Index: linux-2.6.21/drivers/char/ts0710.h =================================================================== --- linux-2.6.21.orig/drivers/char/ts0710.h 2007-04-27 20:35:44.000000000 -0300 +++ linux-2.6.21/drivers/char/ts0710.h 2007-04-27 20:36:03.000000000 -0300 @@ -45,7 +45,6 @@ * 11/18/2002 Modified */ -#include #include #include @@ -58,7 +57,6 @@ #include #include #include -#include #include #include Index: linux-2.6.21/drivers/char/ts0710_mux.c =================================================================== --- linux-2.6.21.orig/drivers/char/ts0710_mux.c 2007-04-27 20:35:44.000000000 -0300 +++ linux-2.6.21/drivers/char/ts0710_mux.c 2007-04-27 20:36:03.000000000 -0300 @@ -46,7 +46,6 @@ * 11/18/2002 Second version * 04/21/2004 Add GPRS PROC */ -#include #include #include @@ -70,15 +69,12 @@ #include #include #include -#include -//#include #include #include #include #ifdef USB_FOR_MUX -//#include #include "ts0710_mux_usb.h" #endif @@ -268,8 +264,8 @@ static struct work_struct post_recv_tqueue; static struct tty_struct *mux_table[NR_MUXS]; -static struct termios *mux_termios[NR_MUXS]; -static struct termios *mux_termios_locked[NR_MUXS]; +static struct ktermios *mux_termios[NR_MUXS]; +static struct ktermios *mux_termios_locked[NR_MUXS]; static volatile short int mux_tty[NR_MUXS]; #ifdef min @@ -1894,11 +1890,7 @@ if (test_bit(TTY_THROTTLED, &tty->flags)) { queue_data = 1; } else { - if (test_bit - (TTY_DONT_FLIP, &tty->flags)) { - queue_data = 1; - post_recv = 1; - } else if (recv_info->total) { + if (recv_info->total) { queue_data = 1; post_recv = 1; } else if (recv_room < uih_len) { @@ -3149,10 +3141,10 @@ /*For BP UART problem End*/ -static void receive_worker(void *private_) +static void receive_worker(struct work_struct *work) { struct tty_struct *tty = COMM_FOR_MUX_TTY; - int i, count, tbuf_free, tbuf_read; + int count, tbuf_free, tbuf_read; static unsigned char tbuf[TS0710MUX_MAX_BUF_SIZE]; static unsigned char *tbuf_ptr = &tbuf[0]; static unsigned char *start_flag = 0; @@ -3168,7 +3160,7 @@ __u32 uih_len; /*For BP UART problem End */ - UNUSED_PARAM(private_); + UNUSED_PARAM(work); if (!tty) return; @@ -3440,7 +3432,7 @@ clear_bit(RECV_RUNNING, &mux_recv_flags); } -static void post_recv_worker(void *private_) +static void post_recv_worker(struct work_struct *work) { ts0710_con *ts0710 = &ts0710_connection; int tty_idx; @@ -3453,7 +3445,7 @@ mux_recv_packet *recv_packet, *recv_packet2; __u8 j; - UNUSED_PARAM(private_); + UNUSED_PARAM(work); if (test_and_set_bit(RECV_RUNNING, &mux_recv_flags)) { schedule_work(&post_recv_tqueue); @@ -3499,10 +3491,6 @@ if (test_bit(TTY_THROTTLED, &tty->flags)) { add_post_recv_queue(&post_recv_q, recv_info); continue; - } else if (test_bit(TTY_DONT_FLIP, &tty->flags)) { - post_recv = 1; - add_post_recv_queue(&post_recv_q, recv_info); - continue; } flow_control = 0; @@ -3635,7 +3623,7 @@ } } -static void send_worker(void *private_) +static void send_worker(struct work_struct *work) { ts0710_con *ts0710 = &ts0710_connection; __u8 j; @@ -3644,7 +3632,7 @@ struct tty_struct *tty; __u8 dlci; - UNUSED_PARAM(private_); + UNUSED_PARAM(work); TS0710_DEBUG("Enter into send_worker"); @@ -3819,7 +3807,8 @@ gprsData[TS0710MUX_GPRS_SESSION_MAX - 1].sentBytes = get_count(TS0710MUX_GPRS2_SEND_COUNT_IDX); - copy_to_user(buf, gprsData, bufLen); + if(copy_to_user(buf, gprsData, bufLen)) + return -EFAULT; return bufLen; } @@ -3836,7 +3825,8 @@ memset(gprsData, 0, bufLen); - copy_from_user(gprsData, buf, bufLen); + if(copy_from_user(gprsData, buf, bufLen)) + return -EFAULT; set_count(TS0710MUX_GPRS1_RECV_COUNT_IDX, gprsData[0].recvBytes); set_count(TS0710MUX_GPRS1_SEND_COUNT_IDX, gprsData[0].sentBytes); @@ -3893,9 +3883,9 @@ } post_recv_count_flag = 0; - INIT_WORK(&send_tqueue, send_worker, NULL); - INIT_WORK(&receive_tqueue, receive_worker, NULL); - INIT_WORK(&post_recv_tqueue, post_recv_worker, NULL); + INIT_WORK(&send_tqueue, send_worker); + INIT_WORK(&receive_tqueue, receive_worker); + INIT_WORK(&post_recv_tqueue, post_recv_worker); mux_driver = alloc_tty_driver(NR_MUXS); if (!mux_driver) @@ -3904,12 +3894,11 @@ mux_driver->owner = THIS_MODULE; mux_driver->driver_name = "ts0710mux"; mux_driver->name = "mux"; - mux_driver->devfs_name = "mux"; mux_driver->major = TS0710MUX_MAJOR; mux_driver->minor_start = TS0710MUX_MINOR_START; mux_driver->type = TTY_DRIVER_TYPE_SERIAL; mux_driver->subtype = SERIAL_TYPE_NORMAL; - mux_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW; + mux_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV; mux_driver->init_termios = tty_std_termios; mux_driver->init_termios.c_iflag = 0; @@ -3917,10 +3906,10 @@ mux_driver->init_termios.c_cflag = B38400 | CS8 | CREAD; mux_driver->init_termios.c_lflag = 0; -// mux_driver.ttys = mux_table; + //mux_driver.ttys = mux_table; mux_driver->termios = mux_termios; mux_driver->termios_locked = mux_termios_locked; -// mux_driver.driver_state = mux_state; + //mux_driver.driver_state = mux_state; mux_driver->other = NULL; mux_driver->open = mux_open; Index: linux-2.6.21/drivers/char/ts0710_mux_usb.c =================================================================== --- linux-2.6.21.orig/drivers/char/ts0710_mux_usb.c 2007-04-27 20:35:44.000000000 -0300 +++ linux-2.6.21/drivers/char/ts0710_mux_usb.c 2007-04-27 22:34:31.000000000 -0300 @@ -188,7 +188,8 @@ buf_list_t *inbuf; int count = urb->actual_length; - inbuf = kmalloc(sizeof(buf_list_t), GFP_KERNEL); + // we are called from interrupt context. + inbuf = kmalloc(sizeof(buf_list_t), GFP_ATOMIC); if (!inbuf) { printk("append_to_inbuf_list: (%d) out of memory!\n", sizeof(buf_list_t)); @@ -196,7 +197,7 @@ } inbuf->size = count; - inbuf->body = kmalloc(sizeof(char)*count, GFP_KERNEL); + inbuf->body = kmalloc(sizeof(char)*count, GFP_ATOMIC); if (!inbuf->body) { kfree(inbuf); printk("append_to_inbuf_list: (%d) out of memory!\n", @@ -222,7 +223,7 @@ inbuf = list_entry(ptr, buf_list_t, list); src_count = inbuf->size; if (dst_count >= src_count) { - memcpy(buf, inbuf->body, src_count); + memcpy((unsigned char *)buf, inbuf->body, src_count); ret = src_count; list_del(ptr); kfree(inbuf->body); @@ -282,9 +283,8 @@ spin_unlock(&bvd_ipc->in_buf_lock); } -static void usb_ipc_read_bulk(struct urb *urb, struct pt_regs *regs) +static void usb_ipc_read_bulk(struct urb *urb) { - buf_list_t *inbuf; int count = urb->actual_length; struct tty_struct *tty = &ipcusb_tty; @@ -319,7 +319,7 @@ bvd_dbg("usb_ipc_read_bulk: completed!!!"); } -static void usb_ipc_write_bulk(struct urb *urb, struct pt_regs *regs) +static void usb_ipc_write_bulk(struct urb *urb) { callback_times++; bvd_ipc->write_finished_flag = 1; @@ -437,7 +437,7 @@ /*send IN token*/ bvd_ipc->readurb_mux.actual_length = 0; bvd_ipc->readurb_mux.dev = bvd_ipc->ipc_dev; - if (ret = usb_submit_urb(&bvd_ipc->readurb_mux, GFP_ATOMIC)) + if ((ret = usb_submit_urb(&bvd_ipc->readurb_mux, GFP_ATOMIC))) printk("ipcusb_xmit_data: usb_submit_urb(read mux bulk)" "failed! status=%d\n", ret); bvd_dbg("ipcusb_xmit_data: Send a IN token successfully!"); @@ -447,7 +447,7 @@ bvd_ipc->write_finished_flag = 0; //printk("%s: clear write_finished_flag:%d\n", __FUNCTION__, bvd_ipc->write_finished_flag); bvd_ipc->writeurb_mux.dev = bvd_ipc->ipc_dev; - if (result = usb_submit_urb(&bvd_ipc->writeurb_mux, GFP_ATOMIC)) + if ((result = usb_submit_urb(&bvd_ipc->writeurb_mux, GFP_ATOMIC))) warn("ipcusb_xmit_data: funky result! result=%d\n", result); bvd_dbg("ipcusb_xmit_data: usb_submit_urb finished! result:%d", result); @@ -498,7 +498,7 @@ return 0; if (*ipcusb_ap_to_bp != NULL) - (*ipcusb_ap_to_bp)(buf, count); + (*ipcusb_ap_to_bp)((unsigned char *)buf, count); bvd_ipc->suspend_flag = 1; @@ -602,6 +602,7 @@ } ep_cnt = have_bulk_in_mux = have_bulk_out_mux = 0; + readsize = writesize = 0; while (ep_cnt < interface->bNumEndpoints) { endpoint = &intf->cur_altsetting->endpoint[ep_cnt].desc; @@ -792,6 +793,8 @@ bvd_ipc->ipc_dev = NULL; bvd_ipc->xmit.head = bvd_ipc->xmit.tail = 0; bvd_ipc->write_flag = IPC_USB_WRITE_INIT; + spin_lock_init(&bvd_ipc->lock); + spin_lock_init(&bvd_ipc->in_buf_lock); ipcusb_tty_driver.write = usb_ipc_write; ipcusb_tty_driver.chars_in_buffer = usb_ipc_chars_in_buffer;