[media] iguanair: cannot send data from the stack

Note that the firmware already disables the receiver before transmit,
there is no need to do this from the driver.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 1e4c68a5cecfedfa24c2053dd1b67db88f83e5a3..51d7057aca0443414f8325e119a1da81a2e03840 100644 (file)
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -28,6 +28,7 @@
 #include <media/rc-core.h>
 
 #define DRIVER_NAME "iguanair"
+#define BUF_SIZE 152
 
 struct iguanair {
        struct rc_dev *rc;
@@ -35,26 +36,23 @@ struct iguanair {
        struct device *dev;
        struct usb_device *udev;
 
-       int pipe_out;
        uint16_t version;
        uint8_t bufsize;
+       uint8_t cycle_overhead;
 
        struct mutex lock;
 
        /* receiver support */
        bool receiver_on;
-       dma_addr_t dma_in;
+       dma_addr_t dma_in, dma_out;
        uint8_t *buf_in;
-       struct urb *urb_in;
+       struct urb *urb_in, *urb_out;
        struct completion completion;
 
        /* transmit support */
        bool tx_overflow;
        uint32_t carrier;
-       uint8_t cycle_overhead;
-       uint8_t channels;
-       uint8_t busy4;
-       uint8_t busy7;
+       struct send_packet *packet;
 
        char name[64];
        char phys[64];
@@ -73,7 +71,8 @@ struct iguanair {
 #define DIR_IN                 0xdc
 #define DIR_OUT                        0xcd
 
-#define MAX_PACKET_SIZE                8u
+#define MAX_IN_PACKET          8u
+#define MAX_OUT_PACKET         (sizeof(struct send_packet) + BUF_SIZE)
 #define TIMEOUT                        1000
 #define RX_RESOLUTION          21333
 
@@ -191,20 +190,25 @@ static void iguanair_rx(struct urb *urb)
                dev_warn(ir->dev, "failed to resubmit urb: %d\n", rc);
 }
 
-static int iguanair_send(struct iguanair *ir, void *data, unsigned size)
+static void iguanair_irq_out(struct urb *urb)
 {
-       int rc, transferred;
+       struct iguanair *ir = urb->context;
+
+       if (urb->status)
+               dev_dbg(ir->dev, "Error: out urb status = %d\n", urb->status);
+}
+
+static int iguanair_send(struct iguanair *ir, unsigned size)
+{
+       int rc;
 
        INIT_COMPLETION(ir->completion);
 
-       rc = usb_interrupt_msg(ir->udev, ir->pipe_out, data, size,
-                                                       &transferred, TIMEOUT);
+       ir->urb_out->transfer_buffer_length = size;
+       rc = usb_submit_urb(ir->urb_out, GFP_KERNEL);
        if (rc)
                return rc;
 
-       if (transferred != size)
-               return -EIO;
-
        if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
                return -ETIMEDOUT;
 
@@ -213,14 +217,13 @@ static int iguanair_send(struct iguanair *ir, void *data, unsigned size)
 
 static int iguanair_get_features(struct iguanair *ir)
 {
-       struct packet packet;
        int rc;
 
-       packet.start = 0;
-       packet.direction = DIR_OUT;
-       packet.cmd = CMD_GET_VERSION;
+       ir->packet->header.start = 0;
+       ir->packet->header.direction = DIR_OUT;
+       ir->packet->header.cmd = CMD_GET_VERSION;
 
-       rc = iguanair_send(ir, &packet, sizeof(packet));
+       rc = iguanair_send(ir, sizeof(ir->packet->header));
        if (rc) {
                dev_info(ir->dev, "failed to get version\n");
                goto out;
@@ -235,17 +238,23 @@ static int iguanair_get_features(struct iguanair *ir)
        ir->bufsize = 150;
        ir->cycle_overhead = 65;
 
-       packet.cmd = CMD_GET_BUFSIZE;
+       ir->packet->header.cmd = CMD_GET_BUFSIZE;
 
-       rc = iguanair_send(ir, &packet, sizeof(packet));
+       rc = iguanair_send(ir, sizeof(ir->packet->header));
        if (rc) {
                dev_info(ir->dev, "failed to get buffer size\n");
                goto out;
        }
 
-       packet.cmd = CMD_GET_FEATURES;
+       if (ir->bufsize > BUF_SIZE) {
+               dev_info(ir->dev, "buffer size %u larger than expected\n",
+                                                               ir->bufsize);
+               ir->bufsize = BUF_SIZE;
+       }
+
+       ir->packet->header.cmd = CMD_GET_FEATURES;
 
