GIT c57719f330ec71ba80ada53ada19ba23820eac5d git+ssh://master.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git

commit 
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Feb 10 23:57:57 2007 +0100

    ieee1394: eth1394: clean up host removal
    
    ether1394_add_host() guarantees that hi->dev != NULL if hi != NULL.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit a2a474ce8199fea536b8361e31098ef37070e887
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Feb 10 23:56:38 2007 +0100

    ieee1394: eth1394: unregister address space in failure case
    
    Warn if hpsb_allocate_and_register_addrspace() failed.
    Unregister the address space if something else failed.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 94a6c285bad2d4fea6bc7ee127c036e4954af20f
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Feb 10 22:07:38 2007 +0100

    ieee1394: deserialize nodemgr between several hosts
    
    We can let multiple knodemgrd threads run concurrently since there is
    other lock protection in place for data shared across hosts, in
    particular the rwsems which are used to protect driver core data.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 1e403c1f01e33a310b497cdb79ddabfdd09301c0
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Feb 10 22:06:18 2007 +0100

    ieee1394: fix another deadlock in nodemgr
    
    A "modprobe ohci1394; sleep 1.5; modprobe -r ohci1394" could get stuck
    in uninterruptible state, especially if an external node was connected.
    http://bugzilla.kernel.org/show_bug.cgi?id=7792
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit b221cdece82fd91617fc92d3313f003ea36f12e4
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Mon Feb 12 20:39:42 2007 +0100

    ieee1394: raw1394: bump userspace API version
    
    for iso cycle timer read extension
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 162a56dd10952c13b193a26a94907de9acfc7137
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Feb 11 15:54:12 2007 +0100

    ieee1394: raw1394: remove underscore from a struct name
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 5468ee91741092a711327628c7c524a4d4d0cd6a
Author: Pieter Palmers <pieterp@joow.be>
Date:   Sat Feb 3 17:44:39 2007 +0100

    ieee1394: cycle timer read extension for raw1394
    
    This implements the simultaneous read of the isochronous cycle timer and
    the system clock (in usecs).  This allows to express the exact receive
    time of an ISO packet as a system time with microsecond accuracy.
    http://bugzilla.kernel.org/show_bug.cgi?id=7773
    
    The counterpart patch for libraw1394 can be found at
    http://thread.gmane.org/gmane.linux.kernel.firewire.devel/8934
    
    Patch update (Stefan R.):
      - Disable preemption and local interrupts.
      - Fix integer overflow.
      - Add paranoid error checks and kerneldoc to hpsb_read_cycle_timer.
        Move it to other ieee1394_core high-level API functions.
      - Change comments.  Adjust whitespace.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit c85bd3015d6e2e54585b3b10040588b71fd3b3fd
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:40 2007 -0500

    Use dma_mapping_error() for checking for DMA mapping errors.
    
    Pointed out by Pete Zaitcev.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 268885b129b9d8fd329015900d07bcccec0a98c3
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:39 2007 -0500

    Credit the old sbp2.c driver for being a good starting point.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit c47a3d62364460d58e37c8ad9d336d84bece85be
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:38 2007 -0500

    Use atomic_t's for serial numbers.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    
    Use atomic_inc_return.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 806358415e6869292549ecc35b0a6175e9fb73ee
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:37 2007 -0500

    Spell out fw as firewire in sysfs.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit b41ad18a31f13046c3972cb364af4683bd93b785
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:36 2007 -0500

    Complete SCSI commands with DID_BUS_BUSY when a bus reset happens.
    
    This lets the SCSI stack retry the command when a SCSI command is
    interrupted by a FireWire bus reset.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 9d8a7e8bc337a473ea786e1481229ba6854ae77d
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:35 2007 -0500

    Schedule topology work before calling driver update functions.
    
    This prevents superfluous bus traffic as fw-sbp2 logs in only to
    get kicked off the device by another bus reset as the driver core
    does bus management.  Scheduling it this way lets the driver core
    finish bus management before higher level drivers get the update
    callback.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 6c5d18b14b7de3b50077d97ae8eb8ba2ff006cda
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:34 2007 -0500

    Introduce a retry mechanism for reconnects and logins.
    
    Sometimes we reconnect too soon, sometimes too late.  Adding a retry
    mechanism make the reconnect step much more robust.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 2e015837b2893191fd4fec96d451b89f8cc03212
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:33 2007 -0500

    fw-sbp2: Do ORB timeout right.
    
    When a management ORB times out, either because the fw_transaction
    times out or when we don't get the status write, we need to properly
    cancel the entire operation.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit cc21798b39860a12a7a91114dddc6548e0d89153
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:32 2007 -0500

    Implement proper transaction cancelation.
    
    Drivers such as fw-sbp2 had no way to properly cancel in-progress
    transactions, which could leave a pending transaction or an unset
    packet in the low-level queues after kfree'ing the containing
    structure. fw_cancel_transaction() lets drivers cancel a submitted
    transaction.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 63e80781ecee6cfa0a138312eeec4f25ffcd628c
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:31 2007 -0500

    Reduce some redundant register definitions.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 06b1d729a571be8cd50d6668d5805f8060edd7d2
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Feb 6 14:49:30 2007 -0500

    Rework async receive DMA.
    
    The old DMA program for receiving async packets stops DMA while
    processing received packets and only expects one packet per
    interrupt.  Stopping DMA can silently drop packets and we need to
    handle multiple received packets per interrupt.
    
    This new version keeps DMA running at all times and just append new
    pages as buffers fill up, and supports multiple packets per interrupt.
    
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit fcfbcd4343e546d92716ef98527f80dd341883c9
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Tue Feb 6 02:34:45 2007 +0100

    ieee1394: fix host device registering when nodemgr disabled
    
    Since my commit 8252bbb1363b7fe963a3eb6f8a36da619a6f5a65 in 2.6.20-rc1,
    host devices have a dummy driver attached.  Alas the driver was not
    registered before use if ieee1394 was loaded with disable_nodemgr=1.
    http://bugzilla.kernel.org/show_bug.cgi?id=7942
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 46e9e59185d643f13cfb1dc6a990e1bfece5a24c
Author: David Moore <dcm@acm.org>
Date:   Sat Feb 3 03:09:09 2007 -0500

    ieee1394: video1394: DMA fix
    
    This together with the phys_to_virt fix in lib/swiotlb.c::swiotlb_sync_sg
    fixes video1394 DMA on machines with DMA bounce buffers, especially Intel
    x86-64 machines with > 3GB RAM.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: David Moore <dcm@acm.org>
    Tested-by: Nicolas Turro <Nicolas.Turro@inrialpes.fr>

commit a5f979286db3e34c60423852016dce3195f03d33
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Feb 4 20:57:38 2007 +0100

    ieee1394: sbp2: move some memory allocations into non-atomic context
    
    When the command ORB pool is created, the ORB list won't be accessed
    concurrently.  Therefore we don't have to take the spinlock there.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 2ddd89851611d5b4615f19441f82f4f1b589c9b2
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Feb 4 20:54:57 2007 +0100

    ieee1394: sbp2: optimize DMA direction of s/g tables
    
    Unlike the name suggests, "cmd->scatter_gather_element" holds only the
    s/g table, not the actual s/g elements.  Since the table is only read
    but never written by the device, DMA_BIDIRECTIONAL can be replaced by
    DMA_TO_DEVICE which may be cheaper on some architectures.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit d7a2adac01681bcc05b8e5aed6eda708fdb3270b
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Feb 4 20:25:43 2007 +0100

    ieee1394: sbp2: enforce 32bit DMA mapping
    
    In order to use OHCI-1394 physical DMA, all s/g elements, s/g tables,
    ORBs, and response buffers have to reside within the first 4 GB of the
    FireWire controller's physical address space.  Set the correct mask for
    DMA mappings.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 64cdff55ed5a44422985cc7e0c4937405301991d
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Feb 4 13:04:32 2007 +0100

    ieee1394: sbp2: remove unnecessary alignments of struct members
    
    The members "dma_addr_t command_orb_dma" and "dma_addr_t sge_dma" of
    sbp2.h::sbp2_command_info do not have to be aligned themselves --- only
    the memory which they point to has to be.
    
    The member "struct sbp2_command_orb command_orb" has to be aligned on
    4 bytes boundary which is guaranteed because it contains u32 members.
    
    The member "struct sbp2_unrestricted_page_table scatter_gather_element",
    i.e. the SBP-2 s/g table, has to be aligned on 8 bytes boundary
    according to the SBP-2 spec.  This is not a requirement for FireWire
    controllers but could be expected by SBP-2 targets.
    
    I see no need to align the members command_orb and
    scatter_gather_element on CPU cacheline boundaries.  It could have
    performance benefits, but on the other hand sbp2 has a somewhat wasteful
    allocation scheme which should be optimized first before further tweaks
    like cacheline alignments.  (E.g. don't always allocate SG_ALL s/g table
    elements.)
    
    Note, before as well as after the patch, the code relies on the
    assumption that memory alignment in the virtual address space is
    preserved in the physical address space after DMA mapping.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 46d2069a3fc6dcca5928e2094dc5a7479836cd02
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Feb 3 16:48:51 2007 +0100

    ieee1394: raw1394: prevent unloading of low-level driver
    
    Unloading the low-level driver module of a FireWire host can lead to
    all sorts of trouble if a raw1394 userspace client is using the host.
    Just disallow it by incrementing the LLD's module reference count on
    a RAW1394_REQ_SET_CARD write operation.  Decrement it when the file
    is closed.
    
    This feature wouldn't be relevant if "modprobe -r video1394" or
    "modprobe -r dv1394" didn't automatically unload ohci1394 too.
    http://bugzilla.kernel.org/show_bug.cgi?id=7701
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Dan Dennedy <dan@dennedy.org>

commit 2680c78afc8f0e73920af167fd5d34b669d812c5
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Jan 27 13:54:23 2007 +0100

    ieee1394: dv1394: tidy up card removal
    
    small coding style touch-up and terser coding
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit ce9dd8a20b238d7ab6dc2d0727cb4cd4f9c6d495
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Jan 27 13:52:52 2007 +0100

    ieee1394: dv1394: fix CardBus card ejection
    
    Fix NULL pointer dereference on hot ejection of a FireWire card while
    dv1394 was loaded.  http://bugzilla.kernel.org/show_bug.cgi?id=7121
    I did not test card ejection with open /dev/dv1394 files yet.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 20501596238d3d7a2d490af82f8e0eb009704385
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Jan 27 16:59:15 2007 +0100

    firewire: fix compilation with gcc 3.4
    
    drivers/firewire/fw-topology.c: In function `report_found_node':
    drivers/firewire/fw-topology.c:345: error: `typeof' applied to a bit-field
    drivers/firewire/fw-topology.c:345: error: `typeof' applied to a bit-field
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit d392a8a3ee0a0ff05b8c4b308730e48fae35faeb
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Jan 27 10:34:55 2007 +0100

    firewire: use atomic type for fw_device.state
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 49141de922a0090279baee4b293ae27b92b6a976
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Tue Jan 23 21:20:08 2007 +0100

    firewire: fw-sbp2: set command set related device flags
    
    Copied from sbp2:
      - enable spin-up by START STOP UNIT for all devices
      - enable INQUIRY (36) workaround on demand
      - prefer READ/ WRITE (10) over (6) for all devices
      - prefer MODE SENSE (10) for MMC devices
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 5910e36828c1fd4561d8f8ffaf4b76fdf7bde880
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:49 2007 -0500

    Make sure we wait for DMA to stop before we reprogram it.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 400a0fc0340c97e754d9848900c48560528ae3cf
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:45 2007 -0500

    Implement compliant bus management.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 671ee732c4bd6dd2e461299f09e943295f93db3c
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:38 2007 -0500

    Fix bit shift typo.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit aa62dfd3680ef653fa80dadad6bb50203844e725
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:34 2007 -0500

    Sanitize send error codes.
    
    Drop the negative errnos and use RCODEs for all error codes
    in the complete transaction callback.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 4482637792c2b4d41629035fde5172def53be73b
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:26 2007 -0500

    Handle access to CSR resources on local node.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 0d07fdc4f033fc539fe4427dd88f1393a0b7de21
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:18 2007 -0500

    Add lock transaction opcodes to fw-device-cdev.h.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit db932da61cb869389cc6e5e2878b14ead76f9385
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:13 2007 -0500

    Clean up response handling.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit d056d380a04a96368e97c2b3296fb0366de8e9a5
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:38:04 2007 -0500

    Loop requests to the host controller back into the stack.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 7d65248266e535632ae742be6dce0fb29ffa31cc
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:37:57 2007 -0500

    Use struct fw_packet for incoming packets too in controller interface.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 20b5afb3883ede95cc60c6f52cb97d5e76f9be19
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Fri Jan 26 00:37:50 2007 -0500

    Implement gap count optimization.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit ff4754ed71363750f90c9044ea0f1bfaac62c9e5
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Thu Jan 25 22:35:47 2007 +0100

    ieee1394: sbp2: lower block queue alignment requirement
    
    The old setting is copy & waste from usb-storage and doesn't apply to
    sbp2.  There is only 4-byte alignment required for everything, except
    for S/G table elements which have to be 8-byte aligned according to the
    SBP-2 spec.  (They happen to be ____cacheline_aligned in our
    implementation.  Whether that's good is another question.)
    
    We now simply don't tune block queue alignment at all.  The default
    alignment would surely never become anything else than a multiple of 4,
    else tons of calls to blk_queue_dma_alignment would have to be added
    everywhere in drivers/...
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit fe6440a38dfed0ca084dfe5e6e7160d59737719d
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Tue Jan 23 21:11:43 2007 +0100

    firewire: consistent usage of node_id
    
    Definitions as per IEEE 1212 and IEEE 1394:
    
         Node ID: Concatenation of bus ID and local ID. 16 bits long.
          Bus ID: Identifies a particular bus within a group of buses
                  interconnected by bus bridges.
        Local ID: Identifies a particular node on a bus.
          PHY ID: Local ID of IEEE 1394 nodes. 6 bits long.
    
    Never ever use a variable called node_id for anything else than a node ID.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit dd76107832eb38ad1e6abbbb3ae152945bda6bf2
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Tue Jan 23 21:09:23 2007 +0100

    firewire: fw-ohci: remove unnecessary macro
    
    Cleans up after patch "Add PCI class ID for firewire OHCI controllers".
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>

commit 2799fe14c79da285e30a0d435dba5c09007026d2
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 21 20:50:11 2007 +0100

    firewire: fw-sbp2: remove unused macro
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>

commit a085eb93664492988cf6ebd1bc5bd93617ac2448
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 21 20:49:38 2007 +0100

    firewire: fw-sbp2: remove bogus "emulated" host flag
    
    There is no emulation going on here too.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>

commit 6e5fef8066117adf5757d515e5834f48304ef315
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 21 20:46:45 2007 +0100

    firewire: fix failure path in ohci_enable_phys_dma
    
    "goto out" happens with the lock taken.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>

commit 5a69f8a27715a56c3fc61080e9fa612c96ce95c3
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 21 20:45:32 2007 +0100

    firewire: comma after last enum item or initializer
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>

commit ba6398427b777cbc7b6635008f5128eed056bd00
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 21 20:44:09 2007 +0100

    firewire: whitespace adjustments
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>

commit 82279ff73f730ea6183ecd993327a588accab88f
Author: Adrian Bunk <bunk@stusta.de>
Date:   Mon Jan 22 19:17:37 2007 +0100

    drivers/firewire/: cleanups
    
    This patch contains the following cleanups:
    - "extern inline" -> "static inline"
    - fw-topology.c: make struct fw_node_create static
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    Signed-off-by: Kristian Høgsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 12434a56c657b0bfacae769076f499ad6538a98a
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 14 15:29:07 2007 +0100

    firewire: mark some structs const
    
    Instances of struct file_operations and struct fw_card_driver can be
    qualified as "const".  Ditto with struct fw_descriptor.data, struct
    fw_device_id, and predefined instances of struct fw_address_region,
    at least in the current implementation.
    
    Data qualified as const is placed into the .rodata section which won't
    be mixed with dirty data.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 64fa177093706ef32878a7b338c4f3ba353d6762
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 7 22:33:59 2007 +0100

    firewire: additional help in Kconfig
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 97727a0ded217d5b33f5fa0fe553e94417eac267
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Dec 31 17:20:20 2006 +0100

    firewire: put old and new stack into same Kconfig submenu
    
    Screenshot from "make menuconfig":
    ...
      ?????????????????????? IEEE 1394 (FireWire) support ???????????????????????
      ?  Arrow keys navigate the menu.  <Enter> selects submenus --->.          ?
    ...
      ? ??????????????????????????????????????????????????????????????????????? ?
      ? ?    <M> IEEE 1394 (FireWire) support (JUJU alternative stack, experim? ?
      ? ?    <M>   Support for OHCI firewire host controllers                 ? ?
      ? ?    <M>   Support for storage devices (SBP-2 protocol driver)        ? ?
      ? ?    <M> IEEE 1394 (FireWire) support                                 ? ?
      ? ?    ---   Subsystem Options                                          ? ?
      ? ?    [ ]   Excessive debugging output                                 ? ?
    ...
      ?                    <Select>    < Exit >    < Help >                     ?
      ???????????????????????????????????????????????????????????????????????????
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 001cbe684b36f05734bb69f7903a5f626a93f9b8
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Thu Dec 28 16:20:00 2006 +0100

    firewire: consistent ifndef blocks in header files
    
    Replace __fw_core_h by __fw_transaction_h to match the file name.
    Add comments to the final #endif in header files.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 6a2fff17843cbfd3f915a859557c94fbd647d635
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Thu Jan 4 18:35:00 2007 +0100

    firewire: typo in Kconfig
    
    Correct a typo.  Also spell FireWire consistently.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit c0799c12f9079bb77d5e685e6e5cc5f0e7495787
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Thu Dec 28 16:20:00 2006 +0100

    firewire: mark fw-core as experimental
    
    The new stack is not yet stable WRT functionality and APIs.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit bb03f845a4dde333061bba91cbf59c0626caac67
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 14 19:40:41 2007 +0100

    ieee1394: sbp2: remove bogus "emulated" host flag
    
    There is no emulation going on here.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit a252c5f6db9beb11ef951d94c1d0df71adc6158a
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 7 21:51:48 2007 +0100

    ieee1394: save one word in struct hpsb_host
    
    hpsb_host.config_roms is a bitfield of which only one bit is currently
    used.  hpsb_host.update_config_rom is only a Boolean.  Neither one is
    accessed in hot code paths or with alignment requirements.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 3d6bab9116345b015e6ccc1415ffe9251fad1f78
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 7 21:49:27 2007 +0100

    ieee1394: restore config ROM when resuming
    
    After PM suspend + resume, the local configuration ROM was not restored.
    This prevented remote nodes from recognizing the resuming machine.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit e22780affd79ffd280360d759f79695afbfc31ac
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Jan 6 15:07:05 2007 +0100

    ieee1394: ohci1394: drop pcmcia-cs compatibility code
    
    #ifdef PCMCIA is only true if compiled inside pcmcia-cs, isn't it?
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit e1e1fbe85b3df3298e15539e3964ed407a8e8556
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Wed Jan 3 19:32:13 2007 +0100

    ieee1394: nodemgr: check info_length in ROM header earlier
    
    The whole ROM area which is covered by the crc_length field of the ROM
    header was fetched before the info_length field was checked for correct
    general ROM format.  This might be wasteful or even dangerous with nodes
    with minimal ROM, nonstandard ROM, or corrupt ROM.
    
    Perform this check at the earliest opportunity.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 064884db39ab08e77514ba8caeef8377284ec3d9
Author: Adrian Bunk <bunk@stusta.de>
Date:   Tue Jan 2 22:56:53 2007 +0100

    the scheduled IEEE1394_OUI_DB removal
    
    This patch contains the scheduled IEEE1394_OUI_DB removal.
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    
    Update: Also remove drivers/ieee1394/.gitignore.
    Remove now unused struct members in drivers/ieee1394/nodemgr.h.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 35568522fdd275ae15cd7d4babc2a193a50b27a8
Author: Adrian Bunk <bunk@stusta.de>
Date:   Tue Jan 2 22:56:57 2007 +0100

    the scheduled IEEE1394_EXPORT_FULL_API removal
    
    This patch contains the scheduled IEEE1394_EXPORT_FULL_API removal.
    
    Signed-off-by: Adrian Bunk <bunk@stusta.de>
    
    Update: Pull proper portion of feature-removal-schedule.txt.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 0b78bdf2809b0712a6df46c780cf395a89f877b7
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Dec 30 15:37:09 2006 +0100

    ieee1394: sbp2: use a better wildcard for blacklist
    
    0x000000 could be a valid value to match against, but anything bigger
    than 0xffffff cannot.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 626f46af3d0efe3e1ea73d0240c1c1b45cf2b582
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Thu Dec 28 12:46:54 2006 +0100

    firewire: build fix 3
    
    drivers/firewire/fw-sbp2.c: At top level:
    drivers/firewire/fw-sbp2.c:1060: error: storage size of '__mod_ieee1394_device_table' isn't known
    (error pointed out by akpm)
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit fa7afb4f2d2676317410c6378f66c5f0270d308e
Author: Andrew Morton <akpm@osdl.org>
Date:   Wed Dec 27 14:49:23 2006 -0800

    firewire: build fix 2
    
    ia64:
    
    drivers/firewire/fw-sbp2.c: In function `sbp2_command_orb_map_scatterlist':
    drivers/firewire/fw-sbp2.c:826: warning: implicit declaration of function `sg_dma_len'
    drivers/firewire/fw-sbp2.c:828: warning: implicit declaration of function `sg_dma_address'
    drivers/firewire/fw-sbp2.c:837: error: invalid use of undefined type `struct scatterlist'
    drivers/firewire/fw-sbp2.c:838: error: invalid use of undefined type `struct scatterlist'
    
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit c776c601ace0036d0b638460b0afe16746d753e6
Author: Andrew Morton <akpm@osdl.org>
Date:   Wed Dec 27 14:36:37 2006 -0800

    firewire: build fix
    
    alpha:
    
    drivers/firewire/fw-ohci.c: In function 'ar_context_tasklet':
    drivers/firewire/fw-ohci.c:266: warning: implicit declaration of function 'dma_sync_single_for_device'
    drivers/firewire/fw-ohci.c:267: error: 'DMA_TO_DEVICE' undeclared (first use in this function)
    drivers/firewire/fw-ohci.c:267: error: (Each undeclared identifier is reported only once
    drivers/firewire/fw-ohci.c:267: error: for each function it appears in.)
    drivers/firewire/fw-ohci.c: In function 'ar_context_init':
    drivers/firewire/fw-ohci.c:282: warning: implicit declaration of function 'dma_map_single'
    drivers/firewire/fw-ohci.c:283: error: 'DMA_TO_DEVICE' undeclared (first use in this function)
    drivers/firewire/fw-ohci.c:293: error: 'DMA_FROM_DEVICE' undeclared (first use in this function)
    etc.
    
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 49eb8fd76ce9eb1045914db124985385811b2363
Author: Andrew Morton <akpm@osdl.org>
Date:   Wed Dec 27 13:51:57 2006 -0800

    firewire: printk warning fix
    
    drivers/firewire/fw-ohci.c: In function 'ar_context_init':
    drivers/firewire/fw-ohci.c:288: warning: format '%08x' expects type 'unsigned int', but argument 2 has type 'dma_addr_t'
    
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 8fac912c25f213bf09887460a48912b5dfa43e55
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Dec 19 19:58:40 2006 -0500

    firewire: Add SBP-2 protocol driver for storage devices.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 8cd83a79fc101828d0b187bf1285bd1ba9c2d467
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Dec 19 19:58:35 2006 -0500

    firewire: Add driver for OHCI firewire host controllers.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 50120e2fe705021f05ca48c3c63be2c6b4ff075a
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Dec 19 19:58:31 2006 -0500

    firewire: Add device probing and sysfs integration.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit 0ec7898ec9c2f67a8078be79493fa30c9d68e17a
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Tue Dec 19 19:58:27 2006 -0500

    firewire: Add core firewire stack.
    
    Signed-off-by: Kristian Hoegsberg <krh@redhat.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit c5094dfac99e2e8c9334847139bcc9b3ebdfcfe0
Author: Kristian Høgsberg <krh@redhat.com>
Date:   Sun Dec 17 14:34:09 2006 -0500

    Add PCI class ID for firewire OHCI controllers.
    
    Pull this define out of drivers/ieee1394/ohci1394.c and rename to match
    other PCI class defines.
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

commit ad8cdf07ce6bdf95b8103be579c519ee0eb7f62c
Author: Andrea Guzzo <xant@dyne.org>
Date:   Fri Dec 8 00:53:24 2006 +0100

    ieee1394: modified csr1212_key_id_type_map to support lisight
    
    This patch applies a little change in csr1212.c to fix iSight (firewire
    digital camera) related issues (but maybe other firewire devices could
    also need such modification)
    The actual implementation of the "csr1212_key_id_type_map" table doesn't
    support some node types used by the iSight for the audio unit. This
    limit makes the csr scanning routine to never see the audio unit node ,
    and consequently the iSight driver probe() routine to be never called
    and there is no way to hook an isight device when it is inserted.
    
    Signed-off-by: Andrea Guzzo <xant@xant.net>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
 drivers/Makefile                  |    1 
 drivers/firewire/Kconfig          |   60 +
 drivers/firewire/Makefile         |   10 
 drivers/firewire/fw-card.c        |  547 ++++++++++++
 drivers/firewire/fw-device-cdev.c |  617 ++++++++++++++
 drivers/firewire/fw-device-cdev.h |  154 ++++
 drivers/firewire/fw-device.c      |  606 ++++++++++++++
 drivers/firewire/fw-device.h      |  128 +++
 drivers/firewire/fw-iso.c         |  142 +++
 drivers/firewire/fw-ohci.c        | 1622 +++++++++++++++++++++++++++++++++++++
 drivers/firewire/fw-ohci.h        |  152 +++
 drivers/firewire/fw-sbp2.c        | 1164 +++++++++++++++++++++++++++
 drivers/firewire/fw-topology.c    |  504 +++++++++++
 drivers/firewire/fw-topology.h    |   91 ++
 drivers/firewire/fw-transaction.c |  763 +++++++++++++++++
 drivers/firewire/fw-transaction.h |  463 +++++++++++
 drivers/ieee1394/Kconfig          |    2 
 drivers/ieee1394/eth1394.c        |   40 -
 drivers/ieee1394/ieee1394-ioctl.h |    2 
 drivers/ieee1394/ieee1394_core.c  |   43 +
 drivers/ieee1394/ieee1394_core.h  |    3 
 drivers/ieee1394/nodemgr.c        |   24 -
 drivers/ieee1394/raw1394.c        |   20 
 drivers/ieee1394/raw1394.h        |   12 
 drivers/ieee1394/sbp2.c           |   37 -
 drivers/ieee1394/sbp2.h           |    8 
 26 files changed, 7145 insertions(+), 70 deletions(-)

