linux1394-2.6.git tree vs. linus v2.6.29-rc3-git1 on 20090130 by jarod

---

 firewire-git/drivers/firewire/fw-card.c        |   68 -

 firewire-git/drivers/firewire/fw-cdev.c        | 1014 +++++++++++++++++--------

 firewire-git/drivers/firewire/fw-device.c      |   43 -

 firewire-git/drivers/firewire/fw-device.h      |    7 

 firewire-git/drivers/firewire/fw-iso.c         |  225 ++++-

 firewire-git/drivers/firewire/fw-ohci.c        |  236 ++---

 firewire-git/drivers/firewire/fw-sbp2.c        |   57 -

 firewire-git/drivers/firewire/fw-topology.c    |   28 

 firewire-git/drivers/firewire/fw-topology.h    |   19 

 firewire-git/drivers/firewire/fw-transaction.c |  151 +--

 firewire-git/drivers/firewire/fw-transaction.h |  125 ---

 include/linux/firewire-cdev.h                  |  170 +++-

 12 files changed, 1359 insertions(+), 784 deletions(-)

diff -Naurp linux-2.6-git/drivers/firewire/fw-card.c firewire-git/drivers/firewire/fw-card.c

--- linux-2.6-git/drivers/firewire/fw-card.c	2009-01-30 13:39:02.989651512 -0500

+++ firewire-git/drivers/firewire/fw-card.c	2009-01-30 13:35:51.859771884 -0500

@@ -63,8 +63,7 @@ static int descriptor_count;

 #define BIB_CMC			((1) << 30)

 #define BIB_IMC			((1) << 31)

-static u32 *

-generate_config_rom(struct fw_card *card, size_t *config_rom_length)

+static u32 *generate_config_rom(struct fw_card *card, size_t *config_rom_length)

 {

 	struct fw_descriptor *desc;

 	static u32 config_rom[256];

@@ -128,8 +127,7 @@ generate_config_rom(struct fw_card *card

 	return config_rom;

 }

-static void

-update_config_roms(void)

+static void update_config_roms(void)

 {

 	struct fw_card *card;

 	u32 *config_rom;

@@ -141,8 +139,7 @@ update_config_roms(void)

 	}

 }

-int

-fw_core_add_descriptor(struct fw_descriptor *desc)

+int fw_core_add_descriptor(struct fw_descriptor *desc)

 {

 	size_t i;

@@ -171,8 +168,7 @@ fw_core_add_descriptor(struct fw_descrip

 	return 0;

 }

-void

-fw_core_remove_descriptor(struct fw_descriptor *desc)

+void fw_core_remove_descriptor(struct fw_descriptor *desc)

 {

 	mutex_lock(&card_mutex);

@@ -189,8 +185,7 @@ static const char gap_count_table[] = {

 	63, 5, 7, 8, 10, 13, 16, 18, 21, 24, 26, 29, 32, 35, 37, 40

 };

-void

-fw_schedule_bm_work(struct fw_card *card, unsigned long delay)

+void fw_schedule_bm_work(struct fw_card *card, unsigned long delay)

 {

 	int scheduled;

@@ -200,8 +195,7 @@ fw_schedule_bm_work(struct fw_card *card

 		fw_card_put(card);

 }

-static void

-fw_card_bm_work(struct work_struct *work)

+static void fw_card_bm_work(struct work_struct *work)

 {

 	struct fw_card *card = container_of(work, struct fw_card, work.work);

 	struct fw_device *root_device;

@@ -371,17 +365,16 @@ fw_card_bm_work(struct work_struct *work

 	fw_card_put(card);

 }

-static void

-flush_timer_callback(unsigned long data)

+static void flush_timer_callback(unsigned long data)

 {

 	struct fw_card *card = (struct fw_card *)data;

 	fw_flush_transactions(card);

 }

-void

-fw_card_initialize(struct fw_card *card, const struct fw_card_driver *driver,

-		   struct device *device)

+void fw_card_initialize(struct fw_card *card,

+			const struct fw_card_driver *driver,

+			struct device *device)

 {

 	static atomic_t index = ATOMIC_INIT(-1);

@@ -406,9 +399,8 @@ fw_card_initialize(struct fw_card *card,

 }

 EXPORT_SYMBOL(fw_card_initialize);

-int

-fw_card_add(struct fw_card *card,

-	    u32 max_receive, u32 link_speed, u64 guid)

+int fw_card_add(struct fw_card *card,

+		u32 max_receive, u32 link_speed, u64 guid)

 {

 	u32 *config_rom;

 	size_t length;

@@ -435,23 +427,20 @@ EXPORT_SYMBOL(fw_card_add);

  * dummy driver just fails all IO.

