14 files changed, 1299 insertions, 497 deletions

diff --git a/drivers/firewire/Kconfig b/drivers/firewire/Kconfig
index fcf3ea28340b..2be6f4520772 100644
--- a/drivers/firewire/Kconfig
+++ b/drivers/firewire/Kconfig
@@ -3,9 +3,6 @@ menu "IEEE 1394 (FireWire) support"
         # firewire-core does not depend on PCI but is
         # not useful without PCI controller driver
 
-comment "You can enable one or both FireWire driver stacks."
-comment "The newer stack is recommended."
-
 config FIREWIRE
         tristate "FireWire driver stack"
         select CRC_ITU_T
@@ -22,7 +19,7 @@ config FIREWIRE
 
 config FIREWIRE_OHCI
         tristate "OHCI-1394 controllers"
-        depends on PCI && FIREWIRE
+        depends on PCI && FIREWIRE && MMU
         help
           Enable this driver if you have a FireWire controller based
           on the OHCI specification.  For all practical purposes, this
@@ -52,20 +49,16 @@ config FIREWIRE_SBP2
           configuration section.
 
 config FIREWIRE_NET
-        tristate "IP networking over 1394 (EXPERIMENTAL)"
-        depends on FIREWIRE && INET && EXPERIMENTAL
+        tristate "IP networking over 1394"
+        depends on FIREWIRE && INET
         help
           This enables IPv4 over IEEE 1394, providing IP connectivity with
           other implementations of RFC 2734 as found on several operating
           systems.  Multicast support is currently limited.
 
-          NOTE, this driver is not stable yet!
-
           To compile this driver as a module, say M here:  The module will be
           called firewire-net.
 
-source "drivers/ieee1394/Kconfig"
-
 config FIREWIRE_NOSY
         tristate "Nosy - a FireWire traffic sniffer for PCILynx cards"
         depends on PCI
@@ -82,7 +75,8 @@ config FIREWIRE_NOSY
           The following cards are known to be based on PCILynx or PCILynx-2:
           IOI IOI-1394TT (PCI card), Unibrain Fireboard 400 PCI Lynx-2
           (PCI card), Newer Technology FireWire 2 Go (CardBus card),
-          Apple Power Mac G3 blue & white (onboard controller).
+          Apple Power Mac G3 blue & white and G4 with PCI graphics
+          (onboard controller).
 
           To compile this driver as a module, say M here:  The module will be
           called nosy.  Source code of a userspace interface to nosy, called
diff --git a/drivers/firewire/Makefile b/drivers/firewire/Makefile
index 3c6a7fb20aa7..e3870d5c43dd 100644
--- a/drivers/firewire/Makefile
+++ b/drivers/firewire/Makefile
@@ -13,3 +13,4 @@ obj-$(CONFIG_FIREWIRE_OHCI) += firewire-ohci.o
 obj-$(CONFIG_FIREWIRE_SBP2) += firewire-sbp2.o
 obj-$(CONFIG_FIREWIRE_NET)  += firewire-net.o
 obj-$(CONFIG_FIREWIRE_NOSY) += nosy.o
+obj-$(CONFIG_PROVIDE_OHCI1394_DMA_INIT) += init_ohci1394_dma.o
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index be0492398ef9..29d2423fae6d 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -75,6 +75,15 @@ static size_t config_rom_length = 1 + 4 + 1 + 1;
 #define BIB_IRMC                ((1) << 31)
 #define NODE_CAPABILITIES       0x0c0083c0 /* per IEEE 1394 clause 8.3.2.6.5.2 */
 
+/*
+ * IEEE-1394 specifies a default SPLIT_TIMEOUT value of 800 cycles (100 ms),
+ * but we have to make it longer because there are many devices whose firmware
+ * is just too slow for that.
+ */
+#define DEFAULT_SPLIT_TIMEOUT   (2 * 8000)
+
+#define CANON_OUI               0x000085
+
 static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 {
         struct fw_descriptor *desc;
@@ -219,8 +228,8 @@ void fw_schedule_bus_reset(struct fw_card *card, bool delayed, bool short_reset)
 
         /* Use an arbitrary short delay to combine multiple reset requests. */
         fw_card_get(card);
-        if (!schedule_delayed_work(&card->br_work,
-                                   delayed ? DIV_ROUND_UP(HZ, 100) : 0))
+        if (!queue_delayed_work(fw_workqueue, &card->br_work,
+                                delayed ? DIV_ROUND_UP(HZ, 100) : 0))
                 fw_card_put(card);
 }
 EXPORT_SYMBOL(fw_schedule_bus_reset);
@@ -231,8 +240,8 @@ static void br_work(struct work_struct *work)
 
         /* Delay for 2s after last reset per IEEE 1394 clause 8.2.1. */
         if (card->reset_jiffies != 0 &&
-            time_is_after_jiffies(card->reset_jiffies + 2 * HZ)) {
-                if (!schedule_delayed_work(&card->br_work, 2 * HZ))
+            time_before64(get_jiffies_64(), card->reset_jiffies + 2 * HZ)) {
+                if (!queue_delayed_work(fw_workqueue, &card->br_work, 2 * HZ))
                         fw_card_put(card);
                 return;
         }
@@ -249,8 +258,7 @@ static void allocate_broadcast_channel(struct fw_card *card, int generation)
 
         if (!card->broadcast_channel_allocated) {
                 fw_iso_resource_manage(card, generation, 1ULL << 31,
-                                       &channel, &bandwidth, true,
-                                       card->bm_transaction_data);
+                                       &channel, &bandwidth, true);
                 if (channel != 31) {
                         fw_notify("failed to allocate broadcast channel\n");
                         return;
@@ -284,6 +292,8 @@ static void bm_work(struct work_struct *work)
         bool root_device_is_running;
         bool root_device_is_cmc;
         bool irm_is_1394_1995_only;
+        bool keep_this_irm;
+        __be32 transaction_data[2];
 
         spin_lock_irq(&card->lock);
 
@@ -305,11 +315,16 @@ static void bm_work(struct work_struct *work)
         irm_is_1394_1995_only = irm_device && irm_device->config_rom &&
                         (irm_device->config_rom[2] & 0x000000f0) == 0;
 
+        /* Canon MV5i works unreliably if it is not root node. */
+        keep_this_irm = irm_device && irm_device->config_rom &&
+                        irm_device->config_rom[3] >> 8 == CANON_OUI;
+
         root_id  = root_node->node_id;
         irm_id   = card->irm_node->node_id;
         local_id = card->local_node->node_id;
 
-        grace = time_after(jiffies, card->reset_jiffies + DIV_ROUND_UP(HZ, 8));
+        grace = time_after64(get_jiffies_64(),
+                             card->reset_jiffies + DIV_ROUND_UP(HZ, 8));
 
         if ((is_next_generation(generation, card->bm_generation) &&
              !card->bm_abdicate) ||
@@ -333,28 +348,28 @@ static void bm_work(struct work_struct *work)
                         goto pick_me;
                 }
 
-                if (irm_is_1394_1995_only) {
+                if (irm_is_1394_1995_only && !keep_this_irm) {
                         new_root_id = local_id;
                         fw_notify("%s, making local node (%02x) root.\n",
                                   "IRM is not 1394a compliant", new_root_id);
                         goto pick_me;
                 }
 
-                card->bm_transaction_data[0] = cpu_to_be32(0x3f);
-                card->bm_transaction_data[1] = cpu_to_be32(local_id);
+                transaction_data[0] = cpu_to_be32(0x3f);
+                transaction_data[1] = cpu_to_be32(local_id);
 
                 spin_unlock_irq(&card->lock);
 
                 rcode = fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
                                 irm_id, generation, SCODE_100,
                                 CSR_REGISTER_BASE + CSR_BUS_MANAGER_ID,
-                                card->bm_transaction_data, 8);
+                                transaction_data, 8);
 
                 if (rcode == RCODE_GENERATION)
                         /* Another bus reset, BM work has been rescheduled. */
                         goto out;
 
-                bm_id = be32_to_cpu(card->bm_transaction_data[0]);
+                bm_id = be32_to_cpu(transaction_data[0]);
 
                 spin_lock_irq(&card->lock);
                 if (rcode == RCODE_COMPLETE && generation == card->generation)
@@ -382,7 +397,7 @@ static void bm_work(struct work_struct *work)
 
                 spin_lock_irq(&card->lock);
 
-                if (rcode != RCODE_COMPLETE) {
+                if (rcode != RCODE_COMPLETE && !keep_this_irm) {
                         /*
                          * The lock request failed, maybe the IRM
                          * isn't really IRM capable after all. Let's
@@ -475,11 +490,11 @@ static void bm_work(struct work_struct *work)
                 /*
                  * Make sure that the cycle master sends cycle start packets.
                  */
-                card->bm_transaction_data[0] = cpu_to_be32(CSR_STATE_BIT_CMSTR);
+                transaction_data[0] = cpu_to_be32(CSR_STATE_BIT_CMSTR);
                 rcode = fw_run_transaction(card, TCODE_WRITE_QUADLET_REQUEST,
                                 root_id, generation, SCODE_100,
                                 CSR_REGISTER_BASE + CSR_STATE_SET,
-                                card->bm_transaction_data, 4);
+                                transaction_data, 4);
                 if (rcode == RCODE_GENERATION)
                         goto out;
         }
@@ -504,10 +519,11 @@ void fw_card_initialize(struct fw_card *card,
         card->device = device;
         card->current_tlabel = 0;
         card->tlabel_mask = 0;
-        card->split_timeout_hi = 0;
-        card->split_timeout_lo = 800 << 19;
-        card->split_timeout_cycles = 800;
-        card->split_timeout_jiffies = DIV_ROUND_UP(HZ, 10);
+        card->split_timeout_hi = DEFAULT_SPLIT_TIMEOUT / 8000;
+        card->split_timeout_lo = (DEFAULT_SPLIT_TIMEOUT % 8000) << 19;
+        card->split_timeout_cycles = DEFAULT_SPLIT_TIMEOUT;
+        card->split_timeout_jiffies =
+                        DIV_ROUND_UP(DEFAULT_SPLIT_TIMEOUT * HZ, 8000);
         card->color = 0;
         card->broadcast_channel = BROADCAST_CHANNEL_INITIAL;
 
@@ -614,6 +630,10 @@ static int dummy_queue_iso(struct fw_iso_context *ctx, struct fw_iso_packet *p,
         return -ENODEV;
 }
 
+static void dummy_flush_queue_iso(struct fw_iso_context *ctx)
+{
+}
+
 static const struct fw_card_driver dummy_driver_template = {
         .read_phy_reg           = dummy_read_phy_reg,
         .update_phy_reg         = dummy_update_phy_reg,
@@ -625,6 +645,7 @@ static const struct fw_card_driver dummy_driver_template = {
         .start_iso              = dummy_start_iso,
         .set_iso_channels       = dummy_set_iso_channels,
         .queue_iso              = dummy_queue_iso,
+        .flush_queue_iso        = dummy_flush_queue_iso,
 };
 
 void fw_card_release(struct kref *kref)
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 14bb7b7b5dd7..b1c11775839c 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -64,6 +64,7 @@ struct client {
         struct idr resource_idr;
         struct list_head event_list;
         wait_queue_head_t wait;
+        wait_queue_head_t tx_flush_wait;
         u64 bus_reset_closure;
 
         struct fw_iso_context *iso_context;
@@ -140,7 +141,6 @@ struct iso_resource {
         int generation;
         u64 channels;
         s32 bandwidth;
-        __be32 transaction_data[2];
         struct iso_resource_event *e_alloc, *e_dealloc;
 };
 
@@ -149,7 +149,7 @@ static void release_iso_resource(struct client *, struct client_resource *);
 static void schedule_iso_resource(struct iso_resource *r, unsigned long delay)
 {
         client_get(r->client);
-        if (!schedule_delayed_work(&r->work, delay))
+        if (!queue_delayed_work(fw_workqueue, &r->work, delay))
                 client_put(r->client);
 }
 
@@ -251,6 +251,7 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
         idr_init(&client->resource_idr);
         INIT_LIST_HEAD(&client->event_list);
         init_waitqueue_head(&client->wait);
+        init_waitqueue_head(&client->tx_flush_wait);
         INIT_LIST_HEAD(&client->phy_receiver_link);
         kref_init(&client->kref);
 
@@ -520,10 +521,6 @@ static int release_client_resource(struct client *client, u32 handle,
 static void release_transaction(struct client *client,
                                 struct client_resource *resource)
 {
-        struct outbound_transaction_resource *r = container_of(resource,
-                        struct outbound_transaction_resource, resource);
-
-        fw_cancel_transaction(client->device->card, &r->transaction);
 }
 
 static void complete_transaction(struct fw_card *card, int rcode,
@@ -540,22 +537,9 @@ static void complete_transaction(struct fw_card *card, int rcode,
                 memcpy(rsp->data, payload, rsp->length);
 
         spin_lock_irqsave(&client->lock, flags);
-        /*
-         * 1. If called while in shutdown, the idr tree must be left untouched.
-         *    The idr handle will be removed and the client reference will be
-         *    dropped later.
-         * 2. If the call chain was release_client_resource ->
-         *    release_transaction -> complete_transaction (instead of a normal
-         *    conclusion of the transaction), i.e. if this resource was already
-         *    unregistered from the idr, the client reference will be dropped
-         *    by release_client_resource and we must not drop it here.
-         */
-        if (!client->in_shutdown &&
-            idr_find(&client->resource_idr, e->r.resource.handle)) {
-                idr_remove(&client->resource_idr, e->r.resource.handle);
-                /* Drop the idr's reference */
-                client_put(client);
-        }
+        idr_remove(&client->resource_idr, e->r.resource.handle);
+        if (client->in_shutdown)
+                wake_up(&client->tx_flush_wait);
         spin_unlock_irqrestore(&client->lock, flags);
 
         rsp->type = FW_CDEV_EVENT_RESPONSE;
@@ -575,7 +559,7 @@ static void complete_transaction(struct fw_card *card, int rcode,
                 queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length,
                             NULL, 0);
 
-        /* Drop the transaction callback's reference */
+        /* Drop the idr's reference */
         client_put(client);
 }
 
@@ -614,9 +598,6 @@ static int init_request(struct client *client,
         if (ret < 0)
                 goto failed;
 
-        /* Get a reference for the transaction callback */
-        client_get(client);
-
         fw_send_request(client->device->card, &e->r.transaction,
                         request->tcode, destination_id, request->generation,
                         speed, request->offset, e->response.data,
@@ -1126,6 +1107,7 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
                 payload += u.packet.payload_length;
                 count++;
         }
+        fw_iso_context_queue_flush(ctx);
 
         a->size    -= uptr_to_u64(p) - a->packets;
         a->packets  = uptr_to_u64(p);
@@ -1223,7 +1205,8 @@ static void iso_resource_work(struct work_struct *work)
         todo = r->todo;
         /* Allow 1000ms grace period for other reallocations. */
         if (todo == ISO_RES_ALLOC &&
-            time_is_after_jiffies(client->device->card->reset_jiffies + HZ)) {
+            time_before64(get_jiffies_64(),
+                          client->device->card->reset_jiffies + HZ)) {
                 schedule_iso_resource(r, DIV_ROUND_UP(HZ, 3));
                 skip = true;
         } else {
@@ -1246,8 +1229,7 @@ static void iso_resource_work(struct work_struct *work)
                         r->channels, &channel, &bandwidth,
                         todo == ISO_RES_ALLOC ||
                         todo == ISO_RES_REALLOC ||
-                        todo == ISO_RES_ALLOC_ONCE,
-                        r->transaction_data);
+                        todo == ISO_RES_ALLOC_ONCE);
         /*
          * Is this generation outdated already?  As long as this resource sticks
          * in the idr, it will be scheduled again for a newer generation or at
@@ -1501,9 +1483,10 @@ static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
         e->client               = client;
         e->p.speed              = SCODE_100;
         e->p.generation         = a->generation;
-        e->p.header[0]          = a->data[0];
-        e->p.header[1]          = a->data[1];
-        e->p.header_length      = 8;
+        e->p.header[0]          = TCODE_LINK_INTERNAL << 4;
+        e->p.header[1]          = a->data[0];
+        e->p.header[2]          = a->data[1];
+        e->p.header_length      = 12;
         e->p.callback           = outbound_phy_packet_callback;
         e->phy_packet.closure   = a->closure;
         e->phy_packet.type      = FW_CDEV_EVENT_PHY_PACKET_SENT;
@@ -1677,6 +1660,25 @@ static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
         return ret;
 }
 
