- patches.apparmor/remove_suid_new_case_in_2.6.22.diff: Merge fix.
[linux-flexiantxendom0-3.2.10.git] / drivers / ieee1394 / ieee1394_core.c
index d791d08..8f71b6a 100644 (file)
@@ -30,7 +30,6 @@
 #include <linux/moduleparam.h>
 #include <linux/bitops.h>
 #include <linux/kdev_t.h>
-#include <linux/skbuff.h>
 #include <linux/suspend.h>
 #include <linux/kthread.h>
 #include <linux/preempt.h>
@@ -96,13 +95,15 @@ static void queue_packet_complete(struct hpsb_packet *packet);
 
 
 /**
- * hpsb_set_packet_complete_task - set the task that runs when a packet
- * completes. You cannot call this more than once on a single packet
- * before it is sent.
- *
+ * hpsb_set_packet_complete_task - set task that runs when a packet completes
  * @packet: the packet whose completion we want the task added to
  * @routine: function to call
  * @data: data (if any) to pass to the above function
+ *
+ * Set the task that runs when a packet completes. You cannot call this more
+ * than once on a single packet before it is sent.
+ *
+ * Typically, the complete @routine is responsible to call hpsb_free_packet().
  */
 void hpsb_set_packet_complete_task(struct hpsb_packet *packet,
                                   void (*routine)(void *), void *data)
@@ -115,12 +116,12 @@ void hpsb_set_packet_complete_task(struct hpsb_packet *packet,
 
 /**
  * hpsb_alloc_packet - allocate new packet structure
- * @data_size: size of the data block to be allocated
+ * @data_size: size of the data block to be allocated, in bytes
  *
  * This function allocates, initializes and returns a new &struct hpsb_packet.
- * It can be used in interrupt context.  A header block is always included, its
- * size is big enough to contain all possible 1394 headers.  The data block is
- * only allocated when @data_size is not zero.
+ * It can be used in interrupt context.  A header block is always included and
+ * initialized with zeros.  Its size is big enough to contain all possible 1394
+ * headers.  The data block is only allocated if @data_size is not zero.
  *
  * For packets for which responses will be received the @data_size has to be big
  * enough to contain the response's data block since no further allocation
@@ -135,50 +136,49 @@ void hpsb_set_packet_complete_task(struct hpsb_packet *packet,
  */
 struct hpsb_packet *hpsb_alloc_packet(size_t data_size)
 {
-       struct hpsb_packet *packet = NULL;
-       struct sk_buff *skb;
+       struct hpsb_packet *packet;
 
        data_size = ((data_size + 3) & ~3);
 
-       skb = alloc_skb(data_size + sizeof(*packet), GFP_ATOMIC);
-       if (skb == NULL)
+       packet = kzalloc(sizeof(*packet) + data_size, GFP_ATOMIC);
+       if (!packet)
                return NULL;
 
-       memset(skb->data, 0, data_size + sizeof(*packet));
-
-       packet = (struct hpsb_packet *)skb->data;
-       packet->skb = skb;
-
-       packet->header = packet->embedded_header;
        packet->state = hpsb_unused;
        packet->generation = -1;
        INIT_LIST_HEAD(&packet->driver_list);
+       INIT_LIST_HEAD(&packet->queue);
        atomic_set(&packet->refcnt, 1);
 
        if (data_size) {
-               packet->data = (quadlet_t *)(skb->data + sizeof(*packet));
-               packet->data_size = data_size;
+               packet->data = packet->embedded_data;
+               packet->allocated_data_size = data_size;
        }
-
        return packet;
 }
 
-
 /**
  * hpsb_free_packet - free packet and data associated with it
  * @packet: packet to free (is NULL safe)
  *
- * This function will free packet->data and finally the packet itself.
+ * Frees @packet->data only if it was allocated through hpsb_alloc_packet().
  */
 void hpsb_free_packet(struct hpsb_packet *packet)
 {
        if (packet && atomic_dec_and_test(&packet->refcnt)) {
-               BUG_ON(!list_empty(&packet->driver_list));
-               kfree_skb(packet->skb);
+               BUG_ON(!list_empty(&packet->driver_list) ||
+                      !list_empty(&packet->queue));
+               kfree(packet);
        }
 }
 