  */

-static int

-dummy_enable(struct fw_card *card, u32 *config_rom, size_t length)

+static int dummy_enable(struct fw_card *card, u32 *config_rom, size_t length)

 {

 	BUG();

 	return -1;

 }

-static int

-dummy_update_phy_reg(struct fw_card *card, int address,

-		     int clear_bits, int set_bits)

+static int dummy_update_phy_reg(struct fw_card *card, int address,

+				int clear_bits, int set_bits)

 {

 	return -ENODEV;

 }

-static int

-dummy_set_config_rom(struct fw_card *card,

-		     u32 *config_rom, size_t length)

+static int dummy_set_config_rom(struct fw_card *card,

+				u32 *config_rom, size_t length)

 {

 	/*

 	 * We take the card out of card_list before setting the dummy

@@ -461,27 +450,23 @@ dummy_set_config_rom(struct fw_card *car

 	return -1;

 }

-static void

-dummy_send_request(struct fw_card *card, struct fw_packet *packet)

+static void dummy_send_request(struct fw_card *card, struct fw_packet *packet)

 {

 	packet->callback(packet, card, -ENODEV);

 }

-static void

-dummy_send_response(struct fw_card *card, struct fw_packet *packet)

+static void dummy_send_response(struct fw_card *card, struct fw_packet *packet)

 {

 	packet->callback(packet, card, -ENODEV);

 }

-static int

-dummy_cancel_packet(struct fw_card *card, struct fw_packet *packet)

+static int dummy_cancel_packet(struct fw_card *card, struct fw_packet *packet)

 {

 	return -ENOENT;

 }

-static int

-dummy_enable_phys_dma(struct fw_card *card,

-		      int node_id, int generation)

+static int dummy_enable_phys_dma(struct fw_card *card,

+				 int node_id, int generation)

 {

 	return -ENODEV;

 }

@@ -496,16 +481,14 @@ static struct fw_card_driver dummy_drive

 	.enable_phys_dma = dummy_enable_phys_dma,

 };

-void

-fw_card_release(struct kref *kref)

+void fw_card_release(struct kref *kref)

 {

 	struct fw_card *card = container_of(kref, struct fw_card, kref);

 	complete(&card->done);

 }

-void

-fw_core_remove_card(struct fw_card *card)

+void fw_core_remove_card(struct fw_card *card)

 {

 	card->driver->update_phy_reg(card, 4,

 				     PHY_LINK_ACTIVE | PHY_CONTENDER, 0);

@@ -529,8 +512,7 @@ fw_core_remove_card(struct fw_card *card

 }

 EXPORT_SYMBOL(fw_core_remove_card);

-int

-fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)

+int fw_core_initiate_bus_reset(struct fw_card *card, int short_reset)

 {

 	int reg = short_reset ? 5 : 1;

 	int bit = short_reset ? PHY_BUS_SHORT_RESET : PHY_BUS_RESET;

diff -Naurp linux-2.6-git/drivers/firewire/fw-cdev.c firewire-git/drivers/firewire/fw-cdev.c