+static int is_outbound_transaction_resource(int id, void *p, void *data)
+{
+        struct client_resource *resource = p;
+
+        return resource->release == release_transaction;
+}
+
+static int has_outbound_transactions(struct client *client)
+{
+        int ret;
+
+        spin_lock_irq(&client->lock);
+        ret = idr_for_each(&client->resource_idr,
+                           is_outbound_transaction_resource, NULL);
+        spin_unlock_irq(&client->lock);
+
+        return ret;
+}
+
 static int shutdown_resource(int id, void *p, void *data)
 {
         struct client_resource *resource = p;
@@ -1712,6 +1714,8 @@ static int fw_device_op_release(struct inode *inode, struct file *file)
         client->in_shutdown = true;
         spin_unlock_irq(&client->lock);
 
+        wait_event(client->tx_flush_wait, !has_outbound_transactions(client));
+
         idr_for_each(&client->resource_idr, shutdown_resource, client);
         idr_remove_all(&client->resource_idr);
         idr_destroy(&client->resource_idr);
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 6113b896e790..95a471401892 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -725,6 +725,15 @@ struct fw_device *fw_device_get_by_devt(dev_t devt)
         return device;
 }
 
+struct workqueue_struct *fw_workqueue;
+EXPORT_SYMBOL(fw_workqueue);
+
+static void fw_schedule_device_work(struct fw_device *device,
+                                    unsigned long delay)
+{
+        queue_delayed_work(fw_workqueue, &device->work, delay);
+}
+
 /*
  * These defines control the retry behavior for reading the config
  * rom.  It shouldn't be necessary to tweak these; if the device
@@ -747,9 +756,10 @@ static void fw_device_shutdown(struct work_struct *work)
                 container_of(work, struct fw_device, work.work);
         int minor = MINOR(device->device.devt);
 
-        if (time_is_after_jiffies(device->card->reset_jiffies + SHUTDOWN_DELAY)
+        if (time_before64(get_jiffies_64(),
+                          device->card->reset_jiffies + SHUTDOWN_DELAY)
             && !list_empty(&device->card->link)) {
-                schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
+                fw_schedule_device_work(device, SHUTDOWN_DELAY);
                 return;
         }
 
@@ -861,7 +871,7 @@ static int lookup_existing_device(struct device *dev, void *data)
                 fw_notify("rediscovered device %s\n", dev_name(dev));
 
                 PREPARE_DELAYED_WORK(&old->work, fw_device_update);
-                schedule_delayed_work(&old->work, 0);
+                fw_schedule_device_work(old, 0);
 
                 if (current_node == card->root_node)
                         fw_schedule_bm_work(card, 0);
@@ -952,10 +962,11 @@ static void fw_device_init(struct work_struct *work)
                 if (device->config_rom_retries < MAX_RETRIES &&
                     atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
                         device->config_rom_retries++;
-                        schedule_delayed_work(&device->work, RETRY_DELAY);
+                        fw_schedule_device_work(device, RETRY_DELAY);
                 } else {
-                        fw_notify("giving up on config rom for node id %x\n",
-                                  device->node_id);
+                        if (device->node->link_on)
+                                fw_notify("giving up on config rom for node id %x\n",
+                                          device->node_id);
                         if (device->node == device->card->root_node)
                                 fw_schedule_bm_work(device->card, 0);
                         fw_device_release(&device->device);
@@ -1017,7 +1028,7 @@ static void fw_device_init(struct work_struct *work)
                            FW_DEVICE_INITIALIZING,
                            FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
                 PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
-                schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
+                fw_schedule_device_work(device, SHUTDOWN_DELAY);
         } else {
                 if (device->config_rom_retries)
                         fw_notify("created device %s: GUID %08x%08x, S%d00, "
@@ -1096,7 +1107,7 @@ static void fw_device_refresh(struct work_struct *work)
                 if (device->config_rom_retries < MAX_RETRIES / 2 &&
                     atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
                         device->config_rom_retries++;
-                        schedule_delayed_work(&device->work, RETRY_DELAY / 2);
+                        fw_schedule_device_work(device, RETRY_DELAY / 2);
 
                         return;
                 }
@@ -1129,7 +1140,7 @@ static void fw_device_refresh(struct work_struct *work)
                 if (device->config_rom_retries < MAX_RETRIES &&
                     atomic_read(&device->state) == FW_DEVICE_INITIALIZING) {
                         device->config_rom_retries++;
-                        schedule_delayed_work(&device->work, RETRY_DELAY);
+                        fw_schedule_device_work(device, RETRY_DELAY);
 
                         return;
                 }
@@ -1156,7 +1167,7 @@ static void fw_device_refresh(struct work_struct *work)
  gone:
         atomic_set(&device->state, FW_DEVICE_GONE);
         PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
-        schedule_delayed_work(&device->work, SHUTDOWN_DELAY);
+        fw_schedule_device_work(device, SHUTDOWN_DELAY);
  out:
         if (node_id == card->root_node->node_id)
                 fw_schedule_bm_work(card, 0);
@@ -1168,9 +1179,12 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 
         switch (event) {
         case FW_NODE_CREATED:
-        case FW_NODE_LINK_ON:
-                if (!node->link_on)
-                        break;
+                /*
+                 * Attempt to scan the node, regardless whether its self ID has
+                 * the L (link active) flag set or not.  Some broken devices
+                 * send L=0 but have an up-and-running link; others send L=1
+                 * without actually having a link.
+                 */
  create:
                 device = kzalloc(sizeof(*device), GFP_ATOMIC);
                 if (device == NULL)
@@ -1209,10 +1223,11 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                  * first config rom scan half a second after bus reset.
                  */
                 INIT_DELAYED_WORK(&device->work, fw_device_init);
-                schedule_delayed_work(&device->work, INITIAL_DELAY);
+                fw_schedule_device_work(device, INITIAL_DELAY);
                 break;
 
         case FW_NODE_INITIATED_RESET:
+        case FW_NODE_LINK_ON:
                 device = node->data;
                 if (device == NULL)
                         goto create;
@@ -1224,22 +1239,22 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                             FW_DEVICE_RUNNING,
                             FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
                         PREPARE_DELAYED_WORK(&device->work, fw_device_refresh);
-                        schedule_delayed_work(&device->work,
+                        fw_schedule_device_work(device,
                                 device->is_local ? 0 : INITIAL_DELAY);
                 }
                 break;
 
         case FW_NODE_UPDATED:
-                if (!node->link_on || node->data == NULL)
+                device = node->data;
+                if (device == NULL)
                         break;
 
-                device = node->data;
                 device->node_id = node->node_id;
                 smp_wmb();  /* update node_id before generation */
                 device->generation = card->generation;
                 if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
                         PREPARE_DELAYED_WORK(&device->work, fw_device_update);
-                        schedule_delayed_work(&device->work, 0);
+                        fw_schedule_device_work(device, 0);
                 }
                 break;
 
@@ -1264,7 +1279,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 if (atomic_xchg(&device->state,
                                 FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
                         PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
-                        schedule_delayed_work(&device->work,
+                        fw_schedule_device_work(device,
                                 list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
                 }
                 break;
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index c003fa4e2db1..57c3973093ad 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -185,6 +185,12 @@ int fw_iso_context_queue(struct fw_iso_context *ctx,
 }
 EXPORT_SYMBOL(fw_iso_context_queue);
 
+void fw_iso_context_queue_flush(struct fw_iso_context *ctx)
+{
+        ctx->card->driver->flush_queue_iso(ctx);
+}
+EXPORT_SYMBOL(fw_iso_context_queue_flush);
+
 int fw_iso_context_stop(struct fw_iso_context *ctx)
 {
         return ctx->card->driver->stop_iso(ctx);
@@ -196,9 +202,10 @@ EXPORT_SYMBOL(fw_iso_context_stop);
  */
 
 static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
-                            int bandwidth, bool allocate, __be32 data[2])
+                            int bandwidth, bool allocate)
 {
         int try, new, old = allocate ? BANDWIDTH_AVAILABLE_INITIAL : 0;
+        __be32 data[2];
 
         /*
          * On a 1394a IRM with low contention, try < 1 is enough.
@@ -233,47 +240,48 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
 }
 
 static int manage_channel(struct fw_card *card, int irm_id, int generation,
-                u32 channels_mask, u64 offset, bool allocate, __be32 data[2])
+                u32 channels_mask, u64 offset, bool allocate)
 {
-        __be32 c, all, old;
-        int i, ret = -EIO, retry = 5;
+        __be32 bit, all, old;
+        __be32 data[2];
+        int channel, ret = -EIO, retry = 5;
 
         old = all = allocate ? cpu_to_be32(~0) : 0;
 
-        for (i = 0; i < 32; i++) {
-                if (!(channels_mask & 1 << i))
+        for (channel = 0; channel < 32; channel++) {
+                if (!(channels_mask & 1 << channel))
                         continue;
 
                 ret = -EBUSY;
 
-                c = cpu_to_be32(1 << (31 - i));
-                if ((old & c) != (all & c))
+                bit = cpu_to_be32(1 << (31 - channel));
+                if ((old & bit) != (all & bit))
                         continue;
 
                 data[0] = old;
-                data[1] = old ^ c;
+                data[1] = old ^ bit;
                 switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
                                            irm_id, generation, SCODE_100,
                                            offset, data, 8)) {
                 case RCODE_GENERATION:
                         /* A generation change frees all channels. */
-                        return allocate ? -EAGAIN : i;
+                        return allocate ? -EAGAIN : channel;
 
                 case RCODE_COMPLETE:
                         if (data[0] == old)
-                                return i;
+                                return channel;
 
                         old = data[0];
 
                         /* Is the IRM 1394a-2000 compliant? */
-                        if ((data[0] & c) == (data[1] & c))
+                        if ((data[0] & bit) == (data[1] & bit))
                                 continue;
 
                         /* 1394-1995 IRM, fall through to retry. */
                 default:
                         if (retry) {
                                 retry--;
-                                i--;
+                                channel--;
                         } else {
                                 ret = -EIO;
                         }
@@ -284,7 +292,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
 }
 
 static void deallocate_channel(struct fw_card *card, int irm_id,
-                               int generation, int channel, __be32 buffer[2])
+                               int generation, int channel)
 {
         u32 mask;
         u64 offset;
@@ -293,7 +301,7 @@ static void deallocate_channel(struct fw_card *card, int irm_id,
         offset = channel < 32 ? CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_HI :
                                 CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_LO;
 
-        manage_channel(card, irm_id, generation, mask, offset, false, buffer);
+        manage_channel(card, irm_id, generation, mask, offset, false);
 }
 
 /**
@@ -322,7 +330,7 @@ static void deallocate_channel(struct fw_card *card, int irm_id,
  */
 void fw_iso_resource_manage(struct fw_card *card, int generation,
                             u64 channels_mask, int *channel, int *bandwidth,
-                            bool allocate, __be32 buffer[2])
+                            bool allocate)
 {
         u32 channels_hi = channels_mask;        /* channels 31...0 */
         u32 channels_lo = channels_mask >> 32;  /* channels 63...32 */
@@ -335,11 +343,11 @@ void fw_iso_resource_manage(struct fw_card *card, int generation,
         if (channels_hi)
                 c = manage_channel(card, irm_id, generation, channels_hi,
                                 CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_HI,
-                                allocate, buffer);
+                                allocate);
         if (channels_lo && c < 0) {
                 c = manage_channel(card, irm_id, generation, channels_lo,
                                 CSR_REGISTER_BASE + CSR_CHANNELS_AVAILABLE_LO,
-                                allocate, buffer);
+                                allocate);
                 if (c >= 0)
                         c += 32;
         }
@@ -351,14 +359,14 @@ void fw_iso_resource_manage(struct fw_card *card, int generation,
         if (*bandwidth == 0)
                 return;
 
-        ret = manage_bandwidth(card, irm_id, generation, *bandwidth,
-                               allocate, buffer);
+        ret = manage_bandwidth(card, irm_id, generation, *bandwidth, allocate);
         if (ret < 0)
                 *bandwidth = 0;
 
         if (allocate && ret < 0) {
                 if (c >= 0)
-                        deallocate_channel(card, irm_id, generation, c, buffer);
+                        deallocate_channel(card, irm_id, generation, c);
                 *channel = ret;
         }
 }
+EXPORT_SYMBOL(fw_iso_resource_manage);
diff --git a/drivers/firewire/core-topology.c b/drivers/firewire/core-topology.c
index 09be1a635505..193ed9233144 100644
--- a/drivers/firewire/core-topology.c
+++ b/drivers/firewire/core-topology.c
@@ -545,7 +545,7 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation,
          */
         smp_wmb();
         card->generation = generation;
-        card->reset_jiffies = jiffies;
+        card->reset_jiffies = get_jiffies_64();
         card->bm_node_id  = 0xffff;
         card->bm_abdicate = bm_abdicate;
         fw_schedule_bm_work(card, 0);
diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
index b42a0bde8494..334b82a3542c 100644
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -36,6 +36,7 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/types.h>
+#include <linux/workqueue.h>
 
 #include <asm/byteorder.h>
 
@@ -72,6 +73,15 @@
 #define PHY_CONFIG_ROOT_ID(node_id)     ((((node_id) & 0x3f) << 24) | (1 << 23))
 #define PHY_IDENTIFIER(id)              ((id) << 30)
 
+/* returns 0 if the split timeout handler is already running */
+static int try_cancel_split_timeout(struct fw_transaction *t)
+{
+        if (t->is_split_transaction)
+                return del_timer(&t->split_timeout_timer);
+        else
+                return 1;
+}
+
 static int close_transaction(struct fw_transaction *transaction,
                              struct fw_card *card, int rcode)
 {
@@ -81,7 +91,7 @@ static int close_transaction(struct fw_transaction *transaction,
         spin_lock_irqsave(&card->lock, flags);
         list_for_each_entry(t, &card->transaction_list, link) {
                 if (t == transaction) {
-                        if (!del_timer(&t->split_timeout_timer)) {
+                        if (!try_cancel_split_timeout(t)) {
                                 spin_unlock_irqrestore(&card->lock, flags);
                                 goto timed_out;
                         }
@@ -141,16 +151,28 @@ static void split_transaction_timeout_callback(unsigned long data)
         card->tlabel_mask &= ~(1ULL << t->tlabel);
         spin_unlock_irqrestore(&card->lock, flags);
 
-        card->driver->cancel_packet(card, &t->packet);
-
-        /*
-         * At this point cancel_packet will never call the transaction
-         * callback, since we just took the transaction out of the list.
-         * So do it here.
-         */
         t->callback(card, RCODE_CANCELLED, NULL, 0, t->callback_data);
 }
 
+static void start_split_transaction_timeout(struct fw_transaction *t,
+                                            struct fw_card *card)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&card->lock, flags);
+
+        if (list_empty(&t->link) || WARN_ON(t->is_split_transaction)) {
+                spin_unlock_irqrestore(&card->lock, flags);
+                return;
+        }
+
+        t->is_split_transaction = true;
+        mod_timer(&t->split_timeout_timer,
+                  jiffies + card->split_timeout_jiffies);
+
+        spin_unlock_irqrestore(&card->lock, flags);
+}
+
 static void transmit_complete_callback(struct fw_packet *packet,
                                        struct fw_card *card, int status)
 {
@@ -162,7 +184,7 @@ static void transmit_complete_callback(struct fw_packet *packet,
                 close_transaction(t, card, RCODE_COMPLETE);
                 break;
         case ACK_PENDING:
-                t->timestamp = packet->timestamp;
+                start_split_transaction_timeout(t, card);
                 break;
         case ACK_BUSY_X:
         case ACK_BUSY_A:
@@ -250,7 +272,7 @@ static void fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
                 break;
 
         default:
-                WARN(1, "wrong tcode %d", tcode);
+                WARN(1, "wrong tcode %d\n", tcode);
         }
  common:
         packet->speed = speed;
@@ -305,8 +327,8 @@ static int allocate_tlabel(struct fw_card *card)
  * It will contain tag, channel, and sy data instead of a node ID then.
  *
  * The payload buffer at @data is going to be DMA-mapped except in case of
- * quadlet-sized payload or of local (loopback) requests.  Hence make sure that
- * the buffer complies with the restrictions for DMA-mapped memory.  The
+ * @length <= 8 or of local (loopback) requests.  Hence make sure that the
+ * buffer complies with the restrictions of the streaming DMA mapping API.
  * @payload must not be freed before the @callback is called.
  *
  * In case of request types without payload, @data is NULL and @length is 0.
@@ -349,11 +371,9 @@ void fw_send_request(struct fw_card *card, struct fw_transaction *t, int tcode,
         t->node_id = destination_id;
         t->tlabel = tlabel;
         t->card = card;
+        t->is_split_transaction = false;
         setup_timer(&t->split_timeout_timer,
                     split_transaction_timeout_callback, (unsigned long)t);
-        /* FIXME: start this timer later, relative to t->timestamp */
-        mod_timer(&t->split_timeout_timer,
-                  jiffies + card->split_timeout_jiffies);
         t->callback = callback;
         t->callback_data = callback_data;
 
