<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/firewire, branch v2.6.26-rc7</title>
<subtitle>Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git</subtitle>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/'/>
<entry>
<title>firewire: Kconfig menu touch-up</title>
<updated>2008-06-18T22:12:35+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-06-14T12:24:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=a7b64b8704b03c9972b114932fdf517e06153f11'/>
<id>a7b64b8704b03c9972b114932fdf517e06153f11</id>
<content type='text'>
Emphasize the recommendation to build only one stack.
Trim the prompts to better fit into short attention spans.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Emphasize the recommendation to build only one stack.
Trim the prompts to better fit into short attention spans.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: deadline for PHY config transmission</title>
<updated>2008-06-18T22:12:35+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-06-18T16:20:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=ae1e53557911d7e60a637b2400173add958aae94'/>
<id>ae1e53557911d7e60a637b2400173add958aae94</id>
<content type='text'>
If the low-level driver failed to initialize a card properly without
noticing it, fw-core was blocked indefinitely when trying to send a
PHY config packet.  This hung up the events kernel thread, e.g. locked
up keyboard input.
https://bugzilla.redhat.com/show_bug.cgi?id=444694
https://bugzilla.redhat.com/show_bug.cgi?id=446763

This problem was introduced between 2.6.25 and 2.6.26-rc1 by commit
2a0a2590498be7b92e3e76409c9b8ee722e23c8f "firewire: wait until PHY
configuration packet was transmitted (fix bus reset loop)".

The solution is to wait with timeout.  I tested it with 7 different
working controllers and 1 non-working controller.  On the working ones,
the packet callback complete()s usually --- but not always --- before a
timeout of 10ms.  Hence I chose a safer timeout of 100ms.

On the few tests with the non-working controller ALi M5271, PHY config
packet transmission always timed out so far.  (Fw-ohci needs to be fixed
for this controller independently of this deadline fix.  Often the core
doesn't even attempt to send a phy config because not even self ID
reception works.)

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If the low-level driver failed to initialize a card properly without
noticing it, fw-core was blocked indefinitely when trying to send a
PHY config packet.  This hung up the events kernel thread, e.g. locked
up keyboard input.
https://bugzilla.redhat.com/show_bug.cgi?id=444694
https://bugzilla.redhat.com/show_bug.cgi?id=446763

This problem was introduced between 2.6.25 and 2.6.26-rc1 by commit
2a0a2590498be7b92e3e76409c9b8ee722e23c8f "firewire: wait until PHY
configuration packet was transmitted (fix bus reset loop)".

The solution is to wait with timeout.  I tested it with 7 different
working controllers and 1 non-working controller.  On the working ones,
the packet callback complete()s usually --- but not always --- before a
timeout of 10ms.  Hence I chose a safer timeout of 100ms.

On the few tests with the non-working controller ALi M5271, PHY config
packet transmission always timed out so far.  (Fw-ohci needs to be fixed
for this controller independently of this deadline fix.  Often the core
doesn't even attempt to send a phy config because not even self ID
reception works.)

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: fw-ohci: unify printk prefixes</title>
<updated>2008-06-18T22:12:35+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-06-14T12:23:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=161b96e782ec995c55843101976d9c35b57aa109'/>
<id>161b96e782ec995c55843101976d9c35b57aa109</id>
<content type='text'>
The messages which can be enabled by fw-ohci's debug module parameter
are changed from KERN_DEBUG to KERN_NOTICE level and uniformly prefixed
with "firewire_ohci: ".  This further simplifies communication with
users when we ask them to capture debug messages.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The messages which can be enabled by fw-ohci's debug module parameter
are changed from KERN_DEBUG to KERN_NOTICE level and uniformly prefixed
with "firewire_ohci: ".  This further simplifies communication with
users when we ask them to capture debug messages.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: fill_bus_reset_event needs lock protection</title>
<updated>2008-06-18T22:12:35+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-06-06T20:11:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=5cb84067d646fa3889463129dad8b218806b4698'/>
<id>5cb84067d646fa3889463129dad8b218806b4698</id>
<content type='text'>
Callers of fill_bus_reset_event() have to take card-&gt;lock.  Otherwise
access to node data may oops if node removal is in progress.

A lockless alternative would be

-	event-&gt;local_node_id = card-&gt;local_node-&gt;node_id;
+	tmp = fw_node_get(card-&gt;local_node);
+	event-&gt;local_node_id = tmp-&gt;node_id;
+	fw_node_put(tmp);

and ditto with the other node pointers which fill_bus_reset_event()
accesses.  But I went the locked route because one of the two callers
already holds the lock.  As a bonus, we don't need the memory barrier
anymore because device-&gt;generation and device-&gt;node_id are written in
a card-&gt;lock protected section.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
Signed-off-by: Kristian Høgsberg &lt;krh@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Callers of fill_bus_reset_event() have to take card-&gt;lock.  Otherwise
access to node data may oops if node removal is in progress.