diff --git a/drivers/Makefile b/drivers/Makefile
index 3a718f5..57d92da 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -36,6 +36,7 @@ obj-$(CONFIG_FC4)		+= fc4/
 obj-$(CONFIG_SCSI)		+= scsi/
 obj-$(CONFIG_ATA)		+= ata/
 obj-$(CONFIG_FUSION)		+= message/
+obj-$(CONFIG_FW)		+= firewire/
 obj-$(CONFIG_IEEE1394)		+= ieee1394/
 obj-y				+= cdrom/
 obj-y				+= auxdisplay/
diff --git a/drivers/firewire/Kconfig b/drivers/firewire/Kconfig
new file mode 100644
index 0000000..5c46e25
--- /dev/null
+++ b/drivers/firewire/Kconfig
@@ -0,0 +1,60 @@
+# -*- shell-script -*-
+
+comment "An alternative FireWire stack is available with EXPERIMENTAL=y"
+	depends on EXPERIMENTAL=n
+
+config FW
+	tristate "IEEE 1394 (FireWire) support (JUJU alternative stack, experimental)"
+	depends on EXPERIMENTAL
+	help
+	  IEEE 1394 describes a high performance serial bus, which is also
+	  known as FireWire(tm) or i.Link(tm) and is used for connecting all
+	  sorts of devices (most notably digital video cameras) to your
+	  computer.
+
+	  If you have FireWire hardware and want to use it, say Y here.  This
+	  is the core support only, you will also need to select a driver for
+	  your IEEE 1394 adapter.
+
+	  To compile this driver as a module, say M here: the module will be
+	  called fw-core.
+
+	  This is the "JUJU" FireWire stack, an alternative implementation
+	  designed for robustness and simplicity.  You can build either this
+	  stack, or the classic stack (the ieee1394 driver, ohci1394 etc.)
+	  or both.
+
+config FW_OHCI
+	tristate "Support for OHCI FireWire host controllers"
+	depends on PCI && FW
+	help
+	  Enable this driver if you have a FireWire controller based
+	  on the OHCI specification.  For all practical purposes, this
+	  is the only chipset in use, so say Y here.
+
+	  To compile this driver as a module, say M here:  The module will be
+	  called fw-ohci.
+
+	  If you also build ohci1394 of the classic IEEE 1394 driver stack,
+	  blacklist either ohci1394 or fw-ohci to let hotplug load the desired
+	  driver.
+
+config FW_SBP2
+	tristate "Support for storage devices (SBP-2 protocol driver)"
+	depends on FW && SCSI
+	help
+	  This option enables you to use SBP-2 devices connected to a
+	  FireWire bus.  SBP-2 devices include storage devices like
+	  harddisks and DVD drives, also some other FireWire devices
+	  like scanners.
+
+	  To compile this driver as a module, say M here:  The module will be
+	  called fw-sbp2.
+
+	  You should also enable support for disks, CD-ROMs, etc. in the SCSI
+	  configuration section.
+
+	  If you also build sbp2 of the classic IEEE 1394 driver stack,
+	  blacklist either sbp2 or fw-sbp2 to let hotplug load the desired
+	  driver.
+
diff --git a/drivers/firewire/Makefile b/drivers/firewire/Makefile
new file mode 100644
index 0000000..b955c99
--- /dev/null
+++ b/drivers/firewire/Makefile
@@ -0,0 +1,10 @@
+#
+# Makefile for the Linux IEEE 1394 implementation
+#
+
+fw-core-objs := fw-card.o fw-topology.o fw-transaction.o fw-iso.o \
+	fw-device.o fw-device-cdev.o
+
+obj-$(CONFIG_FW) += fw-core.o
+obj-$(CONFIG_FW_OHCI) += fw-ohci.o
+obj-$(CONFIG_FW_SBP2) += fw-sbp2.o
\ No newline at end of file
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
new file mode 100644
index 0000000..3f8661a
--- /dev/null
+++ b/drivers/firewire/fw-card.c
@@ -0,0 +1,547 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-card.c - card level functions
+ *
+ * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/device.h>
+#include "fw-transaction.h"
+#include "fw-topology.h"
+#include "fw-device.h"
+
+/* The lib/crc16.c implementation uses the standard (0x8005)
+ * polynomial, but we need the ITU-T (or CCITT) polynomial (0x1021).
+ * The implementation below works on an array of host-endian u32
+ * words, assuming they'll be transmited msb first. */
+static u16
+crc16_itu_t(const u32 *buffer, size_t length)
+{
+	int shift, i;
+	u32 data;
+	u16 sum, crc = 0;
+
+	for (i = 0; i < length; i++) {
+		data = *buffer++;
+		for (shift = 28; shift >= 0; shift -= 4 ) {
+			sum = ((crc >> 12) ^ (data >> shift)) & 0xf;
+			crc = (crc << 4) ^ (sum << 12) ^ (sum << 5) ^ (sum);
+		}
+		crc &= 0xffff;
+	}
+
+	return crc;
+}
+
+static LIST_HEAD(card_list);
+
+static LIST_HEAD(descriptor_list);
+static int descriptor_count;
+
+#define bib_crc(v)		((v) <<  0)
+#define bib_crc_length(v)	((v) << 16)
+#define bib_info_length(v)	((v) << 24)
+
+#define bib_link_speed(v)	((v) <<  0)
+#define bib_generation(v)	((v) <<  4)
+#define bib_max_rom(v)		((v) <<  8)
+#define bib_max_receive(v)	((v) << 12)
+#define bib_cyc_clk_acc(v)	((v) << 16)
+#define bib_pmc			((1) << 27)
+#define bib_bmc			((1) << 28)
+#define bib_isc			((1) << 29)
+#define bib_cmc			((1) << 30)
+#define bib_imc			((1) << 31)
+
+static u32 *
+generate_config_rom (struct fw_card *card, size_t *config_rom_length)
+{
+	struct fw_descriptor *desc;
+	static u32 config_rom[256];
+	int i, j, length;
+
+	/* Initialize contents of config rom buffer.  On the OHCI
+	 * controller, block reads to the config rom accesses the host
+	 * memory, but quadlet read access the hardware bus info block
+	 * registers.  That's just crack, but it means we should make
+	 * sure the contents of bus info block in host memory mathces
+	 * the version stored in the OHCI registers. */
+
+	memset(config_rom, 0, sizeof config_rom);
+	config_rom[0] = bib_crc_length(4) | bib_info_length(4) | bib_crc(0);
+	config_rom[1] = 0x31333934;
+
+	config_rom[2] =
+		bib_link_speed(card->link_speed) |
+		bib_generation(card->config_rom_generation++ % 14 + 2) |
+		bib_max_rom(2) |
+		bib_max_receive(card->max_receive) |
+		bib_bmc | bib_isc | bib_cmc | bib_imc;
+	config_rom[3] = card->guid >> 32;
+	config_rom[4] = card->guid;
+
+	/* Generate root directory. */
+	i = 5;
+	config_rom[i++] = 0;
+	config_rom[i++] = 0x0c0083c0; /* node capabilities */
+	config_rom[i++] = 0x03d00d1e; /* vendor id */
+	j = i + descriptor_count;
+
+	/* Generate root directory entries for descriptors. */
+	list_for_each_entry (desc, &descriptor_list, link) {
+		config_rom[i] = desc->key | (j - i);
+		i++;
+		j += desc->length;
+	}
+
+	/* Update root directory length. */
+	config_rom[5] = (i - 5 - 1) << 16;
+
+	/* End of root directory, now copy in descriptors. */
+	list_for_each_entry (desc, &descriptor_list, link) {
+		memcpy(&config_rom[i], desc->data, desc->length * 4);
+		i += desc->length;
+	}
+
+	/* Calculate CRCs for all blocks in the config rom.  This
+	 * assumes that CRC length and info length are identical for
+	 * the bus info block, which is always the case for this
+	 * implementation. */
+	for (i = 0; i < j; i += length + 1) {
+		length = (config_rom[i] >> 16) & 0xff;
+		config_rom[i] |= crc16_itu_t(&config_rom[i + 1], length);
+	}
+
+	*config_rom_length = j;
+
+	return config_rom;
+}
+
+static void
+update_config_roms (void)
+{
+	struct fw_card *card;
+	u32 *config_rom;
+	size_t length;
+
+	list_for_each_entry (card, &card_list, link) {
+		config_rom = generate_config_rom(card, &length);
+		card->driver->set_config_rom(card, config_rom, length);
+	}
+}
+
+int
+fw_core_add_descriptor (struct fw_descriptor *desc)
+{
+	size_t i;
+
+	/* Check descriptor is valid; the length of all blocks in the
+	 * descriptor has to add up to exactly the length of the
+	 * block. */
+	i = 0;
+	while (i < desc->length)
+		i += (desc->data[i] >> 16) + 1;
+
+	if (i != desc->length)
+		return -1;
+
+	down_write(&fw_bus_type.subsys.rwsem);
+
+	list_add_tail (&desc->link, &descriptor_list);
+	descriptor_count++;
+	update_config_roms();
+
+	up_write(&fw_bus_type.subsys.rwsem);
+
+	return 0;
+}
+EXPORT_SYMBOL(fw_core_add_descriptor);
+
+void
+fw_core_remove_descriptor (struct fw_descriptor *desc)
+{
+	down_write(&fw_bus_type.subsys.rwsem);
+
+	list_del(&desc->link);
+	descriptor_count--;
+	update_config_roms();
+
+	up_write(&fw_bus_type.subsys.rwsem);
+}
+EXPORT_SYMBOL(fw_core_remove_descriptor);
+
+static const char gap_count_table[] = {
+	63, 5, 7, 8, 10, 13, 16, 18, 21, 24, 26, 29, 32, 35, 37, 40
+};
+
+struct bm_data {
+	struct fw_transaction t;
+	struct {
+		__be32 arg;
+		__be32 data;
+	} lock;
+	u32 old;
+	int rcode;
+	struct completion done;
+};
+
+static void
+complete_bm_lock(struct fw_card *card, int rcode,
+		 void *payload, size_t length, void *data)
+{
+	struct bm_data *bmd = data;
+
+	if (rcode == RCODE_COMPLETE)
+		bmd->old = be32_to_cpu(*(__be32 *) payload);
+	bmd->rcode = rcode;
+	complete(&bmd->done);
+}
+
+static void
+fw_card_bm_work(struct work_struct *work)
+{
+	struct fw_card *card = container_of(work, struct fw_card, work.work);
+	struct fw_device *root;
+	struct bm_data bmd;
+	unsigned long flags;
+	int root_id, new_root_id, irm_id, gap_count, generation, grace;
+	int do_reset = 0;
+
+	spin_lock_irqsave(&card->lock, flags);
+
+	generation = card->generation;
+	root = card->root_node->data;
+	root_id = card->root_node->node_id;
+	grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 10));
+
+	if (card->bm_generation + 1 == generation ||
+	    (card->bm_generation != generation && grace)) {
+		/* This first step is to figure out who is IRM and
+		 * then try to become bus manager.  If the IRM is not
+		 * well defined (e.g. does not have an active link
+		 * layer or does not responds to our lock request, we
+		 * will have to do a little vigilante bus management.
+		 * In that case, we do a goto into the gap count logic
+		 * so that when we do the reset, we still optimize the
+		 * gap count.  That could well save a reset in the
+		 * next generation. */
+
+		irm_id = card->irm_node->node_id;
+		if (!card->irm_node->link_on) {
+			new_root_id = card->local_node->node_id;
+			fw_notify("IRM has link off, making local node (%02x) root.\n",
+				  new_root_id);
+			goto pick_me;
+		}
+
+		bmd.lock.arg = cpu_to_be32(0x3f);
+		bmd.lock.data = cpu_to_be32(card->local_node->node_id);
+
+		spin_unlock_irqrestore(&card->lock, flags);
+
+		init_completion(&bmd.done);
+		fw_send_request(card, &bmd.t, TCODE_LOCK_COMPARE_SWAP,
+				irm_id, generation,
+				SCODE_100, CSR_REGISTER_BASE + CSR_BUS_MANAGER_ID,
+				&bmd.lock, sizeof bmd.lock,
+				complete_bm_lock, &bmd);
+		wait_for_completion(&bmd.done);
+
+		if (bmd.rcode == RCODE_GENERATION) {
+			/* Another bus reset happened. Just return,
+			 * the BM work has been rescheduled. */
+			return;
+		}
+
+		if (bmd.rcode == RCODE_COMPLETE && bmd.old != 0x3f)
+			/* Somebody else is BM, let them do the work. */
+			return;
+
+		spin_lock_irqsave(&card->lock, flags);
+		if (bmd.rcode != RCODE_COMPLETE) {
+			/* The lock request failed, maybe the IRM
+			 * isn't really IRM capable after all. Let's
+			 * do a bus reset and pick the local node as
+			 * root, and thus, IRM. */
+			new_root_id = card->local_node->node_id;
+			fw_notify("BM lock failed, making local node (%02x) root.\n",
+				  new_root_id);
+			goto pick_me;
+		}
+	} else if (card->bm_generation != generation) {
+		/* OK, we weren't BM in the last generation, and it's
+		 * less than 100ms since last bus reset. Reschedule
+		 * this task 100ms from now. */
+		spin_unlock_irqrestore(&card->lock, flags);
+		schedule_delayed_work(&card->work, DIV_ROUND_UP(HZ, 10));
+		return;
+	}
+
+	/* We're bus manager for this generation, so next step is to
+	 * make sure we have an active cycle master and do gap count
+	 * optimization. */
+	card->bm_generation = generation;
+
+	if (root == NULL) {
+		/* Either link_on is false, or we failed to read the
+		 * config rom.  In either case, pick another root. */
+		new_root_id = card->local_node->node_id;
+	} else if (atomic_read(&root->state) != FW_DEVICE_RUNNING) {
+		/* If we haven't probed this device yet, bail out now
+		 * and let's try again once that's done. */
+		spin_unlock_irqrestore(&card->lock, flags);
+		return;
+	} else if (root->config_rom[2] & bib_cmc) {
+		/* FIXME: I suppose we should set the cmstr bit in the
+		 * STATE_CLEAR register of this node, as described in
+		 * 1394-1995, 8.4.2.6.  Also, send out a force root
+		 * packet for this node. */
+		new_root_id = root_id;
+	} else {
+		/* Current root has an active link layer and we
+		 * successfully read the config rom, but it's not
+		 * cycle master capable. */
+		new_root_id = card->local_node->node_id;
+	}
+
+ pick_me:
+	/* Now figure out what gap count to set. */
+	if (card->topology_type == FW_TOPOLOGY_A &&
+	    card->root_node->max_hops < ARRAY_SIZE(gap_count_table))
+		gap_count = gap_count_table[card->root_node->max_hops];
+	else
+		gap_count = 63;
+
+	/* Finally, figure out if we should do a reset or not.  If we've
+	 * done less that 5 resets with the same physical topology and we
+	 * have either a new root or a new gap count setting, let's do it. */
+
+	if (card->bm_retries++ < 5 &&
+	    (card->gap_count != gap_count || new_root_id != root_id))
+		do_reset = 1;
+
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	if (do_reset) {
+		fw_notify("phy config: card %d, new root=%x, gap_count=%d\n",
+			  card->index, new_root_id, gap_count);
+		fw_send_phy_config(card, new_root_id, generation, gap_count);
+		fw_core_initiate_bus_reset(card, 1);
+	}
+}
+
+static void
+release_card(struct device *device)
+{
+	struct fw_card *card =
+		container_of(device, struct fw_card, card_device);
+
+	kfree(card);
+}
+
+static void
+flush_timer_callback(unsigned long data)
+{
+	struct fw_card *card = (struct fw_card *)data;
+
+	fw_flush_transactions(card);
+}
+
+void
+fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
+		   struct device *device)
+{
+	static atomic_t index = ATOMIC_INIT(-1);
+
+	card->index = atomic_inc_return(&index);
+	card->driver = driver;
+	card->device = device;
+	card->current_tlabel = 0;
+	card->tlabel_mask = 0;
+	card->color = 0;
+
+	INIT_LIST_HEAD(&card->transaction_list);
+	spin_lock_init(&card->lock);
+	setup_timer(&card->flush_timer,
+		    flush_timer_callback, (unsigned long)card);
+
+	card->local_node = NULL;
+
+	INIT_DELAYED_WORK(&card->work, fw_card_bm_work);
+
+	card->card_device.bus     = &fw_bus_type;
+	card->card_device.release = release_card;
+	card->card_device.parent  = card->device;
+	snprintf(card->card_device.bus_id, sizeof card->card_device.bus_id,
+		 "fwcard%d", card->index);
+
+	device_initialize(&card->card_device);
+}
+EXPORT_SYMBOL(fw_card_initialize);
+
+int
+fw_card_add(struct fw_card *card,
+	    u32 max_receive, u32 link_speed, u64 guid)
+{
+	int retval;
+	u32 *config_rom;
+	size_t length;
+
+	card->max_receive = max_receive;
+	card->link_speed = link_speed;
+	card->guid = guid;
+
+	/* FIXME: add #define's for phy registers. */
+	/* Activate link_on bit and contender bit in our self ID packets.*/
+	if (card->driver->update_phy_reg(card, 4, 0, 0x80 | 0x40) < 0)
+		return -EIO;
+
+	retval = device_add(&card->card_device);
+	if (retval < 0) {
+		fw_error("Failed to register card device.");
+		return retval;
+	}
+
+	/* The subsystem grabs a reference when the card is added and
+	 * drops it when the driver calls fw_core_remove_card. */
+	fw_card_get(card);
+
+	down_write(&fw_bus_type.subsys.rwsem);
+	config_rom = generate_config_rom (card, &length);
+	list_add_tail(&card->link, &card_list);
+	up_write(&fw_bus_type.subsys.rwsem);
+
+	return card->driver->enable(card, config_rom, length);
+}
+EXPORT_SYMBOL(fw_card_add);
+
+
+/* The next few functions implements a dummy driver that use once a
+ * card driver shuts down an fw_card.  This allows the driver to
+ * cleanly unload, as all IO to the card will be handled by the dummy
+ * driver instead of calling into the (possibly) unloaded module.  The
+ * dummy driver just fails all IO. */
+
+static int
+dummy_enable(struct fw_card *card, u32 *config_rom, size_t length)
+{
+	BUG();
+	return -1;
+}
+
+static int
+dummy_update_phy_reg(struct fw_card *card, int address,
+		     int clear_bits, int set_bits)
+{
+	return -ENODEV;
+}
+
+static int
+dummy_set_config_rom(struct fw_card *card,
+		     u32 *config_rom, size_t length)
+{
+	/* We take the card out of card_list before setting the dummy
+	 * driver, so this should never get called. */
+	BUG();
+	return -1;
+}
+
+static void
+dummy_send_request(struct fw_card *card, struct fw_packet *packet)
+{
+	packet->callback(packet, card, -ENODEV);
+}
+
+static void
+dummy_send_response(struct fw_card *card, struct fw_packet *packet)
+{
+	packet->callback(packet, card, -ENODEV);
+}
+
+static int
+dummy_cancel_packet(struct fw_card *card, struct fw_packet *packet)
+{
+	return -ENOENT;
+}
+
+static int
+dummy_enable_phys_dma(struct fw_card *card,
+		      int node_id, int generation)
+{
+	return -ENODEV;
+}
+
+static struct fw_card_driver dummy_driver = {
+	.name            = "dummy",
+	.enable          = dummy_enable,
+	.update_phy_reg  = dummy_update_phy_reg,
+	.set_config_rom  = dummy_set_config_rom,
+	.send_request    = dummy_send_request,
+	.cancel_packet   = dummy_cancel_packet,
+	.send_response   = dummy_send_response,
+	.enable_phys_dma = dummy_enable_phys_dma,
+};
+
+void
+fw_core_remove_card(struct fw_card *card)
+{
+	card->driver->update_phy_reg(card, 4, 0x80 | 0x40, 0);
+	fw_core_initiate_bus_reset(card, 1);
+
+	down_write(&fw_bus_type.subsys.rwsem);
+	list_del(&card->link);
+	up_write(&fw_bus_type.subsys.rwsem);
+
+	/* Set up the dummy driver. */
+	card->driver = &dummy_driver;
+
+	fw_flush_transactions(card);
+
+	fw_destroy_nodes(card);
+
+	/* This also drops the subsystem reference. */
+	device_unregister(&card->card_device);
+}
+EXPORT_SYMBOL(fw_core_remove_card);
+
+struct fw_card *
+fw_card_get(struct fw_card *card)
+{
+	get_device(&card->card_device);
+
+	return card;
+}
+EXPORT_SYMBOL(fw_card_get);
+
+/* An assumption for fw_card_put() is that the card driver allocates
+ * the fw_card struct with kalloc and that it has been shut down
+ * before the last ref is dropped. */
+void
+fw_card_put(struct fw_card *card)
+{
+	put_device(&card->card_device);
+}
+EXPORT_SYMBOL(fw_card_put);
+
+int
+fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)
+{
+	return card->driver->update_phy_reg(card, short_reset ? 5 : 1, 0, 0x40);
+}
+EXPORT_SYMBOL(fw_core_initiate_bus_reset);
diff --git a/drivers/firewire/fw-device-cdev.c b/drivers/firewire/fw-device-cdev.c
new file mode 100644
index 0000000..1b9e5f7
--- /dev/null
+++ b/drivers/firewire/fw-device-cdev.c
@@ -0,0 +1,617 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-device-cdev.c - Char device for device raw access
+ *
+ * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/wait.h>
+#include <linux/errno.h>
+#include <linux/device.h>
+#include <linux/vmalloc.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/mm.h>
+#include <linux/compat.h>
+#include <asm/uaccess.h>
+#include "fw-transaction.h"
+#include "fw-topology.h"
+#include "fw-device.h"
+#include "fw-device-cdev.h"
+
+/*
+ * todo
+ *
+ * - bus resets sends a new packet with new generation and node id
+ *
+ */
+
+/* dequeue_event() just kfree()'s the event, so the event has to be
+ * the first field in the struct. */
+
+struct event {
+	struct { void *data; size_t size; } v[2];
+	struct list_head link;
+};
+
+struct response {
+	struct event event;
+	struct fw_transaction transaction;
+	struct client *client;
+	struct fw_cdev_event_response response;
+};
+
+struct iso_interrupt {
+	struct event event;
+	struct fw_cdev_event_iso_interrupt interrupt;
+};
+
+struct client {
+	struct fw_device *device;
+	spinlock_t lock;
+	struct list_head handler_list;
+	struct list_head request_list;
+	u32 request_serial;
+	struct list_head event_list;
+	struct semaphore event_list_sem;
+	wait_queue_head_t wait;
+	unsigned long vm_start;
+	struct fw_iso_context *iso_context;
+};
+
+static inline void __user *
+u64_to_uptr(__u64 value)
+{
+	return (void __user *)(unsigned long)value;
+}
+
+static inline __u64
+uptr_to_u64(void __user *ptr)
+{
+	return (__u64)(unsigned long)ptr;
+}
+
+static int fw_device_op_open(struct inode *inode, struct file *file)
+{
+	struct fw_device *device;
+	struct client *client;
+
+	device = container_of(inode->i_cdev, struct fw_device, cdev);
+
+	client = kzalloc(sizeof *client, GFP_KERNEL);
+	if (client == NULL)
+		return -ENOMEM;
+
+	client->device = fw_device_get(device);
+	INIT_LIST_HEAD(&client->event_list);
+	sema_init(&client->event_list_sem, 0);
+	INIT_LIST_HEAD(&client->handler_list);
+	INIT_LIST_HEAD(&client->request_list);
+	spin_lock_init(&client->lock);
+	init_waitqueue_head(&client->wait);
+
+	file->private_data = client;
+
+	return 0;
+}
+
+static void queue_event(struct client *client, struct event *event,
+			void *data0, size_t size0, void *data1, size_t size1)
+{
+	unsigned long flags;
+
+	event->v[0].data = data0;
+	event->v[0].size = size0;
+	event->v[1].data = data1;
+	event->v[1].size = size1;
+
+	spin_lock_irqsave(&client->lock, flags);
+
+	list_add_tail(&event->link, &client->event_list);
+
+	up(&client->event_list_sem);
+	wake_up_interruptible(&client->wait);
+
+	spin_unlock_irqrestore(&client->lock, flags);
+}
+
+static int dequeue_event(struct client *client, char __user *buffer, size_t count)
+{
+	unsigned long flags;
+	struct event *event;
+	size_t size, total;
+	int i, retval = -EFAULT;
+
+	if (down_interruptible(&client->event_list_sem) < 0)
+		return -EINTR;
+
+	spin_lock_irqsave(&client->lock, flags);
+
+	event = container_of(client->event_list.next, struct event, link);
+	list_del(&event->link);
+
+	spin_unlock_irqrestore(&client->lock, flags);
+
+	if (buffer == NULL)
+		goto out;
+
+	total = 0;
+	for (i = 0; i < ARRAY_SIZE(event->v) && total < count; i++) {
+		size = min(event->v[i].size, count - total);
+		if (copy_to_user(buffer + total, event->v[i].data, size))
+			goto out;
+		total += size;
+	}
+	retval = total;
+
+ out:
+	kfree(event);
+
+	return retval;
+}
+
+static ssize_t
+fw_device_op_read(struct file *file,
+		  char __user *buffer, size_t count, loff_t *offset)
+{
+	struct client *client = file->private_data;
+
+	return dequeue_event(client, buffer, count);
+}
+
+static int ioctl_config_rom(struct client *client, void __user *arg)
+{
+	struct fw_cdev_get_config_rom rom;
+
+	rom.length = client->device->config_rom_length;
+	memcpy(rom.data, client->device->config_rom, rom.length * 4);
+	if (copy_to_user(arg, &rom,
+			 (char *)&rom.data[rom.length] - (char *)&rom))
+		return -EFAULT;
+
+	return 0;
+}
+
+static void
+complete_transaction(struct fw_card *card, int rcode,
+		     void *payload, size_t length, void *data)
+{
+	struct response *response = data;
+	struct client *client = response->client;
+
+	if (length < response->response.length)
+		response->response.length = length;
+	if (rcode == RCODE_COMPLETE)
+		memcpy(response->response.data, payload,
+		       response->response.length);
+
+	response->response.type   = FW_CDEV_EVENT_RESPONSE;
+	response->response.rcode  = rcode;
+	queue_event(client, &response->event,
+		    &response->response, sizeof response->response,
+		    response->response.data, response->response.length);
+}
+
+static ssize_t ioctl_send_request(struct client *client, void __user *arg)
+{
+	struct fw_device *device = client->device;
+	struct fw_cdev_send_request request;
+	struct response *response;
+
+	if (copy_from_user(&request, arg, sizeof request))
+		return -EFAULT;
+
+	/* What is the biggest size we'll accept, really? */
+	if (request.length > 4096)
+		return -EINVAL;
+
+	response = kmalloc(sizeof *response + request.length, GFP_KERNEL);
+	if (response == NULL)
+		return -ENOMEM;
+
+	response->client = client;
+	response->response.length = request.length;
+	response->response.closure = request.closure;
+
+	if (request.data &&
+	    copy_from_user(response->response.data,
+			   u64_to_uptr(request.data), request.length)) {
+		kfree(response);
+		return -EFAULT;
+	}
+
+	fw_send_request(device->card, &response->transaction,
+			request.tcode,
+			device->node->node_id,
+			device->card->generation,
+			device->node->max_speed,
+			request.offset,
+			response->response.data, request.length,
+			complete_transaction, response);
+
+	if (request.data)
+		return sizeof request + request.length;
+	else
+		return sizeof request;
+}
+
+struct address_handler {
+	struct fw_address_handler handler;
+	__u64 closure;
+	struct client *client;
+	struct list_head link;
+};
+
+struct request {
+	struct fw_request *request;
+	void *data;
+	size_t length;
+	u32 serial;
+	struct list_head link;
+};
+
+struct request_event {
+	struct event event;
+	struct fw_cdev_event_request request;
+};
+
+static void
+handle_request(struct fw_card *card, struct fw_request *r,
+	       int tcode, int destination, int source,
+	       int generation, int speed,
+	       unsigned long long offset,
+	       void *payload, size_t length, void *callback_data)
+{
+	struct address_handler *handler = callback_data;
+	struct request *request;
+	struct request_event *e;
+	unsigned long flags;
+	struct client *client = handler->client;
+
+	request = kmalloc(sizeof *request, GFP_ATOMIC);
+	e = kmalloc(sizeof *e, GFP_ATOMIC);
+	if (request == NULL || e == NULL) {
+		kfree(request);
+		kfree(e);
+		fw_send_response(card, r, RCODE_CONFLICT_ERROR);
+		return;
+	}
+
+	request->request = r;
+	request->data    = payload;
+	request->length  = length;
+
+	spin_lock_irqsave(&client->lock, flags);
+	request->serial = client->request_serial++;
+	list_add_tail(&request->link, &client->request_list);
+	spin_unlock_irqrestore(&client->lock, flags);
+
+	e->request.type    = FW_CDEV_EVENT_REQUEST;
+	e->request.tcode   = tcode;
+	e->request.offset  = offset;
+	e->request.length  = length;
+	e->request.serial  = request->serial;
+	e->request.closure = handler->closure;
+
+	queue_event(client, &e->event,
+		    &e->request, sizeof e->request, payload, length);
+}
+
+static int ioctl_allocate(struct client *client, void __user *arg)
+{
+	struct fw_cdev_allocate request;
+	struct address_handler *handler;
+	unsigned long flags;
+	struct fw_address_region region;
+
+	if (copy_from_user(&request, arg, sizeof request))
+		return -EFAULT;
+
+	handler = kmalloc(sizeof *handler, GFP_KERNEL);
+	if (handler == NULL)
+		return -ENOMEM;
+
+	region.start = request.offset;
+	region.end = request.offset + request.length;
+	handler->handler.length = request.length;
+	handler->handler.address_callback = handle_request;
+	handler->handler.callback_data = handler;
+	handler->closure = request.closure;
+	handler->client = client;
+
+	if (fw_core_add_address_handler(&handler->handler, &region) < 0) {
+		kfree(handler);
+		return -EBUSY;
+	}
+
+	spin_lock_irqsave(&client->lock, flags);
+	list_add_tail(&handler->link, &client->handler_list);
+	spin_unlock_irqrestore(&client->lock, flags);
+
+	return 0;
+}
+
+static int ioctl_send_response(struct client *client, void __user *arg)
+{
+	struct fw_cdev_send_response request;
+	struct request *r;
+	unsigned long flags;
+
+	if (copy_from_user(&request, arg, sizeof request))
+		return -EFAULT;
+
+	spin_lock_irqsave(&client->lock, flags);
+	list_for_each_entry(r, &client->request_list, link) {
+		if (r->serial == request.serial) {
+			list_del(&r->link);
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&client->lock, flags);
+
+	if (&r->link == &client->request_list)
+		return -EINVAL;
+
+	if (request.length < r->length)
+		r->length = request.length;
+	if (copy_from_user(r->data, u64_to_uptr(request.data), r->length))
+		return -EFAULT;
+
+	fw_send_response(client->device->card, r->request, request.rcode);
+
+	kfree(r);
+
+	return 0;
+}
+
+static void
+iso_callback(struct fw_iso_context *context, int status, u32 cycle, void *data)
+{
+	struct client *client = data;
+	struct iso_interrupt *interrupt;
+
+	interrupt = kzalloc(sizeof *interrupt, GFP_ATOMIC);
+	if (interrupt == NULL)
+		return;
+
+	interrupt->interrupt.type      = FW_CDEV_EVENT_ISO_INTERRUPT;
+	interrupt->interrupt.closure   = 0;
+	interrupt->interrupt.cycle     = cycle;
+	queue_event(client, &interrupt->event,
+		    &interrupt->interrupt, sizeof interrupt->interrupt, NULL, 0);
+}
+
+static int ioctl_create_iso_context(struct client *client, void __user *arg)
+{
+	struct fw_cdev_create_iso_context request;
+
+	if (copy_from_user(&request, arg, sizeof request))
+		return -EFAULT;
+
+	client->iso_context = fw_iso_context_create(client->device->card,
+						    FW_ISO_CONTEXT_TRANSMIT,
+						    request.buffer_size,
+						    iso_callback, client);
+	if (IS_ERR(client->iso_context))
+		return PTR_ERR(client->iso_context);
+
+	return 0;
+}
+
+static int ioctl_queue_iso(struct client *client, void __user *arg)
+{
+	struct fw_cdev_queue_iso request;
+	struct fw_cdev_iso_packet __user *p, *end, *next;
+	void *payload, *payload_end;
+	unsigned long index;
+	int count;
+	struct {
+		struct fw_iso_packet packet;
+		u8 header[256];
+	} u;
+
+	if (client->iso_context == NULL)
+		return -EINVAL;
+	if (copy_from_user(&request, arg, sizeof request))
+		return -EFAULT;
+
+	/* If the user passes a non-NULL data pointer, has mmap()'ed
+	 * the iso buffer, and the pointer points inside the buffer,
+	 * we setup the payload pointers accordingly.  Otherwise we
+	 * set them both to NULL, which will still let packets with
+	 * payload_length == 0 through.  In other words, if no packets
+	 * use the indirect payload, the iso buffer need not be mapped
+	 * and the request.data pointer is ignored.*/
+
+	index = (unsigned long)request.data - client->vm_start;
+	if (request.data != 0 && client->vm_start != 0 &&
+	    index <= client->iso_context->buffer_size) {
+		payload = client->iso_context->buffer + index;
+		payload_end = client->iso_context->buffer +
+			client->iso_context->buffer_size;
+	} else {
+		payload = NULL;
+		payload_end = NULL;
+	}
+
+	if (!access_ok(VERIFY_READ, request.packets, request.size))
+		return -EFAULT;
+
+	p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(request.packets);
+	end = (void __user *)p + request.size;
+	count = 0;
+	while (p < end) {
+		if (__copy_from_user(&u.packet, p, sizeof *p))
+			return -EFAULT;
+		next = (struct fw_cdev_iso_packet __user *)
+			&p->header[u.packet.header_length / 4];
+		if (next > end)
+			return -EINVAL;
+		if (__copy_from_user
+		    (u.packet.header, p->header, u.packet.header_length))
+			return -EFAULT;
+		if (u.packet.skip &&
+		    u.packet.header_length + u.packet.payload_length > 0)
+			return -EINVAL;
+		if (payload + u.packet.payload_length > payload_end)
+			return -EINVAL;
+
+		if (fw_iso_context_queue(client->iso_context,
+					 &u.packet, payload))
+			break;
+
+		p = next;
+		payload += u.packet.payload_length;
+		count++;
+	}
+
+	request.size    -= uptr_to_u64(p) - request.packets;
+	request.packets  = uptr_to_u64(p);
+	request.data     =
+		client->vm_start + (payload - client->iso_context->buffer);
+
+	if (copy_to_user(arg, &request, sizeof request))
+		return -EFAULT;
+
+	return count;
+}
+
+static int ioctl_send_iso(struct client *client, void __user *arg)
+{
+	struct fw_cdev_send_iso request;
+
+	if (copy_from_user(&request, arg, sizeof request))
+		return -EFAULT;
+
+	return fw_iso_context_send(client->iso_context, request.channel,
+				   request.speed, request.cycle);
+}
+
+static int
+dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
+{
+	switch (cmd) {
+	case FW_CDEV_IOC_GET_CONFIG_ROM:
+		return ioctl_config_rom(client, arg);
+	case FW_CDEV_IOC_SEND_REQUEST:
+		return ioctl_send_request(client, arg);
+	case FW_CDEV_IOC_ALLOCATE:
+		return ioctl_allocate(client, arg);
+	case FW_CDEV_IOC_SEND_RESPONSE:
+		return ioctl_send_response(client, arg);
+	case FW_CDEV_IOC_CREATE_ISO_CONTEXT:
+		return ioctl_create_iso_context(client, arg);
+	case FW_CDEV_IOC_QUEUE_ISO:
+		return ioctl_queue_iso(client, arg);
+	case FW_CDEV_IOC_SEND_ISO:
+		return ioctl_send_iso(client, arg);
+	default:
+		return -EINVAL;
+	}
+}
+
+static long
+fw_device_op_ioctl(struct file *file,
+		   unsigned int cmd, unsigned long arg)
+{
+	struct client *client = file->private_data;
+
+	return dispatch_ioctl(client, cmd, (void __user *) arg);
+}
+
+#ifdef CONFIG_COMPAT
+static long
+fw_device_op_compat_ioctl(struct file *file,
+			  unsigned int cmd, unsigned long arg)
+{
+	struct client *client = file->private_data;
+
+	return dispatch_ioctl(client, cmd, compat_ptr(arg));
+}
+#endif
+
+static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	struct client *client = file->private_data;
+
+	if (client->iso_context->buffer == NULL)
+		return -EINVAL;
+
+	client->vm_start = vma->vm_start;
+
+	return remap_vmalloc_range(vma, client->iso_context->buffer, 0);
+}
+
+static int fw_device_op_release(struct inode *inode, struct file *file)
+{
+	struct client *client = file->private_data;
+	struct address_handler *h, *next;
+	struct request *r, *next_r;
+
+	if (client->iso_context)
+		fw_iso_context_destroy(client->iso_context);
+
+	list_for_each_entry_safe(h, next, &client->handler_list, link) {
+		fw_core_remove_address_handler(&h->handler);
+		kfree(h);
+	}
+
+	list_for_each_entry_safe(r, next_r, &client->request_list, link) {
+		fw_send_response(client->device->card, r->request,
+				 RCODE_CONFLICT_ERROR);
+		kfree(r);
+	}
+
+	/* TODO: wait for all transactions to finish so
+	 * complete_transaction doesn't try to queue up responses
+	 * after we free client. */
+	while (!list_empty(&client->event_list))
+		dequeue_event(client, NULL, 0);
+
+	fw_device_put(client->device);
+	kfree(client);
+
+	return 0;
+}
+
+static unsigned int fw_device_op_poll(struct file *file, poll_table * pt)
+{
+	struct client *client = file->private_data;
+
+	poll_wait(file, &client->wait, pt);
+
+	if (!list_empty(&client->event_list))
+		return POLLIN | POLLRDNORM;
+	else
+		return 0;
+}
+
+const struct file_operations fw_device_ops = {
+	.owner		= THIS_MODULE,
+	.open		= fw_device_op_open,
+	.read		= fw_device_op_read,
+	.unlocked_ioctl	= fw_device_op_ioctl,
+	.poll		= fw_device_op_poll,
+	.release	= fw_device_op_release,
+	.mmap		= fw_device_op_mmap,
+
+#ifdef CONFIG_COMPAT
+	.compat_ioctl	= fw_device_op_compat_ioctl,
+#endif
+};
diff --git a/drivers/firewire/fw-device-cdev.h b/drivers/firewire/fw-device-cdev.h
new file mode 100644
index 0000000..ddbae43
--- /dev/null
+++ b/drivers/firewire/fw-device-cdev.h
@@ -0,0 +1,154 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-device-cdev.h -- Char device interface.
+ *
+ * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __fw_cdev_h
+#define __fw_cdev_h
+
+#include <asm/ioctl.h>
+#include <asm/types.h>
+
+#define TCODE_WRITE_QUADLET_REQUEST	0
+#define TCODE_WRITE_BLOCK_REQUEST	1
+#define TCODE_WRITE_RESPONSE		2
+#define TCODE_READ_QUADLET_REQUEST	4
+#define TCODE_READ_BLOCK_REQUEST	5
+#define TCODE_READ_QUADLET_RESPONSE	6
+#define TCODE_READ_BLOCK_RESPONSE	7
+#define TCODE_CYCLE_START		8
+#define TCODE_LOCK_REQUEST		9
+#define TCODE_STREAM_DATA		10
+#define TCODE_LOCK_RESPONSE		11
+
+#define TCODE_LOCK_MASK_SWAP		0x11
+#define TCODE_LOCK_COMPARE_SWAP		0x12
+#define TCODE_LOCK_FETCH_ADD		0x13
+#define TCODE_LOCK_LITTLE_ADD		0x14
+#define TCODE_LOCK_BOUNDED_ADD		0x15
+#define TCODE_LOCK_WRAP_ADD		0x16
+#define TCODE_LOCK_VENDOR_DEPENDENT	0x17
+
+#define RCODE_COMPLETE			0x0
+#define RCODE_CONFLICT_ERROR		0x4
+#define RCODE_DATA_ERROR		0x5
+#define RCODE_TYPE_ERROR		0x6
+#define RCODE_ADDRESS_ERROR		0x7
+
+#define SCODE_100			0x0
+#define SCODE_200			0x1
+#define SCODE_400			0x2
+#define SCODE_800			0x3
+#define SCODE_1600			0x4
+#define SCODE_3200			0x5
+
+#define FW_CDEV_EVENT_RESPONSE		0x00
+#define FW_CDEV_EVENT_REQUEST		0x01
+#define FW_CDEV_EVENT_ISO_INTERRUPT	0x02
+
+/* The 'closure' fields are for user space to use.  Data passed in the
+ * 'closure' field for a request will be returned in the corresponding
+ * event.  It's a 64-bit type so that it's a fixed size type big
+ * enough to hold a pointer on all platforms. */
+
+struct fw_cdev_event_response {
+	__u32 type;
+	__u32 rcode;
+	__u64 closure;
+	__u32 length;
+	__u32 data[0];
+};
+
+struct fw_cdev_event_request {
+	__u32 type;
+	__u32 tcode;
+	__u64 offset;
+	__u64 closure;
+	__u32 serial;
+	__u32 length;
+	__u32 data[0];
+};
+
+struct fw_cdev_event_iso_interrupt {
+	__u32 type;
+	__u32 cycle;
+	__u64 closure;
+};
+
+#define FW_CDEV_IOC_GET_CONFIG_ROM	_IOR('#', 0x00, struct fw_cdev_get_config_rom)
+#define FW_CDEV_IOC_SEND_REQUEST	_IO('#', 0x01)
+#define FW_CDEV_IOC_ALLOCATE		_IO('#', 0x02)
+#define FW_CDEV_IOC_SEND_RESPONSE	_IO('#', 0x03)
+#define FW_CDEV_IOC_CREATE_ISO_CONTEXT	_IO('#', 0x04)
+#define FW_CDEV_IOC_QUEUE_ISO		_IO('#', 0x05)
+#define FW_CDEV_IOC_SEND_ISO		_IO('#', 0x06)
+
+struct fw_cdev_get_config_rom {
+	__u32 length;
+	__u32 data[256];
+};
+
+struct fw_cdev_send_request {
+	__u32 tcode;
+	__u32 length;
+	__u64 offset;
+	__u64 closure;
+	__u64 data;
+};
+
+struct fw_cdev_send_response {
+	__u32 rcode;
+	__u32 length;
+	__u64 data;
+	__u32 serial;
+};
+
+struct fw_cdev_allocate {
+	__u64 offset;
+	__u64 closure;
+	__u32 length;
+};
+
+struct fw_cdev_create_iso_context {
+	__u32 buffer_size;
+};
+
+struct fw_cdev_iso_packet {
+	__u16 payload_length;	/* Length of indirect payload. */
+	__u32 interrupt : 1;	/* Generate interrupt on this packet */
+	__u32 skip : 1;		/* Set to not send packet at all. */
+	__u32 tag : 2;
+	__u32 sy : 4;
+	__u32 header_length : 8;	/* Length of immediate header. */
+	__u32 header[0];
+};
+
+struct fw_cdev_queue_iso {
+	__u32 size;
+	__u64 packets;
+	__u64 data;
+};
+
+struct fw_cdev_send_iso {
+	__u32 channel;
+	__u32 speed;
+	__s32 cycle;
+};
+
+#endif /* __fw_cdev_h */
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
new file mode 100644
index 0000000..df2e929
--- /dev/null
+++ b/drivers/firewire/fw-device.c
@@ -0,0 +1,606 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-device.c - Device probing and sysfs code.
+ *
+ * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/wait.h>
+#include <linux/errno.h>
+#include <linux/kthread.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include "fw-transaction.h"
+#include "fw-topology.h"
+#include "fw-device.h"
+
+void fw_csr_iterator_init(struct fw_csr_iterator *ci, u32 * p)
+{
+	ci->p = p + 1;
+	ci->end = ci->p + (p[0] >> 16);
+}
+EXPORT_SYMBOL(fw_csr_iterator_init);
+
+int fw_csr_iterator_next(struct fw_csr_iterator *ci, int *key, int *value)
+{
+	*key = *ci->p >> 24;
+	*value = *ci->p & 0xffffff;
+
+	return ci->p++ < ci->end;
+}
+EXPORT_SYMBOL(fw_csr_iterator_next);
+
+static int is_fw_unit(struct device *dev);
+
+static int match_unit_directory(u32 * directory, const struct fw_device_id *id)
+{
+	struct fw_csr_iterator ci;
+	int key, value, match;
+
+	match = 0;
+	fw_csr_iterator_init(&ci, directory);
+	while (fw_csr_iterator_next(&ci, &key, &value)) {
+		if (key == CSR_VENDOR && value == id->vendor)
+			match |= FW_MATCH_VENDOR;
+		if (key == CSR_MODEL && value == id->model)
+			match |= FW_MATCH_MODEL;
+		if (key == CSR_SPECIFIER_ID && value == id->specifier_id)
+			match |= FW_MATCH_SPECIFIER_ID;
+		if (key == CSR_VERSION && value == id->version)
+			match |= FW_MATCH_VERSION;
+	}
+
+	return (match & id->match_flags) == id->match_flags;
+}
+
+static int fw_unit_match(struct device *dev, struct device_driver *drv)
+{
+	struct fw_unit *unit = fw_unit(dev);
+	struct fw_driver *driver = fw_driver(drv);
+	int i;
+
+	/* We only allow binding to fw_units. */
+	if (!is_fw_unit(dev))
+		return 0;
+
+	for (i = 0; driver->id_table[i].match_flags != 0; i++) {
+		if (match_unit_directory(unit->directory, &driver->id_table[i]))
+			return 1;
+	}
+
+	return 0;
+}
+
+static int get_modalias(struct fw_unit *unit, char *buffer, size_t buffer_size)
+{
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct fw_csr_iterator ci;
+
+	int key, value;
+	int vendor = 0;
+	int model = 0;
+	int specifier_id = 0;
+	int version = 0;
+
+	fw_csr_iterator_init(&ci, &device->config_rom[5]);
+	while (fw_csr_iterator_next(&ci, &key, &value)) {