@@ -392,7 +412,8 @@ static void transaction_callback(struct fw_card *card, int rcode,
  *
  * Returns the RCODE.  See fw_send_request() for parameter documentation.
  * Unlike fw_send_request(), @data points to the payload of the request or/and
- * to the payload of the response.
+ * to the payload of the response.  DMA mapping restrictions apply to outbound
+ * request payloads of >= 8 bytes but not to inbound response payloads.
  */
 int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
                        int generation, int speed, unsigned long long offset,
@@ -423,7 +444,8 @@ static void transmit_phy_packet_callback(struct fw_packet *packet,
 }
 
 static struct fw_packet phy_config_packet = {
-        .header_length  = 8,
+        .header_length  = 12,
+        .header[0]      = TCODE_LINK_INTERNAL << 4,
         .payload_length = 0,
         .speed          = SCODE_100,
         .callback       = transmit_phy_packet_callback,
@@ -451,8 +473,8 @@ void fw_send_phy_config(struct fw_card *card,
 
         mutex_lock(&phy_config_mutex);
 
-        phy_config_packet.header[0] = data;
-        phy_config_packet.header[1] = ~data;
+        phy_config_packet.header[1] = data;
+        phy_config_packet.header[2] = ~data;
         phy_config_packet.generation = generation;
         INIT_COMPLETION(phy_config_done);
 
@@ -638,7 +660,7 @@ int fw_get_response_length(struct fw_request *r)
                 }
 
         default:
-                WARN(1, "wrong tcode %d", tcode);
+                WARN(1, "wrong tcode %d\n", tcode);
                 return 0;
         }
 }
@@ -694,7 +716,7 @@ void fw_fill_response(struct fw_packet *response, u32 *request_header,
                 break;
 
         default:
-                WARN(1, "wrong tcode %d", tcode);
+                WARN(1, "wrong tcode %d\n", tcode);
         }
 
         response->payload_mapped = false;
@@ -925,7 +947,7 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
         spin_lock_irqsave(&card->lock, flags);
         list_for_each_entry(t, &card->transaction_list, link) {
                 if (t->node_id == source && t->tlabel == tlabel) {
-                        if (!del_timer(&t->split_timeout_timer)) {
+                        if (!try_cancel_split_timeout(t)) {
                                 spin_unlock_irqrestore(&card->lock, flags);
                                 goto timed_out;
                         }
@@ -1192,13 +1214,21 @@ static int __init fw_core_init(void)
 {
         int ret;
 
+        fw_workqueue = alloc_workqueue("firewire",
+                                       WQ_NON_REENTRANT | WQ_MEM_RECLAIM, 0);
+        if (!fw_workqueue)
+                return -ENOMEM;
+
         ret = bus_register(&fw_bus_type);
-        if (ret < 0)
+        if (ret < 0) {
+                destroy_workqueue(fw_workqueue);
                 return ret;
+        }
 
         fw_cdev_major = register_chrdev(0, "firewire", &fw_device_ops);
         if (fw_cdev_major < 0) {
                 bus_unregister(&fw_bus_type);
+                destroy_workqueue(fw_workqueue);
                 return fw_cdev_major;
         }
 
@@ -1214,6 +1244,7 @@ static void __exit fw_core_cleanup(void)
 {
         unregister_chrdev(fw_cdev_major, "firewire");
         bus_unregister(&fw_bus_type);
+        destroy_workqueue(fw_workqueue);
         idr_destroy(&fw_device_idr);
 }
 
diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
index e6239f971be6..0fe4e4e6eda7 100644
--- a/drivers/firewire/core.h
+++ b/drivers/firewire/core.h
@@ -97,6 +97,8 @@ struct fw_card_driver {
                          struct fw_iso_buffer *buffer,
                          unsigned long payload);
 
+        void (*flush_queue_iso)(struct fw_iso_context *ctx);
+
         int (*stop_iso)(struct fw_iso_context *ctx);
 };
 
@@ -147,9 +149,6 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event);
 /* -iso */
 
 int fw_iso_buffer_map(struct fw_iso_buffer *buffer, struct vm_area_struct *vma);
-void fw_iso_resource_manage(struct fw_card *card, int generation,
-                            u64 channels_mask, int *channel, int *bandwidth,
-                            bool allocate, __be32 buffer[2]);
 
 
 /* -topology */
@@ -215,9 +214,11 @@ static inline bool is_next_generation(int new_generation, int old_generation)
 
 /* -transaction */
 
+#define TCODE_LINK_INTERNAL             0xe
+
 #define TCODE_IS_READ_REQUEST(tcode)    (((tcode) & ~1) == 4)
 #define TCODE_IS_BLOCK_PACKET(tcode)    (((tcode) &  1) != 0)
-#define TCODE_IS_LINK_INTERNAL(tcode)   ((tcode) == 0xe)
+#define TCODE_IS_LINK_INTERNAL(tcode)   ((tcode) == TCODE_LINK_INTERNAL)
 #define TCODE_IS_REQUEST(tcode)         (((tcode) &  2) == 0)
 #define TCODE_IS_RESPONSE(tcode)        (((tcode) &  2) != 0)
 #define TCODE_HAS_REQUEST_DATA(tcode)   (((tcode) & 12) != 4)
diff --git a/drivers/firewire/init_ohci1394_dma.c b/drivers/firewire/init_ohci1394_dma.c
new file mode 100644
index 000000000000..a9a347adb353
--- /dev/null
+++ b/drivers/firewire/init_ohci1394_dma.c
@@ -0,0 +1,309 @@
+/*
+ * init_ohci1394_dma.c - Initializes physical DMA on all OHCI 1394 controllers
+ *
+ * Copyright (C) 2006-2007      Bernhard Kaindl <bk@suse.de>
+ *
+ * Derived from drivers/ieee1394/ohci1394.c and arch/x86/kernel/early-quirks.c
+ * this file has functions to:
+ * - scan the PCI very early on boot for all OHCI 1394-compliant controllers
+ * - reset and initialize them and make them join the IEEE1394 bus and
+ * - enable physical DMA on them to allow remote debugging
+ *
+ * All code and data is marked as __init and __initdata, respective as
+ * during boot, all OHCI1394 controllers may be claimed by the firewire
+ * stack and at this point, this code should not touch them anymore.
+ *
+ * To use physical DMA after the initialization of the firewire stack,
+ * be sure that the stack enables it and (re-)attach after the bus reset
+ * which may be caused by the firewire stack initialization.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/pci.h>          /* for PCI defines */
+#include <linux/string.h>
+
+#include <asm/pci-direct.h>     /* for direct PCI config space access */
+#include <asm/fixmap.h>
+
+#include <linux/init_ohci1394_dma.h>
+#include "ohci.h"
+
+int __initdata init_ohci1394_dma_early;
+
+struct ohci {
+        void __iomem *registers;
+};
+
+static inline void reg_write(const struct ohci *ohci, int offset, u32 data)
+{
+        writel(data, ohci->registers + offset);
+}
+
+static inline u32 reg_read(const struct ohci *ohci, int offset)
+{
+        return readl(ohci->registers + offset);
+}
+
+#define OHCI_LOOP_COUNT         100     /* Number of loops for reg read waits */
+
+/* Reads a PHY register of an OHCI-1394 controller */
+static inline u8 __init get_phy_reg(struct ohci *ohci, u8 addr)
+{
+        int i;
+        u32 r;
+
+        reg_write(ohci, OHCI1394_PhyControl, (addr << 8) | 0x00008000);
+
+        for (i = 0; i < OHCI_LOOP_COUNT; i++) {
+                if (reg_read(ohci, OHCI1394_PhyControl) & 0x80000000)
+                        break;
+                mdelay(1);
+        }
+        r = reg_read(ohci, OHCI1394_PhyControl);
+
+        return (r & 0x00ff0000) >> 16;
+}
+
+/* Writes to a PHY register of an OHCI-1394 controller */
+static inline void __init set_phy_reg(struct ohci *ohci, u8 addr, u8 data)
+{
+        int i;
+
+        reg_write(ohci, OHCI1394_PhyControl, (addr << 8) | data | 0x00004000);
+
+        for (i = 0; i < OHCI_LOOP_COUNT; i++) {
+                if (!(reg_read(ohci, OHCI1394_PhyControl) & 0x00004000))
+                        break;
+                mdelay(1);
+        }
+}
+
+/* Resets an OHCI-1394 controller (for sane state before initialization) */
+static inline void __init init_ohci1394_soft_reset(struct ohci *ohci)
+{
+        int i;
+
+        reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_softReset);
+
+        for (i = 0; i < OHCI_LOOP_COUNT; i++) {
+                if (!(reg_read(ohci, OHCI1394_HCControlSet)
+                                   & OHCI1394_HCControl_softReset))
+                        break;
+                mdelay(1);
+        }
+}
+
+#define OHCI1394_MAX_AT_REQ_RETRIES     0xf
+#define OHCI1394_MAX_AT_RESP_RETRIES    0x2
+#define OHCI1394_MAX_PHYS_RESP_RETRIES  0x8
+
+/* Basic OHCI-1394 register and port inititalization */
+static inline void __init init_ohci1394_initialize(struct ohci *ohci)
+{
+        u32 bus_options;
+        int num_ports, i;
+
+        /* Put some defaults to these undefined bus options */
+        bus_options = reg_read(ohci, OHCI1394_BusOptions);
+        bus_options |=  0x60000000; /* Enable CMC and ISC */
+        bus_options &= ~0x00ff0000; /* XXX: Set cyc_clk_acc to zero for now */
+        bus_options &= ~0x18000000; /* Disable PMC and BMC */
+        reg_write(ohci, OHCI1394_BusOptions, bus_options);
+
+        /* Set the bus number */
+        reg_write(ohci, OHCI1394_NodeID, 0x0000ffc0);
+
+        /* Enable posted writes */
+        reg_write(ohci, OHCI1394_HCControlSet,
+                        OHCI1394_HCControl_postedWriteEnable);
+
+        /* Clear link control register */
+        reg_write(ohci, OHCI1394_LinkControlClear, 0xffffffff);
+
+        /* enable phys */
+        reg_write(ohci, OHCI1394_LinkControlSet,
+                        OHCI1394_LinkControl_rcvPhyPkt);
+
+        /* Don't accept phy packets into AR request context */
+        reg_write(ohci, OHCI1394_LinkControlClear, 0x00000400);
+
+        /* Clear the Isochonouys interrupt masks */
+        reg_write(ohci, OHCI1394_IsoRecvIntMaskClear, 0xffffffff);
+        reg_write(ohci, OHCI1394_IsoRecvIntEventClear, 0xffffffff);
+        reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, 0xffffffff);
+        reg_write(ohci, OHCI1394_IsoXmitIntEventClear, 0xffffffff);
+
+        /* Accept asyncronous transfer requests from all nodes for now */
+        reg_write(ohci, OHCI1394_AsReqFilterHiSet, 0x80000000);
+
+        /* Specify asyncronous transfer retries */
+        reg_write(ohci, OHCI1394_ATRetries,
+                  OHCI1394_MAX_AT_REQ_RETRIES |
+                  (OHCI1394_MAX_AT_RESP_RETRIES<<4) |
+                  (OHCI1394_MAX_PHYS_RESP_RETRIES<<8));
+
+        /* We don't want hardware swapping */
+        reg_write(ohci, OHCI1394_HCControlClear,
+                  OHCI1394_HCControl_noByteSwapData);
+
+        /* Enable link */
+        reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_linkEnable);
+
+        /* If anything is connected to a port, make sure it is enabled */
+        num_ports = get_phy_reg(ohci, 2) & 0xf;
+        for (i = 0; i < num_ports; i++) {
+                unsigned int status;
+
+                set_phy_reg(ohci, 7, i);
+                status = get_phy_reg(ohci, 8);
+
+                if (status & 0x20)
+                        set_phy_reg(ohci, 8, status & ~1);
+        }
+}
+
+/**
+ * init_ohci1394_wait_for_busresets - wait until bus resets are completed
+ *
+ * OHCI1394 initialization itself and any device going on- or offline
+ * and any cable issue cause a IEEE1394 bus reset. The OHCI1394 spec
+ * specifies that physical DMA is disabled on each bus reset and it
+ * has to be enabled after each bus reset when needed. We resort
+ * to polling here because on early boot, we have no interrupts.
+ */
+static inline void __init init_ohci1394_wait_for_busresets(struct ohci *ohci)
+{
+        int i, events;
+
+        for (i = 0; i < 9; i++) {
+                mdelay(200);
+                events = reg_read(ohci, OHCI1394_IntEventSet);
+                if (events & OHCI1394_busReset)
+                        reg_write(ohci, OHCI1394_IntEventClear,
+                                        OHCI1394_busReset);
+        }
+}
+
+/**
+ * init_ohci1394_enable_physical_dma - Enable physical DMA for remote debugging
+ * This enables remote DMA access over IEEE1394 from every host for the low
+ * 4GB of address space. DMA accesses above 4GB are not available currently.
+ */
+static inline void __init init_ohci1394_enable_physical_dma(struct ohci *ohci)
+{
+        reg_write(ohci, OHCI1394_PhyReqFilterHiSet, 0xffffffff);
+        reg_write(ohci, OHCI1394_PhyReqFilterLoSet, 0xffffffff);
+        reg_write(ohci, OHCI1394_PhyUpperBound, 0xffff0000);
+}
+
+/**
+ * init_ohci1394_reset_and_init_dma - init controller and enable DMA
+ * This initializes the given controller and enables physical DMA engine in it.
+ */
+static inline void __init init_ohci1394_reset_and_init_dma(struct ohci *ohci)
+{
+        /* Start off with a soft reset, clears everything to a sane state. */
+        init_ohci1394_soft_reset(ohci);
+
+        /* Accessing some registers without LPS enabled may cause lock up */
+        reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_LPS);
+
+        /* Disable and clear interrupts */
+        reg_write(ohci, OHCI1394_IntEventClear, 0xffffffff);
+        reg_write(ohci, OHCI1394_IntMaskClear, 0xffffffff);
+
+        mdelay(50); /* Wait 50msec to make sure we have full link enabled */
+
+        init_ohci1394_initialize(ohci);
+        /*
+         * The initialization causes at least one IEEE1394 bus reset. Enabling
+         * physical DMA only works *after* *all* bus resets have calmed down:
+         */
+        init_ohci1394_wait_for_busresets(ohci);
+
+        /* We had to wait and do this now if we want to debug early problems */
+        init_ohci1394_enable_physical_dma(ohci);
+}
+
+/**
+ * init_ohci1394_controller - Map the registers of the controller and init DMA
+ * This maps the registers of the specified controller and initializes it
+ */
+static inline void __init init_ohci1394_controller(int num, int slot, int func)
+{
+        unsigned long ohci_base;
+        struct ohci ohci;
+
+        printk(KERN_INFO "init_ohci1394_dma: initializing OHCI-1394"
+                         " at %02x:%02x.%x\n", num, slot, func);
+
+        ohci_base = read_pci_config(num, slot, func, PCI_BASE_ADDRESS_0+(0<<2))
+                                                   & PCI_BASE_ADDRESS_MEM_MASK;
+
+        set_fixmap_nocache(FIX_OHCI1394_BASE, ohci_base);
+
+        ohci.registers = (void __iomem *)fix_to_virt(FIX_OHCI1394_BASE);
+
+        init_ohci1394_reset_and_init_dma(&ohci);
+}
+
+/**
+ * debug_init_ohci1394_dma - scan for OHCI1394 controllers and init DMA on them
+ * Scans the whole PCI space for OHCI1394 controllers and inits DMA on them
+ */
+void __init init_ohci1394_dma_on_all_controllers(void)
+{
+        int num, slot, func;
+        u32 class;
+
+        if (!early_pci_allowed())
+                return;
+
+        /* Poor man's PCI discovery, the only thing we can do at early boot */
+        for (num = 0; num < 32; num++) {
+                for (slot = 0; slot < 32; slot++) {
+                        for (func = 0; func < 8; func++) {
+                                class = read_pci_config(num, slot, func,
+                                                        PCI_CLASS_REVISION);
+                                if (class == 0xffffffff)
+                                        continue; /* No device at this func */
+
+                                if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
+                                        continue; /* Not an OHCI-1394 device */
+
+                                init_ohci1394_controller(num, slot, func);
+                                break; /* Assume one controller per device */
+                        }
+                }
+        }
+        printk(KERN_INFO "init_ohci1394_dma: finished initializing OHCI DMA\n");
+}
+
+/**
+ * setup_init_ohci1394_early - enables early OHCI1394 DMA initialization
+ */
+static int __init setup_ohci1394_dma(char *opt)
+{
+        if (!strcmp(opt, "early"))
+                init_ohci1394_dma_early = 1;
+        return 0;
+}
+
+/* passing ohci1394_dma=early on boot causes early OHCI1394 DMA initialization */
+early_param("ohci1394_dma", setup_ohci1394_dma);
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 33f8421c71cc..b9762d07198d 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/bug.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/ethtool.h>
 #include <linux/firewire.h>
@@ -27,8 +28,14 @@
 #include <asm/unaligned.h>
 #include <net/arp.h>
 