-
+/**
+ * hpsb_reset_bus - initiate bus reset on the given host
+ * @host: host controller whose bus to reset
+ * @type: one of enum reset_types
+ *
+ * Returns 1 if bus reset already in progress, 0 otherwise.
+ */
 int hpsb_reset_bus(struct hpsb_host *host, int type)
 {
        if (!host->in_bus_reset) {
@@ -229,6 +229,14 @@ int hpsb_read_cycle_timer(struct hpsb_host *host, u32 *cycle_timer,
        return 0;
 }
 
+/**
+ * hpsb_bus_reset - notify a bus reset to the core
+ *
+ * For host driver module usage.  Safe to use in interrupt context, although
+ * quite complex; so you may want to run it in the bottom rather than top half.
+ *
+ * Returns 1 if bus reset already in progress, 0 otherwise.
+ */
 int hpsb_bus_reset(struct hpsb_host *host)
 {
        if (host->in_bus_reset) {
@@ -405,6 +413,14 @@ static void build_speed_map(struct hpsb_host *host, int nodecount)
 }
 
 
+/**
+ * hpsb_selfid_received - hand over received selfid packet to the core
+ *
+ * For host driver module usage.  Safe to use in interrupt context.
+ *
+ * The host driver should have done a successful complement check (second
+ * quadlet is complement of first) beforehand.
+ */
 void hpsb_selfid_received(struct hpsb_host *host, quadlet_t sid)
 {
        if (host->in_bus_reset) {
@@ -416,6 +432,15 @@ void hpsb_selfid_received(struct hpsb_host *host, quadlet_t sid)
        }
 }
 
+/**
+ * hpsb_selfid_complete - notify completion of SelfID stage to the core
+ *
+ * For host driver module usage.  Safe to use in interrupt context, although
+ * quite complex; so you may want to run it in the bottom rather than top half.
+ *
+ * Notify completion of SelfID stage to the core and report new physical ID
+ * and whether host is root now.
+ */
 void hpsb_selfid_complete(struct hpsb_host *host, int phyid, int isroot)
 {
        if (!host->in_bus_reset)
@@ -462,30 +487,41 @@ void hpsb_selfid_complete(struct hpsb_host *host, int phyid, int isroot)
        highlevel_host_reset(host);
 }
 
+static spinlock_t pending_packets_lock = SPIN_LOCK_UNLOCKED;
 
+/**
+ * hpsb_packet_sent - notify core of sending a packet
+ *
+ * For host driver module usage.  Safe to call from within a transmit packet
+ * routine.
+ *
+ * Notify core of sending a packet.  Ackcode is the ack code returned for async
+ * transmits or ACKX_SEND_ERROR if the transmission failed completely; ACKX_NONE
+ * for other cases (internal errors that don't justify a panic).
+ */
 void hpsb_packet_sent(struct hpsb_host *host, struct hpsb_packet *packet,
                      int ackcode)
 {
        unsigned long flags;
 
-       spin_lock_irqsave(&host->pending_packet_queue.lock, flags);
+       spin_lock_irqsave(&pending_packets_lock, flags);
 
        packet->ack_code = ackcode;
 
        if (packet->no_waiter || packet->state == hpsb_complete) {
                /* if packet->no_waiter, must not have a tlabel allocated */
-               spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
+               spin_unlock_irqrestore(&pending_packets_lock, flags);
                hpsb_free_packet(packet);
                return;
        }
 
        atomic_dec(&packet->refcnt);    /* drop HC's reference */
-       /* here the packet must be on the host->pending_packet_queue */
+       /* here the packet must be on the host->pending_packets queue */
 
        if (ackcode != ACK_PENDING || !packet->expect_response) {
                packet->state = hpsb_complete;
-               __skb_unlink(packet->skb, &host->pending_packet_queue);
-               spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
+               list_del_init(&packet->queue);
+               spin_unlock_irqrestore(&pending_packets_lock, flags);
                queue_packet_complete(packet);
                return;
        }
@@ -493,7 +529,7 @@ void hpsb_packet_sent(struct hpsb_host *host, struct hpsb_packet *packet,
        packet->state = hpsb_pending;
        packet->sendtime = jiffies;
 
