V4L/DVB: fix dvb frontend lockup
[safe/jmp/linux-2.6] / drivers / ieee1394 / csr1212.c
index 54408cb..e76cac6 100644 (file)
@@ -34,6 +34,8 @@
  */
 
 #include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/kmemcheck.h>
 #include <linux/string.h>
 #include <asm/bug.h>
 #include <asm/byteorder.h>
@@ -83,7 +85,7 @@ static const u8 csr1212_key_id_type_map[0x30] = {
 
 
 #define quads_to_bytes(_q) ((_q) * sizeof(u32))
-#define bytes_to_quads(_b) (((_b) + sizeof(u32) - 1) / sizeof(u32))
+#define bytes_to_quads(_b) DIV_ROUND_UP(_b, sizeof(u32))
 
 static void free_keyval(struct csr1212_keyval *kv)
 {
@@ -113,10 +115,7 @@ static u16 csr1212_crc16(const u32 *buffer, size_t length)
        return cpu_to_be16(crc);
 }
 
-#if 0
-/* Microsoft computes the CRC with the bytes in reverse order.  Therefore we
- * have a special version of the CRC algorithm to account for their buggy
- * software. */
+/* Microsoft computes the CRC with the bytes in reverse order. */
 static u16 csr1212_msft_crc16(const u32 *buffer, size_t length)
 {
        int shift;
@@ -135,7 +134,6 @@ static u16 csr1212_msft_crc16(const u32 *buffer, size_t length)
 
        return cpu_to_be16(crc);
 }
-#endif
 
 static struct csr1212_dentry *
 csr1212_find_keyval(struct csr1212_keyval *dir, struct csr1212_keyval *kv)
@@ -143,10 +141,9 @@ csr1212_find_keyval(struct csr1212_keyval *dir, struct csr1212_keyval *kv)
        struct csr1212_dentry *pos;
 
        for (pos = dir->value.directory.dentries_head;
-            pos != NULL; pos = pos->next) {
+            pos != NULL; pos = pos->next)
                if (pos->kv == kv)
                        return pos;
-       }
        return NULL;
 }
 
@@ -155,10 +152,9 @@ csr1212_find_keyval_offset(struct csr1212_keyval *kv_list, u32 offset)
 {
        struct csr1212_keyval *kv;
 
-       for (kv = kv_list->next; kv && (kv != kv_list); kv = kv->next) {
+       for (kv = kv_list->next; kv && (kv != kv_list); kv = kv->next)
                if (kv->offset == offset)
                        return kv;
-       }
        return NULL;
 }
 
@@ -223,12 +219,10 @@ static struct csr1212_keyval *csr1212_new_keyval(u8 type, u8 key)
        if (!kv)
                return NULL;
 
+       atomic_set(&kv->refcnt, 1);
        kv->key.type = type;
        kv->key.id = key;
-
        kv->associate = NULL;
-       kv->refcnt = 1;
-
        kv->next = NULL;
        kv->prev = NULL;
        kv->offset = 0;
@@ -238,8 +232,9 @@ static struct csr1212_keyval *csr1212_new_keyval(u8 type, u8 key)
 
 struct csr1212_keyval *csr1212_new_immediate(u8 key, u32 value)
 {
-       struct csr1212_keyval *kv = csr1212_new_keyval(CSR1212_KV_TYPE_IMMEDIATE, key);
+       struct csr1212_keyval *kv;
 
+       kv = csr1212_new_keyval(CSR1212_KV_TYPE_IMMEDIATE, key);
        if (!kv)
                return NULL;
 
@@ -251,8 +246,9 @@ struct csr1212_keyval *csr1212_new_immediate(u8 key, u32 value)
 static struct csr1212_keyval *
 csr1212_new_leaf(u8 key, const void *data, size_t data_len)
 {
-       struct csr1212_keyval *kv = csr1212_new_keyval(CSR1212_KV_TYPE_LEAF, key);
+       struct csr1212_keyval *kv;
 
+       kv = csr1212_new_keyval(CSR1212_KV_TYPE_LEAF, key);
        if (!kv)
                return NULL;
 
@@ -279,8 +275,9 @@ csr1212_new_leaf(u8 key, const void *data, size_t data_len)
 static struct csr1212_keyval *
 csr1212_new_csr_offset(u8 key, u32 csr_offset)
 {
-       struct csr1212_keyval *kv = csr1212_new_keyval(CSR1212_KV_TYPE_CSR_OFFSET, key);
+       struct csr1212_keyval *kv;
 
+       kv = csr1212_new_keyval(CSR1212_KV_TYPE_CSR_OFFSET, key);
        if (!kv)
                return NULL;
 
@@ -293,8 +290,9 @@ csr1212_new_csr_offset(u8 key, u32 csr_offset)
 
 struct csr1212_keyval *csr1212_new_directory(u8 key)
 {
-       struct csr1212_keyval *kv = csr1212_new_keyval(CSR1212_KV_TYPE_DIRECTORY, key);
+       struct csr1212_keyval *kv;
 
+       kv = csr1212_new_keyval(CSR1212_KV_TYPE_DIRECTORY, key);
        if (!kv)
                return NULL;
 
@@ -316,7 +314,7 @@ void csr1212_associate_keyval(struct csr1212_keyval *kv,
                associate->key.id != CSR1212_KV_ID_EXTENDED_DATA &&
                associate->key.id < 0x30) ||
               (kv->key.id == CSR1212_KV_ID_EXTENDED_KEY_SPECIFIER_ID &&
-               associate->key.id != CSR1212_KV_ID_EXTENDED_KEY) ||
+               associate->key.id != CSR1212_KV_ID_EXTENDED_KEY) ||
               (kv->key.id == CSR1212_KV_ID_EXTENDED_KEY &&
                associate->key.id != CSR1212_KV_ID_EXTENDED_DATA) ||
               (associate->key.id == CSR1212_KV_ID_EXTENDED_KEY &&
@@ -327,12 +325,13 @@ void csr1212_associate_keyval(struct csr1212_keyval *kv,
        if (kv->associate)
                csr1212_release_keyval(kv->associate);
 
