17 Oct, 2010

1 commit

  • Revert commit 54672386ccf36ffa21d1de8e75624af83f9b0eeb
    "firewire: ohci: fix up configuration of TI chips".
    It caused massive slow-down and data corruption with a TSB82AA2 based
    StarTech EC1394B2 ExpressCard and FireWire 800 harddisks.

    https://bugs.launchpad.net/ubuntu/+source/linux/+bug/657081
    http://thread.gmane.org/gmane.linux.kernel.firewire.user/4013

    The fact that some card EEPROMs do not program these enhancements may be
    related to TSB81BA3 phy chip errata, if not to bugs of TSB82AA2 itself.
    We could re-add these configuration steps, but only conditional on a
    whitelist of cards on which these enhancements bring a proven positive
    effect.

    Reported-and-tested-by: Eric Shattow
    Cc: Clemens Ladisch
    Cc: 2.6.35
    Signed-off-by: Stefan Richter

    Stefan Richter
     

09 Sep, 2010

1 commit


29 Aug, 2010

1 commit

  • VIA VT6306, VIA VT6308, and NEC OrangeLink controllers do not write
    packet event codes for received PHY packets (or perhaps write
    evt_no_status, hard to tell). Work around it by overwriting the
    packet's ACK by ack_complete, so that upper layers that listen to PHY
    packet reception get to see these packets.

    (Also tested: TI TSB82AA2, TI TSB43AB22/A, TI XIO2213A, Agere FW643,
    JMicron JMB381 --- these do not exhibit this bug.)

    Clemens proposed a quirks flag for that, IOW whitelist known misbehaving
    controllers for this workaround. Though to me it seems harmless enough
    to enable for all controllers.

    The log_ar_at_event() debug log will continue to show the original
    status from the DMA unit.

    Reported-by: Clemens Ladisch (VT6308)
    Signed-off-by: Stefan Richter

    Stefan Richter
     

20 Aug, 2010

4 commits

  • Because we might be in interrupt context, replace del_timer_sync() with
    del_timer(). If the timer is already running, we know that it will
    clean up the transaction, so we do not need to do any further processing
    in the normal transaction handler.

    Many thanks to Yong Zhang for diagnosing this.

    Reported-by: Stefan Richter
    Signed-off-by: Clemens Ladisch
    Signed-off-by: Stefan Richter

    Clemens Ladisch
     
  • The incoming request hander fwnet_receive_packet() expects subsequent
    datagram handling code to return non-zero on errors. However, almost
    none of the failure paths did so. Fix them all.

    (This error reporting is used to send and RCODE_CONFLICT_ERROR to the
    sender node in such failure cases. Two modes of failure exist: Out of
    memory, or firewire-net is unaware of any peer node to which a fragment
    or an ARP packet belongs. However, it is unclear whether a sender can
    actually make use of such information. A Linux peer apparently can't.
    Maybe it should all be simplified to void functions.)

    Reported-by: Julia Lawall
    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Fix I/O stalls with some 4-bay RAID enclosures which are based on
    OXUF936QSE:
    - Onnto dataTale RSM4QO, old firmware (not anymore with current
    firmware),
    - inXtron Hydra Super-S LCM, old as well as current firmware
    when used in RAID-5 mode, perhaps also in other RAID modes.

    The stalls happen during heavy or moderate disk traffic in periods that
    are a multiple of 5 minutes, roughly twice per hour. They are caused
    by the target responding too late to an ORB_Pointer register write:
    The target responds after Split_Timeout, hence firewire-core cancels
    the transaction, and firewire-sbp2 fails the SCSI request. The SCSI
    core retries the request, that fails again (and again), hence SCSI core
    calls firewire-sbp2's abort handler (and even the Management_Agent
    register write in the abort handler has the transaction timeout
    problem).

    During all that, the process which issued the I/O is stalled in I/O
    wait state.

    Meanwhile, the target actually acts on the first failed SCSI request:
    It responds to the ORB_Pointer write later (seen in the kernel log as
    "firewire_core: Unsolicited response") and also finishes the SCSI
    request with proper status (seen in the kernel log as "firewire_sbp2:
    status write for unknown orb").