-       spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
+       spin_unlock_irqrestore(&pending_packets_lock, flags);
 
        mod_timer(&host->timeout, jiffies + host->timeout_interval);
 }
@@ -504,9 +540,10 @@ void hpsb_packet_sent(struct hpsb_host *host, struct hpsb_packet *packet,
  * @rootid: root whose force_root bit should get set (-1 = don't set force_root)
  * @gapcnt: gap count value to set (-1 = don't set gap count)
  *
- * This function sends a PHY config packet on the bus through the specified host.
+ * This function sends a PHY config packet on the bus through the specified
+ * host.
  *
- * Return value: 0 for success or error number otherwise.
+ * Return value: 0 for success or negative error number otherwise.
  */
 int hpsb_send_phy_config(struct hpsb_host *host, int rootid, int gapcnt)
 {
@@ -567,12 +604,16 @@ int hpsb_send_packet(struct hpsb_packet *packet)
        WARN_ON(packet->no_waiter && packet->expect_response);
 
        if (!packet->no_waiter || packet->expect_response) {
+               unsigned long flags;
+
                atomic_inc(&packet->refcnt);
                /* Set the initial "sendtime" to 10 seconds from now, to
                   prevent premature expiry.  If a packet takes more than
                   10 seconds to hit the wire, we have bigger problems :) */
                packet->sendtime = jiffies + 10 * HZ;
-               skb_queue_tail(&host->pending_packet_queue, packet->skb);
+               spin_lock_irqsave(&pending_packets_lock, flags);
+               list_add_tail(&packet->queue, &host->pending_packets);
+               spin_unlock_irqrestore(&pending_packets_lock, flags);
        }
 
        if (packet->node_id == host->node_id) {
@@ -621,6 +662,12 @@ static void complete_packet(void *data)
        complete((struct completion *) data);
 }
 
+/**
+ * hpsb_send_packet_and_wait - enqueue packet, block until transaction completes
+ * @packet: packet to send
+ *
+ * Return value: 0 on success, negative errno on failure.
+ */
 int hpsb_send_packet_and_wait(struct hpsb_packet *packet)
 {
        struct completion done;
@@ -642,86 +689,97 @@ static void send_packet_nocare(struct hpsb_packet *packet)
        }
 }
 
+static size_t packet_size_to_data_size(size_t packet_size, size_t header_size,
+                                      size_t buffer_size, int tcode)
+{
+       size_t ret = packet_size <= header_size ? 0 : packet_size - header_size;
+
+       if (unlikely(ret > buffer_size))
+               ret = buffer_size;
+
+       if (unlikely(ret + header_size != packet_size))
+               HPSB_ERR("unexpected packet size %zd (tcode %d), bug?",
+                        packet_size, tcode);
+       return ret;
+}
 
 static void handle_packet_response(struct hpsb_host *host, int tcode,
                                   quadlet_t *data, size_t size)
 {
-       struct hpsb_packet *packet = NULL;
-       struct sk_buff *skb;
-       int tcode_match = 0;
-       int tlabel;
+       struct hpsb_packet *packet;
+       int tlabel = (data[0] >> 10) & 0x3f;
+       size_t header_size;
        unsigned long flags;
 
-       tlabel = (data[0] >> 10) & 0x3f;
-
-       spin_lock_irqsave(&host->pending_packet_queue.lock, flags);
+       spin_lock_irqsave(&pending_packets_lock, flags);
 