-       associate->refcnt++;
+       csr1212_keep_keyval(associate);
        kv->associate = associate;
 }
 
-int csr1212_attach_keyval_to_directory(struct csr1212_keyval *dir,
-                                      struct csr1212_keyval *kv)
+static int __csr1212_attach_keyval_to_directory(struct csr1212_keyval *dir,
+                                               struct csr1212_keyval *kv,
+                                               bool keep_keyval)
 {
        struct csr1212_dentry *dentry;
 
@@ -342,10 +341,10 @@ int csr1212_attach_keyval_to_directory(struct csr1212_keyval *dir,
        if (!dentry)
                return -ENOMEM;
 
+       if (keep_keyval)
+               csr1212_keep_keyval(kv);
        dentry->kv = kv;
 
-       kv->refcnt++;
-
        dentry->next = NULL;
        dentry->prev = dir->value.directory.dentries_tail;
 
@@ -359,6 +358,12 @@ int csr1212_attach_keyval_to_directory(struct csr1212_keyval *dir,
        return CSR1212_SUCCESS;
 }
 
+int csr1212_attach_keyval_to_directory(struct csr1212_keyval *dir,
+                                      struct csr1212_keyval *kv)
+{
+       return __csr1212_attach_keyval_to_directory(dir, kv, true);
+}
+
 #define CSR1212_DESCRIPTOR_LEAF_DATA(kv) \
        (&((kv)->value.leaf.data[1]))
 
@@ -383,104 +388,74 @@ csr1212_new_descriptor_leaf(u8 dtype, u32 specifier_id,
        if (!kv)
                return NULL;
 
+       kmemcheck_annotate_variable(kv->value.leaf.data[0]);
        CSR1212_DESCRIPTOR_LEAF_SET_TYPE(kv, dtype);
        CSR1212_DESCRIPTOR_LEAF_SET_SPECIFIER_ID(kv, specifier_id);
 
-       if (data) {
+       if (data)
                memcpy(CSR1212_DESCRIPTOR_LEAF_DATA(kv), data, data_len);
-       }
-
-       return kv;
-}
-
-#define CSR1212_TEXTUAL_DESCRIPTOR_LEAF_SET_WIDTH(kv, width) \
-       ((kv)->value.leaf.data[1] = \
-        ((kv)->value.leaf.data[1] & \
-         cpu_to_be32(~(CSR1212_TEXTUAL_DESCRIPTOR_LEAF_WIDTH_MASK << \
-                       CSR1212_TEXTUAL_DESCRIPTOR_LEAF_WIDTH_SHIFT))) | \
-        cpu_to_be32(((width) & CSR1212_TEXTUAL_DESCRIPTOR_LEAF_WIDTH_MASK) << \
-                    CSR1212_TEXTUAL_DESCRIPTOR_LEAF_WIDTH_SHIFT))
-
-#define CSR1212_TEXTUAL_DESCRIPTOR_LEAF_SET_CHAR_SET(kv, char_set) \
-       ((kv)->value.leaf.data[1] = \
-        ((kv)->value.leaf.data[1] & \
-         cpu_to_be32(~(CSR1212_TEXTUAL_DESCRIPTOR_LEAF_CHAR_SET_MASK << \
-                       CSR1212_TEXTUAL_DESCRIPTOR_LEAF_CHAR_SET_SHIFT))) | \
-        cpu_to_be32(((char_set) & \
-                     CSR1212_TEXTUAL_DESCRIPTOR_LEAF_CHAR_SET_MASK) << \
-                    CSR1212_TEXTUAL_DESCRIPTOR_LEAF_CHAR_SET_SHIFT))
-
-#define CSR1212_TEXTUAL_DESCRIPTOR_LEAF_SET_LANGUAGE(kv, language) \
-       ((kv)->value.leaf.data[1] = \
-        ((kv)->value.leaf.data[1] & \
-         cpu_to_be32(~(CSR1212_TEXTUAL_DESCRIPTOR_LEAF_LANGUAGE_MASK))) | \
-        cpu_to_be32(((language) & \
-                     CSR1212_TEXTUAL_DESCRIPTOR_LEAF_LANGUAGE_MASK)))
-
-static struct csr1212_keyval *
-csr1212_new_textual_descriptor_leaf(u8 cwidth, u16 cset, u16 language,
-                                   const void *data, size_t data_len)
-{
-       struct csr1212_keyval *kv;
-       char *lstr;
-
-       kv = csr1212_new_descriptor_leaf(0, 0, NULL, data_len +
-                                        CSR1212_TEXTUAL_DESCRIPTOR_LEAF_OVERHEAD);
-       if (!kv)
-               return NULL;
-
-       CSR1212_TEXTUAL_DESCRIPTOR_LEAF_SET_WIDTH(kv, cwidth);
-       CSR1212_TEXTUAL_DESCRIPTOR_LEAF_SET_CHAR_SET(kv, cset);
-       CSR1212_TEXTUAL_DESCRIPTOR_LEAF_SET_LANGUAGE(kv, language);
-
-       lstr = (char*)CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(kv);
-
-       /* make sure last quadlet is zeroed out */
-       *((u32*)&(lstr[(data_len - 1) & ~0x3])) = 0;
-
-       /* don't copy the NUL terminator */
-       memcpy(lstr, data, data_len);
 