-#define FWNET_MAX_FRAGMENTS     25      /* arbitrary limit */
-#define FWNET_ISO_PAGE_COUNT    (PAGE_SIZE < 16 * 1024 ? 4 : 2)
+/* rx limits */
+#define FWNET_MAX_FRAGMENTS             30 /* arbitrary, > TX queue depth */
+#define FWNET_ISO_PAGE_COUNT            (PAGE_SIZE < 16*1024 ? 4 : 2)
+
+/* tx limits */
+#define FWNET_MAX_QUEUED_DATAGRAMS      20 /* < 64 = number of tlabels */
+#define FWNET_MIN_QUEUED_DATAGRAMS      10 /* should keep AT DMA busy enough */
+#define FWNET_TX_QUEUE_LEN              FWNET_MAX_QUEUED_DATAGRAMS /* ? */
 
 #define IEEE1394_BROADCAST_CHANNEL      31
 #define IEEE1394_ALL_NODES              (0xffc0 | 0x003f)
@@ -170,16 +177,10 @@ struct fwnet_device {
         struct fw_address_handler handler;
         u64 local_fifo;
 
-        /* List of packets to be sent */
-        struct list_head packet_list;
-        /*
-         * List of packets that were broadcasted.  When we get an ISO interrupt
-         * one of them has been sent
-         */
-        struct list_head broadcasted_list;
-        /* List of packets that have been sent but not yet acked */
-        struct list_head sent_list;
+        /* Number of tx datagrams that have been queued but not yet acked */
+        int queued_datagrams;
 
+        int peer_count;
         struct list_head peer_list;
         struct fw_card *card;
         struct net_device *netdev;
@@ -190,13 +191,14 @@ struct fwnet_peer {
         struct fwnet_device *dev;
         u64 guid;
         u64 fifo;
+        __be32 ip;
 
         /* guarded by dev->lock */
         struct list_head pd_list; /* received partial datagrams */
         unsigned pdg_size;        /* pd_list size */
 
         u16 datagram_label;       /* outgoing datagram label */
-        unsigned max_payload;     /* includes RFC2374_FRAG_HDR_SIZE overhead */
+        u16 max_payload;          /* includes RFC2374_FRAG_HDR_SIZE overhead */
         int node_id;
         int generation;
         unsigned speed;
@@ -204,22 +206,18 @@ struct fwnet_peer {
 
 /* This is our task struct. It's used for the packet complete callback.  */
 struct fwnet_packet_task {
-        /*
-         * ptask can actually be on dev->packet_list, dev->broadcasted_list,
-         * or dev->sent_list depending on its current state.
-         */
-        struct list_head pt_link;
         struct fw_transaction transaction;
         struct rfc2734_header hdr;
         struct sk_buff *skb;
         struct fwnet_device *dev;
 
         int outstanding_pkts;
-        unsigned max_payload;
         u64 fifo_addr;
         u16 dest_node;
+        u16 max_payload;
         u8 generation;
         u8 speed;
+        u8 enqueued;
 };
 
 /*
@@ -455,7 +453,7 @@ static bool fwnet_pd_update(struct fwnet_peer *peer,
         memcpy(pd->pbuf + frag_off, frag_buf, frag_len);
 
         /*
-         * Move list entry to beginnig of list so that oldest partial
+         * Move list entry to beginning of list so that oldest partial
          * datagrams percolate to the end of the list
          */
         list_move_tail(&pd->pd_link, &peer->pd_list);
@@ -573,6 +571,8 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
                                 peer->speed = sspd;
                         if (peer->max_payload > max_payload)
                                 peer->max_payload = max_payload;
+
+                        peer->ip = arp1394->sip;
                 }
                 spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -651,8 +651,6 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
                 net->stats.rx_packets++;
                 net->stats.rx_bytes += skb->len;
         }
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
 
         return 0;
 
@@ -661,8 +659,6 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
         net->stats.rx_dropped++;
 
         dev_kfree_skb_any(skb);
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
 
         return -ENOENT;
 }
@@ -794,15 +790,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
          * Datagram is not complete, we're done for the
          * moment.
          */
-        spin_unlock_irqrestore(&dev->lock, flags);
-
-        return 0;
+        retval = 0;
  fail:
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
-
         return retval;
 }
 
@@ -890,7 +881,9 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        if (retval < 0)
+        if (retval >= 0)
+                fw_iso_context_queue_flush(dev->broadcast_rcv_context);
+        else
                 fw_error("requeue failed\n");
 }
 
@@ -902,11 +895,19 @@ static void fwnet_free_ptask(struct fwnet_packet_task *ptask)
         kmem_cache_free(fwnet_packet_task_cache, ptask);
 }
 
+/* Caller must hold dev->lock. */
+static void dec_queued_datagrams(struct fwnet_device *dev)
+{
+        if (--dev->queued_datagrams == FWNET_MIN_QUEUED_DATAGRAMS)
+                netif_wake_queue(dev->netdev);
+}
+
 static int fwnet_send_packet(struct fwnet_packet_task *ptask);
 
 static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
 {
         struct fwnet_device *dev = ptask->dev;
+        struct sk_buff *skb = ptask->skb;
         unsigned long flags;
         bool free;
 
@@ -915,10 +916,14 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
         ptask->outstanding_pkts--;
 
         /* Check whether we or the networking TX soft-IRQ is last user. */
-        free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+        free = (ptask->outstanding_pkts == 0 && ptask->enqueued);
+        if (free)
+                dec_queued_datagrams(dev);
 
-        if (ptask->outstanding_pkts == 0)
-                list_del(&ptask->pt_link);
+        if (ptask->outstanding_pkts == 0) {
+                dev->netdev->stats.tx_packets++;
+                dev->netdev->stats.tx_bytes += skb->len;
+        }
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -927,7 +932,6 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                 u16 fg_off;
                 u16 datagram_label;
                 u16 lf;
-                struct sk_buff *skb;
 
                 /* Update the ptask to point to the next fragment and send it */
                 lf = fwnet_get_hdr_lf(&ptask->hdr);
@@ -954,7 +958,7 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                         datagram_label = fwnet_get_hdr_dgl(&ptask->hdr);
                         break;
                 }
-                skb = ptask->skb;
+
                 skb_pull(skb, ptask->max_payload);
                 if (ptask->outstanding_pkts > 1) {
                         fwnet_make_sf_hdr(&ptask->hdr, RFC2374_HDR_INTFRAG,
@@ -971,18 +975,52 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                 fwnet_free_ptask(ptask);
 }
 
+static void fwnet_transmit_packet_failed(struct fwnet_packet_task *ptask)
+{
+        struct fwnet_device *dev = ptask->dev;
+        unsigned long flags;
+        bool free;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* One fragment failed; don't try to send remaining fragments. */
+        ptask->outstanding_pkts = 0;
+
+        /* Check whether we or the networking TX soft-IRQ is last user. */
+        free = ptask->enqueued;
+        if (free)
+                dec_queued_datagrams(dev);
+
+        dev->netdev->stats.tx_dropped++;
+        dev->netdev->stats.tx_errors++;
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        if (free)
+                fwnet_free_ptask(ptask);
+}
+
 static void fwnet_write_complete(struct fw_card *card, int rcode,
                                  void *payload, size_t length, void *data)
 {
-        struct fwnet_packet_task *ptask;
-
-        ptask = data;
+        struct fwnet_packet_task *ptask = data;
+        static unsigned long j;
+        static int last_rcode, errors_skipped;
 
-        if (rcode == RCODE_COMPLETE)
+        if (rcode == RCODE_COMPLETE) {
                 fwnet_transmit_packet_done(ptask);
-        else
-                fw_error("fwnet_write_complete: failed: %x\n", rcode);
-                /* ??? error recovery */
+        } else {
+                fwnet_transmit_packet_failed(ptask);
+
+                if (printk_timed_ratelimit(&j,  1000) || rcode != last_rcode) {
+                        fw_error("fwnet_write_complete: "
+                                "failed: %x (skipped %d)\n", rcode, errors_skipped);
+
+                        errors_skipped = 0;
+                        last_rcode = rcode;
+                } else
+                        errors_skipped++;
+        }
 }
 
 static int fwnet_send_packet(struct fwnet_packet_task *ptask)
@@ -1040,9 +1078,11 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                 spin_lock_irqsave(&dev->lock, flags);
 
                 /* If the AT tasklet already ran, we may be last user. */
-                free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+                free = (ptask->outstanding_pkts == 0 && !ptask->enqueued);
                 if (!free)
-                        list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+                        ptask->enqueued = true;
+                else
+                        dec_queued_datagrams(dev);
 
                 spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -1057,9 +1097,11 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
         spin_lock_irqsave(&dev->lock, flags);
 
         /* If the AT tasklet already ran, we may be last user. */
-        free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+        free = (ptask->outstanding_pkts == 0 && !ptask->enqueued);
         if (!free)
-                list_add_tail(&ptask->pt_link, &dev->sent_list);
+                ptask->enqueued = true;
+        else
+                dec_queued_datagrams(dev);
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -1186,6 +1228,14 @@ static int fwnet_broadcast_start(struct fwnet_device *dev)
         return retval;
 }
 
+static void set_carrier_state(struct fwnet_device *dev)
+{
+        if (dev->peer_count > 1)
+                netif_carrier_on(dev->netdev);
+        else
+                netif_carrier_off(dev->netdev);
+}
+
 /* ifup */
 static int fwnet_open(struct net_device *net)
 {
@@ -1199,6 +1249,10 @@ static int fwnet_open(struct net_device *net)
         }
         netif_start_queue(net);
 
+        spin_lock_irq(&dev->lock);
+        set_carrier_state(dev);
+        spin_unlock_irq(&dev->lock);
+
         return 0;
 }
 
@@ -1225,6 +1279,15 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
         struct fwnet_peer *peer;
         unsigned long flags;
 
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* Can this happen? */
+        if (netif_queue_stopped(dev->netdev)) {
+                spin_unlock_irqrestore(&dev->lock, flags);
+
+                return NETDEV_TX_BUSY;
+        }
+
         ptask = kmem_cache_alloc(fwnet_packet_task_cache, GFP_ATOMIC);
         if (ptask == NULL)
                 goto fail;
@@ -1243,9 +1306,6 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
         proto = hdr_buf.h_proto;
         dg_size = skb->len;
 
-        /* serialize access to peer, including peer->datagram_label */
-        spin_lock_irqsave(&dev->lock, flags);
-
         /*
          * Set the transmission type for the packet.  ARP packets and IP
          * broadcast packets are sent via GASP.
@@ -1267,7 +1327,7 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
 
                 peer = fwnet_peer_find_by_guid(dev, be64_to_cpu(guid));
                 if (!peer || peer->fifo == FWNET_NO_FIFO_ADDR)
-                        goto fail_unlock;
+                        goto fail;
 
                 generation         = peer->generation;
                 dest_node          = peer->node_id;
@@ -1321,18 +1381,21 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
                 max_payload += RFC2374_FRAG_HDR_SIZE;
         }
 
+        if (++dev->queued_datagrams == FWNET_MAX_QUEUED_DATAGRAMS)
+                netif_stop_queue(dev->netdev);
+
         spin_unlock_irqrestore(&dev->lock, flags);
 
         ptask->max_payload = max_payload;
-        INIT_LIST_HEAD(&ptask->pt_link);
+        ptask->enqueued    = 0;
 
         fwnet_send_packet(ptask);
 
         return NETDEV_TX_OK;
 
- fail_unlock:
-        spin_unlock_irqrestore(&dev->lock, flags);
  fail:
+        spin_unlock_irqrestore(&dev->lock, flags);
+
         if (ptask)
                 kmem_cache_free(fwnet_packet_task_cache, ptask);
 
@@ -1361,15 +1424,8 @@ static int fwnet_change_mtu(struct net_device *net, int new_mtu)
         return 0;
 }
 
-static void fwnet_get_drvinfo(struct net_device *net,
-                              struct ethtool_drvinfo *info)
-{
-        strcpy(info->driver, KBUILD_MODNAME);
-        strcpy(info->bus_info, "ieee1394");
-}
-
 static const struct ethtool_ops fwnet_ethtool_ops = {
-        .get_drvinfo = fwnet_get_drvinfo,
+        .get_link       = ethtool_op_get_link,
 };
 
 static const struct net_device_ops fwnet_netdev_ops = {
@@ -1389,8 +1445,8 @@ static void fwnet_init_dev(struct net_device *net)
         net->addr_len           = FWNET_ALEN;
         net->hard_header_len    = FWNET_HLEN;
         net->type               = ARPHRD_IEEE1394;
-        net->tx_queue_len       = 10;
-        SET_ETHTOOL_OPS(net, &fwnet_ethtool_ops);
+        net->tx_queue_len       = FWNET_TX_QUEUE_LEN;
+        net->ethtool_ops        = &fwnet_ethtool_ops;
 }
 
 /* caller must hold fwnet_device_mutex */
@@ -1419,6 +1475,7 @@ static int fwnet_add_peer(struct fwnet_device *dev,
         peer->dev = dev;
         peer->guid = (u64)device->config_rom[3] << 32 | device->config_rom[4];
         peer->fifo = FWNET_NO_FIFO_ADDR;
+        peer->ip = 0;
         INIT_LIST_HEAD(&peer->pd_list);
         peer->pdg_size = 0;
         peer->datagram_label = 0;
@@ -1431,6 +1488,8 @@ static int fwnet_add_peer(struct fwnet_device *dev,
 
         spin_lock_irq(&dev->lock);
         list_add_tail(&peer->peer_link, &dev->peer_list);
+        dev->peer_count++;
+        set_carrier_state(dev);
         spin_unlock_irq(&dev->lock);
 
         return 0;
@@ -1470,14 +1529,9 @@ static int fwnet_probe(struct device *_dev)
         dev->broadcast_rcv_context = NULL;
         dev->broadcast_xmt_max_payload = 0;
         dev->broadcast_xmt_datagramlabel = 0;
-
         dev->local_fifo = FWNET_NO_FIFO_ADDR;
-
-        INIT_LIST_HEAD(&dev->packet_list);
-        INIT_LIST_HEAD(&dev->broadcasted_list);
-        INIT_LIST_HEAD(&dev->sent_list);
+        dev->queued_datagrams = 0;
         INIT_LIST_HEAD(&dev->peer_list);
-
         dev->card = card;
         dev->netdev = net;
 
@@ -1516,13 +1570,15 @@ static int fwnet_probe(struct device *_dev)
         return ret;
 }
 
-static void fwnet_remove_peer(struct fwnet_peer *peer)
+static void fwnet_remove_peer(struct fwnet_peer *peer, struct fwnet_device *dev)
 {
         struct fwnet_partial_datagram *pd, *pd_next;
 
-        spin_lock_irq(&peer->dev->lock);
+        spin_lock_irq(&dev->lock);
         list_del(&peer->peer_link);
-        spin_unlock_irq(&peer->dev->lock);
+        dev->peer_count--;
+        set_carrier_state(dev);
+        spin_unlock_irq(&dev->lock);
 
         list_for_each_entry_safe(pd, pd_next, &peer->pd_list, pd_link)
                 fwnet_pd_delete(pd);
@@ -1535,14 +1591,17 @@ static int fwnet_remove(struct device *_dev)
         struct fwnet_peer *peer = dev_get_drvdata(_dev);
         struct fwnet_device *dev = peer->dev;
         struct net_device *net;
-        struct fwnet_packet_task *ptask, *pt_next;
+        int i;
 
         mutex_lock(&fwnet_device_mutex);
 