-       skb_queue_walk(&host->pending_packet_queue, skb) {
-               packet = (struct hpsb_packet *)skb->data;
-               if ((packet->tlabel == tlabel)
-                   && (packet->node_id == (data[1] >> 16))){
-                       break;
-               }
-
-               packet = NULL;
-       }
+       list_for_each_entry(packet, &host->pending_packets, queue)
+               if (packet->tlabel == tlabel &&
+                   packet->node_id == (data[1] >> 16))
+                       goto found;
 
-       if (packet == NULL) {
-               HPSB_DEBUG("unsolicited response packet received - no tlabel match");
-               dump_packet("contents", data, 16, -1);
-               spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
-               return;
-       }
+       spin_unlock_irqrestore(&pending_packets_lock, flags);
+       HPSB_DEBUG("unsolicited response packet received - %s",
+                  "no tlabel match");
+       dump_packet("contents", data, 16, -1);
+       return;
 
+found:
        switch (packet->tcode) {
        case TCODE_WRITEQ:
        case TCODE_WRITEB:
-               if (tcode != TCODE_WRITE_RESPONSE)
+               if (unlikely(tcode != TCODE_WRITE_RESPONSE))
                        break;
-               tcode_match = 1;
-               memcpy(packet->header, data, 12);
-               break;
+               header_size = 12;
+               size = 0;
+               goto dequeue;
+
        case TCODE_READQ:
-               if (tcode != TCODE_READQ_RESPONSE)
+               if (unlikely(tcode != TCODE_READQ_RESPONSE))
                        break;
-               tcode_match = 1;
-               memcpy(packet->header, data, 16);
-               break;
+               header_size = 16;
+               size = 0;
+               goto dequeue;
+
        case TCODE_READB:
-               if (tcode != TCODE_READB_RESPONSE)
+               if (unlikely(tcode != TCODE_READB_RESPONSE))
                        break;
-               tcode_match = 1;
-               BUG_ON(packet->skb->len - sizeof(*packet) < size - 16);
-               memcpy(packet->header, data, 16);
-               memcpy(packet->data, data + 4, size - 16);
-               break;
+               header_size = 16;
+               size = packet_size_to_data_size(size, header_size,
+                                               packet->allocated_data_size,
+                                               tcode);
+               goto dequeue;
+
        case TCODE_LOCK_REQUEST:
-               if (tcode != TCODE_LOCK_RESPONSE)
+               if (unlikely(tcode != TCODE_LOCK_RESPONSE))
                        break;
-               tcode_match = 1;
-               size = min((size - 16), (size_t)8);
-               BUG_ON(packet->skb->len - sizeof(*packet) < size);
-               memcpy(packet->header, data, 16);
-               memcpy(packet->data, data + 4, size);
-               break;
+               header_size = 16;
+               size = packet_size_to_data_size(min(size, (size_t)(16 + 8)),
+                                               header_size,
+                                               packet->allocated_data_size,
+                                               tcode);
+               goto dequeue;
        }
 
-       if (!tcode_match) {
-               spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
-               HPSB_INFO("unsolicited response packet received - tcode mismatch");
-               dump_packet("contents", data, 16, -1);
-               return;
-       }
+       spin_unlock_irqrestore(&pending_packets_lock, flags);
+       HPSB_DEBUG("unsolicited response packet received - %s",
+                  "tcode mismatch");
+       dump_packet("contents", data, 16, -1);
+       return;
 
-       __skb_unlink(skb, &host->pending_packet_queue);
+dequeue:
+       list_del_init(&packet->queue);
+       spin_unlock_irqrestore(&pending_packets_lock, flags);
 
        if (packet->state == hpsb_queued) {
                packet->sendtime = jiffies;
                packet->ack_code = ACK_PENDING;
        }
-
        packet->state = hpsb_complete;
-       spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
+
+       memcpy(packet->header, data, header_size);
+       if (size)
+               memcpy(packet->data, data + 4, size);
 
        queue_packet_complete(packet);
 }
@@ -735,6 +793,7 @@ static struct hpsb_packet *create_reply_packet(struct hpsb_host *host,
        p = hpsb_alloc_packet(dsize);
        if (unlikely(p == NULL)) {
                /* FIXME - send data_error response */
+               HPSB_ERR("out of memory, cannot send response packet");
                return NULL;
        }
 
