SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/ieee1394/raw1394.c

   1 /*
   2  * IEEE 1394 for Linux
   3  *
   4  * Raw interface to the bus
   5  *
   6  * Copyright (C) 1999, 2000 Andreas E. Bombe
   7  *               2001, 2002 Manfred Weihs <weihs@ict.tuwien.ac.at>
   8  *                     2002 Christian Toegel <christian.toegel@gmx.at>
   9  *
  10  * This code is licensed under the GPL.  See the file COPYING in the root
  11  * directory of the kernel sources for details.
  12  *
  13  *
  14  * Contributions:
  15  *
  16  * Manfred Weihs <weihs@ict.tuwien.ac.at>
  17  *        configuration ROM manipulation
  18  *        address range mapping
  19  *        adaptation for new (transparent) loopback mechanism
  20  *        sending of arbitrary async packets
  21  * Christian Toegel <christian.toegel@gmx.at>
  22  *        address range mapping
  23  *        lock64 request
  24  *        transmit physical packet
  25  *        busreset notification control (switch on/off)
  26  *        busreset with selection of type (short/long)
  27  *        request_reply
  28  */
  29
  30 #include <linux/kernel.h>
  31 #include <linux/list.h>
  32 #include <linux/string.h>
  33 #include <linux/slab.h>
  34 #include <linux/fs.h>
  35 #include <linux/poll.h>
  36 #include <linux/module.h>
  37 #include <linux/init.h>
  38 #include <linux/smp_lock.h>
  39 #include <linux/interrupt.h>
  40 #include <linux/vmalloc.h>
  41 #include <linux/cdev.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/atomic.h>
  44 #include <linux/devfs_fs_kernel.h>
  45
  46 #include "csr1212.h"
  47 #include "ieee1394.h"
  48 #include "ieee1394_types.h"
  49 #include "ieee1394_core.h"
  50 #include "nodemgr.h"
  51 #include "hosts.h"
  52 #include "highlevel.h"
  53 #include "iso.h"
  54 #include "ieee1394_transactions.h"
  55 #include "raw1394.h"
  56 #include "raw1394-private.h"
  57
  58 #define int2ptr(x) ((void __user *)(unsigned long)x)
  59 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
  60
  61 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
  62 #define RAW1394_DEBUG
  63 #endif
  64
  65 #ifdef RAW1394_DEBUG
  66 #define DBGMSG(fmt, args...) \
  67 printk(KERN_INFO "raw1394:" fmt "\n" , ## args)
  68 #else
  69 #define DBGMSG(fmt, args...)
  70 #endif
  71
  72 static LIST_HEAD(host_info_list);
  73 static int host_count;
  74 static DEFINE_SPINLOCK(host_info_lock);
  75 static atomic_t internal_generation = ATOMIC_INIT(0);
  76
  77 static atomic_t iso_buffer_size;
  78 static const int iso_buffer_max = 4 * 1024 * 1024;      /* 4 MB */
  79
  80 static struct hpsb_highlevel raw1394_highlevel;
  81
  82 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
  83                     u64 addr, size_t length, u16 flags);
  84 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
  85                      quadlet_t * data, u64 addr, size_t length, u16 flags);
  86 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
  87                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
  88                     u16 flags);
  89 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
  90                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
  91                       u16 flags);
  92 static struct hpsb_address_ops arm_ops = {
  93         .read = arm_read,
  94         .write = arm_write,
  95         .lock = arm_lock,
  96         .lock64 = arm_lock64,
  97 };
  98
  99 static void queue_complete_cb(struct pending_request *req);
 100
 101 static struct pending_request *__alloc_pending_request(gfp_t flags)
 102 {
 103         struct pending_request *req;
 104
 105         req = (struct pending_request *)kmalloc(sizeof(struct pending_request),
 106                                                 flags);
 107         if (req != NULL) {
 108                 memset(req, 0, sizeof(struct pending_request));
 109                 INIT_LIST_HEAD(&req->list);
 110         }
 111
 112         return req;
 113 }
 114
 115 static inline struct pending_request *alloc_pending_request(void)
 116 {
 117         return __alloc_pending_request(SLAB_KERNEL);
 118 }
 119
 120 static void free_pending_request(struct pending_request *req)
 121 {
 122         if (req->ibs) {
 123                 if (atomic_dec_and_test(&req->ibs->refcount)) {
 124                         atomic_sub(req->ibs->data_size, &iso_buffer_size);
 125                         kfree(req->ibs);
 126                 }
 127         } else if (req->free_data) {
 128                 kfree(req->data);
 129         }
 130         hpsb_free_packet(req->packet);
 131         kfree(req);
 132 }
 133
 134 /* fi->reqlists_lock must be taken */
 135 static void __queue_complete_req(struct pending_request *req)
 136 {
 137         struct file_info *fi = req->file_info;
 138         list_del(&req->list);
 139         list_add_tail(&req->list, &fi->req_complete);
 140
 141         up(&fi->complete_sem);
 142         wake_up_interruptible(&fi->poll_wait_complete);
 143 }
 144
 145 static void queue_complete_req(struct pending_request *req)
 146 {
 147         unsigned long flags;
 148         struct file_info *fi = req->file_info;
 149
 150         spin_lock_irqsave(&fi->reqlists_lock, flags);
 151         __queue_complete_req(req);
 152         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
 153 }
 154
 155 static void queue_complete_cb(struct pending_request *req)
 156 {
 157         struct hpsb_packet *packet = req->packet;
 158         int rcode = (packet->header[1] >> 12) & 0xf;
 159
 160         switch (packet->ack_code) {
 161         case ACKX_NONE:
 162         case ACKX_SEND_ERROR:
 163                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 164                 break;
 165         case ACKX_ABORTED:
 166                 req->req.error = RAW1394_ERROR_ABORTED;
 167                 break;
 168         case ACKX_TIMEOUT:
 169                 req->req.error = RAW1394_ERROR_TIMEOUT;
 170                 break;
 171         default:
 172                 req->req.error = (packet->ack_code << 16) | rcode;
 173                 break;
 174         }
 175
 176         if (!((packet->ack_code == ACK_PENDING) && (rcode == RCODE_COMPLETE))) {
 177                 req->req.length = 0;
 178         }
 179
 180         if ((req->req.type == RAW1394_REQ_ASYNC_READ) ||
 181             (req->req.type == RAW1394_REQ_ASYNC_WRITE) ||
 182             (req->req.type == RAW1394_REQ_ASYNC_STREAM) ||
 183             (req->req.type == RAW1394_REQ_LOCK) ||
 184             (req->req.type == RAW1394_REQ_LOCK64))
 185                 hpsb_free_tlabel(packet);
 186
 187         queue_complete_req(req);
 188 }
 189
 190 static void add_host(struct hpsb_host *host)
 191 {
 192         struct host_info *hi;
 193         unsigned long flags;
 194
 195         hi = (struct host_info *)kmalloc(sizeof(struct host_info), GFP_KERNEL);
 196
 197         if (hi != NULL) {
 198                 INIT_LIST_HEAD(&hi->list);
 199                 hi->host = host;
 200                 INIT_LIST_HEAD(&hi->file_info_list);
 201
 202                 spin_lock_irqsave(&host_info_lock, flags);
 203                 list_add_tail(&hi->list, &host_info_list);
 204                 host_count++;
 205                 spin_unlock_irqrestore(&host_info_lock, flags);
 206         }
 207
 208         atomic_inc(&internal_generation);
 209 }
 210
 211 static struct host_info *find_host_info(struct hpsb_host *host)
 212 {
 213         struct host_info *hi;
 214
 215         list_for_each_entry(hi, &host_info_list, list)
 216             if (hi->host == host)
 217                 return hi;
 218
 219         return NULL;
 220 }
 221
 222 static void remove_host(struct hpsb_host *host)
 223 {
 224         struct host_info *hi;
 225         unsigned long flags;
 226
 227         spin_lock_irqsave(&host_info_lock, flags);
 228         hi = find_host_info(host);
 229
 230         if (hi != NULL) {
 231                 list_del(&hi->list);
 232                 host_count--;
 233                 /*
 234                    FIXME: address ranges should be removed
 235                    and fileinfo states should be initialized
 236                    (including setting generation to
 237                    internal-generation ...)
 238                  */
 239         }
 240         spin_unlock_irqrestore(&host_info_lock, flags);
 241
 242         if (hi == NULL) {
 243                 printk(KERN_ERR "raw1394: attempt to remove unknown host "
 244                        "0x%p\n", host);
 245                 return;
 246         }
 247
 248         kfree(hi);
 249
 250         atomic_inc(&internal_generation);
 251 }
 252
 253 static void host_reset(struct hpsb_host *host)
 254 {
 255         unsigned long flags;
 256         struct host_info *hi;
 257         struct file_info *fi;
 258         struct pending_request *req;
 259
 260         spin_lock_irqsave(&host_info_lock, flags);
 261         hi = find_host_info(host);
 262
 263         if (hi != NULL) {
 264                 list_for_each_entry(fi, &hi->file_info_list, list) {
 265                         if (fi->notification == RAW1394_NOTIFY_ON) {
 266                                 req = __alloc_pending_request(SLAB_ATOMIC);
 267
 268                                 if (req != NULL) {
 269                                         req->file_info = fi;
 270                                         req->req.type = RAW1394_REQ_BUS_RESET;
 271                                         req->req.generation =
 272                                             get_hpsb_generation(host);
 273                                         req->req.misc = (host->node_id << 16)
 274                                             | host->node_count;
 275                                         if (fi->protocol_version > 3) {
 276                                                 req->req.misc |=
 277                                                     (NODEID_TO_NODE
 278                                                      (host->irm_id)
 279                                                      << 8);
 280                                         }
 281
 282                                         queue_complete_req(req);
 283                                 }
 284                         }
 285                 }
 286         }
 287         spin_unlock_irqrestore(&host_info_lock, flags);
 288 }
 289
 290 static void iso_receive(struct hpsb_host *host, int channel, quadlet_t * data,
 291                         size_t length)
 292 {
 293         unsigned long flags;
 294         struct host_info *hi;
 295         struct file_info *fi;
 296         struct pending_request *req, *req_next;
 297         struct iso_block_store *ibs = NULL;
 298         LIST_HEAD(reqs);
 299
 300         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 301                 HPSB_INFO("dropped iso packet");
 302                 return;
 303         }
 304
 305         spin_lock_irqsave(&host_info_lock, flags);
 306         hi = find_host_info(host);
 307
 308         if (hi != NULL) {
 309                 list_for_each_entry(fi, &hi->file_info_list, list) {
 310                         if (!(fi->listen_channels & (1ULL << channel)))
 311                                 continue;
 312
 313                         req = __alloc_pending_request(SLAB_ATOMIC);
 314                         if (!req)
 315                                 break;
 316
 317                         if (!ibs) {
 318                                 ibs = kmalloc(sizeof(struct iso_block_store)
 319                                               + length, SLAB_ATOMIC);
 320                                 if (!ibs) {
 321                                         kfree(req);
 322                                         break;
 323                                 }
 324
 325                                 atomic_add(length, &iso_buffer_size);
 326                                 atomic_set(&ibs->refcount, 0);
 327                                 ibs->data_size = length;
 328                                 memcpy(ibs->data, data, length);
 329                         }
 330
 331                         atomic_inc(&ibs->refcount);
 332
 333                         req->file_info = fi;
 334                         req->ibs = ibs;
 335                         req->data = ibs->data;
 336                         req->req.type = RAW1394_REQ_ISO_RECEIVE;
 337                         req->req.generation = get_hpsb_generation(host);
 338                         req->req.misc = 0;
 339                         req->req.recvb = ptr2int(fi->iso_buffer);
 340                         req->req.length = min(length, fi->iso_buffer_length);
 341
 342                         list_add_tail(&req->list, &reqs);
 343                 }
 344         }
 345         spin_unlock_irqrestore(&host_info_lock, flags);
 346
 347         list_for_each_entry_safe(req, req_next, &reqs, list)
 348             queue_complete_req(req);
 349 }
 350
 351 static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
 352                         int cts, u8 * data, size_t length)
 353 {
 354         unsigned long flags;
 355         struct host_info *hi;
 356         struct file_info *fi;
 357         struct pending_request *req, *req_next;
 358         struct iso_block_store *ibs = NULL;
 359         LIST_HEAD(reqs);
 360
 361         if ((atomic_read(&iso_buffer_size) + length) > iso_buffer_max) {
 362                 HPSB_INFO("dropped fcp request");
 363                 return;
 364         }
 365
 366         spin_lock_irqsave(&host_info_lock, flags);
 367         hi = find_host_info(host);
 368
 369         if (hi != NULL) {
 370                 list_for_each_entry(fi, &hi->file_info_list, list) {
 371                         if (!fi->fcp_buffer)
 372                                 continue;
 373
 374                         req = __alloc_pending_request(SLAB_ATOMIC);
 375                         if (!req)
 376                                 break;
 377
 378                         if (!ibs) {
 379                                 ibs = kmalloc(sizeof(struct iso_block_store)
 380                                               + length, SLAB_ATOMIC);
 381                                 if (!ibs) {
 382                                         kfree(req);
 383                                         break;
 384                                 }
 385
 386                                 atomic_add(length, &iso_buffer_size);
 387                                 atomic_set(&ibs->refcount, 0);
 388                                 ibs->data_size = length;
 389                                 memcpy(ibs->data, data, length);
 390                         }
 391
 392                         atomic_inc(&ibs->refcount);
 393
 394                         req->file_info = fi;
 395                         req->ibs = ibs;
 396                         req->data = ibs->data;
 397                         req->req.type = RAW1394_REQ_FCP_REQUEST;
 398                         req->req.generation = get_hpsb_generation(host);
 399                         req->req.misc = nodeid | (direction << 16);
 400                         req->req.recvb = ptr2int(fi->fcp_buffer);
 401                         req->req.length = length;
 402
 403                         list_add_tail(&req->list, &reqs);
 404                 }
 405         }
 406         spin_unlock_irqrestore(&host_info_lock, flags);
 407
 408         list_for_each_entry_safe(req, req_next, &reqs, list)
 409             queue_complete_req(req);
 410 }
 411
 412 static ssize_t raw1394_read(struct file *file, char __user * buffer,
 413                             size_t count, loff_t * offset_is_ignored)
 414 {
 415         struct file_info *fi = (struct file_info *)file->private_data;
 416         struct list_head *lh;
 417         struct pending_request *req;
 418         ssize_t ret;
 419
 420         if (count != sizeof(struct raw1394_request)) {
 421                 return -EINVAL;
 422         }
 423
 424         if (!access_ok(VERIFY_WRITE, buffer, count)) {
 425                 return -EFAULT;
 426         }
 427
 428         if (file->f_flags & O_NONBLOCK) {
 429                 if (down_trylock(&fi->complete_sem)) {
 430                         return -EAGAIN;
 431                 }
 432         } else {
 433                 if (down_interruptible(&fi->complete_sem)) {
 434                         return -ERESTARTSYS;
 435                 }
 436         }
 437
 438         spin_lock_irq(&fi->reqlists_lock);
 439         lh = fi->req_complete.next;
 440         list_del(lh);
 441         spin_unlock_irq(&fi->reqlists_lock);
 442
 443         req = list_entry(lh, struct pending_request, list);
 444
 445         if (req->req.length) {
 446                 if (copy_to_user(int2ptr(req->req.recvb), req->data,
 447                                  req->req.length)) {
 448                         req->req.error = RAW1394_ERROR_MEMFAULT;
 449                 }
 450         }
 451         if (copy_to_user(buffer, &req->req, sizeof(req->req))) {
 452                 ret = -EFAULT;
 453                 goto out;
 454         }
 455
 456         ret = (ssize_t) sizeof(struct raw1394_request);
 457       out:
 458         free_pending_request(req);
 459         return ret;
 460 }
 461
 462 static int state_opened(struct file_info *fi, struct pending_request *req)
 463 {
 464         if (req->req.type == RAW1394_REQ_INITIALIZE) {
 465                 switch (req->req.misc) {
 466                 case RAW1394_KERNELAPI_VERSION:
 467                 case 3:
 468                         fi->state = initialized;
 469                         fi->protocol_version = req->req.misc;
 470                         req->req.error = RAW1394_ERROR_NONE;
 471                         req->req.generation = atomic_read(&internal_generation);
 472                         break;
 473
 474                 default:
 475                         req->req.error = RAW1394_ERROR_COMPAT;
 476                         req->req.misc = RAW1394_KERNELAPI_VERSION;
 477                 }