-        fwnet_remove_peer(peer);
+        net = dev->netdev;
+        if (net && peer->ip)
+                arp_invalidate(net, peer->ip);
+
+        fwnet_remove_peer(peer, dev);
 
         if (list_empty(&dev->peer_list)) {
-                net = dev->netdev;
                 unregister_netdev(net);
 
                 if (dev->local_fifo != FWNET_NO_FIFO_ADDR)
@@ -1553,21 +1612,9 @@ static int fwnet_remove(struct device *_dev)
                                               dev->card);
                         fw_iso_context_destroy(dev->broadcast_rcv_context);
                 }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->packet_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->broadcasted_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->sent_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
+                for (i = 0; dev->queued_datagrams && i < 5; i++)
+                        ssleep(1);
+                WARN_ON(dev->queued_datagrams);
                 list_del(&dev->dev_link);
 
                 free_netdev(net);
diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c
index 8528b10763ed..0618145376ad 100644
--- a/drivers/firewire/nosy.c
+++ b/drivers/firewire/nosy.c
@@ -302,7 +302,7 @@ nosy_open(struct inode *inode, struct file *file)
 
         file->private_data = client;
 
-        return 0;
+        return nonseekable_open(inode, file);
 fail:
         kfree(client);
         lynx_put(lynx);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 9dcb17d51aee..ebb897329c1e 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -18,6 +18,7 @@
  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 
+#include <linux/bitops.h>
 #include <linux/bug.h>
 #include <linux/compiler.h>
 #include <linux/delay.h>
@@ -40,6 +41,7 @@
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/time.h>
+#include <linux/vmalloc.h>
 
 #include <asm/byteorder.h>
 #include <asm/page.h>
@@ -80,17 +82,23 @@ struct descriptor {
 #define COMMAND_PTR(regs)       ((regs) + 12)
 #define CONTEXT_MATCH(regs)     ((regs) + 16)
 
-struct ar_buffer {
-        struct descriptor descriptor;
-        struct ar_buffer *next;
-        __le32 data[0];
-};
+#define AR_BUFFER_SIZE  (32*1024)
+#define AR_BUFFERS_MIN  DIV_ROUND_UP(AR_BUFFER_SIZE, PAGE_SIZE)
+/* we need at least two pages for proper list management */
+#define AR_BUFFERS      (AR_BUFFERS_MIN >= 2 ? AR_BUFFERS_MIN : 2)
+
+#define MAX_ASYNC_PAYLOAD       4096
+#define MAX_AR_PACKET_SIZE      (16 + MAX_ASYNC_PAYLOAD + 4)
+#define AR_WRAPAROUND_PAGES     DIV_ROUND_UP(MAX_AR_PACKET_SIZE, PAGE_SIZE)
 
 struct ar_context {
         struct fw_ohci *ohci;
-        struct ar_buffer *current_buffer;
-        struct ar_buffer *last_buffer;
+        struct page *pages[AR_BUFFERS];
+        void *buffer;
+        struct descriptor *descriptors;
+        dma_addr_t descriptors_bus;
         void *pointer;
+        unsigned int last_buffer_index;
         u32 regs;
         struct tasklet_struct tasklet;
 };
@@ -117,6 +125,8 @@ struct context {
         struct fw_ohci *ohci;
         u32 regs;
         int total_allocation;
+        bool running;
+        bool flushing;
 
         /*
          * List of page-sized buffers for storing DMA descriptors.
@@ -161,6 +171,9 @@ struct iso_context {
         int excess_bytes;
         void *header;
         size_t header_length;
+
+        u8 sync;
+        u8 tags;
 };
 
 #define CONFIG_ROM_SIZE 1024
@@ -177,7 +190,8 @@ struct fw_ohci {
         u32 bus_time;
         bool is_root;
         bool csr_state_setclear_abdicate;
-
+        int n_ir;
+        int n_it;
         /*
          * Spinlock for accessing fw_ohci data.  Never call out of
          * this driver with this lock held.
@@ -186,14 +200,19 @@ struct fw_ohci {
 
         struct mutex phy_reg_mutex;
 
+        void *misc_buffer;
+        dma_addr_t misc_buffer_bus;
+
         struct ar_context ar_request_ctx;
         struct ar_context ar_response_ctx;
         struct context at_request_ctx;
         struct context at_response_ctx;
 
+        u32 it_context_support;
         u32 it_context_mask;     /* unoccupied IT contexts */
         struct iso_context *it_context_list;
         u64 ir_context_channels; /* unoccupied channels */
+        u32 ir_context_support;
         u32 ir_context_mask;     /* unoccupied IR contexts */
         struct iso_context *ir_context_list;
         u64 mc_channels; /* channels in use by the multichannel IR context */
@@ -242,8 +261,10 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
 
 static char ohci_driver_name[] = KBUILD_MODNAME;
 
+#define PCI_DEVICE_ID_AGERE_FW643       0x5901
 #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
 #define PCI_DEVICE_ID_TI_TSB12LV22      0x8009
+#define PCI_VENDOR_ID_PINNACLE_SYSTEMS  0x11bd
 
 #define QUIRK_CYCLE_TIMER               1
 #define QUIRK_RESET_PACKET              2
@@ -253,18 +274,34 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 
 /* In case of multiple matches in ohci_quirks[], only the first one is used. */
 static const struct {
-        unsigned short vendor, device, flags;
+        unsigned short vendor, device, revision, flags;
 } ohci_quirks[] = {
-        {PCI_VENDOR_ID_TI,      PCI_DEVICE_ID_TI_TSB12LV22, QUIRK_CYCLE_TIMER |
-                                                            QUIRK_RESET_PACKET |
-                                                            QUIRK_NO_1394A},
-        {PCI_VENDOR_ID_TI,      PCI_ANY_ID,     QUIRK_RESET_PACKET},
-        {PCI_VENDOR_ID_AL,      PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, QUIRK_NO_MSI},
-        {PCI_VENDOR_ID_NEC,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_VIA,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_RICOH,   PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_APPLE,   PCI_DEVICE_ID_APPLE_UNI_N_FW, QUIRK_BE_HEADERS},
+        {PCI_VENDOR_ID_AL, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER},
+
+        {PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_UNI_N_FW, PCI_ANY_ID,
+                QUIRK_BE_HEADERS},
+
+        {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
+                QUIRK_NO_MSI},
+
+        {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, PCI_ANY_ID,
+                QUIRK_NO_MSI},
+
+        {PCI_VENDOR_ID_NEC, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER},
+
+        {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER},
+
+        {PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_TSB12LV22, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER | QUIRK_RESET_PACKET | QUIRK_NO_1394A},
+
+        {PCI_VENDOR_ID_TI, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_RESET_PACKET},
+
+        {PCI_VENDOR_ID_VIA, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
 };
 
 /* This overrides anything that was found in ohci_quirks[]. */
@@ -304,7 +341,7 @@ static void log_irqs(u32 evt)
             !(evt & OHCI1394_busReset))
                 return;
 
-        fw_notify("IRQ %08x%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n", evt,
+        fw_notify("IRQ %08x%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n", evt,
             evt & OHCI1394_selfIDComplete       ? " selfID"             : "",
             evt & OHCI1394_RQPkt                ? " AR_req"             : "",
             evt & OHCI1394_RSPkt                ? " AR_resp"            : "",
@@ -317,6 +354,7 @@ static void log_irqs(u32 evt)
             evt & OHCI1394_cycle64Seconds       ? " cycle64Seconds"     : "",
             evt & OHCI1394_cycleInconsistent    ? " cycleInconsistent"  : "",
             evt & OHCI1394_regAccessFail        ? " regAccessFail"      : "",
+            evt & OHCI1394_unrecoverableError   ? " unrecoverableError" : "",
             evt & OHCI1394_busReset             ? " busReset"           : "",
             evt & ~(OHCI1394_selfIDComplete | OHCI1394_RQPkt |
                     OHCI1394_RSPkt | OHCI1394_reqTxComplete |
@@ -394,10 +432,6 @@ static const char *tcodes[] = {
         [0xc] = "-reserved-",           [0xd] = "-reserved-",
         [0xe] = "link internal",        [0xf] = "-reserved-",
 };
-static const char *phys[] = {
-        [0x0] = "phy config packet",    [0x1] = "link-on packet",
-        [0x2] = "self-id packet",       [0x3] = "-reserved-",
-};
 
 static void log_ar_at_event(char dir, int speed, u32 *header, int evt)
 {
@@ -416,12 +450,6 @@ static void log_ar_at_event(char dir, int speed, u32 *header, int evt)
                 return;
         }
 
-        if (header[0] == ~header[1]) {
-                fw_notify("A%c %s, %s, %08x\n",
-                    dir, evts[evt], phys[header[0] >> 30 & 0x3], header[0]);
-                return;
-        }
-
         switch (tcode) {
         case 0x0: case 0x6: case 0x8:
                 snprintf(specific, sizeof(specific), " = %08x",
@@ -436,9 +464,13 @@ static void log_ar_at_event(char dir, int speed, u32 *header, int evt)
         }
 
         switch (tcode) {
-        case 0xe: case 0xa:
+        case 0xa:
                 fw_notify("A%c %s, %s\n", dir, evts[evt], tcodes[tcode]);
                 break;
+        case 0xe:
+                fw_notify("A%c %s, PHY %08x %08x\n",
+                          dir, evts[evt], header[1], header[2]);
+                break;
         case 0x0: case 0x1: case 0x4: case 0x5: case 0x9:
                 fw_notify("A%c spd %x tl %02x, "
                     "%04x -> %04x, %s, "
@@ -577,52 +609,150 @@ static int ohci_update_phy_reg(struct fw_card *card, int addr,
         return ret;
 }
 
-static int ar_context_add_page(struct ar_context *ctx)
+static inline dma_addr_t ar_buffer_bus(struct ar_context *ctx, unsigned int i)
 {
-        struct device *dev = ctx->ohci->card.device;
-        struct ar_buffer *ab;
-        dma_addr_t uninitialized_var(ab_bus);
-        size_t offset;
+        return page_private(ctx->pages[i]);
+}
 
-        ab = dma_alloc_coherent(dev, PAGE_SIZE, &ab_bus, GFP_ATOMIC);
-        if (ab == NULL)
-                return -ENOMEM;
+static void ar_context_link_page(struct ar_context *ctx, unsigned int index)
+{
+        struct descriptor *d;
 
-        ab->next = NULL;
-        memset(&ab->descriptor, 0, sizeof(ab->descriptor));
-        ab->descriptor.control        = cpu_to_le16(DESCRIPTOR_INPUT_MORE |
-                                                    DESCRIPTOR_STATUS |
-                                                    DESCRIPTOR_BRANCH_ALWAYS);
-        offset = offsetof(struct ar_buffer, data);
-        ab->descriptor.req_count      = cpu_to_le16(PAGE_SIZE - offset);
-        ab->descriptor.data_address   = cpu_to_le32(ab_bus + offset);
-        ab->descriptor.res_count      = cpu_to_le16(PAGE_SIZE - offset);
-        ab->descriptor.branch_address = 0;
+        d = &ctx->descriptors[index];
+        d->branch_address  &= cpu_to_le32(~0xf);
+        d->res_count       =  cpu_to_le16(PAGE_SIZE);
+        d->transfer_status =  0;
 
         wmb(); /* finish init of new descriptors before branch_address update */
-        ctx->last_buffer->descriptor.branch_address = cpu_to_le32(ab_bus | 1);
-        ctx->last_buffer->next = ab;
-        ctx->last_buffer = ab;
+        d = &ctx->descriptors[ctx->last_buffer_index];
+        d->branch_address  |= cpu_to_le32(1);
+
+        ctx->last_buffer_index = index;
 
         reg_write(ctx->ohci, CONTROL_SET(ctx->regs), CONTEXT_WAKE);
         flush_writes(ctx->ohci);
-
-        return 0;
 }
 
 static void ar_context_release(struct ar_context *ctx)
 {
-        struct ar_buffer *ab, *ab_next;
-        size_t offset;
-        dma_addr_t ab_bus;
+        unsigned int i;
+
+        if (ctx->buffer)
+                vm_unmap_ram(ctx->buffer, AR_BUFFERS + AR_WRAPAROUND_PAGES);
+
+        for (i = 0; i < AR_BUFFERS; i++)
+                if (ctx->pages[i]) {
+                        dma_unmap_page(ctx->ohci->card.device,
+                                       ar_buffer_bus(ctx, i),
+                                       PAGE_SIZE, DMA_FROM_DEVICE);
+                        __free_page(ctx->pages[i]);
+                }
+}
+
+static void ar_context_abort(struct ar_context *ctx, const char *error_msg)
+{
+        if (reg_read(ctx->ohci, CONTROL_CLEAR(ctx->regs)) & CONTEXT_RUN) {
+                reg_write(ctx->ohci, CONTROL_CLEAR(ctx->regs), CONTEXT_RUN);
+                flush_writes(ctx->ohci);
 
-        for (ab = ctx->current_buffer; ab; ab = ab_next) {
-                ab_next = ab->next;
-                offset = offsetof(struct ar_buffer, data);
-                ab_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
-                dma_free_coherent(ctx->ohci->card.device, PAGE_SIZE,
-                                  ab, ab_bus);
+                fw_error("AR error: %s; DMA stopped\n", error_msg);
         }
+        /* FIXME: restart? */
+}
+
+static inline unsigned int ar_next_buffer_index(unsigned int index)
+{
+        return (index + 1) % AR_BUFFERS;
+}
+
+static inline unsigned int ar_prev_buffer_index(unsigned int index)
+{
+        return (index - 1 + AR_BUFFERS) % AR_BUFFERS;
+}
+
+static inline unsigned int ar_first_buffer_index(struct ar_context *ctx)
+{
+        return ar_next_buffer_index(ctx->last_buffer_index);
+}
+
+/*
+ * We search for the buffer that contains the last AR packet DMA data written
+ * by the controller.
+ */
+static unsigned int ar_search_last_active_buffer(struct ar_context *ctx,
+                                                 unsigned int *buffer_offset)
+{
+        unsigned int i, next_i, last = ctx->last_buffer_index;
+        __le16 res_count, next_res_count;
+
+        i = ar_first_buffer_index(ctx);
+        res_count = ACCESS_ONCE(ctx->descriptors[i].res_count);
+
+        /* A buffer that is not yet completely filled must be the last one. */
+        while (i != last && res_count == 0) {
+
+                /* Peek at the next descriptor. */
+                next_i = ar_next_buffer_index(i);
+                rmb(); /* read descriptors in order */
+                next_res_count = ACCESS_ONCE(
+                                ctx->descriptors[next_i].res_count);
+                /*
+                 * If the next descriptor is still empty, we must stop at this
+                 * descriptor.
+                 */
+                if (next_res_count == cpu_to_le16(PAGE_SIZE)) {
+                        /*
+                         * The exception is when the DMA data for one packet is
+                         * split over three buffers; in this case, the middle
+                         * buffer's descriptor might be never updated by the
+                         * controller and look still empty, and we have to peek
+                         * at the third one.
+                         */
+                        if (MAX_AR_PACKET_SIZE > PAGE_SIZE && i != last) {
+                                next_i = ar_next_buffer_index(next_i);
+                                rmb();
+                                next_res_count = ACCESS_ONCE(
+                                        ctx->descriptors[next_i].res_count);
+                                if (next_res_count != cpu_to_le16(PAGE_SIZE))
+                                        goto next_buffer_is_active;
+                        }
+
+                        break;
+                }
+
+next_buffer_is_active:
+                i = next_i;
+                res_count = next_res_count;
+        }
+
+        rmb(); /* read res_count before the DMA data */
+
+        *buffer_offset = PAGE_SIZE - le16_to_cpu(res_count);
+        if (*buffer_offset > PAGE_SIZE) {
+                *buffer_offset = 0;
+                ar_context_abort(ctx, "corrupted descriptor");
+        }
+
+        return i;
+}
+
+static void ar_sync_buffers_for_cpu(struct ar_context *ctx,
+                                    unsigned int end_buffer_index,
+                                    unsigned int end_buffer_offset)
+{
+        unsigned int i;
+
+        i = ar_first_buffer_index(ctx);
+        while (i != end_buffer_index) {
+                dma_sync_single_for_cpu(ctx->ohci->card.device,
+                                        ar_buffer_bus(ctx, i),
+                                        PAGE_SIZE, DMA_FROM_DEVICE);
+                i = ar_next_buffer_index(i);
+        }
+        if (end_buffer_offset > 0)
+                dma_sync_single_for_cpu(ctx->ohci->card.device,
+                                        ar_buffer_bus(ctx, i),
+                                        end_buffer_offset, DMA_FROM_DEVICE);
 }
 