        return kv;
 }
 
+/* Check if string conforms to minimal ASCII as per IEEE 1212 clause 7.4 */
 static int csr1212_check_minimal_ascii(const char *s)
 {
        static const char minimal_ascii_table[] = {
-               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07,
-               0x00, 0x00, 0x0a, 0x00, 0x0C, 0x0D, 0x00, 0x00,
-               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-               0x20, 0x21, 0x22, 0x00, 0x00, 0x25, 0x26, 0x27,
-               0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-               0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
-               0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-               0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
-               0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
-               0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
-               0x58, 0x59, 0x5a, 0x00, 0x00, 0x00, 0x00, 0x5f,
-               0x00, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-               0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
-               0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-               0x78, 0x79, 0x7a, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                       /*  1   2   4   8  16  32  64  128 */
+               128,                    /* --, --, --, --, --, --, --, 07, */
+               4 + 16 + 32,            /* --, --, 0a, --, 0C, 0D, --, --, */
+               0,                      /* --, --, --, --, --, --, --, --, */
+               0,                      /* --, --, --, --, --, --, --, --, */
+               255 - 8 - 16,           /* 20, 21, 22, --, --, 25, 26, 27, */
+               255,                    /* 28, 29, 2a, 2b, 2c, 2d, 2e, 2f, */
+               255,                    /* 30, 31, 32, 33, 34, 35, 36, 37, */
+               255,                    /* 38, 39, 3a, 3b, 3c, 3d, 3e, 3f, */
+               255,                    /* 40, 41, 42, 43, 44, 45, 46, 47, */
+               255,                    /* 48, 49, 4a, 4b, 4c, 4d, 4e, 4f, */
+               255,                    /* 50, 51, 52, 53, 54, 55, 56, 57, */
+               1 + 2 + 4 + 128,        /* 58, 59, 5a, --, --, --, --, 5f, */
+               255 - 1,                /* --, 61, 62, 63, 64, 65, 66, 67, */
+               255,                    /* 68, 69, 6a, 6b, 6c, 6d, 6e, 6f, */
+               255,                    /* 70, 71, 72, 73, 74, 75, 76, 77, */
+               1 + 2 + 4,              /* 78, 79, 7a, --, --, --, --, --, */
        };
+       int i, j;
+
        for (; *s; s++) {
-               if (minimal_ascii_table[*s & 0x7F] != *s)
-                       return -1; /* failed */
+               i = *s >> 3;            /*  i = *s / 8;         */
+               j = 1 << (*s & 3);      /*  j = 1 << (*s % 8);  */
+
+               if (i >= ARRAY_SIZE(minimal_ascii_table) ||
+                   !(minimal_ascii_table[i] & j))
+                       return -EINVAL;
        }
-       /* String conforms to minimal-ascii, as specified by IEEE 1212,
-        * par. 7.4 */
        return 0;
 }
 
+/* IEEE 1212 clause 7.5.4.1 textual descriptors (English, minimal ASCII) */
 struct csr1212_keyval *csr1212_new_string_descriptor_leaf(const char *s)
 {
-       /* Check if string conform to minimal_ascii format */
-       if (csr1212_check_minimal_ascii(s))
+       struct csr1212_keyval *kv;
+       u32 *text;
+       size_t str_len, quads;
+
+       if (!s || !*s || csr1212_check_minimal_ascii(s))
+               return NULL;
+
+       str_len = strlen(s);
+       quads = bytes_to_quads(str_len);
+       kv = csr1212_new_descriptor_leaf(0, 0, NULL, quads_to_bytes(quads) +
+                                     CSR1212_TEXTUAL_DESCRIPTOR_LEAF_OVERHEAD);
+       if (!kv)
                return NULL;
 
-       /* IEEE 1212, par. 7.5.4.1  Textual descriptors (minimal ASCII) */
-       return csr1212_new_textual_descriptor_leaf(0, 0, 0, s, strlen(s));
+       kv->value.leaf.data[1] = 0;     /* width, character_set, language */
+       text = CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(kv);
+       text[quads - 1] = 0;            /* padding */
+       memcpy(text, s, str_len);
+
+       return kv;
 }
 
 
@@ -515,15 +490,18 @@ void csr1212_detach_keyval_from_directory(struct csr1212_keyval *dir,
 
 /* This function is used to free the memory taken by a keyval.  If the given
  * keyval is a directory type, then any keyvals contained in that directory
- * will be destroyed as well if their respective refcnts are 0.  By means of
+ * will be destroyed as well if noone holds a reference on them.  By means of
  * list manipulation, this routine will descend a directory structure in a
  * non-recursive manner. */
-void _csr1212_destroy_keyval(struct csr1212_keyval *kv)
+void csr1212_release_keyval(struct csr1212_keyval *kv)
 {
        struct csr1212_keyval *k, *a;
        struct csr1212_dentry dentry;
        struct csr1212_dentry *head, *tail;
 
+       if (!atomic_dec_and_test(&kv->refcnt))
+               return;
+
        dentry.kv = kv;
        dentry.next = NULL;
        dentry.prev = NULL;
@@ -535,19 +513,20 @@ void _csr1212_destroy_keyval(struct csr1212_keyval *kv)
                k = head->kv;
 
                while (k) {
-                       k->refcnt--;
-
-                       if (k->refcnt > 0)
+                       /* must not dec_and_test kv->refcnt again */
+                       if (k != kv && !atomic_dec_and_test(&k->refcnt))
                                break;
 
                        a = k->associate;
 
                        if (k->key.type == CSR1212_KV_TYPE_DIRECTORY) {
-                               /* If the current entry is a directory, then move all
+                               /* If the current entry is a directory, move all
                                 * the entries to the destruction list. */
                                if (k->value.directory.dentries_head) {
-                                       tail->next = k->value.directory.dentries_head;
-                                       k->value.directory.dentries_head->prev = tail;
+                                       tail->next =
+                                           k->value.directory.dentries_head;
+                                       k->value.directory.dentries_head->prev =
+                                           tail;
                                        tail = k->value.directory.dentries_tail;
                                }
                        }
@@ -557,12 +536,12 @@ void _csr1212_destroy_keyval(struct csr1212_keyval *kv)
 
                head = head->next;
                if (head) {
-                       if (head->prev && head->prev != &dentry) {
+                       if (head->prev && head->prev != &dentry)
                                CSR1212_FREE(head->prev);
-                       }
                        head->prev = NULL;
-               } else if (tail != &dentry)
+               } else if (tail != &dentry) {
                        CSR1212_FREE(tail);
+               }
        }
 }
 
