There is a DMA map/ unmap imbalance whenever a block write request
packet is sent and then dequeued with ohci_cancel_packet.  The latter
may happen frequently if the AR resp tasklet is executed before the AT
req tasklet for the same transaction.

Add the missing dma_unmap_single.  This fixes
https://bugzilla.redhat.com/show_bug.cgi?id=475156

Reported-by: Emmanuel Kowalski
Tested-by: Emmanuel Kowalski
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Share code between fw_send_request + wait_for_completion callers.
Signed-off-by: NJay Fenlason <fenlason@redhat.com>

Addendum:
Removes an unnecessary struct and an ununsed retry loop.
Calls it fw_run_transaction() instead of fw_send_request_sync().
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Acked-by: NKristian Høgsberg <krh@redhat.com>

Use only statically allocated data for PHY config packet transmission.
With the previous incarnation, some data wouldn't be freed if the packet
transmit callback was never called.

A theoretical drawback now is that, in PCs with more than one card,
card A may complete() for a waiter on card B.  But this is highly
unlikely and its impact not serious.  Bus manager B may reset bus B
before the PHY config went out, but the next phy config on B should be
fine.  However, with a timeout of 100ms, this situation is close to
impossible.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

  - better name for a function argument
  - removal of a local variable which became unnecessary after
    "fully initialize fw_transaction before marking it pending"
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

In theory, card->flush_timer could already access a transaction between
fw_send_request()'s spin_unlock_irqrestore and the rest of what happens
in fw_send_request().  This would happen if the process which sends the
request is preempted and put to sleep right after spin_unlock_irqrestore
for longer than 100ms.

Therefore we fill in everything in struct fw_transaction at which the
flush_timer might look at before we lift the lock.

To do:  Ensure that the timer does not pick up the transaction before
the time of the AT request event plus split transaction timeout.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Contrary to a comment in the source, request->ack of a broadcast write
request can be ACK_PENDING.  Hence the existing check is insufficient.

Debug dmesg before:
AR spd 0 tl 00, ffc0 -> ffff, ack_pending , QW req, fffff0000234 = ffffffff
AT spd 0 tl 00, ffff -> ffc0, ack_complete, W resp
And the requesting node (linux1394) reports an unsolicited response.

Debug dmesg after:
AR spd 0 tl 00, ffc0 -> ffff, ack_pending , QW req, fffff0000234 = ffffffff
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

See IEEE 1394a clause 8.3.2.3.11.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

If the low-level driver failed to initialize a card properly without
noticing it, fw-core was blocked indefinitely when trying to send a
PHY config packet.  This hung up the events kernel thread, e.g. locked
up keyboard input.
https://bugzilla.redhat.com/show_bug.cgi?id=444694
https://bugzilla.redhat.com/show_bug.cgi?id=446763

This problem was introduced between 2.6.25 and 2.6.26-rc1 by commit
2a0a2590 "firewire: wait until PHY
configuration packet was transmitted (fix bus reset loop)".

The solution is to wait with timeout.  I tested it with 7 different
working controllers and 1 non-working controller.  On the working ones,
the packet callback complete()s usually --- but not always --- before a
timeout of 10ms.  Hence I chose a safer timeout of 100ms.

On the few tests with the non-working controller ALi M5271, PHY config
packet transmission always timed out so far.  (Fw-ohci needs to be fixed
for this controller independently of this deadline fix.  Often the core
doesn't even attempt to send a phy config because not even self ID
reception works.)
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

BUG() at this place is wrong.  (Unless if the low level driver would
already do higher-level input validation of incoming request headers.)

Invalid incoming requests or bugs in the controller which corrupt the
AR-req buffer needlessly crashed the box because this is run in tasklet
context.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

None of these files use any of the functionality promised by
asm/semaphore.h.  It's possible that they rely on it dragging in some
unrelated header file, but I can't build all these files, so we'll have
fix any build failures as they come up.
Signed-off-by: NMatthew Wilcox <willy@linux.intel.com>

This patch contains the following cleanups:
- #if 0 the following unused structs:
  - fw-transaction.c:fw_low_memory_region
  - fw-transaction.c:fw_private_region
  - fw-transaction.c:fw_csr_region
  - fw-transaction.c:fw_unit_space_region
- remove the following unused EXPORT_SYMBOL's:
  - fw-card.c:fw_core_add_descriptor
  - fw-card.c:fw_core_remove_descriptor
  - fw-iso.c:fw_iso_context_create
  - fw-iso.c:fw_iso_context_destroy
  - fw-iso.c:fw_iso_context_start
  - fw-iso.c:fw_iso_context_queue
  - fw-iso.c:fw_iso_context_stop
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

We now exit fw_send_phy_config /after/ the PHY config packet has been
transmitted, instead of before.  A subsequent fw_core_initiate_bus_reset
will therefore not overlap with the transmission.  This is meant to make
the send PHY config packet + reset bus routine more deterministic.