@@ -784,7 +843,6 @@ static void fill_async_readblock_resp(struct hpsb_packet *packet, int rcode,
 static void fill_async_write_resp(struct hpsb_packet *packet, int rcode)
 {
        PREP_ASYNC_HEAD_RCODE(TCODE_WRITE_RESPONSE);
-       packet->header[2] = 0;
        packet->header_size = 12;
        packet->data_size = 0;
 }
@@ -801,12 +859,9 @@ static void fill_async_lock_resp(struct hpsb_packet *packet, int rcode, int extc
        packet->data_size = length;
 }
 
-#define PREP_REPLY_PACKET(length) \
-               packet = create_reply_packet(host, data, length); \
-               if (packet == NULL) break
-
 static void handle_incoming_packet(struct hpsb_host *host, int tcode,
-                                  quadlet_t *data, size_t size, int write_acked)
+                                  quadlet_t *data, size_t size,
+                                  int write_acked)
 {
        struct hpsb_packet *packet;
        int length, rcode, extcode;
@@ -816,74 +871,72 @@ static void handle_incoming_packet(struct hpsb_host *host, int tcode,
        u16 flags = (u16) data[0];
        u64 addr;
 
-       /* big FIXME - no error checking is done for an out of bounds length */
+       /* FIXME?
+        * Out-of-bounds lengths are left for highlevel_read|write to cap. */
 
        switch (tcode) {
        case TCODE_WRITEQ:
                addr = (((u64)(data[1] & 0xffff)) << 32) | data[2];
-               rcode = highlevel_write(host, source, dest, data+3,
+               rcode = highlevel_write(host, source, dest, data + 3,
                                        addr, 4, flags);
-
-               if (!write_acked
-                   && (NODEID_TO_NODE(data[0] >> 16) != NODE_MASK)
-                   && (rcode >= 0)) {
-                       /* not a broadcast write, reply */
-                       PREP_REPLY_PACKET(0);
-                       fill_async_write_resp(packet, rcode);
-                       send_packet_nocare(packet);
-               }
-               break;
+               goto handle_write_request;
 
        case TCODE_WRITEB:
                addr = (((u64)(data[1] & 0xffff)) << 32) | data[2];
-               rcode = highlevel_write(host, source, dest, data+4,
-                                       addr, data[3]>>16, flags);
-
-               if (!write_acked
-                   && (NODEID_TO_NODE(data[0] >> 16) != NODE_MASK)
-                   && (rcode >= 0)) {
-                       /* not a broadcast write, reply */
-                       PREP_REPLY_PACKET(0);
+               rcode = highlevel_write(host, source, dest, data + 4,
+                                       addr, data[3] >> 16, flags);
+handle_write_request:
+               if (rcode < 0 || write_acked ||
+                   NODEID_TO_NODE(data[0] >> 16) == NODE_MASK)
+                       return;
+               /* not a broadcast write, reply */
+               packet = create_reply_packet(host, data, 0);
+               if (packet) {
                        fill_async_write_resp(packet, rcode);
                        send_packet_nocare(packet);
                }
-               break;
+               return;
 
        case TCODE_READQ:
                addr = (((u64)(data[1] & 0xffff)) << 32) | data[2];
                rcode = highlevel_read(host, source, &buffer, addr, 4, flags);
+               if (rcode < 0)
+                       return;
 
