speedtch cxacru.c,1.42,1.43 usbatm.c,1.60,1.61 xusbatm.c,1.21,1.22

[Duncan Sands]

Update of /home/cvs/speedtch
In directory phoenix.infradead.org:/tmp/cvs-serv6226

Modified Files:
	cxacru.c usbatm.c xusbatm.c 
Log Message:
Handle tx and rx buffer size calculations separately.  The tx buffer needs
to be a multiple of the stride, which wasn't enforced before (so this is a
bug fix).  The rx buffer is a multiple of the endpoint packet size as
before.  I threw in some formatting and name changes from the kernel patch
for good measure.


Index: cxacru.c
===================================================================
RCS file: /home/cvs/speedtch/cxacru.c,v
retrieving revision 1.42
retrieving revision 1.43
diff -u -r1.42 -r1.43
--- cxacru.c	10 Jan 2006 23:02:27 -0000	1.42
+++ cxacru.c	12 Jan 2006 15:04:05 -0000	1.43
@@ -723,7 +723,7 @@
 
 	usbatm_instance->driver_data = instance;
 
-	usbatm_instance->flags = cxacru_card_status(instance) ? 0 : UDSL_SKIP_HEAVY_INIT;
+	usbatm_instance->flags = (cxacru_card_status(instance) ? 0 : UDSL_SKIP_HEAVY_INIT);
 
 	return 0;
 

Index: usbatm.c
===================================================================
RCS file: /home/cvs/speedtch/usbatm.c,v
retrieving revision 1.60
retrieving revision 1.61
diff -u -r1.60 -r1.61
--- usbatm.c	10 Jan 2006 17:09:29 -0000	1.60
+++ usbatm.c	12 Jan 2006 15:04:05 -0000	1.61
@@ -334,7 +334,7 @@
 
 	if (sarb->tail + ATM_CELL_PAYLOAD > sarb->end) {
 		atm_rldbg(instance, "%s: buffer overrun (sarb->len %u, vcc: 0x%p)!\n",
-			  __func__, sarb->len, vcc);
+				__func__, sarb->len, vcc);
 		/* discard cells already received */
 		skb_trim(sarb, 0);
 		UDSL_ASSERT(sarb->tail + ATM_CELL_PAYLOAD <= sarb->end);
@@ -462,14 +462,14 @@
 {
 	struct usbatm_control *ctrl = UDSL_SKB(skb);
 	struct atm_vcc *vcc = ctrl->atm.vcc;
-	unsigned int num_written;
+	unsigned int bytes_written;
 	unsigned int stride = instance->tx_channel.stride;
 
 	vdbg("%s: skb->len=%d, avail_space=%u", __func__, skb->len, avail_space);
 	UDSL_ASSERT(!(avail_space % stride));
 
-	for (num_written = 0; num_written < avail_space && ctrl->len;
-	     num_written += stride, target += stride) {
+	for (bytes_written = 0; bytes_written < avail_space && ctrl->len;
+	     bytes_written += stride, target += stride) {
 		unsigned int data_len = min_t(unsigned int, skb->len, ATM_CELL_PAYLOAD);
 		unsigned int left = ATM_CELL_PAYLOAD - data_len;
 		u8 *ptr = target;
@@ -512,7 +512,7 @@
 			ctrl->crc = crc32_be(ctrl->crc, ptr, left);
 	}
 
-	return num_written;
+	return bytes_written;
 }
 
 
@@ -580,7 +580,7 @@
 	struct sk_buff *skb = instance->current_skb;
 	struct urb *urb = NULL;
 	const unsigned int buf_size = instance->tx_channel.buf_size;
-	unsigned int num_written = 0;
+	unsigned int bytes_written = 0;
 	u8 *buffer = NULL;
 
 	if (!skb)
@@ -592,16 +592,16 @@
 			if (!urb)
 				break;		/* no more senders */
 			buffer = urb->transfer_buffer;
-			num_written = (urb->status == -EAGAIN) ?
+			bytes_written = (urb->status == -EAGAIN) ?
 				urb->transfer_buffer_length : 0;
 		}
 
-		num_written += usbatm_write_cells(instance, skb,
-						  buffer + num_written,
-						  buf_size - num_written);
+		bytes_written += usbatm_write_cells(instance, skb,
+						  buffer + bytes_written,
+						  buf_size - bytes_written);
 
 		vdbg("%s: wrote %u bytes from skb 0x%p to urb 0x%p",
-		     __func__, num_written, skb, urb);
+		     __func__, bytes_written, skb, urb);
 
 		if (!UDSL_SKB(skb)->len) {
 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
@@ -612,8 +612,8 @@
 			skb = skb_dequeue(&instance->sndqueue);
 		}
 