+		switch (key) {
+		case CSR_VENDOR:
+			vendor = value;
+			break;
+		case CSR_MODEL:
+			model = value;
+			break;
+		}
+	}
+
+	fw_csr_iterator_init(&ci, unit->directory);
+	while (fw_csr_iterator_next(&ci, &key, &value)) {
+		switch (key) {
+		case CSR_SPECIFIER_ID:
+			specifier_id = value;
+			break;
+		case CSR_VERSION:
+			version = value;
+			break;
+		}
+	}
+
+	return snprintf(buffer, buffer_size,
+			"ieee1394:ven%08Xmo%08Xsp%08Xver%08X",
+			vendor, model, specifier_id, version);
+}
+
+static int
+fw_unit_uevent(struct device *dev, char **envp, int num_envp,
+	       char *buffer, int buffer_size)
+{
+	struct fw_unit *unit = fw_unit(dev);
+	char modalias[64];
+	int length = 0;
+	int i = 0;
+
+	if (!is_fw_unit(dev))
+		goto out;
+
+	get_modalias(unit, modalias, sizeof modalias);
+
+	if (add_uevent_var(envp, num_envp, &i,
+			   buffer, buffer_size, &length,
+			   "MODALIAS=%s", modalias))
+		return -ENOMEM;
+
+      out:
+	envp[i] = NULL;
+
+	return 0;
+}
+
+struct bus_type fw_bus_type = {
+	.name = "firewire",
+	.match = fw_unit_match,
+	.uevent = fw_unit_uevent,
+};
+EXPORT_SYMBOL(fw_bus_type);
+
+extern struct fw_device *fw_device_get(struct fw_device *device)
+{
+	get_device(&device->device);
+
+	return device;
+}
+
+extern void fw_device_put(struct fw_device *device)
+{
+	put_device(&device->device);
+}
+
+static void fw_device_release(struct device *dev)
+{
+	struct fw_device *device = fw_device(dev);
+	unsigned long flags;
+
+	/* Take the card lock so we don't set this to NULL while a
+	 * FW_NODE_UPDATED callback is being handled. */
+	spin_lock_irqsave(&device->card->lock, flags);
+	device->node->data = NULL;
+	spin_unlock_irqrestore(&device->card->lock, flags);
+
+	fw_node_put(device->node);
+	fw_card_put(device->card);
+	kfree(device->config_rom);
+	kfree(device);
+}
+
+int fw_device_enable_phys_dma(struct fw_device *device)
+{
+	return device->card->driver->enable_phys_dma(device->card,
+						     device->node_id,
+						     device->generation);
+}
+EXPORT_SYMBOL(fw_device_enable_phys_dma);
+
+static ssize_t
+show_modalias_attribute(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	struct fw_unit *unit = fw_unit(dev);
+	int length;
+
+	length = get_modalias(unit, buf, PAGE_SIZE);
+	strcpy(buf + length, "\n");
+
+	return length + 1;
+}
+
+static struct device_attribute modalias_attribute = {
+	.attr = { .name = "modalias", .mode = S_IRUGO, },
+	.show = show_modalias_attribute,
+};
+
+static ssize_t
+show_config_rom_attribute(struct device *dev,
+			  struct device_attribute *attr, char *buf)
+{
+	struct fw_device *device = fw_device(dev);
+
+	memcpy(buf, device->config_rom, device->config_rom_length * 4);
+
+	return device->config_rom_length * 4;
+}
+
+static struct device_attribute config_rom_attribute = {
+	.attr = {.name = "config_rom", .mode = S_IRUGO,},
+	.show = show_config_rom_attribute,
+};
+
+struct read_quadlet_callback_data {
+	struct completion done;
+	int rcode;
+	u32 data;
+};
+
+static void
+complete_transaction(struct fw_card *card, int rcode,
+		     void *payload, size_t length, void *data)
+{
+	struct read_quadlet_callback_data *callback_data = data;
+
+	if (rcode == RCODE_COMPLETE)
+		callback_data->data = be32_to_cpu(*(__be32 *)payload);
+	callback_data->rcode = rcode;
+	complete(&callback_data->done);
+}
+
+static int read_rom(struct fw_device *device, int index, u32 * data)
+{
+	struct read_quadlet_callback_data callback_data;
+	struct fw_transaction t;
+	u64 offset;
+
+	init_completion(&callback_data.done);
+
+	offset = 0xfffff0000400ULL + index * 4;
+	fw_send_request(device->card, &t, TCODE_READ_QUADLET_REQUEST,
+			device->node_id,
+			device->generation, SCODE_100,
+			offset, NULL, 4, complete_transaction, &callback_data);
+
+	wait_for_completion(&callback_data.done);
+
+	*data = callback_data.data;
+
+	return callback_data.rcode;
+}
+
+static int read_bus_info_block(struct fw_device *device)
+{
+	static u32 rom[256];
+	u32 stack[16], sp, key;
+	int i, end, length;
+
+	/* First read the bus info block. */
+	for (i = 0; i < 5; i++) {
+		if (read_rom(device, i, &rom[i]) != RCODE_COMPLETE)
+			return -1;
+		/* As per IEEE1212 7.2, during power-up, devices can
+		 * reply with a 0 for the first quadlet of the config
+		 * rom to indicate that they are booting (for example,
+		 * if the firmware is on the disk of a external
+		 * harddisk).  In that case we just fail, and the
+		 * retry mechanism will try again later. */
+		if (i == 0 && rom[i] == 0)
+			return -1;
+	}
+
+	/* Now parse the config rom.  The config rom is a recursive
+	 * directory structure so we parse it using a stack of
+	 * references to the blocks that make up the structure.  We
+	 * push a reference to the root directory on the stack to
+	 * start things off. */
+	length = i;
+	sp = 0;
+	stack[sp++] = 0xc0000005;
+	while (sp > 0) {
+		/* Pop the next block reference of the stack.  The
+		 * lower 24 bits is the offset into the config rom,
+		 * the upper 8 bits are the type of the reference the
+		 * block. */
+		key = stack[--sp];
+		i = key & 0xffffff;
+		if (i >= ARRAY_SIZE(rom))
+			/* The reference points outside the standard
+			 * config rom area, something's fishy. */
+			return -1;
+
+		/* Read header quadlet for the block to get the length. */
+		if (read_rom(device, i, &rom[i]) != RCODE_COMPLETE)
+			return -1;
+		end = i + (rom[i] >> 16) + 1;
+		i++;
+		if (end > ARRAY_SIZE(rom))
+			/* This block extends outside standard config
+			 * area (and the array we're reading it
+			 * into).  That's broken, so ignore this
+			 * device. */
+			return -1;
+
+		/* Now read in the block.  If this is a directory
+		 * block, check the entries as we read them to see if
+		 * it references another block, and push it in that case. */
+		while (i < end) {
+			if (read_rom(device, i, &rom[i]) != RCODE_COMPLETE)
+				return -1;
+			if ((key >> 30) == 3 && (rom[i] >> 30) > 1 &&
+			    sp < ARRAY_SIZE(stack))
+				stack[sp++] = i + rom[i];
+			i++;
+		}
+		if (length < i)
+			length = i;
+	}
+
+	device->config_rom = kmalloc(length * 4, GFP_KERNEL);
+	if (device->config_rom == NULL)
+		return -1;
+	memcpy(device->config_rom, rom, length * 4);
+	device->config_rom_length = length;
+
+	return 0;
+}
+
+static void fw_unit_release(struct device *dev)
+{
+	struct fw_unit *unit = fw_unit(dev);
+
+	kfree(unit);
+}
+
+static int is_fw_unit(struct device *dev)
+{
+	return dev->release == fw_unit_release;
+}
+
+static void create_units(struct fw_device *device)
+{
+	struct fw_csr_iterator ci;
+	struct fw_unit *unit;
+	int key, value, i;
+
+	i = 0;
+	fw_csr_iterator_init(&ci, &device->config_rom[5]);
+	while (fw_csr_iterator_next(&ci, &key, &value)) {
+		if (key != (CSR_UNIT | CSR_DIRECTORY))
+			continue;
+
+		/* Get the address of the unit directory and try to
+		 * match the drivers id_tables against it. */
+		unit = kzalloc(sizeof *unit, GFP_KERNEL);
+		if (unit == NULL) {
+			fw_error("failed to allocate memory for unit\n");
+			continue;
+		}
+
+		unit->directory = ci.p + value - 1;
+		unit->device.bus = &fw_bus_type;
+		unit->device.release = fw_unit_release;
+		unit->device.parent = &device->device;
+		snprintf(unit->device.bus_id, sizeof unit->device.bus_id,
+			 "%s.%d", device->device.bus_id, i++);
+
+		if (device_register(&unit->device) < 0) {
+			kfree(unit);
+			continue;
+		}
+
+		if (device_create_file(&unit->device, &modalias_attribute) < 0) {
+			device_unregister(&unit->device);
+			kfree(unit);
+		}
+	}
+}
+
+static int shutdown_unit(struct device *device, void *data)
+{
+	struct fw_unit *unit = fw_unit(device);
+
+	if (is_fw_unit(device)) {
+		device_remove_file(&unit->device, &modalias_attribute);
+		device_unregister(&unit->device);
+	}
+
+	return 0;
+}
+
+static void fw_device_shutdown(struct work_struct *work)
+{
+	struct fw_device *device =
+		container_of(work, struct fw_device, work.work);
+
+	device_remove_file(&device->device, &config_rom_attribute);
+	cdev_del(&device->cdev);
+	unregister_chrdev_region(device->device.devt, 1);
+	device_for_each_child(&device->device, NULL, shutdown_unit);
+	device_unregister(&device->device);
+}
+
+/* These defines control the retry behavior for reading the config
+ * rom.  It shouldn't be necessary to tweak these; if the device
+ * doesn't respond to a config rom read within 10 seconds, it's not
+ * going to respond at all.  As for the initial delay, a lot of
+ * devices will be able to respond within half a second after bus
+ * reset.  On the other hand, it's not really worth being more
+ * aggressive than that, since it scales pretty well; if 10 devices
+ * are plugged in, they're all getting read within one second. */
+
+#define MAX_RETRIES	5
+#define RETRY_DELAY	(2 * HZ)
+#define INITIAL_DELAY	(HZ / 2)
+
+static void fw_device_init(struct work_struct *work)
+{
+	static atomic_t serial = ATOMIC_INIT(-1);
+	struct fw_device *device =
+		container_of(work, struct fw_device, work.work);
+
+	/* All failure paths here set node->data to NULL, so that we
+	 * don't try to do device_for_each_child() on a kfree()'d
+	 * device. */
+
+	if (read_bus_info_block(device) < 0) {
+		if (device->config_rom_retries < MAX_RETRIES) {
+			device->config_rom_retries++;
+			schedule_delayed_work(&device->work, RETRY_DELAY);
+		} else {
+			fw_notify("giving up on config rom for node id %x\n",
+				  device->node_id);
+			if (device->node == device->card->root_node)
+				schedule_delayed_work(&device->card->work, 0);
+			fw_device_release(&device->device);
+		}
+		return;
+	}
+
+	device->device.bus = &fw_bus_type;
+	device->device.release = fw_device_release;
+	device->device.parent = device->card->device;
+	snprintf(device->device.bus_id, sizeof device->device.bus_id,
+		 "fw%d", atomic_inc_return(&serial));
+
+	if (alloc_chrdev_region(&device->device.devt, 0, 1, "fw")) {
+		fw_error("Failed to register char device region.\n");
+		goto error;
+	}
+
+	cdev_init(&device->cdev, &fw_device_ops);
+	device->cdev.owner = THIS_MODULE;
+	kobject_set_name(&device->cdev.kobj, device->device.bus_id);
+	if (cdev_add(&device->cdev, device->device.devt, 1)) {
+		fw_error("Failed to register char device.\n");
+		goto error;
+	}
+
+	if (device_add(&device->device)) {
+		fw_error("Failed to add device.\n");
+		goto error;
+	}
+
+	if (device_create_file(&device->device, &config_rom_attribute) < 0) {
+		fw_error("Failed to create config rom file.\n");
+		goto error_with_device;
+	}
+
+	create_units(device);
+
+	/* Transition the device to running state.  If it got pulled
+	 * out from under us while we did the intialization work, we
+	 * have to shut down the device again here.  Normally, though,
+	 * fw_node_event will be responsible for shutting it down when
+	 * necessary.  We have to use the atomic cmpxchg here to avoid
+	 * racing with the FW_NODE_DESTROYED case in
+	 * fw_node_event(). */
+	if (atomic_cmpxchg(&device->state,
+		    FW_DEVICE_INITIALIZING,
+		    FW_DEVICE_RUNNING) == FW_DEVICE_SHUTDOWN)
+		fw_device_shutdown(&device->work.work);
+	else
+		fw_notify("created new fw device %s (%d config rom retries)\n",
+			  device->device.bus_id, device->config_rom_retries);
+
+	/* Reschedule the IRM work if we just finished reading the
+	 * root node config rom.  If this races with a bus reset we
+	 * just end up running the IRM work a couple of extra times -
+	 * pretty harmless. */
+	if (device->node == device->card->root_node)
+		schedule_delayed_work(&device->card->work, 0);
+
+	return;
+
+      error_with_device:
+	device_del(&device->device);
+      error:
+	cdev_del(&device->cdev);
+	unregister_chrdev_region(device->device.devt, 1);
+	put_device(&device->device);
+}
+
+static int update_unit(struct device *dev, void *data)
+{
+	struct fw_unit *unit = fw_unit(dev);
+	struct fw_driver *driver = (struct fw_driver *)dev->driver;
+
+	if (is_fw_unit(dev) && driver != NULL && driver->update != NULL)
+		driver->update(unit);
+
+	return 0;
+}
+
+void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
+{
+	struct fw_device *device;
+
+	switch (event) {
+	case FW_NODE_CREATED:
+	case FW_NODE_LINK_ON:
+		if (!node->link_on)
+			break;
+
+		device = kzalloc(sizeof(*device), GFP_ATOMIC);
+		if (device == NULL)
+			break;
+
+		/* Do minimal intialization of the device here, the
+		 * rest will happen in fw_device_init().  We need the
+		 * card and node so we can read the config rom and we
+		 * need to do device_initialize() now so
+		 * device_for_each_child() in FW_NODE_UPDATED is
+		 * doesn't freak out. */
+		device_initialize(&device->device);
+		atomic_set(&device->state, FW_DEVICE_INITIALIZING);
+		device->card = fw_card_get(card);
+		device->node = fw_node_get(node);
+		device->node_id = node->node_id;
+		device->generation = card->generation;
+
+		/* Set the node data to point back to this device so
+		 * FW_NODE_UPDATED callbacks can update the node_id
+		 * and generation for the device. */
+		node->data = device;
+
+		/* Many devices are slow to respond after bus resets,
+		 * especially if they are bus powered and go through
+		 * power-up after getting plugged in.  We schedule the
+		 * first config rom scan half a second after bus reset. */
+		INIT_DELAYED_WORK(&device->work, fw_device_init);
+		schedule_delayed_work(&device->work, INITIAL_DELAY);
+		break;
+
+	case FW_NODE_UPDATED:
+		if (!node->link_on || node->data == NULL)
+			break;
+
+		device = node->data;
+		device->node_id = node->node_id;
+		device->generation = card->generation;
+		device_for_each_child(&device->device, NULL, update_unit);
+		break;
+
+	case FW_NODE_DESTROYED:
+	case FW_NODE_LINK_OFF:
+		if (!node->data)
+			break;
+
+		/* Destroy the device associated with the node.  There
+		 * are two cases here: either the device is fully
+		 * initialized (FW_DEVICE_RUNNING) or we're in the
+		 * process of reading its config rom
+		 * (FW_DEVICE_INITIALIZING).  If it is fully
+		 * initialized we can reuse device->work to schedule a
+		 * full fw_device_shutdown().  If not, there's work
+		 * scheduled to read it's config rom, and we just put
+		 * the device in shutdown state to have that code fail
+		 * to create the device. */
+		device = node->data;
+		if (atomic_xchg(&device->state,
+			 FW_DEVICE_SHUTDOWN) == FW_DEVICE_RUNNING) {
+			INIT_DELAYED_WORK(&device->work, fw_device_shutdown);
+			schedule_delayed_work(&device->work, 0);
+		}
+		break;
+	}
+}
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
new file mode 100644
index 0000000..402a785
--- /dev/null
+++ b/drivers/firewire/fw-device.h
@@ -0,0 +1,128 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-device.h - Device probing and sysfs code.
+ *
+ * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __fw_device_h
+#define __fw_device_h
+
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <asm/atomic.h>
+
+enum fw_device_state {
+	FW_DEVICE_INITIALIZING,
+	FW_DEVICE_RUNNING,
+	FW_DEVICE_SHUTDOWN,
+};
+
+struct fw_device {
+	atomic_t state;
+	struct fw_node *node;
+	int node_id;
+	int generation;
+	struct fw_card *card;
+	struct device device;
+	struct cdev cdev;
+	__be32 *config_rom;
+	size_t config_rom_length;
+	int config_rom_retries;
+	struct delayed_work work;
+};
+
+static inline struct fw_device *
+fw_device(struct device *dev)
+{
+	return container_of(dev, struct fw_device, device);
+}
+
+struct fw_device *fw_device_get(struct fw_device *device);
+void fw_device_put(struct fw_device *device);
+int fw_device_enable_phys_dma(struct fw_device *device);
+
+struct fw_unit {
+	struct device device;
+	u32 *directory;
+};
+
+static inline struct fw_unit *
+fw_unit(struct device *dev)
+{
+	return container_of(dev, struct fw_unit, device);
+}
+
+#define CSR_OFFSET	0x40
+#define CSR_LEAF	0x80
+#define CSR_DIRECTORY	0xc0
+
+#define CSR_DESCRIPTOR		0x01
+#define CSR_VENDOR		0x03
+#define CSR_HARDWARE_VERSION	0x04
+#define CSR_NODE_CAPABILITIES	0x0c
+#define CSR_UNIT		0x11
+#define CSR_SPECIFIER_ID	0x12
+#define CSR_VERSION		0x13
+#define CSR_DEPENDENT_INFO	0x14
+#define CSR_MODEL		0x17
+#define CSR_INSTANCE		0x18
+
+#define SBP2_COMMAND_SET_SPECIFIER	0x38
+#define SBP2_COMMAND_SET		0x39
+#define SBP2_COMMAND_SET_REVISION	0x3b
+#define SBP2_FIRMWARE_REVISION		0x3c
+
+struct fw_csr_iterator {
+	u32 *p;
+	u32 *end;
+};
+
+void fw_csr_iterator_init(struct fw_csr_iterator *ci, u32 *p);
+int fw_csr_iterator_next(struct fw_csr_iterator *ci,
+			 int *key, int *value);
+
+#define FW_MATCH_VENDOR		0x0001
+#define FW_MATCH_MODEL		0x0002
+#define FW_MATCH_SPECIFIER_ID	0x0004
+#define FW_MATCH_VERSION	0x0008
+
+struct fw_device_id {
+	u32 match_flags;
+	u32 vendor;
+	u32 model;
+	u32 specifier_id;
+	u32 version;
+	void *driver_data;
+};
+
+struct fw_driver {
+	struct device_driver driver;
+	/* Called when the parent device sits through a bus reset. */
+	void (*update) (struct fw_unit *unit);
+	const struct fw_device_id *id_table;
+};
+
+static inline struct fw_driver *
+fw_driver(struct device_driver *drv)
+{
+	return container_of(drv, struct fw_driver, driver);
+}
+
+extern const struct file_operations fw_device_ops;
+
+#endif /* __fw_device_h */
diff --git a/drivers/firewire/fw-iso.c b/drivers/firewire/fw-iso.c
new file mode 100644
index 0000000..6481e3d
--- /dev/null
+++ b/drivers/firewire/fw-iso.c
@@ -0,0 +1,142 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-iso.c - Isochronous IO
+ * Copyright (C) 2006 Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
+
+#include "fw-transaction.h"
+#include "fw-topology.h"
+#include "fw-device.h"
+
+static int
+setup_iso_buffer(struct fw_iso_context *ctx, size_t size,
+		 enum dma_data_direction direction)
+{
+	struct page *page;
+	int i, j;
+	void *p;
+
+	ctx->buffer_size = PAGE_ALIGN(size);
+	if (size == 0)
+		return 0;
+
+	ctx->buffer = vmalloc_32_user(ctx->buffer_size);
+	if (ctx->buffer == NULL)
+		goto fail_buffer_alloc;
+
+	ctx->page_count = ctx->buffer_size >> PAGE_SHIFT;
+	ctx->pages =
+	    kzalloc(ctx->page_count * sizeof(ctx->pages[0]), GFP_KERNEL);
+	if (ctx->pages == NULL)
+		goto fail_pages_alloc;
+
+	p = ctx->buffer;
+	for (i = 0; i < ctx->page_count; i++, p += PAGE_SIZE) {
+		page = vmalloc_to_page(p);
+		ctx->pages[i] = dma_map_page(ctx->card->device,
+					     page, 0, PAGE_SIZE, direction);
+		if (dma_mapping_error(ctx->pages[i]))
+			goto fail_mapping;
+	}
+
+	return 0;
+
+ fail_mapping:
+	for (j = 0; j < i; j++)
+		dma_unmap_page(ctx->card->device, ctx->pages[j],
+			       PAGE_SIZE, DMA_TO_DEVICE);
+ fail_pages_alloc:
+	vfree(ctx->buffer);
+ fail_buffer_alloc:
+	return -ENOMEM;
+}
+
+static void destroy_iso_buffer(struct fw_iso_context *ctx)
+{
+	int i;
+
+	for (i = 0; i < ctx->page_count; i++)
+		dma_unmap_page(ctx->card->device, ctx->pages[i],
+			       PAGE_SIZE, DMA_TO_DEVICE);
+
+	kfree(ctx->pages);
+	vfree(ctx->buffer);
+}
+
+struct fw_iso_context *fw_iso_context_create(struct fw_card *card, int type,
+					     size_t buffer_size,
+					     fw_iso_callback_t callback,
+					     void *callback_data)
+{
+	struct fw_iso_context *ctx;
+	int retval;
+
+	ctx = card->driver->allocate_iso_context(card, type);
+	if (IS_ERR(ctx))
+		return ctx;
+
+	ctx->card = card;
+	ctx->type = type;
+	ctx->callback = callback;
+	ctx->callback_data = callback_data;
+
+	retval = setup_iso_buffer(ctx, buffer_size, DMA_TO_DEVICE);
+	if (retval < 0) {
+		card->driver->free_iso_context(ctx);
+		return ERR_PTR(retval);
+	}
+
+	return ctx;
+}
+EXPORT_SYMBOL(fw_iso_context_create);
+
+void fw_iso_context_destroy(struct fw_iso_context *ctx)
+{
+	struct fw_card *card = ctx->card;
+
+	destroy_iso_buffer(ctx);
+
+	card->driver->free_iso_context(ctx);
+}
+EXPORT_SYMBOL(fw_iso_context_destroy);
+
+int
+fw_iso_context_send(struct fw_iso_context *ctx,
+		    int channel, int speed, int cycle)
+{
+	ctx->channel = channel;
+	ctx->speed = speed;
+
+	return ctx->card->driver->send_iso(ctx, cycle);
+}
+EXPORT_SYMBOL(fw_iso_context_send);
+
+int
+fw_iso_context_queue(struct fw_iso_context *ctx,
+		     struct fw_iso_packet *packet, void *payload)
+{
+	struct fw_card *card = ctx->card;
+
+	return card->driver->queue_iso(ctx, packet, payload);
+}
+EXPORT_SYMBOL(fw_iso_context_queue);
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
new file mode 100644
index 0000000..4512edb
--- /dev/null
+++ b/drivers/firewire/fw-ohci.c
@@ -0,0 +1,1622 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-ohci.c - Driver for OHCI 1394 boards
+ * Copyright (C) 2003-2006 Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/poll.h>
+#include <linux/dma-mapping.h>
+
+#include <asm/uaccess.h>
+#include <asm/semaphore.h>
+
+#include "fw-transaction.h"
+#include "fw-ohci.h"
+
+#define descriptor_output_more		0
+#define descriptor_output_last		(1 << 12)
+#define descriptor_input_more		(2 << 12)
+#define descriptor_input_last		(3 << 12)
+#define descriptor_status		(1 << 11)
+#define descriptor_key_immediate	(2 << 8)
+#define descriptor_ping			(1 << 7)
+#define descriptor_yy			(1 << 6)
+#define descriptor_no_irq		(0 << 4)
+#define descriptor_irq_error		(1 << 4)
+#define descriptor_irq_always		(3 << 4)
+#define descriptor_branch_always	(3 << 2)
+
+struct descriptor {
+	__le16 req_count;
+	__le16 control;
+	__le32 data_address;
+	__le32 branch_address;
+	__le16 res_count;
+	__le16 transfer_status;
+} __attribute__((aligned(16)));
+
+#define control_set(regs)	(regs)
+#define control_clear(regs)	((regs) + 4)
+#define command_ptr(regs)	((regs) + 12)
+#define context_match(regs)	((regs) + 16)
+
+struct ar_buffer {
+	struct descriptor descriptor;
+	struct ar_buffer *next;
+	__le32 data[0];
+};
+
+struct ar_context {
+	struct fw_ohci *ohci;
+	struct ar_buffer *current_buffer;
+	struct ar_buffer *last_buffer;
+	void *pointer;
+	u32 regs;
+	struct tasklet_struct tasklet;
+};
+
+struct at_context {
+	struct fw_ohci *ohci;
+	dma_addr_t descriptor_bus;
+	dma_addr_t buffer_bus;
+	struct fw_packet *current_packet;
+
+	struct list_head list;
+
+	struct {
+		struct descriptor more;
+		__le32 header[4];
+		struct descriptor last;
+	} d;
+
+	u32 regs;
+
+	struct tasklet_struct tasklet;
+};
+
+#define it_header_sy(v)          ((v) <<  0)
+#define it_header_tcode(v)       ((v) <<  4)
+#define it_header_channel(v)     ((v) <<  8)
+#define it_header_tag(v)         ((v) << 14)
+#define it_header_speed(v)       ((v) << 16)
+#define it_header_data_length(v) ((v) << 16)
+
+struct iso_context {
+	struct fw_iso_context base;
+	struct tasklet_struct tasklet;
+	u32 regs;
+
+	struct descriptor *buffer;
+	dma_addr_t buffer_bus;
+	struct descriptor *head_descriptor;
+	struct descriptor *tail_descriptor;
+	struct descriptor *tail_descriptor_last;
+	struct descriptor *prev_descriptor;
+};
+
+#define CONFIG_ROM_SIZE 1024
+
+struct fw_ohci {
+	struct fw_card card;
+
+	__iomem char *registers;
+	dma_addr_t self_id_bus;
+	__le32 *self_id_cpu;
+	struct tasklet_struct bus_reset_tasklet;
+	int node_id;
+	int generation;
+	int request_generation;
+
+	/* Spinlock for accessing fw_ohci data.  Never call out of
+	 * this driver with this lock held. */
+	spinlock_t lock;
+	u32 self_id_buffer[512];
+
+	/* Config rom buffers */
+	__be32 *config_rom;
+	dma_addr_t config_rom_bus;
+	__be32 *next_config_rom;
+	dma_addr_t next_config_rom_bus;
+	u32 next_header;
+
+	struct ar_context ar_request_ctx;
+	struct ar_context ar_response_ctx;
+	struct at_context at_request_ctx;
+	struct at_context at_response_ctx;
+
+	u32 it_context_mask;
+	struct iso_context *it_context_list;
+	u32 ir_context_mask;
+	struct iso_context *ir_context_list;
+};
+
+static inline struct fw_ohci *fw_ohci(struct fw_card *card)
+{
+	return container_of(card, struct fw_ohci, card);
+}
+
+#define CONTEXT_CYCLE_MATCH_ENABLE	0x80000000
+
+#define CONTEXT_RUN	0x8000
+#define CONTEXT_WAKE	0x1000
+#define CONTEXT_DEAD	0x0800
+#define CONTEXT_ACTIVE	0x0400
+
+#define OHCI1394_MAX_AT_REQ_RETRIES	0x2
+#define OHCI1394_MAX_AT_RESP_RETRIES	0x2
+#define OHCI1394_MAX_PHYS_RESP_RETRIES	0x8
+
+#define FW_OHCI_MAJOR			240
+#define OHCI1394_REGISTER_SIZE		0x800
+#define OHCI_LOOP_COUNT			500
+#define OHCI1394_PCI_HCI_Control	0x40
+#define SELF_ID_BUF_SIZE		0x800
+#define OHCI_TCODE_PHY_PACKET		0x0e
+
+static char ohci_driver_name[] = KBUILD_MODNAME;
+
+static inline void reg_write(const struct fw_ohci *ohci, int offset, u32 data)
+{
+	writel(data, ohci->registers + offset);
+}
+
+static inline u32 reg_read(const struct fw_ohci *ohci, int offset)
+{
+	return readl(ohci->registers + offset);
+}
+
+static inline void flush_writes(const struct fw_ohci *ohci)
+{
+	/* Do a dummy read to flush writes. */
+	reg_read(ohci, OHCI1394_Version);
+}
+
+static int
+ohci_update_phy_reg(struct fw_card *card, int addr,
+		    int clear_bits, int set_bits)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+	u32 val, old;
+
+	reg_write(ohci, OHCI1394_PhyControl, OHCI1394_PhyControl_Read(addr));
+	msleep(2);
+	val = reg_read(ohci, OHCI1394_PhyControl);
+	if ((val & OHCI1394_PhyControl_ReadDone) == 0) {
+		fw_error("failed to set phy reg bits.\n");
+		return -EBUSY;
+	}
+
+	old = OHCI1394_PhyControl_ReadData(val);
+	old = (old & ~clear_bits) | set_bits;
+	reg_write(ohci, OHCI1394_PhyControl,
+		  OHCI1394_PhyControl_Write(addr, old));
+
+	return 0;
+}
+
+static int ar_context_add_page(struct ar_context *ctx)
+{
+	struct device *dev = ctx->ohci->card.device;
+	struct ar_buffer *ab;
+	dma_addr_t ab_bus;
+	size_t offset;
+
+	ab = (struct ar_buffer *) __get_free_page(GFP_ATOMIC);
+	if (ab == NULL)
+		return -ENOMEM;
+
+	ab_bus = dma_map_single(dev, ab, PAGE_SIZE, DMA_BIDIRECTIONAL);
+	if (dma_mapping_error(ab_bus)) {
+		free_page((unsigned long) ab);
+		return -ENOMEM;
+	}
+
+	memset(&ab->descriptor, 0, sizeof ab->descriptor);
+	ab->descriptor.control        = cpu_to_le16(descriptor_input_more |
+						    descriptor_status |
+						    descriptor_branch_always);
+	offset = offsetof(struct ar_buffer, data);
+	ab->descriptor.req_count      = cpu_to_le16(PAGE_SIZE - offset);
+	ab->descriptor.data_address   = cpu_to_le32(ab_bus + offset);
+	ab->descriptor.res_count      = cpu_to_le16(PAGE_SIZE - offset);
+	ab->descriptor.branch_address = 0;
+
+	dma_sync_single_for_device(dev, ab_bus, PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+	ctx->last_buffer->descriptor.branch_address = ab_bus | 1;
+	ctx->last_buffer->next = ab;
+	ctx->last_buffer = ab;
+
+	reg_write(ctx->ohci, control_set(ctx->regs), CONTEXT_WAKE);
+	flush_writes(ctx->ohci);
+
+	return 0;
+}
+
+static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
+{
+	struct fw_ohci *ohci = ctx->ohci;
+	struct fw_packet p;
+	u32 status, length, tcode;
+
+	p.header[0] = le32_to_cpu(buffer[0]);
+	p.header[1] = le32_to_cpu(buffer[1]);
+	p.header[2] = le32_to_cpu(buffer[2]);
+
+	tcode = (p.header[0] >> 4) & 0x0f;
+	switch (tcode) {
+	case TCODE_WRITE_QUADLET_REQUEST:
+	case TCODE_READ_QUADLET_RESPONSE:
+		p.header[3] = (__force __u32) buffer[3];
+		p.header_length = 16;
+		p.payload_length = 0;
+		break;
+
+	case TCODE_READ_BLOCK_REQUEST :
+		p.header[3] = le32_to_cpu(buffer[3]);
+		p.header_length = 16;
+		p.payload_length = 0;
+		break;
+
+	case TCODE_WRITE_BLOCK_REQUEST:
+	case TCODE_READ_BLOCK_RESPONSE:
+	case TCODE_LOCK_REQUEST:
+	case TCODE_LOCK_RESPONSE:
+		p.header[3] = le32_to_cpu(buffer[3]);
+		p.header_length = 16;
+		p.payload_length = p.header[3] >> 16;
+		break;
+
+	case TCODE_WRITE_RESPONSE:
+	case TCODE_READ_QUADLET_REQUEST:
+	case OHCI_TCODE_PHY_PACKET:
+		p.header_length = 12;
+		p.payload_length = 0;
+		break;
+	}
+
+	p.payload = (void *) buffer + p.header_length;
+
+	/* FIXME: What to do about evt_* errors? */
+	length = (p.header_length + p.payload_length + 3) / 4;
+	status = le32_to_cpu(buffer[length]);
+
+	p.ack        = ((status >> 16) & 0x1f) - 16;
+	p.speed      = (status >> 21) & 0x7;
+	p.timestamp  = status & 0xffff;
+	p.generation = ohci->request_generation;
+
+	/* The OHCI bus reset handler synthesizes a phy packet with
+	 * the new generation number when a bus reset happens (see
+	 * section 8.4.2.3).  This helps us determine when a request
+	 * was received and make sure we send the response in the same
+	 * generation.  We only need this for requests; for responses
+	 * we use the unique tlabel for finding the matching
+	 * request. */
+
+	if (p.ack + 16 == 0x09)
+		ohci->request_generation = (buffer[2] >> 16) & 0xff;
+	else if (ctx == &ohci->ar_request_ctx)
+		fw_core_handle_request(&ohci->card, &p);
+	else
+		fw_core_handle_response(&ohci->card, &p);
+
+	return buffer + length + 1;
+}
+
+static void ar_context_tasklet(unsigned long data)
+{
+	struct ar_context *ctx = (struct ar_context *)data;
+	struct fw_ohci *ohci = ctx->ohci;
+	struct ar_buffer *ab;
+	struct descriptor *d;
+	void *buffer, *end;
+
+	ab = ctx->current_buffer;
+	d = &ab->descriptor;
+
+	if (d->res_count == 0) {
+		size_t size, rest, offset;
+
+		/* This descriptor is finished and we may have a
+		 * packet split across this and the next buffer. We
+		 * reuse the page for reassembling the split packet. */
+
+		offset = offsetof(struct ar_buffer, data);
+		dma_unmap_single(ohci->card.device,
+				 ab->descriptor.data_address - offset,
+				 PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+		buffer = ab;
+		ab = ab->next;
+		d = &ab->descriptor;
+		size = buffer + PAGE_SIZE - ctx->pointer;
+		rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
+		memmove(buffer, ctx->pointer, size);
+		memcpy(buffer + size, ab->data, rest);
+		ctx->current_buffer = ab;
+		ctx->pointer = (void *) ab->data + rest;
+		end = buffer + size + rest;
+
+		while (buffer < end)
+			buffer = handle_ar_packet(ctx, buffer);
+
+		free_page((unsigned long)buffer);
+		ar_context_add_page(ctx);
+	} else {
+		buffer = ctx->pointer;
+		ctx->pointer = end =
+			(void *) ab + PAGE_SIZE - le16_to_cpu(d->res_count);
+
+		while (buffer < end)
+			buffer = handle_ar_packet(ctx, buffer);
+	}
+}
+
+static int
+ar_context_init(struct ar_context *ctx, struct fw_ohci *ohci, u32 regs)
+{
+	struct ar_buffer ab;
+
+	ctx->regs        = regs;
+	ctx->ohci        = ohci;
+	ctx->last_buffer = &ab;
+	tasklet_init(&ctx->tasklet, ar_context_tasklet, (unsigned long)ctx);
+
+	ar_context_add_page(ctx);
+	ar_context_add_page(ctx);
+	ctx->current_buffer = ab.next;
+	ctx->pointer = ctx->current_buffer->data;
+
+	reg_write(ctx->ohci, command_ptr(ctx->regs), ab.descriptor.branch_address);
+	reg_write(ctx->ohci, control_set(ctx->regs), CONTEXT_RUN);
+	flush_writes(ctx->ohci);
+
+	return 0;
+}
+
+static void
+do_packet_callbacks(struct fw_ohci *ohci, struct list_head *list)
+{
+	struct fw_packet *p, *next;
+
+	list_for_each_entry_safe(p, next, list, link)
+		p->callback(p, &ohci->card, p->ack);
+}
+
+static void
+complete_transmission(struct fw_packet *packet,
+		      int ack, struct list_head *list)
+{
+	list_move_tail(&packet->link, list);
+	packet->ack = ack;
+}
+
+/* This function prepares the first packet in the context queue for
+ * transmission.  Must always be called with the ochi->lock held to
+ * ensure proper generation handling and locking around packet queue
+ * manipulation. */
+static void
+at_context_setup_packet(struct at_context *ctx, struct list_head *list)
+{
+	struct fw_packet *packet;
+	struct fw_ohci *ohci = ctx->ohci;
+	int z, tcode;
+
+	packet = fw_packet(ctx->list.next);
+
+	memset(&ctx->d, 0, sizeof ctx->d);
+	if (packet->payload_length > 0) {
+		packet->payload_bus = dma_map_single(ohci->card.device,
+						     packet->payload,
+						     packet->payload_length,
+						     DMA_TO_DEVICE);
+		if (dma_mapping_error(packet->payload_bus)) {
+			complete_transmission(packet, RCODE_SEND_ERROR, list);
+			return;
+		}
+
+		ctx->d.more.control      =
+			cpu_to_le16(descriptor_output_more |
+				    descriptor_key_immediate);
+		ctx->d.more.req_count    = cpu_to_le16(packet->header_length);
+		ctx->d.more.res_count    = cpu_to_le16(packet->timestamp);
+		ctx->d.last.control      =
+			cpu_to_le16(descriptor_output_last |
+				    descriptor_irq_always |
+				    descriptor_branch_always);
+		ctx->d.last.req_count    = cpu_to_le16(packet->payload_length);
+		ctx->d.last.data_address = cpu_to_le32(packet->payload_bus);
+		z = 3;
+	} else {
+		ctx->d.more.control   =
+			cpu_to_le16(descriptor_output_last |
+				    descriptor_key_immediate |
+				    descriptor_irq_always |
+				    descriptor_branch_always);
+		ctx->d.more.req_count = cpu_to_le16(packet->header_length);
+		ctx->d.more.res_count = cpu_to_le16(packet->timestamp);
+		z = 2;
+	}
+
+	/* The DMA format for asyncronous link packets is different
+	 * from the IEEE1394 layout, so shift the fields around
+	 * accordingly.  If header_length is 8, it's a PHY packet, to
+	 * which we need to prepend an extra quadlet. */
+	if (packet->header_length > 8) {
+		ctx->d.header[0] = cpu_to_le32((packet->header[0] & 0xffff) |
+					       (packet->speed << 16));
+		ctx->d.header[1] = cpu_to_le32((packet->header[1] & 0xffff) |
+					       (packet->header[0] & 0xffff0000));
+		ctx->d.header[2] = cpu_to_le32(packet->header[2]);
+
+		tcode = (packet->header[0] >> 4) & 0x0f;
+		if (TCODE_IS_BLOCK_PACKET(tcode))
+			ctx->d.header[3] = cpu_to_le32(packet->header[3]);
+		else
+			ctx->d.header[3] = packet->header[3];
+	} else {
+		ctx->d.header[0] =
+			cpu_to_le32((OHCI1394_phy_tcode << 4) |
+				    (packet->speed << 16));
+		ctx->d.header[1] = cpu_to_le32(packet->header[0]);
+		ctx->d.header[2] = cpu_to_le32(packet->header[1]);
+		ctx->d.more.req_count = cpu_to_le16(12);
+	}
+
+	/* FIXME: Document how the locking works. */
+	if (ohci->generation == packet->generation) {
+		reg_write(ctx->ohci, command_ptr(ctx->regs),
+			  ctx->descriptor_bus | z);
+		reg_write(ctx->ohci, control_set(ctx->regs),
+			  CONTEXT_RUN | CONTEXT_WAKE);
+		ctx->current_packet = packet;
+	} else {
+		/* We dont return error codes from this function; all
+		 * transmission errors are reported through the
+		 * callback. */
+		complete_transmission(packet, RCODE_GENERATION, list);
+	}
+}
+
+static void at_context_stop(struct at_context *ctx)
+{
+	u32 reg;
+
+	reg_write(ctx->ohci, control_clear(ctx->regs), CONTEXT_RUN);
+
+	reg = reg_read(ctx->ohci, control_set(ctx->regs));
+	if (reg & CONTEXT_ACTIVE)
+		fw_notify("Tried to stop context, but it is still active "
+			  "(0x%08x).\n", reg);
+}
+
+static void at_context_tasklet(unsigned long data)
+{
+	struct at_context *ctx = (struct at_context *)data;
+	struct fw_ohci *ohci = ctx->ohci;
+	struct fw_packet *packet;
+	LIST_HEAD(list);
+	unsigned long flags;
+	int evt;
+
+	spin_lock_irqsave(&ohci->lock, flags);
+
+	packet = fw_packet(ctx->list.next);
+
+	at_context_stop(ctx);
+
+	/* If the head of the list isn't the packet that just got
+	 * transmitted, the packet got cancelled before we finished
+	 * transmitting it. */
+	if (ctx->current_packet != packet)
+		goto skip_to_next;
+
+	if (packet->payload_length > 0) {
+		dma_unmap_single(ohci->card.device, packet->payload_bus,
+				 packet->payload_length, DMA_TO_DEVICE);
+		evt = le16_to_cpu(ctx->d.last.transfer_status) & 0x1f;
+		packet->timestamp = le16_to_cpu(ctx->d.last.res_count);
+	}
+	else {
+		evt = le16_to_cpu(ctx->d.more.transfer_status) & 0x1f;
+		packet->timestamp = le16_to_cpu(ctx->d.more.res_count);
+	}
+
+	if (evt < 16) {
+		switch (evt) {
+		case OHCI1394_evt_timeout:
+			/* Async response transmit timed out. */
+			complete_transmission(packet, RCODE_CANCELLED, &list);
+			break;
+
+		case OHCI1394_evt_flushed:
+			/* The packet was flushed should give same
+			 * error as when we try to use a stale
+			 * generation count. */
+			complete_transmission(packet,
+					      RCODE_GENERATION, &list);
+			break;
+
+		case OHCI1394_evt_missing_ack:
+			/* Using a valid (current) generation count,
+			 * but the node is not on the bus or not
+			 * sending acks. */
+			complete_transmission(packet, RCODE_NO_ACK, &list);
+			break;
+
+		default:
+			complete_transmission(packet, RCODE_SEND_ERROR, &list);
+			break;
+		}
+	} else
+		complete_transmission(packet, evt - 16, &list);
+
+ skip_to_next:
+	/* If more packets are queued, set up the next one. */
+	if (!list_empty(&ctx->list))
+		at_context_setup_packet(ctx, &list);
+
+	spin_unlock_irqrestore(&ohci->lock, flags);
+
+	do_packet_callbacks(ohci, &list);
+}
+
+static int
+at_context_init(struct at_context *ctx, struct fw_ohci *ohci, u32 regs)
+{
+	INIT_LIST_HEAD(&ctx->list);
+
+	ctx->descriptor_bus =
+		dma_map_single(ohci->card.device, &ctx->d,
+			       sizeof ctx->d, DMA_TO_DEVICE);
+	if (dma_mapping_error(ctx->descriptor_bus))
+		return -ENOMEM;
+
+	ctx->regs = regs;
+	ctx->ohci = ohci;
+
+	tasklet_init(&ctx->tasklet, at_context_tasklet, (unsigned long)ctx);
+
+	return 0;
+}
+
+#define header_get_destination(q)	(((q) >> 16) & 0xffff)
+#define header_get_tcode(q)		(((q) >> 4) & 0x0f)
+#define header_get_offset_high(q)	(((q) >> 0) & 0xffff)
+#define header_get_data_length(q)	(((q) >> 16) & 0xffff)
+#define header_get_extended_tcode(q)	(((q) >> 0) & 0xffff)
+
+static void
+handle_local_rom(struct fw_ohci *ohci, struct fw_packet *packet, u32 csr)
+{
+	struct fw_packet response;
+	int tcode, length, i;
+
+	tcode = header_get_tcode(packet->header[0]);
+	if (TCODE_IS_BLOCK_PACKET(tcode))
+		length = header_get_data_length(packet->header[3]);
+	else
+		length = 4;
+
+	i = csr - CSR_CONFIG_ROM;
+	if (i + length > CONFIG_ROM_SIZE) {
+		fw_fill_response(&response, packet->header,
+				 RCODE_ADDRESS_ERROR, NULL, 0);
+	} else if (!TCODE_IS_READ_REQUEST(tcode)) {
+		fw_fill_response(&response, packet->header,
+				 RCODE_TYPE_ERROR, NULL, 0);
+	} else {
+		fw_fill_response(&response, packet->header, RCODE_COMPLETE,
+				 (void *) ohci->config_rom + i, length);
+	}
+
+	fw_core_handle_response(&ohci->card, &response);
+}
+
+static void
+handle_local_lock(struct fw_ohci *ohci, struct fw_packet *packet, u32 csr)
+{
+	struct fw_packet response;
+	int tcode, length, ext_tcode, sel;
+	__be32 *payload, lock_old;
+	u32 lock_arg, lock_data;
+
+	tcode = header_get_tcode(packet->header[0]);
+	length = header_get_data_length(packet->header[3]);
+	payload = packet->payload;
+	ext_tcode = header_get_extended_tcode(packet->header[3]);
+
+	if (tcode == TCODE_LOCK_REQUEST &&
+	    ext_tcode == EXTCODE_COMPARE_SWAP && length == 8) {
+		lock_arg = be32_to_cpu(payload[0]);
+		lock_data = be32_to_cpu(payload[1]);
+	} else if (tcode == TCODE_READ_QUADLET_REQUEST) {
+		lock_arg = 0;
+		lock_data = 0;
+	} else {
+		fw_fill_response(&response, packet->header,
+				 RCODE_TYPE_ERROR, NULL, 0);
+		goto out;
+	}
+
+	sel = (csr - CSR_BUS_MANAGER_ID) / 4;
+	reg_write(ohci, OHCI1394_CSRData, lock_data);
+	reg_write(ohci, OHCI1394_CSRCompareData, lock_arg);
+	reg_write(ohci, OHCI1394_CSRControl, sel);
+
+	if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000)
+		lock_old = cpu_to_be32(reg_read(ohci, OHCI1394_CSRData));
+	else
+		fw_notify("swap not done yet\n");
+
+	fw_fill_response(&response, packet->header,
+			 RCODE_COMPLETE, &lock_old, sizeof lock_old);
+ out:
+	fw_core_handle_response(&ohci->card, &response);
+}
+
+static void
+handle_local_request(struct at_context *ctx, struct fw_packet *packet)
+{
+	u64 offset;
+	u32 csr;
+
+	packet->ack = ACK_PENDING;
+	packet->callback(packet, &ctx->ohci->card, packet->ack);
+
+	offset =
+		((unsigned long long)
+		 header_get_offset_high(packet->header[1]) << 32) |
+		packet->header[2];
+	csr = offset - CSR_REGISTER_BASE;
+
+	/* Handle config rom reads. */
+	if (csr >= CSR_CONFIG_ROM && csr < CSR_CONFIG_ROM_END)
+		handle_local_rom(ctx->ohci, packet, csr);
+	else switch (csr) {
+	case CSR_BUS_MANAGER_ID:
+	case CSR_BANDWIDTH_AVAILABLE:
+	case CSR_CHANNELS_AVAILABLE_HI:
+	case CSR_CHANNELS_AVAILABLE_LO:
+		handle_local_lock(ctx->ohci, packet, csr);
+		break;
+	default:
+		if (ctx == &ctx->ohci->at_request_ctx)