 478         } else {
 479                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 480         }
 481
 482         req->req.length = 0;
 483         queue_complete_req(req);
 484         return sizeof(struct raw1394_request);
 485 }
 486
 487 static int state_initialized(struct file_info *fi, struct pending_request *req)
 488 {
 489         struct host_info *hi;
 490         struct raw1394_khost_list *khl;
 491
 492         if (req->req.generation != atomic_read(&internal_generation)) {
 493                 req->req.error = RAW1394_ERROR_GENERATION;
 494                 req->req.generation = atomic_read(&internal_generation);
 495                 req->req.length = 0;
 496                 queue_complete_req(req);
 497                 return sizeof(struct raw1394_request);
 498         }
 499
 500         switch (req->req.type) {
 501         case RAW1394_REQ_LIST_CARDS:
 502                 spin_lock_irq(&host_info_lock);
 503                 khl = kmalloc(sizeof(struct raw1394_khost_list) * host_count,
 504                               SLAB_ATOMIC);
 505
 506                 if (khl != NULL) {
 507                         req->req.misc = host_count;
 508                         req->data = (quadlet_t *) khl;
 509
 510                         list_for_each_entry(hi, &host_info_list, list) {
 511                                 khl->nodes = hi->host->node_count;
 512                                 strcpy(khl->name, hi->host->driver->name);
 513                                 khl++;
 514                         }
 515                 }
 516                 spin_unlock_irq(&host_info_lock);
 517
 518                 if (khl != NULL) {
 519                         req->req.error = RAW1394_ERROR_NONE;
 520                         req->req.length = min(req->req.length,
 521                                               (u32) (sizeof
 522                                                      (struct raw1394_khost_list)
 523                                                      * req->req.misc));
 524                         req->free_data = 1;
 525                 } else {
 526                         return -ENOMEM;
 527                 }
 528                 break;
 529
 530         case RAW1394_REQ_SET_CARD:
 531                 spin_lock_irq(&host_info_lock);
 532                 if (req->req.misc < host_count) {
 533                         list_for_each_entry(hi, &host_info_list, list) {
 534                                 if (!req->req.misc--)
 535                                         break;
 536                         }
 537                         get_device(&hi->host->device);  // XXX Need to handle failure case
 538                         list_add_tail(&fi->list, &hi->file_info_list);
 539                         fi->host = hi->host;
 540                         fi->state = connected;
 541
 542                         req->req.error = RAW1394_ERROR_NONE;
 543                         req->req.generation = get_hpsb_generation(fi->host);
 544                         req->req.misc = (fi->host->node_id << 16)
 545                             | fi->host->node_count;
 546                         if (fi->protocol_version > 3) {
 547                                 req->req.misc |=
 548                                     NODEID_TO_NODE(fi->host->irm_id) << 8;
 549                         }
 550                 } else {
 551                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 552                 }
 553                 spin_unlock_irq(&host_info_lock);
 554
 555                 req->req.length = 0;
 556                 break;
 557
 558         default:
 559                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 560                 req->req.length = 0;
 561                 break;
 562         }
 563
 564         queue_complete_req(req);
 565         return sizeof(struct raw1394_request);
 566 }
 567
 568 static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
 569 {
 570         int channel = req->req.misc;
 571
 572         spin_lock_irq(&host_info_lock);
 573         if ((channel > 63) || (channel < -64)) {
 574                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 575         } else if (channel >= 0) {
 576                 /* allocate channel req.misc */
 577                 if (fi->listen_channels & (1ULL << channel)) {
 578                         req->req.error = RAW1394_ERROR_ALREADY;
 579                 } else {
 580                         if (hpsb_listen_channel
 581                             (&raw1394_highlevel, fi->host, channel)) {
 582                                 req->req.error = RAW1394_ERROR_ALREADY;
 583                         } else {
 584                                 fi->listen_channels |= 1ULL << channel;
 585                                 fi->iso_buffer = int2ptr(req->req.recvb);
 586                                 fi->iso_buffer_length = req->req.length;
 587                         }
 588                 }
 589         } else {
 590                 /* deallocate channel (one's complement neg) req.misc */
 591                 channel = ~channel;
 592
 593                 if (fi->listen_channels & (1ULL << channel)) {
 594                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host,
 595                                               channel);
 596                         fi->listen_channels &= ~(1ULL << channel);
 597                 } else {
 598                         req->req.error = RAW1394_ERROR_INVALID_ARG;
 599                 }
 600         }
 601
 602         req->req.length = 0;
 603         queue_complete_req(req);
 604         spin_unlock_irq(&host_info_lock);
 605 }
 606
 607 static void handle_fcp_listen(struct file_info *fi, struct pending_request *req)
 608 {
 609         if (req->req.misc) {
 610                 if (fi->fcp_buffer) {
 611                         req->req.error = RAW1394_ERROR_ALREADY;
 612                 } else {
 613                         fi->fcp_buffer = int2ptr(req->req.recvb);
 614                 }
 615         } else {
 616                 if (!fi->fcp_buffer) {
 617                         req->req.error = RAW1394_ERROR_ALREADY;
 618                 } else {
 619                         fi->fcp_buffer = NULL;
 620                 }
 621         }
 622
 623         req->req.length = 0;
 624         queue_complete_req(req);
 625 }
 626
 627 static int handle_async_request(struct file_info *fi,
 628                                 struct pending_request *req, int node)
 629 {
 630         struct hpsb_packet *packet = NULL;
 631         u64 addr = req->req.address & 0xffffffffffffULL;
 632
 633         switch (req->req.type) {
 634         case RAW1394_REQ_ASYNC_READ:
 635                 DBGMSG("read_request called");
 636                 packet =
 637                     hpsb_make_readpacket(fi->host, node, addr, req->req.length);
 638
 639                 if (!packet)
 640                         return -ENOMEM;
 641
 642                 if (req->req.length == 4)
 643                         req->data = &packet->header[3];
 644                 else
 645                         req->data = packet->data;
 646
 647                 break;
 648
 649         case RAW1394_REQ_ASYNC_WRITE:
 650                 DBGMSG("write_request called");
 651
 652                 packet = hpsb_make_writepacket(fi->host, node, addr, NULL,
 653                                                req->req.length);
 654                 if (!packet)
 655                         return -ENOMEM;
 656
 657                 if (req->req.length == 4) {
 658                         if (copy_from_user
 659                             (&packet->header[3], int2ptr(req->req.sendb),
 660                              req->req.length))
 661                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 662                 } else {
 663                         if (copy_from_user
 664                             (packet->data, int2ptr(req->req.sendb),
 665                              req->req.length))
 666                                 req->req.error = RAW1394_ERROR_MEMFAULT;
 667                 }
 668
 669                 req->req.length = 0;
 670                 break;
 671
 672         case RAW1394_REQ_ASYNC_STREAM:
 673                 DBGMSG("stream_request called");
 674
 675                 packet =
 676                     hpsb_make_streampacket(fi->host, NULL, req->req.length,
 677                                            node & 0x3f /*channel */ ,
 678                                            (req->req.misc >> 16) & 0x3,
 679                                            req->req.misc & 0xf);
 680                 if (!packet)
 681                         return -ENOMEM;
 682
 683                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 684                                    req->req.length))
 685                         req->req.error = RAW1394_ERROR_MEMFAULT;
 686
 687                 req->req.length = 0;
 688                 break;
 689
 690         case RAW1394_REQ_LOCK:
 691                 DBGMSG("lock_request called");
 692                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 693                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 694                         if (req->req.length != 4) {
 695                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 696                                 break;
 697                         }
 698                 } else {
 699                         if (req->req.length != 8) {
 700                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 701                                 break;
 702                         }
 703                 }
 704
 705                 packet = hpsb_make_lockpacket(fi->host, node, addr,
 706                                               req->req.misc, NULL, 0);
 707                 if (!packet)
 708                         return -ENOMEM;
 709
 710                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 711                                    req->req.length)) {
 712                         req->req.error = RAW1394_ERROR_MEMFAULT;
 713                         break;
 714                 }
 715
 716                 req->data = packet->data;
 717                 req->req.length = 4;
 718                 break;
 719
 720         case RAW1394_REQ_LOCK64:
 721                 DBGMSG("lock64_request called");
 722                 if ((req->req.misc == EXTCODE_FETCH_ADD)
 723                     || (req->req.misc == EXTCODE_LITTLE_ADD)) {
 724                         if (req->req.length != 8) {
 725                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 726                                 break;
 727                         }
 728                 } else {
 729                         if (req->req.length != 16) {
 730                                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 731                                 break;
 732                         }
 733                 }
 734                 packet = hpsb_make_lock64packet(fi->host, node, addr,
 735                                                 req->req.misc, NULL, 0);
 736                 if (!packet)
 737                         return -ENOMEM;
 738
 739                 if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 740                                    req->req.length)) {
 741                         req->req.error = RAW1394_ERROR_MEMFAULT;
 742                         break;
 743                 }
 744
 745                 req->data = packet->data;
 746                 req->req.length = 8;
 747                 break;
 748
 749         default:
 750                 req->req.error = RAW1394_ERROR_STATE_ORDER;
 751         }
 752
 753         req->packet = packet;
 754
 755         if (req->req.error) {
 756                 req->req.length = 0;
 757                 queue_complete_req(req);
 758                 return sizeof(struct raw1394_request);
 759         }
 760
 761         hpsb_set_packet_complete_task(packet,
 762                                       (void (*)(void *))queue_complete_cb, req);
 763
 764         spin_lock_irq(&fi->reqlists_lock);
 765         list_add_tail(&req->list, &fi->req_pending);
 766         spin_unlock_irq(&fi->reqlists_lock);
 767
 768         packet->generation = req->req.generation;
 769
 770         if (hpsb_send_packet(packet) < 0) {
 771                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 772                 req->req.length = 0;
 773                 hpsb_free_tlabel(packet);
 774                 queue_complete_req(req);
 775         }
 776         return sizeof(struct raw1394_request);
 777 }
 778
 779 static int handle_iso_send(struct file_info *fi, struct pending_request *req,
 780                            int channel)
 781 {
 782         struct hpsb_packet *packet;
 783
 784         packet = hpsb_make_isopacket(fi->host, req->req.length, channel & 0x3f,
 785                                      (req->req.misc >> 16) & 0x3,
 786                                      req->req.misc & 0xf);
 787         if (!packet)
 788                 return -ENOMEM;
 789
 790         packet->speed_code = req->req.address & 0x3;
 791
 792         req->packet = packet;
 793
 794         if (copy_from_user(packet->data, int2ptr(req->req.sendb),
 795                            req->req.length)) {
 796                 req->req.error = RAW1394_ERROR_MEMFAULT;
 797                 req->req.length = 0;
 798                 queue_complete_req(req);
 799                 return sizeof(struct raw1394_request);
 800         }
 801
 802         req->req.length = 0;
 803         hpsb_set_packet_complete_task(packet,
 804                                       (void (*)(void *))queue_complete_req,
 805                                       req);
 806
 807         spin_lock_irq(&fi->reqlists_lock);
 808         list_add_tail(&req->list, &fi->req_pending);
 809         spin_unlock_irq(&fi->reqlists_lock);
 810
 811         /* Update the generation of the packet just before sending. */
 812         packet->generation = req->req.generation;
 813
 814         if (hpsb_send_packet(packet) < 0) {
 815                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 816                 queue_complete_req(req);
 817         }
 818
 819         return sizeof(struct raw1394_request);
 820 }
 821
 822 static int handle_async_send(struct file_info *fi, struct pending_request *req)
 823 {
 824         struct hpsb_packet *packet;
 825         int header_length = req->req.misc & 0xffff;
 826         int expect_response = req->req.misc >> 16;
 827
 828         if ((header_length > req->req.length) || (header_length < 12)) {
 829                 req->req.error = RAW1394_ERROR_INVALID_ARG;
 830                 req->req.length = 0;
 831                 queue_complete_req(req);
 832                 return sizeof(struct raw1394_request);
 833         }
 834
 835         packet = hpsb_alloc_packet(req->req.length - header_length);
 836         req->packet = packet;
 837         if (!packet)
 838                 return -ENOMEM;
 839
 840         if (copy_from_user(packet->header, int2ptr(req->req.sendb),
 841                            header_length)) {
 842                 req->req.error = RAW1394_ERROR_MEMFAULT;
 843                 req->req.length = 0;
 844                 queue_complete_req(req);
 845                 return sizeof(struct raw1394_request);
 846         }
 847
 848         if (copy_from_user
 849             (packet->data, int2ptr(req->req.sendb) + header_length,
 850              packet->data_size)) {
 851                 req->req.error = RAW1394_ERROR_MEMFAULT;
 852                 req->req.length = 0;
 853                 queue_complete_req(req);
 854                 return sizeof(struct raw1394_request);
 855         }
 856
 857         packet->type = hpsb_async;
 858         packet->node_id = packet->header[0] >> 16;
 859         packet->tcode = (packet->header[0] >> 4) & 0xf;
 860         packet->tlabel = (packet->header[0] >> 10) & 0x3f;
 861         packet->host = fi->host;
 862         packet->expect_response = expect_response;
 863         packet->header_size = header_length;
 864         packet->data_size = req->req.length - header_length;
 865
 866         req->req.length = 0;
 867         hpsb_set_packet_complete_task(packet,
 868                                       (void (*)(void *))queue_complete_cb, req);
 869
 870         spin_lock_irq(&fi->reqlists_lock);
 871         list_add_tail(&req->list, &fi->req_pending);
 872         spin_unlock_irq(&fi->reqlists_lock);
 873
 874         /* Update the generation of the packet just before sending. */
 875         packet->generation = req->req.generation;
 876
 877         if (hpsb_send_packet(packet) < 0) {
 878                 req->req.error = RAW1394_ERROR_SEND_ERROR;
 879                 queue_complete_req(req);
 880         }
 881
 882         return sizeof(struct raw1394_request);
 883 }
 884
 885 static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
 886                     u64 addr, size_t length, u16 flags)
 887 {
 888         struct pending_request *req;
 889         struct host_info *hi;
 890         struct file_info *fi = NULL;
 891         struct list_head *entry;
 892         struct arm_addr *arm_addr = NULL;
 893         struct arm_request *arm_req = NULL;
 894         struct arm_response *arm_resp = NULL;
 895         int found = 0, size = 0, rcode = -1;
 896         struct arm_request_response *arm_req_resp = NULL;
 897
 898         DBGMSG("arm_read  called by node: %X"
 899                "addr: %4.4x %8.8x length: %Zu", nodeid,
 900                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
 901                length);
 902         spin_lock(&host_info_lock);
 903         hi = find_host_info(host);      /* search address-entry */
 904         if (hi != NULL) {
 905                 list_for_each_entry(fi, &hi->file_info_list, list) {
 906                         entry = fi->addr_list.next;
 907                         while (entry != &(fi->addr_list)) {