 #if defined(CONFIG_PPC_PMAC) && defined(CONFIG_PPC32)
@@ -665,6 +795,10 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
                 p.header[3] = cond_le32_to_cpu(buffer[3]);
                 p.header_length = 16;
                 p.payload_length = p.header[3] >> 16;
+                if (p.payload_length > MAX_ASYNC_PAYLOAD) {
+                        ar_context_abort(ctx, "invalid packet length");
+                        return NULL;
+                }
                 break;
 
         case TCODE_WRITE_RESPONSE:
@@ -675,9 +809,8 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
                 break;
 
         default:
-                /* FIXME: Stop context, discard everything, and restart? */
-                p.header_length = 0;
-                p.payload_length = 0;
+                ar_context_abort(ctx, "invalid tcode");
+                return NULL;
         }
 
         p.payload = (void *) buffer + p.header_length;
@@ -727,99 +860,159 @@ static __le32 *handle_ar_packet(struct ar_context *ctx, __le32 *buffer)
         return buffer + length + 1;
 }
 
+static void *handle_ar_packets(struct ar_context *ctx, void *p, void *end)
+{
+        void *next;
+
+        while (p < end) {
+                next = handle_ar_packet(ctx, p);
+                if (!next)
+                        return p;
+                p = next;
+        }
+
+        return p;
+}
+
+static void ar_recycle_buffers(struct ar_context *ctx, unsigned int end_buffer)
+{
+        unsigned int i;
+
+        i = ar_first_buffer_index(ctx);
+        while (i != end_buffer) {
+                dma_sync_single_for_device(ctx->ohci->card.device,
+                                           ar_buffer_bus(ctx, i),
+                                           PAGE_SIZE, DMA_FROM_DEVICE);
+                ar_context_link_page(ctx, i);
+                i = ar_next_buffer_index(i);
+        }
+}
+
 static void ar_context_tasklet(unsigned long data)
 {
         struct ar_context *ctx = (struct ar_context *)data;
-        struct fw_ohci *ohci = ctx->ohci;
-        struct ar_buffer *ab;
-        struct descriptor *d;
-        void *buffer, *end;
+        unsigned int end_buffer_index, end_buffer_offset;
+        void *p, *end;
 
-        ab = ctx->current_buffer;
-        d = &ab->descriptor;
+        p = ctx->pointer;
+        if (!p)
+                return;
 
-        if (d->res_count == 0) {
-                size_t size, rest, offset;
-                dma_addr_t start_bus;
-                void *start;
+        end_buffer_index = ar_search_last_active_buffer(ctx,
+                                                        &end_buffer_offset);
+        ar_sync_buffers_for_cpu(ctx, end_buffer_index, end_buffer_offset);
+        end = ctx->buffer + end_buffer_index * PAGE_SIZE + end_buffer_offset;
 
+        if (end_buffer_index < ar_first_buffer_index(ctx)) {
                 /*
-                 * This descriptor is finished and we may have a
-                 * packet split across this and the next buffer. We
-                 * reuse the page for reassembling the split packet.
+                 * The filled part of the overall buffer wraps around; handle
+                 * all packets up to the buffer end here.  If the last packet
+                 * wraps around, its tail will be visible after the buffer end
+                 * because the buffer start pages are mapped there again.
                  */
+                void *buffer_end = ctx->buffer + AR_BUFFERS * PAGE_SIZE;
+                p = handle_ar_packets(ctx, p, buffer_end);
+                if (p < buffer_end)
+                        goto error;
+                /* adjust p to point back into the actual buffer */
+                p -= AR_BUFFERS * PAGE_SIZE;
+        }
 
-                offset = offsetof(struct ar_buffer, data);
-                start = buffer = ab;
-                start_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
-
-                ab = ab->next;
-                d = &ab->descriptor;
-                size = buffer + PAGE_SIZE - ctx->pointer;
-                rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
-                memmove(buffer, ctx->pointer, size);
-                memcpy(buffer + size, ab->data, rest);
-                ctx->current_buffer = ab;
-                ctx->pointer = (void *) ab->data + rest;
-                end = buffer + size + rest;
-
-                while (buffer < end)
-                        buffer = handle_ar_packet(ctx, buffer);
-
-                dma_free_coherent(ohci->card.device, PAGE_SIZE,
-                                  start, start_bus);
-                ar_context_add_page(ctx);
-        } else {
-                buffer = ctx->pointer;
-                ctx->pointer = end =
-                        (void *) ab + PAGE_SIZE - le16_to_cpu(d->res_count);
-
-                while (buffer < end)
-                        buffer = handle_ar_packet(ctx, buffer);
+        p = handle_ar_packets(ctx, p, end);
+        if (p != end) {
+                if (p > end)
+                        ar_context_abort(ctx, "inconsistent descriptor");
+                goto error;
         }
+
+        ctx->pointer = p;
+        ar_recycle_buffers(ctx, end_buffer_index);
+
+        return;
+
+error:
+        ctx->pointer = NULL;
 }
 
-static int ar_context_init(struct ar_context *ctx,
-                           struct fw_ohci *ohci, u32 regs)
+static int ar_context_init(struct ar_context *ctx, struct fw_ohci *ohci,
+                           unsigned int descriptors_offset, u32 regs)
 {
-        struct ar_buffer ab;
+        unsigned int i;
+        dma_addr_t dma_addr;
+        struct page *pages[AR_BUFFERS + AR_WRAPAROUND_PAGES];
+        struct descriptor *d;
 
         ctx->regs        = regs;
         ctx->ohci        = ohci;
-        ctx->last_buffer = &ab;
         tasklet_init(&ctx->tasklet, ar_context_tasklet, (unsigned long)ctx);
 
-        ar_context_add_page(ctx);
-        ar_context_add_page(ctx);
-        ctx->current_buffer = ab.next;
-        ctx->pointer = ctx->current_buffer->data;
+        for (i = 0; i < AR_BUFFERS; i++) {
+                ctx->pages[i] = alloc_page(GFP_KERNEL | GFP_DMA32);
+                if (!ctx->pages[i])
+                        goto out_of_memory;
+                dma_addr = dma_map_page(ohci->card.device, ctx->pages[i],
+                                        0, PAGE_SIZE, DMA_FROM_DEVICE);
+                if (dma_mapping_error(ohci->card.device, dma_addr)) {
+                        __free_page(ctx->pages[i]);
+                        ctx->pages[i] = NULL;
+                        goto out_of_memory;
+                }
+                set_page_private(ctx->pages[i], dma_addr);
+        }
+
+        for (i = 0; i < AR_BUFFERS; i++)
+                pages[i]              = ctx->pages[i];
+        for (i = 0; i < AR_WRAPAROUND_PAGES; i++)
+                pages[AR_BUFFERS + i] = ctx->pages[i];
+        ctx->buffer = vm_map_ram(pages, AR_BUFFERS + AR_WRAPAROUND_PAGES,
+                                 -1, PAGE_KERNEL);
+        if (!ctx->buffer)
+                goto out_of_memory;
+
+        ctx->descriptors     = ohci->misc_buffer     + descriptors_offset;
+        ctx->descriptors_bus = ohci->misc_buffer_bus + descriptors_offset;
+
+        for (i = 0; i < AR_BUFFERS; i++) {
+                d = &ctx->descriptors[i];
+                d->req_count      = cpu_to_le16(PAGE_SIZE);
+                d->control        = cpu_to_le16(DESCRIPTOR_INPUT_MORE |
+                                                DESCRIPTOR_STATUS |
+                                                DESCRIPTOR_BRANCH_ALWAYS);
+                d->data_address   = cpu_to_le32(ar_buffer_bus(ctx, i));
+                d->branch_address = cpu_to_le32(ctx->descriptors_bus +
+                        ar_next_buffer_index(i) * sizeof(struct descriptor));
+        }
 
         return 0;
+
+out_of_memory:
+        ar_context_release(ctx);
+
+        return -ENOMEM;
 }
 
 static void ar_context_run(struct ar_context *ctx)
 {
-        struct ar_buffer *ab = ctx->current_buffer;
-        dma_addr_t ab_bus;
-        size_t offset;
+        unsigned int i;
 
-        offset = offsetof(struct ar_buffer, data);
-        ab_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
+        for (i = 0; i < AR_BUFFERS; i++)
+                ar_context_link_page(ctx, i);
 
-        reg_write(ctx->ohci, COMMAND_PTR(ctx->regs), ab_bus | 1);
+        ctx->pointer = ctx->buffer;
+
+        reg_write(ctx->ohci, COMMAND_PTR(ctx->regs), ctx->descriptors_bus | 1);
         reg_write(ctx->ohci, CONTROL_SET(ctx->regs), CONTEXT_RUN);
         flush_writes(ctx->ohci);
 }
 
 static struct descriptor *find_branch_descriptor(struct descriptor *d, int z)
 {
-        int b, key;
+        __le16 branch;
 
-        b   = (le16_to_cpu(d->control) & DESCRIPTOR_BRANCH_ALWAYS) >> 2;
-        key = (le16_to_cpu(d->control) & DESCRIPTOR_KEY_IMMEDIATE) >> 8;
+        branch = d->control & cpu_to_le16(DESCRIPTOR_BRANCH_ALWAYS);
 
         /* figure out which descriptor the branch address goes in */
-        if (z == 2 && (b == 3 || key == 2))
+        if (z == 2 && branch == cpu_to_le16(DESCRIPTOR_BRANCH_ALWAYS))
                 return d;
         else
                 return d + z - 1;
@@ -983,6 +1176,7 @@ static void context_run(struct context *ctx, u32 extra)
                   le32_to_cpu(ctx->last->branch_address));
         reg_write(ohci, CONTROL_CLEAR(ctx->regs), ~0);
         reg_write(ohci, CONTROL_SET(ctx->regs), CONTEXT_RUN | extra);
+        ctx->running = true;
         flush_writes(ohci);
 }
 
@@ -999,9 +1193,6 @@ static void context_append(struct context *ctx,
         wmb(); /* finish init of new descriptors before branch_address update */
         ctx->prev->branch_address = cpu_to_le32(d_bus | z);
         ctx->prev = find_branch_descriptor(d, z);
-
-        reg_write(ctx->ohci, CONTROL_SET(ctx->regs), CONTEXT_WAKE);
-        flush_writes(ctx->ohci);
 }
 
 static void context_stop(struct context *ctx)
@@ -1010,6 +1201,7 @@ static void context_stop(struct context *ctx)
         int i;
 
         reg_write(ctx->ohci, CONTROL_CLEAR(ctx->regs), CONTEXT_RUN);
+        ctx->running = false;
         flush_writes(ctx->ohci);
 
         for (i = 0; i < 10; i++) {
@@ -1023,6 +1215,7 @@ static void context_stop(struct context *ctx)
 }
 
 struct driver_data {
+        u8 inline_data[8];
         struct fw_packet *packet;
 };
 
@@ -1040,7 +1233,6 @@ static int at_context_queue_packet(struct context *ctx,
         struct descriptor *d, *last;
         __le32 *header;
         int z, tcode;
-        u32 reg;
 
         d = context_get_descriptors(ctx, 4, &d_bus);
         if (d == NULL) {
@@ -1054,21 +1246,27 @@ static int at_context_queue_packet(struct context *ctx,
         /*
          * The DMA format for asyncronous link packets is different
          * from the IEEE1394 layout, so shift the fields around
-         * accordingly.  If header_length is 8, it's a PHY packet, to
-         * which we need to prepend an extra quadlet.
+         * accordingly.
          */
 
+        tcode = (packet->header[0] >> 4) & 0x0f;
         header = (__le32 *) &d[1];
-        switch (packet->header_length) {
-        case 16:
-        case 12:
+        switch (tcode) {
+        case TCODE_WRITE_QUADLET_REQUEST:
+        case TCODE_WRITE_BLOCK_REQUEST:
+        case TCODE_WRITE_RESPONSE:
+        case TCODE_READ_QUADLET_REQUEST:
+        case TCODE_READ_BLOCK_REQUEST:
+        case TCODE_READ_QUADLET_RESPONSE:
+        case TCODE_READ_BLOCK_RESPONSE:
+        case TCODE_LOCK_REQUEST:
+        case TCODE_LOCK_RESPONSE:
                 header[0] = cpu_to_le32((packet->header[0] & 0xffff) |
                                         (packet->speed << 16));
                 header[1] = cpu_to_le32((packet->header[1] & 0xffff) |
                                         (packet->header[0] & 0xffff0000));
                 header[2] = cpu_to_le32(packet->header[2]);
 
-                tcode = (packet->header[0] >> 4) & 0x0f;
                 if (TCODE_IS_BLOCK_PACKET(tcode))
                         header[3] = cpu_to_le32(packet->header[3]);
                 else
@@ -1077,18 +1275,18 @@ static int at_context_queue_packet(struct context *ctx,
                 d[0].req_count = cpu_to_le16(packet->header_length);
                 break;
 
-        case 8:
+        case TCODE_LINK_INTERNAL:
                 header[0] = cpu_to_le32((OHCI1394_phy_tcode << 4) |
                                         (packet->speed << 16));
-                header[1] = cpu_to_le32(packet->header[0]);
-                header[2] = cpu_to_le32(packet->header[1]);
+                header[1] = cpu_to_le32(packet->header[1]);
+                header[2] = cpu_to_le32(packet->header[2]);
                 d[0].req_count = cpu_to_le16(12);
 
-                if (is_ping_packet(packet->header))
+                if (is_ping_packet(&packet->header[1]))
                         d[0].control |= cpu_to_le16(DESCRIPTOR_PING);
                 break;
 
-        case 4:
+        case TCODE_STREAM_DATA:
                 header[0] = cpu_to_le32((packet->header[0] & 0xffff) |
                                         (packet->speed << 16));
                 header[1] = cpu_to_le32(packet->header[0] & 0xffff0000);
@@ -1101,20 +1299,28 @@ static int at_context_queue_packet(struct context *ctx,
                 return -1;
         }
 
+        BUILD_BUG_ON(sizeof(struct driver_data) > sizeof(struct descriptor));
         driver_data = (struct driver_data *) &d[3];
         driver_data->packet = packet;
         packet->driver_data = driver_data;
 
         if (packet->payload_length > 0) {
-                payload_bus =
-                        dma_map_single(ohci->card.device, packet->payload,
-                                       packet->payload_length, DMA_TO_DEVICE);
-                if (dma_mapping_error(ohci->card.device, payload_bus)) {
-                        packet->ack = RCODE_SEND_ERROR;
-                        return -1;
+                if (packet->payload_length > sizeof(driver_data->inline_data)) {
+                        payload_bus = dma_map_single(ohci->card.device,
+                                                     packet->payload,
+                                                     packet->payload_length,
+                                                     DMA_TO_DEVICE);
+                        if (dma_mapping_error(ohci->card.device, payload_bus)) {
+                                packet->ack = RCODE_SEND_ERROR;
+                                return -1;
+                        }
+                        packet->payload_bus     = payload_bus;
+                        packet->payload_mapped  = true;
+                } else {
+                        memcpy(driver_data->inline_data, packet->payload,
+                               packet->payload_length);
+                        payload_bus = d_bus + 3 * sizeof(*d);
                 }
-                packet->payload_bus     = payload_bus;
-                packet->payload_mapped  = true;
 
                 d[2].req_count    = cpu_to_le16(packet->payload_length);
                 d[2].data_address = cpu_to_le32(payload_bus);
@@ -1129,19 +1335,8 @@ static int at_context_queue_packet(struct context *ctx,
                                      DESCRIPTOR_IRQ_ALWAYS |
                                      DESCRIPTOR_BRANCH_ALWAYS);
 
-        /*
-         * If the controller and packet generations don't match, we need to
-         * bail out and try again.  If IntEvent.busReset is set, the AT context
-         * is halted, so appending to the context and trying to run it is
-         * futile.  Most controllers do the right thing and just flush the AT
-         * queue (per section 7.2.3.2 of the OHCI 1.1 specification), but
-         * some controllers (like a JMicron JMB381 PCI-e) misbehave and wind
-         * up stalling out.  So we just bail out in software and try again
-         * later, and everyone is happy.
-         * FIXME: Document how the locking works.
-         */
-        if (ohci->generation != packet->generation ||
-            reg_read(ohci, OHCI1394_IntEventSet) & OHCI1394_busReset) {
+        /* FIXME: Document how the locking works. */
+        if (ohci->generation != packet->generation) {
                 if (packet->payload_mapped)
                         dma_unmap_single(ohci->card.device, payload_bus,
                                          packet->payload_length, DMA_TO_DEVICE);
@@ -1151,14 +1346,27 @@ static int at_context_queue_packet(struct context *ctx,
 
         context_append(ctx, d, z, 4 - z);
 