-		if (num_written == buf_size || (!skb && num_written)) {
-			urb->transfer_buffer_length = num_written;
+		if (bytes_written == buf_size || (!skb && bytes_written)) {
+			urb->transfer_buffer_length = bytes_written;
 
 			if (usbatm_submit_urb(urb))
 				break;
@@ -677,7 +677,7 @@
 
 	if (skb->len > ATM_MAX_AAL5_PDU) {
 		atm_rldbg(instance, "%s: packet too long (%d vs %d)!\n",
-			  __func__, skb->len, ATM_MAX_AAL5_PDU);
+				__func__, skb->len, ATM_MAX_AAL5_PDU);
 		err = -EINVAL;
 		goto fail;
 	}
@@ -1054,6 +1054,7 @@
 	char *buf;
 	int error = -ENOMEM;
 	int i, length;
+	unsigned int maxpacket, num_packets;
 
 	dev_dbg(dev, "%s: trying driver %s with vendor=%04x, product=%04x, ifnum %2d\n",
 			__func__, driver->driver_name,
@@ -1121,8 +1122,6 @@
 	tasklet_init(&instance->tx_channel.tasklet, usbatm_tx_process, (unsigned long)instance);
 	instance->rx_channel.stride = ATM_CELL_SIZE + driver->rx_padding;
 	instance->tx_channel.stride = ATM_CELL_SIZE + driver->tx_padding;
-	instance->rx_channel.buf_size = rcv_buf_bytes;
-	instance->tx_channel.buf_size = snd_buf_bytes;
 	instance->rx_channel.usbatm = instance->tx_channel.usbatm = instance;
 
 	if ((instance->flags & UDSL_USE_ISOC) && driver->isoc_in)
@@ -1132,29 +1131,37 @@
 
 	instance->tx_channel.endpoint = usb_sndbulkpipe(usb_dev, driver->bulk_out);
 
-	/* calculate buffer sizes */
+	/* tx buffer size must be a positive multiple of the stride */
+	instance->tx_channel.buf_size = max (instance->tx_channel.stride,
+			snd_buf_bytes - (snd_buf_bytes % instance->tx_channel.stride));
 
-	for (i = 0; i < 2; i++) {
-		struct usbatm_channel *channel = i ?
-			&instance->tx_channel : &instance->rx_channel;
-		unsigned int maxpacket = usb_maxpacket(usb_dev, channel->endpoint, i);
-		unsigned int num_packets;
 
-		if ((maxpacket < 1) || (maxpacket > UDSL_MAX_BUF_SIZE)) {
-			dev_err(dev, "%s: invalid endpoint %02x!\n", __func__, usb_pipeendpoint(channel->endpoint));
-			error = -EINVAL;
-			goto fail_unbind;
-		}
+	/* rx buffer size must be a positive multiple of the endpoint maxpacket */
+	maxpacket = usb_maxpacket(usb_dev, instance->rx_channel.endpoint, 0);
+
+	if ((maxpacket < 1) || (maxpacket > UDSL_MAX_BUF_SIZE)) {
+		dev_err(dev, "%s: invalid endpoint %02x!\n", __func__,
+				usb_pipeendpoint(instance->rx_channel.endpoint));
+		error = -EINVAL;
+		goto fail_unbind;
+	}
 
-		num_packets = max (1U, (channel->buf_size + maxpacket / 2) / maxpacket); /* round */
+	num_packets = max (1U, (rcv_buf_bytes + maxpacket / 2) / maxpacket); /* round */
 
-		if (num_packets * maxpacket > UDSL_MAX_BUF_SIZE)
-			num_packets--;
+	if (num_packets * maxpacket > UDSL_MAX_BUF_SIZE)
+		num_packets--;
 
-		channel->buf_size = num_packets * maxpacket;
-		channel->packet_size = maxpacket;
-		dev_dbg(dev, "%s: using %d byte buffer for channel 0x%p\n", __func__, channel->buf_size, channel);
+	instance->rx_channel.buf_size = num_packets * maxpacket;
+	instance->rx_channel.packet_size = maxpacket;
+
+#ifdef DEBUG
+	for (i = 0; i < 2; i++) {
+		struct usbatm_channel *channel = i ?
+			&instance->tx_channel : &instance->rx_channel;
+
+		dev_dbg(dev, "%s: using %d byte buffer for %s channel 0x%p\n", __func__, channel->buf_size, i ? "tx" : "rx", channel);
 	}
+#endif
 
 	/* initialize urbs */
 
@@ -1176,6 +1183,7 @@
 
 		instance->urbs[i] = urb;
 
+		/* zero the tx padding to avoid leaking information */
 		buffer = kzalloc(channel->buf_size, GFP_KERNEL);
 		if (!buffer) {
 			dev_err(dev, "%s: no memory for buffer %d!\n", __func__, i);

Index: xusbatm.c
===================================================================
RCS file: /home/cvs/speedtch/xusbatm.c,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- xusbatm.c	10 Jan 2006 23:02:28 -0000	1.21
+++ xusbatm.c	12 Jan 2006 15:04:05 -0000	1.22
@@ -101,7 +101,7 @@
 	int ret;
 
 	usb_dbg(usbatm, "%s: binding driver %d: vendor %04x product %04x"
-		" rx: ep %02x  padd %d alt %2d tx: ep %02x  padd %d alt %2d\n",
+		" rx: ep %02x padd %d alt %2d tx: ep %02x padd %d alt %2d\n",
 		__func__, drv_ix, vendor[drv_ix], product[drv_ix],
 		rx_endpoint[drv_ix], rx_padding[drv_ix], rx_alt,
 		tx_endpoint[drv_ix], tx_padding[drv_ix], tx_alt);