@@ -603,30 +582,34 @@ static int csr1212_append_new_cache(struct csr1212_csr *csr, size_t romsize)
        /* ROM size must be a multiple of csr->max_rom */
        romsize = (romsize + (csr->max_rom - 1)) & ~(csr->max_rom - 1);
 
-       csr_addr = csr->ops->allocate_addr_range(romsize, csr->max_rom, csr->private);
-       if (csr_addr == CSR1212_INVALID_ADDR_SPACE) {
+       csr_addr = csr->ops->allocate_addr_range(romsize, csr->max_rom,
+                                                csr->private);
+       if (csr_addr == CSR1212_INVALID_ADDR_SPACE)
                return -ENOMEM;
-       }
+
        if (csr_addr < CSR1212_REGISTER_SPACE_BASE) {
                /* Invalid address returned from allocate_addr_range(). */
                csr->ops->release_addr(csr_addr, csr->private);
                return -ENOMEM;
        }
 
-       cache = csr1212_rom_cache_malloc(csr_addr - CSR1212_REGISTER_SPACE_BASE, romsize);
+       cache = csr1212_rom_cache_malloc(csr_addr - CSR1212_REGISTER_SPACE_BASE,
+                                        romsize);
        if (!cache) {
                csr->ops->release_addr(csr_addr, csr->private);
                return -ENOMEM;
        }
 
-       cache->ext_rom = csr1212_new_keyval(CSR1212_KV_TYPE_LEAF, CSR1212_KV_ID_EXTENDED_ROM);
+       cache->ext_rom = csr1212_new_keyval(CSR1212_KV_TYPE_LEAF,
+                                           CSR1212_KV_ID_EXTENDED_ROM);
        if (!cache->ext_rom) {
                csr->ops->release_addr(csr_addr, csr->private);
                CSR1212_FREE(cache);
                return -ENOMEM;
        }
 
-       if (csr1212_attach_keyval_to_directory(csr->root_kv, cache->ext_rom) != CSR1212_SUCCESS) {
+       if (csr1212_attach_keyval_to_directory(csr->root_kv, cache->ext_rom) !=
+           CSR1212_SUCCESS) {
                csr1212_release_keyval(cache->ext_rom);
                csr->ops->release_addr(csr_addr, csr->private);
                CSR1212_FREE(cache);
@@ -657,7 +640,8 @@ static void csr1212_remove_cache(struct csr1212_csr *csr,
                cache->next->prev = cache->prev;
 
        if (cache->ext_rom) {
-               csr1212_detach_keyval_from_directory(csr->root_kv, cache->ext_rom);
+               csr1212_detach_keyval_from_directory(csr->root_kv,
+                                                    cache->ext_rom);
                csr1212_release_keyval(cache->ext_rom);
        }
 
@@ -677,28 +661,29 @@ static int csr1212_generate_layout_subdir(struct csr1212_keyval *dir,
             dentry = dentry->next) {
                for (dkv = dentry->kv; dkv; dkv = dkv->associate) {
                        /* Special Case: Extended Key Specifier_ID */
-                       if (dkv->key.id == CSR1212_KV_ID_EXTENDED_KEY_SPECIFIER_ID) {
-                               if (last_extkey_spec == NULL) {
+                       if (dkv->key.id ==
+                           CSR1212_KV_ID_EXTENDED_KEY_SPECIFIER_ID) {
+                               if (last_extkey_spec == NULL)
                                        last_extkey_spec = dkv;
-                               } else if (dkv->value.immediate != last_extkey_spec->value.immediate) {
+                               else if (dkv->value.immediate !=
+                                        last_extkey_spec->value.immediate)
                                        last_extkey_spec = dkv;
-                               } else {
+                               else
                                        continue;
-                               }
                        /* Special Case: Extended Key */
                        } else if (dkv->key.id == CSR1212_KV_ID_EXTENDED_KEY) {
-                               if (last_extkey == NULL) {
+                               if (last_extkey == NULL)
                                        last_extkey = dkv;
-                               } else if (dkv->value.immediate != last_extkey->value.immediate) {
+                               else if (dkv->value.immediate !=
+                                        last_extkey->value.immediate)
                                        last_extkey = dkv;
-                               } else {
+                               else
                                        continue;
-                               }
                        }
 
                        num_entries += 1;
 
-                       switch(dkv->key.type) {
+                       switch (dkv->key.type) {
                        default:
                        case CSR1212_KV_TYPE_IMMEDIATE:
                        case CSR1212_KV_TYPE_CSR_OFFSET:
@@ -716,8 +701,9 @@ static int csr1212_generate_layout_subdir(struct csr1212_keyval *dir,
                                /* Special case: Extended ROM leafs */
                                if (dkv->key.id == CSR1212_KV_ID_EXTENDED_ROM) {
                                        dkv->value.leaf.len = -1;
-                                       /* Don't add Extended ROM leafs in the layout list,
-                                        * they are handled differently. */
+                                       /* Don't add Extended ROM leafs in the
+                                        * layout list, they are handled
+                                        * differently. */
                                        break;
                                }
 
@@ -738,15 +724,16 @@ static size_t csr1212_generate_layout_order(struct csr1212_keyval *kv)
        struct csr1212_keyval *ltail = kv;
        size_t agg_size = 0;
 
-       while(kv) {
-               switch(kv->key.type) {
+       while (kv) {
+               switch (kv->key.type) {
                case CSR1212_KV_TYPE_LEAF:
                        /* Add 1 quadlet for crc/len field */
                        agg_size += kv->value.leaf.len + 1;
                        break;
 
                case CSR1212_KV_TYPE_DIRECTORY:
-                       kv->value.directory.len = csr1212_generate_layout_subdir(kv, &ltail);
+                       kv->value.directory.len =
+                               csr1212_generate_layout_subdir(kv, &ltail);
                        /* Add 1 quadlet for crc/len field */
                        agg_size += kv->value.directory.len + 1;
                        break;
@@ -767,13 +754,12 @@ csr1212_generate_positions(struct csr1212_csr_rom_cache *cache,
 
        cache->layout_head = kv;
 
