From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932492AbcELIyS (ORCPT ); Thu, 12 May 2016 04:54:18 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:34193 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932190AbcELIuh (ORCPT ); Thu, 12 May 2016 04:50:37 -0400 From: Mathieu OTHACEHE To: johan@kernel.org Cc: gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Mathieu OTHACEHE Subject: [PATCH 26/36] usb: serial: ti_usb_3410_5052: Fix firmware downloading Date: Thu, 12 May 2016 10:48:58 +0200 Message-Id: <1463042948-12205-27-git-send-email-m.othacehe@gmail.com> X-Mailer: git-send-email 2.8.2 In-Reply-To: <1463042948-12205-1-git-send-email-m.othacehe@gmail.com> References: <1463042948-12205-1-git-send-email-m.othacehe@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The buffer used to store firmware is allocated to maximum firmware size (TI_FIRMWARE_BUF_SIZE) + header size. This buffer is filled with requested firmware (fw_p->size) and padded with 0xff bytes. The header is written over the 3 first bytes of the buffer (overwritting the 3 first bytes of the requested firmware) Then, ti_do_download function is called to send only the first fw_p->size bytes from the buffer to the device. The rest of the buffer is never used. So it is sufficient to allocate a buffer of fw_p->size bytes to store only the requested firmware. There is no need to do any padding. This patch also move firmware buffer manipulation to ti_do_download function. Signed-off-by: Mathieu OTHACEHE --- drivers/usb/serial/ti_usb_3410_5052.c | 62 +++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 29 deletions(-) diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c index b50f52f..85f66f0 100644 --- a/drivers/usb/serial/ti_usb_3410_5052.c +++ b/drivers/usb/serial/ti_usb_3410_5052.c @@ -1259,47 +1259,65 @@ static void ti_handle_new_msr(struct usb_serial_port *port, u8 msr) tport->tp_msr = msr & TI_MSR_MASK; } -static int ti_do_download(struct usb_device *dev, int pipe, - u8 *buffer, int size) +static int ti_do_download(struct usb_serial *serial, + const struct firmware *fw_p) { int pos; u8 cs = 0; int done; + struct usb_device *dev = serial->dev; struct ti_firmware_header *header; int status = 0; + u8 *buffer; + int buffer_size; int len; + unsigned int pipe; + + pipe = usb_sndbulkpipe(dev, serial->port[0]->bulk_out_endpointAddress); + + buffer_size = fw_p->size; + buffer = kmalloc(buffer_size, GFP_KERNEL); + if (!buffer) + return -ENOMEM; - for (pos = sizeof(struct ti_firmware_header); pos < size; pos++) + memcpy(buffer, fw_p->data, fw_p->size); + + for (pos = sizeof(*header); pos < buffer_size; pos++) cs = (u8)(cs + buffer[pos]); header = (struct ti_firmware_header *)buffer; - header->wLength = cpu_to_le16((u16)(size - - sizeof(struct ti_firmware_header))); + header->wLength = cpu_to_le16(buffer_size - sizeof(*header)); header->bCheckSum = cs; dev_dbg(&dev->dev, "%s - downloading firmware\n", __func__); - for (pos = 0; pos < size; pos += done) { - len = min(size - pos, TI_DOWNLOAD_MAX_PACKET_SIZE); + for (pos = 0; pos < buffer_size; pos += done) { + len = min(buffer_size - pos, TI_DOWNLOAD_MAX_PACKET_SIZE); status = usb_bulk_msg(dev, pipe, buffer + pos, len, &done, TI_DOWNLOAD_TIMEOUT); if (status) break; } - return status; + + kfree(buffer); + + if (status) { + dev_err(&dev->dev, "failed to download firmware: %d\n", status); + return status; + } + + dev_dbg(&dev->dev, "%s - download successful\n", __func__); + + return 0; } static int ti_download_firmware(struct usb_serial *serial) { int status; - int buffer_size; - u8 *buffer; struct usb_device *dev = serial->dev; struct ti_device *tdev = usb_get_serial_data(serial); - unsigned int pipe; const struct firmware *fw_p; char buf[32]; - pipe = usb_sndbulkpipe(dev, serial->port[0]->bulk_out_endpointAddress); if (le16_to_cpu(dev->descriptor.idVendor) == MXU1_VENDOR_ID) { snprintf(buf, @@ -1354,30 +1372,16 @@ check_firmware: dev_err(&dev->dev, "%s - firmware not found\n", __func__); return -ENOENT; } + if (fw_p->size > TI_FIRMWARE_BUF_SIZE) { dev_err(&dev->dev, "%s - firmware too large %zu\n", __func__, fw_p->size); release_firmware(fw_p); return -ENOENT; } - buffer_size = TI_FIRMWARE_BUF_SIZE + sizeof(struct ti_firmware_header); - buffer = kmalloc(buffer_size, GFP_KERNEL); - if (buffer) { - memcpy(buffer, fw_p->data, fw_p->size); - memset(buffer + fw_p->size, 0xff, buffer_size - fw_p->size); - status = ti_do_download(dev, pipe, buffer, fw_p->size); - kfree(buffer); - } else { - status = -ENOMEM; - } - release_firmware(fw_p); - if (status) { - dev_err(&dev->dev, "%s - error downloading firmware, %d\n", - __func__, status); - return status; - } + ti_do_download(serial, fw_p); - dev_dbg(&dev->dev, "%s - download successful\n", __func__); + release_firmware(fw_p); return 0; } -- 2.8.2