1 files changed, 54 insertions, 23 deletions

diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
index b42a0bde8494..334b82a3542c 100644
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -36,6 +36,7 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/types.h>
+#include <linux/workqueue.h>
 
 #include <asm/byteorder.h>
 
@@ -72,6 +73,15 @@
 #define PHY_CONFIG_ROOT_ID(node_id)     ((((node_id) & 0x3f) << 24) | (1 << 23))
 #define PHY_IDENTIFIER(id)              ((id) << 30)
 
+/* returns 0 if the split timeout handler is already running */
+static int try_cancel_split_timeout(struct fw_transaction *t)
+{
+        if (t->is_split_transaction)
+                return del_timer(&t->split_timeout_timer);
+        else
+                return 1;
+}
+
 static int close_transaction(struct fw_transaction *transaction,
                              struct fw_card *card, int rcode)
 {
@@ -81,7 +91,7 @@ static int close_transaction(struct fw_transaction *transaction,
         spin_lock_irqsave(&card->lock, flags);
         list_for_each_entry(t, &card->transaction_list, link) {
                 if (t == transaction) {
-                        if (!del_timer(&t->split_timeout_timer)) {
+                        if (!try_cancel_split_timeout(t)) {
                                 spin_unlock_irqrestore(&card->lock, flags);
                                 goto timed_out;
                         }
@@ -141,16 +151,28 @@ static void split_transaction_timeout_callback(unsigned long data)
         card->tlabel_mask &= ~(1ULL << t->tlabel);
         spin_unlock_irqrestore(&card->lock, flags);
 
-        card->driver->cancel_packet(card, &t->packet);
-
-        /*
-         * At this point cancel_packet will never call the transaction
-         * callback, since we just took the transaction out of the list.
-         * So do it here.
-         */
         t->callback(card, RCODE_CANCELLED, NULL, 0, t->callback_data);
 }
 
+static void start_split_transaction_timeout(struct fw_transaction *t,
+                                            struct fw_card *card)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&card->lock, flags);
+
+        if (list_empty(&t->link) || WARN_ON(t->is_split_transaction)) {
+                spin_unlock_irqrestore(&card->lock, flags);
+                return;
+        }
+
+        t->is_split_transaction = true;
+        mod_timer(&t->split_timeout_timer,
+                  jiffies + card->split_timeout_jiffies);
+
+        spin_unlock_irqrestore(&card->lock, flags);
+}
+
 static void transmit_complete_callback(struct fw_packet *packet,
                                        struct fw_card *card, int status)
 {
@@ -162,7 +184,7 @@ static void transmit_complete_callback(struct fw_packet *packet,
                 close_transaction(t, card, RCODE_COMPLETE);
                 break;
         case ACK_PENDING:
-                t->timestamp = packet->timestamp;
+                start_split_transaction_timeout(t, card);
                 break;
         case ACK_BUSY_X:
         case ACK_BUSY_A:
@@ -250,7 +272,7 @@ static void fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
                 break;
 
         default:
-                WARN(1, "wrong tcode %d", tcode);
+                WARN(1, "wrong tcode %d\n", tcode);
         }
  common:
         packet->speed = speed;
@@ -305,8 +327,8 @@ static int allocate_tlabel(struct fw_card *card)
  * It will contain tag, channel, and sy data instead of a node ID then.
  *
  * The payload buffer at @data is going to be DMA-mapped except in case of
- * quadlet-sized payload or of local (loopback) requests.  Hence make sure that
- * the buffer complies with the restrictions for DMA-mapped memory.  The
+ * @length <= 8 or of local (loopback) requests.  Hence make sure that the
+ * buffer complies with the restrictions of the streaming DMA mapping API.
  * @payload must not be freed before the @callback is called.
  *
  * In case of request types without payload, @data is NULL and @length is 0.
@@ -349,11 +371,9 @@ void fw_send_request(struct fw_card *card, struct fw_transaction *t, int tcode,
         t->node_id = destination_id;
         t->tlabel = tlabel;
         t->card = card;
+        t->is_split_transaction = false;
         setup_timer(&t->split_timeout_timer,
                     split_transaction_timeout_callback, (unsigned long)t);
-        /* FIXME: start this timer later, relative to t->timestamp */
-        mod_timer(&t->split_timeout_timer,
-                  jiffies + card->split_timeout_jiffies);
         t->callback = callback;
         t->callback_data = callback_data;
 