-               if (rcode >= 0) {
-                       PREP_REPLY_PACKET(0);
+               packet = create_reply_packet(host, data, 0);
+               if (packet) {
                        fill_async_readquad_resp(packet, rcode, buffer);
                        send_packet_nocare(packet);
                }
-               break;
+               return;
 
        case TCODE_READB:
                length = data[3] >> 16;
-               PREP_REPLY_PACKET(length);
+               packet = create_reply_packet(host, data, length);
+               if (!packet)
+                       return;
 
                addr = (((u64)(data[1] & 0xffff)) << 32) | data[2];
                rcode = highlevel_read(host, source, packet->data, addr,
                                       length, flags);
-
-               if (rcode >= 0) {
-                       fill_async_readblock_resp(packet, rcode, length);
-                       send_packet_nocare(packet);
-               } else {
+               if (rcode < 0) {
                        hpsb_free_packet(packet);
+                       return;
                }
-               break;
+               fill_async_readblock_resp(packet, rcode, length);
+               send_packet_nocare(packet);
+               return;
 
        case TCODE_LOCK_REQUEST:
                length = data[3] >> 16;
                extcode = data[3] & 0xffff;
                addr = (((u64)(data[1] & 0xffff)) << 32) | data[2];
 
-               PREP_REPLY_PACKET(8);
+               packet = create_reply_packet(host, data, 8);
+               if (!packet)
+                       return;
 
-               if ((extcode == 0) || (extcode >= 7)) {
+               if (extcode == 0 || extcode >= 7) {
                        /* let switch default handle error */
                        length = 0;
                }
@@ -891,12 +944,12 @@ static void handle_incoming_packet(struct hpsb_host *host, int tcode,
                switch (length) {
                case 4:
                        rcode = highlevel_lock(host, source, packet->data, addr,
-                                              data[4], 0, extcode,flags);
+                                              data[4], 0, extcode, flags);
                        fill_async_lock_resp(packet, rcode, extcode, 4);
                        break;
                case 8:
-                       if ((extcode != EXTCODE_FETCH_ADD)
-                           && (extcode != EXTCODE_LITTLE_ADD)) {
+                       if (extcode != EXTCODE_FETCH_ADD &&
+                           extcode != EXTCODE_LITTLE_ADD) {
                                rcode = highlevel_lock(host, source,
                                                       packet->data, addr,
                                                       data[5], data[4],
@@ -920,29 +973,38 @@ static void handle_incoming_packet(struct hpsb_host *host, int tcode,
                        break;
                default:
                        rcode = RCODE_TYPE_ERROR;
-                       fill_async_lock_resp(packet, rcode,
-                                            extcode, 0);
+                       fill_async_lock_resp(packet, rcode, extcode, 0);
                }
 
-               if (rcode >= 0) {
-                       send_packet_nocare(packet);
-               } else {
+               if (rcode < 0)
                        hpsb_free_packet(packet);
-               }
-               break;
+               else
+                       send_packet_nocare(packet);
+               return;
        }
-
 }
-#undef PREP_REPLY_PACKET
-
 
+/**
+ * hpsb_packet_received - hand over received packet to the core
+ *
+ * For host driver module usage.
+ *
+ * The contents of data are expected to be the full packet but with the CRCs
+ * left out (data block follows header immediately), with the header (i.e. the
+ * first four quadlets) in machine byte order and the data block in big endian.
+ * *@data can be safely overwritten after this call.
+ *
+ * If the packet is a write request, @write_acked is to be set to true if it was
+ * ack_complete'd already, false otherwise.  This argument is ignored for any
+ * other packet type.
+ */
 void hpsb_packet_received(struct hpsb_host *host, quadlet_t *data, size_t size,
                          int write_acked)
 {
        int tcode;
 
-       if (host->in_bus_reset) {
-               HPSB_INFO("received packet during reset; ignoring");
+       if (unlikely(host->in_bus_reset)) {
+               HPSB_DEBUG("received packet during reset; ignoring");
                return;
        }
 
@@ -976,23 +1038,27 @@ void hpsb_packet_received(struct hpsb_host *host, quadlet_t *data, size_t size,
                break;
 
        default:
-               HPSB_NOTICE("received packet with bogus transaction code %d",
-                           tcode);
+               HPSB_DEBUG("received packet with bogus transaction code %d",
+                          tcode);
                break;
        }
 }
 