    So let's just ignore RCODE_CANCELLED in the transaction callback and
    wait for the target to complete the ORB nevertheless. This requires
    a small modification is sbp2_cancel_orbs(); it now needs to call
    orb->callback() regardless whether fw_cancel_transaction() found the
    transaction unfinished or finished.

    A different solution is to increase Split_Timeout on the local node.
    (Tested: 2000ms timeout; maybe 1000ms or something like that works too.
    200ms is insufficient. Standard is 100ms.) However, I rather not do
    this because any software on any node could change the Split_Timeout to
    something unsuitable. Or such a large Split_Timeout may be undesirable
    for other purposes.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • When an ORB was canceled (Command ORB i.e. SCSI request timed out, or
    Management ORB timed out), or there was a send error in the initial
    transaction, we missed to drop one of the ORB's references and thus
    leaked memory.

    Background:
    In total, we hold 3 references to each Operation Request Block:
    - 1 during sbp2_scsi_queuecommand() or sbp2_send_management_orb()
    respectively,
    - 1 for the duration of the write transaction to the ORB_Pointer or
    Management_Agent register of the target,
    - 1 for as long as the ORB stays within the lu->orb_list, until
    the ORB is unlinked from the list and the orb->callback was
    executed.

    The latter one of these 3 references is finished
    - normally by sbp2_status_write() when the target wrote status
    for a pending ORB,
    - or by sbp2_cancel_orbs() in case of an ORB time-out,
    - or by complete_transaction() in case of a send error.
    Of them, the latter two lacked the kref_put.

    Add the missing kref_put()s. Add comments to the gets and puts of
    references for transaction callbacks and ORB callbacks so that it is
    easier to see what is supposed to happen.

    Signed-off-by: Stefan Richter

    Stefan Richter
     

02 Aug, 2010

2 commits


30 Jul, 2010

5 commits

  • This adds the DMA context programming and userspace ABI for multichannel
    reception, i.e. for listening on multiple channel numbers by means of a
    single DMA context.

    The use case is reception of more streams than there are IR DMA units
    offered by the link layer. This is already implemented by the older
    ohci1394 + ieee1394 + raw1394 stack. And as discussed recently on
    linux1394-devel, this feature is occasionally used in practice.

    The big drawbacks of this mode are that buffer layout and interrupt
    generation necessarily differ from single-channel reception: Headers
    and trailers are not stripped from packets, packets are not aligned with
    buffer chunks, interrupts are per buffer chunk, not per packet.

    These drawbacks also cause a rather hefty code footprint to support this
    rarely used OHCI-1394 feature. (367 lines added, among them 94 lines of
    added userspace ABI documentation.)

    This implementation enforces that a multichannel reception context may
    only listen to channels to which no single-channel context on the same
    link layer is presently listening to. OHCI-1394 would allow to overlay
    single-channel contexts by the multi-channel context, but this would be
    a departure from the present first-come-first-served policy of IR
    context creation.

    The implementation is heavily based on an earlier one by Jay Fenlason.
    Thanks Jay.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Make a note on the seemingly unused linux/sched.h.
    Rename an irritatingly named variable.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • ioctl_create_iso_context enforces ctx->header_size >= 4.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • firewire-ohci keeps book of which isochronous channels are occupied by
    IR DMA contexts, so that there cannot be more than one context listening
    to a certain channel.

    If IR context creation failed due to an out-of-memory condition, this
    bookkeeping leaked a channel.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • When we append to a DMA program, we need to ensure that the order in
    which initialization of the new descriptors and update of the
    branch_address of the old tail descriptor, as seen by the PCI device,
    happen as intended.

    Signed-off-by: Stefan Richter

    Stefan Richter
     

27 Jul, 2010

13 commits

  • This adds nosy-dump, the userspace part of nosy, the IEEE 1394 traffic
    sniffer for Texas Instruments PCILynx/ PCILynx2 based cards. Author is
    Kristian Høgsberg.

    The files added here are taken from
    git://anongit.freedesktop.org/~krh/nosy commit ee29be97 (2009-11-10)
    with the following changes by Stefan Richter:
    - Parts pertaining to the kernel module removed from Makefile.
    - dist target removed from the Makefile.
    - Mentioned nosy-dump in the Kconfig help to nosy's kernel component.
    - Add copyright notice to nosy-dump.c. This is a duplicate of the
    respective notice in the kernel component nosy.c except for a time
    span of 2002 - 2006, according to Kristian's git log.

