1 files changed, 57 insertions, 39 deletions

diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
index 673b03f8b4e..fdc33ff06dc 100644
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -81,7 +81,7 @@ static int close_transaction(struct fw_transaction *transaction,
 	spin_lock_irqsave(&card->lock, flags);
 	list_for_each_entry(t, &card->transaction_list, link) {
 		if (t == transaction) {
-			list_del(&t->link);
+			list_del_init(&t->link);
 			card->tlabel_mask &= ~(1ULL << t->tlabel);
 			break;
 		}
@@ -89,6 +89,7 @@ static int close_transaction(struct fw_transaction *transaction,
 	spin_unlock_irqrestore(&card->lock, flags);
 
 	if (&t->link != &card->transaction_list) {
+		del_timer_sync(&t->split_timeout_timer);
 		t->callback(card, rcode, NULL, 0, t->callback_data);
 		return 0;
 	}
@@ -121,6 +122,31 @@ int fw_cancel_transaction(struct fw_card *card,
 }
 EXPORT_SYMBOL(fw_cancel_transaction);
 
+static void split_transaction_timeout_callback(unsigned long data)
+{
+	struct fw_transaction *t = (struct fw_transaction *)data;
+	struct fw_card *card = t->card;
+	unsigned long flags;
+
+	spin_lock_irqsave(&card->lock, flags);
+	if (list_empty(&t->link)) {
+		spin_unlock_irqrestore(&card->lock, flags);
+		return;
+	}
+	list_del(&t->link);
+	card->tlabel_mask &= ~(1ULL << t->tlabel);
+	spin_unlock_irqrestore(&card->lock, flags);
+
+	card->driver->cancel_packet(card, &t->packet);
+
+	/*
+	 * At this point cancel_packet will never call the transaction
+	 * callback, since we just took the transaction out of the list.
+	 * So do it here.
+	 */
+	t->callback(card, RCODE_CANCELLED, NULL, 0, t->callback_data);
+}
+
 static void transmit_complete_callback(struct fw_packet *packet,
 				       struct fw_card *card, int status)
 {
@@ -229,6 +255,23 @@ static void fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
 	packet->payload_mapped = false;
 }
 
+static int allocate_tlabel(struct fw_card *card)
+{
+	int tlabel;
+
+	tlabel = card->current_tlabel;
+	while (card->tlabel_mask & (1ULL << tlabel)) {
+		tlabel = (tlabel + 1) & 0x3f;
+		if (tlabel == card->current_tlabel)
+			return -EBUSY;
+	}
+
+	card->current_tlabel = (tlabel + 1) & 0x3f;
+	card->tlabel_mask |= 1ULL << tlabel;
+
+	return tlabel;
+}
+
 /**
  * This function provides low-level access to the IEEE1394 transaction
  * logic.  Most C programs would use either fw_read(), fw_write() or
@@ -277,31 +320,26 @@ void fw_send_request(struct fw_card *card, struct fw_transaction *t, int tcode,
 	int tlabel;
 
 	/*
-	 * Bump the flush timer up 100ms first of all so we
-	 * don't race with a flush timer callback.
-	 */
-
-	mod_timer(&card->flush_timer, jiffies + DIV_ROUND_UP(HZ, 10));
-
-	/*
 	 * Allocate tlabel from the bitmap and put the transaction on
 	 * the list while holding the card spinlock.
 	 */
 
 	spin_lock_irqsave(&card->lock, flags);
 
-	tlabel = card->current_tlabel;
-	if (card->tlabel_mask & (1ULL << tlabel)) {
+	tlabel = allocate_tlabel(card);
+	if (tlabel < 0) {
 		spin_unlock_irqrestore(&card->lock, flags);
 		callback(card, RCODE_SEND_ERROR, NULL, 0, callback_data);
 		return;
 	}
 
-	card->current_tlabel = (card->current_tlabel + 1) & 0x3f;
-	card->tlabel_mask |= (1ULL << tlabel);
-
 	t->node_id = destination_id;
 	t->tlabel = tlabel;
+	t->card = card;
+	setup_timer(&t->split_timeout_timer,
+		    split_transaction_timeout_callback, (unsigned long)t);
+	/* FIXME: start this timer later, relative to t->timestamp */
+	mod_timer(&t->split_timeout_timer, jiffies + DIV_ROUND_UP(HZ, 10));
 	t->callback = callback;
 	t->callback_data = callback_data;
 
@@ -347,11 +385,13 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
 	struct transaction_callback_data d;
 	struct fw_transaction t;
 
+	init_timer_on_stack(&t.split_timeout_timer);
 	init_completion(&d.done);
 	d.payload = payload;
 	fw_send_request(card, &t, tcode, destination_id, generation, speed,
 			offset, payload, length, transaction_callback, &d);
 	wait_for_completion(&d.done);
+	destroy_timer_on_stack(&t.split_timeout_timer);
 
 	return d.rcode;
 }
@@ -394,30 +434,6 @@ void fw_send_phy_config(struct fw_card *card,
 	mutex_unlock(&phy_config_mutex);
 }
 
-void fw_flush_transactions(struct fw_card *card)
-{
-	struct fw_transaction *t, *next;
-	struct list_head list;
-	unsigned long flags;
-
-	INIT_LIST_HEAD(&list);
-	spin_lock_irqsave(&card->lock, flags);
-	list_splice_init(&card->transaction_list, &list);
-	card->tlabel_mask = 0;
-	spin_unlock_irqrestore(&card->lock, flags);
-
-	list_for_each_entry_safe(t, next, &list, link) {
-		card->driver->cancel_packet(card, &t->packet);
-
-		/*
-		 * At this point cancel_packet will never call the
-		 * transaction callback, since we just took all the
-		 * transactions out of the list.  So do it here.
-		 */
-		t->callback(card, RCODE_CANCELLED, NULL, 0, t->callback_data);
-	}
-}
-
 static struct fw_address_handler *lookup_overlapping_address_handler(
 	struct list_head *list, unsigned long long offset, size_t length)
 {
@@ -827,8 +843,8 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
 	spin_lock_irqsave(&card->lock, flags);
 	list_for_each_entry(t, &card->transaction_list, link) {
 		if (t->node_id == source && t->tlabel == tlabel) {
-			list_del(&t->link);
-			card->tlabel_mask &= ~(1 << t->tlabel);
+			list_del_init(&t->link);
+			card->tlabel_mask &= ~(1ULL << t->tlabel);
 			break;
 		}
 	}
@@ -869,6 +885,8 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
 		break;
 	}
 
+	del_timer_sync(&t->split_timeout_timer);
+
 	/*
 	 * The response handler may be executed while the request handler
 	 * is still pending.  Cancel the request handler.