-
 static void abort_requests(struct hpsb_host *host)
 {
-       struct hpsb_packet *packet;
-       struct sk_buff *skb;
+       struct hpsb_packet *packet, *p;
+       struct list_head tmp;
+       unsigned long flags;
 
        host->driver->devctl(host, CANCEL_REQUESTS, 0);
 
-       while ((skb = skb_dequeue(&host->pending_packet_queue)) != NULL) {
-               packet = (struct hpsb_packet *)skb->data;
+       INIT_LIST_HEAD(&tmp);
+       spin_lock_irqsave(&pending_packets_lock, flags);
+       list_splice_init(&host->pending_packets, &tmp);
+       spin_unlock_irqrestore(&pending_packets_lock, flags);
 
+       list_for_each_entry_safe(packet, p, &tmp, queue) {
+               list_del_init(&packet->queue);
                packet->state = hpsb_complete;
                packet->ack_code = ACKX_ABORTED;
                queue_packet_complete(packet);
@@ -1002,87 +1068,90 @@ static void abort_requests(struct hpsb_host *host)
 void abort_timedouts(unsigned long __opaque)
 {
        struct hpsb_host *host = (struct hpsb_host *)__opaque;
-       unsigned long flags;
-       struct hpsb_packet *packet;
-       struct sk_buff *skb;
-       unsigned long expire;
+       struct hpsb_packet *packet, *p;
+       struct list_head tmp;
+       unsigned long flags, expire, j;
 
        spin_lock_irqsave(&host->csr.lock, flags);
        expire = host->csr.expire;
        spin_unlock_irqrestore(&host->csr.lock, flags);
 
-       /* Hold the lock around this, since we aren't dequeuing all
-        * packets, just ones we need. */
-       spin_lock_irqsave(&host->pending_packet_queue.lock, flags);
-
-       while (!skb_queue_empty(&host->pending_packet_queue)) {
-               skb = skb_peek(&host->pending_packet_queue);
-
-               packet = (struct hpsb_packet *)skb->data;
+       j = jiffies;
+       INIT_LIST_HEAD(&tmp);
+       spin_lock_irqsave(&pending_packets_lock, flags);
 
-               if (time_before(packet->sendtime + expire, jiffies)) {
-                       __skb_unlink(skb, &host->pending_packet_queue);
-                       packet->state = hpsb_complete;
-                       packet->ack_code = ACKX_TIMEOUT;
-                       queue_packet_complete(packet);
-               } else {
+       list_for_each_entry_safe(packet, p, &host->pending_packets, queue) {
+               if (time_before(packet->sendtime + expire, j))
+                       list_move_tail(&packet->queue, &tmp);
+               else
                        /* Since packets are added to the tail, the oldest
                         * ones are first, always. When we get to one that
                         * isn't timed out, the rest aren't either. */
                        break;
-               }
        }
+       if (!list_empty(&host->pending_packets))
+               mod_timer(&host->timeout, j + host->timeout_interval);
 
-       if (!skb_queue_empty(&host->pending_packet_queue))
-               mod_timer(&host->timeout, jiffies + host->timeout_interval);
+       spin_unlock_irqrestore(&pending_packets_lock, flags);
 
-       spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
+       list_for_each_entry_safe(packet, p, &tmp, queue) {
+               list_del_init(&packet->queue);
+               packet->state = hpsb_complete;
+               packet->ack_code = ACKX_TIMEOUT;
+               queue_packet_complete(packet);
+       }
 }
 
-
-/* Kernel thread and vars, which handles packets that are completed. Only
- * packets that have a "complete" function are sent here. This way, the
- * completion is run out of kernel context, and doesn't block the rest of
- * the stack. */
 static struct task_struct *khpsbpkt_thread;
-static struct sk_buff_head hpsbpkt_queue;
+static LIST_HEAD(hpsbpkt_queue);
 
 static void queue_packet_complete(struct hpsb_packet *packet)
 {
+       unsigned long flags;
+
        if (packet->no_waiter) {
                hpsb_free_packet(packet);
                return;
        }
        if (packet->complete_routine != NULL) {
-               skb_queue_tail(&hpsbpkt_queue, packet->skb);
+               spin_lock_irqsave(&pending_packets_lock, flags);
+               list_add_tail(&packet->queue, &hpsbpkt_queue);
+               spin_unlock_irqrestore(&pending_packets_lock, flags);
                wake_up_process(khpsbpkt_thread);
        }
        return;
 }
 