-       while(kv && pos < cache->size) {
+       while (kv && pos < cache->size) {
                /* Special case: Extended ROM leafs */
-               if (kv->key.id != CSR1212_KV_ID_EXTENDED_ROM) {
+               if (kv->key.id != CSR1212_KV_ID_EXTENDED_ROM)
                        kv->offset = cache->offset + pos;
-               }
 
-               switch(kv->key.type) {
+               switch (kv->key.type) {
                case CSR1212_KV_TYPE_LEAF:
                        kv_len = kv->value.leaf.len;
                        break;
@@ -784,6 +770,7 @@ csr1212_generate_positions(struct csr1212_csr_rom_cache *cache,
 
                default:
                        /* Should never get here */
+                       WARN_ON(1);
                        break;
                }
 
@@ -797,7 +784,7 @@ csr1212_generate_positions(struct csr1212_csr_rom_cache *cache,
        }
 
        cache->layout_tail = okv;
-       cache->len = (okv->offset - cache->offset) + quads_to_bytes(okv_len + 1);
+       cache->len = okv->offset - cache->offset + quads_to_bytes(okv_len + 1);
 
        return kv;
 }
@@ -815,33 +802,37 @@ csr1212_generate_tree_subdir(struct csr1212_keyval *dir, u32 *data_buffer)
        struct csr1212_keyval *last_extkey = NULL;
        int index = 0;
 
-       for (dentry = dir->value.directory.dentries_head; dentry; dentry = dentry->next) {
+       for (dentry = dir->value.directory.dentries_head;
+            dentry;
+            dentry = dentry->next) {
                struct csr1212_keyval *a;
 
                for (a = dentry->kv; a; a = a->associate) {
                        u32 value = 0;
 
                        /* Special Case: Extended Key Specifier_ID */
-                       if (a->key.id == CSR1212_KV_ID_EXTENDED_KEY_SPECIFIER_ID) {
-                               if (last_extkey_spec == NULL) {
+                       if (a->key.id ==
+                           CSR1212_KV_ID_EXTENDED_KEY_SPECIFIER_ID) {
+                               if (last_extkey_spec == NULL)
                                        last_extkey_spec = a;
-                               } else if (a->value.immediate != last_extkey_spec->value.immediate) {
+                               else if (a->value.immediate !=
+                                        last_extkey_spec->value.immediate)
                                        last_extkey_spec = a;
-                               } else {
+                               else
                                        continue;
-                               }
+
                        /* Special Case: Extended Key */
                        } else if (a->key.id == CSR1212_KV_ID_EXTENDED_KEY) {
-                               if (last_extkey == NULL) {
+                               if (last_extkey == NULL)
                                        last_extkey = a;
-                               } else if (a->value.immediate != last_extkey->value.immediate) {
+                               else if (a->value.immediate !=
+                                        last_extkey->value.immediate)
                                        last_extkey = a;
-                               } else {
+                               else
                                        continue;
-                               }
                        }
 
-                       switch(a->key.type) {
+                       switch (a->key.type) {
                        case CSR1212_KV_TYPE_IMMEDIATE:
                                value = a->value.immediate;
                                break;
@@ -860,12 +851,15 @@ csr1212_generate_tree_subdir(struct csr1212_keyval *dir, u32 *data_buffer)
                                break;
                        default:
                                /* Should never get here */
-                               break; /* GDB breakpoint */
+                               WARN_ON(1);
+                               break;
                        }
 
-                       value |= (a->key.id & CSR1212_KV_KEY_ID_MASK) << CSR1212_KV_KEY_SHIFT;
+                       value |= (a->key.id & CSR1212_KV_KEY_ID_MASK) <<
+                                CSR1212_KV_KEY_SHIFT;
                        value |= (a->key.type & CSR1212_KV_KEY_TYPE_MASK) <<
-                               (CSR1212_KV_KEY_SHIFT + CSR1212_KV_KEY_TYPE_SHIFT);
+                                (CSR1212_KV_KEY_SHIFT +
+                                 CSR1212_KV_KEY_TYPE_SHIFT);
                        data_buffer[index] = cpu_to_be32(value);
                        index++;
                }
@@ -885,15 +879,18 @@ static void csr1212_fill_cache(struct csr1212_csr_rom_cache *cache)
        struct csr1212_keyval *kv, *nkv;
        struct csr1212_keyval_img *kvi;
 
-       for (kv = cache->layout_head; kv != cache->layout_tail->next; kv = nkv) {
-               kvi = (struct csr1212_keyval_img *)
-                       (cache->data + bytes_to_quads(kv->offset - cache->offset));
-               switch(kv->key.type) {
+       for (kv = cache->layout_head;
+            kv != cache->layout_tail->next;
+            kv = nkv) {
+               kvi = (struct csr1212_keyval_img *)(cache->data +
+                               bytes_to_quads(kv->offset - cache->offset));
+               switch (kv->key.type) {
                default:
                case CSR1212_KV_TYPE_IMMEDIATE:
                case CSR1212_KV_TYPE_CSR_OFFSET:
                        /* Should never get here */
-                       break; /* GDB breakpoint */
+                       WARN_ON(1);
+                       break;
 
                case CSR1212_KV_TYPE_LEAF:
                        /* Don't copy over Extended ROM areas, they are
@@ -910,7 +907,8 @@ static void csr1212_fill_cache(struct csr1212_csr_rom_cache *cache)
                        csr1212_generate_tree_subdir(kv, kvi->data);
 
                        kvi->length = cpu_to_be16(kv->value.directory.len);
-                       kvi->crc = csr1212_crc16(kvi->data, kv->value.directory.len);
+                       kvi->crc = csr1212_crc16(kvi->data,
+                                                kv->value.directory.len);
                        break;
                }
 