--- linux-2.6-git/drivers/firewire/fw-cdev.c	2008-11-04 11:19:19.000000000 -0500

+++ firewire-git/drivers/firewire/fw-cdev.c	2009-01-30 13:35:51.860646788 -0500

@@ -18,87 +18,162 @@

  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

  */

-#include <linux/module.h>

-#include <linux/kernel.h>

-#include <linux/wait.h>

-#include <linux/errno.h>

+#include <linux/compat.h>

+#include <linux/delay.h>

 #include <linux/device.h>

-#include <linux/vmalloc.h>

+#include <linux/errno.h>

+#include <linux/firewire-cdev.h>

+#include <linux/idr.h>

+#include <linux/jiffies.h>

+#include <linux/kernel.h>

+#include <linux/kref.h>

+#include <linux/mm.h>

+#include <linux/module.h>

+#include <linux/mutex.h>

 #include <linux/poll.h>

 #include <linux/preempt.h>

+#include <linux/spinlock.h>

 #include <linux/time.h>

-#include <linux/delay.h>

-#include <linux/mm.h>

-#include <linux/idr.h>

-#include <linux/compat.h>

-#include <linux/firewire-cdev.h>

+#include <linux/vmalloc.h>

+#include <linux/wait.h>

+#include <linux/workqueue.h>

+

 #include <asm/system.h>

 #include <asm/uaccess.h>

-#include "fw-transaction.h"

-#include "fw-topology.h"

+

 #include "fw-device.h"

+#include "fw-topology.h"

+#include "fw-transaction.h"

+

+struct client {

+	u32 version;

+	struct fw_device *device;

+

+	spinlock_t lock;

+	bool in_shutdown;

+	struct idr resource_idr;

+	struct list_head event_list;

+	wait_queue_head_t wait;

+	u64 bus_reset_closure;

+

+	struct fw_iso_context *iso_context;

+	u64 iso_closure;

+	struct fw_iso_buffer buffer;

+	unsigned long vm_start;

-struct client;

-struct client_resource {

 	struct list_head link;

-	void (*release)(struct client *client, struct client_resource *r);

-	u32 handle;

+	struct kref kref;

+};

+

+static inline void client_get(struct client *client)

+{

+	kref_get(&client->kref);

+}

+

+static void client_release(struct kref *kref)

+{

+	struct client *client = container_of(kref, struct client, kref);

+

+	fw_device_put(client->device);

+	kfree(client);

+}

+

+static void client_put(struct client *client)

+{

+	kref_put(&client->kref, client_release);

+}

+

+struct client_resource;

+typedef void (*client_resource_release_fn_t)(struct client *,

+					     struct client_resource *);

+struct client_resource {

+	client_resource_release_fn_t release;

+	int handle;

+};

+

+struct address_handler_resource {

+	struct client_resource resource;

+	struct fw_address_handler handler;

+	__u64 closure;

+	struct client *client;

+};

+

+struct outbound_transaction_resource {

+	struct client_resource resource;

+	struct fw_transaction transaction;

+};

+

+struct inbound_transaction_resource {

+	struct client_resource resource;

+	struct fw_request *request;

+	void *data;

+	size_t length;

 };

+struct descriptor_resource {

+	struct client_resource resource;

+	struct fw_descriptor descriptor;

+	u32 data[0];

+};

+

+struct iso_resource {

+	struct client_resource resource;

+	struct client *client;

+	/* Schedule work and access todo only with client->lock held. */

+	struct delayed_work work;

+	enum {ISO_RES_ALLOC, ISO_RES_REALLOC, ISO_RES_DEALLOC,

+	      ISO_RES_ALLOC_ONCE, ISO_RES_DEALLOC_ONCE,} todo;

+	int generation;

+	u64 channels;

+	s32 bandwidth;

+	struct iso_resource_event *e_alloc, *e_dealloc;

+};

+

+static void schedule_iso_resource(struct iso_resource *);

+static void release_iso_resource(struct client *, struct client_resource *);

+

 /*

  * dequeue_event() just kfree()'s the event, so the event has to be

- * the first field in the struct.

+ * the first field in a struct XYZ_event.

  */

-

 struct event {

 	struct { void *data; size_t size; } v[2];

 	struct list_head link;

 };

-struct bus_reset {

+struct bus_reset_event {

 	struct event event;

 	struct fw_cdev_event_bus_reset reset;

 };

-struct response {

+struct outbound_transaction_event {

 	struct event event;

-	struct fw_transaction transaction;

 	struct client *client;

-	struct client_resource resource;

+	struct outbound_transaction_resource r;

 	struct fw_cdev_event_response response;

 };

-struct iso_interrupt {

+struct inbound_transaction_event {

 	struct event event;

-	struct fw_cdev_event_iso_interrupt interrupt;