 908                                 arm_addr =
 909                                     list_entry(entry, struct arm_addr,
 910                                                addr_list);
 911                                 if (((arm_addr->start) <= (addr))
 912                                     && ((arm_addr->end) >= (addr + length))) {
 913                                         found = 1;
 914                                         break;
 915                                 }
 916                                 entry = entry->next;
 917                         }
 918                         if (found) {
 919                                 break;
 920                         }
 921                 }
 922         }
 923         rcode = -1;
 924         if (!found) {
 925                 printk(KERN_ERR "raw1394: arm_read FAILED addr_entry not found"
 926                        " -> rcode_address_error\n");
 927                 spin_unlock(&host_info_lock);
 928                 return (RCODE_ADDRESS_ERROR);
 929         } else {
 930                 DBGMSG("arm_read addr_entry FOUND");
 931         }
 932         if (arm_addr->rec_length < length) {
 933                 DBGMSG("arm_read blocklength too big -> rcode_data_error");
 934                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
 935         }
 936         if (rcode == -1) {
 937                 if (arm_addr->access_rights & ARM_READ) {
 938                         if (!(arm_addr->client_transactions & ARM_READ)) {
 939                                 memcpy(buffer,
 940                                        (arm_addr->addr_space_buffer) + (addr -
 941                                                                         (arm_addr->
 942                                                                          start)),
 943                                        length);
 944                                 DBGMSG("arm_read -> (rcode_complete)");
 945                                 rcode = RCODE_COMPLETE;
 946                         }
 947                 } else {
 948                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
 949                         DBGMSG("arm_read -> rcode_type_error (access denied)");
 950                 }
 951         }
 952         if (arm_addr->notification_options & ARM_READ) {
 953                 DBGMSG("arm_read -> entering notification-section");
 954                 req = __alloc_pending_request(SLAB_ATOMIC);
 955                 if (!req) {
 956                         DBGMSG("arm_read -> rcode_conflict_error");
 957                         spin_unlock(&host_info_lock);
 958                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
 959                                                            The request may be retried */
 960                 }
 961                 if (rcode == RCODE_COMPLETE) {
 962                         size =
 963                             sizeof(struct arm_request) +
 964                             sizeof(struct arm_response) +
 965                             length * sizeof(byte_t) +
 966                             sizeof(struct arm_request_response);
 967                 } else {
 968                         size =
 969                             sizeof(struct arm_request) +
 970                             sizeof(struct arm_response) +
 971                             sizeof(struct arm_request_response);
 972                 }
 973                 req->data = kmalloc(size, SLAB_ATOMIC);
 974                 if (!(req->data)) {
 975                         free_pending_request(req);
 976                         DBGMSG("arm_read -> rcode_conflict_error");
 977                         spin_unlock(&host_info_lock);
 978                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
 979                                                            The request may be retried */
 980                 }
 981                 req->free_data = 1;
 982                 req->file_info = fi;
 983                 req->req.type = RAW1394_REQ_ARM;
 984                 req->req.generation = get_hpsb_generation(host);
 985                 req->req.misc =
 986                     (((length << 16) & (0xFFFF0000)) | (ARM_READ & 0xFF));
 987                 req->req.tag = arm_addr->arm_tag;
 988                 req->req.recvb = arm_addr->recvb;
 989                 req->req.length = size;
 990                 arm_req_resp = (struct arm_request_response *)(req->data);
 991                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
 992                                                  (sizeof
 993                                                   (struct
 994                                                    arm_request_response)));
 995                 arm_resp =
 996                     (struct arm_response *)((byte_t *) (arm_req) +
 997                                             (sizeof(struct arm_request)));
 998                 arm_req->buffer = NULL;
 999                 arm_resp->buffer = NULL;
1000                 if (rcode == RCODE_COMPLETE) {
1001                         byte_t *buf =
1002                             (byte_t *) arm_resp + sizeof(struct arm_response);
1003                         memcpy(buf,
1004                                (arm_addr->addr_space_buffer) + (addr -
1005                                                                 (arm_addr->
1006                                                                  start)),
1007                                length);
1008                         arm_resp->buffer =
1009                             int2ptr((arm_addr->recvb) +
1010                                     sizeof(struct arm_request_response) +
1011                                     sizeof(struct arm_request) +
1012                                     sizeof(struct arm_response));
1013                 }
1014                 arm_resp->buffer_length =
1015                     (rcode == RCODE_COMPLETE) ? length : 0;
1016                 arm_resp->response_code = rcode;
1017                 arm_req->buffer_length = 0;
1018                 arm_req->generation = req->req.generation;
1019                 arm_req->extended_transaction_code = 0;
1020                 arm_req->destination_offset = addr;
1021                 arm_req->source_nodeid = nodeid;
1022                 arm_req->destination_nodeid = host->node_id;
1023                 arm_req->tlabel = (flags >> 10) & 0x3f;
1024                 arm_req->tcode = (flags >> 4) & 0x0f;
1025                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1026                                                 sizeof(struct
1027                                                        arm_request_response));
1028                 arm_req_resp->response =
1029                     int2ptr((arm_addr->recvb) +
1030                             sizeof(struct arm_request_response) +
1031                             sizeof(struct arm_request));
1032                 queue_complete_req(req);
1033         }
1034         spin_unlock(&host_info_lock);
1035         return (rcode);
1036 }
1037
1038 static int arm_write(struct hpsb_host *host, int nodeid, int destid,
1039                      quadlet_t * data, u64 addr, size_t length, u16 flags)
1040 {
1041         struct pending_request *req;
1042         struct host_info *hi;
1043         struct file_info *fi = NULL;
1044         struct list_head *entry;
1045         struct arm_addr *arm_addr = NULL;
1046         struct arm_request *arm_req = NULL;
1047         struct arm_response *arm_resp = NULL;
1048         int found = 0, size = 0, rcode = -1, length_conflict = 0;
1049         struct arm_request_response *arm_req_resp = NULL;
1050
1051         DBGMSG("arm_write called by node: %X"
1052                "addr: %4.4x %8.8x length: %Zu", nodeid,
1053                (u16) ((addr >> 32) & 0xFFFF), (u32) (addr & 0xFFFFFFFF),
1054                length);
1055         spin_lock(&host_info_lock);
1056         hi = find_host_info(host);      /* search address-entry */
1057         if (hi != NULL) {
1058                 list_for_each_entry(fi, &hi->file_info_list, list) {
1059                         entry = fi->addr_list.next;
1060                         while (entry != &(fi->addr_list)) {
1061                                 arm_addr =
1062                                     list_entry(entry, struct arm_addr,
1063                                                addr_list);
1064                                 if (((arm_addr->start) <= (addr))
1065                                     && ((arm_addr->end) >= (addr + length))) {
1066                                         found = 1;
1067                                         break;
1068                                 }
1069                                 entry = entry->next;
1070                         }
1071                         if (found) {
1072                                 break;
1073                         }
1074                 }
1075         }
1076         rcode = -1;
1077         if (!found) {
1078                 printk(KERN_ERR "raw1394: arm_write FAILED addr_entry not found"
1079                        " -> rcode_address_error\n");
1080                 spin_unlock(&host_info_lock);
1081                 return (RCODE_ADDRESS_ERROR);
1082         } else {
1083                 DBGMSG("arm_write addr_entry FOUND");
1084         }
1085         if (arm_addr->rec_length < length) {
1086                 DBGMSG("arm_write blocklength too big -> rcode_data_error");
1087                 length_conflict = 1;
1088                 rcode = RCODE_DATA_ERROR;       /* hardware error, data is unavailable */
1089         }
1090         if (rcode == -1) {
1091                 if (arm_addr->access_rights & ARM_WRITE) {
1092                         if (!(arm_addr->client_transactions & ARM_WRITE)) {
1093                                 memcpy((arm_addr->addr_space_buffer) +
1094                                        (addr - (arm_addr->start)), data,
1095                                        length);
1096                                 DBGMSG("arm_write -> (rcode_complete)");
1097                                 rcode = RCODE_COMPLETE;
1098                         }
1099                 } else {
1100                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1101                         DBGMSG("arm_write -> rcode_type_error (access denied)");
1102                 }
1103         }
1104         if (arm_addr->notification_options & ARM_WRITE) {
1105                 DBGMSG("arm_write -> entering notification-section");
1106                 req = __alloc_pending_request(SLAB_ATOMIC);
1107                 if (!req) {
1108                         DBGMSG("arm_write -> rcode_conflict_error");
1109                         spin_unlock(&host_info_lock);
1110                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1111                                                            The request my be retried */
1112                 }
1113                 size =
1114                     sizeof(struct arm_request) + sizeof(struct arm_response) +
1115                     (length) * sizeof(byte_t) +
1116                     sizeof(struct arm_request_response);
1117                 req->data = kmalloc(size, SLAB_ATOMIC);
1118                 if (!(req->data)) {
1119                         free_pending_request(req);
1120                         DBGMSG("arm_write -> rcode_conflict_error");
1121                         spin_unlock(&host_info_lock);
1122                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1123                                                            The request may be retried */
1124                 }
1125                 req->free_data = 1;
1126                 req->file_info = fi;
1127                 req->req.type = RAW1394_REQ_ARM;
1128                 req->req.generation = get_hpsb_generation(host);
1129                 req->req.misc =
1130                     (((length << 16) & (0xFFFF0000)) | (ARM_WRITE & 0xFF));
1131                 req->req.tag = arm_addr->arm_tag;
1132                 req->req.recvb = arm_addr->recvb;
1133                 req->req.length = size;
1134                 arm_req_resp = (struct arm_request_response *)(req->data);
1135                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1136                                                  (sizeof
1137                                                   (struct
1138                                                    arm_request_response)));
1139                 arm_resp =
1140                     (struct arm_response *)((byte_t *) (arm_req) +
1141                                             (sizeof(struct arm_request)));
1142                 arm_resp->buffer = NULL;
1143                 memcpy((byte_t *) arm_resp + sizeof(struct arm_response),
1144                        data, length);
1145                 arm_req->buffer = int2ptr((arm_addr->recvb) +
1146                                           sizeof(struct arm_request_response) +
1147                                           sizeof(struct arm_request) +
1148                                           sizeof(struct arm_response));
1149                 arm_req->buffer_length = length;
1150                 arm_req->generation = req->req.generation;
1151                 arm_req->extended_transaction_code = 0;
1152                 arm_req->destination_offset = addr;
1153                 arm_req->source_nodeid = nodeid;
1154                 arm_req->destination_nodeid = destid;
1155                 arm_req->tlabel = (flags >> 10) & 0x3f;
1156                 arm_req->tcode = (flags >> 4) & 0x0f;
1157                 arm_resp->buffer_length = 0;
1158                 arm_resp->response_code = rcode;
1159                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1160                                                 sizeof(struct
1161                                                        arm_request_response));
1162                 arm_req_resp->response =
1163                     int2ptr((arm_addr->recvb) +
1164                             sizeof(struct arm_request_response) +
1165                             sizeof(struct arm_request));
1166                 queue_complete_req(req);
1167         }
1168         spin_unlock(&host_info_lock);
1169         return (rcode);
1170 }
1171
1172 static int arm_lock(struct hpsb_host *host, int nodeid, quadlet_t * store,
1173                     u64 addr, quadlet_t data, quadlet_t arg, int ext_tcode,
1174                     u16 flags)
1175 {
1176         struct pending_request *req;
1177         struct host_info *hi;
1178         struct file_info *fi = NULL;
1179         struct list_head *entry;
1180         struct arm_addr *arm_addr = NULL;
1181         struct arm_request *arm_req = NULL;
1182         struct arm_response *arm_resp = NULL;
1183         int found = 0, size = 0, rcode = -1;
1184         quadlet_t old, new;
1185         struct arm_request_response *arm_req_resp = NULL;
1186
1187         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1188             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1189                 DBGMSG("arm_lock  called by node: %X "
1190                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X",
1191                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1192                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1193                        be32_to_cpu(data));
1194         } else {
1195                 DBGMSG("arm_lock  called by node: %X "
1196                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X arg: %8.8X",
1197                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1198                        (u32) (addr & 0xFFFFFFFF), ext_tcode & 0xFF,
1199                        be32_to_cpu(data), be32_to_cpu(arg));
1200         }
1201         spin_lock(&host_info_lock);
1202         hi = find_host_info(host);      /* search address-entry */
1203         if (hi != NULL) {
1204                 list_for_each_entry(fi, &hi->file_info_list, list) {
1205                         entry = fi->addr_list.next;
1206                         while (entry != &(fi->addr_list)) {
1207                                 arm_addr =
1208                                     list_entry(entry, struct arm_addr,
1209                                                addr_list);
1210                                 if (((arm_addr->start) <= (addr))
1211                                     && ((arm_addr->end) >=
1212                                         (addr + sizeof(*store)))) {
1213                                         found = 1;
1214                                         break;
1215                                 }
1216                                 entry = entry->next;
1217                         }
1218                         if (found) {
1219                                 break;
1220                         }
1221                 }
1222         }
1223         rcode = -1;
1224         if (!found) {
1225                 printk(KERN_ERR "raw1394: arm_lock FAILED addr_entry not found"
1226                        " -> rcode_address_error\n");
1227                 spin_unlock(&host_info_lock);
1228                 return (RCODE_ADDRESS_ERROR);
1229         } else {
1230                 DBGMSG("arm_lock addr_entry FOUND");
1231         }
1232         if (rcode == -1) {
1233                 if (arm_addr->access_rights & ARM_LOCK) {
1234                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1235                                 memcpy(&old,
1236                                        (arm_addr->addr_space_buffer) + (addr -
1237                                                                         (arm_addr->
1238                                                                          start)),
1239                                        sizeof(old));
1240                                 switch (ext_tcode) {
1241                                 case (EXTCODE_MASK_SWAP):