-       rc = iguanair_send(ir, &packet, sizeof(packet));
+       rc = iguanair_send(ir, sizeof(ir->packet->header));
        if (rc) {
                dev_info(ir->dev, "failed to get features\n");
                goto out;
@@ -257,13 +266,18 @@ out:
 
 static int iguanair_receiver(struct iguanair *ir, bool enable)
 {
-       struct packet packet = { 0, DIR_OUT, enable ?
-                               CMD_RECEIVER_ON : CMD_RECEIVER_OFF };
+       int rc;
+
+       ir->packet->header.start = 0;
+       ir->packet->header.direction = DIR_OUT;
+       ir->packet->header.cmd = enable ? CMD_RECEIVER_ON : CMD_RECEIVER_OFF;
 
        if (enable)
                ir_raw_event_reset(ir->rc);
 
-       return iguanair_send(ir, &packet, sizeof(packet));
+       rc = iguanair_send(ir, sizeof(ir->packet->header));
+
+       return rc;
 }
 
 /*
@@ -308,8 +322,8 @@ static int iguanair_set_tx_carrier(struct rc_dev *dev, uint32_t carrier)
                fours = (cycles - sevens * 7) / 4;
 
                /* magic happens here */
-               ir->busy7 = (4 - sevens) * 2;
-               ir->busy4 = 110 - fours;
+               ir->packet->busy7 = (4 - sevens) * 2;
+               ir->packet->busy4 = 110 - fours;
        }
 
        mutex_unlock(&ir->lock);
@@ -325,7 +339,7 @@ static int iguanair_set_tx_mask(struct rc_dev *dev, uint32_t mask)
                return 4;
 
        mutex_lock(&ir->lock);
-       ir->channels = mask;
+       ir->packet->channels = mask << 4;
        mutex_unlock(&ir->lock);
 
        return 0;
@@ -337,16 +351,9 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
        uint8_t space;
        unsigned i, size, periods, bytes;
        int rc;
-       struct send_packet *packet;
 
        mutex_lock(&ir->lock);
 
-       packet = kmalloc(sizeof(*packet) + ir->bufsize, GFP_KERNEL);
-       if (!packet) {
-               rc = -ENOMEM;
-               goto out;
-       }
-
        /* convert from us to carrier periods */
        for (i = space = size = 0; i < count; i++) {
                periods = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
@@ -356,11 +363,11 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
                        break;
                }
                while (periods > 127) {
-                       packet->payload[size++] = 127 | space;
+                       ir->packet->payload[size++] = 127 | space;
                        periods -= 127;
                }
 
-               packet->payload[size++] = periods | space;
+               ir->packet->payload[size++] = periods | space;
                space ^= 0x80;
        }
 
@@ -369,36 +376,19 @@ static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
                goto out;
        }
 
-       packet->header.start = 0;
-       packet->header.direction = DIR_OUT;
-       packet->header.cmd = CMD_SEND;
-       packet->length = size;
-       packet->channels = ir->channels << 4;
-       packet->busy7 = ir->busy7;
-       packet->busy4 = ir->busy4;
-
-       if (ir->receiver_on) {
-               rc = iguanair_receiver(ir, false);
-               if (rc) {
-                       dev_warn(ir->dev, "disable receiver before transmit failed\n");
-                       goto out;
-               }
-       }
+       ir->packet->header.start = 0;
+       ir->packet->header.direction = DIR_OUT;
+       ir->packet->header.cmd = CMD_SEND;
+       ir->packet->length = size;
 
        ir->tx_overflow = false;
 
-       rc = iguanair_send(ir, packet, size + 8);
+       rc = iguanair_send(ir, sizeof(*ir->packet) + size);
 
        if (rc == 0 && ir->tx_overflow)
                rc = -EOVERFLOW;
 
-       if (ir->receiver_on) {
-               if (iguanair_receiver(ir, true))
-                       dev_warn(ir->dev, "re-enable receiver after transmit failed\n");
-       }
-
 out:
-       kfree(packet);
        mutex_unlock(&ir->lock);
 
        return rc ? rc : count;
@@ -411,8 +401,6 @@ static int iguanair_open(struct rc_dev *rdev)
 
        mutex_lock(&ir->lock);
 
