                                         be64_to_cpu(old));
1603                                         break;
1604                                 case (EXTCODE_LITTLE_ADD):
1605                                         new =
1606                                             cpu_to_le64(le64_to_cpu(data) +
1607                                                         le64_to_cpu(old));
1608                                         break;
1609                                 case (EXTCODE_BOUNDED_ADD):
1610                                         if (old != arg) {
1611                                                 new =
1612                                                     cpu_to_be64(be64_to_cpu
1613                                                                 (data) +
1614                                                                 be64_to_cpu
1615                                                                 (old));
1616                                         } else {
1617                                                 new = old;
1618                                         }
1619                                         break;
1620                                 case (EXTCODE_WRAP_ADD):
1621                                         if (old != arg) {
1622                                                 new =
1623                                                     cpu_to_be64(be64_to_cpu
1624                                                                 (data) +
1625                                                                 be64_to_cpu
1626                                                                 (old));
1627                                         } else {
1628                                                 new = data;
1629                                         }
1630                                         break;
1631                                 default:
1632                                         printk(KERN_ERR
1633                                                "raw1394: arm_lock64 FAILED "
1634                                                "ext_tcode not allowed -> rcode_type_error\n");
1635                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1636                                         break;
1637                                 }       /*switch */
1638                                 if (rcode == -1) {
1639                                         DBGMSG
1640                                             ("arm_lock64 -> (rcode_complete)");
1641                                         rcode = RCODE_COMPLETE;
1642                                         memcpy(store, &old, sizeof(*store));
1643                                         memcpy((arm_addr->addr_space_buffer) +
1644                                                (addr - (arm_addr->start)),
1645                                                &new, sizeof(*store));
1646                                 }
1647                         }
1648                 } else {
1649                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1650                         DBGMSG
1651                             ("arm_lock64 -> rcode_type_error (access denied)");
1652                 }
1653         }
1654         if (arm_addr->notification_options & ARM_LOCK) {
1655                 byte_t *buf1, *buf2;
1656                 DBGMSG("arm_lock64 -> entering notification-section");
1657                 req = __alloc_pending_request(GFP_ATOMIC);
1658                 if (!req) {
1659                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1660                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1661                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1662                                                            The request may be retried */
1663                 }
1664                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1665                 req->data = kmalloc(size, GFP_ATOMIC);
1666                 if (!(req->data)) {
1667                         free_pending_request(req);
1668                         spin_unlock_irqrestore(&host_info_lock, irqflags);
1669                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1670                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1671                                                            The request may be retried */
1672                 }
1673                 req->free_data = 1;
1674                 arm_req_resp = (struct arm_request_response *)(req->data);
1675                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1676                                                  (sizeof
1677                                                   (struct
1678                                                    arm_request_response)));
1679                 arm_resp =
1680                     (struct arm_response *)((byte_t *) (arm_req) +
1681                                             (sizeof(struct arm_request)));
1682                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1683                 buf2 = buf1 + 2 * sizeof(*store);
1684                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1685                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1686                         arm_req->buffer_length = sizeof(*store);
1687                         memcpy(buf1, &data, sizeof(*store));
1688
1689                 } else {
1690                         arm_req->buffer_length = 2 * sizeof(*store);
1691                         memcpy(buf1, &arg, sizeof(*store));
1692                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1693                 }
1694                 if (rcode == RCODE_COMPLETE) {
1695                         arm_resp->buffer_length = sizeof(*store);
1696                         memcpy(buf2, &old, sizeof(*store));
1697                 } else {
1698                         arm_resp->buffer_length = 0;
1699                 }
1700                 req->file_info = fi;
1701                 req->req.type = RAW1394_REQ_ARM;
1702                 req->req.generation = get_hpsb_generation(host);
1703                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1704                                  (ARM_LOCK & 0xFF));
1705                 req->req.tag = arm_addr->arm_tag;
1706                 req->req.recvb = arm_addr->recvb;
1707                 req->req.length = size;
1708                 arm_req->generation = req->req.generation;
1709                 arm_req->extended_transaction_code = ext_tcode;
1710                 arm_req->destination_offset = addr;
1711                 arm_req->source_nodeid = nodeid;
1712                 arm_req->destination_nodeid = host->node_id;
1713                 arm_req->tlabel = (flags >> 10) & 0x3f;
1714                 arm_req->tcode = (flags >> 4) & 0x0f;
1715                 arm_resp->response_code = rcode;
1716                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1717                                                 sizeof(struct
1718                                                        arm_request_response));
1719                 arm_req_resp->response =
1720                     int2ptr((arm_addr->recvb) +
1721                             sizeof(struct arm_request_response) +
1722                             sizeof(struct arm_request));
1723                 arm_req->buffer =
1724                     int2ptr((arm_addr->recvb) +
1725                             sizeof(struct arm_request_response) +
1726                             sizeof(struct arm_request) +
1727                             sizeof(struct arm_response));
1728                 arm_resp->buffer =
1729                     int2ptr((arm_addr->recvb) +
1730                             sizeof(struct arm_request_response) +
1731                             sizeof(struct arm_request) +
1732                             sizeof(struct arm_response) + 2 * sizeof(*store));
1733                 queue_complete_req(req);
1734         }
1735         spin_unlock_irqrestore(&host_info_lock, irqflags);
1736         return (rcode);
1737 }
1738
1739 static int arm_register(struct file_info *fi, struct pending_request *req)
1740 {
1741         int retval;
1742         struct arm_addr *addr;
1743         struct host_info *hi;
1744         struct file_info *fi_hlp = NULL;
1745         struct list_head *entry;
1746         struct arm_addr *arm_addr = NULL;
1747         int same_host, another_host;
1748         unsigned long flags;
1749
1750         DBGMSG("arm_register called "
1751                "addr(Offset): %8.8x %8.8x length: %u "
1752                "rights: %2.2X notify: %2.2X "
1753                "max_blk_len: %4.4X",
1754                (u32) ((req->req.address >> 32) & 0xFFFF),
1755                (u32) (req->req.address & 0xFFFFFFFF),
1756                req->req.length, ((req->req.misc >> 8) & 0xFF),
1757                (req->req.misc & 0xFF), ((req->req.misc >> 16) & 0xFFFF));
1758         /* check addressrange */
1759         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1760             (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) !=
1761              0)) {
1762                 req->req.length = 0;
1763                 return (-EINVAL);
1764         }
1765         /* addr-list-entry for fileinfo */
1766         addr = kmalloc(sizeof(*addr), GFP_KERNEL);
1767         if (!addr) {
1768                 req->req.length = 0;
1769                 return (-ENOMEM);
1770         }
1771         /* allocation of addr_space_buffer */
