1 files changed, 29 insertions, 9 deletions

diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index 56681b3b297b..de9066e69adf 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -27,6 +27,7 @@
 #include <linux/idr.h>
 #include <linux/rwsem.h>
 #include <asm/semaphore.h>
+#include <asm/system.h>
 #include <linux/ctype.h>
 #include "fw-transaction.h"
 #include "fw-topology.h"
@@ -182,9 +183,14 @@ static void fw_device_release(struct device *dev)
 
 int fw_device_enable_phys_dma(struct fw_device *device)
 {
+        int generation = device->generation;
+
+        /* device->node_id, accessed below, must not be older than generation */
+        smp_rmb();
+
         return device->card->driver->enable_phys_dma(device->card,
                                                      device->node_id,
-                                                     device->generation);
+                                                     generation);
 }
 EXPORT_SYMBOL(fw_device_enable_phys_dma);
 
@@ -384,17 +390,21 @@ complete_transaction(struct fw_card *card, int rcode,
         complete(&callback_data->done);
 }
 
-static int read_rom(struct fw_device *device, int index, u32 * data)
+static int
+read_rom(struct fw_device *device, int generation, int index, u32 *data)
 {
         struct read_quadlet_callback_data callback_data;
         struct fw_transaction t;
         u64 offset;
 
+        /* device->node_id, accessed below, must not be older than generation */
+        smp_rmb();
+
         init_completion(&callback_data.done);
 
         offset = 0xfffff0000400ULL + index * 4;
         fw_send_request(device->card, &t, TCODE_READ_QUADLET_REQUEST,
-                        device->node_id, device->generation, device->max_speed,
+                        device->node_id, generation, device->max_speed,
                         offset, NULL, 4, complete_transaction, &callback_data);
 
         wait_for_completion(&callback_data.done);
@@ -404,7 +414,14 @@ static int read_rom(struct fw_device *device, int index, u32 * data)
         return callback_data.rcode;
 }
 
-static int read_bus_info_block(struct fw_device *device)
+/*
+ * Read the bus info block, perform a speed probe, and read all of the rest of
+ * the config ROM.  We do all this with a cached bus generation.  If the bus
+ * generation changes under us, read_bus_info_block will fail and get retried.
+ * It's better to start all over in this case because the node from which we
+ * are reading the ROM may have changed the ROM during the reset.
+ */
+static int read_bus_info_block(struct fw_device *device, int generation)
 {
         static u32 rom[256];
         u32 stack[16], sp, key;
@@ -414,7 +431,7 @@ static int read_bus_info_block(struct fw_device *device)
 
         /* First read the bus info block. */
         for (i = 0; i < 5; i++) {
-                if (read_rom(device, i, &rom[i]) != RCODE_COMPLETE)
+                if (read_rom(device, generation, i, &rom[i]) != RCODE_COMPLETE)
                         return -1;
                 /*
                  * As per IEEE1212 7.2, during power-up, devices can
@@ -449,7 +466,8 @@ static int read_bus_info_block(struct fw_device *device)
                         device->max_speed = device->card->link_speed;
 
                 while (device->max_speed > SCODE_100) {
-                        if (read_rom(device, 0, &dummy) == RCODE_COMPLETE)
+                        if (read_rom(device, generation, 0, &dummy) ==
+                            RCODE_COMPLETE)
                                 break;
                         device->max_speed--;
                 }
@@ -482,7 +500,7 @@ static int read_bus_info_block(struct fw_device *device)
                         return -1;
 
                 /* Read header quadlet for the block to get the length. */
-                if (read_rom(device, i, &rom[i]) != RCODE_COMPLETE)
+                if (read_rom(device, generation, i, &rom[i]) != RCODE_COMPLETE)
                         return -1;
                 end = i + (rom[i] >> 16) + 1;
                 i++;
@@ -501,7 +519,8 @@ static int read_bus_info_block(struct fw_device *device)
                  * it references another block, and push it in that case.
                  */
                 while (i < end) {
-                        if (read_rom(device, i, &rom[i]) != RCODE_COMPLETE)
+                        if (read_rom(device, generation, i, &rom[i]) !=
+                            RCODE_COMPLETE)
                                 return -1;
                         if ((key >> 30) == 3 && (rom[i] >> 30) > 1 &&
                             sp < ARRAY_SIZE(stack))
@@ -648,7 +667,7 @@ static void fw_device_init(struct work_struct *work)
          * device.
          */
 
-        if (read_bus_info_block(device) < 0) {
+        if (read_bus_info_block(device, device->generation) < 0) {
                 if (device->config_rom_retries < MAX_RETRIES) {
                         device->config_rom_retries++;
                         schedule_delayed_work(&device->work, RETRY_DELAY);
@@ -801,6 +820,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 
                 device = node->data;
                 device->node_id = node->node_id;
+                smp_wmb();  /* update node_id before generation */
                 device->generation = card->generation;
                 if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
                         PREPARE_DELAYED_WORK(&device->work, fw_device_update);