+	struct fw_cdev_event_request request;

 };

-struct client {

-	u32 version;

-	struct fw_device *device;

-	spinlock_t lock;

-	u32 resource_handle;

-	struct list_head resource_list;

-	struct list_head event_list;

-	wait_queue_head_t wait;

-	u64 bus_reset_closure;

-

-	struct fw_iso_context *iso_context;

-	u64 iso_closure;

-	struct fw_iso_buffer buffer;

-	unsigned long vm_start;

+struct iso_interrupt_event {

+	struct event event;

+	struct fw_cdev_event_iso_interrupt interrupt;

+};

-	struct list_head link;

+struct iso_resource_event {

+	struct event event;

+	struct fw_cdev_event_iso_resource resource;

 };

-static inline void __user *

-u64_to_uptr(__u64 value)

+static inline void __user *u64_to_uptr(__u64 value)

 {

 	return (void __user *)(unsigned long)value;

 }

-static inline __u64

-uptr_to_u64(void __user *ptr)

+static inline __u64 uptr_to_u64(void __user *ptr)

 {

 	return (__u64)(unsigned long)ptr;

 }

@@ -107,7 +182,6 @@ static int fw_device_op_open(struct inod

 {

 	struct fw_device *device;

 	struct client *client;

-	unsigned long flags;

 	device = fw_device_get_by_devt(inode->i_rdev);

 	if (device == NULL)

@@ -125,16 +199,17 @@ static int fw_device_op_open(struct inod

 	}

 	client->device = device;

-	INIT_LIST_HEAD(&client->event_list);

-	INIT_LIST_HEAD(&client->resource_list);

 	spin_lock_init(&client->lock);

+	idr_init(&client->resource_idr);

+	INIT_LIST_HEAD(&client->event_list);

 	init_waitqueue_head(&client->wait);

+	kref_init(&client->kref);

 	file->private_data = client;

-	spin_lock_irqsave(&device->card->lock, flags);

+	mutex_lock(&device->client_list_mutex);

 	list_add_tail(&client->link, &device->client_list);

-	spin_unlock_irqrestore(&device->card->lock, flags);

+	mutex_unlock(&device->client_list_mutex);

 	return 0;

 }

@@ -150,68 +225,69 @@ static void queue_event(struct client *c

 	event->v[1].size = size1;

 	spin_lock_irqsave(&client->lock, flags);

-	list_add_tail(&event->link, &client->event_list);

+	if (client->in_shutdown)

+		kfree(event);

+	else

+		list_add_tail(&event->link, &client->event_list);

 	spin_unlock_irqrestore(&client->lock, flags);

 	wake_up_interruptible(&client->wait);

 }

-static int

-dequeue_event(struct client *client, char __user *buffer, size_t count)

+static int dequeue_event(struct client *client,

+			 char __user *buffer, size_t count)

 {

-	unsigned long flags;

 	struct event *event;

 	size_t size, total;

-	int i, retval;

+	int i, ret;

-	retval = wait_event_interruptible(client->wait,

-					  !list_empty(&client->event_list) ||

-					  fw_device_is_shutdown(client->device));

-	if (retval < 0)

-		return retval;

+	ret = wait_event_interruptible(client->wait,

+			!list_empty(&client->event_list) ||

+			fw_device_is_shutdown(client->device));

+	if (ret < 0)

+		return ret;

 	if (list_empty(&client->event_list) &&

 		       fw_device_is_shutdown(client->device))

 		return -ENODEV;

-	spin_lock_irqsave(&client->lock, flags);

-	event = container_of(client->event_list.next, struct event, link);

+	spin_lock_irq(&client->lock);

+	event = list_first_entry(&client->event_list, struct event, link);

 	list_del(&event->link);

-	spin_unlock_irqrestore(&client->lock, flags);

+	spin_unlock_irq(&client->lock);

 	total = 0;

 	for (i = 0; i < ARRAY_SIZE(event->v) && total < count; i++) {

 		size = min(event->v[i].size, count - total);

 		if (copy_to_user(buffer + total, event->v[i].data, size)) {

-			retval = -EFAULT;

+			ret = -EFAULT;

 			goto out;