@@ -392,7 +412,8 @@ static void transaction_callback(struct fw_card *card, int rcode,
  *
  * Returns the RCODE.  See fw_send_request() for parameter documentation.
  * Unlike fw_send_request(), @data points to the payload of the request or/and
- * to the payload of the response.
+ * to the payload of the response.  DMA mapping restrictions apply to outbound
+ * request payloads of >= 8 bytes but not to inbound response payloads.
  */
 int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
                        int generation, int speed, unsigned long long offset,
@@ -423,7 +444,8 @@ static void transmit_phy_packet_callback(struct fw_packet *packet,
 }
 
 static struct fw_packet phy_config_packet = {
-        .header_length  = 8,
+        .header_length  = 12,
+        .header[0]      = TCODE_LINK_INTERNAL << 4,
         .payload_length = 0,
         .speed          = SCODE_100,
         .callback       = transmit_phy_packet_callback,
@@ -451,8 +473,8 @@ void fw_send_phy_config(struct fw_card *card,
 
         mutex_lock(&phy_config_mutex);
 
-        phy_config_packet.header[0] = data;
-        phy_config_packet.header[1] = ~data;
+        phy_config_packet.header[1] = data;
+        phy_config_packet.header[2] = ~data;
         phy_config_packet.generation = generation;
         INIT_COMPLETION(phy_config_done);
 
@@ -638,7 +660,7 @@ int fw_get_response_length(struct fw_request *r)
                 }
 
         default:
-                WARN(1, "wrong tcode %d", tcode);
+                WARN(1, "wrong tcode %d\n", tcode);
                 return 0;
         }
 }
@@ -694,7 +716,7 @@ void fw_fill_response(struct fw_packet *response, u32 *request_header,
                 break;
 
         default:
-                WARN(1, "wrong tcode %d", tcode);
+                WARN(1, "wrong tcode %d\n", tcode);
         }
 
         response->payload_mapped = false;
@@ -925,7 +947,7 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
         spin_lock_irqsave(&card->lock, flags);
         list_for_each_entry(t, &card->transaction_list, link) {
                 if (t->node_id == source && t->tlabel == tlabel) {
-                        if (!del_timer(&t->split_timeout_timer)) {
+                        if (!try_cancel_split_timeout(t)) {
                                 spin_unlock_irqrestore(&card->lock, flags);
                                 goto timed_out;
                         }
@@ -1192,13 +1214,21 @@ static int __init fw_core_init(void)
 {
         int ret;
 
+        fw_workqueue = alloc_workqueue("firewire",
+                                       WQ_NON_REENTRANT | WQ_MEM_RECLAIM, 0);
+        if (!fw_workqueue)
+                return -ENOMEM;
+
         ret = bus_register(&fw_bus_type);
-        if (ret < 0)
+        if (ret < 0) {
+                destroy_workqueue(fw_workqueue);
                 return ret;
+        }
 
         fw_cdev_major = register_chrdev(0, "firewire", &fw_device_ops);
         if (fw_cdev_major < 0) {
                 bus_unregister(&fw_bus_type);
+                destroy_workqueue(fw_workqueue);
                 return fw_cdev_major;
         }
 
@@ -1214,6 +1244,7 @@ static void __exit fw_core_cleanup(void)
 {
         unregister_chrdev(fw_cdev_major, "firewire");
         bus_unregister(&fw_bus_type);
+        destroy_workqueue(fw_workqueue);
         idr_destroy(&fw_device_idr);
 }