-        /* If the context isn't already running, start it up. */
-        reg = reg_read(ctx->ohci, CONTROL_SET(ctx->regs));
-        if ((reg & CONTEXT_RUN) == 0)
+        if (ctx->running) {
+                reg_write(ohci, CONTROL_SET(ctx->regs), CONTEXT_WAKE);
+                flush_writes(ohci);
+        } else {
                 context_run(ctx, 0);
+        }
 
         return 0;
 }
 
+static void at_context_flush(struct context *ctx)
+{
+        tasklet_disable(&ctx->tasklet);
+
+        ctx->flushing = true;
+        context_tasklet((unsigned long)ctx);
+        ctx->flushing = false;
+
+        tasklet_enable(&ctx->tasklet);
+}
+
 static int handle_at_packet(struct context *context,
                             struct descriptor *d,
                             struct descriptor *last)
@@ -1168,7 +1376,7 @@ static int handle_at_packet(struct context *context,
         struct fw_ohci *ohci = context->ohci;
         int evt;
 
-        if (last->transfer_status == 0)
+        if (last->transfer_status == 0 && !context->flushing)
                 /* This descriptor isn't done yet, stop iteration. */
                 return 0;
 
@@ -1202,11 +1410,15 @@ static int handle_at_packet(struct context *context,
                 break;
 
         case OHCI1394_evt_missing_ack:
-                /*
-                 * Using a valid (current) generation count, but the
-                 * node is not on the bus or not sending acks.
-                 */
-                packet->ack = RCODE_NO_ACK;
+                if (context->flushing)
+                        packet->ack = RCODE_GENERATION;
+                else {
+                        /*
+                         * Using a valid (current) generation count, but the
+                         * node is not on the bus or not sending acks.
+                         */
+                        packet->ack = RCODE_NO_ACK;
+                }
                 break;
 
         case ACK_COMPLETE + 0x10:
@@ -1219,6 +1431,13 @@ static int handle_at_packet(struct context *context,
                 packet->ack = evt - 0x10;
                 break;
 
+        case OHCI1394_evt_no_status:
+                if (context->flushing) {
+                        packet->ack = RCODE_GENERATION;
+                        break;
+                }
+                /* fall through */
+
         default:
                 packet->ack = RCODE_SEND_ERROR;
                 break;
@@ -1371,6 +1590,47 @@ static void at_context_transmit(struct context *ctx, struct fw_packet *packet)
 
 }
 
+static void detect_dead_context(struct fw_ohci *ohci,
+                                const char *name, unsigned int regs)
+{
+        u32 ctl;
+
+        ctl = reg_read(ohci, CONTROL_SET(regs));
+        if (ctl & CONTEXT_DEAD) {
+#ifdef CONFIG_FIREWIRE_OHCI_DEBUG
+                fw_error("DMA context %s has stopped, error code: %s\n",
+                         name, evts[ctl & 0x1f]);
+#else
+                fw_error("DMA context %s has stopped, error code: %#x\n",
+                         name, ctl & 0x1f);
+#endif
+        }
+}
+
+static void handle_dead_contexts(struct fw_ohci *ohci)
+{
+        unsigned int i;
+        char name[8];
+
+        detect_dead_context(ohci, "ATReq", OHCI1394_AsReqTrContextBase);
+        detect_dead_context(ohci, "ATRsp", OHCI1394_AsRspTrContextBase);
+        detect_dead_context(ohci, "ARReq", OHCI1394_AsReqRcvContextBase);
+        detect_dead_context(ohci, "ARRsp", OHCI1394_AsRspRcvContextBase);
+        for (i = 0; i < 32; ++i) {
+                if (!(ohci->it_context_support & (1 << i)))
+                        continue;
+                sprintf(name, "IT%u", i);
+                detect_dead_context(ohci, name, OHCI1394_IsoXmitContextBase(i));
+        }
+        for (i = 0; i < 32; ++i) {
+                if (!(ohci->ir_context_support & (1 << i)))
+                        continue;
+                sprintf(name, "IR%u", i);
+                detect_dead_context(ohci, name, OHCI1394_IsoRcvContextBase(i));
+        }
+        /* TODO: maybe try to flush and restart the dead contexts */
+}
+
 static u32 cycle_timer_ticks(u32 cycle_timer)
 {
         u32 ticks;
@@ -1524,9 +1784,23 @@ static void bus_reset_tasklet(unsigned long data)
         /* FIXME: Document how the locking works. */
         spin_lock_irqsave(&ohci->lock, flags);
 
-        ohci->generation = generation;
+        ohci->generation = -1; /* prevent AT packet queueing */
         context_stop(&ohci->at_request_ctx);
         context_stop(&ohci->at_response_ctx);
+
+        spin_unlock_irqrestore(&ohci->lock, flags);
+
+        /*
+         * Per OHCI 1.2 draft, clause 7.2.3.3, hardware may leave unsent
+         * packets in the AT queues and software needs to drain them.
+         * Some OHCI 1.1 controllers (JMicron) apparently require this too.
+         */
+        at_context_flush(&ohci->at_request_ctx);
+        at_context_flush(&ohci->at_response_ctx);
+
+        spin_lock_irqsave(&ohci->lock, flags);
+
+        ohci->generation = generation;
         reg_write(ohci, OHCI1394_IntEventClear, OHCI1394_busReset);
 
         if (ohci->quirks & QUIRK_RESET_PACKET)
@@ -1594,8 +1868,12 @@ static irqreturn_t irq_handler(int irq, void *data)
         if (!event || !~event)
                 return IRQ_NONE;
 
-        /* busReset must not be cleared yet, see OHCI 1.1 clause 7.2.3.2 */
-        reg_write(ohci, OHCI1394_IntEventClear, event & ~OHCI1394_busReset);
+        /*
+         * busReset and postedWriteErr must not be cleared yet
+         * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1)
+         */
+        reg_write(ohci, OHCI1394_IntEventClear,
+                  event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));
         log_irqs(event);
 
         if (event & OHCI1394_selfIDComplete)
@@ -1613,30 +1891,41 @@ static irqreturn_t irq_handler(int irq, void *data)
         if (event & OHCI1394_respTxComplete)
                 tasklet_schedule(&ohci->at_response_ctx.tasklet);
 
-        iso_event = reg_read(ohci, OHCI1394_IsoRecvIntEventClear);
-        reg_write(ohci, OHCI1394_IsoRecvIntEventClear, iso_event);
+        if (event & OHCI1394_isochRx) {
+                iso_event = reg_read(ohci, OHCI1394_IsoRecvIntEventClear);
+                reg_write(ohci, OHCI1394_IsoRecvIntEventClear, iso_event);
 
-        while (iso_event) {
-                i = ffs(iso_event) - 1;
-                tasklet_schedule(&ohci->ir_context_list[i].context.tasklet);
-                iso_event &= ~(1 << i);
+                while (iso_event) {
+                        i = ffs(iso_event) - 1;
+                        tasklet_schedule(
+                                &ohci->ir_context_list[i].context.tasklet);
+                        iso_event &= ~(1 << i);
+                }
         }
 
-        iso_event = reg_read(ohci, OHCI1394_IsoXmitIntEventClear);
-        reg_write(ohci, OHCI1394_IsoXmitIntEventClear, iso_event);
+        if (event & OHCI1394_isochTx) {
+                iso_event = reg_read(ohci, OHCI1394_IsoXmitIntEventClear);
+                reg_write(ohci, OHCI1394_IsoXmitIntEventClear, iso_event);
 
-        while (iso_event) {
-                i = ffs(iso_event) - 1;
-                tasklet_schedule(&ohci->it_context_list[i].context.tasklet);
-                iso_event &= ~(1 << i);
+                while (iso_event) {
+                        i = ffs(iso_event) - 1;
+                        tasklet_schedule(
+                                &ohci->it_context_list[i].context.tasklet);
+                        iso_event &= ~(1 << i);
+                }
         }
 
         if (unlikely(event & OHCI1394_regAccessFail))
                 fw_error("Register access failure - "
                          "please notify linux1394-devel@lists.sf.net\n");
 
-        if (unlikely(event & OHCI1394_postedWriteErr))
+        if (unlikely(event & OHCI1394_postedWriteErr)) {
+                reg_read(ohci, OHCI1394_PostedWriteAddressHi);
+                reg_read(ohci, OHCI1394_PostedWriteAddressLo);
+                reg_write(ohci, OHCI1394_IntEventClear,
+                          OHCI1394_postedWriteErr);
                 fw_error("PCI posted write error\n");
+        }
 
         if (unlikely(event & OHCI1394_cycleTooLong)) {
                 if (printk_ratelimit())
@@ -1656,11 +1945,15 @@ static irqreturn_t irq_handler(int irq, void *data)
                         fw_notify("isochronous cycle inconsistent\n");
         }
 
+        if (unlikely(event & OHCI1394_unrecoverableError))
+                handle_dead_contexts(ohci);
+
         if (event & OHCI1394_cycle64Seconds) {
                 spin_lock(&ohci->lock);
                 update_bus_time(ohci);
                 spin_unlock(&ohci->lock);
-        }
+        } else
+                flush_writes(ohci);
 
         return IRQ_HANDLED;
 }
@@ -1783,8 +2076,6 @@ static int ohci_enable(struct fw_card *card,
 
         reg_write(ohci, OHCI1394_SelfIDBuffer, ohci->self_id_bus);
         reg_write(ohci, OHCI1394_LinkControlSet,
-                  OHCI1394_LinkControl_rcvSelfID |
-                  OHCI1394_LinkControl_rcvPhyPkt |
                   OHCI1394_LinkControl_cycleTimerEnable |
                   OHCI1394_LinkControl_cycleMaster);
 
@@ -1811,9 +2102,6 @@ static int ohci_enable(struct fw_card *card,
         reg_write(ohci, OHCI1394_FairnessControl, 0);
         card->priority_budget_implemented = ohci->pri_req_max != 0;
 
-        ar_context_run(&ohci->ar_request_ctx);
-        ar_context_run(&ohci->ar_response_ctx);
-
         reg_write(ohci, OHCI1394_PhyUpperBound, 0x00010000);
         reg_write(ohci, OHCI1394_IntEventClear, ~0);
         reg_write(ohci, OHCI1394_IntMaskClear, ~0);
@@ -1892,7 +2180,9 @@ static int ohci_enable(struct fw_card *card,
                 OHCI1394_selfIDComplete |
                 OHCI1394_regAccessFail |
                 OHCI1394_cycle64Seconds |
-                OHCI1394_cycleInconsistent | OHCI1394_cycleTooLong |
+                OHCI1394_cycleInconsistent |
+                OHCI1394_unrecoverableError |
+                OHCI1394_cycleTooLong |
                 OHCI1394_masterIntEnable;
         if (param_debug & OHCI_PARAM_DEBUG_BUSRESETS)
                 irqs |= OHCI1394_busReset;
@@ -1901,7 +2191,13 @@ static int ohci_enable(struct fw_card *card,
         reg_write(ohci, OHCI1394_HCControlSet,
                   OHCI1394_HCControl_linkEnable |
                   OHCI1394_HCControl_BIBimageValid);
-        flush_writes(ohci);
+
+        reg_write(ohci, OHCI1394_LinkControlSet,
+                  OHCI1394_LinkControl_rcvSelfID |
+                  OHCI1394_LinkControl_rcvPhyPkt);
+
+        ar_context_run(&ohci->ar_request_ctx);
+        ar_context_run(&ohci->ar_response_ctx); /* also flushes writes */
 
         /* We are ready to go, reset bus to finish initialization. */
         fw_schedule_bus_reset(&ohci->card, false, true);
@@ -1914,7 +2210,6 @@ static int ohci_set_config_rom(struct fw_card *card,
 {
         struct fw_ohci *ohci;
         unsigned long flags;
-        int ret = -EBUSY;
         __be32 *next_config_rom;
         dma_addr_t uninitialized_var(next_config_rom_bus);
 
@@ -1955,22 +2250,37 @@ static int ohci_set_config_rom(struct fw_card *card,
 
         spin_lock_irqsave(&ohci->lock, flags);
 
+        /*
+         * If there is not an already pending config_rom update,
+         * push our new allocation into the ohci->next_config_rom
+         * and then mark the local variable as null so that we
+         * won't deallocate the new buffer.
+         *
+         * OTOH, if there is a pending config_rom update, just
+         * use that buffer with the new config_rom data, and
+         * let this routine free the unused DMA allocation.
+         */
+
         if (ohci->next_config_rom == NULL) {
                 ohci->next_config_rom = next_config_rom;
                 ohci->next_config_rom_bus = next_config_rom_bus;
+                next_config_rom = NULL;
+        }
 
-                copy_config_rom(ohci->next_config_rom, config_rom, length);
+        copy_config_rom(ohci->next_config_rom, config_rom, length);
 
-                ohci->next_header = config_rom[0];
-                ohci->next_config_rom[0] = 0;
+        ohci->next_header = config_rom[0];
+        ohci->next_config_rom[0] = 0;
 
-                reg_write(ohci, OHCI1394_ConfigROMmap,
-                          ohci->next_config_rom_bus);
-                ret = 0;
-        }
+        reg_write(ohci, OHCI1394_ConfigROMmap, ohci->next_config_rom_bus);
 
         spin_unlock_irqrestore(&ohci->lock, flags);
 
+        /* If we didn't use the DMA allocation, delete it. */
+        if (next_config_rom != NULL)
+                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+                                  next_config_rom, next_config_rom_bus);
+
         /*
          * Now initiate a bus reset to have the changes take
          * effect. We clean up the old config rom memory and DMA
@@ -1978,13 +2288,10 @@ static int ohci_set_config_rom(struct fw_card *card,
          * controller could need to access it before the bus reset
          * takes effect.
          */
-        if (ret == 0)
-                fw_schedule_bus_reset(&ohci->card, true, true);
-        else
-                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
-                                  next_config_rom, next_config_rom_bus);
 
-        return ret;
+        fw_schedule_bus_reset(&ohci->card, true, true);
+
+        return 0;
 }
 
 static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
@@ -2408,6 +2715,10 @@ static int ohci_start_iso(struct fw_iso_context *base,
         u32 control = IR_CONTEXT_ISOCH_HEADER, match;
         int index;
 
+        /* the controller cannot start without any queued packets */
+        if (ctx->context.last->branch_address == 0)
+                return -ENODATA;
+
         switch (ctx->base.type) {
         case FW_ISO_CONTEXT_TRANSMIT:
                 index = ctx - ohci->it_context_list;
@@ -2436,6 +2747,10 @@ static int ohci_start_iso(struct fw_iso_context *base,
                 reg_write(ohci, OHCI1394_IsoRecvIntMaskSet, 1 << index);
                 reg_write(ohci, CONTEXT_MATCH(ctx->context.regs), match);
                 context_run(&ctx->context, control);
+
+                ctx->sync = sync;
+                ctx->tags = tags;
+
                 break;
         }
 
@@ -2462,6 +2777,7 @@ static int ohci_stop_iso(struct fw_iso_context *base)
         }
         flush_writes(ohci);
         context_stop(&ctx->context);
+        tasklet_kill(&ctx->context.tasklet);
 
         return 0;
 }
@@ -2533,6 +2849,26 @@ static int ohci_set_iso_channels(struct fw_iso_context *base, u64 *channels)
         return ret;
 }
 
+#ifdef CONFIG_PM
+static void ohci_resume_iso_dma(struct fw_ohci *ohci)
+{
+        int i;
+        struct iso_context *ctx;
+
+        for (i = 0 ; i < ohci->n_ir ; i++) {
+                ctx = &ohci->ir_context_list[i];
+                if (ctx->context.running)
+                        ohci_start_iso(&ctx->base, 0, ctx->sync, ctx->tags);
+        }
+
+        for (i = 0 ; i < ohci->n_it ; i++) {
+                ctx = &ohci->it_context_list[i];
+                if (ctx->context.running)
+                        ohci_start_iso(&ctx->base, 0, ctx->sync, ctx->tags);
+        }
+}
+#endif
+
 static int queue_iso_transmit(struct iso_context *ctx,
                               struct fw_iso_packet *packet,
                               struct fw_iso_buffer *buffer,
@@ -2787,6 +3123,15 @@ static int ohci_queue_iso(struct fw_iso_context *base,
         return ret;
 }
 