 		}

 		total += size;

 	}

-	retval = total;

+	ret = total;

  out:

 	kfree(event);

-	return retval;

+	return ret;

 }

-static ssize_t

-fw_device_op_read(struct file *file,

-		  char __user *buffer, size_t count, loff_t *offset)

+static ssize_t fw_device_op_read(struct file *file, char __user *buffer,

+				 size_t count, loff_t *offset)

 {

 	struct client *client = file->private_data;

 	return dequeue_event(client, buffer, count);

 }

-/* caller must hold card->lock so that node pointers can be dereferenced here */

-static void

-fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,

-		     struct client *client)

+static void fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,

+				 struct client *client)

 {

 	struct fw_card *card = client->device->card;

+	spin_lock_irq(&card->lock);

+

 	event->closure	     = client->bus_reset_closure;

 	event->type          = FW_CDEV_EVENT_BUS_RESET;

 	event->generation    = client->device->generation;

@@ -220,39 +296,49 @@ fill_bus_reset_event(struct fw_cdev_even

 	event->bm_node_id    = 0; /* FIXME: We don't track the BM. */

 	event->irm_node_id   = card->irm_node->node_id;

 	event->root_node_id  = card->root_node->node_id;

+

+	spin_unlock_irq(&card->lock);

 }

-static void

-for_each_client(struct fw_device *device,

-		void (*callback)(struct client *client))

+static void for_each_client(struct fw_device *device,

+			    void (*callback)(struct client *client))

 {

-	struct fw_card *card = device->card;

 	struct client *c;

-	unsigned long flags;

-

-	spin_lock_irqsave(&card->lock, flags);

+	mutex_lock(&device->client_list_mutex);

 	list_for_each_entry(c, &device->client_list, link)

 		callback(c);

+	mutex_unlock(&device->client_list_mutex);

+}

+

+static int schedule_reallocations(int id, void *p, void *data)

+{

+	struct client_resource *r = p;

-	spin_unlock_irqrestore(&card->lock, flags);

+	if (r->release == release_iso_resource)

+		schedule_iso_resource(container_of(r,

+					struct iso_resource, resource));

+	return 0;

 }

-static void

-queue_bus_reset_event(struct client *client)

+static void queue_bus_reset_event(struct client *client)

 {

-	struct bus_reset *bus_reset;

+	struct bus_reset_event *e;

-	bus_reset = kzalloc(sizeof(*bus_reset), GFP_ATOMIC);

-	if (bus_reset == NULL) {

+	e = kzalloc(sizeof(*e), GFP_KERNEL);

+	if (e == NULL) {

 		fw_notify("Out of memory when allocating bus reset event\n");

 		return;

 	}

-	fill_bus_reset_event(&bus_reset->reset, client);

+	fill_bus_reset_event(&e->reset, client);

+

+	queue_event(client, &e->event,

+		    &e->reset, sizeof(e->reset), NULL, 0);

-	queue_event(client, &bus_reset->event,

-		    &bus_reset->reset, sizeof(bus_reset->reset), NULL, 0);

+	spin_lock_irq(&client->lock);

+	idr_for_each(&client->resource_idr, schedule_reallocations, client);

+	spin_unlock_irq(&client->lock);

 }

 void fw_device_cdev_update(struct fw_device *device)

@@ -274,11 +360,11 @@ static int ioctl_get_info(struct client 

 {

 	struct fw_cdev_get_info *get_info = buffer;

 	struct fw_cdev_event_bus_reset bus_reset;

-	struct fw_card *card = client->device->card;

 	unsigned long ret = 0;

 	client->version = get_info->version;

 	get_info->version = FW_CDEV_VERSION;

+	get_info->card = client->device->card->index;

 	down_read(&fw_device_rwsem);

@@ -300,49 +386,61 @@ static int ioctl_get_info(struct client 

 	client->bus_reset_closure = get_info->bus_reset_closure;

 	if (get_info->bus_reset != 0) {

 		void __user *uptr = u64_to_uptr(get_info->bus_reset);

-		unsigned long flags;

-		spin_lock_irqsave(&card->lock, flags);

 		fill_bus_reset_event(&bus_reset, client);