-       BUG_ON(ir->receiver_on);
-
        rc = iguanair_receiver(ir, true);
        if (rc == 0)
                ir->receiver_on = true;
@@ -443,7 +431,7 @@ static int __devinit iguanair_probe(struct usb_interface *intf,
        struct usb_device *udev = interface_to_usbdev(intf);
        struct iguanair *ir;
        struct rc_dev *rc;
-       int ret, pipein;
+       int ret, pipein, pipeout;
        struct usb_host_interface *idesc;
 
        ir = kzalloc(sizeof(*ir), GFP_KERNEL);
@@ -453,11 +441,14 @@ static int __devinit iguanair_probe(struct usb_interface *intf,
                goto out;
        }
 
-       ir->buf_in = usb_alloc_coherent(udev, MAX_PACKET_SIZE, GFP_KERNEL,
+       ir->buf_in = usb_alloc_coherent(udev, MAX_IN_PACKET, GFP_KERNEL,
                                                                &ir->dma_in);
+       ir->packet = usb_alloc_coherent(udev, MAX_OUT_PACKET, GFP_KERNEL,
+                                                               &ir->dma_out);
        ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
+       ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
 
-       if (!ir->buf_in || !ir->urb_in) {
+       if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
                ret = -ENOMEM;
                goto out;
        }
@@ -472,13 +463,18 @@ static int __devinit iguanair_probe(struct usb_interface *intf,
        ir->rc = rc;
        ir->dev = &intf->dev;
        ir->udev = udev;
-       ir->pipe_out = usb_sndintpipe(udev,
-                               idesc->endpoint[1].desc.bEndpointAddress);
        mutex_init(&ir->lock);
+
        init_completion(&ir->completion);
+       pipeout = usb_sndintpipe(udev,
+                               idesc->endpoint[1].desc.bEndpointAddress);
+       usb_fill_int_urb(ir->urb_out, udev, pipeout, ir->packet, MAX_OUT_PACKET,
+                                               iguanair_irq_out, ir, 1);
+       ir->urb_out->transfer_dma = ir->dma_out;
+       ir->urb_out->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
        pipein = usb_rcvintpipe(udev, idesc->endpoint[0].desc.bEndpointAddress);
-       usb_fill_int_urb(ir->urb_in, udev, pipein, ir->buf_in, MAX_PACKET_SIZE,
+       usb_fill_int_urb(ir->urb_in, udev, pipein, ir->buf_in, MAX_IN_PACKET,
                                                         iguanair_rx, ir, 1);
        ir->urb_in->transfer_dma = ir->dma_in;
        ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -528,11 +524,14 @@ static int __devinit iguanair_probe(struct usb_interface *intf,
        return 0;
 out2:
        usb_kill_urb(ir->urb_in);
+       usb_kill_urb(ir->urb_out);
 out:
        if (ir) {
                usb_free_urb(ir->urb_in);
-               usb_free_coherent(udev, MAX_PACKET_SIZE, ir->buf_in,
-                                                               ir->dma_in);
+               usb_free_urb(ir->urb_out);
+               usb_free_coherent(udev, MAX_IN_PACKET, ir->buf_in, ir->dma_in);
+               usb_free_coherent(udev, MAX_OUT_PACKET, ir->packet,
+                                                               ir->dma_out);
        }
        rc_free_device(rc);
        kfree(ir);
@@ -546,8 +545,11 @@ static void __devexit iguanair_disconnect(struct usb_interface *intf)
        rc_unregister_device(ir->rc);
        usb_set_intfdata(intf, NULL);
        usb_kill_urb(ir->urb_in);
+       usb_kill_urb(ir->urb_out);
        usb_free_urb(ir->urb_in);
-       usb_free_coherent(ir->udev, MAX_PACKET_SIZE, ir->buf_in, ir->dma_in);
+       usb_free_urb(ir->urb_out);
+       usb_free_coherent(ir->udev, MAX_IN_PACKET, ir->buf_in, ir->dma_in);
+       usb_free_coherent(ir->udev, MAX_OUT_PACKET, ir->packet, ir->dma_out);
        kfree(ir);
 }
 
@@ -565,6 +567,7 @@ static int iguanair_suspend(struct usb_interface *intf, pm_message_t message)
        }
 
        usb_kill_urb(ir->urb_in);
+       usb_kill_urb(ir->urb_out);
 
        mutex_unlock(&ir->lock);