A lockless alternative would be

-	event-&gt;local_node_id = card-&gt;local_node-&gt;node_id;
+	tmp = fw_node_get(card-&gt;local_node);
+	event-&gt;local_node_id = tmp-&gt;node_id;
+	fw_node_put(tmp);

and ditto with the other node pointers which fill_bus_reset_event()
accesses.  But I went the locked route because one of the two callers
already holds the lock.  As a bonus, we don't need the memory barrier
anymore because device-&gt;generation and device-&gt;node_id are written in
a card-&gt;lock protected section.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
Signed-off-by: Kristian Høgsberg &lt;krh@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: fw-ohci: write selfIDBufferPtr before LinkControl.rcvSelfID</title>
<updated>2008-06-18T22:12:35+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-06-05T18:50:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=affc9c24ade666f9903163c12686da567dbfe06f'/>
<id>affc9c24ade666f9903163c12686da567dbfe06f</id>
<content type='text'>
OHCI 1.1 clause 5.10 requires that selfIDBufferPtr is valid when a 1 is
written into LinkControl.rcvSelfID.

This driver bug has so far not been known to cause harm because most
chips obviously accept a later selfIDBufferPtr write, at least before
HCControl.linkEnable is written.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
Signed-off-by: Jarod Wilson &lt;jwilson@redhat.com&gt;
Signed-off-by: Kristian Høgsberg &lt;krh@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
OHCI 1.1 clause 5.10 requires that selfIDBufferPtr is valid when a 1 is
written into LinkControl.rcvSelfID.

This driver bug has so far not been known to cause harm because most
chips obviously accept a later selfIDBufferPtr write, at least before
HCControl.linkEnable is written.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
Signed-off-by: Jarod Wilson &lt;jwilson@redhat.com&gt;
Signed-off-by: Kristian Høgsberg &lt;krh@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: fw-ohci: disable PHY packet reception into AR context</title>
<updated>2008-06-18T22:12:34+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-06-05T18:49:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=e896ec4302f45fdaf2fc78aec0093eca5478fe28'/>
<id>e896ec4302f45fdaf2fc78aec0093eca5478fe28</id>
<content type='text'>
We want the rcvPhyPkt bit in LinkControl off before we start using the
chip.  However, the spec says that the reset value of it is undefined.
Hence switch it explicitly off.

https://bugzilla.redhat.com/show_bug.cgi?id=244576#c48 shows that for
example the nForce2 integrated FireWire controller seems to have it on
by default.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
Signed-off-by: Jarod Wilson &lt;jwilson@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We want the rcvPhyPkt bit in LinkControl off before we start using the
chip.  However, the spec says that the reset value of it is undefined.
Hence switch it explicitly off.

https://bugzilla.redhat.com/show_bug.cgi?id=244576#c48 shows that for
example the nForce2 integrated FireWire controller seems to have it on
by default.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
Signed-off-by: Jarod Wilson &lt;jwilson@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: fw-ohci: use of uninitialized data in AR handler</title>
<updated>2008-06-18T22:12:34+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-05-31T17:36:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=ccff962943df539c5860aa120eecc189d70a308b'/>
<id>ccff962943df539c5860aa120eecc189d70a308b</id>
<content type='text'>
header_length and payload_length are filled with random data if an
unknown tcode was read from the AR buffer (i.e. if the AR buffer
contained invalid data).

We still need a better strategy to recover from this, but at least
handle_ar_packet now doesn't return out of bound buffer addresses
anymore.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
header_length and payload_length are filled with random data if an
unknown tcode was read from the AR buffer (i.e. if the AR buffer
contained invalid data).

We still need a better strategy to recover from this, but at least
handle_ar_packet now doesn't return out of bound buffer addresses
anymore.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: don't panic on invalid AR request buffer</title>
<updated>2008-06-18T22:12:34+00:00</updated>
<author>
<name>Stefan Richter</name>
<email>stefanr@s5r6.in-berlin.de</email>
</author>
<published>2008-05-31T17:01:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=0bf607c5b4edd13362e4add6ca1e81f8a9fbd47c'/>
<id>0bf607c5b4edd13362e4add6ca1e81f8a9fbd47c</id>
<content type='text'>
BUG() at this place is wrong.  (Unless if the low level driver would
already do higher-level input validation of incoming request headers.)

Invalid incoming requests or bugs in the controller which corrupt the
AR-req buffer needlessly crashed the box because this is run in tasklet
context.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
BUG() at this place is wrong.  (Unless if the low level driver would
already do higher-level input validation of incoming request headers.)