1772         addr->addr_space_buffer = vmalloc(req->req.length);
1773         if (!(addr->addr_space_buffer)) {
1774                 kfree(addr);
1775                 req->req.length = 0;
1776                 return (-ENOMEM);
1777         }
1778         /* initialization of addr_space_buffer */
1779         if ((req->req.sendb) == (unsigned long)NULL) {
1780                 /* init: set 0 */
1781                 memset(addr->addr_space_buffer, 0, req->req.length);
1782         } else {
1783                 /* init: user -> kernel */
1784                 if (copy_from_user
1785                     (addr->addr_space_buffer, int2ptr(req->req.sendb),
1786                      req->req.length)) {
1787                         vfree(addr->addr_space_buffer);
1788                         kfree(addr);
1789                         return (-EFAULT);
1790                 }
1791         }
1792         INIT_LIST_HEAD(&addr->addr_list);
1793         addr->arm_tag = req->req.tag;
1794         addr->start = req->req.address;
1795         addr->end = req->req.address + req->req.length;
1796         addr->access_rights = (u8) (req->req.misc & 0x0F);
1797         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1798         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1799         addr->access_rights |= addr->client_transactions;
1800         addr->notification_options |= addr->client_transactions;
1801         addr->recvb = req->req.recvb;
1802         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1803
1804         spin_lock_irqsave(&host_info_lock, flags);
1805         hi = find_host_info(fi->host);
1806         same_host = 0;
1807         another_host = 0;
1808         /* same host with address-entry containing same addressrange ? */
1809         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1810                 entry = fi_hlp->addr_list.next;
1811                 while (entry != &(fi_hlp->addr_list)) {
1812                         arm_addr =
1813                             list_entry(entry, struct arm_addr, addr_list);
1814                         if ((arm_addr->start == addr->start)
1815                             && (arm_addr->end == addr->end)) {
1816                                 DBGMSG("same host ownes same "
1817                                        "addressrange -> EALREADY");
1818                                 same_host = 1;
1819                                 break;
1820                         }
1821                         entry = entry->next;
1822                 }
1823                 if (same_host) {
1824                         break;
1825                 }
1826         }
1827         if (same_host) {
1828                 /* addressrange occupied by same host */
1829                 spin_unlock_irqrestore(&host_info_lock, flags);
1830                 vfree(addr->addr_space_buffer);
1831                 kfree(addr);
1832                 return (-EALREADY);
1833         }
1834         /* another host with valid address-entry containing same addressrange */
1835         list_for_each_entry(hi, &host_info_list, list) {
1836                 if (hi->host != fi->host) {
1837                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1838                                 entry = fi_hlp->addr_list.next;
1839                                 while (entry != &(fi_hlp->addr_list)) {
1840                                         arm_addr =
1841                                             list_entry(entry, struct arm_addr,
1842                                                        addr_list);
1843                                         if ((arm_addr->start == addr->start)
1844                                             && (arm_addr->end == addr->end)) {
1845                                                 DBGMSG
1846                                                     ("another host ownes same "
1847                                                      "addressrange");
1848                                                 another_host = 1;
1849                                                 break;
1850                                         }
1851                                         entry = entry->next;
1852                                 }
1853                                 if (another_host) {
1854                                         break;
1855                                 }
1856                         }
1857                 }
1858         }
1859         spin_unlock_irqrestore(&host_info_lock, flags);
1860
1861         if (another_host) {
1862                 DBGMSG("another hosts entry is valid -> SUCCESS");
1863                 if (copy_to_user(int2ptr(req->req.recvb),
1864                                  &addr->start, sizeof(u64))) {
1865                         printk(KERN_ERR "raw1394: arm_register failed "
1866                                " address-range-entry is invalid -> EFAULT !!!\n");
1867                         vfree(addr->addr_space_buffer);
1868                         kfree(addr);
1869                         return (-EFAULT);
1870                 }
1871                 free_pending_request(req);      /* immediate success or fail */
1872                 /* INSERT ENTRY */
1873                 spin_lock_irqsave(&host_info_lock, flags);
1874                 list_add_tail(&addr->addr_list, &fi->addr_list);
1875                 spin_unlock_irqrestore(&host_info_lock, flags);
1876                 return 0;
1877         }
1878         retval =
1879             hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
1880                                     req->req.address,
1881                                     req->req.address + req->req.length);
1882         if (retval) {
1883                 /* INSERT ENTRY */
1884                 spin_lock_irqsave(&host_info_lock, flags);
1885                 list_add_tail(&addr->addr_list, &fi->addr_list);
1886                 spin_unlock_irqrestore(&host_info_lock, flags);
1887         } else {
1888                 DBGMSG("arm_register failed errno: %d \n", retval);
1889                 vfree(addr->addr_space_buffer);
1890                 kfree(addr);
1891                 return (-EALREADY);
1892         }
1893         free_pending_request(req);      /* immediate success or fail */
1894         return 0;
1895 }
1896
1897 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1898 {
1899         int found = 0;
1900         int retval = 0;
1901         struct list_head *entry;
1902         struct arm_addr *addr = NULL;
1903         struct host_info *hi;
1904         struct file_info *fi_hlp = NULL;
1905         struct arm_addr *arm_addr = NULL;
1906         int another_host;
1907         unsigned long flags;
1908
1909         DBGMSG("arm_Unregister called addr(Offset): "
1910                "%8.8x %8.8x",
1911                (u32) ((req->req.address >> 32) & 0xFFFF),
1912                (u32) (req->req.address & 0xFFFFFFFF));
1913         spin_lock_irqsave(&host_info_lock, flags);
1914         /* get addr */
1915         entry = fi->addr_list.next;
1916         while (entry != &(fi->addr_list)) {
1917                 addr = list_entry(entry, struct arm_addr, addr_list);
1918                 if (addr->start == req->req.address) {
1919                         found = 1;
1920                         break;
1921                 }
1922                 entry = entry->next;
1923         }
1924         if (!found) {
1925                 DBGMSG("arm_Unregister addr not found");
1926                 spin_unlock_irqrestore(&host_info_lock, flags);
1927                 return (-EINVAL);
1928         }
1929         DBGMSG("arm_Unregister addr found");
1930         another_host = 0;
1931         /* another host with valid address-entry containing
1932            same addressrange */
1933         list_for_each_entry(hi, &host_info_list, list) {
1934                 if (hi->host != fi->host) {
1935                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1936                                 entry = fi_hlp->addr_list.next;
1937                                 while (entry != &(fi_hlp->addr_list)) {
1938                                         arm_addr = list_entry(entry,
1939                                                               struct arm_addr,
1940                                                               addr_list);
1941                                         if (arm_addr->start == addr->start) {
1942                                                 DBGMSG("another host ownes "
1943                                                        "same addressrange");
1944                                                 another_host = 1;
1945                                                 break;
1946                                         }
1947                                         entry = entry->next;
1948                                 }
1949                                 if (another_host) {
1950                                         break;
1951                                 }
1952                         }
1953                 }
1954         }
1955         if (another_host) {
1956                 DBGMSG("delete entry from list -> success");
1957                 list_del(&addr->addr_list);
1958                 spin_unlock_irqrestore(&host_info_lock, flags);
1959                 vfree(addr->addr_space_buffer);
1960                 kfree(addr);
1961                 free_pending_request(req);      /* immediate success or fail */
1962                 return 0;
1963         }
1964         retval =