+			fw_core_handle_request(&ctx->ohci->card, packet);
+		else
+			fw_core_handle_response(&ctx->ohci->card, packet);
+		break;
+	}
+}
+
+static void
+at_context_transmit(struct at_context *ctx, struct fw_packet *packet)
+{
+	LIST_HEAD(list);
+	unsigned long flags;
+
+	spin_lock_irqsave(&ctx->ohci->lock, flags);
+
+	if (header_get_destination(packet->header[0]) == ctx->ohci->node_id &&
+	    ctx->ohci->generation == packet->generation) {
+		spin_unlock_irqrestore(&ctx->ohci->lock, flags);
+		handle_local_request(ctx, packet);
+		return;
+	}
+
+	list_add_tail(&packet->link, &ctx->list);
+	if (ctx->list.next == &packet->link)
+		at_context_setup_packet(ctx, &list);
+
+	spin_unlock_irqrestore(&ctx->ohci->lock, flags);
+
+	do_packet_callbacks(ctx->ohci, &list);
+}
+
+static void bus_reset_tasklet(unsigned long data)
+{
+	struct fw_ohci *ohci = (struct fw_ohci *)data;
+	int self_id_count, i, j, reg;
+	int generation, new_generation;
+	unsigned long flags;
+
+	reg = reg_read(ohci, OHCI1394_NodeID);
+	if (!(reg & OHCI1394_NodeID_idValid)) {
+		fw_error("node ID not valid, new bus reset in progress\n");
+		return;
+	}
+	ohci->node_id = reg & 0xffff;
+
+	/* The count in the SelfIDCount register is the number of
+	 * bytes in the self ID receive buffer.  Since we also receive
+	 * the inverted quadlets and a header quadlet, we shift one
+	 * bit extra to get the actual number of self IDs. */
+
+	self_id_count = (reg_read(ohci, OHCI1394_SelfIDCount) >> 3) & 0x3ff;
+	generation = (le32_to_cpu(ohci->self_id_cpu[0]) >> 16) & 0xff;
+
+	for (i = 1, j = 0; j < self_id_count; i += 2, j++) {
+		if (ohci->self_id_cpu[i] != ~ohci->self_id_cpu[i + 1])
+			fw_error("inconsistent self IDs\n");
+		ohci->self_id_buffer[j] = le32_to_cpu(ohci->self_id_cpu[i]);
+	}
+
+	/* Check the consistency of the self IDs we just read.  The
+	 * problem we face is that a new bus reset can start while we
+	 * read out the self IDs from the DMA buffer. If this happens,
+	 * the DMA buffer will be overwritten with new self IDs and we
+	 * will read out inconsistent data.  The OHCI specification
+	 * (section 11.2) recommends a technique similar to
+	 * linux/seqlock.h, where we remember the generation of the
+	 * self IDs in the buffer before reading them out and compare
+	 * it to the current generation after reading them out.  If
+	 * the two generations match we know we have a consistent set
+	 * of self IDs. */
+
+	new_generation = (reg_read(ohci, OHCI1394_SelfIDCount) >> 16) & 0xff;
+	if (new_generation != generation) {
+		fw_notify("recursive bus reset detected, "
+			  "discarding self ids\n");
+		return;
+	}
+
+	/* FIXME: Document how the locking works. */
+	spin_lock_irqsave(&ohci->lock, flags);
+
+	ohci->generation = generation;
+	at_context_stop(&ohci->at_request_ctx);
+	at_context_stop(&ohci->at_response_ctx);
+	reg_write(ohci, OHCI1394_IntEventClear, OHCI1394_busReset);
+
+	/* This next bit is unrelated to the AT context stuff but we
+	 * have to do it under the spinlock also.  If a new config rom
+	 * was set up before this reset, the old one is now no longer
+	 * in use and we can free it. Update the config rom pointers
+	 * to point to the current config rom and clear the
+	 * next_config_rom pointer so a new udpate can take place. */
+
+	if (ohci->next_config_rom != NULL) {
+		dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+				  ohci->config_rom, ohci->config_rom_bus);
+		ohci->config_rom      = ohci->next_config_rom;
+		ohci->config_rom_bus  = ohci->next_config_rom_bus;
+		ohci->next_config_rom = NULL;
+
+		/* Restore config_rom image and manually update
+		 * config_rom registers.  Writing the header quadlet
+		 * will indicate that the config rom is ready, so we
+		 * do that last. */
+		reg_write(ohci, OHCI1394_BusOptions,
+			  be32_to_cpu(ohci->config_rom[2]));
+		ohci->config_rom[0] = cpu_to_be32(ohci->next_header);
+		reg_write(ohci, OHCI1394_ConfigROMhdr, ohci->next_header);
+	}
+
+	spin_unlock_irqrestore(&ohci->lock, flags);
+
+	fw_core_handle_bus_reset(&ohci->card, ohci->node_id, generation,
+				 self_id_count, ohci->self_id_buffer);
+}
+
+static irqreturn_t irq_handler(int irq, void *data)
+{
+	struct fw_ohci *ohci = data;
+	u32 event, iso_event;
+	int i;
+
+	event = reg_read(ohci, OHCI1394_IntEventClear);
+
+	if (!event)
+		return IRQ_NONE;
+
+	reg_write(ohci, OHCI1394_IntEventClear, event);
+
+	if (event & OHCI1394_selfIDComplete)
+		tasklet_schedule(&ohci->bus_reset_tasklet);
+
+	if (event & OHCI1394_RQPkt)
+		tasklet_schedule(&ohci->ar_request_ctx.tasklet);
+
+	if (event & OHCI1394_RSPkt)
+		tasklet_schedule(&ohci->ar_response_ctx.tasklet);
+
+	if (event & OHCI1394_reqTxComplete)
+		tasklet_schedule(&ohci->at_request_ctx.tasklet);
+
+	if (event & OHCI1394_respTxComplete)
+		tasklet_schedule(&ohci->at_response_ctx.tasklet);
+
+	iso_event = reg_read(ohci, OHCI1394_IsoRecvIntEventSet);
+	reg_write(ohci, OHCI1394_IsoRecvIntEventClear, iso_event);
+
+	while (iso_event) {
+		i = ffs(iso_event) - 1;
+		tasklet_schedule(&ohci->ir_context_list[i].tasklet);
+		iso_event &= ~(1 << i);
+	}
+
+	iso_event = reg_read(ohci, OHCI1394_IsoXmitIntEventSet);
+	reg_write(ohci, OHCI1394_IsoXmitIntEventClear, iso_event);
+
+	while (iso_event) {
+		i = ffs(iso_event) - 1;
+		tasklet_schedule(&ohci->it_context_list[i].tasklet);
+		iso_event &= ~(1 << i);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int ohci_enable(struct fw_card *card, u32 *config_rom, size_t length)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+	struct pci_dev *dev = to_pci_dev(card->device);
+
+	/* When the link is not yet enabled, the atomic config rom
+	 * update mechanism described below in ohci_set_config_rom()
+	 * is not active.  We have to update ConfigRomHeader and
+	 * BusOptions manually, and the write to ConfigROMmap takes
+	 * effect immediately.  We tie this to the enabling of the
+	 * link, so we have a valid config rom before enabling - the
+	 * OHCI requires that ConfigROMhdr and BusOptions have valid
+	 * values before enabling.
+	 *
+	 * However, when the ConfigROMmap is written, some controllers
+	 * always read back quadlets 0 and 2 from the config rom to
+	 * the ConfigRomHeader and BusOptions registers on bus reset.
+	 * They shouldn't do that in this initial case where the link
+	 * isn't enabled.  This means we have to use the same
+	 * workaround here, setting the bus header to 0 and then write
+	 * the right values in the bus reset tasklet.
+	 */
+
+	ohci->next_config_rom =
+		dma_alloc_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+				   &ohci->next_config_rom_bus, GFP_KERNEL);
+	if (ohci->next_config_rom == NULL)
+		return -ENOMEM;
+
+	memset(ohci->next_config_rom, 0, CONFIG_ROM_SIZE);
+	fw_memcpy_to_be32(ohci->next_config_rom, config_rom, length * 4);
+
+	ohci->next_header = config_rom[0];
+	ohci->next_config_rom[0] = 0;
+	reg_write(ohci, OHCI1394_ConfigROMhdr, 0);
+	reg_write(ohci, OHCI1394_BusOptions, config_rom[2]);
+	reg_write(ohci, OHCI1394_ConfigROMmap, ohci->next_config_rom_bus);
+
+	reg_write(ohci, OHCI1394_AsReqFilterHiSet, 0x80000000);
+
+	if (request_irq(dev->irq, irq_handler,
+			SA_SHIRQ, ohci_driver_name, ohci)) {
+		fw_error("Failed to allocate shared interrupt %d.\n",
+			 dev->irq);
+		dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+				  ohci->config_rom, ohci->config_rom_bus);
+		return -EIO;
+	}
+
+	reg_write(ohci, OHCI1394_HCControlSet,
+		  OHCI1394_HCControl_linkEnable |
+		  OHCI1394_HCControl_BIBimageValid);
+	flush_writes(ohci);
+
+	/* We are ready to go, initiate bus reset to finish the
+	 * initialization. */
+
+	fw_core_initiate_bus_reset(&ohci->card, 1);
+
+	return 0;
+}
+
+static int
+ohci_set_config_rom(struct fw_card *card, u32 *config_rom, size_t length)
+{
+	struct fw_ohci *ohci;
+	unsigned long flags;
+	int retval = 0;
+	__be32 *next_config_rom;
+	dma_addr_t next_config_rom_bus;
+
+	ohci = fw_ohci(card);
+
+	/* When the OHCI controller is enabled, the config rom update
+	 * mechanism is a bit tricky, but easy enough to use.  See
+	 * section 5.5.6 in the OHCI specification.
+	 *
+	 * The OHCI controller caches the new config rom address in a
+	 * shadow register (ConfigROMmapNext) and needs a bus reset
+	 * for the changes to take place.  When the bus reset is
+	 * detected, the controller loads the new values for the
+	 * ConfigRomHeader and BusOptions registers from the specified
+	 * config rom and loads ConfigROMmap from the ConfigROMmapNext
+	 * shadow register. All automatically and atomically.
+	 *
+	 * Now, there's a twist to this story.  The automatic load of
+	 * ConfigRomHeader and BusOptions doesn't honor the
+	 * noByteSwapData bit, so with a be32 config rom, the
+	 * controller will load be32 values in to these registers
+	 * during the atomic update, even on litte endian
+	 * architectures.  The workaround we use is to put a 0 in the
+	 * header quadlet; 0 is endian agnostic and means that the
+	 * config rom isn't ready yet.  In the bus reset tasklet we
+	 * then set up the real values for the two registers.
+	 *
+	 * We use ohci->lock to avoid racing with the code that sets
+	 * ohci->next_config_rom to NULL (see bus_reset_tasklet).
+	 */
+
+	next_config_rom =
+		dma_alloc_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+				   &next_config_rom_bus, GFP_KERNEL);
+	if (next_config_rom == NULL)
+		return -ENOMEM;
+
+	spin_lock_irqsave(&ohci->lock, flags);
+
+	if (ohci->next_config_rom == NULL) {
+		ohci->next_config_rom = next_config_rom;
+		ohci->next_config_rom_bus = next_config_rom_bus;
+
+		memset(ohci->next_config_rom, 0, CONFIG_ROM_SIZE);
+		fw_memcpy_to_be32(ohci->next_config_rom, config_rom,
+				  length * 4);
+
+		ohci->next_header = config_rom[0];
+		ohci->next_config_rom[0] = 0;
+
+		reg_write(ohci, OHCI1394_ConfigROMmap,
+			  ohci->next_config_rom_bus);
+	} else {
+		dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+				  next_config_rom, next_config_rom_bus);
+		retval = -EBUSY;
+	}
+
+	spin_unlock_irqrestore(&ohci->lock, flags);
+
+	/* Now initiate a bus reset to have the changes take
+	 * effect. We clean up the old config rom memory and DMA
+	 * mappings in the bus reset tasklet, since the OHCI
+	 * controller could need to access it before the bus reset
+	 * takes effect. */
+	if (retval == 0)
+		fw_core_initiate_bus_reset(&ohci->card, 1);
+
+	return retval;
+}
+
+static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+
+	at_context_transmit(&ohci->at_request_ctx, packet);
+}
+
+static void ohci_send_response(struct fw_card *card, struct fw_packet *packet)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+
+	at_context_transmit(&ohci->at_response_ctx, packet);
+}
+
+static int ohci_cancel_packet(struct fw_card *card, struct fw_packet *packet)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+	LIST_HEAD(list);
+	unsigned long flags;
+
+	spin_lock_irqsave(&ohci->lock, flags);
+
+	if (packet->ack == 0) {
+		fw_notify("cancelling packet %p (header[0]=%08x)\n",
+			  packet, packet->header[0]);
+
+		complete_transmission(packet, RCODE_CANCELLED, &list);
+	}
+
+	spin_unlock_irqrestore(&ohci->lock, flags);
+
+	do_packet_callbacks(ohci, &list);
+
+	/* Return success if we actually cancelled something. */
+	return list_empty(&list) ? -ENOENT : 0;
+}
+
+static int
+ohci_enable_phys_dma(struct fw_card *card, int node_id, int generation)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+	unsigned long flags;
+	int n, retval = 0;
+
+	/* FIXME:  Make sure this bitmask is cleared when we clear the busReset
+	 * interrupt bit.  Clear physReqResourceAllBuses on bus reset. */
+
+	spin_lock_irqsave(&ohci->lock, flags);
+
+	if (ohci->generation != generation) {
+		retval = -ESTALE;
+		goto out;
+	}
+
+	/* NOTE, if the node ID contains a non-local bus ID, physical DMA is
+	 * enabled for _all_ nodes on remote buses. */
+
+	n = (node_id & 0xffc0) == LOCAL_BUS ? node_id & 0x3f : 63;
+	if (n < 32)
+		reg_write(ohci, OHCI1394_PhyReqFilterLoSet, 1 << n);
+	else
+		reg_write(ohci, OHCI1394_PhyReqFilterHiSet, 1 << (n - 32));
+
+	flush_writes(ohci);
+ out:
+	spin_unlock_irqrestore(&ohci->lock, flags);
+	return retval;
+}
+
+static void ir_context_tasklet(unsigned long data)
+{
+	struct iso_context *ctx = (struct iso_context *)data;
+
+	(void)ctx;
+}
+
+#define ISO_BUFFER_SIZE (64 * 1024)
+
+static void flush_iso_context(struct iso_context *ctx)
+{
+	struct fw_ohci *ohci = fw_ohci(ctx->base.card);
+	struct descriptor *d, *last;
+	u32 address;
+	int z;
+
+	dma_sync_single_for_cpu(ohci->card.device, ctx->buffer_bus,
+				ISO_BUFFER_SIZE, DMA_TO_DEVICE);
+
+	d    = ctx->tail_descriptor;
+	last = ctx->tail_descriptor_last;
+
+	while (last->branch_address != 0 && last->transfer_status != 0) {
+		address = le32_to_cpu(last->branch_address);
+		z = address & 0xf;
+		d = ctx->buffer + (address - ctx->buffer_bus) / sizeof *d;
+
+		if (z == 2)
+			last = d;
+		else
+			last = d + z - 1;
+
+		if (le16_to_cpu(last->control) & descriptor_irq_always)
+			ctx->base.callback(&ctx->base,
+					   0, le16_to_cpu(last->res_count),
+					   ctx->base.callback_data);
+	}
+
+	ctx->tail_descriptor      = d;
+	ctx->tail_descriptor_last = last;
+}
+
+static void it_context_tasklet(unsigned long data)
+{
+	struct iso_context *ctx = (struct iso_context *)data;
+
+	flush_iso_context(ctx);
+}
+
+static struct fw_iso_context *ohci_allocate_iso_context(struct fw_card *card,
+							int type)
+{
+	struct fw_ohci *ohci = fw_ohci(card);
+	struct iso_context *ctx, *list;
+	void (*tasklet) (unsigned long data);
+	u32 *mask;
+	unsigned long flags;
+	int index;
+
+	if (type == FW_ISO_CONTEXT_TRANSMIT) {
+		mask = &ohci->it_context_mask;
+		list = ohci->it_context_list;
+		tasklet = it_context_tasklet;
+	} else {
+		mask = &ohci->ir_context_mask;
+		list = ohci->ir_context_list;
+		tasklet = ir_context_tasklet;
+	}
+
+	spin_lock_irqsave(&ohci->lock, flags);
+	index = ffs(*mask) - 1;
+	if (index >= 0)
+		*mask &= ~(1 << index);
+	spin_unlock_irqrestore(&ohci->lock, flags);
+
+	if (index < 0)
+		return ERR_PTR(-EBUSY);
+
+	ctx = &list[index];
+	memset(ctx, 0, sizeof *ctx);
+	tasklet_init(&ctx->tasklet, tasklet, (unsigned long)ctx);
+
+	ctx->buffer = kmalloc(ISO_BUFFER_SIZE, GFP_KERNEL);
+	if (ctx->buffer == NULL)
+		goto buffer_alloc_failed;
+
+	ctx->buffer_bus =
+	    dma_map_single(card->device, ctx->buffer,
+			   ISO_BUFFER_SIZE, DMA_TO_DEVICE);
+	if (dma_mapping_error(ctx->buffer_bus))
+		goto buffer_map_failed;
+
+	ctx->head_descriptor      = ctx->buffer;
+	ctx->prev_descriptor      = ctx->buffer;
+	ctx->tail_descriptor      = ctx->buffer;
+	ctx->tail_descriptor_last = ctx->buffer;
+
+	/* We put a dummy descriptor in the buffer that has a NULL
+	 * branch address and looks like it's been sent.  That way we
+	 * have a descriptor to append DMA programs to.  Also, the
+	 * ring buffer invariant is that it always has at least one
+	 * element so that head == tail means buffer full. */
+
+	memset(ctx->head_descriptor, 0, sizeof *ctx->head_descriptor);
+	ctx->head_descriptor->control = cpu_to_le16(descriptor_output_last);
+	ctx->head_descriptor->transfer_status = cpu_to_le16(0x8011);
+	ctx->head_descriptor++;
+
+	return &ctx->base;
+
+ buffer_map_failed:
+	kfree(ctx->buffer);
+ buffer_alloc_failed:
+	spin_lock_irqsave(&ohci->lock, flags);
+	*mask |= 1 << index;
+	spin_unlock_irqrestore(&ohci->lock, flags);
+
+	return ERR_PTR(-ENOMEM);
+}
+
+static int ohci_send_iso(struct fw_iso_context *base, s32 cycle)
+{
+	struct iso_context *ctx = (struct iso_context *)base;
+	struct fw_ohci *ohci = fw_ohci(ctx->base.card);
+	u32 cycle_match = 0;
+	int index;
+
+	index = ctx - ohci->it_context_list;
+	if (cycle > 0)
+		cycle_match = CONTEXT_CYCLE_MATCH_ENABLE |
+			(cycle & 0x7fff) << 16;
+
+	reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, 1 << index);
+	reg_write(ohci, OHCI1394_IsoXmitCommandPtr(index),
+		  le32_to_cpu(ctx->tail_descriptor_last->branch_address));
+	reg_write(ohci, OHCI1394_IsoXmitContextControlClear(index), ~0);
+	reg_write(ohci, OHCI1394_IsoXmitContextControlSet(index),
+		  CONTEXT_RUN | cycle_match);
+	flush_writes(ohci);
+
+	return 0;
+}
+
+static void ohci_free_iso_context(struct fw_iso_context *base)
+{
+	struct fw_ohci *ohci = fw_ohci(base->card);
+	struct iso_context *ctx = (struct iso_context *)base;
+	unsigned long flags;
+	int index;
+
+	flush_iso_context(ctx);
+
+	spin_lock_irqsave(&ohci->lock, flags);
+
+	if (ctx->base.type == FW_ISO_CONTEXT_TRANSMIT) {
+		index = ctx - ohci->it_context_list;
+		reg_write(ohci, OHCI1394_IsoXmitContextControlClear(index), ~0);
+		reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, 1 << index);
+		ohci->it_context_mask |= 1 << index;
+	} else {
+		index = ctx - ohci->ir_context_list;
+		reg_write(ohci, OHCI1394_IsoRcvContextControlClear(index), ~0);
+		reg_write(ohci, OHCI1394_IsoRecvIntMaskClear, 1 << index);
+		ohci->ir_context_mask |= 1 << index;
+	}
+	flush_writes(ohci);
+
+	dma_unmap_single(ohci->card.device, ctx->buffer_bus,
+			 ISO_BUFFER_SIZE, DMA_TO_DEVICE);
+
+	spin_unlock_irqrestore(&ohci->lock, flags);
+}
+
+static int
+ohci_queue_iso(struct fw_iso_context *base,
+	       struct fw_iso_packet *packet, void *payload)
+{
+	struct iso_context *ctx = (struct iso_context *)base;
+	struct fw_ohci *ohci = fw_ohci(ctx->base.card);
+	struct descriptor *d, *end, *last, *tail, *pd;
+	struct fw_iso_packet *p;
+	__le32 *header;
+	dma_addr_t d_bus;
+	u32 z, header_z, payload_z, irq;
+	u32 payload_index, payload_end_index, next_page_index;
+	int index, page, end_page, i, length, offset;
+
+	/* FIXME: Cycle lost behavior should be configurable: lose
+	 * packet, retransmit or terminate.. */
+
+	p = packet;
+	payload_index = payload - ctx->base.buffer;
+	d = ctx->head_descriptor;
+	tail = ctx->tail_descriptor;
+	end = ctx->buffer + ISO_BUFFER_SIZE / sizeof(struct descriptor);
+
+	if (p->skip)
+		z = 1;
+	else
+		z = 2;
+	if (p->header_length > 0)
+		z++;
+
+	/* Determine the first page the payload isn't contained in. */
+	end_page = PAGE_ALIGN(payload_index + p->payload_length) >> PAGE_SHIFT;
+	if (p->payload_length > 0)
+		payload_z = end_page - (payload_index >> PAGE_SHIFT);
+	else
+		payload_z = 0;
+
+	z += payload_z;
+
+	/* Get header size in number of descriptors. */
+	header_z = DIV_ROUND_UP(p->header_length, sizeof *d);
+
+	if (d + z + header_z <= tail) {
+		goto has_space;
+	} else if (d > tail && d + z + header_z <= end) {
+		goto has_space;
+	} else if (d > tail && ctx->buffer + z + header_z <= tail) {
+		d = ctx->buffer;
+		goto has_space;
+	}
+
+	/* No space in buffer */
+	return -1;
+
+ has_space:
+	memset(d, 0, (z + header_z) * sizeof *d);
+	d_bus = ctx->buffer_bus + (d - ctx->buffer) * sizeof *d;
+
+	if (!p->skip) {
+		d[0].control   = cpu_to_le16(descriptor_key_immediate);
+		d[0].req_count = cpu_to_le16(8);
+
+		header = (__le32 *) &d[1];
+		header[0] = cpu_to_le32(it_header_sy(p->sy) |
+					it_header_tag(p->tag) |
+					it_header_tcode(TCODE_STREAM_DATA) |
+					it_header_channel(ctx->base.channel) |
+					it_header_speed(ctx->base.speed));
+		header[1] =
+			cpu_to_le32(it_header_data_length(p->header_length +
+							  p->payload_length));
+	}
+
+	if (p->header_length > 0) {
+		d[2].req_count    = cpu_to_le16(p->header_length);
+		d[2].data_address = cpu_to_le32(d_bus + z * sizeof *d);
+		memcpy(&d[z], p->header, p->header_length);
+	}
+
+	pd = d + z - payload_z;
+	payload_end_index = payload_index + p->payload_length;
+	for (i = 0; i < payload_z; i++) {
+		page               = payload_index >> PAGE_SHIFT;
+		offset             = payload_index & ~PAGE_MASK;
+		next_page_index    = (page + 1) << PAGE_SHIFT;
+		length             =
+			min(next_page_index, payload_end_index) - payload_index;
+		pd[i].req_count    = cpu_to_le16(length);
+		pd[i].data_address = cpu_to_le32(ctx->base.pages[page] + offset);
+
+		payload_index += length;
+	}
+
+	if (z == 2)
+		last = d;
+	else
+		last = d + z - 1;
+
+	if (p->interrupt)
+		irq = descriptor_irq_always;
+	else
+		irq = descriptor_no_irq;
+
+	last->control = cpu_to_le16(descriptor_output_last |
+				    descriptor_status |
+				    descriptor_branch_always |
+				    irq);
+
+	dma_sync_single_for_device(ohci->card.device, ctx->buffer_bus,
+				   ISO_BUFFER_SIZE, DMA_TO_DEVICE);
+
+	ctx->head_descriptor = d + z + header_z;
+	ctx->prev_descriptor->branch_address = cpu_to_le32(d_bus | z);
+	ctx->prev_descriptor = last;
+
+	index = ctx - ohci->it_context_list;
+	reg_write(ohci, OHCI1394_IsoXmitContextControlSet(index), CONTEXT_WAKE);
+	flush_writes(ohci);
+
+	return 0;
+}
+
+static const struct fw_card_driver ohci_driver = {
+	.name			= ohci_driver_name,
+	.enable			= ohci_enable,
+	.update_phy_reg		= ohci_update_phy_reg,
+	.set_config_rom		= ohci_set_config_rom,
+	.send_request		= ohci_send_request,
+	.send_response		= ohci_send_response,
+	.cancel_packet		= ohci_cancel_packet,
+	.enable_phys_dma	= ohci_enable_phys_dma,
+
+	.allocate_iso_context	= ohci_allocate_iso_context,
+	.free_iso_context	= ohci_free_iso_context,
+	.queue_iso		= ohci_queue_iso,
+	.send_iso		= ohci_send_iso,
+};
+
+static int software_reset(struct fw_ohci *ohci)
+{
+	int i;
+
+	reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_softReset);
+
+	for (i = 0; i < OHCI_LOOP_COUNT; i++) {
+		if ((reg_read(ohci, OHCI1394_HCControlSet) &
+		     OHCI1394_HCControl_softReset) == 0)
+			return 0;
+		msleep(1);
+	}
+
+	return -EBUSY;
+}
+
+/* ---------- pci subsystem interface ---------- */
+
+enum {
+	CLEANUP_SELF_ID,
+	CLEANUP_REGISTERS,
+	CLEANUP_IOMEM,
+	CLEANUP_DISABLE,
+	CLEANUP_PUT_CARD,
+};
+
+static int cleanup(struct fw_ohci *ohci, int stage, int code)
+{
+	struct pci_dev *dev = to_pci_dev(ohci->card.device);
+
+	switch (stage) {
+	case CLEANUP_SELF_ID:
+		dma_free_coherent(ohci->card.device, SELF_ID_BUF_SIZE,
+				  ohci->self_id_cpu, ohci->self_id_bus);
+	case CLEANUP_REGISTERS:
+		kfree(ohci->it_context_list);
+		kfree(ohci->ir_context_list);
+		pci_iounmap(dev, ohci->registers);
+	case CLEANUP_IOMEM:
+		pci_release_region(dev, 0);
+	case CLEANUP_DISABLE:
+		pci_disable_device(dev);
+	case CLEANUP_PUT_CARD:
+		fw_card_put(&ohci->card);
+	}
+
+	return code;
+}
+
+static int __devinit
+pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+{
+	struct fw_ohci *ohci;
+	u32 bus_options, max_receive, link_speed;
+	u64 guid;
+	int error_code;
+	size_t size;
+
+	ohci = kzalloc(sizeof *ohci, GFP_KERNEL);
+	if (ohci == NULL) {
+		fw_error("Could not malloc fw_ohci data.\n");
+		return -ENOMEM;
+	}
+
+	fw_card_initialize(&ohci->card, &ohci_driver, &dev->dev);
+
+	if (pci_enable_device(dev)) {
+		fw_error("Failed to enable OHCI hardware.\n");
+		return cleanup(ohci, CLEANUP_PUT_CARD, -ENODEV);
+	}
+
+	pci_set_master(dev);
+	pci_write_config_dword(dev, OHCI1394_PCI_HCI_Control, 0);
+	pci_set_drvdata(dev, ohci);
+
+	spin_lock_init(&ohci->lock);
+
+	tasklet_init(&ohci->bus_reset_tasklet,
+		     bus_reset_tasklet, (unsigned long)ohci);
+
+	if (pci_request_region(dev, 0, ohci_driver_name)) {
+		fw_error("MMIO resource unavailable\n");
+		return cleanup(ohci, CLEANUP_DISABLE, -EBUSY);
+	}
+
+	ohci->registers = pci_iomap(dev, 0, OHCI1394_REGISTER_SIZE);
+	if (ohci->registers == NULL) {
+		fw_error("Failed to remap registers\n");
+		return cleanup(ohci, CLEANUP_IOMEM, -ENXIO);
+	}
+
+	if (software_reset(ohci)) {
+		fw_error("Failed to reset ohci card.\n");
+		return cleanup(ohci, CLEANUP_REGISTERS, -EBUSY);
+	}
+
+	/* Now enable LPS, which we need in order to start accessing
+	 * most of the registers.  In fact, on some cards (ALI M5251),
+	 * accessing registers in the SClk domain without LPS enabled
+	 * will lock up the machine.  Wait 50msec to make sure we have
+	 * full link enabled.  */
+	reg_write(ohci, OHCI1394_HCControlSet,
+		  OHCI1394_HCControl_LPS |
+		  OHCI1394_HCControl_postedWriteEnable);
+	flush_writes(ohci);
+	msleep(50);
+
+	reg_write(ohci, OHCI1394_HCControlClear,
+		  OHCI1394_HCControl_noByteSwapData);
+
+	reg_write(ohci, OHCI1394_LinkControlSet,
+		  OHCI1394_LinkControl_rcvSelfID |
+		  OHCI1394_LinkControl_cycleTimerEnable |
+		  OHCI1394_LinkControl_cycleMaster);
+
+	ar_context_init(&ohci->ar_request_ctx, ohci,
+			OHCI1394_AsReqRcvContextControlSet);
+
+	ar_context_init(&ohci->ar_response_ctx, ohci,
+			OHCI1394_AsRspRcvContextControlSet);
+
+	at_context_init(&ohci->at_request_ctx, ohci,
+			OHCI1394_AsReqTrContextControlSet);
+
+	at_context_init(&ohci->at_response_ctx, ohci,
+			OHCI1394_AsRspTrContextControlSet);
+
+	reg_write(ohci, OHCI1394_ATRetries,
+		  OHCI1394_MAX_AT_REQ_RETRIES |
+		  (OHCI1394_MAX_AT_RESP_RETRIES << 4) |
+		  (OHCI1394_MAX_PHYS_RESP_RETRIES << 8));
+
+	reg_write(ohci, OHCI1394_IsoRecvIntMaskSet, ~0);
+	ohci->it_context_mask = reg_read(ohci, OHCI1394_IsoRecvIntMaskSet);
+	reg_write(ohci, OHCI1394_IsoRecvIntMaskClear, ~0);
+	size = sizeof(struct iso_context) * hweight32(ohci->it_context_mask);
+	ohci->it_context_list = kzalloc(size, GFP_KERNEL);
+
+	reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
+	ohci->ir_context_mask = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
+	reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
+	size = sizeof(struct iso_context) * hweight32(ohci->ir_context_mask);
+	ohci->ir_context_list = kzalloc(size, GFP_KERNEL);
+
+	if (ohci->it_context_list == NULL || ohci->ir_context_list == NULL) {
+		fw_error("Out of memory for it/ir contexts.\n");
+		return cleanup(ohci, CLEANUP_REGISTERS, -ENOMEM);
+	}
+
+	/* self-id dma buffer allocation */
+	ohci->self_id_cpu = dma_alloc_coherent(ohci->card.device,
+					       SELF_ID_BUF_SIZE,
+					       &ohci->self_id_bus,
+					       GFP_KERNEL);
+	if (ohci->self_id_cpu == NULL) {
+		fw_error("Out of memory for self ID buffer.\n");
+		return cleanup(ohci, CLEANUP_REGISTERS, -ENOMEM);
+	}
+
+	reg_write(ohci, OHCI1394_SelfIDBuffer, ohci->self_id_bus);
+	reg_write(ohci, OHCI1394_PhyUpperBound, 0x00010000);
+	reg_write(ohci, OHCI1394_IntEventClear, ~0);
+	reg_write(ohci, OHCI1394_IntMaskClear, ~0);
+	reg_write(ohci, OHCI1394_IntMaskSet,
+		  OHCI1394_selfIDComplete |
+		  OHCI1394_RQPkt | OHCI1394_RSPkt |
+		  OHCI1394_reqTxComplete | OHCI1394_respTxComplete |
+		  OHCI1394_isochRx | OHCI1394_isochTx |
+		  OHCI1394_masterIntEnable);
+
+	bus_options = reg_read(ohci, OHCI1394_BusOptions);
+	max_receive = (bus_options >> 12) & 0xf;
+	link_speed = bus_options & 0x7;
+	guid = ((u64) reg_read(ohci, OHCI1394_GUIDHi) << 32) |
+		reg_read(ohci, OHCI1394_GUIDLo);
+
+	error_code = fw_card_add(&ohci->card, max_receive, link_speed, guid);
+	if (error_code < 0)
+		return cleanup(ohci, CLEANUP_SELF_ID, error_code);
+
+	fw_notify("Added fw-ohci device %s.\n", dev->dev.bus_id);
+
+	return 0;
+}
+
+static void pci_remove(struct pci_dev *dev)
+{
+	struct fw_ohci *ohci;
+
+	ohci = pci_get_drvdata(dev);
+	reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_masterIntEnable);
+	fw_core_remove_card(&ohci->card);
+
+	/* FIXME: Fail all pending packets here, now that the upper
+	 * layers can't queue any more. */
+
+	software_reset(ohci);
+	free_irq(dev->irq, ohci);
+	cleanup(ohci, CLEANUP_SELF_ID, 0);
+
+	fw_notify("Removed fw-ohci device.\n");
+}
+
+static struct pci_device_id pci_table[] = {
+	{ PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_FIREWIRE_OHCI, ~0) },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(pci, pci_table);
+
+static struct pci_driver fw_ohci_pci_driver = {
+	.name		= ohci_driver_name,
+	.id_table	= pci_table,
+	.probe		= pci_probe,
+	.remove		= pci_remove,
+};
+
+MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
+MODULE_DESCRIPTION("Driver for PCI OHCI IEEE1394 controllers");
+MODULE_LICENSE("GPL");
+
+static int __init fw_ohci_init(void)
+{
+	return pci_register_driver(&fw_ohci_pci_driver);
+}
+
+static void __exit fw_ohci_cleanup(void)
+{
+	pci_unregister_driver(&fw_ohci_pci_driver);
+}
+
+module_init(fw_ohci_init);
+module_exit(fw_ohci_cleanup);
diff --git a/drivers/firewire/fw-ohci.h b/drivers/firewire/fw-ohci.h
new file mode 100644
index 0000000..a562305
--- /dev/null
+++ b/drivers/firewire/fw-ohci.h
@@ -0,0 +1,152 @@
+#ifndef __fw_ohci_h
+#define __fw_ohci_h
+
+/* OHCI register map */
+
+#define OHCI1394_Version                      0x000
+#define OHCI1394_GUID_ROM                     0x004
+#define OHCI1394_ATRetries                    0x008
+#define OHCI1394_CSRData                      0x00C
+#define OHCI1394_CSRCompareData               0x010
+#define OHCI1394_CSRControl                   0x014
+#define OHCI1394_ConfigROMhdr                 0x018
+#define OHCI1394_BusID                        0x01C
+#define OHCI1394_BusOptions                   0x020
+#define OHCI1394_GUIDHi                       0x024
+#define OHCI1394_GUIDLo                       0x028
+#define OHCI1394_ConfigROMmap                 0x034
+#define OHCI1394_PostedWriteAddressLo         0x038
+#define OHCI1394_PostedWriteAddressHi         0x03C
+#define OHCI1394_VendorID                     0x040
+#define OHCI1394_HCControlSet                 0x050
+#define OHCI1394_HCControlClear               0x054
+#define  OHCI1394_HCControl_BIBimageValid	0x80000000
+#define  OHCI1394_HCControl_noByteSwapData	0x40000000
+#define  OHCI1394_HCControl_programPhyEnable	0x00800000
+#define  OHCI1394_HCControl_aPhyEnhanceEnable	0x00400000
+#define  OHCI1394_HCControl_LPS			0x00080000
+#define  OHCI1394_HCControl_postedWriteEnable	0x00040000
+#define  OHCI1394_HCControl_linkEnable		0x00020000
+#define  OHCI1394_HCControl_softReset		0x00010000
+#define OHCI1394_SelfIDBuffer                 0x064
+#define OHCI1394_SelfIDCount                  0x068
+#define OHCI1394_IRMultiChanMaskHiSet         0x070
+#define OHCI1394_IRMultiChanMaskHiClear       0x074
+#define OHCI1394_IRMultiChanMaskLoSet         0x078
+#define OHCI1394_IRMultiChanMaskLoClear       0x07C
+#define OHCI1394_IntEventSet                  0x080
+#define OHCI1394_IntEventClear                0x084
+#define OHCI1394_IntMaskSet                   0x088
+#define OHCI1394_IntMaskClear                 0x08C
+#define OHCI1394_IsoXmitIntEventSet           0x090
+#define OHCI1394_IsoXmitIntEventClear         0x094
+#define OHCI1394_IsoXmitIntMaskSet            0x098
+#define OHCI1394_IsoXmitIntMaskClear          0x09C
+#define OHCI1394_IsoRecvIntEventSet           0x0A0
+#define OHCI1394_IsoRecvIntEventClear         0x0A4
+#define OHCI1394_IsoRecvIntMaskSet            0x0A8
+#define OHCI1394_IsoRecvIntMaskClear          0x0AC
+#define OHCI1394_InitialBandwidthAvailable    0x0B0
+#define OHCI1394_InitialChannelsAvailableHi   0x0B4
+#define OHCI1394_InitialChannelsAvailableLo   0x0B8
+#define OHCI1394_FairnessControl              0x0DC
+#define OHCI1394_LinkControlSet               0x0E0
+#define OHCI1394_LinkControlClear             0x0E4
+#define   OHCI1394_LinkControl_rcvSelfID	(1 << 9)
+#define   OHCI1394_LinkControl_rcvPhyPkt	(1 << 10)
+#define   OHCI1394_LinkControl_cycleTimerEnable	(1 << 20)
+#define   OHCI1394_LinkControl_cycleMaster	(1 << 21)
+#define   OHCI1394_LinkControl_cycleSource	(1 << 22)
+#define OHCI1394_NodeID                       0x0E8
+#define   OHCI1394_NodeID_idValid             0x80000000
+#define OHCI1394_PhyControl                   0x0EC
+#define   OHCI1394_PhyControl_Read(addr)	(((addr) << 8) | 0x00008000)
+#define   OHCI1394_PhyControl_ReadDone		0x80000000
+#define   OHCI1394_PhyControl_ReadData(r)	(((r) & 0x00ff0000) >> 16)
+#define   OHCI1394_PhyControl_Write(addr, data)	(((addr) << 8) | (data) | 0x00004000)
+#define   OHCI1394_PhyControl_WriteDone		0x00004000
+#define OHCI1394_IsochronousCycleTimer        0x0F0
+#define OHCI1394_AsReqFilterHiSet             0x100
+#define OHCI1394_AsReqFilterHiClear           0x104
+#define OHCI1394_AsReqFilterLoSet             0x108
+#define OHCI1394_AsReqFilterLoClear           0x10C
+#define OHCI1394_PhyReqFilterHiSet            0x110
+#define OHCI1394_PhyReqFilterHiClear          0x114
+#define OHCI1394_PhyReqFilterLoSet            0x118
+#define OHCI1394_PhyReqFilterLoClear          0x11C
+#define OHCI1394_PhyUpperBound                0x120
+
+#define OHCI1394_AsReqTrContextBase           0x180
+#define OHCI1394_AsReqTrContextControlSet     0x180
+#define OHCI1394_AsReqTrContextControlClear   0x184
+#define OHCI1394_AsReqTrCommandPtr            0x18C
+
+#define OHCI1394_AsRspTrContextBase           0x1A0
+#define OHCI1394_AsRspTrContextControlSet     0x1A0
+#define OHCI1394_AsRspTrContextControlClear   0x1A4
+#define OHCI1394_AsRspTrCommandPtr            0x1AC
+
+#define OHCI1394_AsReqRcvContextBase          0x1C0
+#define OHCI1394_AsReqRcvContextControlSet    0x1C0
+#define OHCI1394_AsReqRcvContextControlClear  0x1C4
+#define OHCI1394_AsReqRcvCommandPtr           0x1CC
+
+#define OHCI1394_AsRspRcvContextBase          0x1E0
+#define OHCI1394_AsRspRcvContextControlSet    0x1E0
+#define OHCI1394_AsRspRcvContextControlClear  0x1E4
+#define OHCI1394_AsRspRcvCommandPtr           0x1EC
+
+/* Isochronous transmit registers */
+#define OHCI1394_IsoXmitContextBase(n)           (0x200 + 16 * (n))
+#define OHCI1394_IsoXmitContextControlSet(n)     (0x200 + 16 * (n))
+#define OHCI1394_IsoXmitContextControlClear(n)   (0x204 + 16 * (n))
+#define OHCI1394_IsoXmitCommandPtr(n)            (0x20C + 16 * (n))
+
+/* Isochronous receive registers */
+#define OHCI1394_IsoRcvContextControlSet(n)   (0x400 + 32 * (n))
+#define OHCI1394_IsoRcvContextControlClear(n) (0x404 + 32 * (n))
+#define OHCI1394_IsoRcvCommandPtr(n)          (0x40C + 32 * (n))
+#define OHCI1394_IsoRcvContextMatch(n)        (0x410 + 32 * (n))
+
+/* Interrupts Mask/Events */
+#define OHCI1394_reqTxComplete		0x00000001
+#define OHCI1394_respTxComplete		0x00000002
+#define OHCI1394_ARRQ			0x00000004
+#define OHCI1394_ARRS			0x00000008
+#define OHCI1394_RQPkt			0x00000010
+#define OHCI1394_RSPkt			0x00000020
+#define OHCI1394_isochTx		0x00000040
+#define OHCI1394_isochRx		0x00000080
+#define OHCI1394_postedWriteErr		0x00000100
+#define OHCI1394_lockRespErr		0x00000200
+#define OHCI1394_selfIDComplete		0x00010000
+#define OHCI1394_busReset		0x00020000
+#define OHCI1394_phy			0x00080000
+#define OHCI1394_cycleSynch		0x00100000
+#define OHCI1394_cycle64Seconds		0x00200000
+#define OHCI1394_cycleLost		0x00400000
+#define OHCI1394_cycleInconsistent	0x00800000
+#define OHCI1394_unrecoverableError	0x01000000
+#define OHCI1394_cycleTooLong		0x02000000
+#define OHCI1394_phyRegRcvd		0x04000000
+#define OHCI1394_masterIntEnable	0x80000000
+
+#define OHCI1394_evt_no_status		0x0
+#define OHCI1394_evt_long_packet	0x2
+#define OHCI1394_evt_missing_ack	0x3
+#define OHCI1394_evt_underrun		0x4
+#define OHCI1394_evt_overrun		0x5
+#define OHCI1394_evt_descriptor_read	0x6
+#define OHCI1394_evt_data_read		0x7
+#define OHCI1394_evt_data_write		0x8
+#define OHCI1394_evt_bus_reset		0x9
+#define OHCI1394_evt_timeout		0xa
+#define OHCI1394_evt_tcode_err		0xb
+#define OHCI1394_evt_reserved_b		0xc
+#define OHCI1394_evt_reserved_c		0xd
+#define OHCI1394_evt_unknown		0xe
+#define OHCI1394_evt_flushed		0xf
+
+#define OHCI1394_phy_tcode		0xe
+
+#endif /* __fw_ohci_h */
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
new file mode 100644
index 0000000..2259e22
--- /dev/null
+++ b/drivers/firewire/fw-sbp2.c
@@ -0,0 +1,1164 @@
+/*						-*- c-basic-offset: 8 -*-
+ * fw-sbp2.c -- SBP2 driver (SCSI over IEEE1394)
+ *
+ * Copyright (C) 2005-2007  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/* The basic structure of this driver is based the old storage driver,
+ * drivers/ieee1394/sbp2.c, originally written by
+ *     James Goodwin <jamesg@filanet.com>
+ * with later contributions and ongoing maintenance from
+ *     Ben Collins <bcollins@debian.org>,
+ *     Stefan Richter <stefanr@s5r6.in-berlin.de>
+ * and many others.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/device.h>
+#include <linux/scatterlist.h>
+#include <linux/dma-mapping.h>
+#include <linux/timer.h>
+
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_dbg.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_host.h>
+
+#include "fw-transaction.h"
+#include "fw-topology.h"
+#include "fw-device.h"
+
+/* I don't know why the SCSI stack doesn't define something like this... */
+typedef void (*scsi_done_fn_t) (struct scsi_cmnd *);
+
+static const char sbp2_driver_name[] = "sbp2";
+
+struct sbp2_device {
+	struct fw_unit *unit;
+	struct fw_address_handler address_handler;
+	struct list_head orb_list;
+	u64 management_agent_address;
+	u64 command_block_agent_address;
+	u32 workarounds;
+	int login_id;
+
+	/* We cache these addresses and only update them once we've
+	 * logged in or reconnected to the sbp2 device.  That way, any
+	 * IO to the device will automatically fail and get retried if
+	 * it happens in a window where the device is not ready to
+	 * handle it (e.g. after a bus reset but before we reconnect). */
+	int node_id;
+	int address_high;
+	int generation;
+
+	/* Timer for flushing ORBs. */
+	struct timer_list orb_timer;
+
+	int retries;
+	struct delayed_work work;
+	struct Scsi_Host *scsi_host;
+};
+
+#define SBP2_MAX_SG_ELEMENT_LENGTH	0xf000
+#define SBP2_MAX_SECTORS		255	/* Max sectors supported */
+#define SBP2_ORB_TIMEOUT		2000	/* Timeout in ms */
+
+#define SBP2_ORB_NULL			0x80000000
+
+#define SBP2_DIRECTION_TO_MEDIA		0x0
+#define SBP2_DIRECTION_FROM_MEDIA	0x1
+
+/* Unit directory keys */
+#define SBP2_COMMAND_SET_SPECIFIER	0x38
+#define SBP2_COMMAND_SET		0x39
+#define SBP2_COMMAND_SET_REVISION	0x3b
+#define SBP2_FIRMWARE_REVISION		0x3c
+
+/* Flags for detected oddities and brokeness */
+#define SBP2_WORKAROUND_128K_MAX_TRANS	0x1
+#define SBP2_WORKAROUND_INQUIRY_36	0x2
+#define SBP2_WORKAROUND_MODE_SENSE_8	0x4
+#define SBP2_WORKAROUND_FIX_CAPACITY	0x8
+#define SBP2_WORKAROUND_OVERRIDE	0x100
+
+/* Management orb opcodes */
+#define SBP2_LOGIN_REQUEST		0x0
+#define SBP2_QUERY_LOGINS_REQUEST	0x1
+#define SBP2_RECONNECT_REQUEST		0x3
+#define SBP2_SET_PASSWORD_REQUEST	0x4
+#define SBP2_LOGOUT_REQUEST		0x7
+#define SBP2_ABORT_TASK_REQUEST		0xb
+#define SBP2_ABORT_TASK_SET		0xc
+#define SBP2_LOGICAL_UNIT_RESET		0xe
+#define SBP2_TARGET_RESET_REQUEST	0xf
+
+/* Offsets for command block agent registers */
+#define SBP2_AGENT_STATE		0x00
+#define SBP2_AGENT_RESET		0x04
+#define SBP2_ORB_POINTER		0x08
+#define SBP2_DOORBELL			0x10
+#define SBP2_UNSOLICITED_STATUS_ENABLE	0x14
+
+/* Status write response codes */
+#define SBP2_STATUS_REQUEST_COMPLETE	0x0
+#define SBP2_STATUS_TRANSPORT_FAILURE	0x1
+#define SBP2_STATUS_ILLEGAL_REQUEST	0x2
+#define SBP2_STATUS_VENDOR_DEPENDENT	0x3
+
+#define status_get_orb_high(v)		((v).status & 0xffff)
+#define status_get_sbp_status(v)	(((v).status >> 16) & 0xff)
+#define status_get_len(v)		(((v).status >> 24) & 0x07)
+#define status_get_dead(v)		(((v).status >> 27) & 0x01)
+#define status_get_response(v)		(((v).status >> 28) & 0x03)
+#define status_get_source(v)		(((v).status >> 30) & 0x03)
+#define status_get_orb_low(v)		((v).orb_low)
+#define status_get_data(v)		((v).data)
+
+struct sbp2_status {
+	u32 status;
+	u32 orb_low;
+	u8 data[24];
+};
+
+struct sbp2_pointer {
+	u32 high;
+	u32 low;
+};
+
+struct sbp2_orb {
+	struct fw_transaction t;
+	dma_addr_t request_bus;
+	int rcode;
+	struct sbp2_pointer pointer;
+	void (*callback) (struct sbp2_orb * orb, struct sbp2_status * status);
+	struct list_head link;
+};
+
+#define management_orb_lun(v)			((v))
+#define management_orb_function(v)		((v) << 16)
+#define management_orb_reconnect(v)		((v) << 20)
+#define management_orb_exclusive		((1) << 28)
+#define management_orb_request_format(v)	((v) << 29)
+#define management_orb_notify			((1) << 31)
+
+#define management_orb_response_length(v)	((v))
+#define management_orb_password_length(v)	((v) << 16)
+
+struct sbp2_management_orb {