+/*
+ * Kernel thread which handles packets that are completed.  This way the
+ * packet's "complete" function is asynchronously run in process context.
+ * Only packets which have a "complete" function may be sent here.
+ */
 static int hpsbpkt_thread(void *__hi)
 {
-       struct sk_buff *skb;
-       struct hpsb_packet *packet;
-       void (*complete_routine)(void*);
-       void *complete_data;
+       struct hpsb_packet *packet, *p;
+       struct list_head tmp;
+       int may_schedule;
 
        current->flags |= PF_NOFREEZE;
 
        while (!kthread_should_stop()) {
-               while ((skb = skb_dequeue(&hpsbpkt_queue)) != NULL) {
-                       packet = (struct hpsb_packet *)skb->data;
-
-                       complete_routine = packet->complete_routine;
-                       complete_data = packet->complete_data;
 
-                       packet->complete_routine = packet->complete_data = NULL;
+               INIT_LIST_HEAD(&tmp);
+               spin_lock_irq(&pending_packets_lock);
+               list_splice_init(&hpsbpkt_queue, &tmp);
+               spin_unlock_irq(&pending_packets_lock);
 
-                       complete_routine(complete_data);
+               list_for_each_entry_safe(packet, p, &tmp, queue) {
+                       list_del_init(&packet->queue);
+                       packet->complete_routine(packet->complete_data);
                }
 
                set_current_state(TASK_INTERRUPTIBLE);
-               if (!skb_peek(&hpsbpkt_queue))
+               spin_lock_irq(&pending_packets_lock);
+               may_schedule = list_empty(&hpsbpkt_queue);
+               spin_unlock_irq(&pending_packets_lock);
+               if (may_schedule)
                        schedule();
                __set_current_state(TASK_RUNNING);
        }
@@ -1093,8 +1162,6 @@ static int __init ieee1394_init(void)
 {
        int i, ret;
 
-       skb_queue_head_init(&hpsbpkt_queue);
-
        /* non-fatal error */
        if (hpsb_init_config_roms()) {
                HPSB_ERR("Failed to initialize some config rom entries.\n");
@@ -1268,7 +1335,6 @@ EXPORT_SYMBOL(hpsb_destroy_hostinfo);
 EXPORT_SYMBOL(hpsb_set_hostinfo_key);
 EXPORT_SYMBOL(hpsb_get_hostinfo_bykey);
 EXPORT_SYMBOL(hpsb_set_hostinfo);
-EXPORT_SYMBOL(highlevel_host_reset);
 
 /** nodemgr.c **/
 EXPORT_SYMBOL(hpsb_node_fill_packet);
@@ -1311,11 +1377,10 @@ EXPORT_SYMBOL(hpsb_iso_wake);
 EXPORT_SYMBOL(hpsb_iso_recv_flush);
 
 /** csr1212.c **/
-EXPORT_SYMBOL(csr1212_new_directory);
 EXPORT_SYMBOL(csr1212_attach_keyval_to_directory);
 EXPORT_SYMBOL(csr1212_detach_keyval_from_directory);
-EXPORT_SYMBOL(csr1212_release_keyval);
-EXPORT_SYMBOL(csr1212_read);
+EXPORT_SYMBOL(csr1212_get_keyval);
+EXPORT_SYMBOL(csr1212_new_directory);
 EXPORT_SYMBOL(csr1212_parse_keyval);
-EXPORT_SYMBOL(_csr1212_read_keyval);
-EXPORT_SYMBOL(_csr1212_destroy_keyval);
+EXPORT_SYMBOL(csr1212_read);
+EXPORT_SYMBOL(csr1212_release_keyval);