1242                                         new = data | (old & ~arg);
1243                                         break;
1244                                 case (EXTCODE_COMPARE_SWAP):
1245                                         if (old == arg) {
1246                                                 new = data;
1247                                         } else {
1248                                                 new = old;
1249                                         }
1250                                         break;
1251                                 case (EXTCODE_FETCH_ADD):
1252                                         new =
1253                                             cpu_to_be32(be32_to_cpu(data) +
1254                                                         be32_to_cpu(old));
1255                                         break;
1256                                 case (EXTCODE_LITTLE_ADD):
1257                                         new =
1258                                             cpu_to_le32(le32_to_cpu(data) +
1259                                                         le32_to_cpu(old));
1260                                         break;
1261                                 case (EXTCODE_BOUNDED_ADD):
1262                                         if (old != arg) {
1263                                                 new =
1264                                                     cpu_to_be32(be32_to_cpu
1265                                                                 (data) +
1266                                                                 be32_to_cpu
1267                                                                 (old));
1268                                         } else {
1269                                                 new = old;
1270                                         }
1271                                         break;
1272                                 case (EXTCODE_WRAP_ADD):
1273                                         if (old != arg) {
1274                                                 new =
1275                                                     cpu_to_be32(be32_to_cpu
1276                                                                 (data) +
1277                                                                 be32_to_cpu
1278                                                                 (old));
1279                                         } else {
1280                                                 new = data;
1281                                         }
1282                                         break;
1283                                 default:
1284                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1285                                         printk(KERN_ERR
1286                                                "raw1394: arm_lock FAILED "
1287                                                "ext_tcode not allowed -> rcode_type_error\n");
1288                                         break;
1289                                 }       /*switch */
1290                                 if (rcode == -1) {
1291                                         DBGMSG("arm_lock -> (rcode_complete)");
1292                                         rcode = RCODE_COMPLETE;
1293                                         memcpy(store, &old, sizeof(*store));
1294                                         memcpy((arm_addr->addr_space_buffer) +
1295                                                (addr - (arm_addr->start)),
1296                                                &new, sizeof(*store));
1297                                 }
1298                         }
1299                 } else {
1300                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1301                         DBGMSG("arm_lock -> rcode_type_error (access denied)");
1302                 }
1303         }
1304         if (arm_addr->notification_options & ARM_LOCK) {
1305                 byte_t *buf1, *buf2;
1306                 DBGMSG("arm_lock -> entering notification-section");
1307                 req = __alloc_pending_request(SLAB_ATOMIC);
1308                 if (!req) {
1309                         DBGMSG("arm_lock -> rcode_conflict_error");
1310                         spin_unlock(&host_info_lock);
1311                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1312                                                            The request may be retried */
1313                 }
1314                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1315                 req->data = kmalloc(size, SLAB_ATOMIC);
1316                 if (!(req->data)) {
1317                         free_pending_request(req);
1318                         DBGMSG("arm_lock -> rcode_conflict_error");
1319                         spin_unlock(&host_info_lock);
1320                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1321                                                            The request may be retried */
1322                 }
1323                 req->free_data = 1;
1324                 arm_req_resp = (struct arm_request_response *)(req->data);
1325                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1326                                                  (sizeof
1327                                                   (struct
1328                                                    arm_request_response)));
1329                 arm_resp =
1330                     (struct arm_response *)((byte_t *) (arm_req) +
1331                                             (sizeof(struct arm_request)));
1332                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1333                 buf2 = buf1 + 2 * sizeof(*store);
1334                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1335                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1336                         arm_req->buffer_length = sizeof(*store);
1337                         memcpy(buf1, &data, sizeof(*store));
1338
1339                 } else {
1340                         arm_req->buffer_length = 2 * sizeof(*store);
1341                         memcpy(buf1, &arg, sizeof(*store));
1342                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1343                 }
1344                 if (rcode == RCODE_COMPLETE) {
1345                         arm_resp->buffer_length = sizeof(*store);
1346                         memcpy(buf2, &old, sizeof(*store));
1347                 } else {
1348                         arm_resp->buffer_length = 0;
1349                 }
1350                 req->file_info = fi;
1351                 req->req.type = RAW1394_REQ_ARM;
1352                 req->req.generation = get_hpsb_generation(host);
1353                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1354                                  (ARM_LOCK & 0xFF));
1355                 req->req.tag = arm_addr->arm_tag;
1356                 req->req.recvb = arm_addr->recvb;
1357                 req->req.length = size;
1358                 arm_req->generation = req->req.generation;
1359                 arm_req->extended_transaction_code = ext_tcode;
1360                 arm_req->destination_offset = addr;
1361                 arm_req->source_nodeid = nodeid;
1362                 arm_req->destination_nodeid = host->node_id;
1363                 arm_req->tlabel = (flags >> 10) & 0x3f;
1364                 arm_req->tcode = (flags >> 4) & 0x0f;
1365                 arm_resp->response_code = rcode;
1366                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1367                                                 sizeof(struct
1368                                                        arm_request_response));
1369                 arm_req_resp->response =
1370                     int2ptr((arm_addr->recvb) +
1371                             sizeof(struct arm_request_response) +
1372                             sizeof(struct arm_request));
1373                 arm_req->buffer =
1374                     int2ptr((arm_addr->recvb) +
1375                             sizeof(struct arm_request_response) +
1376                             sizeof(struct arm_request) +
1377                             sizeof(struct arm_response));
1378                 arm_resp->buffer =
1379                     int2ptr((arm_addr->recvb) +
1380                             sizeof(struct arm_request_response) +
1381                             sizeof(struct arm_request) +
1382                             sizeof(struct arm_response) + 2 * sizeof(*store));
1383                 queue_complete_req(req);
1384         }
1385         spin_unlock(&host_info_lock);
1386         return (rcode);
1387 }
1388
1389 static int arm_lock64(struct hpsb_host *host, int nodeid, octlet_t * store,
1390                       u64 addr, octlet_t data, octlet_t arg, int ext_tcode,
1391                       u16 flags)
1392 {
1393         struct pending_request *req;
1394         struct host_info *hi;
1395         struct file_info *fi = NULL;
1396         struct list_head *entry;
1397         struct arm_addr *arm_addr = NULL;
1398         struct arm_request *arm_req = NULL;
1399         struct arm_response *arm_resp = NULL;
1400         int found = 0, size = 0, rcode = -1;
1401         octlet_t old, new;
1402         struct arm_request_response *arm_req_resp = NULL;
1403
1404         if (((ext_tcode & 0xFF) == EXTCODE_FETCH_ADD) ||
1405             ((ext_tcode & 0xFF) == EXTCODE_LITTLE_ADD)) {
1406                 DBGMSG("arm_lock64 called by node: %X "
1407                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X ",
1408                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1409                        (u32) (addr & 0xFFFFFFFF),
1410                        ext_tcode & 0xFF,
1411                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1412                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF));
1413         } else {
1414                 DBGMSG("arm_lock64 called by node: %X "
1415                        "addr: %4.4x %8.8x extcode: %2.2X data: %8.8X %8.8X arg: "
1416                        "%8.8X %8.8X ",
1417                        nodeid, (u16) ((addr >> 32) & 0xFFFF),
1418                        (u32) (addr & 0xFFFFFFFF),
1419                        ext_tcode & 0xFF,
1420                        (u32) ((be64_to_cpu(data) >> 32) & 0xFFFFFFFF),
1421                        (u32) (be64_to_cpu(data) & 0xFFFFFFFF),
1422                        (u32) ((be64_to_cpu(arg) >> 32) & 0xFFFFFFFF),
1423                        (u32) (be64_to_cpu(arg) & 0xFFFFFFFF));
1424         }
1425         spin_lock(&host_info_lock);
1426         hi = find_host_info(host);      /* search addressentry in file_info's for host */
1427         if (hi != NULL) {
1428                 list_for_each_entry(fi, &hi->file_info_list, list) {
1429                         entry = fi->addr_list.next;
1430                         while (entry != &(fi->addr_list)) {
1431                                 arm_addr =
1432                                     list_entry(entry, struct arm_addr,
1433                                                addr_list);
1434                                 if (((arm_addr->start) <= (addr))
1435                                     && ((arm_addr->end) >=
1436                                         (addr + sizeof(*store)))) {
1437                                         found = 1;
1438                                         break;
1439                                 }
1440                                 entry = entry->next;
1441                         }
1442                         if (found) {
1443                                 break;
1444                         }
1445                 }
1446         }
1447         rcode = -1;
1448         if (!found) {
1449                 printk(KERN_ERR
1450                        "raw1394: arm_lock64 FAILED addr_entry not found"
1451                        " -> rcode_address_error\n");
1452                 spin_unlock(&host_info_lock);
1453                 return (RCODE_ADDRESS_ERROR);
1454         } else {
1455                 DBGMSG("arm_lock64 addr_entry FOUND");
1456         }
1457         if (rcode == -1) {
1458                 if (arm_addr->access_rights & ARM_LOCK) {
1459                         if (!(arm_addr->client_transactions & ARM_LOCK)) {
1460                                 memcpy(&old,
1461                                        (arm_addr->addr_space_buffer) + (addr -
1462                                                                         (arm_addr->
1463                                                                          start)),
1464                                        sizeof(old));
1465                                 switch (ext_tcode) {
1466                                 case (EXTCODE_MASK_SWAP):
1467                                         new = data | (old & ~arg);
1468                                         break;
1469                                 case (EXTCODE_COMPARE_SWAP):
1470                                         if (old == arg) {
1471                                                 new = data;
1472                                         } else {
1473                                                 new = old;
1474                                         }
1475                                         break;
1476                                 case (EXTCODE_FETCH_ADD):
1477                                         new =
1478                                             cpu_to_be64(be64_to_cpu(data) +
1479                                                         be64_to_cpu(old));
1480                                         break;
1481                                 case (EXTCODE_LITTLE_ADD):
1482                                         new =
1483                                             cpu_to_le64(le64_to_cpu(data) +
1484                                                         le64_to_cpu(old));
1485                                         break;
1486                                 case (EXTCODE_BOUNDED_ADD):
1487                                         if (old != arg) {
1488                                                 new =
1489                                                     cpu_to_be64(be64_to_cpu
1490                                                                 (data) +
1491                                                                 be64_to_cpu
1492                                                                 (old));
1493                                         } else {
1494                                                 new = old;
1495                                         }
1496                                         break;
1497                                 case (EXTCODE_WRAP_ADD):
1498                                         if (old != arg) {
1499                                                 new =
1500                                                     cpu_to_be64(be64_to_cpu
1501                                                                 (data) +
1502                                                                 be64_to_cpu
1503                                                                 (old));
1504                                         } else {
1505                                                 new = data;
1506                                         }
1507                                         break;
1508                                 default:
1509                                         printk(KERN_ERR
1510                                                "raw1394: arm_lock64 FAILED "
1511                                                "ext_tcode not allowed -> rcode_type_error\n");
1512                                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1513                                         break;
1514                                 }       /*switch */
1515                                 if (rcode == -1) {
1516                                         DBGMSG
1517                                             ("arm_lock64 -> (rcode_complete)");
1518                                         rcode = RCODE_COMPLETE;
1519                                         memcpy(store, &old, sizeof(*store));
1520                                         memcpy((arm_addr->addr_space_buffer) +
1521                                                (addr - (arm_addr->start)),
1522                                                &new, sizeof(*store));
1523                                 }
1524                         }
1525                 } else {
1526                         rcode = RCODE_TYPE_ERROR;       /* function not allowed */
1527                         DBGMSG
1528                             ("arm_lock64 -> rcode_type_error (access denied)");
1529                 }
1530         }
1531         if (arm_addr->notification_options & ARM_LOCK) {
1532                 byte_t *buf1, *buf2;
1533                 DBGMSG("arm_lock64 -> entering notification-section");
1534                 req = __alloc_pending_request(SLAB_ATOMIC);
1535                 if (!req) {
1536                         spin_unlock(&host_info_lock);
1537                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1538                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1539                                                            The request may be retried */
1540                 }
1541                 size = sizeof(struct arm_request) + sizeof(struct arm_response) + 3 * sizeof(*store) + sizeof(struct arm_request_response);     /* maximum */
1542                 req->data = kmalloc(size, SLAB_ATOMIC);
1543                 if (!(req->data)) {
1544                         free_pending_request(req);
1545                         spin_unlock(&host_info_lock);
1546                         DBGMSG("arm_lock64 -> rcode_conflict_error");
1547                         return (RCODE_CONFLICT_ERROR);  /* A resource conflict was detected.