1965             hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
1966                                       addr->start);
1967         if (!retval) {
1968                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1969                 spin_unlock_irqrestore(&host_info_lock, flags);
1970                 return (-EINVAL);
1971         }
1972         DBGMSG("delete entry from list -> success");
1973         list_del(&addr->addr_list);
1974         spin_unlock_irqrestore(&host_info_lock, flags);
1975         vfree(addr->addr_space_buffer);
1976         kfree(addr);
1977         free_pending_request(req);      /* immediate success or fail */
1978         return 0;
1979 }
1980
1981 /* Copy data from ARM buffer(s) to user buffer. */
1982 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1983 {
1984         struct arm_addr *arm_addr = NULL;
1985         unsigned long flags;
1986         unsigned long offset;
1987
1988         struct list_head *entry;
1989
1990         DBGMSG("arm_get_buf "
1991                "addr(Offset): %04X %08X length: %u",
1992                (u32) ((req->req.address >> 32) & 0xFFFF),
1993                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1994
1995         spin_lock_irqsave(&host_info_lock, flags);
1996         entry = fi->addr_list.next;
1997         while (entry != &(fi->addr_list)) {
1998                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1999                 if ((arm_addr->start <= req->req.address) &&
2000                     (arm_addr->end > req->req.address)) {
2001                         if (req->req.address + req->req.length <= arm_addr->end) {
2002                                 offset = req->req.address - arm_addr->start;
2003                                 spin_unlock_irqrestore(&host_info_lock, flags);
2004
2005                                 DBGMSG
2006                                     ("arm_get_buf copy_to_user( %08X, %p, %u )",
2007                                      (u32) req->req.recvb,
2008                                      arm_addr->addr_space_buffer + offset,
2009                                      (u32) req->req.length);
2010                                 if (copy_to_user
2011                                     (int2ptr(req->req.recvb),
2012                                      arm_addr->addr_space_buffer + offset,
2013                                      req->req.length))
2014                                         return (-EFAULT);
2015
2016                                 /* We have to free the request, because we
2017                                  * queue no response, and therefore nobody
2018                                  * will free it. */
2019                                 free_pending_request(req);
2020                                 return 0;
2021                         } else {
2022                                 DBGMSG("arm_get_buf request exceeded mapping");
2023                                 spin_unlock_irqrestore(&host_info_lock, flags);
2024                                 return (-EINVAL);
2025                         }
2026                 }
2027                 entry = entry->next;
2028         }
2029         spin_unlock_irqrestore(&host_info_lock, flags);
2030         return (-EINVAL);
2031 }
2032
2033 /* Copy data from user buffer to ARM buffer(s). */
2034 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
2035 {
2036         struct arm_addr *arm_addr = NULL;
2037         unsigned long flags;
2038         unsigned long offset;
2039
2040         struct list_head *entry;
2041
2042         DBGMSG("arm_set_buf "
2043                "addr(Offset): %04X %08X length: %u",
2044                (u32) ((req->req.address >> 32) & 0xFFFF),
2045                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
2046
2047         spin_lock_irqsave(&host_info_lock, flags);
2048         entry = fi->addr_list.next;
2049         while (entry != &(fi->addr_list)) {
2050                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
2051                 if ((arm_addr->start <= req->req.address) &&
2052                     (arm_addr->end > req->req.address)) {
2053                         if (req->req.address + req->req.length <= arm_addr->end) {
2054                                 offset = req->req.address - arm_addr->start;
2055                                 spin_unlock_irqrestore(&host_info_lock, flags);
2056
2057                                 DBGMSG
2058                                     ("arm_set_buf copy_from_user( %p, %08X, %u )",
2059                                      arm_addr->addr_space_buffer + offset,
2060                                      (u32) req->req.sendb,
2061                                      (u32) req->req.length);
2062                                 if (copy_from_user
2063                                     (arm_addr->addr_space_buffer + offset,
2064                                      int2ptr(req->req.sendb),
2065                                      req->req.length))
2066                                         return (-EFAULT);
2067
2068                                 /* We have to free the request, because we
2069                                  * queue no response, and therefore nobody
2070                                  * will free it. */
2071                                 free_pending_request(req);
2072                                 return 0;
2073                         } else {
2074                                 DBGMSG("arm_set_buf request exceeded mapping");
2075                                 spin_unlock_irqrestore(&host_info_lock, flags);
2076                                 return (-EINVAL);
2077                         }
2078                 }
2079                 entry = entry->next;
2080         }
2081         spin_unlock_irqrestore(&host_info_lock, flags);
2082         return (-EINVAL);
2083 }
2084
2085 static int reset_notification(struct file_info *fi, struct pending_request *req)
2086 {
2087         DBGMSG("reset_notification called - switch %s ",
2088                (req->req.misc == RAW1394_NOTIFY_OFF) ? "OFF" : "ON");
2089         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
2090             (req->req.misc == RAW1394_NOTIFY_ON)) {
2091                 fi->notification = (u8) req->req.misc;
2092                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2093                 return 0;
2094         }
2095         /* error EINVAL (22) invalid argument */
2096         return (-EINVAL);
2097 }
2098
2099 static int write_phypacket(struct file_info *fi, struct pending_request *req)
2100 {
2101         struct hpsb_packet *packet = NULL;
2102         int retval = 0;
2103         quadlet_t data;
2104         unsigned long flags;
2105
2106         data = be32_to_cpu((u32) req->req.sendb);
2107         DBGMSG("write_phypacket called - quadlet 0x%8.8x ", data);
2108         packet = hpsb_make_phypacket(fi->host, data);
2109         if (!packet)
2110                 return -ENOMEM;
2111         req->req.length = 0;
2112         req->packet = packet;
2113         hpsb_set_packet_complete_task(packet,
2114                                       (void (*)(void *))queue_complete_cb, req);
2115         spin_lock_irqsave(&fi->reqlists_lock, flags);
2116         list_add_tail(&req->list, &fi->req_pending);
2117         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2118         packet->generation = req->req.generation;
2119         retval = hpsb_send_packet(packet);
2120         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
2121         if (retval < 0) {
2122                 req->req.error = RAW1394_ERROR_SEND_ERROR;
2123                 req->req.length = 0;
2124                 queue_complete_req(req);
2125         }
2126         return 0;
2127 }
2128
2129 static int get_config_rom(struct file_info *fi, struct pending_request *req)
2130 {
2131         int ret = 0;
2132         quadlet_t *data = kmalloc(req->req.length, GFP_KERNEL);
2133         int status;
2134
2135         if (!data)
2136                 return -ENOMEM;
2137
2138         status =
2139             csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
2140                          data, req->req.length);
2141         if (copy_to_user(int2ptr(req->req.recvb), data, req->req.length))
2142                 ret = -EFAULT;
2143         if (copy_to_user
2144             (int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
2145              sizeof(fi->host->csr.rom->cache_head->len)))
2146                 ret = -EFAULT;
2147         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
2148                          sizeof(fi->host->csr.generation)))
2149                 ret = -EFAULT;
2150         if (copy_to_user(int2ptr(req->req.sendb), &status, sizeof(status)))
2151                 ret = -EFAULT;
2152         kfree(data);
2153         if (ret >= 0) {
2154                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2155         }
2156         return ret;
2157 }
2158
2159 static int update_config_rom(struct file_info *fi, struct pending_request *req)
2160 {
2161         int ret = 0;
2162         quadlet_t *data = kmalloc(req->req.length, GFP_KERNEL);
2163         if (!data)
2164                 return -ENOMEM;
2165         if (copy_from_user(data, int2ptr(req->req.sendb), req->req.length)) {
2166                 ret = -EFAULT;
2167         } else {
2168                 int status = hpsb_update_config_rom(fi->host,
2169                                                     data, req->req.length,
2170                                                     (unsigned char)req->req.
