[media] iguanair: cannot send data from the stack
Note that the firmware already disables the receiver before transmit,
there is no need to do this from the driver.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 1e4c68a..51d7057 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -28,6 +28,7 @@
#include <media/rc-core.h>
#define DRIVER_NAME "iguanair"
+#define BUF_SIZE 152
struct iguanair {
struct rc_dev *rc;
@@ -35,26 +36,23 @@
struct device *dev;
struct usb_device *udev;
- int pipe_out;
uint16_t version;
uint8_t bufsize;
+ uint8_t cycle_overhead;
struct mutex lock;
/* receiver support */
bool receiver_on;
- dma_addr_t dma_in;
+ dma_addr_t dma_in, dma_out;
uint8_t *buf_in;
- struct urb *urb_in;
+ struct urb *urb_in, *urb_out;
struct completion completion;
/* transmit support */
bool tx_overflow;
uint32_t carrier;
- uint8_t cycle_overhead;
- uint8_t channels;
- uint8_t busy4;
- uint8_t busy7;
+ struct send_packet *packet;
char name[64];
char phys[64];
@@ -73,7 +71,8 @@
#define DIR_IN 0xdc
#define DIR_OUT 0xcd
-#define MAX_PACKET_SIZE 8u
+#define MAX_IN_PACKET 8u
+#define MAX_OUT_PACKET (sizeof(struct send_packet) + BUF_SIZE)
#define TIMEOUT 1000
#define RX_RESOLUTION 21333
@@ -191,20 +190,25 @@
dev_warn(ir->dev, "failed to resubmit urb: %d\n", rc);
}
-static int iguanair_send(struct iguanair *ir, void *data, unsigned size)
+static void iguanair_irq_out(struct urb *urb)
{
- int rc, transferred;
+ struct iguanair *ir = urb->context;
+
+ if (urb->status)
+ dev_dbg(ir->dev, "Error: out urb status = %d\n", urb->status);
+}
+
+static int iguanair_send(struct iguanair *ir, unsigned size)
+{
+ int rc;
INIT_COMPLETION(ir->completion);
- rc = usb_interrupt_msg(ir->udev, ir->pipe_out, data, size,
- &transferred, TIMEOUT);
+ ir->urb_out->transfer_buffer_length = size;
+ rc = usb_submit_urb(ir->urb_out, GFP_KERNEL);
if (rc)
return rc;
- if (transferred != size)
- return -EIO;
-
if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
return -ETIMEDOUT;
@@ -213,14 +217,13 @@
static int iguanair_get_features(struct iguanair *ir)
{
- struct packet packet;
int rc;
- packet.start = 0;
- packet.direction = DIR_OUT;
- packet.cmd = CMD_GET_VERSION;
+ ir->packet->header.start = 0;
+ ir->packet->header.direction = DIR_OUT;
+ ir->packet->header.cmd = CMD_GET_VERSION;
- rc = iguanair_send(ir, &packet, sizeof(packet));
+ rc = iguanair_send(ir, sizeof(ir->packet->header));
if (rc) {
dev_info(ir->dev, "failed to get version\n");
goto out;
@@ -235,17 +238,23 @@
ir->bufsize = 150;
ir->cycle_overhead = 65;
- packet.cmd = CMD_GET_BUFSIZE;
+ ir->packet->header.cmd = CMD_GET_BUFSIZE;
- rc = iguanair_send(ir, &packet, sizeof(packet));
+ rc = iguanair_send(ir, sizeof(ir->packet->header));
if (rc) {
dev_info(ir->dev, "failed to get buffer size\n");
goto out;
}
- packet.cmd = CMD_GET_FEATURES;
+ if (ir->bufsize > BUF_SIZE) {
+ dev_info(ir->dev, "buffer size %u larger than expected\n",
+ ir->bufsize);
+ ir->bufsize = BUF_SIZE;
+ }
- rc = iguanair_send(ir, &packet, sizeof(packet));
+ ir->packet->header.cmd = CMD_GET_FEATURES;
+
+ rc = iguanair_send(ir, sizeof(ir->packet->header));
if (rc) {
dev_info(ir->dev, "failed to get features\n");
goto out;
@@ -257,13 +266,18 @@
static int iguanair_receiver(struct iguanair *ir, bool enable)
{
- struct packet packet = { 0, DIR_OUT, enable ?