1548                                                            The request may be retried */
1549                 }
1550                 req->free_data = 1;
1551                 arm_req_resp = (struct arm_request_response *)(req->data);
1552                 arm_req = (struct arm_request *)((byte_t *) (req->data) +
1553                                                  (sizeof
1554                                                   (struct
1555                                                    arm_request_response)));
1556                 arm_resp =
1557                     (struct arm_response *)((byte_t *) (arm_req) +
1558                                             (sizeof(struct arm_request)));
1559                 buf1 = (byte_t *) arm_resp + sizeof(struct arm_response);
1560                 buf2 = buf1 + 2 * sizeof(*store);
1561                 if ((ext_tcode == EXTCODE_FETCH_ADD) ||
1562                     (ext_tcode == EXTCODE_LITTLE_ADD)) {
1563                         arm_req->buffer_length = sizeof(*store);
1564                         memcpy(buf1, &data, sizeof(*store));
1565
1566                 } else {
1567                         arm_req->buffer_length = 2 * sizeof(*store);
1568                         memcpy(buf1, &arg, sizeof(*store));
1569                         memcpy(buf1 + sizeof(*store), &data, sizeof(*store));
1570                 }
1571                 if (rcode == RCODE_COMPLETE) {
1572                         arm_resp->buffer_length = sizeof(*store);
1573                         memcpy(buf2, &old, sizeof(*store));
1574                 } else {
1575                         arm_resp->buffer_length = 0;
1576                 }
1577                 req->file_info = fi;
1578                 req->req.type = RAW1394_REQ_ARM;
1579                 req->req.generation = get_hpsb_generation(host);
1580                 req->req.misc = ((((sizeof(*store)) << 16) & (0xFFFF0000)) |
1581                                  (ARM_LOCK & 0xFF));
1582                 req->req.tag = arm_addr->arm_tag;
1583                 req->req.recvb = arm_addr->recvb;
1584                 req->req.length = size;
1585                 arm_req->generation = req->req.generation;
1586                 arm_req->extended_transaction_code = ext_tcode;
1587                 arm_req->destination_offset = addr;
1588                 arm_req->source_nodeid = nodeid;
1589                 arm_req->destination_nodeid = host->node_id;
1590                 arm_req->tlabel = (flags >> 10) & 0x3f;
1591                 arm_req->tcode = (flags >> 4) & 0x0f;
1592                 arm_resp->response_code = rcode;
1593                 arm_req_resp->request = int2ptr((arm_addr->recvb) +
1594                                                 sizeof(struct
1595                                                        arm_request_response));
1596                 arm_req_resp->response =
1597                     int2ptr((arm_addr->recvb) +
1598                             sizeof(struct arm_request_response) +
1599                             sizeof(struct arm_request));
1600                 arm_req->buffer =
1601                     int2ptr((arm_addr->recvb) +
1602                             sizeof(struct arm_request_response) +
1603                             sizeof(struct arm_request) +
1604                             sizeof(struct arm_response));
1605                 arm_resp->buffer =
1606                     int2ptr((arm_addr->recvb) +
1607                             sizeof(struct arm_request_response) +
1608                             sizeof(struct arm_request) +
1609                             sizeof(struct arm_response) + 2 * sizeof(*store));
1610                 queue_complete_req(req);
1611         }
1612         spin_unlock(&host_info_lock);
1613         return (rcode);
1614 }
1615
1616 static int arm_register(struct file_info *fi, struct pending_request *req)
1617 {
1618         int retval;
1619         struct arm_addr *addr;
1620         struct host_info *hi;
1621         struct file_info *fi_hlp = NULL;
1622         struct list_head *entry;
1623         struct arm_addr *arm_addr = NULL;
1624         int same_host, another_host;
1625         unsigned long flags;
1626
1627         DBGMSG("arm_register called "
1628                "addr(Offset): %8.8x %8.8x length: %u "
1629                "rights: %2.2X notify: %2.2X "
1630                "max_blk_len: %4.4X",
1631                (u32) ((req->req.address >> 32) & 0xFFFF),
1632                (u32) (req->req.address & 0xFFFFFFFF),
1633                req->req.length, ((req->req.misc >> 8) & 0xFF),
1634                (req->req.misc & 0xFF), ((req->req.misc >> 16) & 0xFFFF));
1635         /* check addressrange */
1636         if ((((req->req.address) & ~(0xFFFFFFFFFFFFULL)) != 0) ||
1637             (((req->req.address + req->req.length) & ~(0xFFFFFFFFFFFFULL)) !=
1638              0)) {
1639                 req->req.length = 0;
1640                 return (-EINVAL);
1641         }
1642         /* addr-list-entry for fileinfo */
1643         addr = (struct arm_addr *)kmalloc(sizeof(struct arm_addr), SLAB_KERNEL);
1644         if (!addr) {
1645                 req->req.length = 0;
1646                 return (-ENOMEM);
1647         }
1648         /* allocation of addr_space_buffer */
1649         addr->addr_space_buffer = (u8 *) vmalloc(req->req.length);
1650         if (!(addr->addr_space_buffer)) {
1651                 kfree(addr);
1652                 req->req.length = 0;
1653                 return (-ENOMEM);
1654         }
1655         /* initialization of addr_space_buffer */
1656         if ((req->req.sendb) == (unsigned long)NULL) {
1657                 /* init: set 0 */
1658                 memset(addr->addr_space_buffer, 0, req->req.length);
1659         } else {
1660                 /* init: user -> kernel */
1661                 if (copy_from_user
1662                     (addr->addr_space_buffer, int2ptr(req->req.sendb),
1663                      req->req.length)) {
1664                         vfree(addr->addr_space_buffer);
1665                         kfree(addr);
1666                         return (-EFAULT);
1667                 }
1668         }
1669         INIT_LIST_HEAD(&addr->addr_list);
1670         addr->arm_tag = req->req.tag;
1671         addr->start = req->req.address;
1672         addr->end = req->req.address + req->req.length;
1673         addr->access_rights = (u8) (req->req.misc & 0x0F);
1674         addr->notification_options = (u8) ((req->req.misc >> 4) & 0x0F);
1675         addr->client_transactions = (u8) ((req->req.misc >> 8) & 0x0F);
1676         addr->access_rights |= addr->client_transactions;
1677         addr->notification_options |= addr->client_transactions;
1678         addr->recvb = req->req.recvb;
1679         addr->rec_length = (u16) ((req->req.misc >> 16) & 0xFFFF);
1680         spin_lock_irqsave(&host_info_lock, flags);
1681         hi = find_host_info(fi->host);
1682         same_host = 0;
1683         another_host = 0;
1684         /* same host with address-entry containing same addressrange ? */
1685         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1686                 entry = fi_hlp->addr_list.next;
1687                 while (entry != &(fi_hlp->addr_list)) {
1688                         arm_addr =
1689                             list_entry(entry, struct arm_addr, addr_list);
1690                         if ((arm_addr->start == addr->start)
1691                             && (arm_addr->end == addr->end)) {
1692                                 DBGMSG("same host ownes same "
1693                                        "addressrange -> EALREADY");
1694                                 same_host = 1;
1695                                 break;
1696                         }
1697                         entry = entry->next;
1698                 }
1699                 if (same_host) {
1700                         break;
1701                 }
1702         }
1703         if (same_host) {
1704                 /* addressrange occupied by same host */
1705                 vfree(addr->addr_space_buffer);
1706                 kfree(addr);
1707                 spin_unlock_irqrestore(&host_info_lock, flags);
1708                 return (-EALREADY);
1709         }
1710         /* another host with valid address-entry containing same addressrange */
1711         list_for_each_entry(hi, &host_info_list, list) {
1712                 if (hi->host != fi->host) {
1713                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1714                                 entry = fi_hlp->addr_list.next;
1715                                 while (entry != &(fi_hlp->addr_list)) {
1716                                         arm_addr =
1717                                             list_entry(entry, struct arm_addr,
1718                                                        addr_list);
1719                                         if ((arm_addr->start == addr->start)
1720                                             && (arm_addr->end == addr->end)) {
1721                                                 DBGMSG
1722                                                     ("another host ownes same "
1723                                                      "addressrange");
1724                                                 another_host = 1;
1725                                                 break;
1726                                         }
1727                                         entry = entry->next;
1728                                 }
1729                                 if (another_host) {
1730                                         break;
1731                                 }
1732                         }
1733                 }
1734         }
1735         if (another_host) {
1736                 DBGMSG("another hosts entry is valid -> SUCCESS");
1737                 if (copy_to_user(int2ptr(req->req.recvb),
1738                                  &addr->start, sizeof(u64))) {
1739                         printk(KERN_ERR "raw1394: arm_register failed "
1740                                " address-range-entry is invalid -> EFAULT !!!\n");
1741                         vfree(addr->addr_space_buffer);
1742                         kfree(addr);
1743                         spin_unlock_irqrestore(&host_info_lock, flags);
1744                         return (-EFAULT);
1745                 }
1746                 free_pending_request(req);      /* immediate success or fail */
1747                 /* INSERT ENTRY */
1748                 list_add_tail(&addr->addr_list, &fi->addr_list);
1749                 spin_unlock_irqrestore(&host_info_lock, flags);
1750                 return sizeof(struct raw1394_request);
1751         }
1752         retval =
1753             hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
1754                                     req->req.address,
1755                                     req->req.address + req->req.length);
1756         if (retval) {
1757                 /* INSERT ENTRY */
1758                 list_add_tail(&addr->addr_list, &fi->addr_list);
1759         } else {
1760                 DBGMSG("arm_register failed errno: %d \n", retval);
1761                 vfree(addr->addr_space_buffer);
1762                 kfree(addr);
1763                 spin_unlock_irqrestore(&host_info_lock, flags);
1764                 return (-EALREADY);
1765         }
1766         spin_unlock_irqrestore(&host_info_lock, flags);
1767         free_pending_request(req);      /* immediate success or fail */
1768         return sizeof(struct raw1394_request);
1769 }
1770
1771 static int arm_unregister(struct file_info *fi, struct pending_request *req)
1772 {
1773         int found = 0;
1774         int retval = 0;
1775         struct list_head *entry;
1776         struct arm_addr *addr = NULL;
1777         struct host_info *hi;
1778         struct file_info *fi_hlp = NULL;
1779         struct arm_addr *arm_addr = NULL;
1780         int another_host;
1781         unsigned long flags;
1782
1783         DBGMSG("arm_Unregister called addr(Offset): "
1784                "%8.8x %8.8x",
1785                (u32) ((req->req.address >> 32) & 0xFFFF),
1786                (u32) (req->req.address & 0xFFFFFFFF));
1787         spin_lock_irqsave(&host_info_lock, flags);
1788         /* get addr */
1789         entry = fi->addr_list.next;
1790         while (entry != &(fi->addr_list)) {
1791                 addr = list_entry(entry, struct arm_addr, addr_list);
1792                 if (addr->start == req->req.address) {
1793                         found = 1;
1794                         break;
1795                 }
1796                 entry = entry->next;
1797         }
1798         if (!found) {
1799                 DBGMSG("arm_Unregister addr not found");
1800                 spin_unlock_irqrestore(&host_info_lock, flags);
1801                 return (-EINVAL);
1802         }
1803         DBGMSG("arm_Unregister addr found");
1804         another_host = 0;
1805         /* another host with valid address-entry containing
1806            same addressrange */
1807         list_for_each_entry(hi, &host_info_list, list) {
1808                 if (hi->host != fi->host) {
1809                         list_for_each_entry(fi_hlp, &hi->file_info_list, list) {
1810                                 entry = fi_hlp->addr_list.next;
1811                                 while (entry != &(fi_hlp->addr_list)) {
1812                                         arm_addr = list_entry(entry,
1813                                                               struct arm_addr,
1814                                                               addr_list);
1815                                         if (arm_addr->start == addr->start) {
1816                                                 DBGMSG("another host ownes "
1817                                                        "same addressrange");
1818                                                 another_host = 1;
1819                                                 break;
1820                                         }
1821                                         entry = entry->next;
1822                                 }
1823                                 if (another_host) {
1824                                         break;
1825                                 }
1826                         }
1827                 }
1828         }
1829         if (another_host) {
1830                 DBGMSG("delete entry from list -> success");
1831                 list_del(&addr->addr_list);
1832                 vfree(addr->addr_space_buffer);
1833                 kfree(addr);
