4 files changed, 16 insertions, 16 deletions

diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index 41476abc0693..db703758db98 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -224,6 +224,7 @@ ohci_update_phy_reg(struct fw_card *card, int addr,
         u32 val, old;
 
         reg_write(ohci, OHCI1394_PhyControl, OHCI1394_PhyControl_Read(addr));
+        flush_writes(ohci);
         msleep(2);
         val = reg_read(ohci, OHCI1394_PhyControl);
         if ((val & OHCI1394_PhyControl_ReadDone) == 0) {
@@ -586,7 +587,7 @@ static void context_stop(struct context *ctx)
                         break;
 
                 fw_notify("context_stop: still active (0x%08x)\n", reg);
-                msleep(1);
+                mdelay(1);
         }
 }
 
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index e5e5b0a2b8a9..3e4a369d0057 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -840,7 +840,6 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
                 container_of(base_orb, struct sbp2_command_orb, base);
         struct fw_unit *unit = orb->unit;
         struct fw_device *device = fw_device(unit->device.parent);
-        struct scatterlist *sg;
         int result;
 
         if (status != NULL) {
@@ -876,11 +875,10 @@ complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
         dma_unmap_single(device->card->device, orb->base.request_bus,
                          sizeof(orb->request), DMA_TO_DEVICE);
 
-        if (orb->cmd->use_sg > 0) {
-                sg = (struct scatterlist *)orb->cmd->request_buffer;
-                dma_unmap_sg(device->card->device, sg, orb->cmd->use_sg,
+        if (scsi_sg_count(orb->cmd) > 0)
+                dma_unmap_sg(device->card->device, scsi_sglist(orb->cmd),
+                             scsi_sg_count(orb->cmd),
                              orb->cmd->sc_data_direction);
-        }
 
         if (orb->page_table_bus != 0)
                 dma_unmap_single(device->card->device, orb->page_table_bus,
@@ -901,8 +899,8 @@ static int sbp2_command_orb_map_scatterlist(struct sbp2_command_orb *orb)
         int sg_len, l, i, j, count;
         dma_addr_t sg_addr;
 
-        sg = (struct scatterlist *)orb->cmd->request_buffer;
-        count = dma_map_sg(device->card->device, sg, orb->cmd->use_sg,
+        sg = scsi_sglist(orb->cmd);
+        count = dma_map_sg(device->card->device, sg, scsi_sg_count(orb->cmd),
                            orb->cmd->sc_data_direction);
         if (count == 0)
                 goto fail;
@@ -971,7 +969,7 @@ static int sbp2_command_orb_map_scatterlist(struct sbp2_command_orb *orb)
         return 0;
 
  fail_page_table:
-        dma_unmap_sg(device->card->device, sg, orb->cmd->use_sg,
+        dma_unmap_sg(device->card->device, sg, scsi_sg_count(orb->cmd),
                      orb->cmd->sc_data_direction);
  fail:
         return -ENOMEM;
@@ -1031,7 +1029,7 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
                 orb->request.misc |=
                         COMMAND_ORB_DIRECTION(SBP2_DIRECTION_TO_MEDIA);
 
-        if (cmd->use_sg && sbp2_command_orb_map_scatterlist(orb) < 0)
+        if (scsi_sg_count(cmd) && sbp2_command_orb_map_scatterlist(orb) < 0)
                 goto fail_mapping;
 
         fw_memcpy_to_be32(&orb->request, &orb->request, sizeof(orb->request));
diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
index 80d0121463d0..3ce8e2fbe15f 100644
--- a/drivers/firewire/fw-transaction.c
+++ b/drivers/firewire/fw-transaction.c
@@ -605,8 +605,10 @@ fw_send_response(struct fw_card *card, struct fw_request *request, int rcode)
          * check is sufficient to ensure we don't send response to
          * broadcast packets or posted writes.
          */
-        if (request->ack != ACK_PENDING)
+        if (request->ack != ACK_PENDING) {
+                kfree(request);
                 return;
+        }
 
         if (rcode == RCODE_COMPLETE)
                 fw_fill_response(&request->response, request->request_header,
@@ -628,11 +630,6 @@ fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
         unsigned long flags;
         int tcode, destination, source;
 
-        if (p->payload_length > 2048) {
-                /* FIXME: send error response. */
-                return;
-        }
-
         if (p->ack != ACK_PENDING && p->ack != ACK_COMPLETE)
                 return;
 
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index 5abed193f4a6..5ceaccd10564 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -123,6 +123,10 @@ typedef void (*fw_transaction_callback_t)(struct fw_card *card, int rcode,
                                           size_t length,
                                           void *callback_data);
 
+/*
+ * Important note:  The callback must guarantee that either fw_send_response()
+ * or kfree() is called on the @request.
+ */
 typedef void (*fw_address_callback_t)(struct fw_card *card,
                                       struct fw_request *request,
                                       int tcode, int destination, int source,