@@ -924,7 +922,9 @@ static void csr1212_fill_cache(struct csr1212_csr_rom_cache *cache)
        }
 }
 
-#define CSR1212_EXTENDED_ROM_SIZE (0x10000 * sizeof(u32))
+/* This size is arbitrarily chosen.
+ * The struct overhead is subtracted for more economic allocations. */
+#define CSR1212_EXTENDED_ROM_SIZE (2048 - sizeof(struct csr1212_csr_rom_cache))
 
 int csr1212_generate_csr_image(struct csr1212_csr *csr)
 {
@@ -952,7 +952,9 @@ int csr1212_generate_csr_image(struct csr1212_csr *csr)
 
        init_offset = csr->bus_info_len;
 
-       for (kv = csr->root_kv, cache = csr->cache_head; kv; cache = cache->next) {
+       for (kv = csr->root_kv, cache = csr->cache_head;
+            kv;
+            cache = cache->next) {
                if (!cache) {
                        /* Estimate approximate number of additional cache
                         * regions needed (it assumes that the cache holding
@@ -963,7 +965,8 @@ int csr1212_generate_csr_image(struct csr1212_csr *csr)
                        /* Add additional cache regions, extras will be
                         * removed later */
                        for (; est_c; est_c--) {
-                               ret = csr1212_append_new_cache(csr, CSR1212_EXTENDED_ROM_SIZE);
+                               ret = csr1212_append_new_cache(csr,
+                                               CSR1212_EXTENDED_ROM_SIZE);
                                if (ret != CSR1212_SUCCESS)
                                        return ret;
                        }
@@ -988,7 +991,7 @@ int csr1212_generate_csr_image(struct csr1212_csr *csr)
 
        /* Go through the list backward so that when done, the correct CRC
         * will be calculated for the Extended ROM areas. */
-       for(cache = csr->cache_tail; cache; cache = cache->prev) {
+       for (cache = csr->cache_tail; cache; cache = cache->prev) {
                /* Only Extended ROM caches should have this set. */
                if (cache->ext_rom) {
                        int leaf_size;
@@ -1036,18 +1039,36 @@ int csr1212_read(struct csr1212_csr *csr, u32 offset, void *buffer, u32 len)
 {
        struct csr1212_csr_rom_cache *cache;
 
-       for (cache = csr->cache_head; cache; cache = cache->next) {
+       for (cache = csr->cache_head; cache; cache = cache->next)
                if (offset >= cache->offset &&
                    (offset + len) <= (cache->offset + cache->size)) {
-                       memcpy(buffer,
-                              &cache->data[bytes_to_quads(offset - cache->offset)],
+                       memcpy(buffer, &cache->data[
+                                       bytes_to_quads(offset - cache->offset)],
                               len);
                        return CSR1212_SUCCESS;
                }
-       }
+
        return -ENOENT;
 }
 
+/*
+ * Apparently there are many different wrong implementations of the CRC
+ * algorithm.  We don't fail, we just warn... approximately once per GUID.
+ */
+static void
+csr1212_check_crc(const u32 *buffer, size_t length, u16 crc, __be32 *guid)
+{
+       static u64 last_bad_eui64;
+       u64 eui64 = ((u64)be32_to_cpu(guid[0]) << 32) | be32_to_cpu(guid[1]);
+
+       if (csr1212_crc16(buffer, length) == crc ||
+           csr1212_msft_crc16(buffer, length) == crc ||
+           eui64 == last_bad_eui64)
+               return;
+
+       printk(KERN_DEBUG "ieee1394: config ROM CRC error\n");
+       last_bad_eui64 = eui64;
+}
 
 /* Parse a chunk of data as a Config ROM */
 
@@ -1058,16 +1079,10 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
        int i;
        int ret;
 
-       /* IEEE 1212 says that the entire bus info block should be readable in
-        * a single transaction regardless of the max_rom value.
-        * Unfortunately, many IEEE 1394 devices do not abide by that, so the
-        * bus info block will be read 1 quadlet at a time.  The rest of the
-        * ConfigROM will be read according to the max_rom field. */
        for (i = 0; i < csr->bus_info_len; i += sizeof(u32)) {
                ret = csr->ops->bus_read(csr, CSR1212_CONFIG_ROM_SPACE_BASE + i,
-                                        sizeof(u32),
-                                        &csr->cache_head->data[bytes_to_quads(i)],
-                                        csr->private);
+                               &csr->cache_head->data[bytes_to_quads(i)],
+                               csr->private);
                if (ret != CSR1212_SUCCESS)
                        return ret;
 
@@ -1081,24 +1096,19 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
        bi = (struct csr1212_bus_info_block_img*)csr->cache_head->data;
        csr->crc_len = quads_to_bytes(bi->crc_length);
 
-       /* IEEE 1212 recommends that crc_len be equal to bus_info_len, but that is not
-        * always the case, so read the rest of the crc area 1 quadlet at a time. */
+       /* IEEE 1212 recommends that crc_len be equal to bus_info_len, but that
+        * is not always the case, so read the rest of the crc area 1 quadlet at
+        * a time. */
        for (i = csr->bus_info_len; i <= csr->crc_len; i += sizeof(u32)) {
                ret = csr->ops->bus_read(csr, CSR1212_CONFIG_ROM_SPACE_BASE + i,
-                                        sizeof(u32),
-                                        &csr->cache_head->data[bytes_to_quads(i)],
-                                        csr->private);
+                               &csr->cache_head->data[bytes_to_quads(i)],
+                               csr->private);
                if (ret != CSR1212_SUCCESS)
                        return ret;
        }
 