- CMD_RECEIVER_ON : CMD_RECEIVER_OFF };
+ int rc;
+
+ ir->packet->header.start = 0;
+ ir->packet->header.direction = DIR_OUT;
+ ir->packet->header.cmd = enable ? CMD_RECEIVER_ON : CMD_RECEIVER_OFF;
if (enable)
ir_raw_event_reset(ir->rc);
- return iguanair_send(ir, &packet, sizeof(packet));
+ rc = iguanair_send(ir, sizeof(ir->packet->header));
+
+ return rc;
}
/*
@@ -308,8 +322,8 @@
fours = (cycles - sevens * 7) / 4;
/* magic happens here */
- ir->busy7 = (4 - sevens) * 2;
- ir->busy4 = 110 - fours;
+ ir->packet->busy7 = (4 - sevens) * 2;
+ ir->packet->busy4 = 110 - fours;
}
mutex_unlock(&ir->lock);
@@ -325,7 +339,7 @@
return 4;
mutex_lock(&ir->lock);
- ir->channels = mask;
+ ir->packet->channels = mask << 4;
mutex_unlock(&ir->lock);
return 0;
@@ -337,16 +351,9 @@
uint8_t space;
unsigned i, size, periods, bytes;
int rc;
- struct send_packet *packet;
mutex_lock(&ir->lock);
- packet = kmalloc(sizeof(*packet) + ir->bufsize, GFP_KERNEL);
- if (!packet) {
- rc = -ENOMEM;
- goto out;
- }
-
/* convert from us to carrier periods */
for (i = space = size = 0; i < count; i++) {
periods = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
@@ -356,11 +363,11 @@
break;
}
while (periods > 127) {
- packet->payload[size++] = 127 | space;
+ ir->packet->payload[size++] = 127 | space;
periods -= 127;
}
- packet->payload[size++] = periods | space;
+ ir->packet->payload[size++] = periods | space;
space ^= 0x80;
}
@@ -369,36 +376,19 @@
goto out;
}
- packet->header.start = 0;
- packet->header.direction = DIR_OUT;
- packet->header.cmd = CMD_SEND;
- packet->length = size;
- packet->channels = ir->channels << 4;
- packet->busy7 = ir->busy7;
- packet->busy4 = ir->busy4;
-
- if (ir->receiver_on) {
- rc = iguanair_receiver(ir, false);
- if (rc) {
- dev_warn(ir->dev, "disable receiver before transmit failed\n");
- goto out;
- }
- }
+ ir->packet->header.start = 0;
+ ir->packet->header.direction = DIR_OUT;
+ ir->packet->header.cmd = CMD_SEND;
+ ir->packet->length = size;
ir->tx_overflow = false;
- rc = iguanair_send(ir, packet, size + 8);
+ rc = iguanair_send(ir, sizeof(*ir->packet) + size);
if (rc == 0 && ir->tx_overflow)
rc = -EOVERFLOW;
- if (ir->receiver_on) {
- if (iguanair_receiver(ir, true))
- dev_warn(ir->dev, "re-enable receiver after transmit failed\n");
- }
-
out:
- kfree(packet);
mutex_unlock(&ir->lock);
return rc ? rc : count;
@@ -411,8 +401,6 @@
mutex_lock(&ir->lock);
- BUG_ON(ir->receiver_on);
-
rc = iguanair_receiver(ir, true);
if (rc == 0)
ir->receiver_on = true;
@@ -443,7 +431,7 @@
struct usb_device *udev = interface_to_usbdev(intf);
struct iguanair *ir;
struct rc_dev *rc;
- int ret, pipein;
+ int ret, pipein, pipeout;
struct usb_host_interface *idesc;
ir = kzalloc(sizeof(*ir), GFP_KERNEL);
@@ -453,11 +441,14 @@
goto out;
}
- ir->buf_in = usb_alloc_coherent(udev, MAX_PACKET_SIZE, GFP_KERNEL,
+ ir->buf_in = usb_alloc_coherent(udev, MAX_IN_PACKET, GFP_KERNEL,
&ir->dma_in);
+ ir->packet = usb_alloc_coherent(udev, MAX_OUT_PACKET, GFP_KERNEL,
+ &ir->dma_out);
ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
+ ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
- if (!ir->buf_in || !ir->urb_in) {
+ if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
ret = -ENOMEM;
goto out;
}
@@ -472,13 +463,18 @@
ir->rc = rc;
ir->dev = &intf->dev;
ir->udev = udev;
- ir->pipe_out = usb_sndintpipe(udev,
- idesc->endpoint[1].desc.bEndpointAddress);
mutex_init(&ir->lock);
+
init_completion(&ir->completion);
+ pipeout = usb_sndintpipe(udev,
+ idesc->endpoint[1].desc.bEndpointAddress);
+ usb_fill_int_urb(ir->urb_out, udev, pipeout, ir->packet, MAX_OUT_PACKET,
+ iguanair_irq_out, ir, 1);
+ ir->urb_out->transfer_dma = ir->dma_out;
+ ir->urb_out->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
pipein = usb_rcvintpipe(udev, idesc->endpoint[0].desc.bEndpointAddress);
- usb_fill_int_urb(ir->urb_in, udev, pipein, ir->buf_in, MAX_PACKET_SIZE,
+ usb_fill_int_urb(ir->urb_in, udev, pipein, ir->buf_in, MAX_IN_PACKET,
iguanair_rx, ir, 1);
ir->urb_in->transfer_dma = ir->dma_in;
ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -528,11 +524,14 @@
return 0;
out2:
usb_kill_urb(ir->urb_in);
+ usb_kill_urb(ir->urb_out);
out:
if (ir) {
usb_free_urb(ir->urb_in);
- usb_free_coherent(udev, MAX_PACKET_SIZE, ir->buf_in,
- ir->dma_in);
+ usb_free_urb(ir->urb_out);
+ usb_free_coherent(udev, MAX_IN_PACKET, ir->buf_in, ir->dma_in);
+ usb_free_coherent(udev, MAX_OUT_PACKET, ir->packet,
+ ir->dma_out);
}
rc_free_device(rc);
kfree(ir);
@@ -546,8 +545,11 @@
rc_unregister_device(ir->rc);
usb_set_intfdata(intf, NULL);
usb_kill_urb(ir->urb_in);
+ usb_kill_urb(ir->urb_out);
usb_free_urb(ir->urb_in);
- usb_free_coherent(ir->udev, MAX_PACKET_SIZE, ir->buf_in, ir->dma_in);
+ usb_free_urb(ir->urb_out);
+ usb_free_coherent(ir->udev, MAX_IN_PACKET, ir->buf_in, ir->dma_in);
+ usb_free_coherent(ir->udev, MAX_OUT_PACKET, ir->packet, ir->dma_out);
kfree(ir);
}
@@ -565,6 +567,7 @@
}
usb_kill_urb(ir->urb_in);
+ usb_kill_urb(ir->urb_out);
mutex_unlock(&ir->lock);