2171                                                     misc);
2172                 if (copy_to_user
2173                     (int2ptr(req->req.recvb), &status, sizeof(status)))
2174                         ret = -ENOMEM;
2175         }
2176         kfree(data);
2177         if (ret >= 0) {
2178                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2179                 fi->cfgrom_upd = 1;
2180         }
2181         return ret;
2182 }
2183
2184 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
2185 {
2186         struct csr1212_keyval *kv;
2187         struct csr1212_csr_rom_cache *cache;
2188         struct csr1212_dentry *dentry;
2189         u32 dr;
2190         int ret = 0;
2191
2192         if (req->req.misc == ~0) {
2193                 if (req->req.length == 0)
2194                         return -EINVAL;
2195
2196                 /* Find an unused slot */
2197                 for (dr = 0;
2198                      dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr];
2199                      dr++) ;
2200
2201                 if (dr == RAW1394_MAX_USER_CSR_DIRS)
2202                         return -ENOMEM;
2203
2204                 fi->csr1212_dirs[dr] =
2205                     csr1212_new_directory(CSR1212_KV_ID_VENDOR);
2206                 if (!fi->csr1212_dirs[dr])
2207                         return -ENOMEM;
2208         } else {
2209                 dr = req->req.misc;
2210                 if (!fi->csr1212_dirs[dr])
2211                         return -EINVAL;
2212
2213                 /* Delete old stuff */
2214                 for (dentry =
2215                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2216                      dentry; dentry = dentry->next) {
2217                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2218                                                              root_kv,
2219                                                              dentry->kv);
2220                 }
2221
2222                 if (req->req.length == 0) {
2223                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
2224                         fi->csr1212_dirs[dr] = NULL;
2225
2226                         hpsb_update_config_rom_image(fi->host);
2227                         free_pending_request(req);
2228                         return 0;
2229                 }
2230         }
2231
2232         cache = csr1212_rom_cache_malloc(0, req->req.length);
2233         if (!cache) {
2234                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2235                 fi->csr1212_dirs[dr] = NULL;
2236                 return -ENOMEM;
2237         }
2238
2239         cache->filled_head = kmalloc(sizeof(*cache->filled_head), GFP_KERNEL);
2240         if (!cache->filled_head) {
2241                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2242                 fi->csr1212_dirs[dr] = NULL;
2243                 CSR1212_FREE(cache);
2244                 return -ENOMEM;
2245         }
2246         cache->filled_tail = cache->filled_head;
2247
2248         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
2249                            req->req.length)) {
2250                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2251                 fi->csr1212_dirs[dr] = NULL;
2252                 ret = -EFAULT;
2253         } else {
2254                 cache->len = req->req.length;
2255                 cache->filled_head->offset_start = 0;
2256                 cache->filled_head->offset_end = cache->size - 1;
2257
2258                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2259
2260                 ret = CSR1212_SUCCESS;
2261                 /* parse all the items */
2262                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2263                      kv = kv->next) {
2264                         ret = csr1212_parse_keyval(kv, cache);
2265                 }
2266
2267                 /* attach top level items to the root directory */
2268                 for (dentry =
2269                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2270                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2271                         ret =
2272                             csr1212_attach_keyval_to_directory(fi->host->csr.
2273                                                                rom->root_kv,
2274                                                                dentry->kv);
2275                 }
2276
2277                 if (ret == CSR1212_SUCCESS) {
2278                         ret = hpsb_update_config_rom_image(fi->host);
2279
2280                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2281                                                      &dr, sizeof(dr))) {
2282                                 ret = -ENOMEM;
2283                         }
2284                 }
2285         }
2286         kfree(cache->filled_head);
2287         CSR1212_FREE(cache);
2288
2289         if (ret >= 0) {
2290                 /* we have to free the request, because we queue no response,
2291                  * and therefore nobody will free it */
2292                 free_pending_request(req);
2293                 return 0;
2294         } else {
2295                 for (dentry =
2296                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2297                      dentry; dentry = dentry->next) {
2298                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2299                                                              root_kv,
2300                                                              dentry->kv);
2301                 }
2302                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2303                 fi->csr1212_dirs[dr] = NULL;
2304                 return ret;
2305         }
2306 }
2307
2308 static int state_connected(struct file_info *fi, struct pending_request *req)
2309 {
2310         int node = req->req.address >> 48;
2311
2312         req->req.error = RAW1394_ERROR_NONE;
2313
2314         switch (req->req.type) {
2315
2316         case RAW1394_REQ_ECHO:
2317                 queue_complete_req(req);
2318                 return 0;
2319
2320         case RAW1394_REQ_ISO_SEND:
2321                 print_old_iso_deprecation();
2322                 return handle_iso_send(fi, req, node);
2323
2324         case RAW1394_REQ_ARM_REGISTER:
2325                 return arm_register(fi, req);
2326
2327         case RAW1394_REQ_ARM_UNREGISTER:
2328                 return arm_unregister(fi, req);
2329
2330         case RAW1394_REQ_ARM_SET_BUF:
2331                 return arm_set_buf(fi, req);
2332
2333         case RAW1394_REQ_ARM_GET_BUF:
2334                 return arm_get_buf(fi, req);
2335
2336         case RAW1394_REQ_RESET_NOTIFY:
2337                 return reset_notification(fi, req);
2338
2339         case RAW1394_REQ_ISO_LISTEN:
2340                 print_old_iso_deprecation();
2341                 handle_iso_listen(fi, req);
2342                 return 0;
2343
2344         case RAW1394_REQ_FCP_LISTEN:
2345                 handle_fcp_listen(fi, req);
2346                 return 0;
2347
2348         case RAW1394_REQ_RESET_BUS:
2349                 if (req->req.misc == RAW1394_LONG_RESET) {
2350                         DBGMSG("busreset called (type: LONG)");
2351                         hpsb_reset_bus(fi->host, LONG_RESET);
2352                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2353                         return 0;
2354                 }
2355                 if (req->req.misc == RAW1394_SHORT_RESET) {
2356                         DBGMSG("busreset called (type: SHORT)");
2357                         hpsb_reset_bus(fi->host, SHORT_RESET);
2358                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2359                         return 0;
2360                 }
2361                 /* error EINVAL (22) invalid argument */
2362                 return (-EINVAL);
2363         case RAW1394_REQ_GET_ROM:
2364                 return get_config_rom(fi, req);
2365
2366         case RAW1394_REQ_UPDATE_ROM:
2367                 return update_config_rom(fi, req);
2368
2369         case RAW1394_REQ_MODIFY_ROM:
2370                 return modify_config_rom(fi, req);
2371         }
2372
2373         if (req->req.generation != get_hpsb_generation(fi->host)) {
2374                 req->req.error = RAW1394_ERROR_GENERATION;
2375                 req->req.generation = get_hpsb_generation(fi->host);
2376                 req->req.length = 0;
2377                 queue_complete_req(req);
2378                 return 0;
2379         }
2380
2381         switch (req->req.type) {
2382         case RAW1394_REQ_PHYPACKET:
2383                 return write_phypacket(fi, req);
2384         case RAW1394_REQ_ASYNC_SEND:
2385                 return handle_async_send(fi, req);
2386         }
2387
2388         if (req->req.length == 0) {
2389                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2390                 queue_complete_req(req);
2391                 return 0;
2392         }
2393