    "git shortlog decode-fcp.c list.h nosy-dump.[ch]" from nosy's git
    repository:

    Jonathan Woithe (1):
    Save logs on Ctrl-C

    Kristian Høgsberg (11):
    Pull over nosy from mercurial repo.
    Remove some fields from default view, add logging feature.
    Use infinite time out for poll(), mark more detail fields.
    Fix byte ordering macro.
    Add decoding of iso data and lock packets.
    Add flag to indicate data length field.
    Add cycle start packet decoding, add --iso and --cycle-start flags.
    Distinguish between phy-packets and 0-length iso data.
    Fix transaction and stats view.
    Add simple AV/C decoder.
    Don't break down on big payloads.

    Signed-off-by: Stefan Richter
    Acked-by: Kristian Høgsberg

    Stefan Richter
     
  • Replace home-grown printk wrapper macros by ones from kernel.h and
    device.h.

    Also raise the log level in set_phy_reg() from debug to error because
    these are really error conditions. Could even be WARN_ON. Lower the
    log level in the device probe and driver shutdown from notice to info.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • 1.) The DMA programs (struct pcl) are PCI-endian = little endian data
    (except for the 3rd quadlet in a PCL which the controller does not
    touch). Annotate them as such.

    Fix all accesses of the PCL to work with big endian CPUs also. Not
    actually tested, I only have a little endian PC to test with. This
    includes replacement of a bitfield struct pcl_status by open-coded
    shift and mask operations.

    2.) The two __attribute__ ((packed)) at struct pcl are not really
    required since it consists of u32/__le32 only, i.e. there will be no
    padding with or without the attribute.

    3.) The received IEEE 1394 data are byteswapped by the controller from
    IEEE 1394 endian = big endian to PCI endian = little endian because the
    PCL_BIGENDIAN control bit is set. Therefore annotate the DMA buffer as
    a __le32 array.

    Fix the one access of the DMA buffer (the check of the transaction code
    of link packets) to work with big endian CPUs. Also fix the two
    accesses of the client bounce buffer (the reading of packet length).

    4.) Add a comment to the userspace ABI header that all of the data gets
    out as little endian data, except for the timestamp which is CPU endian.
    (We could make it little endian too, but why? Vice versa, an ioctl
    could be added to dump packet data in big endian byte order...)

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Fix race between nosy_open() and remove_card() by replacing the
    unprotected array of card pointers by a mutex-protected list of cards.

    Make card instances reference-counted and let each client hold a
    reference.

    Notify clients about card removal via POLLHUP in poll()'s events
    bitmap; also let read() fail with errno=ENODEV if the card was removed
    and everything in the buffer was read.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • and add a missing pci_disable_device() to device shutdown.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Untested, I don't have a PCILynx CardBus card.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • nosy_start/stop_snoop() and nosy_add/remove_client() are simple enough
    to be inlined into their callers.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • nosy_start/stop_snoop() are always only called by the ioctl method, i.e.
    with IRQs enabled. packet_handler() and bus_reset_handler() are always
    only called by the IRQ handler. Hence neither one needs to track IRQ
    flags.

    To underline the call context of packet_handler() and
    bus_reset_handler(), rename these functions to *_irq_handler().

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • nosy_stop_snoop() would blow up the second time it was called without
    nosy_start_snoop() in between.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • The required serialization of NOSY_IOC_START and NOSY_IOC_STOP is
    already provided by the client_list_lock.

    NOSY_IOC_FILTER does not really require serialization since accesses
    to tcode_mask are atomic on any sane CPU architecture. Nevertheless,
    make it explicit that we want this to be atomic by means of
    client_list_lock (which also surrounds the other tcode_mask access in
    the IRQ handler). While we are at it, change the type of tcode_mask to
    u32 for consistency with the user API.

    NOSY_IOC_GET_STATS does not require serialization against itself. But
    there is a bug here regarding concurrent updates of the two counters
    by the IRQ handler. Fix it by taking the client_list_lock in this ioctl
    too.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Extend copyright note to 2007, c.f. Kristian's git log.