1834                 free_pending_request(req);      /* immediate success or fail */
1835                 spin_unlock_irqrestore(&host_info_lock, flags);
1836                 return sizeof(struct raw1394_request);
1837         }
1838         retval =
1839             hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
1840                                       addr->start);
1841         if (!retval) {
1842                 printk(KERN_ERR "raw1394: arm_Unregister failed -> EINVAL\n");
1843                 spin_unlock_irqrestore(&host_info_lock, flags);
1844                 return (-EINVAL);
1845         }
1846         DBGMSG("delete entry from list -> success");
1847         list_del(&addr->addr_list);
1848         spin_unlock_irqrestore(&host_info_lock, flags);
1849         vfree(addr->addr_space_buffer);
1850         kfree(addr);
1851         free_pending_request(req);      /* immediate success or fail */
1852         return sizeof(struct raw1394_request);
1853 }
1854
1855 /* Copy data from ARM buffer(s) to user buffer. */
1856 static int arm_get_buf(struct file_info *fi, struct pending_request *req)
1857 {
1858         struct arm_addr *arm_addr = NULL;
1859         unsigned long flags;
1860         unsigned long offset;
1861
1862         struct list_head *entry;
1863
1864         DBGMSG("arm_get_buf "
1865                "addr(Offset): %04X %08X length: %u",
1866                (u32) ((req->req.address >> 32) & 0xFFFF),
1867                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1868
1869         spin_lock_irqsave(&host_info_lock, flags);
1870         entry = fi->addr_list.next;
1871         while (entry != &(fi->addr_list)) {
1872                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1873                 if ((arm_addr->start <= req->req.address) &&
1874                     (arm_addr->end > req->req.address)) {
1875                         if (req->req.address + req->req.length <= arm_addr->end) {
1876                                 offset = req->req.address - arm_addr->start;
1877
1878                                 DBGMSG
1879                                     ("arm_get_buf copy_to_user( %08X, %p, %u )",
1880                                      (u32) req->req.recvb,
1881                                      arm_addr->addr_space_buffer + offset,
1882                                      (u32) req->req.length);
1883
1884                                 if (copy_to_user
1885                                     (int2ptr(req->req.recvb),
1886                                      arm_addr->addr_space_buffer + offset,
1887                                      req->req.length)) {
1888                                         spin_unlock_irqrestore(&host_info_lock,
1889                                                                flags);
1890                                         return (-EFAULT);
1891                                 }
1892
1893                                 spin_unlock_irqrestore(&host_info_lock, flags);
1894                                 /* We have to free the request, because we
1895                                  * queue no response, and therefore nobody
1896                                  * will free it. */
1897                                 free_pending_request(req);
1898                                 return sizeof(struct raw1394_request);
1899                         } else {
1900                                 DBGMSG("arm_get_buf request exceeded mapping");
1901                                 spin_unlock_irqrestore(&host_info_lock, flags);
1902                                 return (-EINVAL);
1903                         }
1904                 }
1905                 entry = entry->next;
1906         }
1907         spin_unlock_irqrestore(&host_info_lock, flags);
1908         return (-EINVAL);
1909 }
1910
1911 /* Copy data from user buffer to ARM buffer(s). */
1912 static int arm_set_buf(struct file_info *fi, struct pending_request *req)
1913 {
1914         struct arm_addr *arm_addr = NULL;
1915         unsigned long flags;
1916         unsigned long offset;
1917
1918         struct list_head *entry;
1919
1920         DBGMSG("arm_set_buf "
1921                "addr(Offset): %04X %08X length: %u",
1922                (u32) ((req->req.address >> 32) & 0xFFFF),
1923                (u32) (req->req.address & 0xFFFFFFFF), (u32) req->req.length);
1924
1925         spin_lock_irqsave(&host_info_lock, flags);
1926         entry = fi->addr_list.next;
1927         while (entry != &(fi->addr_list)) {
1928                 arm_addr = list_entry(entry, struct arm_addr, addr_list);
1929                 if ((arm_addr->start <= req->req.address) &&
1930                     (arm_addr->end > req->req.address)) {
1931                         if (req->req.address + req->req.length <= arm_addr->end) {
1932                                 offset = req->req.address - arm_addr->start;
1933
1934                                 DBGMSG
1935                                     ("arm_set_buf copy_from_user( %p, %08X, %u )",
1936                                      arm_addr->addr_space_buffer + offset,
1937                                      (u32) req->req.sendb,
1938                                      (u32) req->req.length);
1939
1940                                 if (copy_from_user
1941                                     (arm_addr->addr_space_buffer + offset,
1942                                      int2ptr(req->req.sendb),
1943                                      req->req.length)) {
1944                                         spin_unlock_irqrestore(&host_info_lock,
1945                                                                flags);
1946                                         return (-EFAULT);
1947                                 }
1948
1949                                 spin_unlock_irqrestore(&host_info_lock, flags);
1950                                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
1951                                 return sizeof(struct raw1394_request);
1952                         } else {
1953                                 DBGMSG("arm_set_buf request exceeded mapping");
1954                                 spin_unlock_irqrestore(&host_info_lock, flags);
1955                                 return (-EINVAL);
1956                         }
1957                 }
1958                 entry = entry->next;
1959         }
1960         spin_unlock_irqrestore(&host_info_lock, flags);
1961         return (-EINVAL);
1962 }
1963
1964 static int reset_notification(struct file_info *fi, struct pending_request *req)
1965 {
1966         DBGMSG("reset_notification called - switch %s ",
1967                (req->req.misc == RAW1394_NOTIFY_OFF) ? "OFF" : "ON");
1968         if ((req->req.misc == RAW1394_NOTIFY_OFF) ||
1969             (req->req.misc == RAW1394_NOTIFY_ON)) {
1970                 fi->notification = (u8) req->req.misc;
1971                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
1972                 return sizeof(struct raw1394_request);
1973         }
1974         /* error EINVAL (22) invalid argument */
1975         return (-EINVAL);
1976 }
1977
1978 static int write_phypacket(struct file_info *fi, struct pending_request *req)
1979 {
1980         struct hpsb_packet *packet = NULL;
1981         int retval = 0;
1982         quadlet_t data;
1983
1984         data = be32_to_cpu((u32) req->req.sendb);
1985         DBGMSG("write_phypacket called - quadlet 0x%8.8x ", data);
1986         packet = hpsb_make_phypacket(fi->host, data);
1987         if (!packet)
1988                 return -ENOMEM;
1989         req->req.length = 0;
1990         req->packet = packet;
1991         hpsb_set_packet_complete_task(packet,
1992                                       (void (*)(void *))queue_complete_cb, req);
1993         spin_lock_irq(&fi->reqlists_lock);
1994         list_add_tail(&req->list, &fi->req_pending);
1995         spin_unlock_irq(&fi->reqlists_lock);
1996         packet->generation = req->req.generation;
1997         retval = hpsb_send_packet(packet);
1998         DBGMSG("write_phypacket send_packet called => retval: %d ", retval);
1999         if (retval < 0) {
2000                 req->req.error = RAW1394_ERROR_SEND_ERROR;
2001                 req->req.length = 0;
2002                 queue_complete_req(req);
2003         }
2004         return sizeof(struct raw1394_request);
2005 }
2006
2007 static int get_config_rom(struct file_info *fi, struct pending_request *req)
2008 {
2009         int ret = sizeof(struct raw1394_request);
2010         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2011         int status;
2012
2013         if (!data)
2014                 return -ENOMEM;
2015
2016         status =
2017             csr1212_read(fi->host->csr.rom, CSR1212_CONFIG_ROM_SPACE_OFFSET,
2018                          data, req->req.length);
2019         if (copy_to_user(int2ptr(req->req.recvb), data, req->req.length))
2020                 ret = -EFAULT;
2021         if (copy_to_user
2022             (int2ptr(req->req.tag), &fi->host->csr.rom->cache_head->len,
2023              sizeof(fi->host->csr.rom->cache_head->len)))
2024                 ret = -EFAULT;
2025         if (copy_to_user(int2ptr(req->req.address), &fi->host->csr.generation,
2026                          sizeof(fi->host->csr.generation)))
2027                 ret = -EFAULT;
2028         if (copy_to_user(int2ptr(req->req.sendb), &status, sizeof(status)))
2029                 ret = -EFAULT;
2030         kfree(data);
2031         if (ret >= 0) {
2032                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2033         }
2034         return ret;
2035 }
2036
2037 static int update_config_rom(struct file_info *fi, struct pending_request *req)
2038 {
2039         int ret = sizeof(struct raw1394_request);
2040         quadlet_t *data = kmalloc(req->req.length, SLAB_KERNEL);
2041         if (!data)
2042                 return -ENOMEM;
2043         if (copy_from_user(data, int2ptr(req->req.sendb), req->req.length)) {
2044                 ret = -EFAULT;
2045         } else {
2046                 int status = hpsb_update_config_rom(fi->host,
2047                                                     data, req->req.length,
2048                                                     (unsigned char)req->req.
2049                                                     misc);
2050                 if (copy_to_user
2051                     (int2ptr(req->req.recvb), &status, sizeof(status)))
2052                         ret = -ENOMEM;
2053         }
2054         kfree(data);
2055         if (ret >= 0) {
2056                 free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2057                 fi->cfgrom_upd = 1;
2058         }
2059         return ret;
2060 }
2061
2062 static int modify_config_rom(struct file_info *fi, struct pending_request *req)
2063 {
2064         struct csr1212_keyval *kv;
2065         struct csr1212_csr_rom_cache *cache;
2066         struct csr1212_dentry *dentry;
2067         u32 dr;
2068         int ret = 0;
2069
2070         if (req->req.misc == ~0) {
2071                 if (req->req.length == 0)
2072                         return -EINVAL;
2073
2074                 /* Find an unused slot */
2075                 for (dr = 0;
2076                      dr < RAW1394_MAX_USER_CSR_DIRS && fi->csr1212_dirs[dr];
2077                      dr++) ;
2078
2079                 if (dr == RAW1394_MAX_USER_CSR_DIRS)
2080                         return -ENOMEM;
2081
2082                 fi->csr1212_dirs[dr] =
2083                     csr1212_new_directory(CSR1212_KV_ID_VENDOR);
2084                 if (!fi->csr1212_dirs[dr])
2085                         return -ENOMEM;
2086         } else {
2087                 dr = req->req.misc;
2088                 if (!fi->csr1212_dirs[dr])
2089                         return -EINVAL;
2090
2091                 /* Delete old stuff */
2092                 for (dentry =
2093                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2094                      dentry; dentry = dentry->next) {
2095                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2096                                                              root_kv,
2097                                                              dentry->kv);
2098                 }
2099
2100                 if (req->req.length == 0) {
2101                         csr1212_release_keyval(fi->csr1212_dirs[dr]);
2102                         fi->csr1212_dirs[dr] = NULL;
2103
2104                         hpsb_update_config_rom_image(fi->host);
2105                         free_pending_request(req);
2106                         return sizeof(struct raw1394_request);
2107                 }
2108         }
2109
2110         cache = csr1212_rom_cache_malloc(0, req->req.length);
2111         if (!cache) {
2112                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2113                 fi->csr1212_dirs[dr] = NULL;
2114                 return -ENOMEM;
2115         }
2116
2117         cache->filled_head =
2118             kmalloc(sizeof(struct csr1212_cache_region), GFP_KERNEL);
2119         if (!cache->filled_head) {
2120                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2121                 fi->csr1212_dirs[dr] = NULL;
2122                 CSR1212_FREE(cache);
2123                 return -ENOMEM;
2124         }
2125         cache->filled_tail = cache->filled_head;
2126
2127         if (copy_from_user(cache->data, int2ptr(req->req.sendb),
2128                            req->req.length)) {
2129                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2130                 fi->csr1212_dirs[dr] = NULL;
2131                 CSR1212_FREE(cache);
2132                 ret = -EFAULT;
2133         } else {
2134                 cache->len = req->req.length;
2135                 cache->filled_head->offset_start = 0;
2136                 cache->filled_head->offset_end = cache->size - 1;
2137
2138                 cache->layout_head = cache->layout_tail = fi->csr1212_dirs[dr];
2139
2140                 ret = CSR1212_SUCCESS;
2141                 /* parse all the items */
2142                 for (kv = cache->layout_head; ret == CSR1212_SUCCESS && kv;
2143                      kv = kv->next) {
2144                         ret = csr1212_parse_keyval(kv, cache);
2145                 }
2146
2147                 /* attach top level items to the root directory */
2148                 for (dentry =
2149                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2150                      ret == CSR1212_SUCCESS && dentry; dentry = dentry->next) {
2151                         ret =
2152                             csr1212_attach_keyval_to_directory(fi->host->csr.