Invalid incoming requests or bugs in the controller which corrupt the
AR-req buffer needlessly crashed the box because this is run in tasklet
context.

Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>firewire: prevent userspace from accessing shut down devices</title>
<updated>2008-05-20T16:24:17+00:00</updated>
<author>
<name>Jay Fenlason</name>
<email>fenlason@redhat.com</email>
</author>
<published>2008-05-16T15:15:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=551f4cb9de716ffcdaf968c99a450c22ff12e8c3'/>
<id>551f4cb9de716ffcdaf968c99a450c22ff12e8c3</id>
<content type='text'>
If userspace ignores the POLLERR bit from poll(), and only attempts to
read() the device when POLLIN is set, it can still make ioctl() calls on
a device that has been removed from the system.  The node_id and
generation returned by GET_INFO will be outdated, but INITIATE_BUS_RESET
would still cause a bus reset, and GET_CYCLE_TIMER will return data.
And if you guess the correct generation to use, you can send requests to
a different device on the bus, and get responses back.

This patch prevents open, ioctl, compat_ioctl, and mmap against shutdown
devices.

Signed-off-by: Jay Fenlason &lt;fenlason@redhat.com&gt;
Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If userspace ignores the POLLERR bit from poll(), and only attempts to
read() the device when POLLIN is set, it can still make ioctl() calls on
a device that has been removed from the system.  The node_id and
generation returned by GET_INFO will be outdated, but INITIATE_BUS_RESET
would still cause a bus reset, and GET_CYCLE_TIMER will return data.
And if you guess the correct generation to use, you can send requests to
a different device on the bus, and get responses back.

This patch prevents open, ioctl, compat_ioctl, and mmap against shutdown
devices.

Signed-off-by: Jay Fenlason &lt;fenlason@redhat.com&gt;
Signed-off-by: Stefan Richter &lt;stefanr@s5r6.in-berlin.de&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6</title>
<updated>2008-05-02T20:52:35+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2008-05-02T20:52:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=d626e3bf728c47746f2129aa00c775d4e8c2a73b'/>
<id>d626e3bf728c47746f2129aa00c775d4e8c2a73b</id>
<content type='text'>
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6:
  [SCSI] aic94xx: fix section mismatch
  [SCSI] u14-34f: Fix 32bit only problem
  [SCSI] dpt_i2o: sysfs code
  [SCSI] dpt_i2o: 64 bit support
  [SCSI] dpt_i2o: move from virt_to_bus/bus_to_virt to dma_alloc_coherent
  [SCSI] dpt_i2o: use standard __init / __exit code
  [SCSI] megaraid_sas: fix suspend/resume sections
  [SCSI] aacraid: Add Power Management support
  [SCSI] aacraid: Fix jbod operations scan issues
  [SCSI] aacraid: Fix warning about macro side-effects
  [SCSI] add support for variable length extended commands
  [SCSI] Let scsi_cmnd-&gt;cmnd use request-&gt;cmd buffer
  [SCSI] bsg: add large command support
  [SCSI] aacraid: Fix down_interruptible() to check the return value correctly
  [SCSI] megaraid_sas; Update the Version and Changelog
  [SCSI] ibmvscsi: Handle non SCSI error status
  [SCSI] bug fix for free list handling
  [SCSI] ipr: Rename ipr's state scsi host attribute to prevent collisions
  [SCSI] megaraid_mbox: fix Dell CERC firmware problem
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6:
  [SCSI] aic94xx: fix section mismatch
  [SCSI] u14-34f: Fix 32bit only problem
  [SCSI] dpt_i2o: sysfs code
  [SCSI] dpt_i2o: 64 bit support
  [SCSI] dpt_i2o: move from virt_to_bus/bus_to_virt to dma_alloc_coherent
  [SCSI] dpt_i2o: use standard __init / __exit code
  [SCSI] megaraid_sas: fix suspend/resume sections
  [SCSI] aacraid: Add Power Management support
  [SCSI] aacraid: Fix jbod operations scan issues
  [SCSI] aacraid: Fix warning about macro side-effects
  [SCSI] add support for variable length extended commands
  [SCSI] Let scsi_cmnd-&gt;cmnd use request-&gt;cmd buffer
  [SCSI] bsg: add large command support
  [SCSI] aacraid: Fix down_interruptible() to check the return value correctly
  [SCSI] megaraid_sas; Update the Version and Changelog
  [SCSI] ibmvscsi: Handle non SCSI error status
  [SCSI] bug fix for free list handling
  [SCSI] ipr: Rename ipr's state scsi host attribute to prevent collisions
  [SCSI] megaraid_mbox: fix Dell CERC firmware problem
</pre>
</div>
</content>
</entry>
</feed>