2394         return handle_async_request(fi, req, node);
2395 }
2396
2397 static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2398                              size_t count, loff_t * offset_is_ignored)
2399 {
2400         struct file_info *fi = (struct file_info *)file->private_data;
2401         struct pending_request *req;
2402         ssize_t retval = -EBADFD;
2403
2404 #ifdef CONFIG_COMPAT
2405         if (count == sizeof(struct compat_raw1394_req) &&
2406             sizeof(struct compat_raw1394_req) !=
2407                         sizeof(struct raw1394_request)) {
2408                 buffer = raw1394_compat_write(buffer);
2409                 if (IS_ERR(buffer))
2410                         return PTR_ERR(buffer);
2411         } else
2412 #endif
2413         if (count != sizeof(struct raw1394_request)) {
2414                 return -EINVAL;
2415         }
2416
2417         req = alloc_pending_request();
2418         if (req == NULL) {
2419                 return -ENOMEM;
2420         }
2421         req->file_info = fi;
2422
2423         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2424                 free_pending_request(req);
2425                 return -EFAULT;
2426         }
2427
2428         switch (fi->state) {
2429         case opened:
2430                 retval = state_opened(fi, req);
2431                 break;
2432
2433         case initialized:
2434                 retval = state_initialized(fi, req);
2435                 break;
2436
2437         case connected:
2438                 retval = state_connected(fi, req);
2439                 break;
2440         }
2441
2442         if (retval < 0) {
2443                 free_pending_request(req);
2444         } else {
2445                 BUG_ON(retval);
2446                 retval = count;
2447         }
2448
2449         return retval;
2450 }
2451
2452 /* rawiso operations */
2453
2454 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2455  * completion queue (reqlists_lock must be taken) */
2456 static inline int __rawiso_event_in_queue(struct file_info *fi)
2457 {
2458         struct pending_request *req;
2459
2460         list_for_each_entry(req, &fi->req_complete, list)
2461             if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2462                 return 1;
2463
2464         return 0;
2465 }
2466
2467 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2468 static void queue_rawiso_event(struct file_info *fi)
2469 {
2470         unsigned long flags;
2471
2472         spin_lock_irqsave(&fi->reqlists_lock, flags);
2473
2474         /* only one ISO activity event may be in the queue */
2475         if (!__rawiso_event_in_queue(fi)) {
2476                 struct pending_request *req =
2477                     __alloc_pending_request(GFP_ATOMIC);
2478
2479                 if (req) {
2480                         req->file_info = fi;
2481                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2482                         req->req.generation = get_hpsb_generation(fi->host);
2483                         __queue_complete_req(req);
2484                 } else {
2485                         /* on allocation failure, signal an overflow */
2486                         if (fi->iso_handle) {
2487                                 atomic_inc(&fi->iso_handle->overflows);
2488                         }
2489                 }
2490         }
2491         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2492 }
2493
2494 static void rawiso_activity_cb(struct hpsb_iso *iso)
2495 {
2496         unsigned long flags;
2497         struct host_info *hi;
2498         struct file_info *fi;
2499
2500         spin_lock_irqsave(&host_info_lock, flags);
2501         hi = find_host_info(iso->host);
2502
2503         if (hi != NULL) {
2504                 list_for_each_entry(fi, &hi->file_info_list, list) {
2505                         if (fi->iso_handle == iso)
2506                                 queue_rawiso_event(fi);
2507                 }
2508         }
2509
2510         spin_unlock_irqrestore(&host_info_lock, flags);
2511 }
2512
2513 /* helper function - gather all the kernel iso status bits for returning to user-space */
2514 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
2515                                     struct raw1394_iso_status *stat)
2516 {
2517         stat->config.data_buf_size = iso->buf_size;
2518         stat->config.buf_packets = iso->buf_packets;
2519         stat->config.channel = iso->channel;
2520         stat->config.speed = iso->speed;
2521         stat->config.irq_interval = iso->irq_interval;
2522         stat->n_packets = hpsb_iso_n_ready(iso);
2523         stat->overflows = atomic_read(&iso->overflows);
2524         stat->xmit_cycle = iso->xmit_cycle;
2525 }
2526
2527 static int raw1394_iso_xmit_init(struct file_info *fi, void __user * uaddr)
2528 {
2529         struct raw1394_iso_status stat;
2530
2531         if (!fi->host)
2532                 return -EINVAL;
2533
2534         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2535                 return -EFAULT;
2536
2537         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2538                                             stat.config.data_buf_size,
2539                                             stat.config.buf_packets,
2540                                             stat.config.channel,
2541                                             stat.config.speed,
2542                                             stat.config.irq_interval,
2543                                             rawiso_activity_cb);
2544         if (!fi->iso_handle)
2545                 return -ENOMEM;
2546
2547         fi->iso_state = RAW1394_ISO_XMIT;
2548
2549         raw1394_iso_fill_status(fi->iso_handle, &stat);
2550         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2551                 return -EFAULT;
2552
2553         /* queue an event to get things started */
2554         rawiso_activity_cb(fi->iso_handle);
2555
2556         return 0;
2557 }
2558
2559 static int raw1394_iso_recv_init(struct file_info *fi, void __user * uaddr)
2560 {
2561         struct raw1394_iso_status stat;
2562
2563         if (!fi->host)
2564                 return -EINVAL;
2565
2566         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2567                 return -EFAULT;
2568
2569         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2570                                             stat.config.data_buf_size,
2571                                             stat.config.buf_packets,
2572                                             stat.config.channel,
2573                                             stat.config.dma_mode,
2574                                             stat.config.irq_interval,
2575                                             rawiso_activity_cb);
2576         if (!fi->iso_handle)
2577                 return -ENOMEM;
2578
2579         fi->iso_state = RAW1394_ISO_RECV;
2580
2581         raw1394_iso_fill_status(fi->iso_handle, &stat);
2582         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2583                 return -EFAULT;
2584         return 0;
2585 }
2586
2587 static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
2588 {
2589         struct raw1394_iso_status stat;
2590         struct hpsb_iso *iso = fi->iso_handle;
2591
2592         raw1394_iso_fill_status(fi->iso_handle, &stat);
2593         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2594                 return -EFAULT;
2595
2596         /* reset overflow counter */
2597         atomic_set(&iso->overflows, 0);
2598
2599         return 0;
2600 }
2601
2602 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2603 static int raw1394_iso_recv_packets(struct file_info *fi, void __user * uaddr)
2604 {
2605         struct raw1394_iso_packets upackets;
2606         unsigned int packet = fi->iso_handle->first_packet;
2607         int i;
2608
2609         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2610                 return -EFAULT;
2611
2612         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2613                 return -EINVAL;
2614
2615         /* ensure user-supplied buffer is accessible and big enough */
2616         if (!access_ok(VERIFY_WRITE, upackets.infos,
2617                        upackets.n_packets *
2618                        sizeof(struct raw1394_iso_packet_info)))
2619                 return -EFAULT;
2620
2621         /* copy the packet_infos out */
2622         for (i = 0; i < upackets.n_packets; i++) {
2623                 if (__copy_to_user(&upackets.infos[i],
2624                                    &fi->iso_handle->infos[packet],
2625                                    sizeof(struct raw1394_iso_packet_info)))
2626                         return -EFAULT;
2627
2628                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2629         }
2630
2631         return 0;
2632 }
2633
2634 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2635 static int raw1394_iso_send_packets(struct file_info *fi, void __user * uaddr)
2636 {