+	struct sbp2_orb base;
+	struct {
+		struct sbp2_pointer password;
+		struct sbp2_pointer response;
+		u32 misc;
+		u32 length;
+		struct sbp2_pointer status_fifo;
+	} request;
+	__be32 response[4];
+	dma_addr_t response_bus;
+	struct completion done;
+	struct sbp2_status status;
+};
+
+#define login_response_get_login_id(v)	((v).misc & 0xffff)
+#define login_response_get_length(v)	(((v).misc >> 16) & 0xffff)
+
+struct sbp2_login_response {
+	u32 misc;
+	struct sbp2_pointer command_block_agent;
+	u32 reconnect_hold;
+};
+
+#define command_orb_data_size(v)	((v))
+#define command_orb_page_size(v)	((v) << 16)
+#define command_orb_page_table_present	((1) << 19)
+#define command_orb_max_payload(v)	((v) << 20)
+#define command_orb_speed(v)		((v) << 24)
+#define command_orb_direction(v)	((v) << 27)
+#define command_orb_request_format(v)	((v) << 29)
+#define command_orb_notify		((1) << 31)
+
+struct sbp2_command_orb {
+	struct sbp2_orb base;
+	struct {
+		struct sbp2_pointer next;
+		struct sbp2_pointer data_descriptor;
+		u32 misc;
+		u8 command_block[12];
+	} request;
+	struct scsi_cmnd *cmd;
+	scsi_done_fn_t done;
+	struct fw_unit *unit;
+
+	struct sbp2_pointer page_table[SG_ALL];
+	dma_addr_t page_table_bus;
+	dma_addr_t request_buffer_bus;
+};
+
+/*
+ * List of devices with known bugs.
+ *
+ * The firmware_revision field, masked with 0xffff00, is the best
+ * indicator for the type of bridge chip of a device.  It yields a few
+ * false positives but this did not break correctly behaving devices
+ * so far.  We use ~0 as a wildcard, since the 24 bit values we get
+ * from the config rom can never match that.
+ */
+static const struct {
+	u32 firmware_revision;
+	u32 model;
+	unsigned workarounds;
+} sbp2_workarounds_table[] = {
+	/* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
+		.firmware_revision	= 0x002800,
+		.model			= 0x001010,
+		.workarounds		= SBP2_WORKAROUND_INQUIRY_36 |
+					  SBP2_WORKAROUND_MODE_SENSE_8,
+	},
+	/* Initio bridges, actually only needed for some older ones */ {
+		.firmware_revision	= 0x000200,
+		.model			= ~0,
+		.workarounds		= SBP2_WORKAROUND_INQUIRY_36,
+	},
+	/* Symbios bridge */ {
+		.firmware_revision	= 0xa0b800,
+		.model			= ~0,
+		.workarounds		= SBP2_WORKAROUND_128K_MAX_TRANS,
+	},
+	/* There are iPods (2nd gen, 3rd gen) with model_id == 0, but
+	 * these iPods do not feature the read_capacity bug according
+	 * to one report.  Read_capacity behaviour as well as model_id
+	 * could change due to Apple-supplied firmware updates though. */
+	/* iPod 4th generation. */ {
+		.firmware_revision	= 0x0a2700,
+		.model			= 0x000021,
+		.workarounds		= SBP2_WORKAROUND_FIX_CAPACITY,
+	},
+	/* iPod mini */ {
+		.firmware_revision	= 0x0a2700,
+		.model			= 0x000023,
+		.workarounds		= SBP2_WORKAROUND_FIX_CAPACITY,
+	},
+	/* iPod Photo */ {
+		.firmware_revision	= 0x0a2700,
+		.model			= 0x00007e,
+		.workarounds		= SBP2_WORKAROUND_FIX_CAPACITY,
+	}
+};
+
+static void
+sbp2_status_write(struct fw_card *card, struct fw_request *request,
+		  int tcode, int destination, int source,
+		  int generation, int speed,
+		  unsigned long long offset,
+		  void *payload, size_t length, void *callback_data)
+{
+	struct sbp2_device *sd = callback_data;
+	struct sbp2_orb *orb;
+	struct sbp2_status status;
+	size_t header_size;
+	unsigned long flags;
+
+	if (tcode != TCODE_WRITE_BLOCK_REQUEST ||
+	    length == 0 || length > sizeof status) {
+		fw_send_response(card, request, RCODE_TYPE_ERROR);
+		return;
+	}
+
+	header_size = min(length, 2 * sizeof(u32));
+	fw_memcpy_from_be32(&status, payload, header_size);
+	if (length > header_size)
+		memcpy(status.data, payload + 8, length - header_size);
+	if (status_get_source(status) == 2 || status_get_source(status) == 3) {
+		fw_notify("non-orb related status write, not handled\n");
+		fw_send_response(card, request, RCODE_COMPLETE);
+		return;
+	}
+
+	/* Lookup the orb corresponding to this status write. */
+	spin_lock_irqsave(&card->lock, flags);
+	list_for_each_entry(orb, &sd->orb_list, link) {
+		if (status_get_orb_high(status) == 0 &&
+		    status_get_orb_low(status) == orb->request_bus) {
+			list_del(&orb->link);
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	if (&orb->link != &sd->orb_list)
+		orb->callback(orb, &status);
+	else
+		fw_error("status write for unknown orb\n");
+
+	fw_send_response(card, request, RCODE_COMPLETE);
+}
+
+static void
+complete_transaction(struct fw_card *card, int rcode,
+		     void *payload, size_t length, void *data)
+{
+	struct sbp2_orb *orb = data;
+	unsigned long flags;
+
+	orb->rcode = rcode;
+	if (rcode != RCODE_COMPLETE) {
+		spin_lock_irqsave(&card->lock, flags);
+		list_del(&orb->link);
+		spin_unlock_irqrestore(&card->lock, flags);
+		orb->callback(orb, NULL);
+	}
+}
+
+static void
+sbp2_send_orb(struct sbp2_orb *orb, struct fw_unit *unit,
+	      int node_id, int generation, u64 offset)
+{
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+	unsigned long flags;
+
+	orb->pointer.high = 0;
+	orb->pointer.low = orb->request_bus;
+	fw_memcpy_to_be32(&orb->pointer, &orb->pointer, sizeof orb->pointer);
+
+	spin_lock_irqsave(&device->card->lock, flags);
+	list_add_tail(&orb->link, &sd->orb_list);
+	spin_unlock_irqrestore(&device->card->lock, flags);
+
+	mod_timer(&sd->orb_timer,
+		  jiffies + DIV_ROUND_UP(SBP2_ORB_TIMEOUT * HZ, 1000));
+
+	fw_send_request(device->card, &orb->t, TCODE_WRITE_BLOCK_REQUEST,
+			node_id, generation,
+			device->node->max_speed, offset,
+			&orb->pointer, sizeof orb->pointer,
+			complete_transaction, orb);
+}
+
+static void sbp2_cancel_orbs(struct fw_unit *unit)
+{
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+	struct sbp2_orb *orb, *next;
+	struct list_head list;
+	unsigned long flags;
+
+	INIT_LIST_HEAD(&list);
+	spin_lock_irqsave(&device->card->lock, flags);
+	list_splice_init(&sd->orb_list, &list);
+	spin_unlock_irqrestore(&device->card->lock, flags);
+
+	list_for_each_entry_safe(orb, next, &list, link) {
+		if (fw_cancel_transaction(device->card, &orb->t) == 0)
+			continue;
+
+		orb->rcode = RCODE_CANCELLED;
+		orb->callback(orb, NULL);
+	}
+}
+
+static void orb_timer_callback(unsigned long data)
+{
+	struct sbp2_device *sd = (struct sbp2_device *)data;
+
+	sbp2_cancel_orbs(sd->unit);
+}
+
+static void
+complete_management_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
+{
+	struct sbp2_management_orb *orb =
+	    (struct sbp2_management_orb *)base_orb;
+
+	if (status)
+		memcpy(&orb->status, status, sizeof *status);
+	complete(&orb->done);
+}
+
+static int
+sbp2_send_management_orb(struct fw_unit *unit, int node_id, int generation,
+			 int function, int lun, void *response)
+{
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+	struct sbp2_management_orb *orb;
+	int retval = -ENOMEM;
+
+	orb = kzalloc(sizeof *orb, GFP_ATOMIC);
+	if (orb == NULL)
+		return -ENOMEM;
+
+	/* The sbp2 device is going to send a block read request to
+	 * read out the request from host memory, so map it for
+	 * dma. */
+	orb->base.request_bus =
+		dma_map_single(device->card->device, &orb->request,
+			       sizeof orb->request, DMA_TO_DEVICE);
+	if (dma_mapping_error(orb->base.request_bus))
+		goto out;
+
+	orb->response_bus =
+		dma_map_single(device->card->device, &orb->response,
+			       sizeof orb->response, DMA_FROM_DEVICE);
+	if (dma_mapping_error(orb->response_bus))
+		goto out;
+
+	orb->request.response.high    = 0;
+	orb->request.response.low     = orb->response_bus;
+
+	orb->request.misc =
+		management_orb_notify |
+		management_orb_function(function) |
+		management_orb_lun(lun);
+	orb->request.length =
+		management_orb_response_length(sizeof orb->response);
+
+	orb->request.status_fifo.high = sd->address_handler.offset >> 32;
+	orb->request.status_fifo.low  = sd->address_handler.offset;
+
+	/* FIXME: Yeah, ok this isn't elegant, we hardwire exclusive
+	 * login and 1 second reconnect time.  The reconnect setting
+	 * is probably fine, but the exclusive login should be an
+	 * option. */
+	if (function == SBP2_LOGIN_REQUEST) {
+		orb->request.misc |=
+			management_orb_exclusive |
+			management_orb_reconnect(0);
+	}
+
+	fw_memcpy_to_be32(&orb->request, &orb->request, sizeof orb->request);
+
+	init_completion(&orb->done);
+	orb->base.callback = complete_management_orb;
+	sbp2_send_orb(&orb->base, unit,
+		      node_id, generation, sd->management_agent_address);
+
+	wait_for_completion(&orb->done);
+
+	/* FIXME: Handle bus reset race here. */
+
+	retval = -EIO;
+	if (orb->base.rcode != RCODE_COMPLETE) {
+		fw_error("management write failed, rcode 0x%02x\n",
+			 orb->base.rcode);
+		goto out;
+	}
+
+	if (orb->base.rcode == RCODE_CANCELLED) {
+		fw_error("orb reply timed out, rcode=0x%02x\n",
+			 orb->base.rcode);
+		goto out;
+	}
+
+	if (status_get_response(orb->status) != 0 ||
+	    status_get_sbp_status(orb->status) != 0) {
+		fw_error("error status: %d:%d\n",
+			 status_get_response(orb->status),
+			 status_get_sbp_status(orb->status));
+		goto out;
+	}
+
+	retval = 0;
+ out:
+	dma_unmap_single(device->card->device, orb->base.request_bus,
+			 sizeof orb->request, DMA_TO_DEVICE);
+	dma_unmap_single(device->card->device, orb->response_bus,
+			 sizeof orb->response, DMA_FROM_DEVICE);
+
+	if (response)
+		fw_memcpy_from_be32(response,
+				    orb->response, sizeof orb->response);
+	kfree(orb);
+
+	return retval;
+}
+
+static void
+complete_agent_reset_write(struct fw_card *card, int rcode,
+			   void *payload, size_t length, void *data)
+{
+	struct fw_transaction *t = data;
+
+	fw_notify("agent reset write rcode=%d\n", rcode);
+	kfree(t);
+}
+
+static int sbp2_agent_reset(struct fw_unit *unit)
+{
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+	struct fw_transaction *t;
+	static u32 zero;
+
+	t = kzalloc(sizeof *t, GFP_ATOMIC);
+	if (t == NULL)
+		return -ENOMEM;
+
+	fw_send_request(device->card, t, TCODE_WRITE_QUADLET_REQUEST,
+			sd->node_id, sd->generation, SCODE_400,
+			sd->command_block_agent_address + SBP2_AGENT_RESET,
+			&zero, sizeof zero, complete_agent_reset_write, t);
+
+	return 0;
+}
+
+static int add_scsi_devices(struct fw_unit *unit);
+static void remove_scsi_devices(struct fw_unit *unit);
+static void sbp2_reconnect(struct work_struct *work);
+
+static void sbp2_login(struct work_struct *work)
+{
+	struct sbp2_device *sd =
+		container_of(work, struct sbp2_device, work.work);
+	struct fw_unit *unit = sd->unit;
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_login_response response;
+	int generation, node_id, local_node_id, lun, retval;
+
+	/* FIXME: Make this work for multi-lun devices. */
+	lun = 0;
+
+	generation    = device->card->generation;
+	node_id       = device->node->node_id;
+	local_node_id = device->card->local_node->node_id;
+
+	if (sbp2_send_management_orb(unit, node_id, generation,
+				     SBP2_LOGIN_REQUEST, lun, &response) < 0) {
+		if (sd->retries++ < 5) {
+			fw_error("login attempt %d for %s failed, "
+				 "rescheduling\n",
+				 sd->retries, unit->device.bus_id);
+			schedule_delayed_work(&sd->work, DIV_ROUND_UP(HZ, 5));
+		} else {
+			fw_error("failed to login to %s\n",
+				 unit->device.bus_id);
+			remove_scsi_devices(unit);
+		}
+		return;
+	}
+
+	sd->generation   = generation;
+	sd->node_id      = node_id;
+	sd->address_high = local_node_id << 16;
+
+	/* Get command block agent offset and login id. */
+	sd->command_block_agent_address =
+		((u64) response.command_block_agent.high << 32) |
+		response.command_block_agent.low;
+	sd->login_id = login_response_get_login_id(response);
+
+	fw_notify("logged in to sbp2 unit %s\n", unit->device.bus_id);
+	fw_notify(" - management_agent_address: 0x%012llx\n",
+		  (unsigned long long) sd->management_agent_address);
+	fw_notify(" - command_block_agent_address: 0x%012llx\n",
+		  (unsigned long long) sd->command_block_agent_address);
+	fw_notify(" - status write address: 0x%012llx\n",
+		  (unsigned long long) sd->address_handler.offset);
+
+#if 0
+	/* FIXME: The linux1394 sbp2 does this last step. */
+	sbp2_set_busy_timeout(scsi_id);
+#endif
+
+	INIT_DELAYED_WORK(&sd->work, sbp2_reconnect);
+	sbp2_agent_reset(unit);
+
+	retval = add_scsi_devices(unit);
+	if (retval < 0) {
+		sbp2_send_management_orb(unit, sd->node_id, sd->generation,
+					 SBP2_LOGOUT_REQUEST, sd->login_id,
+					 NULL);
+		/* Set this back to sbp2_login so we fall back and
+		 * retry login on bus reset. */
+		INIT_DELAYED_WORK(&sd->work, sbp2_login);
+	}
+}
+
+static int sbp2_probe(struct device *dev)
+{
+	struct fw_unit *unit = fw_unit(dev);
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd;
+	struct fw_csr_iterator ci;
+	int i, key, value;
+	u32 model, firmware_revision;
+
+	sd = kzalloc(sizeof *sd, GFP_KERNEL);
+	if (sd == NULL)
+		return -ENOMEM;
+
+	unit->device.driver_data = sd;
+	sd->unit = unit;
+	INIT_LIST_HEAD(&sd->orb_list);
+	setup_timer(&sd->orb_timer, orb_timer_callback, (unsigned long)sd);
+
+	sd->address_handler.length = 0x100;
+	sd->address_handler.address_callback = sbp2_status_write;
+	sd->address_handler.callback_data = sd;
+
+	if (fw_core_add_address_handler(&sd->address_handler,
+					&fw_high_memory_region) < 0) {
+		kfree(sd);
+		return -EBUSY;
+	}
+
+	if (fw_device_enable_phys_dma(device) < 0) {
+		fw_core_remove_address_handler(&sd->address_handler);
+		kfree(sd);
+		return -EBUSY;
+	}
+
+	/* Scan unit directory to get management agent address,
+	 * firmware revison and model.  Initialize firmware_revision
+	 * and model to values that wont match anything in our table. */
+	firmware_revision = 0xff000000;
+	model = 0xff000000;
+	fw_csr_iterator_init(&ci, unit->directory);
+	while (fw_csr_iterator_next(&ci, &key, &value)) {
+		switch (key) {
+		case CSR_DEPENDENT_INFO | CSR_OFFSET:
+			sd->management_agent_address =
+				0xfffff0000000ULL + 4 * value;
+			break;
+		case SBP2_FIRMWARE_REVISION:
+			firmware_revision = value;
+			break;
+		case CSR_MODEL:
+			model = value;
+			break;
+		}
+	}
+
+	for (i = 0; i < ARRAY_SIZE(sbp2_workarounds_table); i++) {
+		if (sbp2_workarounds_table[i].firmware_revision !=
+		    (firmware_revision & 0xffffff00))
+			continue;
+		if (sbp2_workarounds_table[i].model != model &&
+		    sbp2_workarounds_table[i].model != ~0)
+			continue;
+		sd->workarounds |= sbp2_workarounds_table[i].workarounds;
+		break;
+	}
+
+	if (sd->workarounds)
+		fw_notify("Workarounds for node %s: 0x%x "
+			  "(firmware_revision 0x%06x, model_id 0x%06x)\n",
+			  unit->device.bus_id,
+			  sd->workarounds, firmware_revision, model);
+
+	/* We schedule work to do the login so we can easily
+	 * reschedule retries. */
+	INIT_DELAYED_WORK(&sd->work, sbp2_login);
+	schedule_delayed_work(&sd->work, 0);
+
+	return 0;
+}
+
+static int sbp2_remove(struct device *dev)
+{
+	struct fw_unit *unit = fw_unit(dev);
+	struct sbp2_device *sd = unit->device.driver_data;
+
+	sbp2_send_management_orb(unit, sd->node_id, sd->generation,
+				 SBP2_LOGOUT_REQUEST, sd->login_id, NULL);
+
+	remove_scsi_devices(unit);
+	del_timer_sync(&sd->orb_timer);
+
+	fw_core_remove_address_handler(&sd->address_handler);
+	kfree(sd);
+
+	fw_notify("removed sbp2 unit %s\n", dev->bus_id);
+
+	return 0;
+}
+
+static void sbp2_reconnect(struct work_struct *work)
+{
+	struct sbp2_device *sd =
+		container_of(work, struct sbp2_device, work.work);
+	struct fw_unit *unit = sd->unit;
+	struct fw_device *device = fw_device(unit->device.parent);
+	int generation, node_id, local_node_id;
+
+	generation    = device->card->generation;
+	node_id       = device->node->node_id;
+	local_node_id = device->card->local_node->node_id;
+
+	if (sbp2_send_management_orb(unit, node_id, generation,
+				     SBP2_RECONNECT_REQUEST,
+				     sd->login_id, NULL) < 0) {
+		if (sd->retries++ < 5) {
+			fw_error("reconnect attempt %d for %s failed, "
+				 "rescheduling\n",
+				 sd->retries, unit->device.bus_id);
+		} else {
+			fw_error("failed to reconnect to %s\n",
+				 unit->device.bus_id);
+			/* Fall back and try to log in again. */
+			sd->retries = 0;
+			INIT_DELAYED_WORK(&sd->work, sbp2_login);
+		}
+		schedule_delayed_work(&sd->work, DIV_ROUND_UP(HZ, 5));
+		return;
+	}
+
+	sd->generation   = generation;
+	sd->node_id      = node_id;
+	sd->address_high = local_node_id << 16;
+
+	fw_notify("reconnected to unit %s\n", unit->device.bus_id);
+	sbp2_agent_reset(unit);
+	sbp2_cancel_orbs(unit);
+}
+
+static void sbp2_update(struct fw_unit *unit)
+{
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+
+	sd->retries = 0;
+	fw_device_enable_phys_dma(device);
+	schedule_delayed_work(&sd->work, 0);
+}
+
+#define SBP2_UNIT_SPEC_ID_ENTRY	0x0000609e
+#define SBP2_SW_VERSION_ENTRY	0x00010483
+
+static const struct fw_device_id sbp2_id_table[] = {
+	{
+		.match_flags  = FW_MATCH_SPECIFIER_ID | FW_MATCH_VERSION,
+		.specifier_id = SBP2_UNIT_SPEC_ID_ENTRY,
+		.version      = SBP2_SW_VERSION_ENTRY,
+	},
+	{ }
+};
+
+static struct fw_driver sbp2_driver = {
+	.driver   = {
+		.owner  = THIS_MODULE,
+		.name   = sbp2_driver_name,
+		.bus    = &fw_bus_type,
+		.probe  = sbp2_probe,
+		.remove = sbp2_remove,
+	},
+	.update   = sbp2_update,
+	.id_table = sbp2_id_table,
+};
+
+static unsigned int sbp2_status_to_sense_data(u8 * sbp2_status, u8 * sense_data)
+{
+	sense_data[0] = 0x70;
+	sense_data[1] = 0x0;
+	sense_data[2] = sbp2_status[1];
+	sense_data[3] = sbp2_status[4];
+	sense_data[4] = sbp2_status[5];
+	sense_data[5] = sbp2_status[6];
+	sense_data[6] = sbp2_status[7];
+	sense_data[7] = 10;
+	sense_data[8] = sbp2_status[8];
+	sense_data[9] = sbp2_status[9];
+	sense_data[10] = sbp2_status[10];
+	sense_data[11] = sbp2_status[11];
+	sense_data[12] = sbp2_status[2];
+	sense_data[13] = sbp2_status[3];
+	sense_data[14] = sbp2_status[12];
+	sense_data[15] = sbp2_status[13];
+
+	switch (sbp2_status[0] & 0x3f) {
+	case SAM_STAT_GOOD:
+		return DID_OK;
+
+	case SAM_STAT_CHECK_CONDITION:
+		/* return CHECK_CONDITION << 1 | DID_OK << 16; */
+		return DID_OK;
+
+	case SAM_STAT_BUSY:
+		return DID_BUS_BUSY;
+
+	case SAM_STAT_CONDITION_MET:
+	case SAM_STAT_RESERVATION_CONFLICT:
+	case SAM_STAT_COMMAND_TERMINATED:
+	default:
+		return DID_ERROR;
+	}
+}
+
+static void
+complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
+{
+	struct sbp2_command_orb *orb = (struct sbp2_command_orb *)base_orb;
+	struct fw_unit *unit = orb->unit;
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct scatterlist *sg;
+	int result;
+
+	if (status != NULL) {
+		if (status_get_dead(*status)) {
+			fw_notify("agent died, issuing agent reset\n");
+			sbp2_agent_reset(unit);
+		}
+
+		switch (status_get_response(*status)) {
+		case SBP2_STATUS_REQUEST_COMPLETE:
+			result = DID_OK;
+			break;
+		case SBP2_STATUS_TRANSPORT_FAILURE:
+			result = DID_BUS_BUSY;
+			break;
+		case SBP2_STATUS_ILLEGAL_REQUEST:
+		case SBP2_STATUS_VENDOR_DEPENDENT:
+		default:
+			result = DID_ERROR;
+			break;
+		}
+
+		if (result == DID_OK && status_get_len(*status) > 1)
+			result = sbp2_status_to_sense_data(status_get_data(*status),
+							   orb->cmd->sense_buffer);
+	} else {
+		/* If the orb completes with status == NULL, something
+		 * went wrong, typically a bus reset happened mid-orb
+		 * or when sending the write (less likely). */
+		fw_notify("no command orb status, rcode=%d\n",
+			  orb->base.rcode);
+		result = DID_BUS_BUSY;
+	}
+
+	dma_unmap_single(device->card->device, orb->base.request_bus,
+			 sizeof orb->request, DMA_TO_DEVICE);
+
+	if (orb->cmd->use_sg > 0) {
+		sg = (struct scatterlist *)orb->cmd->request_buffer;
+		dma_unmap_sg(device->card->device, sg, orb->cmd->use_sg,
+			     orb->cmd->sc_data_direction);
+	}
+
+	if (orb->page_table_bus != 0)
+		dma_unmap_single(device->card->device, orb->page_table_bus,
+				 sizeof orb->page_table_bus, DMA_TO_DEVICE);
+
+	if (orb->request_buffer_bus != 0)
+		dma_unmap_single(device->card->device, orb->request_buffer_bus,
+				 sizeof orb->request_buffer_bus,
+				 DMA_FROM_DEVICE);
+
+	orb->cmd->result = result << 16;
+	orb->done(orb->cmd);
+
+	kfree(orb);
+}
+
+static void sbp2_command_orb_map_scatterlist(struct sbp2_command_orb *orb)
+{
+	struct fw_unit *unit =
+		(struct fw_unit *)orb->cmd->device->host->hostdata[0];
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+	struct scatterlist *sg;
+	int sg_len, l, i, j, count;
+	size_t size;
+	dma_addr_t sg_addr;
+
+	sg = (struct scatterlist *)orb->cmd->request_buffer;
+	count = dma_map_sg(device->card->device, sg, orb->cmd->use_sg,
+			   orb->cmd->sc_data_direction);
+
+	/* Handle the special case where there is only one element in
+	 * the scatter list by converting it to an immediate block
+	 * request. This is also a workaround for broken devices such
+	 * as the second generation iPod which doesn't support page
+	 * tables. */
+	if (count == 1 && sg_dma_len(sg) < SBP2_MAX_SG_ELEMENT_LENGTH) {
+		orb->request.data_descriptor.high = sd->address_high;
+		orb->request.data_descriptor.low  = sg_dma_address(sg);
+		orb->request.misc |=
+			command_orb_data_size(sg_dma_len(sg));
+		return;
+	}
+
+	/* Convert the scatterlist to an sbp2 page table.  If any
+	 * scatterlist entries are too big for sbp2 we split the as we go. */
+	for (i = 0, j = 0; i < count; i++) {
+		sg_len = sg_dma_len(sg + i);
+		sg_addr = sg_dma_address(sg + i);
+		while (sg_len) {
+			l = min(sg_len, SBP2_MAX_SG_ELEMENT_LENGTH);
+			orb->page_table[j].low = sg_addr;
+			orb->page_table[j].high = (l << 16);
+			sg_addr += l;
+			sg_len -= l;
+			j++;
+		}
+	}
+
+	size = sizeof orb->page_table[0] * j;
+
+	/* The data_descriptor pointer is the one case where we need
+	 * to fill in the node ID part of the address.  All other
+	 * pointers assume that the data referenced reside on the
+	 * initiator (i.e. us), but data_descriptor can refer to data
+	 * on other nodes so we need to put our ID in descriptor.high. */
+
+	orb->page_table_bus =
+		dma_map_single(device->card->device, orb->page_table,
+			       size, DMA_TO_DEVICE);
+	orb->request.data_descriptor.high = sd->address_high;
+	orb->request.data_descriptor.low  = orb->page_table_bus;
+	orb->request.misc |=
+		command_orb_page_table_present |
+		command_orb_data_size(j);
+
+	fw_memcpy_to_be32(orb->page_table, orb->page_table, size);
+}
+
+static void sbp2_command_orb_map_buffer(struct sbp2_command_orb *orb)
+{
+	struct fw_unit *unit =
+		(struct fw_unit *)orb->cmd->device->host->hostdata[0];
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+
+	/* As for map_scatterlist, we need to fill in the high bits of
+	 * the data_descriptor pointer. */
+
+	orb->request_buffer_bus =
+		dma_map_single(device->card->device,
+			       orb->cmd->request_buffer,
+			       orb->cmd->request_bufflen,
+			       orb->cmd->sc_data_direction);
+	orb->request.data_descriptor.high = sd->address_high;
+	orb->request.data_descriptor.low  = orb->request_buffer_bus;
+	orb->request.misc |=
+		command_orb_data_size(orb->cmd->request_bufflen);
+}
+
+/* SCSI stack integration */
+
+static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
+{
+	struct fw_unit *unit = (struct fw_unit *)cmd->device->host->hostdata[0];
+	struct fw_device *device = fw_device(unit->device.parent);
+	struct sbp2_device *sd = unit->device.driver_data;
+	struct sbp2_command_orb *orb;
+
+	/* Bidirectional commands are not yet implemented, and unknown
+	 * transfer direction not handled. */
+	if (cmd->sc_data_direction == DMA_BIDIRECTIONAL) {
+		fw_error("Cannot handle DMA_BIDIRECTIONAL - rejecting command");
+		goto fail_alloc;
+	}
+
+	orb = kzalloc(sizeof *orb, GFP_ATOMIC);
+	if (orb == NULL) {
+		fw_notify("failed to alloc orb\n");
+		goto fail_alloc;
+	}
+
+	orb->base.request_bus =
+		dma_map_single(device->card->device, &orb->request,
+			       sizeof orb->request, DMA_TO_DEVICE);
+	if (dma_mapping_error(orb->base.request_bus))
+		goto fail_mapping;
+
+	orb->unit = unit;
+	orb->done = done;
+	orb->cmd  = cmd;
+
+	orb->request.next.high   = SBP2_ORB_NULL;
+	orb->request.next.low    = 0x0;
+	/* At speed 100 we can do 512 bytes per packet, at speed 200,
+	 * 1024 bytes per packet etc.  The SBP-2 max_payload field
+	 * specifies the max payload size as 2 ^ (max_payload + 2), so
+	 * if we set this to max_speed + 7, we get the right value. */
+	orb->request.misc =
+		command_orb_max_payload(device->node->max_speed + 7) |
+		command_orb_speed(device->node->max_speed) |
+		command_orb_notify;
+
+	if (cmd->sc_data_direction == DMA_FROM_DEVICE)
+		orb->request.misc |=
+			command_orb_direction(SBP2_DIRECTION_FROM_MEDIA);
+	else if (cmd->sc_data_direction == DMA_TO_DEVICE)
+		orb->request.misc |=
+			command_orb_direction(SBP2_DIRECTION_TO_MEDIA);
+
+	if (cmd->use_sg) {
+		sbp2_command_orb_map_scatterlist(orb);
+	} else if (cmd->request_bufflen > SBP2_MAX_SG_ELEMENT_LENGTH) {
+		/* FIXME: Need to split this into a sg list... but
+		 * could we get the scsi or blk layer to do that by
+		 * reporting our max supported block size? */
+		fw_error("command > 64k\n");
+		goto fail_bufflen;
+	} else if (cmd->request_bufflen > 0) {
+		sbp2_command_orb_map_buffer(orb);
+	}
+
+	fw_memcpy_to_be32(&orb->request, &orb->request, sizeof orb->request);
+
+	memset(orb->request.command_block,
+	       0, sizeof orb->request.command_block);
+	memcpy(orb->request.command_block, cmd->cmnd, COMMAND_SIZE(*cmd->cmnd));
+
+	orb->base.callback = complete_command_orb;
+
+	sbp2_send_orb(&orb->base, unit, sd->node_id, sd->generation,
+		      sd->command_block_agent_address + SBP2_ORB_POINTER);
+
+	return 0;
+
+ fail_bufflen:
+	dma_unmap_single(device->card->device, orb->base.request_bus,
+			 sizeof orb->request, DMA_TO_DEVICE);
+ fail_mapping:
+	kfree(orb);
+ fail_alloc:
+	cmd->result = DID_ERROR << 16;
+	done(cmd);
+	return 0;
+}
+
+static int sbp2_scsi_slave_alloc(struct scsi_device *sdev)
+{
+	struct fw_unit *unit = (struct fw_unit *)sdev->host->hostdata[0];
+	struct sbp2_device *sd = unit->device.driver_data;
+
+	sdev->allow_restart = 1;
+
+	if (sd->workarounds & SBP2_WORKAROUND_INQUIRY_36)
+		sdev->inquiry_len = 36;
+	return 0;
+}
+
+static int sbp2_scsi_slave_configure(struct scsi_device *sdev)
+{
+	struct fw_unit *unit = (struct fw_unit *)sdev->host->hostdata[0];
+	struct sbp2_device *sd = unit->device.driver_data;
+
+	sdev->use_10_for_rw = 1;
+
+	if (sdev->type == TYPE_ROM)
+		sdev->use_10_for_ms = 1;
+	if (sdev->type == TYPE_DISK &&
+	    sd->workarounds & SBP2_WORKAROUND_MODE_SENSE_8)
+		sdev->skip_ms_page_8 = 1;
+	if (sd->workarounds & SBP2_WORKAROUND_FIX_CAPACITY) {
+		fw_notify("setting fix_capacity for %s\n", unit->device.bus_id);
+		sdev->fix_capacity = 1;
+	}
+
+	return 0;
+}
+
+/*
+ * Called by scsi stack when something has really gone wrong.  Usually
+ * called when a command has timed-out for some reason.
+ */
+static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
+{
+	struct fw_unit *unit = (struct fw_unit *)cmd->device->host->hostdata[0];
+
+	fw_notify("sbp2_scsi_abort\n");
+
+	sbp2_cancel_orbs(unit);
+
+	return SUCCESS;
+}
+
+static struct scsi_host_template scsi_driver_template = {
+	.module			= THIS_MODULE,
+	.name			= "SBP-2 IEEE-1394",
+	.proc_name		= (char *)sbp2_driver_name,
+	.queuecommand		= sbp2_scsi_queuecommand,
+	.slave_alloc		= sbp2_scsi_slave_alloc,
+	.slave_configure	= sbp2_scsi_slave_configure,
+	.eh_abort_handler	= sbp2_scsi_abort,
+	.this_id		= -1,
+	.sg_tablesize		= SG_ALL,
+	.use_clustering		= ENABLE_CLUSTERING,
+	.cmd_per_lun		= 1,
+	.can_queue		= 1,
+};
+
+static int add_scsi_devices(struct fw_unit *unit)
+{
+	struct sbp2_device *sd = unit->device.driver_data;
+	int retval, lun;
+
+	if (sd->scsi_host != NULL)
+		return 0;
+
+	sd->scsi_host = scsi_host_alloc(&scsi_driver_template,
+					sizeof(unsigned long));
+	if (sd->scsi_host == NULL) {
+		fw_error("failed to register scsi host\n");
+		return -1;
+	}
+
+	sd->scsi_host->hostdata[0] = (unsigned long)unit;
+	retval = scsi_add_host(sd->scsi_host, &unit->device);
+	if (retval < 0) {
+		fw_error("failed to add scsi host\n");
+		scsi_host_put(sd->scsi_host);
+		return retval;
+	}
+
+	/* FIXME: Loop over luns here. */
+	lun = 0;
+	retval = scsi_add_device(sd->scsi_host, 0, 0, lun);
+	if (retval < 0) {
+		fw_error("failed to add scsi device\n");
+		scsi_remove_host(sd->scsi_host);
+		scsi_host_put(sd->scsi_host);
+		return retval;
+	}
+
+	return 0;
+}
+
+static void remove_scsi_devices(struct fw_unit *unit)
+{
+	struct sbp2_device *sd = unit->device.driver_data;
+
+	if (sd->scsi_host != NULL) {
+		scsi_remove_host(sd->scsi_host);
+		scsi_host_put(sd->scsi_host);
+	}
+	sd->scsi_host = NULL;
+}
+
+MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
+MODULE_DESCRIPTION("SCSI over IEEE1394");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
+
+static int __init sbp2_init(void)
+{
+	return driver_register(&sbp2_driver.driver);
+}
+
+static void __exit sbp2_cleanup(void)
+{
+	driver_unregister(&sbp2_driver.driver);
+}
+
+module_init(sbp2_init);
+module_exit(sbp2_cleanup);
diff --git a/drivers/firewire/fw-topology.c b/drivers/firewire/fw-topology.c
new file mode 100644
index 0000000..36c9be7
--- /dev/null
+++ b/drivers/firewire/fw-topology.c
@@ -0,0 +1,504 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-topology.c - Incremental bus scan, based on bus topology
+ *
+ * Copyright (C) 2004-2006 Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/wait.h>
+#include <linux/errno.h>
+#include "fw-transaction.h"
+#include "fw-topology.h"
+
+#define self_id_phy_id(q)		(((q) >> 24) & 0x3f)
+#define self_id_extended(q)		(((q) >> 23) & 0x01)
+#define self_id_link_on(q)		(((q) >> 22) & 0x01)
+#define self_id_gap_count(q)		(((q) >> 16) & 0x3f)
+#define self_id_phy_speed(q)		(((q) >> 14) & 0x03)
+#define self_id_contender(q)		(((q) >> 11) & 0x01)
+#define self_id_phy_initiator(q)	(((q) >>  1) & 0x01)
+#define self_id_more_packets(q)		(((q) >>  0) & 0x01)
+
+#define self_id_ext_sequence(q)		(((q) >> 20) & 0x07)
+
+static u32 *count_ports(u32 *sid, int *total_port_count, int *child_port_count)
+{
+	u32 q;
+	int port_type, shift, seq;
+
+	*total_port_count = 0;
+	*child_port_count = 0;
+
+	shift = 6;
+	q = *sid;
+	seq = 0;
+
+	while (1) {
+		port_type = (q >> shift) & 0x03;
+		switch (port_type) {
+		case SELFID_PORT_CHILD:
+			(*child_port_count)++;
+		case SELFID_PORT_PARENT:
+		case SELFID_PORT_NCONN:
+			(*total_port_count)++;
+		case SELFID_PORT_NONE:
+			break;
+		}
+
+		shift -= 2;
+		if (shift == 0) {
+			if (!self_id_more_packets(q))
+				return sid + 1;
+
+			shift = 16;
+			sid++;
+			q = *sid;
+
+			/* Check that the extra packets actually are
+			 * extended self ID packets and that the
+			 * sequence numbers in the extended self ID
+			 * packets increase as expected. */
+
+			if (!self_id_extended(q) ||
+			    seq != self_id_ext_sequence(q))
+				return NULL;
+
+			seq++;
+		}
+	}
+}
+
+static int get_port_type(u32 *sid, int port_index)
+{
+	int index, shift;
+
+	index = (port_index + 5) / 8;
+	shift = 16 - ((port_index + 5) & 7) * 2;
+	return (sid[index] >> shift) & 0x03;
+}
+
+static struct fw_node *fw_node_create(u32 sid, int port_count, int color)
+{
+	struct fw_node *node;
+
+	node = kzalloc(sizeof *node + port_count * sizeof node->ports[0],
+		       GFP_ATOMIC);
+	if (node == NULL)
+		return NULL;
+
+	node->color = color;
+	node->node_id = LOCAL_BUS | self_id_phy_id(sid);
+	node->link_on = self_id_link_on(sid);
+	node->phy_speed = self_id_phy_speed(sid);
+	node->port_count = port_count;
+
+	atomic_set(&node->ref_count, 1);
+	INIT_LIST_HEAD(&node->link);
+
+	return node;
+}
+
+/* Compute the maximum hop count for this node and it's children.  The
+ * maximum hop count is the maximum number of connections between any
+ * two nodes in the subtree rooted at this node.  We need this for
+ * setting the gap count.  As we build the tree bottom up in
+ * build_tree() below, this is fairly easy to do: for each node we
+ * maintain the max hop count and the max depth, ie the number of hops
+ * to the furthest leaf.  Computing the max hop count breaks down into
+ * two cases: either the path goes through this node, in which case
+ * the hop count is the sum of the two biggest child depths plus 2.
+ * Or it could be the case that the max hop path is entirely
+ * containted in a child tree, in which case the max hop count is just
+ * the max hop count of this child.
+ */
+static void update_hop_count(struct fw_node *node)
+{
+	int depths[2] = { -1, -1 };
+	int max_child_hops = 0;
+	int i;
+
+	for (i = 0; i < node->port_count; i++) {
+		if (node->ports[i].node == NULL)
+			continue;
+
+		if (node->ports[i].node->max_hops > max_child_hops)
+			max_child_hops = node->ports[i].node->max_hops;
+
+		if (node->ports[i].node->max_depth > depths[0]) {
+			depths[1] = depths[0];
+			depths[0] = node->ports[i].node->max_depth;
+		} else if (node->ports[i].node->max_depth > depths[1])
+			depths[1] = node->ports[i].node->max_depth;
+	}
+
+	node->max_depth = depths[0] + 1;
+	node->max_hops = max(max_child_hops, depths[0] + depths[1] + 2);
+}
+
+
+/**
+ * build_tree - Build the tree representation of the topology
+ * @self_ids: array of self IDs to create the tree from
+ * @self_id_count: the length of the self_ids array
+ * @local_id: the node ID of the local node
+ *
+ * This function builds the tree representation of the topology given
+ * by the self IDs from the latest bus reset.  During the construction
+ * of the tree, the function checks that the self IDs are valid and
+ * internally consistent.  On succcess this funtions returns the
+ * fw_node corresponding to the local card otherwise NULL.
+ */
+static struct fw_node *build_tree(struct fw_card *card)
+{
+	struct fw_node *node, *child, *local_node;
+	struct list_head stack, *h;
+	u32 *sid, *next_sid, *end, q;
+	int i, port_count, child_port_count, phy_id, parent_count, stack_depth;
+	int gap_count, topology_type;
+
+	local_node = NULL;
+	node = NULL;
+	INIT_LIST_HEAD(&stack);
+	stack_depth = 0;
+	sid = card->self_ids;
+	end = sid + card->self_id_count;
+	phy_id = 0;
+	card->irm_node = NULL;
+	gap_count = self_id_gap_count(*sid);
+	topology_type = 0;
+
+	while (sid < end) {
+		next_sid = count_ports(sid, &port_count, &child_port_count);
+
+		if (next_sid == NULL) {
+			fw_error("Inconsistent extended self IDs.\n");
+			return NULL;
+		}
+
+		q = *sid;
+		if (phy_id != self_id_phy_id(q)) {
+			fw_error("PHY ID mismatch in self ID: %d != %d.\n",
+				 phy_id, self_id_phy_id(q));
+			return NULL;
+		}
+
+		if (child_port_count > stack_depth) {
+			fw_error("Topology stack underflow\n");
+			return NULL;
+		}
+
+		/* Seek back from the top of our stack to find the
+		 * start of the child nodes for this node. */
+		for (i = 0, h = &stack; i < child_port_count; i++)
+			h = h->prev;
+		child = fw_node(h);
+
+		node = fw_node_create(q, port_count, card->color);
+		if (node == NULL) {
+			fw_error("Out of memory while building topology.");
+			return NULL;
+		}
+
+		if (phy_id == (card->node_id & 0x3f))
+			local_node = node;
+
+		if (self_id_contender(q))
+			card->irm_node = node;
+
+		if (node->phy_speed == SCODE_BETA)
+			topology_type |= FW_TOPOLOGY_B;
+		else
+			topology_type |= FW_TOPOLOGY_A;
+
+		parent_count = 0;
+
+		for (i = 0; i < port_count; i++) {
+			switch (get_port_type(sid, i)) {
+			case SELFID_PORT_PARENT:
+				/* Who's your daddy?  We dont know the
+				 * parent node at this time, so we
+				 * temporarily abuse node->color for
+				 * remembering the entry in the
+				 * node->ports array where the parent
+				 * node should be.  Later, when we
+				 * handle the parent node, we fix up
+				 * the reference.
+				 */
+				parent_count++;
+				node->color = i;
+				break;
+
+			case SELFID_PORT_CHILD:
+				node->ports[i].node = child;
+				/* Fix up parent reference for this
+				 * child node. */
+				child->ports[child->color].node = node;
+				child->color = card->color;
+				child = fw_node(child->link.next);
+				break;
+			}
+		}
+
+		/* Check that the node reports exactly one parent
+		 * port, except for the root, which of course should
+		 * have no parents. */
+		if ((next_sid == end && parent_count != 0) ||
+		    (next_sid < end && parent_count != 1)) {
+			fw_error("Parent port inconsistency for node %d: "
+				 "parent_count=%d\n", phy_id, parent_count);
+			return NULL;
+		}
+
+		/* Pop the child nodes off the stack and push the new node. */
+		__list_del(h->prev, &stack);
+		list_add_tail(&node->link, &stack);
+		stack_depth += 1 - child_port_count;
+
+		/* If all PHYs does not report the same gap count
+		 * setting, we fall back to 63 which will force a gap
+		 * count reconfiguration and a reset. */
+		if (self_id_gap_count(q) != gap_count)
+			gap_count = 63;
+
+		update_hop_count(node);
+
+		sid = next_sid;
+		phy_id++;
+	}
+
+	card->root_node = node;
+	card->gap_count = gap_count;
+	card->topology_type = topology_type;
+
+	return local_node;
+}
+
+typedef void (*fw_node_callback_t) (struct fw_card * card,
+				    struct fw_node * node,
+				    struct fw_node * parent);
+
+static void
+for_each_fw_node(struct fw_card *card, struct fw_node *root,
+		 fw_node_callback_t callback)
+{
+	struct list_head list;
+	struct fw_node *node, *next, *child, *parent;
+	int i;
+
+	INIT_LIST_HEAD(&list);
+
+	fw_node_get(root);
+	list_add_tail(&root->link, &list);
+	parent = NULL;
+	list_for_each_entry(node, &list, link) {
+		node->color = card->color;
+
+		for (i = 0; i < node->port_count; i++) {
+			child = node->ports[i].node;
+			if (!child)
+				continue;
+			if (child->color == card->color)
+				parent = child;
+			else {
+				fw_node_get(child);
+				list_add_tail(&child->link, &list);
+			}
+		}
+
+		callback(card, node, parent);
+	}
+
+	list_for_each_entry_safe(node, next, &list, link)
+		fw_node_put(node);
+}
+
+static void
+report_lost_node(struct fw_card *card,
+		 struct fw_node *node, struct fw_node *parent)
+{
+	fw_node_event(card, node, FW_NODE_DESTROYED);
+	fw_node_put(node);
+}
+
+static void
+report_found_node(struct fw_card *card,
+		  struct fw_node *node, struct fw_node *parent)
+{
+	int b_path = (node->phy_speed == SCODE_BETA);
+
+	if (parent != NULL) {
+		/* min() macro doesn't work here with gcc 3.4 */
+		node->max_speed = parent->max_speed < node->phy_speed ?
+					parent->max_speed : node->phy_speed;
+		node->b_path = parent->b_path && b_path;
+	} else {
+		node->max_speed = node->phy_speed;
+		node->b_path = b_path;
+	}
+
+	fw_node_event(card, node, FW_NODE_CREATED);
+}
+
+void fw_destroy_nodes(struct fw_card *card)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&card->lock, flags);
+	card->color++;
+	if (card->local_node != NULL)
+		for_each_fw_node(card, card->local_node, report_lost_node);
+	spin_unlock_irqrestore(&card->lock, flags);
+}
+
+static void move_tree(struct fw_node *node0, struct fw_node *node1, int port)
+{
+	struct fw_node *tree;
+	int i;
+
+	tree = node1->ports[port].node;
+	node0->ports[port].node = tree;
+	for (i = 0; i < tree->port_count; i++) {
+		if (tree->ports[i].node == node1) {
+			tree->ports[i].node = node0;
+			break;
+		}
+	}
+}
+
+/**
+ * update_tree - compare the old topology tree for card with the new
+ * one specified by root.  Queue the nodes and mark them as either
+ * found, lost or updated.  Update the nodes in the card topology tree
+ * as we go.
+ */
+static void
+update_tree(struct fw_card *card, struct fw_node *root)
+{
+	struct list_head list0, list1;
+	struct fw_node *node0, *node1;
+	int i, event;
+
+	INIT_LIST_HEAD(&list0);
+	list_add_tail(&card->local_node->link, &list0);
+	INIT_LIST_HEAD(&list1);
+	list_add_tail(&root->link, &list1);
+
+	node0 = fw_node(list0.next);
+	node1 = fw_node(list1.next);
+
+	while (&node0->link != &list0) {
+
+		/* assert(node0->port_count == node1->port_count); */
+		if (node0->link_on && !node1->link_on)