2153                                                                rom->root_kv,
2154                                                                dentry->kv);
2155                 }
2156
2157                 if (ret == CSR1212_SUCCESS) {
2158                         ret = hpsb_update_config_rom_image(fi->host);
2159
2160                         if (ret >= 0 && copy_to_user(int2ptr(req->req.recvb),
2161                                                      &dr, sizeof(dr))) {
2162                                 ret = -ENOMEM;
2163                         }
2164                 }
2165         }
2166         kfree(cache->filled_head);
2167         kfree(cache);
2168
2169         if (ret >= 0) {
2170                 /* we have to free the request, because we queue no response,
2171                  * and therefore nobody will free it */
2172                 free_pending_request(req);
2173                 return sizeof(struct raw1394_request);
2174         } else {
2175                 for (dentry =
2176                      fi->csr1212_dirs[dr]->value.directory.dentries_head;
2177                      dentry; dentry = dentry->next) {
2178                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2179                                                              root_kv,
2180                                                              dentry->kv);
2181                 }
2182                 csr1212_release_keyval(fi->csr1212_dirs[dr]);
2183                 fi->csr1212_dirs[dr] = NULL;
2184                 return ret;
2185         }
2186 }
2187
2188 static int state_connected(struct file_info *fi, struct pending_request *req)
2189 {
2190         int node = req->req.address >> 48;
2191
2192         req->req.error = RAW1394_ERROR_NONE;
2193
2194         switch (req->req.type) {
2195
2196         case RAW1394_REQ_ECHO:
2197                 queue_complete_req(req);
2198                 return sizeof(struct raw1394_request);
2199
2200         case RAW1394_REQ_ISO_SEND:
2201                 return handle_iso_send(fi, req, node);
2202
2203         case RAW1394_REQ_ARM_REGISTER:
2204                 return arm_register(fi, req);
2205
2206         case RAW1394_REQ_ARM_UNREGISTER:
2207                 return arm_unregister(fi, req);
2208
2209         case RAW1394_REQ_ARM_SET_BUF:
2210                 return arm_set_buf(fi, req);
2211
2212         case RAW1394_REQ_ARM_GET_BUF:
2213                 return arm_get_buf(fi, req);
2214
2215         case RAW1394_REQ_RESET_NOTIFY:
2216                 return reset_notification(fi, req);
2217
2218         case RAW1394_REQ_ISO_LISTEN:
2219                 handle_iso_listen(fi, req);
2220                 return sizeof(struct raw1394_request);
2221
2222         case RAW1394_REQ_FCP_LISTEN:
2223                 handle_fcp_listen(fi, req);
2224                 return sizeof(struct raw1394_request);
2225
2226         case RAW1394_REQ_RESET_BUS:
2227                 if (req->req.misc == RAW1394_LONG_RESET) {
2228                         DBGMSG("busreset called (type: LONG)");
2229                         hpsb_reset_bus(fi->host, LONG_RESET);
2230                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2231                         return sizeof(struct raw1394_request);
2232                 }
2233                 if (req->req.misc == RAW1394_SHORT_RESET) {
2234                         DBGMSG("busreset called (type: SHORT)");
2235                         hpsb_reset_bus(fi->host, SHORT_RESET);
2236                         free_pending_request(req);      /* we have to free the request, because we queue no response, and therefore nobody will free it */
2237                         return sizeof(struct raw1394_request);
2238                 }
2239                 /* error EINVAL (22) invalid argument */
2240                 return (-EINVAL);
2241         case RAW1394_REQ_GET_ROM:
2242                 return get_config_rom(fi, req);
2243
2244         case RAW1394_REQ_UPDATE_ROM:
2245                 return update_config_rom(fi, req);
2246
2247         case RAW1394_REQ_MODIFY_ROM:
2248                 return modify_config_rom(fi, req);
2249         }
2250
2251         if (req->req.generation != get_hpsb_generation(fi->host)) {
2252                 req->req.error = RAW1394_ERROR_GENERATION;
2253                 req->req.generation = get_hpsb_generation(fi->host);
2254                 req->req.length = 0;
2255                 queue_complete_req(req);
2256                 return sizeof(struct raw1394_request);
2257         }
2258
2259         switch (req->req.type) {
2260         case RAW1394_REQ_PHYPACKET:
2261                 return write_phypacket(fi, req);
2262         case RAW1394_REQ_ASYNC_SEND:
2263                 return handle_async_send(fi, req);
2264         }
2265
2266         if (req->req.length == 0) {
2267                 req->req.error = RAW1394_ERROR_INVALID_ARG;
2268                 queue_complete_req(req);
2269                 return sizeof(struct raw1394_request);
2270         }
2271
2272         return handle_async_request(fi, req, node);
2273 }
2274
2275 static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2276                              size_t count, loff_t * offset_is_ignored)
2277 {
2278         struct file_info *fi = (struct file_info *)file->private_data;
2279         struct pending_request *req;
2280         ssize_t retval = 0;
2281
2282         if (count != sizeof(struct raw1394_request)) {
2283                 return -EINVAL;
2284         }
2285
2286         req = alloc_pending_request();
2287         if (req == NULL) {
2288                 return -ENOMEM;
2289         }
2290         req->file_info = fi;
2291
2292         if (copy_from_user(&req->req, buffer, sizeof(struct raw1394_request))) {
2293                 free_pending_request(req);
2294                 return -EFAULT;
2295         }
2296
2297         switch (fi->state) {
2298         case opened:
2299                 retval = state_opened(fi, req);
2300                 break;
2301
2302         case initialized:
2303                 retval = state_initialized(fi, req);
2304                 break;
2305
2306         case connected:
2307                 retval = state_connected(fi, req);
2308                 break;
2309         }
2310
2311         if (retval < 0) {
2312                 free_pending_request(req);
2313         }
2314
2315         return retval;
2316 }
2317
2318 /* rawiso operations */
2319
2320 /* check if any RAW1394_REQ_RAWISO_ACTIVITY event is already in the
2321  * completion queue (reqlists_lock must be taken) */
2322 static inline int __rawiso_event_in_queue(struct file_info *fi)
2323 {
2324         struct pending_request *req;
2325
2326         list_for_each_entry(req, &fi->req_complete, list)
2327             if (req->req.type == RAW1394_REQ_RAWISO_ACTIVITY)
2328                 return 1;
2329
2330         return 0;
2331 }
2332
2333 /* put a RAWISO_ACTIVITY event in the queue, if one isn't there already */
2334 static void queue_rawiso_event(struct file_info *fi)
2335 {
2336         unsigned long flags;
2337
2338         spin_lock_irqsave(&fi->reqlists_lock, flags);
2339
2340         /* only one ISO activity event may be in the queue */
2341         if (!__rawiso_event_in_queue(fi)) {
2342                 struct pending_request *req =
2343                     __alloc_pending_request(SLAB_ATOMIC);
2344
2345                 if (req) {
2346                         req->file_info = fi;
2347                         req->req.type = RAW1394_REQ_RAWISO_ACTIVITY;
2348                         req->req.generation = get_hpsb_generation(fi->host);
2349                         __queue_complete_req(req);
2350                 } else {
2351                         /* on allocation failure, signal an overflow */
2352                         if (fi->iso_handle) {
2353                                 atomic_inc(&fi->iso_handle->overflows);
2354                         }
2355                 }
2356         }
2357         spin_unlock_irqrestore(&fi->reqlists_lock, flags);
2358 }
2359
2360 static void rawiso_activity_cb(struct hpsb_iso *iso)
2361 {
2362         unsigned long flags;
2363         struct host_info *hi;
2364         struct file_info *fi;
2365
2366         spin_lock_irqsave(&host_info_lock, flags);
2367         hi = find_host_info(iso->host);
2368
2369         if (hi != NULL) {
2370                 list_for_each_entry(fi, &hi->file_info_list, list) {
2371                         if (fi->iso_handle == iso)
2372                                 queue_rawiso_event(fi);
2373                 }
2374         }
2375
2376         spin_unlock_irqrestore(&host_info_lock, flags);
2377 }
2378
2379 /* helper function - gather all the kernel iso status bits for returning to user-space */
2380 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
2381                                     struct raw1394_iso_status *stat)
2382 {
2383         stat->config.data_buf_size = iso->buf_size;
2384         stat->config.buf_packets = iso->buf_packets;
2385         stat->config.channel = iso->channel;
2386         stat->config.speed = iso->speed;
2387         stat->config.irq_interval = iso->irq_interval;
2388         stat->n_packets = hpsb_iso_n_ready(iso);
2389         stat->overflows = atomic_read(&iso->overflows);
2390         stat->xmit_cycle = iso->xmit_cycle;
2391 }
2392
2393 static int raw1394_iso_xmit_init(struct file_info *fi, void __user * uaddr)
2394 {
2395         struct raw1394_iso_status stat;
2396
2397         if (!fi->host)
2398                 return -EINVAL;
2399
2400         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2401                 return -EFAULT;
2402
2403         fi->iso_handle = hpsb_iso_xmit_init(fi->host,
2404                                             stat.config.data_buf_size,
2405                                             stat.config.buf_packets,
2406                                             stat.config.channel,
2407                                             stat.config.speed,
2408                                             stat.config.irq_interval,
2409                                             rawiso_activity_cb);
2410         if (!fi->iso_handle)
2411                 return -ENOMEM;
2412
2413         fi->iso_state = RAW1394_ISO_XMIT;
2414
2415         raw1394_iso_fill_status(fi->iso_handle, &stat);
2416         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2417                 return -EFAULT;
2418
2419         /* queue an event to get things started */
2420         rawiso_activity_cb(fi->iso_handle);
2421
2422         return 0;
2423 }
2424
2425 static int raw1394_iso_recv_init(struct file_info *fi, void __user * uaddr)
2426 {
2427         struct raw1394_iso_status stat;
2428
2429         if (!fi->host)
2430                 return -EINVAL;
2431
2432         if (copy_from_user(&stat, uaddr, sizeof(stat)))
2433                 return -EFAULT;
2434
2435         fi->iso_handle = hpsb_iso_recv_init(fi->host,
2436                                             stat.config.data_buf_size,
2437                                             stat.config.buf_packets,
2438                                             stat.config.channel,
2439                                             stat.config.dma_mode,
2440                                             stat.config.irq_interval,
2441                                             rawiso_activity_cb);
2442         if (!fi->iso_handle)
2443                 return -ENOMEM;
2444
2445         fi->iso_state = RAW1394_ISO_RECV;
2446
2447         raw1394_iso_fill_status(fi->iso_handle, &stat);
2448         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2449                 return -EFAULT;
2450         return 0;
2451 }
2452
2453 static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
2454 {
2455         struct raw1394_iso_status stat;
2456         struct hpsb_iso *iso = fi->iso_handle;
2457
2458         raw1394_iso_fill_status(fi->iso_handle, &stat);
2459         if (copy_to_user(uaddr, &stat, sizeof(stat)))
2460                 return -EFAULT;
2461
2462         /* reset overflow counter */
2463         atomic_set(&iso->overflows, 0);
2464
2465         return 0;
2466 }
2467
2468 /* copy N packet_infos out of the ringbuffer into user-supplied array */
2469 static int raw1394_iso_recv_packets(struct file_info *fi, void __user * uaddr)
2470 {
2471         struct raw1394_iso_packets upackets;
2472         unsigned int packet = fi->iso_handle->first_packet;
2473         int i;
2474
2475         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2476                 return -EFAULT;
2477
2478         if (upackets.n_packets > hpsb_iso_n_ready(fi->iso_handle))
2479                 return -EINVAL;
2480
2481         /* ensure user-supplied buffer is accessible and big enough */
2482         if (!access_ok(VERIFY_WRITE, upackets.infos,
2483                         upackets.n_packets *
2484                         sizeof(struct raw1394_iso_packet_info)))
2485                 return -EFAULT;
2486
2487         /* copy the packet_infos out */
2488         for (i = 0; i < upackets.n_packets; i++) {
2489                 if (__copy_to_user(&upackets.infos[i],
2490                                    &fi->iso_handle->infos[packet],
2491                                    sizeof(struct raw1394_iso_packet_info)))
2492                         return -EFAULT;
2493
2494                 packet = (packet + 1) % fi->iso_handle->buf_packets;
2495         }
2496
2497         return 0;
2498 }
2499
2500 /* copy N packet_infos from user to ringbuffer, and queue them for transmission */
2501 static int raw1394_iso_send_packets(struct file_info *fi, void __user * uaddr)
2502 {
2503         struct raw1394_iso_packets upackets;
2504         int i, rv;
2505
2506         if (copy_from_user(&upackets, uaddr, sizeof(upackets)))
2507                 return -EFAULT;
2508
2509         if (upackets.n_packets >= fi->iso_handle->buf_packets)
2510                 return -EINVAL;
2511
2512         if (upackets.n_packets >= hpsb_iso_n_ready(fi->iso_handle))
2513                 return -EAGAIN;
2514
2515         /* ensure user-supplied buffer is accessible and big enough */
2516         if (!access_ok(VERIFY_READ, upackets.infos,
2517                         upackets.n_packets *
2518                         sizeof(struct raw1394_iso_packet_info)))
2519                 return -EFAULT;
2520
2521         /* copy the infos structs in and queue the packets */
2522         for (i = 0; i < upackets.n_packets; i++) {
2523                 struct raw1394_iso_packet_info info;
2524
2525                 if (__copy_from_user(&info, &upackets.infos[i],
2526                                      sizeof(struct raw1394_iso_packet_info)))
2527                         return -EFAULT;
2528
2529                 rv = hpsb_iso_xmit_queue_packet(fi->iso_handle, info.offset,
2530                                                 info.len, info.tag, info.sy);
2531                 if (rv)
2532                         return rv;
2533         }
2534
2535         return 0;
2536 }
2537
2538 static void raw1394_iso_shutdown(struct file_info *fi)
2539 {
2540         if (fi->iso_handle)
2541                 hpsb_iso_shutdown(fi->iso_handle);
2542
2543         fi->iso_handle = NULL;
2544         fi->iso_state = RAW1394_ISO_INACTIVE;
2545 }
2546
2547 /* mmap the rawiso xmit/recv buffer */
2548 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
2549 {
2550         struct file_info *fi = file->private_data;
2551
2552         if (fi->iso_state == RAW1394_ISO_INACTIVE)
2553                 return -EINVAL;
2554
2555         return dma_region_mmap(&fi->iso_handle->data_buf, file, vma);
2556 }
2557
2558 /* ioctl is only used for rawiso operations */
2559 static int raw1394_ioctl(struct inode *inode, struct file *file,
2560                          unsigned int cmd, unsigned long arg)
2561 {
2562         struct file_info *fi = file->private_data;
2563         void __user *argp = (void __user *)arg;
2564
2565         switch (fi->iso_state) {
2566         case RAW1394_ISO_INACTIVE:
2567                 switch (cmd) {
2568                 case RAW1394_IOC_ISO_XMIT_INIT:
2569                         return raw1394_iso_xmit_init(fi, argp);
2570                 case RAW1394_IOC_ISO_RECV_INIT:
2571                         return raw1394_iso_recv_init(fi, argp);
2572                 default:
2573                         break;
2574                 }
2575                 break;
2576         case RAW1394_ISO_RECV:
2577                 switch (cmd) {
2578                 case RAW1394_IOC_ISO_RECV_START:{
2579                                 /* copy args from user-space */
2580                                 int args[3];