    Includes:
    - replace some by
    - add required indirectly included
    - order alphabetically

    Coding style related changes:
    - change to utf8
    - normalize whitespace
    - normalize comment style
    - remove usages of __FUNCTION__
    - remove an unnecessary cast from void *

    Const and static declarations:
    - driver_name is not const in pci_driver.name, drop const qualifier
    - driver_name can be taken from KBUILD_MODNAME
    - the global variable minors[] can and should be static
    - constify struct file_operations instance

    Data types:
    - Remove unused struct member struct packet.code. struct packet is
    only used for driver-internal bookkeeping; it does not appear on the
    wire or in DMA programs or the userspace ABI. Hence the unused
    member .code can be removed without worries.

    Preprocessor macros:
    - unroll a preprocessor macro that containd a return
    - use list_for_each_entry

    Printk:
    - add missing terminating \n in some format strings

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • This adds the traffic sniffer driver for Texas Instruments PCILynx/
    PCILynx2 based cards. The use cases for nosy are analysis of
    nonstandard protocols and as an aid in development of drivers,
    applications, or firmwares.

    Author of the driver is Kristian Høgsberg. Known contributers are
    Jody McIntyre and Jonathan Woithe.

    Nosy programs PCILynx chips to operate in promiscuous mode, which is a
    feature that is not found in OHCI-1394 controllers. Hence, only special
    hardware as mentioned in the Kconfig help text is suitable for nosy.

    This is only the kernelspace part of nosy. There is a userspace
    interface to it, called nosy-dump, proposed to be added into the tools/
    subdirectory of the kernel sources in a subsequent change. Kernelspace
    and userspave component of nosy communicate via a 'misc' character
    device file called /dev/nosy with a simple ioctl() and read() based
    protocol, as described by nosy-user.h.

    The files added here are taken from
    git://anongit.freedesktop.org/~krh/nosy commit ee29be97 (2009-11-10)
    with the following changes by Stefan Richter:
    - Kconfig and Makefile hunks are written from scratch.
    - Commented out version printk in nosy.c.
    - Included missing , reported by Stephen Rothwell.

    "git shortlog nosy{-user.h,.c,.h}" from nosy's git repository:

    Jonathan Woithe (2):
    Nosy updates for recent kernels
    Fix uninitialised memory (needed for 2.6.31 kernel)

    Kristian Høgsberg (5):
    Pull over nosy from mercurial repo.
    Use a misc device instead.
    Add simple AV/C decoder.
    Don't break down on big payloads.
    Set parent device for misc device.

    As a low-level IEEE 1394 driver, its files are placed into
    drivers/firewire/ although nosy is not part of the firewire driver
    stack.

    I am aware of the following literature from Texas Instruments about
    PCILynx programming:
    SCPA020A - PCILynx 1394 to PCI Bus Interface TSB12LV21BPGF
    Functional Specification
    SLLA023 - Initialization and Asynchronous Programming of the
    TSB12LV21A 1394 Device

    Signed-off-by: Stefan Richter
    Acked-by: Kristian Høgsberg

    Stefan Richter
     

23 Jul, 2010

7 commits

  • In both the ieee1394 stack and the firewire stack, the core treats
    kernelspace drivers better than userspace drivers when it comes to
    CSR address range allocation: The former may request a register to be
    placed automatically at a free spot anywhere inside a specified address
    range. The latter may only request a register at a fixed offset.

    Hence, userspace drivers which do not require a fixed offset potentially
    need to implement a retry loop with incremented offset in each retry
    until the kernel does not fail allocation with EBUSY. This awkward
    procedure is not fundamentally necessary as the core already provides a
    superior allocation API to kernelspace drivers.

    Therefore change the ioctl() ABI by addition of a region_end member in
    the existing struct fw_cdev_allocate. Userspace and kernelspace APIs
    work the same way now.

    There is a small cost to pay by clients though: If client source code
    is required to compile with older kernel headers too, then any use of
    the new member fw_cdev_allocate.region_end needs to be enclosed by
    #ifdef/#endif directives. However, any client program that seriously
    wants to use address range allocations will require a kernel of cdev ABI
    version >= 4 at runtime and a linux/firewire-cdev.h header of >= 4
    anyway. This is because v4 brings FW_CDEV_EVENT_REQUEST2. The only
    client program in which build-time compatibility with struct
    fw_cdev_allocate as found in older kernel headers makes sense is
    libraw1394.