+			event = FW_NODE_LINK_OFF;
+		else if (!node0->link_on && node1->link_on)
+			event = FW_NODE_LINK_ON;
+		else
+			event = FW_NODE_UPDATED;
+
+		node0->node_id = node1->node_id;
+		node0->color = card->color;
+		node0->link_on = node1->link_on;
+		node0->initiated_reset = node1->initiated_reset;
+		node0->max_hops = node1->max_hops;
+		node1->color = card->color;
+		fw_node_event(card, node0, event);
+
+		if (card->root_node == node1)
+			card->root_node = node0;
+		if (card->irm_node == node1)
+			card->irm_node = node0;
+
+		for (i = 0; i < node0->port_count; i++) {
+			if (node0->ports[i].node && node1->ports[i].node) {
+				/* This port didn't change, queue the
+				 * connected node for further
+				 * investigation. */
+				if (node0->ports[i].node->color == card->color)
+					continue;
+				list_add_tail(&node0->ports[i].node->link,
+					      &list0);
+				list_add_tail(&node1->ports[i].node->link,
+					      &list1);
+			} else if (node0->ports[i].node) {
+				/* The nodes connected here were
+				 * unplugged; unref the lost nodes and
+				 * queue FW_NODE_LOST callbacks for
+				 * them. */
+
+				for_each_fw_node(card, node0->ports[i].node,
+						 report_lost_node);
+				node0->ports[i].node = NULL;
+			} else if (node1->ports[i].node) {
+				/* One or more node were connected to
+				 * this port. Move the new nodes into
+				 * the tree and queue FW_NODE_CREATED
+				 * callbacks for them. */
+				move_tree(node0, node1, i);
+				for_each_fw_node(card, node0->ports[i].node,
+						 report_found_node);
+			}
+		}
+
+		node0 = fw_node(node0->link.next);
+		node1 = fw_node(node1->link.next);
+	}
+}
+
+void
+fw_core_handle_bus_reset(struct fw_card *card,
+			 int node_id, int generation,
+			 int self_id_count, u32 * self_ids)
+{
+	struct fw_node *local_node;
+	unsigned long flags;
+
+	fw_flush_transactions(card);
+
+	spin_lock_irqsave(&card->lock, flags);
+
+	/* If the new topology has a different self_id_count the topology
+	 * changed, either nodes were added or removed. In that case we
+	 * reset the IRM reset counter. */
+	if (card->self_id_count != self_id_count)
+		card->bm_retries = 0;
+
+	card->node_id = node_id;
+	card->self_id_count = self_id_count;
+	card->generation = generation;
+	memcpy(card->self_ids, self_ids, self_id_count * 4);
+	card->reset_jiffies = jiffies;
+	schedule_delayed_work(&card->work, 0);
+
+	local_node = build_tree(card);
+
+	card->color++;
+
+	if (local_node == NULL) {
+		fw_error("topology build failed\n");
+		/* FIXME: We need to issue a bus reset in this case. */
+	} else if (card->local_node == NULL) {
+		card->local_node = local_node;
+		for_each_fw_node(card, local_node, report_found_node);
+	} else {
+		update_tree(card, local_node);
+	}
+
+	spin_unlock_irqrestore(&card->lock, flags);
+}
+EXPORT_SYMBOL(fw_core_handle_bus_reset);
diff --git a/drivers/firewire/fw-topology.h b/drivers/firewire/fw-topology.h
new file mode 100644
index 0000000..f2a575e
--- /dev/null
+++ b/drivers/firewire/fw-topology.h
@@ -0,0 +1,91 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-topology.h -- Incremental bus scan, based on bus topology
+ *
+ * Copyright (C) 2003-2006 Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __fw_topology_h
+#define __fw_topology_h
+
+enum {
+	FW_TOPOLOGY_A =		0x01,
+	FW_TOPOLOGY_B =		0x02,
+	FW_TOPOLOGY_MIXED =	0x03,
+};
+
+enum {
+	FW_NODE_CREATED =   0x00,
+	FW_NODE_UPDATED =   0x01,
+	FW_NODE_DESTROYED = 0x02,
+	FW_NODE_LINK_ON =   0x03,
+	FW_NODE_LINK_OFF =  0x04,
+};
+
+struct fw_port {
+	struct fw_node *node;
+	unsigned speed : 3; /* S100, S200, ... S3200 */
+};
+
+struct fw_node {
+	u16 node_id;
+	u8 color;
+	u8 port_count;
+	unsigned link_on : 1;
+	unsigned initiated_reset : 1;
+	unsigned b_path : 1;
+	u8 phy_speed : 3; /* As in the self ID packet. */
+	u8 max_speed : 5; /* Minimum of all phy-speeds and port speeds on
+			   * the path from the local node to this node. */
+	u8 max_depth : 4; /* Maximum depth to any leaf node */
+	u8 max_hops : 4;  /* Max hops in this sub tree */
+	atomic_t ref_count;
+
+	/* For serializing node topology into a list. */
+	struct list_head link;
+
+	/* Upper layer specific data. */
+	void *data;
+
+	struct fw_port ports[0];
+};
+
+static inline struct fw_node *
+fw_node(struct list_head *l)
+{
+	return list_entry (l, struct fw_node, link);
+}
+
+static inline struct fw_node *
+fw_node_get(struct fw_node *node)
+{
+	atomic_inc(&node->ref_count);
+
+	return node;
+}
+
+static inline void
+fw_node_put(struct fw_node *node)
+{
+	if (atomic_dec_and_test(&node->ref_count))
+		kfree(node);
+}
+
+void
+fw_destroy_nodes(struct fw_card *card);
+
+#endif /* __fw_topology_h */
diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
new file mode 100644
index 0000000..5394569
--- /dev/null
+++ b/drivers/firewire/fw-transaction.c
@@ -0,0 +1,763 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-transaction.c - core IEEE1394 transaction logic
+ *
+ * Copyright (C) 2004-2006 Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/poll.h>
+#include <linux/list.h>
+#include <linux/kthread.h>
+#include <asm/uaccess.h>
+#include <asm/semaphore.h>
+
+#include "fw-transaction.h"
+#include "fw-topology.h"
+#include "fw-device.h"
+
+#define header_pri(pri)			((pri) << 0)
+#define header_tcode(tcode)		((tcode) << 4)
+#define header_retry(retry)		((retry) << 8)
+#define header_tlabel(tlabel)		((tlabel) << 10)
+#define header_destination(destination)	((destination) << 16)
+#define header_source(source)		((source) << 16)
+#define header_rcode(rcode)		((rcode) << 12)
+#define header_offset_high(offset_high)	((offset_high) << 0)
+#define header_data_length(length)	((length) << 16)
+#define header_extended_tcode(tcode)	((tcode) << 0)
+
+#define header_get_tcode(q)		(((q) >> 4) & 0x0f)
+#define header_get_tlabel(q)		(((q) >> 10) & 0x3f)
+#define header_get_rcode(q)		(((q) >> 12) & 0x0f)
+#define header_get_destination(q)	(((q) >> 16) & 0xffff)
+#define header_get_source(q)		(((q) >> 16) & 0xffff)
+#define header_get_offset_high(q)	(((q) >> 0) & 0xffff)
+#define header_get_data_length(q)	(((q) >> 16) & 0xffff)
+#define header_get_extended_tcode(q)	(((q) >> 0) & 0xffff)
+
+#define phy_config_gap_count(gap_count)	(((gap_count) << 16) | (1 << 22))
+#define phy_config_root_id(node_id)	((((node_id) & 0x3f) << 24) | (1 << 23))
+#define phy_identifier(id)		((id) << 30)
+
+static int
+close_transaction(struct fw_transaction *transaction,
+		  struct fw_card *card, int rcode,
+		  u32 *payload, size_t length)
+{
+	struct fw_transaction *t;
+	unsigned long flags;
+
+	spin_lock_irqsave(&card->lock, flags);
+	list_for_each_entry(t, &card->transaction_list, link) {
+		if (t == transaction) {
+			list_del(&t->link);
+			card->tlabel_mask &= ~(1 << t->tlabel);
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	if (&t->link != &card->transaction_list) {
+		t->callback(card, rcode, payload, length, t->callback_data);
+		return 0;
+	}
+
+	return -ENOENT;
+}
+
+/* Only valid for transactions that are potentially pending (ie have
+ * been sent). */
+int
+fw_cancel_transaction(struct fw_card *card,
+		      struct fw_transaction *transaction)
+{
+	/* Cancel the packet transmission if it's still queued.  That
+	 * will call the packet transmission callback which cancels
+	 * the transaction. */
+
+	if (card->driver->cancel_packet(card, &transaction->packet) == 0)
+		return 0;
+
+	/* If the request packet has already been sent, we need to see
+	 * if the transaction is still pending and remove it in that case. */
+
+	return close_transaction(transaction, card, RCODE_CANCELLED, NULL, 0);
+}
+EXPORT_SYMBOL(fw_cancel_transaction);
+
+static void
+transmit_complete_callback(struct fw_packet *packet,
+			   struct fw_card *card, int status)
+{
+	struct fw_transaction *t =
+	    container_of(packet, struct fw_transaction, packet);
+
+	switch (status) {
+	case ACK_COMPLETE:
+		close_transaction(t, card, RCODE_COMPLETE, NULL, 0);
+		break;
+	case ACK_PENDING:
+		t->timestamp = packet->timestamp;
+		break;
+	case ACK_BUSY_X:
+	case ACK_BUSY_A:
+	case ACK_BUSY_B:
+		close_transaction(t, card, RCODE_BUSY, NULL, 0);
+		break;
+	case ACK_DATA_ERROR:
+		close_transaction(t, card, RCODE_DATA_ERROR, NULL, 0);
+		break;
+	case ACK_TYPE_ERROR:
+		close_transaction(t, card, RCODE_TYPE_ERROR, NULL, 0);
+		break;
+	default:
+		/* In this case the ack is really a juju specific
+		 * rcode, so just forward that to the callback. */
+		close_transaction(t, card, status, NULL, 0);
+		break;
+	}
+}
+
+static void
+fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
+		int node_id, int generation, int speed,
+		unsigned long long offset, void *payload, size_t length)
+{
+	int ext_tcode;
+
+	if (tcode > 0x10) {
+		ext_tcode = tcode - 0x10;
+		tcode = TCODE_LOCK_REQUEST;
+	} else
+		ext_tcode = 0;
+
+	packet->header[0] =
+		header_retry(RETRY_X) |
+		header_tlabel(tlabel) |
+		header_tcode(tcode) |
+		header_destination(node_id);
+	packet->header[1] =
+		header_offset_high(offset >> 32) | header_source(0);
+	packet->header[2] =
+		offset;
+
+	switch (tcode) {
+	case TCODE_WRITE_QUADLET_REQUEST:
+		packet->header[3] = *(u32 *)payload;
+		packet->header_length = 16;
+		packet->payload_length = 0;
+		break;
+
+	case TCODE_LOCK_REQUEST:
+	case TCODE_WRITE_BLOCK_REQUEST:
+		packet->header[3] =
+			header_data_length(length) |
+			header_extended_tcode(ext_tcode);
+		packet->header_length = 16;
+		packet->payload = payload;
+		packet->payload_length = length;
+		break;
+
+	case TCODE_READ_QUADLET_REQUEST:
+		packet->header_length = 12;
+		packet->payload_length = 0;
+		break;
+
+	case TCODE_READ_BLOCK_REQUEST:
+		packet->header[3] =
+			header_data_length(length) |
+			header_extended_tcode(ext_tcode);
+		packet->header_length = 16;
+		packet->payload_length = 0;
+		break;
+	}
+
+	packet->speed = speed;
+	packet->generation = generation;
+	packet->ack = 0;
+}
+
+/**
+ * This function provides low-level access to the IEEE1394 transaction
+ * logic.  Most C programs would use either fw_read(), fw_write() or
+ * fw_lock() instead - those function are convenience wrappers for
+ * this function.  The fw_send_request() function is primarily
+ * provided as a flexible, one-stop entry point for languages bindings
+ * and protocol bindings.
+ *
+ * FIXME: Document this function further, in particular the possible
+ * values for rcode in the callback.  In short, we map ACK_COMPLETE to
+ * RCODE_COMPLETE, internal errors set errno and set rcode to
+ * RCODE_SEND_ERROR (which is out of range for standard ieee1394
+ * rcodes).  All other rcodes are forwarded unchanged.  For all
+ * errors, payload is NULL, length is 0.
+ *
+ * Can not expect the callback to be called before the function
+ * returns, though this does happen in some cases (ACK_COMPLETE and
+ * errors).
+ *
+ * The payload is only used for write requests and must not be freed
+ * until the callback has been called.
+ *
+ * @param card the card from which to send the request
+ * @param tcode the tcode for this transaction.  Do not use
+ *   TCODE_LOCK_REQUEST directly, insted use TCODE_LOCK_MASK_SWAP
+ *   etc. to specify tcode and ext_tcode.
+ * @param node_id the destination node ID (bus ID and PHY ID concatenated)
+ * @param generation the generation for which node_id is valid
+ * @param speed the speed to use for sending the request
+ * @param offset the 48 bit offset on the destination node
+ * @param payload the data payload for the request subaction
+ * @param length the length in bytes of the data to read
+ * @param callback function to be called when the transaction is completed
+ * @param callback_data pointer to arbitrary data, which will be
+ *   passed to the callback
+ */
+void
+fw_send_request(struct fw_card *card, struct fw_transaction *t,
+		int tcode, int node_id, int generation, int speed,
+		unsigned long long offset,
+		void *payload, size_t length,
+		fw_transaction_callback_t callback, void *callback_data)
+{
+	unsigned long flags;
+	int tlabel;
+
+	/* Bump the flush timer up 100ms first of all so we
+	 * don't race with a flush timer callback. */
+
+	mod_timer(&card->flush_timer, jiffies + DIV_ROUND_UP(HZ, 10));
+
+	/* Allocate tlabel from the bitmap and put the transaction on
+	 * the list while holding the card spinlock. */
+
+	spin_lock_irqsave(&card->lock, flags);
+
+	tlabel = card->current_tlabel;
+	if (card->tlabel_mask & (1 << tlabel)) {
+		spin_unlock_irqrestore(&card->lock, flags);
+		callback(card, RCODE_SEND_ERROR, NULL, 0, callback_data);
+		return;
+	}
+
+	card->current_tlabel = (card->current_tlabel + 1) & 0x1f;
+	card->tlabel_mask |= (1 << tlabel);
+
+	list_add_tail(&t->link, &card->transaction_list);
+
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	/* Initialize rest of transaction, fill out packet and send it. */
+	t->node_id = node_id;
+	t->tlabel = tlabel;
+	t->callback = callback;
+	t->callback_data = callback_data;
+
+	fw_fill_request(&t->packet, tcode, t->tlabel,
+			node_id, generation, speed, offset, payload, length);
+	t->packet.callback = transmit_complete_callback;
+
+	card->driver->send_request(card, &t->packet);
+}
+EXPORT_SYMBOL(fw_send_request);
+
+static void
+transmit_phy_packet_callback(struct fw_packet *packet,
+			     struct fw_card *card, int status)
+{
+	kfree(packet);
+}
+
+static void send_phy_packet(struct fw_card *card, u32 data, int generation)
+{
+	struct fw_packet *packet;
+
+	packet = kzalloc(sizeof *packet, GFP_ATOMIC);
+	if (packet == NULL)
+		return;
+
+	packet->header[0] = data;
+	packet->header[1] = ~data;
+	packet->header_length = 8;
+	packet->payload_length = 0;
+	packet->speed = SCODE_100;
+	packet->generation = generation;
+	packet->callback = transmit_phy_packet_callback;
+
+	card->driver->send_request(card, packet);
+}
+
+void fw_send_phy_config(struct fw_card *card,
+			int node_id, int generation, int gap_count)
+{
+	u32 q;
+
+	q = phy_identifier(PHY_PACKET_CONFIG) |
+		phy_config_root_id(node_id) |
+		phy_config_gap_count(gap_count);
+
+	send_phy_packet(card, q, generation);
+}
+
+void fw_flush_transactions(struct fw_card *card)
+{
+	struct fw_transaction *t, *next;
+	struct list_head list;
+	unsigned long flags;
+
+	INIT_LIST_HEAD(&list);
+	spin_lock_irqsave(&card->lock, flags);
+	list_splice_init(&card->transaction_list, &list);
+	card->tlabel_mask = 0;
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	list_for_each_entry_safe(t, next, &list, link) {
+		card->driver->cancel_packet(card, &t->packet);
+
+		/* At this point cancel_packet will never call the
+		 * transaction callback, since we just took all the
+		 * transactions out of the list.  So do it here.*/
+		t->callback(card, RCODE_CANCELLED, NULL, 0, t->callback_data);
+	}
+}
+
+static struct fw_address_handler *
+lookup_overlapping_address_handler(struct list_head *list,
+				   unsigned long long offset, size_t length)
+{
+	struct fw_address_handler *handler;
+
+	list_for_each_entry(handler, list, link) {
+		if (handler->offset < offset + length &&
+		    offset < handler->offset + handler->length)
+			return handler;
+	}
+
+	return NULL;
+}
+
+static struct fw_address_handler *
+lookup_enclosing_address_handler(struct list_head *list,
+				 unsigned long long offset, size_t length)
+{
+	struct fw_address_handler *handler;
+
+	list_for_each_entry(handler, list, link) {
+		if (handler->offset <= offset &&
+		    offset + length <= handler->offset + handler->length)
+			return handler;
+	}
+
+	return NULL;
+}
+
+static DEFINE_SPINLOCK(address_handler_lock);
+static LIST_HEAD(address_handler_list);
+
+const struct fw_address_region fw_low_memory_region =
+	{ .start = 0x000000000000ULL, .end = 0x000100000000ULL,  };
+const struct fw_address_region fw_high_memory_region =
+	{ .start = 0x000100000000ULL, .end = 0xffffe0000000ULL,  };
+const struct fw_address_region fw_private_region =
+	{ .start = 0xffffe0000000ULL, .end = 0xfffff0000000ULL,  };
+const struct fw_address_region fw_csr_region =
+	{ .start = 0xfffff0000000ULL, .end = 0xfffff0000800ULL,  };
+const struct fw_address_region fw_unit_space_region =
+	{ .start = 0xfffff0000900ULL, .end = 0x1000000000000ULL, };
+EXPORT_SYMBOL(fw_low_memory_region);
+EXPORT_SYMBOL(fw_high_memory_region);
+EXPORT_SYMBOL(fw_private_region);
+EXPORT_SYMBOL(fw_csr_region);
+EXPORT_SYMBOL(fw_unit_space_region);
+
+/**
+ * Allocate a range of addresses in the node space of the OHCI
+ * controller.  When a request is received that falls within the
+ * specified address range, the specified callback is invoked.  The
+ * parameters passed to the callback give the details of the
+ * particular request
+ */
+int
+fw_core_add_address_handler(struct fw_address_handler *handler,
+			    const struct fw_address_region *region)
+{
+	struct fw_address_handler *other;
+	unsigned long flags;
+	int ret = -EBUSY;
+
+	spin_lock_irqsave(&address_handler_lock, flags);
+
+	handler->offset = region->start;
+	while (handler->offset + handler->length <= region->end) {
+		other =
+		    lookup_overlapping_address_handler(&address_handler_list,
+						       handler->offset,
+						       handler->length);
+		if (other != NULL) {
+			handler->offset += other->length;
+		} else {
+			list_add_tail(&handler->link, &address_handler_list);
+			ret = 0;
+			break;
+		}
+	}
+
+	spin_unlock_irqrestore(&address_handler_lock, flags);
+
+	return ret;
+}
+EXPORT_SYMBOL(fw_core_add_address_handler);
+
+/**
+ * Deallocate a range of addresses allocated with fw_allocate.  This
+ * will call the associated callback one last time with a the special
+ * tcode TCODE_DEALLOCATE, to let the client destroy the registered
+ * callback data.  For convenience, the callback parameters offset and
+ * length are set to the start and the length respectively for the
+ * deallocated region, payload is set to NULL.
+ */
+void fw_core_remove_address_handler(struct fw_address_handler *handler)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&address_handler_lock, flags);
+	list_del(&handler->link);
+	spin_unlock_irqrestore(&address_handler_lock, flags);
+}
+EXPORT_SYMBOL(fw_core_remove_address_handler);
+
+struct fw_request {
+	struct fw_packet response;
+	u32 request_header[4];
+	int ack;
+	u32 length;
+	u32 data[0];
+};
+
+static void
+free_response_callback(struct fw_packet *packet,
+		       struct fw_card *card, int status)
+{
+	struct fw_request *request;
+
+	request = container_of(packet, struct fw_request, response);
+	kfree(request);
+}
+
+void
+fw_fill_response(struct fw_packet *response, u32 *request_header,
+		 int rcode, void *payload, size_t length)
+{
+	int tcode, tlabel, extended_tcode, source, destination;
+
+	tcode          = header_get_tcode(request_header[0]);
+	tlabel         = header_get_tlabel(request_header[0]);
+	source         = header_get_destination(request_header[0]);
+	destination    = header_get_source(request_header[1]);
+	extended_tcode = header_get_extended_tcode(request_header[3]);
+
+	response->header[0] =
+		header_retry(RETRY_1) |
+		header_tlabel(tlabel) |
+		header_destination(destination);
+	response->header[1] =
+		header_source(source) |
+		header_rcode(rcode);
+	response->header[2] = 0;
+
+	switch (tcode) {
+	case TCODE_WRITE_QUADLET_REQUEST:
+	case TCODE_WRITE_BLOCK_REQUEST:
+		response->header[0] |= header_tcode(TCODE_WRITE_RESPONSE);
+		response->header_length = 12;
+		response->payload_length = 0;
+		break;
+
+	case TCODE_READ_QUADLET_REQUEST:
+		response->header[0] |=
+			header_tcode(TCODE_READ_QUADLET_RESPONSE);
+		if (payload != NULL)
+			response->header[3] = *(u32 *)payload;
+		else
+			response->header[3] = 0;
+		response->header_length = 16;
+		response->payload_length = 0;
+		break;
+
+	case TCODE_READ_BLOCK_REQUEST:
+	case TCODE_LOCK_REQUEST:
+		response->header[0] |= header_tcode(tcode + 2);
+		response->header[3] =
+			header_data_length(length) |
+			header_extended_tcode(extended_tcode);
+		response->header_length = 16;
+		response->payload = payload;
+		response->payload_length = length;
+		break;
+
+	default:
+		BUG();
+		return;
+	}
+}
+EXPORT_SYMBOL(fw_fill_response);
+
+static struct fw_request *
+allocate_request(struct fw_packet *p)
+{
+	struct fw_request *request;
+	u32 *data, length;
+	int request_tcode, t;
+
+	request_tcode = header_get_tcode(p->header[0]);
+	switch (request_tcode) {
+	case TCODE_WRITE_QUADLET_REQUEST:
+		data = &p->header[3];
+		length = 4;
+		break;
+
+	case TCODE_WRITE_BLOCK_REQUEST:
+	case TCODE_LOCK_REQUEST:
+		data = p->payload;
+		length = header_get_data_length(p->header[3]);
+		break;
+
+	case TCODE_READ_QUADLET_REQUEST:
+		data = NULL;
+		length = 4;
+		break;
+
+	case TCODE_READ_BLOCK_REQUEST:
+		data = NULL;
+		length = header_get_data_length(p->header[3]);
+		break;
+
+	default:
+		BUG();
+		return NULL;
+	}
+
+	request = kmalloc(sizeof *request + length, GFP_ATOMIC);
+	if (request == NULL)
+		return NULL;
+
+	t = (p->timestamp & 0x1fff) + 4000;
+	if (t >= 8000)
+		t = (p->timestamp & ~0x1fff) + 0x2000 + t - 8000;
+	else
+		t = (p->timestamp & ~0x1fff) + t;
+
+	request->response.speed = p->speed;
+	request->response.timestamp = t;
+	request->response.generation = p->generation;
+	request->response.ack = 0;
+	request->response.callback = free_response_callback;
+	request->ack = p->ack;
+	request->length = length;
+	if (data)
+		memcpy(request->data, p->payload, length);
+
+	memcpy(request->request_header, p->header, sizeof p->header);
+
+	return request;
+}
+
+void
+fw_send_response(struct fw_card *card, struct fw_request *request, int rcode)
+{
+	/* Broadcast packets are reported as ACK_COMPLETE, so this
+	 * check is sufficient to ensure we don't send response to
+	 * broadcast packets or posted writes. */
+	if (request->ack != ACK_PENDING)
+		return;
+
+	if (rcode == RCODE_COMPLETE)
+		fw_fill_response(&request->response, request->request_header,
+				 rcode, request->data, request->length);
+	else
+		fw_fill_response(&request->response, request->request_header,
+				 rcode, NULL, 0);
+
+	card->driver->send_response(card, &request->response);
+}
+EXPORT_SYMBOL(fw_send_response);
+
+void
+fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
+{
+	struct fw_address_handler *handler;
+	struct fw_request *request;
+	unsigned long long offset;
+	unsigned long flags;
+	int tcode, destination, source;
+
+	if (p->payload_length > 2048) {
+		/* FIXME: send error response. */
+		return;
+	}
+
+	if (p->ack != ACK_PENDING && p->ack != ACK_COMPLETE)
+		return;
+
+	request = allocate_request(p);
+	if (request == NULL) {
+		/* FIXME: send statically allocated busy packet. */
+		return;
+	}
+
+	offset      =
+		((unsigned long long)
+		 header_get_offset_high(p->header[1]) << 32) | p->header[2];
+	tcode       = header_get_tcode(p->header[0]);
+	destination = header_get_destination(p->header[0]);
+	source      = header_get_source(p->header[0]);
+
+	spin_lock_irqsave(&address_handler_lock, flags);
+	handler = lookup_enclosing_address_handler(&address_handler_list,
+						   offset, request->length);
+	spin_unlock_irqrestore(&address_handler_lock, flags);
+
+	/* FIXME: lookup the fw_node corresponding to the sender of
+	 * this request and pass that to the address handler instead
+	 * of the node ID.  We may also want to move the address
+	 * allocations to fw_node so we only do this callback if the
+	 * upper layers registered it for this node. */
+
+	if (handler == NULL)
+		fw_send_response(card, request, RCODE_ADDRESS_ERROR);
+	else
+		handler->address_callback(card, request,
+					  tcode, destination, source,
+					  p->generation, p->speed, offset,
+					  request->data, request->length,
+					  handler->callback_data);
+}
+EXPORT_SYMBOL(fw_core_handle_request);
+
+void
+fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
+{
+	struct fw_transaction *t;
+	unsigned long flags;
+	u32 *data;
+	size_t data_length;
+	int tcode, tlabel, destination, source, rcode;
+
+	tcode       = header_get_tcode(p->header[0]);
+	tlabel      = header_get_tlabel(p->header[0]);
+	destination = header_get_destination(p->header[0]);
+	source      = header_get_source(p->header[1]);
+	rcode       = header_get_rcode(p->header[1]);
+
+	spin_lock_irqsave(&card->lock, flags);
+	list_for_each_entry(t, &card->transaction_list, link) {
+		if (t->node_id == source && t->tlabel == tlabel) {
+			list_del(&t->link);
+			card->tlabel_mask &= ~(1 << t->tlabel);
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	if (&t->link == &card->transaction_list) {
+		fw_notify("Unsolicited response (source %x, tlabel %x)\n",
+			  source, tlabel);
+		return;
+	}
+
+	/* FIXME: sanity check packet, is length correct, does tcodes
+	 * and addresses match. */
+
+	switch (tcode) {
+	case TCODE_READ_QUADLET_RESPONSE:
+		data = (u32 *) &p->header[3];
+		data_length = 4;
+		break;
+
+	case TCODE_WRITE_RESPONSE:
+		data = NULL;
+		data_length = 0;
+		break;
+
+	case TCODE_READ_BLOCK_RESPONSE:
+	case TCODE_LOCK_RESPONSE:
+		data = p->payload;
+		data_length = header_get_data_length(p->header[3]);
+		break;
+
+	default:
+		/* Should never happen, this is just to shut up gcc. */
+		data = NULL;
+		data_length = 0;
+		break;
+	}
+
+	t->callback(card, rcode, data, data_length, t->callback_data);
+}
+EXPORT_SYMBOL(fw_core_handle_response);
+
+MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
+MODULE_DESCRIPTION("Core IEEE1394 transaction logic");
+MODULE_LICENSE("GPL");
+
+static const u32 vendor_textual_descriptor_data[] = {
+	/* textual descriptor leaf () */
+	0x00080000,
+	0x00000000,
+	0x00000000,
+	0x4c696e75,		/* L i n u */
+	0x78204669,		/* x   F i */
+	0x72657769,		/* r e w i */
+	0x72652028,		/* r e   ( */
+	0x4a554a55,		/* J U J U */
+	0x29000000,		/* )       */
+};
+
+static struct fw_descriptor vendor_textual_descriptor = {
+	.length = ARRAY_SIZE(vendor_textual_descriptor_data),
+	.key = 0x81000000,
+	.data = vendor_textual_descriptor_data,
+};
+
+static int __init fw_core_init(void)
+{
+	int retval;
+
+	retval = bus_register(&fw_bus_type);
+	if (retval < 0)
+		return retval;
+
+	/* Add the vendor textual descriptor. */
+	retval = fw_core_add_descriptor(&vendor_textual_descriptor);
+	BUG_ON(retval < 0);
+
+	return 0;
+}
+
+static void __exit fw_core_cleanup(void)
+{
+	bus_unregister(&fw_bus_type);
+}
+
+module_init(fw_core_init);
+module_exit(fw_core_cleanup);
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
new file mode 100644
index 0000000..8f0283c
--- /dev/null
+++ b/drivers/firewire/fw-transaction.h
@@ -0,0 +1,463 @@
+/*						-*- c-basic-offset: 8 -*-
+ *
+ * fw-transaction.h - Header for IEEE1394 transaction logic
+ *
+ * Copyright (C) 2003-2006 Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __fw_transaction_h
+#define __fw_transaction_h
+
+#include <linux/device.h>
+#include <linux/timer.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/fs.h>
+
+#define TCODE_WRITE_QUADLET_REQUEST	0
+#define TCODE_WRITE_BLOCK_REQUEST	1
+#define TCODE_WRITE_RESPONSE		2
+#define TCODE_READ_QUADLET_REQUEST	4
+#define TCODE_READ_BLOCK_REQUEST	5
+#define TCODE_READ_QUADLET_RESPONSE	6
+#define TCODE_READ_BLOCK_RESPONSE	7
+#define TCODE_CYCLE_START		8
+#define TCODE_LOCK_REQUEST		9
+#define TCODE_STREAM_DATA		10
+#define TCODE_LOCK_RESPONSE		11
+
+#define TCODE_IS_READ_REQUEST(tcode)	(((tcode) & ~1) == 4)
+#define TCODE_IS_BLOCK_PACKET(tcode)	(((tcode) &  1) != 0)
+#define TCODE_IS_REQUEST(tcode)		(((tcode) &  2) == 0)
+#define TCODE_IS_RESPONSE(tcode)	(((tcode) &  2) != 0)
+#define TCODE_HAS_REQUEST_DATA(tcode)	(((tcode) & 12) != 4)
+#define TCODE_HAS_RESPONSE_DATA(tcode)	(((tcode) & 12) != 0)
+
+/* Juju specific tcodes */
+#define TCODE_DEALLOCATE		0x10
+#define TCODE_LOCK_MASK_SWAP		0x11
+#define TCODE_LOCK_COMPARE_SWAP		0x12
+#define TCODE_LOCK_FETCH_ADD		0x13
+#define TCODE_LOCK_LITTLE_ADD		0x14
+#define TCODE_LOCK_BOUNDED_ADD		0x15
+#define TCODE_LOCK_WRAP_ADD		0x16
+#define TCODE_LOCK_VENDOR_SPECIFIC	0x17
+
+#define SCODE_100			0x0
+#define SCODE_200			0x1
+#define SCODE_400			0x2
+#define SCODE_BETA			0x3
+
+#define EXTCODE_MASK_SWAP	0x1
+#define EXTCODE_COMPARE_SWAP	0x2
+#define EXTCODE_FETCH_ADD	0x3
+#define EXTCODE_LITTLE_ADD	0x4
+#define EXTCODE_BOUNDED_ADD	0x5
+#define EXTCODE_WRAP_ADD	0x6
+
+#define ACK_COMPLETE		0x1
+#define ACK_PENDING		0x2
+#define ACK_BUSY_X		0x4
+#define ACK_BUSY_A		0x5
+#define ACK_BUSY_B		0x6
+#define ACK_DATA_ERROR		0xd
+#define ACK_TYPE_ERROR		0xe
+
+#define RCODE_COMPLETE		0x0
+#define RCODE_CONFLICT_ERROR	0x4
+#define RCODE_DATA_ERROR	0x5
+#define RCODE_TYPE_ERROR	0x6
+#define RCODE_ADDRESS_ERROR	0x7
+
+/* Juju specific rcodes */
+#define RCODE_SEND_ERROR	0x10
+#define RCODE_CANCELLED		0x11
+#define RCODE_BUSY		0x12
+#define RCODE_GENERATION	0x13
+#define RCODE_NO_ACK		0x14
+
+#define RETRY_1	0x00
+#define RETRY_X	0x01
+#define RETRY_A	0x02
+#define RETRY_B	0x03
+
+#define LOCAL_BUS 0xffc0
+
+#define SELFID_PORT_CHILD	0x3
+#define SELFID_PORT_PARENT	0x2
+#define SELFID_PORT_NCONN	0x1
+#define SELFID_PORT_NONE	0x0
+
+#define PHY_PACKET_CONFIG	0x0
+#define PHY_PACKET_LINK_ON	0x1
+#define PHY_PACKET_SELF_ID	0x2
+
+#define CSR_REGISTER_BASE		0xfffff0000000ULL
+
+/* register offsets relative to CSR_REGISTER_BASE */
+#define CSR_STATE_CLEAR			0x0
+#define CSR_STATE_SET			0x4
+#define CSR_NODE_IDS			0x8
+#define CSR_RESET_START			0xc
+#define CSR_SPLIT_TIMEOUT_HI		0x18
+#define CSR_SPLIT_TIMEOUT_LO		0x1c
+#define CSR_CYCLE_TIME			0x200
+#define CSR_BUS_TIME			0x204
+#define CSR_BUSY_TIMEOUT		0x210
+#define CSR_BUS_MANAGER_ID		0x21c
+#define CSR_BANDWIDTH_AVAILABLE		0x220
+#define CSR_CHANNELS_AVAILABLE		0x224
+#define CSR_CHANNELS_AVAILABLE_HI	0x224
+#define CSR_CHANNELS_AVAILABLE_LO	0x228
+#define CSR_BROADCAST_CHANNEL		0x234
+#define CSR_CONFIG_ROM			0x400
+#define CSR_CONFIG_ROM_END		0x800
+#define CSR_FCP_COMMAND			0xB00
+#define CSR_FCP_RESPONSE		0xD00
+#define CSR_FCP_END			0xF00
+#define CSR_TOPOLOGY_MAP		0x1000
+#define CSR_TOPOLOGY_MAP_END		0x1400
+#define CSR_SPEED_MAP			0x2000
+#define CSR_SPEED_MAP_END		0x3000
+
+#define fw_notify(s, args...) printk(KERN_NOTICE KBUILD_MODNAME ": " s, ## args)
+#define fw_error(s, args...) printk(KERN_ERR KBUILD_MODNAME ": " s, ## args)
+#define fw_debug(s, args...) printk(KERN_DEBUG KBUILD_MODNAME ": " s, ## args)
+
+static inline void
+fw_memcpy_from_be32(void *_dst, void *_src, size_t size)
+{
+	u32 *dst = _dst;
+	u32 *src = _src;
+	int i;
+
+	for (i = 0; i < size / 4; i++)
+		dst[i] = cpu_to_be32(src[i]);
+}
+
+static inline void
+fw_memcpy_to_be32(void *_dst, void *_src, size_t size)
+{
+	fw_memcpy_from_be32(_dst, _src, size);
+}
+
+struct fw_card;
+struct fw_packet;
+struct fw_node;
+struct fw_request;
+
+struct fw_descriptor {
+	struct list_head link;
+	size_t length;
+	u32 key;
+	const u32 *data;
+};
+
+int fw_core_add_descriptor (struct fw_descriptor *desc);
+void fw_core_remove_descriptor (struct fw_descriptor *desc);
+
+typedef void (*fw_packet_callback_t) (struct fw_packet *packet,
+				      struct fw_card *card, int status);
+
+typedef void (*fw_transaction_callback_t)(struct fw_card *card, int rcode,
+					  void *data,
+					  size_t length,
+					  void *callback_data);
+
+typedef void (*fw_address_callback_t)(struct fw_card *card,
+				      struct fw_request *request,
+				      int tcode, int destination, int source,
+				      int generation, int speed,
+				      unsigned long long offset,
+				      void *data, size_t length,
+				      void *callback_data);
+
+typedef void (*fw_bus_reset_callback_t)(struct fw_card *handle,
+					int node_id, int generation,
+					u32 *self_ids,
+					int self_id_count,
+					void *callback_data);
+
+struct fw_packet {
+	int speed;
+	int generation;
+	u32 header[4];
+	size_t header_length;
+	void *payload;
+	size_t payload_length;
+	u32 timestamp;
+
+	dma_addr_t payload_bus;
+
+	/* This callback is called when the packet transmission has
+	 * completed; for successful transmission, the status code is
+	 * the ack received from the destination, otherwise it's a
+	 * negative errno: ENOMEM, ESTALE, ETIMEDOUT, ENODEV, EIO.
+	 * The callback can be called from tasklet context and thus
+	 * must never block.
+	 */
+	fw_packet_callback_t callback;
+	int ack;
+	struct list_head link;
+};
+
+struct fw_transaction {
+	int node_id; /* The generation is implied; it is always the current. */
+	int tlabel;
+	int timestamp;
+	struct list_head link;
+
+	struct fw_packet packet;
+
+	/* The data passed to the callback is valid only during the
+	 * callback.  */
+	fw_transaction_callback_t callback;
+	void *callback_data;
+};
+
+static inline struct fw_packet *
+fw_packet(struct list_head *l)
+{
+	return list_entry (l, struct fw_packet, link);
+}
+
+struct fw_address_handler {
+	u64 offset;
+	size_t length;
+	fw_address_callback_t address_callback;
+	void *callback_data;
+	struct list_head link;
+};
+
+
+struct fw_address_region {
+	u64 start;
+	u64 end;
+};
+
+extern const struct fw_address_region fw_low_memory_region;
+extern const struct fw_address_region fw_high_memory_region;
+extern const struct fw_address_region fw_private_region;
+extern const struct fw_address_region fw_csr_region;
+extern const struct fw_address_region fw_unit_space_region;
+
+int fw_core_add_address_handler(struct fw_address_handler *handler,
+				const struct fw_address_region *region);
+void fw_core_remove_address_handler(struct fw_address_handler *handler);
+void fw_fill_response(struct fw_packet *response, u32 *request_header,
+		      int rcode, void *payload, size_t length);
+void fw_send_response(struct fw_card *card,
+		      struct fw_request *request, int rcode);
+
+extern struct bus_type fw_bus_type;
+
+struct fw_card {
+	const struct fw_card_driver *driver;
+	struct device *device;
+
+	int node_id;
+	int generation;
+	/* This is the generation used for timestamping incoming requests. */
+	int request_generation;
+	int current_tlabel, tlabel_mask;
+	struct list_head transaction_list;
+	struct timer_list flush_timer;
+	unsigned long reset_jiffies;
+
+	unsigned long long guid;
+	int max_receive;
+	int link_speed;
+	int config_rom_generation;
+
+	/* We need to store up to 4 self ID for a maximum of 63 devices. */
+	int self_id_count;
+	u32 self_ids[252];
+
+	spinlock_t lock; /* Take this lock when handling the lists in
+			  * this struct. */
+	struct fw_node *local_node;
+	struct fw_node *root_node;
+	struct fw_node *irm_node;
+	int color;
+	int gap_count;
+	int topology_type;
+
+	int index;
+
+	struct device card_device;
+
+	struct list_head link;
+
+	/* Work struct for BM duties. */
+	struct delayed_work work;
+	int bm_retries;
+	int bm_generation;
+};
+
+struct fw_card *fw_card_get(struct fw_card *card);
+void fw_card_put(struct fw_card *card);
+
+/* The iso packet format allows for an immediate header/payload part
+ * stored in 'header' immediately after the packet info plus an
+ * indirect payload part that is pointer to by the 'payload' field.
+ * Applications can use one or the other or both to implement simple
+ * low-bandwidth streaming (e.g. audio) or more advanced
+ * scatter-gather streaming (e.g. assembling video frame automatically). */
+
+struct fw_iso_packet {
+	u16 payload_length;	/* Length of indirect payload. */
+	u32 interrupt : 1;	/* Generate interrupt on this packet */
+	u32 skip : 1;		/* Set to not send packet at all. */
+	u32 tag : 2;
+	u32 sy : 4;
+	u32 header_length : 8;	/* Length of immediate header. */
+	u32 header[0];
+};
+
+#define FW_ISO_CONTEXT_TRANSMIT	0
+#define FW_ISO_CONTEXT_RECEIVE	1
+
+struct fw_iso_context;
+
+typedef void (*fw_iso_callback_t) (struct fw_iso_context *context,
+				   int status, u32 cycle, void *data);
+
+struct fw_iso_context {
+	struct fw_card *card;
+	int type;
+	int channel;
+	int speed;
+	fw_iso_callback_t callback;
+	void *callback_data;
+
+	void *buffer;
+	size_t buffer_size;
+	dma_addr_t *pages;
+	int page_count;
+};
+
+struct fw_iso_context *
+fw_iso_context_create(struct fw_card *card, int type,
+		      size_t buffer_size,
+		      fw_iso_callback_t callback,
+		      void *callback_data);
+
+void
+fw_iso_context_destroy(struct fw_iso_context *ctx);
+
+void
+fw_iso_context_start(struct fw_iso_context *ctx,
+		     int channel, int speed, int cycle);
+
+int
+fw_iso_context_queue(struct fw_iso_context *ctx,
+		     struct fw_iso_packet *packet, void *payload);
+
+int
+fw_iso_context_send(struct fw_iso_context *ctx,
+		    int channel, int speed, int cycle);
+
+struct fw_card_driver {
+	const char *name;
+
+	/* Enable the given card with the given initial config rom.
+	 * This function is expected to activate the card, and either
+	 * enable the PHY or set the link_on bit and initiate a bus
+	 * reset. */
+	int (*enable) (struct fw_card *card, u32 *config_rom, size_t length);
+
+	int (*update_phy_reg) (struct fw_card *card, int address,
+			       int clear_bits, int set_bits);
+
+	/* Update the config rom for an enabled card.  This function
+	 * should change the config rom that is presented on the bus
+	 * an initiate a bus reset. */
+	int (*set_config_rom) (struct fw_card *card,
+			       u32 *config_rom, size_t length);
+
+	void (*send_request) (struct fw_card *card, struct fw_packet *packet);
+	void (*send_response) (struct fw_card *card, struct fw_packet *packet);
+	/* Calling cancel is valid once a packet has been submitted. */
+	int (*cancel_packet) (struct fw_card *card, struct fw_packet *packet);
+
+	/* Allow the specified node ID to do direct DMA out and in of
+	 * host memory.  The card will disable this for all node when
+	 * a bus reset happens, so driver need to reenable this after
+	 * bus reset.  Returns 0 on success, -ENODEV if the card
+	 * doesn't support this, -ESTALE if the generation doesn't
+	 * match. */
+	int (*enable_phys_dma) (struct fw_card *card,
+				int node_id, int generation);
+
+	struct fw_iso_context *
+	(*allocate_iso_context)(struct fw_card *card, int type);
+	void (*free_iso_context)(struct fw_iso_context *ctx);
+
+	int (*send_iso)(struct fw_iso_context *ctx, s32 cycle);
+
+	int (*queue_iso)(struct fw_iso_context *ctx,
+			 struct fw_iso_packet *packet, void *payload);
+};
+
+int
+fw_core_initiate_bus_reset(struct fw_card *card, int short_reset);
+
+void
+fw_send_request(struct fw_card *card, struct fw_transaction *t,
+		int tcode, int node_id, int generation, int speed,
+		unsigned long long offset,
+		void *data, size_t length,
+		fw_transaction_callback_t callback, void *callback_data);
+
+int fw_cancel_transaction(struct fw_card *card,
+			  struct fw_transaction *transaction);
+
+void fw_flush_transactions(struct fw_card *card);
+
+void fw_send_phy_config(struct fw_card *card,
+			int node_id, int generation, int gap_count);
+
+/* Called by the topology code to inform the device code of node
+ * activity; found, lost, or updated nodes */
+void
+fw_node_event(struct fw_card *card, struct fw_node *node, int event);
+
+/* API used by card level drivers */
+
+/* Do we need phy speed here also?  If we add more args, maybe we
+   should go back to struct fw_card_info. */
+void
+fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,
+		   struct device *device);
+int
+fw_card_add(struct fw_card *card,
+	    u32 max_receive, u32 link_speed, u64 guid);
+
+void
+fw_core_remove_card(struct fw_card *card);
+
+void
+fw_core_handle_bus_reset(struct fw_card *card,
+			 int node_id, int generation,
+			 int self_id_count, u32 *self_ids);
+void
+fw_core_handle_request(struct fw_card *card, struct fw_packet *request);
+
+void
+fw_core_handle_response(struct fw_card *card, struct fw_packet *packet);
+
+#endif /* __fw_transaction_h */
diff --git a/drivers/ieee1394/Kconfig b/drivers/ieee1394/Kconfig
index b8a4734..c668538 100644
--- a/drivers/ieee1394/Kconfig
+++ b/drivers/ieee1394/Kconfig
@@ -2,6 +2,8 @@ # -*- shell-script -*-
 