2637         struct raw1394_iso_packets upackets;
2638         int i, rv;
2639
2640         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2641                 return -EFAULT;
2642
2643         if (upackets.n_packets >= fi->iso_handle->buf_packets)
2644                 return -EINVAL;
2645
2646         if (upackets.n_packets >= hpsb_iso_n_ready(fi->iso_handle))
2647                 return -EAGAIN;
2648
2649         /* ensure user-supplied buffer is accessible and big enough */
2650         if (!access_ok(VERIFY_READ, upackets.infos,
2651                        upackets.n_packets *
2652                        sizeof(struct raw1394_iso_packet_info)))
2653                 return -EFAULT;
2654
2655         /* copy the infos structs in and queue the packets */
2656         for (i = 0; i < upackets.n_packets; i++) {
2657                 struct raw1394_iso_packet_info info;
2658
2659                 if (__copy_from_user(&info, &upackets.infos[i],
2660                                      sizeof(struct raw1394_iso_packet_info)))
2661                         return -EFAULT;
2662
2663                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2664                                                 info.len, info.tag, info.sy);
2665                 if (rv)
2666                         return rv;
2667         }
2668
2669         return 0;
2670 }
2671
2672 static void raw1394_iso_shutdown(struct file_info *fi)
2673 {
2674         if (fi->iso_handle)
2675                 hpsb_iso_shutdown(fi->iso_handle);
2676
2677         fi->iso_handle = NULL;
2678         fi->iso_state = RAW1394_ISO_INACTIVE;
2679 }
2680
2681 static int raw1394_read_cycle_timer(struct file_info *fi, void __user * uaddr)
2682 {
2683         struct raw1394_cycle_timer ct;
2684         int err;
2685
2686         err = hpsb_read_cycle_timer(fi->host, &ct.cycle_timer, &ct.local_time);
2687         if (!err)
2688                 if (copy_to_user(uaddr, &ct, sizeof(ct)))
2689                         err = -EFAULT;
2690         return err;
2691 }
2692
2693 /* mmap the rawiso xmit/recv buffer */
2694 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2695 {
2696         struct file_info *fi = file->private_data;
2697
2698         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2699                 return -EINVAL;
2700
2701         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2702 }
2703
2704 /* ioctl is only used for rawiso operations */
2705 static int raw1394_ioctl(struct inode *inode, struct file *file,
2706                          unsigned int cmd, unsigned long arg)
2707 {
2708         struct file_info *fi = file->private_data;
2709         void __user *argp = (void __user *)arg;
2710
2711         switch (fi->iso_state) {
2712         case RAW1394_ISO_INACTIVE:
2713                 switch (cmd) {
2714                 case RAW1394_IOC_ISO_XMIT_INIT:
2715                         return raw1394_iso_xmit_init(fi, argp);
2716                 case RAW1394_IOC_ISO_RECV_INIT:
2717                         return raw1394_iso_recv_init(fi, argp);
2718                 default:
2719                         break;
2720                 }
2721                 break;
2722         case RAW1394_ISO_RECV:
2723                 switch (cmd) {
2724                 case RAW1394_IOC_ISO_RECV_START:{
2725                                 /* copy args from user-space */
2726                                 int args[3];
2727                                 if (copy_from_user
2728                                     (&args[0], argp, sizeof(args)))
2729                                         return -EFAULT;
2730                                 return hpsb_iso_recv_start(fi->iso_handle,
2731                                                            args[0], args[1],
2732                                                            args[2]);
2733                         }
2734                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2735                         hpsb_iso_stop(fi->iso_handle);
2736                         return 0;
2737                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2738                         return hpsb_iso_recv_listen_channel(fi->iso_handle,
2739                                                             arg);
2740                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2741                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle,
2742                                                               arg);
2743                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:{
2744                                 /* copy the u64 from user-space */
2745                                 u64 mask;
2746                                 if (copy_from_user(&mask, argp, sizeof(mask)))
2747                                         return -EFAULT;
2748                                 return hpsb_iso_recv_set_channel_mask(fi->
2749                                                                       iso_handle,
2750                                                                       mask);
2751                         }
2752                 case RAW1394_IOC_ISO_GET_STATUS:
2753                         return raw1394_iso_get_status(fi, argp);
2754                 case RAW1394_IOC_ISO_RECV_PACKETS:
2755                         return raw1394_iso_recv_packets(fi, argp);
2756                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2757                         return hpsb_iso_recv_release_packets(fi->iso_handle,
2758                                                              arg);
2759                 case RAW1394_IOC_ISO_RECV_FLUSH:
2760                         return hpsb_iso_recv_flush(fi->iso_handle);
2761                 case RAW1394_IOC_ISO_SHUTDOWN:
2762                         raw1394_iso_shutdown(fi);
2763                         return 0;
2764                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2765                         queue_rawiso_event(fi);
2766                         return 0;
2767                 }
2768                 break;
2769         case RAW1394_ISO_XMIT:
2770                 switch (cmd) {
2771                 case RAW1394_IOC_ISO_XMIT_START:{
2772                                 /* copy two ints from user-space */
2773                                 int args[2];
2774                                 if (copy_from_user
2775                                     (&args[0], argp, sizeof(args)))
2776                                         return -EFAULT;
2777                                 return hpsb_iso_xmit_start(fi->iso_handle,
2778                                                            args[0], args[1]);
2779                         }
2780                 case RAW1394_IOC_ISO_XMIT_SYNC:
2781                         return hpsb_iso_xmit_sync(fi->iso_handle);
2782                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2783                         hpsb_iso_stop(fi->iso_handle);
2784                         return 0;
2785                 case RAW1394_IOC_ISO_GET_STATUS:
2786                         return raw1394_iso_get_status(fi, argp);
2787                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2788                         return raw1394_iso_send_packets(fi, argp);
2789                 case RAW1394_IOC_ISO_SHUTDOWN:
2790                         raw1394_iso_shutdown(fi);
2791                         return 0;
2792                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2793                         queue_rawiso_event(fi);
2794                         return 0;
2795                 }
2796                 break;
2797         default:
2798                 break;
2799         }
2800
2801         /* state-independent commands */
2802         switch(cmd) {
2803         case RAW1394_IOC_GET_CYCLE_TIMER:
2804                 return raw1394_read_cycle_timer(fi, argp);
2805         default:
2806                 break;
2807         }
2808
2809         return -EINVAL;
2810 }
2811
2812 #ifdef CONFIG_COMPAT
2813 struct raw1394_iso_packets32 {
2814         __u32 n_packets;
2815         compat_uptr_t infos;
2816 } __attribute__((packed));
2817
2818 struct raw1394_cycle_timer32 {
2819         __u32 cycle_timer;
2820         __u64 local_time;
2821 }
2822 #if defined(CONFIG_X86_64) || defined(CONFIG_IA64)
2823 __attribute__((packed))
2824 #endif
2825 ;
2826
2827 #define RAW1394_IOC_ISO_RECV_PACKETS32          \
2828         _IOW ('#', 0x25, struct raw1394_iso_packets32)
2829 #define RAW1394_IOC_ISO_XMIT_PACKETS32          \
2830         _IOW ('#', 0x27, struct raw1394_iso_packets32)
2831 #define RAW1394_IOC_GET_CYCLE_TIMER32           \
2832         _IOR ('#', 0x30, struct raw1394_cycle_timer32)
2833
2834 static long raw1394_iso_xmit_recv_packets32(struct file *file, unsigned int cmd,
2835                                           struct raw1394_iso_packets32 __user *arg)
2836 {
2837         compat_uptr_t infos32;
2838         void *infos;
2839         long err = -EFAULT;
2840         struct raw1394_iso_packets __user *dst = compat_alloc_user_space(sizeof(struct raw1394_iso_packets));