    (libraw1394 uses the older broken FW_CDEV_EVENT_REQUEST to implement a
    makeshift, incorrect transaction responder that does at least work
    somewhat in many simple scenarios, relying on guesswork by libraw1394
    and by libraw1394 based applications. Plus, address range allocation
    and transaction responder is only one of many features that libraw1394
    needs to provide, and these other features need to work with kernel and
    kernel-headers as old as possible. Any new linux/firewire-cdev.h based
    client that implements a transaction responder should never attempt to
    do it like libraw1394; instead it should make a header and kernel of v4
    or later a hard requirement.)

    While we are at it, update the struct fw_cdev_allocate documentation to
    better reflect the recent fw_cdev_event_request2 ABI addition.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • region->end is defined as an upper bound of the requested address range,
    exclusive --- i.e. as an address outside of the range in which the
    requested CSR is to be placed.

    Hence 0x0001,0000,0000,0000 is the biggest valid region->end, not
    0x0000,ffff,ffff,fffc like the current check asserted.

    For simplicity, the fix drops the region->end & 3 test because there is
    no actual problem with these bits set in region->end. The allocated
    address range will be quadlet aligned and of a size of multiple quadlets
    due to the checks for region->start & 3 and handler->length & 3 alone.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • This extends the FW_CDEV_IOC_SEND_PHY_PACKET ioctl() for /dev/fw* to be
    useful for ping time measurements. One application for it would be gap
    count optimization in userspace that is based on ping times rather than
    hop count. (The latter is implemented in firewire-core itself but is
    not applicable to beta PHYs that act as repeater.)

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Add an FW_CDEV_IOC_RECEIVE_PHY_PACKETS ioctl() and
    FW_CDEV_EVENT_PHY_PACKET_RECEIVED poll()/read() event for /dev/fw*.
    This can be used to get information from remote PHYs by remote access
    PHY packets.

    This is also the 2nd half of the functionality (the receive part) to
    support a userspace implementation of a VersaPHY transaction layer.

    Safety considerations:

    - PHY packets are generally broadcasts, hence some kind of elevated
    privileges should be required of a process to be able to listen in
    on PHY packets. This implementation assumes that a process that is
    allowed to open the /dev/fw* of a local node does have this
    privilege.

    There was an inconclusive discussion about introducing POSIX
    capabilities as a means to check for user privileges for these
    kinds of operations.

    Other limitations:

    - PHY packet reception may be switched on by ioctl() but cannot be
    switched off again. It would be trivial to provide an off switch,
    but this is not worth the code. The client should simply close()
    the fd then, or just ignore further events.

    - For sake of simplicity of API and kernel-side implementation, no
    filter per packet content is provided.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Add an FW_CDEV_IOC_SEND_PHY_PACKET ioctl() for /dev/fw* which can be
    used to implement bus management related functionality in userspace.

    This is also half of the functionality (the transmit part) that is
    needed to support a userspace implementation of a VersaPHY transaction
    layer.

    Safety considerations:

    - PHY packets are generally broadcasts and may have interesting
    effects on PHYs and the bus, e.g. make asynchronous arbitration
    impossible due to too low gap count. Hence some kind of elevated
    privileges should be required of a process to be able to send
    PHY packets. This implementation assumes that a process that is
    allowed to open the /dev/fw* of a local node does have this
    privilege.

    There was an inconclusive discussion about introducing POSIX
    capabilities as a means to check for user privileges for these
    kinds of operations.

    - The kernel does not check integrity of the supplied packet data.
    That would be far too much code, considering the many kinds of
    PHY packets. A process which got the privilege to send these
    packets is trusted to do it correctly.

    Just like with the other "send packet" ioctls, a non-blocking API is
    chosen; i.e. the ioctl may return even before AT DMA started. After
    transmission, an event for poll()/read() is enqueued. Most users are
    going to need a blocking API, but a blocking userspace wrapper is easy
    to implement, and the second of the two existing libraw1394 calls
    raw1394_phy_packet_write() and raw1394_start_phy_packet_write() can be
    better supported that way.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • to make the correspondence of ioctl numbers and handlers more obvious.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • core-transaction.c transmit_complete_callback() and close_transaction()
    expect packet callback status to be an ACK or RCODE, and ACKs get
    translated to RCODEs for transaction callbacks.