-		spin_unlock_irqrestore(&card->lock, flags);

-

 		if (copy_to_user(uptr, &bus_reset, sizeof(bus_reset)))

 			return -EFAULT;

 	}

-	get_info->card = card->index;

-

 	return 0;

 }

-static void

-add_client_resource(struct client *client, struct client_resource *resource)

+static int add_client_resource(struct client *client,

+			       struct client_resource *resource, gfp_t gfp_mask)

 {

 	unsigned long flags;

+	int ret;

+

+ retry:

+	if (idr_pre_get(&client->resource_idr, gfp_mask | __GFP_ZERO) == 0)

+		return -ENOMEM;

 	spin_lock_irqsave(&client->lock, flags);

-	list_add_tail(&resource->link, &client->resource_list);

-	resource->handle = client->resource_handle++;

+	if (client->in_shutdown)

+		ret = -ECANCELED;

+	else

+		ret = idr_get_new(&client->resource_idr, resource,

+				  &resource->handle);

+	if (ret >= 0) {

+		client_get(client);

+		if (resource->release == release_iso_resource)

+			schedule_iso_resource(container_of(resource,

+						struct iso_resource, resource));

+	}

 	spin_unlock_irqrestore(&client->lock, flags);

+

+	if (ret == -EAGAIN)

+		goto retry;

+

+	return ret < 0 ? ret : 0;

 }

-static int

-release_client_resource(struct client *client, u32 handle,

-			struct client_resource **resource)

+static int release_client_resource(struct client *client, u32 handle,

+				   client_resource_release_fn_t release,

+				   struct client_resource **resource)

 {

 	struct client_resource *r;

-	unsigned long flags;

-	spin_lock_irqsave(&client->lock, flags);

-	list_for_each_entry(r, &client->resource_list, link) {

-		if (r->handle == handle) {

-			list_del(&r->link);

-			break;

-		}

-	}

-	spin_unlock_irqrestore(&client->lock, flags);

+	spin_lock_irq(&client->lock);

+	if (client->in_shutdown)

+		r = NULL;

+	else

+		r = idr_find(&client->resource_idr, handle);

+	if (r && r->release == release)

+		idr_remove(&client->resource_idr, handle);

+	spin_unlock_irq(&client->lock);

-	if (&r->link == &client->resource_list)

+	if (!(r && r->release == release))

 		return -EINVAL;

 	if (resource)

@@ -350,203 +448,242 @@ release_client_resource(struct client *c

 	else

 		r->release(client, r);

+	client_put(client);

+

 	return 0;

 }

-static void

-release_transaction(struct client *client, struct client_resource *resource)

+static void release_transaction(struct client *client,

+				struct client_resource *resource)

 {

-	struct response *response =

-		container_of(resource, struct response, resource);

+	struct outbound_transaction_resource *r = container_of(resource,

+			struct outbound_transaction_resource, resource);

-	fw_cancel_transaction(client->device->card, &response->transaction);

+	fw_cancel_transaction(client->device->card, &r->transaction);

 }

-static void

-complete_transaction(struct fw_card *card, int rcode,

-		     void *payload, size_t length, void *data)

+static void complete_transaction(struct fw_card *card, int rcode,

+				 void *payload, size_t length, void *data)

 {

-	struct response *response = data;

-	struct client *client = response->client;

+	struct outbound_transaction_event *e = data;

+	struct fw_cdev_event_response *rsp = &e->response;

+	struct client *client = e->client;

 	unsigned long flags;

-	struct fw_cdev_event_response *r = &response->response;

-	if (length < r->length)

-		r->length = length;

+	if (length < rsp->length)

+		rsp->length = length;

 	if (rcode == RCODE_COMPLETE)

-		memcpy(r->data, payload, r->length);

+		memcpy(rsp->data, payload, rsp->length);

 	spin_lock_irqsave(&client->lock, flags);

-	list_del(&response->resource.link);

+	/*

+	 * 1. If called while in shutdown, the idr tree must be left untouched.

+	 *    The idr handle will be removed and the client reference will be

+	 *    dropped later.

