From owner-freebsd-firewire@FreeBSD.ORG  Wed May 26 14:00:12 2004
Return-Path: <owner-freebsd-firewire@FreeBSD.ORG>
Delivered-To: freebsd-firewire@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8748216A4D3
	for <freebsd-firewire@freebsd.org>;
	Wed, 26 May 2004 14:00:12 -0700 (PDT)
Received: from gaia.arc.nasa.gov (gaia.arc.nasa.gov [143.232.155.74])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 674F543D1F
	for <freebsd-firewire@freebsd.org>;
	Wed, 26 May 2004 14:00:12 -0700 (PDT)
	(envelope-from buzz@gaia.arc.nasa.gov)
Received: from mono.arc.nasa.gov (mono.arc.nasa.gov [143.232.155.67])
	by gaia.arc.nasa.gov (8.11.7/8.11.6) with ESMTP id i4QKxJZ03477
	for <freebsd-firewire@freebsd.org>;
	Wed, 26 May 2004 13:59:19 -0700 (PDT)
Date: Wed, 26 May 2004 13:59:16 -0700 (PDT)
From: Buzz Slye <buzz@gaia.arc.nasa.gov>
X-X-Sender: buzz@mono.arc.nasa.gov
To: freebsd-firewire@freebsd.org
Message-ID: <Pine.GSO.4.58.0405261357400.2183@mono.arc.nasa.gov>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: Quadlet read/write bug
X-BeenThere: freebsd-firewire@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Firewire support in FreeBSD <freebsd-firewire.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-firewire>,
	<mailto:freebsd-firewire-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-firewire>
List-Post: <mailto:freebsd-firewire@freebsd.org>
List-Help: <mailto:freebsd-firewire-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-firewire>,
	<mailto:freebsd-firewire-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 26 May 2004 21:00:12 -0000

A temporary fix to the asyncronous read and write cases of fw_ioctl
for a req.len = 16 is (fwdev.c line 595):
        int tc;
        .....
        /* copy response */
        tc = xfer->recv.hdr.mode.hdr.tcode;
        tinfo = &sc->fc->tcode[tc];
        if (tc == FWTCODE_RRESQ || tc == FWTCODE_WRES)
                asyreq->req.len = xfer->recv.pay_len;
        else if (asyreq->req.len >= xfer->recv.pay_len + tinfo->hdr_len)
                asyreq->req.len = xfer->recv.pay_len;
        else
                err = EINVAL;

The above will work for rreqq and wreqq, but I didn't look at the other cases.
Note that for the read request response, the payload length is 4, but the
header length is 16.  This adds up to 20 which doesn't work for req.len=16.
The response header should be 12 maybe, if the payload is 4 ?
For the write request response, the payload length is 4096, but there really
isn't any payload returned.  Returning req.len=4096 isn't good, but if the
application doesn't check it, it certainly beats returning EINVAL.

R. E. Slye
NASA/Ames