 menu "IEEE 1394 (FireWire) support"
 
+source "drivers/firewire/Kconfig"
+
 config IEEE1394
 	tristate "IEEE 1394 (FireWire) support"
 	depends on PCI || BROKEN
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index a953135..80e7258 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -568,8 +568,10 @@ static void ether1394_add_host (struct h
 			&eth1394_highlevel, host, &addr_ops,
 			ETHER1394_REGION_ADDR_LEN, ETHER1394_REGION_ADDR_LEN,
 			CSR1212_INVALID_ADDR_SPACE, CSR1212_INVALID_ADDR_SPACE);
-	if (fifo_addr == CSR1212_INVALID_ADDR_SPACE)
-		goto out;
+	if (fifo_addr == CSR1212_INVALID_ADDR_SPACE) {
+		ETH1394_PRINT_G(KERN_ERR, "Cannot register CSR space\n");
+		return;
+	}
 
 	/* We should really have our own alloc_hpsbdev() function in
 	 * net_init.c instead of calling the one for ethernet then hijacking
@@ -637,40 +639,30 @@ static void ether1394_add_host (struct h
 		else
 			priv->bc_state = ETHER1394_BC_RUNNING;
 	}
-
 	return;
-
 out:
-	if (dev != NULL)
+	if (dev)
 		free_netdev(dev);
 	if (hi)
 		hpsb_destroy_hostinfo(&eth1394_highlevel, host);
-
-	return;
+	hpsb_unregister_addrspace(&eth1394_highlevel, host, fifo_addr);
 }
 