    An old comment on the packet callback API (been there from the initial
    submission of the stack) and the dummy_driver implementation of
    send_request/send_response deviated from this as they also included
    -ERRNO in the range of status values.

    Let's narrow status values down to ACK and RCODE to prevent surprises.
    RCODE_CANCELLED is chosen as the dummy_driver's RCODE as its meaning of
    "transaction timed out" comes closest to what happens when a transaction
    coincides with card removal.

    Signed-off-by: Stefan Richter

    Stefan Richter
     

13 Jul, 2010

5 commits

  • Bus resets which are triggered
    - by the kernel drivers after updates of the local nodes' config ROM,
    - by userspace software via ioctl
    shall be deferred until after >=2 seconds after the last bus reset.

    If multiple modifications of the local nodes' config ROM happen in a row,
    only a single bus reset should happen after them.

    When the local node's link goes from inactive to active or vice versa,
    and at the two occasions of bus resets mentioned above --- and if the
    current gap count differs from 63 --- the bus reset should be preceded
    by a PHY configuration packet that reaffirms the gap count. Otherwise a
    bus manager would have to reset the bus again right after that.

    This is necessary to promote bus stability, e.g. leave grace periods for
    allocations and reallocations of isochronous channels and bandwidth,
    SBP-2 reconnections etc.; see IEEE 1394 clause 8.2.1.

    This change implements all of the above by moving bus reset initiation
    into a delayed work (except for bus resets which are triggered by the
    bus manager workqueue job and are performed there immediately). It
    comes with a necessary addition to the card driver methods that allows
    to get the current gap count from PHY registers.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • When a descriptor was added or removed to the local node's config ROM,
    userspace clients which had a local node's /dev/fw* open did not receive
    any fw_cdev_event_bus_reset for poll()/read() consumption.

    The cause was that the core-device.c facility which re-reads the config
    ROM of the bus reset initiator node missed to call the fw_device update
    function. The fw_units are destroyed and newly added, but their parent
    stays and needs to be updated.

    Reported-by: Jay Fenlason
    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • The FW_ISO_ constants of the in-kernel API of firewire-core and
    FW_CDEV_ISO_ constants of the userspace API of firewire-core have
    nothing to do with each other --- except that the core-cdev.c
    implementation relies on them having the same values.

    Hence put some compile-time assertions into core-cdev.c. It's lame but
    I prefer it over including the userspace API header into the kernelspace
    API header and defining kernelspace API constants from userspace API
    constants. Nor do I want to expose the kernelspace constants in one of
    the two firewire headers that are exported to userland since this only
    concerns the core-cdev.c implementation.

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • The present inline documentation of the fw_send_request() in-kernel API
    refers to userland code that is not applicable to kernel drivers at all.

    Reported-by: Ben Gamari

    While we are at fixing the whole documentation of fw_send_request(),
    also improve the rest of firewire-core's kerneldoc comments:
    - Add a bit of text concerning fw_run_transaction()'s call parameters.
    - Append () to function names and tab-align parameter descriptions as
    suggested by the example in Documentation/kernel-doc-nano-HOWTO.txt.
    - Remove kerneldoc markers from comments on static functions.
    - Remove outdated parameter descriptions at build_tree().

    Signed-off-by: Stefan Richter

    Stefan Richter
     
  • Check that the data length of a write quadlet request actually is large
    enough for a quadlet. Otherwise, fw_fill_request could access the four
    bytes after the end of the outbound_transaction_event structure.

    Signed-off-by: Clemens Ladisch

    Modification of Clemens' change: Consolidate the check into
    init_request() which is used by the affected ioctl_send_request() and
    ioctl_send_broadcast_request() and the unaffected
    ioctl_send_stream_packet(), to save a few lines of code.

    Note, since struct outbound_transaction_event *e is slab-allocated, such
    an out-of-bounds access won't hit unallocated memory but may result in a
    (virtually impossible to exploit) information disclosure.

    Signed-off-by: Stefan Richter

    Clemens Ladisch
     

08 Jul, 2010

1 commit