-#if 0
-       /* Apparently there are too many differnt wrong implementations of the
-        * CRC algorithm that verifying them is moot. */
-       if ((csr1212_crc16(bi->data, bi->crc_length) != bi->crc) &&
-           (csr1212_msft_crc16(bi->data, bi->crc_length) != bi->crc))
-               return -EINVAL;
-#endif
+       csr1212_check_crc(bi->data, bi->crc_length, bi->crc,
+                         &csr->bus_info_data[3]);
 
        cr = CSR1212_MALLOC(sizeof(*cr));
        if (!cr)
@@ -1121,23 +1131,24 @@ static int csr1212_parse_bus_info_block(struct csr1212_csr *csr)
 #define CSR1212_KV_VAL_MASK    0xffffff
 #define CSR1212_KV_VAL(q)      (be32_to_cpu(q) & CSR1212_KV_VAL_MASK)
 
-static int csr1212_parse_dir_entry(struct csr1212_keyval *dir,
-                                  u32 ki, u32 kv_pos)
+static int
+csr1212_parse_dir_entry(struct csr1212_keyval *dir, u32 ki, u32 kv_pos)
 {
        int ret = CSR1212_SUCCESS;
        struct csr1212_keyval *k = NULL;
        u32 offset;
+       bool keep_keyval = true;
 
-       switch(CSR1212_KV_KEY_TYPE(ki)) {
+       switch (CSR1212_KV_KEY_TYPE(ki)) {
        case CSR1212_KV_TYPE_IMMEDIATE:
                k = csr1212_new_immediate(CSR1212_KV_KEY_ID(ki),
                                          CSR1212_KV_VAL(ki));
                if (!k) {
                        ret = -ENOMEM;
-                       goto fail;
+                       goto out;
                }
-
-               k->refcnt = 0;  /* Don't keep local reference when parsing. */
+               /* Don't keep local reference when parsing. */
+               keep_keyval = false;
                break;
 
        case CSR1212_KV_TYPE_CSR_OFFSET:
@@ -1145,9 +1156,10 @@ static int csr1212_parse_dir_entry(struct csr1212_keyval *dir,
                                           CSR1212_KV_VAL(ki));
                if (!k) {
                        ret = -ENOMEM;
-                       goto fail;
+                       goto out;
                }
-               k->refcnt = 0;  /* Don't keep local reference when parsing. */
+               /* Don't keep local reference when parsing. */
+               keep_keyval = false;
                break;
 
        default:
@@ -1158,7 +1170,7 @@ static int csr1212_parse_dir_entry(struct csr1212_keyval *dir,
                         * or Directories.  The Config ROM image is most likely
                         * messed up, so we'll just abort here. */
                        ret = -EIO;
-                       goto fail;
+                       goto out;
                }
 
                k = csr1212_find_keyval_offset(dir, offset);
@@ -1166,17 +1178,19 @@ static int csr1212_parse_dir_entry(struct csr1212_keyval *dir,
                if (k)
                        break;          /* Found it. */
 
-               if (CSR1212_KV_KEY_TYPE(ki) == CSR1212_KV_TYPE_DIRECTORY) {
+               if (CSR1212_KV_KEY_TYPE(ki) == CSR1212_KV_TYPE_DIRECTORY)
                        k = csr1212_new_directory(CSR1212_KV_KEY_ID(ki));
-               } else {
+               else
                        k = csr1212_new_leaf(CSR1212_KV_KEY_ID(ki), NULL, 0);
-               }
+
                if (!k) {
                        ret = -ENOMEM;
-                       goto fail;
+                       goto out;
                }
-               k->refcnt = 0;  /* Don't keep local reference when parsing. */
-               k->valid = 0;   /* Contents not read yet so it's not valid. */
+               /* Don't keep local reference when parsing. */
+               keep_keyval = false;
+               /* Contents not read yet so it's not valid. */
+               k->valid = 0;
                k->offset = offset;
 
                k->prev = dir;
@@ -1184,9 +1198,8 @@ static int csr1212_parse_dir_entry(struct csr1212_keyval *dir,
                dir->next->prev = k;
                dir->next = k;
        }
-       ret = csr1212_attach_keyval_to_directory(dir, k);
-
-fail:
+       ret = __csr1212_attach_keyval_to_directory(dir, k, keep_keyval);
+out:
        if (ret != CSR1212_SUCCESS && k != NULL)
                free_keyval(k);
        return ret;
@@ -1200,21 +1213,14 @@ int csr1212_parse_keyval(struct csr1212_keyval *kv,
        int ret = CSR1212_SUCCESS;
        int kvi_len;
 
-       kvi = (struct csr1212_keyval_img*)&cache->data[bytes_to_quads(kv->offset -
-                                                                     cache->offset)];
+       kvi = (struct csr1212_keyval_img*)
+               &cache->data[bytes_to_quads(kv->offset - cache->offset)];
        kvi_len = be16_to_cpu(kvi->length);
 
-#if 0
-       /* Apparently there are too many differnt wrong implementations of the
-        * CRC algorithm that verifying them is moot. */
-       if ((csr1212_crc16(kvi->data, kvi_len) != kvi->crc) &&
-           (csr1212_msft_crc16(kvi->data, kvi_len) != kvi->crc)) {
-               ret = -EINVAL;
-               goto fail;
-       }
-#endif
+       /* GUID is wrong in here in case of extended ROM.  We don't care. */
+       csr1212_check_crc(kvi->data, kvi_len, kvi->crc, &cache->data[3]);
 
-       switch(kv->key.type) {
+       switch (kv->key.type) {
        case CSR1212_KV_TYPE_DIRECTORY:
                for (i = 0; i < kvi_len; i++) {
                        u32 ki = kvi->data[i];
@@ -1225,33 +1231,34 @@ int csr1212_parse_keyval(struct csr1212_keyval *kv,
                        if (ki == 0x0)
                                continue;
                        ret = csr1212_parse_dir_entry(kv, ki,
-                                                     (kv->offset +
-                                                      quads_to_bytes(i + 1)));
+                                       kv->offset + quads_to_bytes(i + 1));
                }
                kv->value.directory.len = kvi_len;
                break;
 
        case CSR1212_KV_TYPE_LEAF:
                if (kv->key.id != CSR1212_KV_ID_EXTENDED_ROM) {
-                       kv->value.leaf.data = CSR1212_MALLOC(quads_to_bytes(kvi_len));
+                       size_t size = quads_to_bytes(kvi_len);
+
+                       kv->value.leaf.data = CSR1212_MALLOC(size);
                        if (!kv->value.leaf.data) {
                                ret = -ENOMEM;
-                               goto fail;
+                               goto out;
                        }
 