+	 * 2. If the call chain was release_client_resource ->

+	 *    release_transaction -> complete_transaction (instead of a normal

+	 *    conclusion of the transaction), i.e. if this resource was already

+	 *    unregistered from the idr, the client reference will be dropped

+	 *    by release_client_resource and we must not drop it here.

+	 */

+	if (!client->in_shutdown &&

+	    idr_find(&client->resource_idr, e->r.resource.handle)) {

+		idr_remove(&client->resource_idr, e->r.resource.handle);

+		/* Drop the idr's reference */

+		client_put(client);

+	}

 	spin_unlock_irqrestore(&client->lock, flags);

-	r->type   = FW_CDEV_EVENT_RESPONSE;

-	r->rcode  = rcode;

+	rsp->type = FW_CDEV_EVENT_RESPONSE;

+	rsp->rcode = rcode;

 	/*

-	 * In the case that sizeof(*r) doesn't align with the position of the

+	 * In the case that sizeof(*rsp) doesn't align with the position of the

 	 * data, and the read is short, preserve an extra copy of the data

 	 * to stay compatible with a pre-2.6.27 bug.  Since the bug is harmless

 	 * for short reads and some apps depended on it, this is both safe

 	 * and prudent for compatibility.

 	 */

-	if (r->length <= sizeof(*r) - offsetof(typeof(*r), data))

-		queue_event(client, &response->event, r, sizeof(*r),

-			    r->data, r->length);

+	if (rsp->length <= sizeof(*rsp) - offsetof(typeof(*rsp), data))

+		queue_event(client, &e->event, rsp, sizeof(*rsp),

+			    rsp->data, rsp->length);

 	else

-		queue_event(client, &response->event, r, sizeof(*r) + r->length,

+		queue_event(client, &e->event, rsp, sizeof(*rsp) + rsp->length,

 			    NULL, 0);

+

+	/* Drop the transaction callback's reference */

+	client_put(client);

 }

-static int ioctl_send_request(struct client *client, void *buffer)

+static int init_request(struct client *client,

+			struct fw_cdev_send_request *request,

+			int destination_id, int speed)

 {

-	struct fw_device *device = client->device;

-	struct fw_cdev_send_request *request = buffer;

-	struct response *response;

+	struct outbound_transaction_event *e;

+	int ret;

-	/* What is the biggest size we'll accept, really? */

-	if (request->length > 4096)

-		return -EINVAL;

+	if (request->length > 4096 || request->length > 512 << speed)

+		return -EIO;

-	response = kmalloc(sizeof(*response) + request->length, GFP_KERNEL);

-	if (response == NULL)

+	e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL);

+	if (e == NULL)

 		return -ENOMEM;

-	response->client = client;

-	response->response.length = request->length;

-	response->response.closure = request->closure;

+	e->client = client;

+	e->response.length = request->length;

+	e->response.closure = request->closure;

 	if (request->data &&

-	    copy_from_user(response->response.data,

+	    copy_from_user(e->response.data,

 			   u64_to_uptr(request->data), request->length)) {

-		kfree(response);

-		return -EFAULT;

+		ret = -EFAULT;

+		goto failed;

 	}

-	response->resource.release = release_transaction;

-	add_client_resource(client, &response->resource);

-

-	fw_send_request(device->card, &response->transaction,

-			request->tcode & 0x1f,

-			device->node->node_id,

-			request->generation,

-			device->max_speed,

-			request->offset,

-			response->response.data, request->length,

-			complete_transaction, response);

+	e->r.resource.release = release_transaction;

+	ret = add_client_resource(client, &e->r.resource, GFP_KERNEL);

+	if (ret < 0)

+		goto failed;

+

+	/* Get a reference for the transaction callback */

+	client_get(client);

+

+	fw_send_request(client->device->card, &e->r.transaction,

+			request->tcode & 0x1f, destination_id,

+			request->generation, speed, request->offset,

+			e->response.data, request->length,

+			complete_transaction, e);

 	if (request->data)

 		return sizeof(request) + request->length;

 	else

 		return sizeof(request);

+ failed:

+	kfree(e);

+

+	return ret;

 }

-struct address_handler {

-	struct fw_address_handler handler;

-	__u64 closure;

-	struct client *client;

-	struct client_resource resource;