2841
2842         if (!copy_in_user(&dst->n_packets, &arg->n_packets, sizeof arg->n_packets) &&
2843             !copy_from_user(&infos32, &arg->infos, sizeof infos32)) {
2844                 infos = compat_ptr(infos32);
2845                 if (!copy_to_user(&dst->infos, &infos, sizeof infos))
2846                         err = raw1394_ioctl(NULL, file, cmd, (unsigned long)dst);
2847         }
2848         return err;
2849 }
2850
2851 static long raw1394_read_cycle_timer32(struct file_info *fi, void __user * uaddr)
2852 {
2853         struct raw1394_cycle_timer32 ct;
2854         int err;
2855
2856         err = hpsb_read_cycle_timer(fi->host, &ct.cycle_timer, &ct.local_time);
2857         if (!err)
2858                 if (copy_to_user(uaddr, &ct, sizeof(ct)))
2859                         err = -EFAULT;
2860         return err;
2861 }
2862
2863 static long raw1394_compat_ioctl(struct file *file,
2864                                  unsigned int cmd, unsigned long arg)
2865 {
2866         struct file_info *fi = file->private_data;
2867         void __user *argp = (void __user *)arg;
2868         long err;
2869
2870         lock_kernel();
2871         switch (cmd) {
2872         /* These requests have same format as long as 'int' has same size. */
2873         case RAW1394_IOC_ISO_RECV_INIT:
2874         case RAW1394_IOC_ISO_RECV_START:
2875         case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2876         case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2877         case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:
2878         case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2879         case RAW1394_IOC_ISO_RECV_FLUSH:
2880         case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2881         case RAW1394_IOC_ISO_XMIT_INIT:
2882         case RAW1394_IOC_ISO_XMIT_START:
2883         case RAW1394_IOC_ISO_XMIT_SYNC:
2884         case RAW1394_IOC_ISO_GET_STATUS:
2885         case RAW1394_IOC_ISO_SHUTDOWN:
2886         case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2887                 err = raw1394_ioctl(NULL, file, cmd, arg);
2888                 break;
2889         /* These request have different format. */
2890         case RAW1394_IOC_ISO_RECV_PACKETS32:
2891                 err = raw1394_iso_xmit_recv_packets32(file, RAW1394_IOC_ISO_RECV_PACKETS, argp);
2892                 break;
2893         case RAW1394_IOC_ISO_XMIT_PACKETS32:
2894                 err = raw1394_iso_xmit_recv_packets32(file, RAW1394_IOC_ISO_XMIT_PACKETS, argp);
2895                 break;
2896         case RAW1394_IOC_GET_CYCLE_TIMER32:
2897                 err = raw1394_read_cycle_timer32(fi, argp);
2898                 break;
2899         default:
2900                 err = -EINVAL;
2901                 break;
2902         }
2903         unlock_kernel();
2904
2905         return err;
2906 }
2907 #endif
2908
2909 static unsigned int raw1394_poll(struct file *file, poll_table * pt)
2910 {
2911         struct file_info *fi = file->private_data;
2912         unsigned int mask = POLLOUT | POLLWRNORM;
2913         unsigned long flags;
2914
2915         poll_wait(file, &fi->wait_complete, pt);
2916
2917         spin_lock_irqsave(&fi->reqlists_lock, flags);
2918         if (!list_empty(&fi->req_complete)) {
2919                 mask |= POLLIN | POLLRDNORM;
2920         }
2921         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2922
2923         return mask;
2924 }
2925
2926 static int raw1394_open(struct inode *inode, struct file *file)
2927 {
2928         struct file_info *fi;
2929
2930         fi = kzalloc(sizeof(*fi), GFP_KERNEL);
2931         if (!fi)
2932                 return -ENOMEM;
2933
2934         fi->notification = (u8) RAW1394_NOTIFY_ON;      /* busreset notification */
2935
2936         INIT_LIST_HEAD(&fi->list);
2937         fi->state = opened;
2938         INIT_LIST_HEAD(&fi->req_pending);
2939         INIT_LIST_HEAD(&fi->req_complete);
2940         spin_lock_init(&fi->reqlists_lock);
2941         init_waitqueue_head(&fi->wait_complete);
2942         INIT_LIST_HEAD(&fi->addr_list);
2943
2944         file->private_data = fi;
2945
2946         return 0;
2947 }
2948
2949 static int raw1394_release(struct inode *inode, struct file *file)
2950 {
2951         struct file_info *fi = file->private_data;
2952         struct list_head *lh;
2953         struct pending_request *req;
2954         int i, fail;
2955         int retval = 0;
2956         struct list_head *entry;
2957         struct arm_addr *addr = NULL;
2958         struct host_info *hi;
2959         struct file_info *fi_hlp = NULL;
2960         struct arm_addr *arm_addr = NULL;
2961         int another_host;
2962         int csr_mod = 0;
2963         unsigned long flags;
2964
2965         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2966                 raw1394_iso_shutdown(fi);
2967
2968         for (i = 0; i < 64; i++) {
2969                 if (fi->listen_channels & (1ULL << i)) {
2970                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2971                 }
2972         }
2973
2974         spin_lock_irqsave(&host_info_lock, flags);
2975         fi->listen_channels = 0;
2976
2977         fail = 0;
2978         /* set address-entries invalid */
2979
2980         while (!list_empty(&fi->addr_list)) {
2981                 another_host = 0;
2982                 lh = fi->addr_list.next;
2983                 addr = list_entry(lh, struct arm_addr, addr_list);
2984                 /* another host with valid address-entry containing
2985                    same addressrange? */
2986                 list_for_each_entry(hi, &host_info_list, list) {
2987                         if (hi->host != fi->host) {
2988                                 list_for_each_entry(fi_hlp, &hi->file_info_list,
2989                                                     list) {
2990                                         entry = fi_hlp->addr_list.next;
2991                                         while (entry != &(fi_hlp->addr_list)) {
2992                                                 arm_addr = list_entry(entry, struct
2993                                                                       arm_addr,
2994                                                                       addr_list);
2995                                                 if (arm_addr->start ==
2996                                                     addr->start) {
2997                                                         DBGMSG
2998                                                             ("raw1394_release: "
2999                                                              "another host ownes "
3000                                                              "same addressrange");
3001                                                         another_host = 1;
3002                                                         break;
3003                                                 }
3004                                                 entry = entry->next;
3005                                         }
3006                                         if (another_host) {
3007                                                 break;
3008                                         }
3009                                 }
3010                         }
3011                 }
3012                 if (!another_host) {
3013                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
3014                         retval =
3015                             hpsb_unregister_addrspace(&raw1394_highlevel,
3016                                                       fi->host, addr->start);
3017                         if (!retval) {
3018                                 ++fail;
3019                                 printk(KERN_ERR
3020                                        "raw1394_release arm_Unregister failed\n");
3021                         }
3022                 }
3023                 DBGMSG("raw1394_release: delete addr_entry from list");
3024                 list_del(&addr->addr_list);
3025                 vfree(addr->addr_space_buffer);
3026                 kfree(addr);
3027         }                       /* while */
3028         spin_unlock_irqrestore(&host_info_lock, flags);
3029         if (fail > 0) {
3030                 printk(KERN_ERR "raw1394: during addr_list-release "
3031                        "error(s) occurred \n");
3032         }
3033
3034         for (;;) {
3035                 /* This locked section guarantees that neither
3036                  * complete nor pending requests exist once i!=0 */
3037                 spin_lock_irqsave(&fi->reqlists_lock, flags);
3038                 while ((req = __next_complete_req(fi)))
3039                         free_pending_request(req);
3040
3041                 i = list_empty(&fi->req_pending);
3042                 spin_unlock_irqrestore(&fi->reqlists_lock, flags);
3043
3044                 if (i)
3045                         break;
3046                 /*
3047                  * Sleep until more requests can be freed.