                        kv->value.leaf.len = kvi_len;
-                       memcpy(kv->value.leaf.data, kvi->data, quads_to_bytes(kvi_len));
+                       memcpy(kv->value.leaf.data, kvi->data, size);
                }
                break;
        }
 
        kv->valid = 1;
-
-fail:
+out:
        return ret;
 }
 
-int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
+static int
+csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
 {
        struct csr1212_cache_region *cr, *ncr, *newcr = NULL;
        struct csr1212_keyval_img *kvi = NULL;
@@ -1265,11 +1272,10 @@ int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
 
        /* First find which cache the data should be in (or go in if not read
         * yet). */
-       for (cache = csr->cache_head; cache; cache = cache->next) {
+       for (cache = csr->cache_head; cache; cache = cache->next)
                if (kv->offset >= cache->offset &&
                    kv->offset < (cache->offset + cache->size))
                        break;
-       }
 
        if (!cache) {
                u32 q, cache_size;
@@ -1280,9 +1286,8 @@ int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
 
                if (csr->ops->bus_read(csr,
                                       CSR1212_REGISTER_SPACE_BASE + kv->offset,
-                                      sizeof(u32), &q, csr->private)) {
+                                      &q, csr->private))
                        return -EIO;
-               }
 
                kv->value.leaf.len = be32_to_cpu(q) >> 16;
 
@@ -1300,9 +1305,8 @@ int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
                csr->cache_tail = cache;
                cache->filled_head =
                        CSR1212_MALLOC(sizeof(*cache->filled_head));
-               if (!cache->filled_head) {
+               if (!cache->filled_head)
                        return -ENOMEM;
-               }
 
                cache->filled_head->offset_start = 0;
                cache->filled_head->offset_end = sizeof(u32);
@@ -1338,8 +1342,9 @@ int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
                                (&cache->data[bytes_to_quads(cache_index)]);
                        kv_len = quads_to_bytes(be16_to_cpu(kvi->length) + 1);
                        break;
-               } else if (cache_index == cr->offset_end)
+               } else if (cache_index == cr->offset_end) {
                        break;
+               }
        }
 
        if (!cr) {
@@ -1364,17 +1369,8 @@ int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
                addr = (CSR1212_CSR_ARCH_REG_SPACE_BASE + cache->offset +
                        cr->offset_end) & ~(csr->max_rom - 1);
 
-               if (csr->ops->bus_read(csr, addr, csr->max_rom, cache_ptr,
-                                      csr->private)) {
-                       if (csr->max_rom == 4)
-                               /* We've got problems! */
-                               return -EIO;
-
-                       /* Apperently the max_rom value was a lie, set it to
-                        * do quadlet reads and try again. */
-                       csr->max_rom = 4;
-                       continue;
-               }
+               if (csr->ops->bus_read(csr, addr, cache_ptr, csr->private))
+                       return -EIO;
 
                cr->offset_end += csr->max_rom - (cr->offset_end &
                                                  (csr->max_rom - 1));
@@ -1412,9 +1408,19 @@ int _csr1212_read_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
        return csr1212_parse_keyval(kv, cache);
 }
 
+struct csr1212_keyval *
+csr1212_get_keyval(struct csr1212_csr *csr, struct csr1212_keyval *kv)
+{
+       if (!kv)
+               return NULL;
+       if (!kv->valid)
+               if (csr1212_read_keyval(csr, kv) != CSR1212_SUCCESS)
+                       return NULL;
+       return kv;
+}
+
 int csr1212_parse_csr(struct csr1212_csr *csr)
 {
-       static const int mr_map[] = { 4, 64, 1024, 0 };
        struct csr1212_dentry *dentry;
        int ret;
 
@@ -1424,15 +1430,13 @@ int csr1212_parse_csr(struct csr1212_csr *csr)
        if (ret != CSR1212_SUCCESS)
                return ret;
 
-       if (!csr->ops->get_max_rom)
-               csr->max_rom = mr_map[0];       /* default value */
-       else {
-               int i = csr->ops->get_max_rom(csr->bus_info_data,
-                                             csr->private);
-               if (i & ~0x3)
-                       return -EINVAL;
-               csr->max_rom = mr_map[i];
-       }
+       /*
+        * There has been a buggy firmware with bus_info_block.max_rom > 0
+        * spotted which actually only supported quadlet read requests to the
+        * config ROM.  Therefore read everything quadlet by quadlet regardless
+        * of what the bus info block says.
+        */
+       csr->max_rom = 4;
 
        csr->cache_head->layout_head = csr->root_kv;
        csr->cache_head->layout_tail = csr->root_kv;
@@ -1443,7 +1447,7 @@ int csr1212_parse_csr(struct csr1212_csr *csr)
        csr->root_kv->valid = 0;
        csr->root_kv->next = csr->root_kv;
        csr->root_kv->prev = csr->root_kv;
-       ret = _csr1212_read_keyval(csr, csr->root_kv);
+       ret = csr1212_read_keyval(csr, csr->root_kv);
        if (ret != CSR1212_SUCCESS)
                return ret;
 
@@ -1453,7 +1457,7 @@ int csr1212_parse_csr(struct csr1212_csr *csr)
             dentry; dentry = dentry->next) {
                if (dentry->kv->key.id == CSR1212_KV_ID_EXTENDED_ROM &&
                        !dentry->kv->valid) {
-                       ret = _csr1212_read_keyval(csr, dentry->kv);
+                       ret = csr1212_read_keyval(csr, dentry->kv);
                        if (ret != CSR1212_SUCCESS)
                                return ret;
                }