+static void ohci_flush_queue_iso(struct fw_iso_context *base)
+{
+        struct context *ctx =
+                        &container_of(base, struct iso_context, base)->context;
+
+        reg_write(ctx->ohci, CONTROL_SET(ctx->regs), CONTEXT_WAKE);
+        flush_writes(ctx->ohci);
+}
+
 static const struct fw_card_driver ohci_driver = {
         .enable                 = ohci_enable,
         .read_phy_reg           = ohci_read_phy_reg,
@@ -2803,6 +3148,7 @@ static const struct fw_card_driver ohci_driver = {
         .free_iso_context       = ohci_free_iso_context,
         .set_iso_channels       = ohci_set_iso_channels,
         .queue_iso              = ohci_queue_iso,
+        .flush_queue_iso        = ohci_flush_queue_iso,
         .start_iso              = ohci_start_iso,
         .stop_iso               = ohci_stop_iso,
 };
@@ -2842,9 +3188,14 @@ static int __devinit pci_probe(struct pci_dev *dev,
         struct fw_ohci *ohci;
         u32 bus_options, max_receive, link_speed, version;
         u64 guid;
-        int i, err, n_ir, n_it;
+        int i, err;
         size_t size;
 
+        if (dev->vendor == PCI_VENDOR_ID_PINNACLE_SYSTEMS) {
+                dev_err(&dev->dev, "Pinnacle MovieBoard is not yet supported\n");
+                return -ENOSYS;
+        }
+
         ohci = kzalloc(sizeof(*ohci), GFP_KERNEL);
         if (ohci == NULL) {
                 err = -ENOMEM;
@@ -2885,40 +3236,68 @@ static int __devinit pci_probe(struct pci_dev *dev,
         }
 
         for (i = 0; i < ARRAY_SIZE(ohci_quirks); i++)
-                if (ohci_quirks[i].vendor == dev->vendor &&
-                    (ohci_quirks[i].device == dev->device ||
-                     ohci_quirks[i].device == (unsigned short)PCI_ANY_ID)) {
+                if ((ohci_quirks[i].vendor == dev->vendor) &&
+                    (ohci_quirks[i].device == (unsigned short)PCI_ANY_ID ||
+                     ohci_quirks[i].device == dev->device) &&
+                    (ohci_quirks[i].revision == (unsigned short)PCI_ANY_ID ||
+                     ohci_quirks[i].revision >= dev->revision)) {
                         ohci->quirks = ohci_quirks[i].flags;
                         break;
                 }
         if (param_quirks)
                 ohci->quirks = param_quirks;
 
-        ar_context_init(&ohci->ar_request_ctx, ohci,
-                        OHCI1394_AsReqRcvContextControlSet);
+        /*
+         * Because dma_alloc_coherent() allocates at least one page,
+         * we save space by using a common buffer for the AR request/
+         * response descriptors and the self IDs buffer.
+         */
+        BUILD_BUG_ON(AR_BUFFERS * sizeof(struct descriptor) > PAGE_SIZE/4);
+        BUILD_BUG_ON(SELF_ID_BUF_SIZE > PAGE_SIZE/2);
+        ohci->misc_buffer = dma_alloc_coherent(ohci->card.device,
+                                               PAGE_SIZE,
+                                               &ohci->misc_buffer_bus,
+                                               GFP_KERNEL);
+        if (!ohci->misc_buffer) {
+                err = -ENOMEM;
+                goto fail_iounmap;
+        }
+
+        err = ar_context_init(&ohci->ar_request_ctx, ohci, 0,
+                              OHCI1394_AsReqRcvContextControlSet);
+        if (err < 0)
+                goto fail_misc_buf;
 
-        ar_context_init(&ohci->ar_response_ctx, ohci,
-                        OHCI1394_AsRspRcvContextControlSet);
+        err = ar_context_init(&ohci->ar_response_ctx, ohci, PAGE_SIZE/4,
+                              OHCI1394_AsRspRcvContextControlSet);
+        if (err < 0)
+                goto fail_arreq_ctx;
 
-        context_init(&ohci->at_request_ctx, ohci,
-                     OHCI1394_AsReqTrContextControlSet, handle_at_packet);
+        err = context_init(&ohci->at_request_ctx, ohci,
+                           OHCI1394_AsReqTrContextControlSet, handle_at_packet);
+        if (err < 0)
+                goto fail_arrsp_ctx;
 
-        context_init(&ohci->at_response_ctx, ohci,
-                     OHCI1394_AsRspTrContextControlSet, handle_at_packet);
+        err = context_init(&ohci->at_response_ctx, ohci,
+                           OHCI1394_AsRspTrContextControlSet, handle_at_packet);
+        if (err < 0)
+                goto fail_atreq_ctx;
 
         reg_write(ohci, OHCI1394_IsoRecvIntMaskSet, ~0);
         ohci->ir_context_channels = ~0ULL;
-        ohci->ir_context_mask = reg_read(ohci, OHCI1394_IsoRecvIntMaskSet);
+        ohci->ir_context_support = reg_read(ohci, OHCI1394_IsoRecvIntMaskSet);
         reg_write(ohci, OHCI1394_IsoRecvIntMaskClear, ~0);
-        n_ir = hweight32(ohci->ir_context_mask);
-        size = sizeof(struct iso_context) * n_ir;
+        ohci->ir_context_mask = ohci->ir_context_support;
+        ohci->n_ir = hweight32(ohci->ir_context_mask);
+        size = sizeof(struct iso_context) * ohci->n_ir;
         ohci->ir_context_list = kzalloc(size, GFP_KERNEL);
 
         reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
-        ohci->it_context_mask = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
+        ohci->it_context_support = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
         reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
-        n_it = hweight32(ohci->it_context_mask);
-        size = sizeof(struct iso_context) * n_it;
+        ohci->it_context_mask = ohci->it_context_support;
+        ohci->n_it = hweight32(ohci->it_context_mask);
+        size = sizeof(struct iso_context) * ohci->n_it;
         ohci->it_context_list = kzalloc(size, GFP_KERNEL);
 
         if (ohci->it_context_list == NULL || ohci->ir_context_list == NULL) {
@@ -2926,15 +3305,8 @@ static int __devinit pci_probe(struct pci_dev *dev,
                 goto fail_contexts;
         }
 
-        /* self-id dma buffer allocation */
-        ohci->self_id_cpu = dma_alloc_coherent(ohci->card.device,
-                                               SELF_ID_BUF_SIZE,
-                                               &ohci->self_id_bus,
-                                               GFP_KERNEL);
-        if (ohci->self_id_cpu == NULL) {
-                err = -ENOMEM;
-                goto fail_contexts;
-        }
+        ohci->self_id_cpu = ohci->misc_buffer     + PAGE_SIZE/2;
+        ohci->self_id_bus = ohci->misc_buffer_bus + PAGE_SIZE/2;
 
         bus_options = reg_read(ohci, OHCI1394_BusOptions);
         max_receive = (bus_options >> 12) & 0xf;
@@ -2944,33 +3316,37 @@ static int __devinit pci_probe(struct pci_dev *dev,
 
         err = fw_card_add(&ohci->card, max_receive, link_speed, guid);
         if (err)
-                goto fail_self_id;
+                goto fail_contexts;
 
         version = reg_read(ohci, OHCI1394_Version) & 0x00ff00ff;
         fw_notify("Added fw-ohci device %s, OHCI v%x.%x, "
                   "%d IR + %d IT contexts, quirks 0x%x\n",
                   dev_name(&dev->dev), version >> 16, version & 0xff,
-                  n_ir, n_it, ohci->quirks);
+                  ohci->n_ir, ohci->n_it, ohci->quirks);
 
         return 0;
 
- fail_self_id:
-        dma_free_coherent(ohci->card.device, SELF_ID_BUF_SIZE,
-                          ohci->self_id_cpu, ohci->self_id_bus);
  fail_contexts:
         kfree(ohci->ir_context_list);
         kfree(ohci->it_context_list);
         context_release(&ohci->at_response_ctx);
+ fail_atreq_ctx:
         context_release(&ohci->at_request_ctx);
+ fail_arrsp_ctx:
         ar_context_release(&ohci->ar_response_ctx);
+ fail_arreq_ctx:
         ar_context_release(&ohci->ar_request_ctx);
+ fail_misc_buf:
+        dma_free_coherent(ohci->card.device, PAGE_SIZE,
+                          ohci->misc_buffer, ohci->misc_buffer_bus);
+ fail_iounmap:
         pci_iounmap(dev, ohci->registers);
  fail_iomem:
         pci_release_region(dev, 0);
  fail_disable:
         pci_disable_device(dev);
  fail_free:
-        kfree(&ohci->card);
+        kfree(ohci);
         pmac_ohci_off(dev);
  fail:
         if (err == -ENOMEM)
@@ -3002,10 +3378,10 @@ static void pci_remove(struct pci_dev *dev)
         if (ohci->config_rom)
                 dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
                                   ohci->config_rom, ohci->config_rom_bus);
-        dma_free_coherent(ohci->card.device, SELF_ID_BUF_SIZE,
-                          ohci->self_id_cpu, ohci->self_id_bus);
         ar_context_release(&ohci->ar_request_ctx);
         ar_context_release(&ohci->ar_response_ctx);
+        dma_free_coherent(ohci->card.device, PAGE_SIZE,
+                          ohci->misc_buffer, ohci->misc_buffer_bus);
         context_release(&ohci->at_request_ctx);
         context_release(&ohci->at_response_ctx);
         kfree(ohci->it_context_list);
@@ -3014,7 +3390,7 @@ static void pci_remove(struct pci_dev *dev)
         pci_iounmap(dev, ohci->registers);
         pci_release_region(dev, 0);
         pci_disable_device(dev);
-        kfree(&ohci->card);
+        kfree(ohci);
         pmac_ohci_off(dev);
 
         fw_notify("Removed fw-ohci device.\n");
@@ -3056,7 +3432,20 @@ static int pci_resume(struct pci_dev *dev)
                 return err;
         }
 
-        return ohci_enable(&ohci->card, NULL, 0);
+        /* Some systems don't setup GUID register on resume from ram  */
+        if (!reg_read(ohci, OHCI1394_GUIDLo) &&
+                                        !reg_read(ohci, OHCI1394_GUIDHi)) {
+                reg_write(ohci, OHCI1394_GUIDLo, (u32)ohci->card.guid);
+                reg_write(ohci, OHCI1394_GUIDHi, (u32)(ohci->card.guid >> 32));
+        }
+
+        err = ohci_enable(&ohci->card, NULL, 0);
+        if (err)
+                return err;
+
+        ohci_resume_iso_dma(ohci);
+
+        return 0;
 }
 #endif
 
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index bfae4b309791..41841a3e3f99 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -125,9 +125,6 @@ MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
         ", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
         ", or a combination)");
 
-/* I don't know why the SCSI stack doesn't define something like this... */
-typedef void (*scsi_done_fn_t)(struct scsi_cmnd *);
-
 static const char sbp2_driver_name[] = "sbp2";
 
 /*
@@ -261,7 +258,6 @@ struct sbp2_orb {
         struct kref kref;
         dma_addr_t request_bus;
         int rcode;
-        struct sbp2_pointer pointer;
         void (*callback)(struct sbp2_orb * orb, struct sbp2_status * status);
         struct list_head link;
 };
@@ -314,7 +310,6 @@ struct sbp2_command_orb {
                 u8 command_block[SBP2_MAX_CDB_SIZE];
         } request;
         struct scsi_cmnd *cmd;
-        scsi_done_fn_t done;
         struct sbp2_logical_unit *lu;
 
         struct sbp2_pointer page_table[SG_ALL] __attribute__((aligned(8)));
@@ -472,18 +467,12 @@ static void complete_transaction(struct fw_card *card, int rcode,
          * So this callback only sets the rcode if it hasn't already
          * been set and only does the cleanup if the transaction
          * failed and we didn't already get a status write.
-         *
-         * Here we treat RCODE_CANCELLED like RCODE_COMPLETE because some
-         * OXUF936QSE firmwares occasionally respond after Split_Timeout and
-         * complete the ORB just fine.  Note, we also get RCODE_CANCELLED
-         * from sbp2_cancel_orbs() if fw_cancel_transaction() == 0.
          */
         spin_lock_irqsave(&card->lock, flags);
 
         if (orb->rcode == -1)
                 orb->rcode = rcode;
-
-        if (orb->rcode != RCODE_COMPLETE && orb->rcode != RCODE_CANCELLED) {
+        if (orb->rcode != RCODE_COMPLETE) {
                 list_del(&orb->link);
                 spin_unlock_irqrestore(&card->lock, flags);
 
@@ -500,10 +489,11 @@ static void sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
                           int node_id, int generation, u64 offset)
 {
         struct fw_device *device = target_device(lu->tgt);
+        struct sbp2_pointer orb_pointer;
         unsigned long flags;
 
-        orb->pointer.high = 0;
-        orb->pointer.low = cpu_to_be32(orb->request_bus);
+        orb_pointer.high = 0;
+        orb_pointer.low = cpu_to_be32(orb->request_bus);
 
         spin_lock_irqsave(&device->card->lock, flags);
         list_add_tail(&orb->link, &lu->orb_list);
@@ -514,7 +504,7 @@ static void sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
 
         fw_send_request(device->card, &orb->t, TCODE_WRITE_BLOCK_REQUEST,
                         node_id, generation, device->max_speed, offset,
-                        &orb->pointer, 8, complete_transaction, orb);
+                        &orb_pointer, 8, complete_transaction, orb);
 }
 
 static int sbp2_cancel_orbs(struct sbp2_logical_unit *lu)
@@ -532,7 +522,8 @@ static int sbp2_cancel_orbs(struct sbp2_logical_unit *lu)
 
         list_for_each_entry_safe(orb, next, &list, link) {
                 retval = 0;
-                fw_cancel_transaction(device->card, &orb->t);
+                if (fw_cancel_transaction(device->card, &orb->t) == 0)
+                        continue;
 
                 orb->rcode = RCODE_CANCELLED;
                 orb->callback(orb, NULL);
@@ -835,8 +826,6 @@ static void sbp2_target_put(struct sbp2_target *tgt)
         kref_put(&tgt->kref, sbp2_release_target);
 }
 
-static struct workqueue_struct *sbp2_wq;
-
 /*
  * Always get the target's kref when scheduling work on one its units.
  * Each workqueue job is responsible to call sbp2_target_put() upon return.
@@ -844,7 +833,7 @@ static struct workqueue_struct *sbp2_wq;
 static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
 {
         sbp2_target_get(lu->tgt);
-        if (!queue_delayed_work(sbp2_wq, &lu->work, delay))
+        if (!queue_delayed_work(fw_workqueue, &lu->work, delay))
                 sbp2_target_put(lu->tgt);
 }
 
@@ -1403,7 +1392,7 @@ static void complete_command_orb(struct sbp2_orb *base_orb,
         sbp2_unmap_scatterlist(device->card->device, orb);
 
         orb->cmd->result = result;
-        orb->done(orb->cmd);
+        orb->cmd->scsi_done(orb->cmd);
 }
 
 static int sbp2_map_scatterlist(struct sbp2_command_orb *orb,
@@ -1468,7 +1457,8 @@ static int sbp2_map_scatterlist(struct sbp2_command_orb *orb,
 
 /* SCSI stack integration */
 
-static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
+static int sbp2_scsi_queuecommand(struct Scsi_Host *shost,
+                                  struct scsi_cmnd *cmd)
 {
         struct sbp2_logical_unit *lu = cmd->device->hostdata;
         struct fw_device *device = target_device(lu->tgt);
@@ -1482,7 +1472,7 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
         if (cmd->sc_data_direction == DMA_BIDIRECTIONAL) {
                 fw_error("Can't handle DMA_BIDIRECTIONAL, rejecting command\n");
                 cmd->result = DID_ERROR << 16;
-                done(cmd);
+                cmd->scsi_done(cmd);
                 return 0;
         }
 
@@ -1495,11 +1485,8 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
         /* Initialize rcode to something not RCODE_COMPLETE. */
         orb->base.rcode = -1;
         kref_init(&orb->base.kref);
-
-        orb->lu   = lu;
-        orb->done = done;
-        orb->cmd  = cmd;
-
+        orb->lu = lu;
+        orb->cmd = cmd;
         orb->request.next.high = cpu_to_be32(SBP2_ORB_NULL);
         orb->request.misc = cpu_to_be32(
                 COMMAND_ORB_MAX_PAYLOAD(lu->tgt->max_payload) |
@@ -1656,17 +1643,12 @@ MODULE_ALIAS("sbp2");
 
 static int __init sbp2_init(void)
 {
-        sbp2_wq = create_singlethread_workqueue(KBUILD_MODNAME);
-        if (!sbp2_wq)
-                return -ENOMEM;
-
         return driver_register(&sbp2_driver.driver);
 }
 
 static void __exit sbp2_cleanup(void)
 {
         driver_unregister(&sbp2_driver.driver);
-        destroy_workqueue(sbp2_wq);
 }
 
 module_init(sbp2_init);