2581                                 if (copy_from_user
2582                                     (&args[0], argp, sizeof(args)))
2583                                         return -EFAULT;
2584                                 return hpsb_iso_recv_start(fi->iso_handle,
2585                                                            args[0], args[1],
2586                                                            args[2]);
2587                         }
2588                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2589                         hpsb_iso_stop(fi->iso_handle);
2590                         return 0;
2591                 case RAW1394_IOC_ISO_RECV_LISTEN_CHANNEL:
2592                         return hpsb_iso_recv_listen_channel(fi->iso_handle,
2593                                                             arg);
2594                 case RAW1394_IOC_ISO_RECV_UNLISTEN_CHANNEL:
2595                         return hpsb_iso_recv_unlisten_channel(fi->iso_handle,
2596                                                               arg);
2597                 case RAW1394_IOC_ISO_RECV_SET_CHANNEL_MASK:{
2598                                 /* copy the u64 from user-space */
2599                                 u64 mask;
2600                                 if (copy_from_user(&mask, argp, sizeof(mask)))
2601                                         return -EFAULT;
2602                                 return hpsb_iso_recv_set_channel_mask(fi->
2603                                                                       iso_handle,
2604                                                                       mask);
2605                         }
2606                 case RAW1394_IOC_ISO_GET_STATUS:
2607                         return raw1394_iso_get_status(fi, argp);
2608                 case RAW1394_IOC_ISO_RECV_PACKETS:
2609                         return raw1394_iso_recv_packets(fi, argp);
2610                 case RAW1394_IOC_ISO_RECV_RELEASE_PACKETS:
2611                         return hpsb_iso_recv_release_packets(fi->iso_handle,
2612                                                              arg);
2613                 case RAW1394_IOC_ISO_RECV_FLUSH:
2614                         return hpsb_iso_recv_flush(fi->iso_handle);
2615                 case RAW1394_IOC_ISO_SHUTDOWN:
2616                         raw1394_iso_shutdown(fi);
2617                         return 0;
2618                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2619                         queue_rawiso_event(fi);
2620                         return 0;
2621                 }
2622                 break;
2623         case RAW1394_ISO_XMIT:
2624                 switch (cmd) {
2625                 case RAW1394_IOC_ISO_XMIT_START:{
2626                                 /* copy two ints from user-space */
2627                                 int args[2];
2628                                 if (copy_from_user
2629                                     (&args[0], argp, sizeof(args)))
2630                                         return -EFAULT;
2631                                 return hpsb_iso_xmit_start(fi->iso_handle,
2632                                                            args[0], args[1]);
2633                         }
2634                 case RAW1394_IOC_ISO_XMIT_SYNC:
2635                         return hpsb_iso_xmit_sync(fi->iso_handle);
2636                 case RAW1394_IOC_ISO_XMIT_RECV_STOP:
2637                         hpsb_iso_stop(fi->iso_handle);
2638                         return 0;
2639                 case RAW1394_IOC_ISO_GET_STATUS:
2640                         return raw1394_iso_get_status(fi, argp);
2641                 case RAW1394_IOC_ISO_XMIT_PACKETS:
2642                         return raw1394_iso_send_packets(fi, argp);
2643                 case RAW1394_IOC_ISO_SHUTDOWN:
2644                         raw1394_iso_shutdown(fi);
2645                         return 0;
2646                 case RAW1394_IOC_ISO_QUEUE_ACTIVITY:
2647                         queue_rawiso_event(fi);
2648                         return 0;
2649                 }
2650                 break;
2651         default:
2652                 break;
2653         }
2654
2655         return -EINVAL;
2656 }
2657
2658 static unsigned int raw1394_poll(struct file *file, poll_table * pt)
2659 {
2660         struct file_info *fi = file->private_data;
2661         unsigned int mask = POLLOUT | POLLWRNORM;
2662
2663         poll_wait(file, &fi->poll_wait_complete, pt);
2664
2665         spin_lock_irq(&fi->reqlists_lock);
2666         if (!list_empty(&fi->req_complete)) {
2667                 mask |= POLLIN | POLLRDNORM;
2668         }
2669         spin_unlock_irq(&fi->reqlists_lock);
2670
2671         return mask;
2672 }
2673
2674 static int raw1394_open(struct inode *inode, struct file *file)
2675 {
2676         struct file_info *fi;
2677
2678         fi = kmalloc(sizeof(struct file_info), SLAB_KERNEL);
2679         if (fi == NULL)
2680                 return -ENOMEM;
2681
2682         memset(fi, 0, sizeof(struct file_info));
2683         fi->notification = (u8) RAW1394_NOTIFY_ON;      /* busreset notification */
2684
2685         INIT_LIST_HEAD(&fi->list);
2686         fi->state = opened;
2687         INIT_LIST_HEAD(&fi->req_pending);
2688         INIT_LIST_HEAD(&fi->req_complete);
2689         sema_init(&fi->complete_sem, 0);
2690         spin_lock_init(&fi->reqlists_lock);
2691         init_waitqueue_head(&fi->poll_wait_complete);
2692         INIT_LIST_HEAD(&fi->addr_list);
2693
2694         file->private_data = fi;
2695
2696         return 0;
2697 }
2698
2699 static int raw1394_release(struct inode *inode, struct file *file)
2700 {
2701         struct file_info *fi = file->private_data;
2702         struct list_head *lh;
2703         struct pending_request *req;
2704         int done = 0, i, fail = 0;
2705         int retval = 0;
2706         struct list_head *entry;
2707         struct arm_addr *addr = NULL;
2708         struct host_info *hi;
2709         struct file_info *fi_hlp = NULL;
2710         struct arm_addr *arm_addr = NULL;
2711         int another_host;
2712         int csr_mod = 0;
2713
2714         if (fi->iso_state != RAW1394_ISO_INACTIVE)
2715                 raw1394_iso_shutdown(fi);
2716
2717         for (i = 0; i < 64; i++) {
2718                 if (fi->listen_channels & (1ULL << i)) {
2719                         hpsb_unlisten_channel(&raw1394_highlevel, fi->host, i);
2720                 }
2721         }
2722
2723         spin_lock_irq(&host_info_lock);
2724         fi->listen_channels = 0;
2725         spin_unlock_irq(&host_info_lock);
2726
2727         fail = 0;
2728         /* set address-entries invalid */
2729         spin_lock_irq(&host_info_lock);
2730
2731         while (!list_empty(&fi->addr_list)) {
2732                 another_host = 0;
2733                 lh = fi->addr_list.next;
2734                 addr = list_entry(lh, struct arm_addr, addr_list);
2735                 /* another host with valid address-entry containing
2736                    same addressrange? */
2737                 list_for_each_entry(hi, &host_info_list, list) {
2738                         if (hi->host != fi->host) {
2739                                 list_for_each_entry(fi_hlp, &hi->file_info_list,
2740                                                     list) {
2741                                         entry = fi_hlp->addr_list.next;
2742                                         while (entry != &(fi_hlp->addr_list)) {
2743                                                 arm_addr = list_entry(entry,
2744                                                                       struct
2745                                                                       arm_addr,
2746                                                                       addr_list);
2747                                                 if (arm_addr->start ==
2748                                                     addr->start) {
2749                                                         DBGMSG
2750                                                             ("raw1394_release: "
2751                                                              "another host ownes "
2752                                                              "same addressrange");
2753                                                         another_host = 1;
2754                                                         break;
2755                                                 }
2756                                                 entry = entry->next;
2757                                         }
2758                                         if (another_host) {
2759                                                 break;
2760                                         }
2761                                 }
2762                         }
2763                 }
2764                 if (!another_host) {
2765                         DBGMSG("raw1394_release: call hpsb_arm_unregister");
2766                         retval =
2767                             hpsb_unregister_addrspace(&raw1394_highlevel,
2768                                                       fi->host, addr->start);
2769                         if (!retval) {
2770                                 ++fail;
2771                                 printk(KERN_ERR
2772                                        "raw1394_release arm_Unregister failed\n");
2773                         }
2774                 }
2775                 DBGMSG("raw1394_release: delete addr_entry from list");
2776                 list_del(&addr->addr_list);
2777                 vfree(addr->addr_space_buffer);
2778                 kfree(addr);
2779         }                       /* while */
2780         spin_unlock_irq(&host_info_lock);
2781         if (fail > 0) {
2782                 printk(KERN_ERR "raw1394: during addr_list-release "
2783                        "error(s) occurred \n");
2784         }
2785
2786         while (!done) {
2787                 spin_lock_irq(&fi->reqlists_lock);
2788
2789                 while (!list_empty(&fi->req_complete)) {
2790                         lh = fi->req_complete.next;
2791                         list_del(lh);
2792
2793                         req = list_entry(lh, struct pending_request, list);
2794
2795                         free_pending_request(req);
2796                 }
2797
2798                 if (list_empty(&fi->req_pending))
2799                         done = 1;
2800
2801                 spin_unlock_irq(&fi->reqlists_lock);
2802
2803                 if (!done)
2804                         down_interruptible(&fi->complete_sem);
2805         }
2806
2807         /* Remove any sub-trees left by user space programs */
2808         for (i = 0; i < RAW1394_MAX_USER_CSR_DIRS; i++) {
2809                 struct csr1212_dentry *dentry;
2810                 if (!fi->csr1212_dirs[i])
2811                         continue;
2812                 for (dentry =
2813                      fi->csr1212_dirs[i]->value.directory.dentries_head; dentry;
2814                      dentry = dentry->next) {
2815                         csr1212_detach_keyval_from_directory(fi->host->csr.rom->
2816                                                              root_kv,
2817                                                              dentry->kv);
2818                 }
2819                 csr1212_release_keyval(fi->csr1212_dirs[i]);
2820                 fi->csr1212_dirs[i] = NULL;
2821                 csr_mod = 1;
2822         }
2823
2824         if ((csr_mod || fi->cfgrom_upd)
2825             && hpsb_update_config_rom_image(fi->host) < 0)
2826                 HPSB_ERR
2827                     ("Failed to generate Configuration ROM image for host %d",
2828                      fi->host->id);
2829
2830         if (fi->state == connected) {
2831                 spin_lock_irq(&host_info_lock);
2832                 list_del(&fi->list);
2833                 spin_unlock_irq(&host_info_lock);
2834
2835                 put_device(&fi->host->device);
2836         }
2837
2838         kfree(fi);
2839
2840         return 0;
2841 }
2842
2843 /*** HOTPLUG STUFF **********************************************************/
2844 /*
2845  * Export information about protocols/devices supported by this driver.
2846  */
2847 static struct ieee1394_device_id raw1394_id_table[] = {
2848         {
2849          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2850          .specifier_id = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
2851          .version = AVC_SW_VERSION_ENTRY & 0xffffff},
2852         {
2853          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2854          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2855          .version = CAMERA_SW_VERSION_ENTRY & 0xffffff},
2856         {
2857          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2858          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2859          .version = (CAMERA_SW_VERSION_ENTRY + 1) & 0xffffff},
2860         {
2861          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
2862          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
2863          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
2864         {}
2865 };
2866
2867 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
2868
2869 static struct hpsb_protocol_driver raw1394_driver = {
2870         .name = "raw1394 Driver",
2871         .id_table = raw1394_id_table,
2872         .driver = {
2873                    .name = "raw1394",
2874                    .bus = &ieee1394_bus_type,
2875                    },
2876 };
2877
2878 /******************************************************************************/
2879
2880 static struct hpsb_highlevel raw1394_highlevel = {
2881         .name = RAW1394_DEVICE_NAME,
2882         .add_host = add_host,
2883         .remove_host = remove_host,
2884         .host_reset = host_reset,
2885         .iso_receive = iso_receive,
2886         .fcp_request = fcp_request,
2887 };
2888
2889 static struct cdev raw1394_cdev;
2890 static struct file_operations raw1394_fops = {
2891         .owner = THIS_MODULE,
2892         .read = raw1394_read,
2893         .write = raw1394_write,
2894         .mmap = raw1394_mmap,
2895         .ioctl = raw1394_ioctl,
2896         .poll = raw1394_poll,
2897         .open = raw1394_open,
2898         .release = raw1394_release,
2899 };
2900
2901 static int __init init_raw1394(void)
2902 {
2903         int ret = 0;
2904
2905         hpsb_register_highlevel(&raw1394_highlevel);
2906
2907         if (IS_ERR(class_device_create(hpsb_protocol_class, MKDEV(
2908                 IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16),
2909                 NULL, RAW1394_DEVICE_NAME))) {
2910                 ret = -EFAULT;
2911                 goto out_unreg;
2912         }
2913
2914         devfs_mk_cdev(MKDEV(
2915                 IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16),
2916                 S_IFCHR | S_IRUSR | S_IWUSR, RAW1394_DEVICE_NAME);
2917
2918         cdev_init(&raw1394_cdev, &raw1394_fops);
2919         raw1394_cdev.owner = THIS_MODULE;
2920         kobject_set_name(&raw1394_cdev.kobj, RAW1394_DEVICE_NAME);
2921         ret = cdev_add(&raw1394_cdev, IEEE1394_RAW1394_DEV, 1);
2922         if (ret) {
2923                 HPSB_ERR("raw1394 failed to register minor device block");
2924                 goto out_dev;
2925         }
2926
2927         HPSB_INFO("raw1394: /dev/%s device initialized", RAW1394_DEVICE_NAME);
2928
2929         ret = hpsb_register_protocol(&raw1394_driver);
2930         if (ret) {
2931                 HPSB_ERR("raw1394: failed to register protocol");
2932                 cdev_del(&raw1394_cdev);
2933                 goto out_dev;
2934         }
2935
2936         goto out;
2937
2938 out_dev:
2939         devfs_remove(RAW1394_DEVICE_NAME);
2940         class_device_destroy(hpsb_protocol_class,
2941                 MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16));
2942 out_unreg:
2943         hpsb_unregister_highlevel(&raw1394_highlevel);
2944 out:
2945         return ret;
2946 }
2947
2948 static void __exit cleanup_raw1394(void)
2949 {
2950         class_device_destroy(hpsb_protocol_class,
2951                 MKDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16));
2952         cdev_del(&raw1394_cdev);
2953         devfs_remove(RAW1394_DEVICE_NAME);
2954         hpsb_unregister_highlevel(&raw1394_highlevel);
2955         hpsb_unregister_protocol(&raw1394_driver);
2956 }
2957
2958 module_init(init_raw1394);
2959 module_exit(cleanup_raw1394);
2960 MODULE_LICENSE("GPL");