 /* Remove a card from our list */
 static void ether1394_remove_host (struct hpsb_host *host)
 {
 	struct eth1394_host_info *hi;
+	struct eth1394_priv *priv;
 
 	hi = hpsb_get_hostinfo(&eth1394_highlevel, host);
-	if (hi != NULL) {
-		struct eth1394_priv *priv = netdev_priv(hi->dev);
-
-		hpsb_unregister_addrspace(&eth1394_highlevel, host,
-					  priv->local_fifo);
-
-		if (priv->iso != NULL)
-			hpsb_iso_shutdown(priv->iso);
-
-		if (hi->dev) {
-			unregister_netdev (hi->dev);
-			free_netdev(hi->dev);
-		}
-	}
-
-	return;
+	if (!hi)
+		return;
+	priv = netdev_priv(hi->dev);
+	hpsb_unregister_addrspace(&eth1394_highlevel, host, priv->local_fifo);
+	if (priv->iso)
+		hpsb_iso_shutdown(priv->iso);
+	unregister_netdev(hi->dev);
+	free_netdev(hi->dev);
 }
 
 /* A reset has just arisen */
@@ -687,7 +679,7 @@ static void ether1394_host_reset (struct
 	hi = hpsb_get_hostinfo(&eth1394_highlevel, host);
 
 	/* This can happen for hosts that we don't use */
-	if (hi == NULL)
+	if (!hi)
 		return;
 
 	dev = hi->dev;
diff --git a/drivers/ieee1394/ieee1394-ioctl.h b/drivers/ieee1394/ieee1394-ioctl.h
index 8f20750..46878fe 100644
--- a/drivers/ieee1394/ieee1394-ioctl.h
+++ b/drivers/ieee1394/ieee1394-ioctl.h
@@ -100,5 +100,7 @@ #define RAW1394_IOC_ISO_XMIT_SYNC		\
 	_IO  ('#', 0x28)
 #define RAW1394_IOC_ISO_RECV_FLUSH		\
 	_IO  ('#', 0x29)
+#define RAW1394_IOC_GET_CYCLE_TIMER		\
+	_IOR ('#', 0x30, struct raw1394_cycle_timer)
 
 #endif /* __IEEE1394_IOCTL_H */
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index 1521e57..d791d08 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -33,7 +33,10 @@ #include <linux/kdev_t.h>
 #include <linux/skbuff.h>
 #include <linux/suspend.h>
 #include <linux/kthread.h>
+#include <linux/preempt.h>
+#include <linux/time.h>
 
+#include <asm/system.h>
 #include <asm/byteorder.h>
 
 #include "ieee1394_types.h"
@@ -186,6 +189,45 @@ int hpsb_reset_bus(struct hpsb_host *hos
 	}
 }
 
+/**
+ * hpsb_read_cycle_timer - read cycle timer register and system time
+ * @host: host whose isochronous cycle timer register is read
+ * @cycle_timer: address of bitfield to return the register contents
+ * @local_time: address to return the system time
+ *
+ * The format of * @cycle_timer, is described in OHCI 1.1 clause 5.13. This
+ * format is also read from non-OHCI controllers. * @local_time contains the
+ * system time in microseconds since the Epoch, read at the moment when the
+ * cycle timer was read.
+ *
+ * Return value: 0 for success or error number otherwise.
+ */
+int hpsb_read_cycle_timer(struct hpsb_host *host, u32 *cycle_timer,
+			  u64 *local_time)
+{
+	int ctr;
+	struct timeval tv;
+	unsigned long flags;
+
+	if (!host || !cycle_timer || !local_time)
+		return -EINVAL;
+
+	preempt_disable();
+	local_irq_save(flags);
+
+	ctr = host->driver->devctl(host, GET_CYCLE_COUNTER, 0);
+	if (ctr)
+		do_gettimeofday(&tv);
+
+	local_irq_restore(flags);
+	preempt_enable();
+
+	if (!ctr)
+		return -EIO;
+	*cycle_timer = ctr;
+	*local_time = tv.tv_sec * 1000000ULL + tv.tv_usec;
+	return 0;
+}
 
 int hpsb_bus_reset(struct hpsb_host *host)
 {
@@ -1190,6 +1232,7 @@ EXPORT_SYMBOL(hpsb_alloc_packet);
 EXPORT_SYMBOL(hpsb_free_packet);
 EXPORT_SYMBOL(hpsb_send_packet);
 EXPORT_SYMBOL(hpsb_reset_bus);
+EXPORT_SYMBOL(hpsb_read_cycle_timer);
 EXPORT_SYMBOL(hpsb_bus_reset);
 EXPORT_SYMBOL(hpsb_selfid_received);
 EXPORT_SYMBOL(hpsb_selfid_complete);
diff --git a/drivers/ieee1394/ieee1394_core.h b/drivers/ieee1394/ieee1394_core.h
index 536ba3f..bd29d8e 100644
--- a/drivers/ieee1394/ieee1394_core.h
+++ b/drivers/ieee1394/ieee1394_core.h
@@ -127,6 +127,9 @@ int hpsb_send_packet_and_wait(struct hps
  * progress, 0 otherwise. */
 int hpsb_reset_bus(struct hpsb_host *host, int type);
 
+int hpsb_read_cycle_timer(struct hpsb_host *host, u32 *cycle_timer,
+			  u64 *local_time);
+
 /*
  * The following functions are exported for host driver module usage.  All of
  * them are safe to use in interrupt contexts, although some are quite
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index ba9faef..0bec1ed 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -144,8 +144,6 @@ static struct csr1212_bus_ops nodemgr_cs
  * but now we are much simpler because of the LDM.
  */
 
-static DEFINE_MUTEX(nodemgr_serialize);
-
 struct host_info {
 	struct hpsb_host *host;
 	struct list_head list;
@@ -1681,28 +1679,21 @@ static int nodemgr_host_thread(void *__h
 	for (;;) {
 		/* Sleep until next bus reset */
 		set_current_state(TASK_INTERRUPTIBLE);
-		if (get_hpsb_generation(host) == generation)
+		if (get_hpsb_generation(host) == generation &&
+		    !kthread_should_stop())
 			schedule();
 		__set_current_state(TASK_RUNNING);
 
 		/* Thread may have been woken up to freeze or to exit */
 		if (try_to_freeze())
 			continue;
-		if (kthread_should_stop())
-			goto exit;
-
-		if (mutex_lock_interruptible(&nodemgr_serialize)) {
-			if (try_to_freeze())
-				continue;
-			goto exit;
-		}
 
 		/* Pause for 1/4 second in 1/16 second intervals,
 		 * to make sure things settle down. */
 		g = get_hpsb_generation(host);
 		for (i = 0; i < 4 ; i++) {
-			if (msleep_interruptible(63) || kthread_should_stop())
-				goto unlock_exit;
+			if (kthread_should_stop() || msleep_interruptible(63))
+				return 0;
 
 			/* Now get the generation in which the node ID's we collect
 			 * are valid.  During the bus scan we will use this generation
@@ -1720,7 +1711,6 @@ static int nodemgr_host_thread(void *__h
 		if (!nodemgr_check_irm_capability(host, reset_cycles) ||
 		    !nodemgr_do_irm_duties(host, reset_cycles)) {
 			reset_cycles++;
-			mutex_unlock(&nodemgr_serialize);
 			continue;
 		}
 		reset_cycles = 0;
@@ -1737,13 +1727,7 @@ static int nodemgr_host_thread(void *__h
 
 		/* Update some of our sysfs symlinks */
 		nodemgr_update_host_dev_links(host);
-
-		mutex_unlock(&nodemgr_serialize);
 	}
-unlock_exit:
-	mutex_unlock(&nodemgr_serialize);
-exit:
-	HPSB_VERBOSE("NodeMgr: Exiting thread");
 	return 0;
 }
 
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index aa9ca83..bb897a3 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -2669,6 +2669,18 @@ static void raw1394_iso_shutdown(struct 
 	fi->iso_state = RAW1394_ISO_INACTIVE;
 }
 
+static int raw1394_read_cycle_timer(struct file_info *fi, void __user * uaddr)
+{
+	struct raw1394_cycle_timer ct;
+	int err;
+
+	err = hpsb_read_cycle_timer(fi->host, &ct.cycle_timer, &ct.local_time);
+	if (!err)
+		if (copy_to_user(uaddr, &ct, sizeof(ct)))
+			err = -EFAULT;
+	return err;
+}
+
 /* mmap the rawiso xmit/recv buffer */
 static int raw1394_mmap(struct file *file, struct vm_area_struct *vma)
 {
@@ -2777,6 +2789,14 @@ static int raw1394_ioctl(struct inode *i
 		break;
 	}
 
+	/* state-independent commands */
+	switch(cmd) {
+	case RAW1394_IOC_GET_CYCLE_TIMER:
+		return raw1394_read_cycle_timer(fi, argp);
+	default:
+		break;
+	}
+
 	return -EINVAL;
 }
 
diff --git a/drivers/ieee1394/raw1394.h b/drivers/ieee1394/raw1394.h
index 35bfc38..093e712 100644
--- a/drivers/ieee1394/raw1394.h
+++ b/drivers/ieee1394/raw1394.h
@@ -3,7 +3,7 @@ #define IEEE1394_RAW1394_H
 
 /* header for the raw1394 API that is exported to user-space */
 
-#define RAW1394_KERNELAPI_VERSION 4
+#define RAW1394_KERNELAPI_VERSION 5
 
 /* state: opened */
 #define RAW1394_REQ_INITIALIZE    1
@@ -178,4 +178,14 @@ struct raw1394_iso_status {
 	__s16 xmit_cycle;
 };
 
+/* argument to RAW1394_IOC_GET_CYCLE_TIMER ioctl */
+struct raw1394_cycle_timer {
+	/* contents of Isochronous Cycle Timer register,
+	   as in OHCI 1.1 clause 5.13 (also with non-OHCI hosts) */
+	__u32 cycle_timer;
+
+	/* local time in microseconds since Epoch,
+	   simultaneously read with cycle timer */
+	__u64 local_time;
+};
 #endif /* IEEE1394_RAW1394_H */
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 4edfff4..8c471ca 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -469,19 +469,13 @@ static void sbp2util_write_doorbell(stru
 static int sbp2util_create_command_orb_pool(struct sbp2_lu *lu)
 {
 	struct sbp2_fwhost_info *hi = lu->hi;
-	int i;
-	unsigned long flags, orbs;
 	struct sbp2_command_info *cmd;
+	int i, orbs = sbp2_serialize_io ? 2 : SBP2_MAX_CMDS;
 
-	orbs = sbp2_serialize_io ? 2 : SBP2_MAX_CMDS;
-
-	spin_lock_irqsave(&lu->cmd_orb_lock, flags);
 	for (i = 0; i < orbs; i++) {
-		cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
-		if (!cmd) {
-			spin_unlock_irqrestore(&lu->cmd_orb_lock, flags);
+		cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+		if (!cmd)
 			return -ENOMEM;
-		}
 		cmd->command_orb_dma = dma_map_single(hi->host->device.parent,
 						&cmd->command_orb,
 						sizeof(struct sbp2_command_orb),
@@ -489,11 +483,10 @@ static int sbp2util_create_command_orb_p
 		cmd->sge_dma = dma_map_single(hi->host->device.parent,
 					&cmd->scatter_gather_element,
 					sizeof(cmd->scatter_gather_element),
-					DMA_BIDIRECTIONAL);
+					DMA_TO_DEVICE);
 		INIT_LIST_HEAD(&cmd->list);
 		list_add_tail(&cmd->list, &lu->cmd_orb_completed);
 	}
-	spin_unlock_irqrestore(&lu->cmd_orb_lock, flags);
 	return 0;
 }
 
@@ -514,7 +507,7 @@ static void sbp2util_remove_command_orb_
 					 DMA_TO_DEVICE);
 			dma_unmap_single(host->device.parent, cmd->sge_dma,
 					 sizeof(cmd->scatter_gather_element),
-					 DMA_BIDIRECTIONAL);
+					 DMA_TO_DEVICE);
 			kfree(cmd);
 		}
 	spin_unlock_irqrestore(&lu->cmd_orb_lock, flags);
@@ -757,6 +750,11 @@ #ifdef CONFIG_IEEE1394_SBP2_PHYS_DMA
 			SBP2_ERR("failed to register lower 4GB address range");
 			goto failed_alloc;
 		}
+#else
+		if (dma_set_mask(hi->host->device.parent, DMA_32BIT_MASK)) {
+			SBP2_ERR("failed to set 4GB DMA mask");
+			goto failed_alloc;
+		}
 #endif
 	}
 
@@ -865,11 +863,8 @@ static int sbp2_start_device(struct sbp2
 	if (!lu->login_orb)
 		goto alloc_fail;
 
-	if (sbp2util_create_command_orb_pool(lu)) {
-		SBP2_ERR("sbp2util_create_command_orb_pool failed!");
-		sbp2_remove_device(lu);
-		return -ENOMEM;
-	}
+	if (sbp2util_create_command_orb_pool(lu))
+		goto alloc_fail;
 
 	/* Wait a second before trying to log in. Previously logged in
 	 * initiators need a chance to reconnect. */
@@ -1628,7 +1623,7 @@ static void sbp2_link_orb_command(struct
 				   DMA_TO_DEVICE);
 	dma_sync_single_for_device(hi->host->device.parent, cmd->sge_dma,
 				   sizeof(cmd->scatter_gather_element),
-				   DMA_BIDIRECTIONAL);
+				   DMA_TO_DEVICE);
 
 	/* check to see if there are any previous orbs to use */
 	spin_lock_irqsave(&lu->cmd_orb_lock, flags);
@@ -1794,7 +1789,7 @@ static int sbp2_handle_status_write(stru
 					DMA_TO_DEVICE);
 		dma_sync_single_for_cpu(hi->host->device.parent, cmd->sge_dma,
 					sizeof(cmd->scatter_gather_element),
-					DMA_BIDIRECTIONAL);
+					DMA_TO_DEVICE);
 		/* Grab SCSI command pointers and check status. */
 		/*
 		 * FIXME: If the src field in the status is 1, the ORB DMA must
@@ -1926,7 +1921,7 @@ static void sbp2scsi_complete_all_comman
 					DMA_TO_DEVICE);
 		dma_sync_single_for_cpu(hi->host->device.parent, cmd->sge_dma,
 					sizeof(cmd->scatter_gather_element),
-					DMA_BIDIRECTIONAL);
+					DMA_TO_DEVICE);
 		sbp2util_mark_command_completed(lu, cmd);
 		if (cmd->Current_SCpnt) {
 			cmd->Current_SCpnt->result = status << 16;
@@ -2057,7 +2052,7 @@ static int sbp2scsi_abort(struct scsi_cm
 			dma_sync_single_for_cpu(hi->host->device.parent,
 					cmd->sge_dma,
 					sizeof(cmd->scatter_gather_element),
-					DMA_BIDIRECTIONAL);
+					DMA_TO_DEVICE);
 			sbp2util_mark_command_completed(lu, cmd);
 			if (cmd->Current_SCpnt) {
 				cmd->Current_SCpnt->result = DID_ABORT << 16;
diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
index 9ae8423..44402b9 100644
--- a/drivers/ieee1394/sbp2.h
+++ b/drivers/ieee1394/sbp2.h
@@ -250,15 +250,15 @@ enum sbp2_dma_types {
 /* Per SCSI command */
 struct sbp2_command_info {
 	struct list_head list;
-	struct sbp2_command_orb command_orb ____cacheline_aligned;
-	dma_addr_t command_orb_dma ____cacheline_aligned;
+	struct sbp2_command_orb command_orb;
+	dma_addr_t command_orb_dma;
 	struct scsi_cmnd *Current_SCpnt;
 	void (*Current_done)(struct scsi_cmnd *);
 
 	/* Also need s/g structure for each sbp2 command */
 	struct sbp2_unrestricted_page_table
-			scatter_gather_element[SG_ALL] ____cacheline_aligned;
-	dma_addr_t sge_dma ____cacheline_aligned;
+		scatter_gather_element[SG_ALL] __attribute__((aligned(8)));
+	dma_addr_t sge_dma;
 	void *sge_buffer;
 	dma_addr_t cmd_dma;
 	enum sbp2_dma_types dma_type;