3048                  *
3049                  * NB: We call the macro wait_event() with a condition argument
3050                  * with side effect.  This is only possible because the side
3051                  * effect does not occur until the condition became true, and
3052                  * wait_event() won't evaluate the condition again after that.
3053                  */
3054                 wait_event(fi->wait_complete, (req = next_complete_req(fi)));
3055                 free_pending_request(req);
3056         }
3057
3058         /* Remove any sub-trees left by user space programs */
3059         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
3060                 struct csr1212_dentry *dentry;
3061                 if (!fi->csr1212_dirs[i])
3062                         continue;
3063                 for (dentry =
3064                      fi->csr1212_dirs[i]->value.directory.dentries_head; dentry;
3065                      dentry = dentry->next) {
3066                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
3067                                                              root_kv,
3068                                                              dentry->kv);
3069                 }
3070                 csr1212_release_keyval(fi->csr1212_dirs[i]);
3071                 fi->csr1212_dirs[i] = NULL;
3072                 csr_mod = 1;
3073         }
3074
3075         if ((csr_mod || fi->cfgrom_upd)
3076             && hpsb_update_config_rom_image(fi->host) < 0)
3077                 HPSB_ERR
3078                     ("Failed to generate Configuration ROM image for host %d",
3079                      fi->host->id);
3080
3081         if (fi->state == connected) {
3082                 spin_lock_irqsave(&host_info_lock, flags);
3083                 list_del(&fi->list);
3084                 spin_unlock_irqrestore(&host_info_lock, flags);
3085
3086                 put_device(&fi->host->device);
3087         }
3088
3089         spin_lock_irqsave(&host_info_lock, flags);
3090         if (fi->host)
3091                 module_put(fi->host->driver->owner);
3092         spin_unlock_irqrestore(&host_info_lock, flags);
3093
3094         kfree(fi);
3095
3096         return 0;
3097 }
3098
3099 /*** HOTPLUG STUFF **********************************************************/
3100 /*
3101  * Export information about protocols/devices supported by this driver.
3102  */
3103 static struct ieee1394_device_id raw1394_id_table[] = {
3104         {
3105          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
3106          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
3107          .version = AVC_SW_VERSION_ENTRY & 0xffffff},
3108         {
3109          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
3110          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
3111          .version = CAMERA_SW_VERSION_ENTRY & 0xffffff},
3112         {
3113          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
3114          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
3115          .version = (CAMERA_SW_VERSION_ENTRY + 1) & 0xffffff},
3116         {
3117          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
3118          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
3119          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
3120         {}
3121 };
3122
3123 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
3124
3125 static struct hpsb_protocol_driver raw1394_driver = {
3126         .name = "raw1394",
3127         .id_table = raw1394_id_table,
3128 };
3129
3130 /******************************************************************************/
3131
3132 static struct hpsb_highlevel raw1394_highlevel = {
3133         .name = RAW1394_DEVICE_NAME,
3134         .add_host = add_host,
3135         .remove_host = remove_host,
3136         .host_reset = host_reset,
3137         .iso_receive = iso_receive,
3138         .fcp_request = fcp_request,
3139 };
3140
3141 static struct cdev raw1394_cdev;
3142 static const struct file_operations raw1394_fops = {
3143         .owner = THIS_MODULE,
3144         .read = raw1394_read,
3145         .write = raw1394_write,
3146         .mmap = raw1394_mmap,
3147         .ioctl = raw1394_ioctl,
3148 #ifdef CONFIG_COMPAT
3149         .compat_ioctl = raw1394_compat_ioctl,
3150 #endif
3151         .poll = raw1394_poll,
3152         .open = raw1394_open,
3153         .release = raw1394_release,
3154 };
3155
3156 static int __init init_raw1394(void)
3157 {
3158         int ret = 0;
3159
3160         hpsb_register_highlevel(&raw1394_highlevel);
3161
3162         if (IS_ERR
3163             (device_create(
3164               hpsb_protocol_class, NULL,
3165               MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16),
3166               RAW1394_DEVICE_NAME))) {
3167                 ret = -EFAULT;
3168                 goto out_unreg;
3169         }
3170
3171         cdev_init(&raw1394_cdev, &raw1394_fops);
3172         raw1394_cdev.owner = THIS_MODULE;
3173         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
3174         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
3175         if (ret) {
3176                 HPSB_ERR("raw1394 failed to register minor device block");
3177                 goto out_dev;
3178         }
3179
3180         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
3181
3182         ret = hpsb_register_protocol(&raw1394_driver);
3183         if (ret) {
3184                 HPSB_ERR("raw1394: failed to register protocol");
3185                 cdev_del(&raw1394_cdev);
3186                 goto out_dev;
3187         }
3188
3189         goto out;
3190
3191       out_dev:
3192         device_destroy(hpsb_protocol_class,
3193                        MKDEV(IEEE1394_MAJOR,
3194                              IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3195       out_unreg:
3196         hpsb_unregister_highlevel(&raw1394_highlevel);
3197       out:
3198         return ret;
3199 }
3200
3201 static void __exit cleanup_raw1394(void)
3202 {
3203         device_destroy(hpsb_protocol_class,
3204                        MKDEV(IEEE1394_MAJOR,
3205                              IEEE1394_MINOR_BLOCK_RAW1394 * 16));
3206         cdev_del(&raw1394_cdev);
3207         hpsb_unregister_highlevel(&raw1394_highlevel);
3208         hpsb_unregister_protocol(&raw1394_driver);
3209 }
3210
3211 module_init(init_raw1394);
3212 module_exit(cleanup_raw1394);
3213 MODULE_LICENSE("GPL");