Fixes bus reset loop and eventual panic with
  - VIA VT6307 + IOGEAR hub + Unibrain Fire-i camera
    http://bugzilla.kernel.org/show_bug.cgi?id=10128
  - JMicron card
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NJarod Wilson <jwilson@redhat.com>

for code efficiency.
Signed-off-by: NJarod Wilson <jwilson@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Trivial change to replace more meaningless (to the untrained eye) hex
values with defined CSR constants.
Signed-off-by: NJarod Wilson <jwilson@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

This fixes a use-after-free bug in the handling of split transactions.
The AT DMA handler of the request was occasionally executed after the
AR DMA handler of the response.  The AT DMA handler then accessed an
already freed packet.

Reported by Johannes Berg.
http://bugzilla.kernel.org/show_bug.cgi?id=9617Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Tested-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJarod Wilson <jwilson@redhat.com>

Kills warnings from 'make C=1 CHECKFLAGS="-D__CHECK_ENDIAN__" modules':

drivers/firewire/fw-transaction.c:771:10: warning: incorrect type in assignment (different base types)
drivers/firewire/fw-transaction.c:771:10:    expected unsigned int [unsigned] [usertype] <noident>
drivers/firewire/fw-transaction.c:771:10:    got restricted unsigned int [usertype] <noident>
drivers/firewire/fw-transaction.h:93:10: warning: incorrect type in assignment (different base types)
drivers/firewire/fw-transaction.h:93:10:    expected unsigned int [unsigned] [usertype] <noident>
drivers/firewire/fw-transaction.h:93:10:    got restricted unsigned int [usertype] <noident>
drivers/firewire/fw-ohci.c:1490:8: warning: restricted degrades to integer
drivers/firewire/fw-ohci.c:1490:35: warning: restricted degrades to integer
drivers/firewire/fw-ohci.c:1516:5: warning: cast to restricted type
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NJarod Wilson <jwilson@redhat.com>

Replace an unnecessary subtraction with a bitwise AND when determining the
value of ext_tcode in fw_fill_transaction() to save a cpu cycle or two in a
somewhat critical path.
Signed-off-by: NJarod Wilson <jwilson@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Fix extraction of the source node id from the packet header.
Signed-off-by: NRabin Vincent <rabin@rab.in>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NUwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
Signed-off-by: NAdrian Bunk <bunk@kernel.org>

Potentially avoids unnecessary loop runs.
Guarantee quadlet-aligned starts of address regions.
Document the return values.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Found and debugged by Jay Fenlason <fenlason@redhat.com>.
The bug was especially noticeable with direct I/O over fw-sbp2.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NKristian Høgsberg <krh@redhat.com>

This check is bogus:
  - Maximum asynchronous payload size for S800...S3200 is 4096.
  - The p->payload_length is totally uninteresting.  Only the
    request->length of the subsequently allocated and initialized
    struct fw_request is of significance.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NKristian Høgsberg <krh@redhat.com>

Signed-off-by: NKristian Hoegsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Hoegsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Drop filenames from file preamble, drop editor annotations and
use standard indent style for block comments.
Signed-off-by: NKristian Hoegsberg <krh@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (fixed typo)

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

The old mechanism kept a struct cdev for each fw device, but fops->release
would reference this struct after the device got freed in some cases.
Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

This lets us break out "Juju" as the model name in the config rom.
Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Drivers such as fw-sbp2 had no way to properly cancel in-progress
transactions, which could leave a pending transaction or an unset
packet in the low-level queues after kfree'ing the containing
structure. fw_cancel_transaction() lets drivers cancel a submitted
transaction.
Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

The old DMA program for receiving async packets stops DMA while
processing received packets and only expects one packet per
interrupt.  Stopping DMA can silently drop packets and we need to
handle multiple received packets per interrupt.

This new version keeps DMA running at all times and just append new
pages as buffers fill up, and supports multiple packets per interrupt.
Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Drop the negative errnos and use RCODEs for all error codes
in the complete transaction callback.
Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Signed-off-by: NKristian Høgsberg <krh@redhat.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>

Definitions as per IEEE 1212 and IEEE 1394:

     Node ID: Concatenation of bus ID and local ID. 16 bits long.
      Bus ID: Identifies a particular bus within a group of buses
              interconnected by bus bridges.
    Local ID: Identifies a particular node on a bus.
      PHY ID: Local ID of IEEE 1394 nodes. 6 bits long.

Never ever use a variable called node_id for anything else than a node ID.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>