The maximum buffer size does not include the headroom, so subtract the
headroom size from the actual buffer size.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

A stack-allocated buffer is not generally DMA-able and must not be used
for USB control transfers.

Note that the memset and extra buffer byte were redundant as no more
than the bytes actually transferred was ever added to the fifo.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Drop unnecessary explicit casts.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Alex suggested to name it class instead of class type.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

A Greybus driver will bind to a bundle, not an interface. Lets follow
this rule in code.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

A module can have more than one interfaces and we get hotplug events or
manifests for interfaces, not modules. Details like version, vendor,
product id, etc. can be different for different interfaces within the
same module and so shall be fetched from interface descriptor instead of
module descriptor.

So what we have been doing for module descriptors until now must be done
for interface descriptors. There can only be one interface descriptor in
the manifest. Module descriptor isn't used anymore and probably most of
its fields can be removed now.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

An interface can have 1 or more bundles. On link-up event, we must initialize
all the bundles associated with the interface.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Currently we are creating bundles based on interface descriptors. An interface
can have one or more bundles associated with it and so a bundle must be created
based on a bundle descriptor.

Also get class_type from bundle descriptor.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Report size isn't passed as first two bytes of the report according to
USB-HID spec. Get it from payload-size.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

A bundle corresponds to a device and a greybus driver binds to it. This patch
adds a type and descriptor for bundle.

This also shuffles the values of 'enum greybus_descriptor_type' to align
them with Greybus Specifications.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

There can be more than one interface on a module and we need to know the
interface for which the event has occurred.

But at the same time we may not need the module id at all. During initial phase
when AP is probed, the AP will receive the unique Endo id which shall be enough
to draw relationships between interface and module ids.

Code for that isn't available today and so lets create another routine to get
module id (which needs to be fixed separately), which will simply return
interface id passed to it.

Now that we have interface id, update rest of the code to use it.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Devices registered with the device-core needs to be freed by calling
device_unregister(). For module we are calling just put_device() and for
bundle, connection and interface we are calling device_del().

All of these are incomplete and so none of them get freed, i.e. the
.release() routine is never called for their devices.

Module being a special case that it needs to maintain a refcount or a
list of interfaces to trace its usage count. I have chosen refcount.

And so once the refcount is zero, we can Unregister the device and
module will get free as well.

Because of this bug in freeing devices, their sysfs directories were not
getting removed properly and after a manifest is parsed with the help of
gbsim, removing modules was creating problems. The sysfs directory
'greybus' wasn't getting removed. And inserting the modules again
resulted in warnings and insmod failure.

WARNING: CPU: 3 PID: 4277 at
/build/buildd/linux-3.13.0/fs/sysfs/dir.c:486
sysfs_warn_dup+0x86/0xa0()
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

These are definitions from Mark that I've consolidated into
one header file. I'd like to get these merged at some point
soon, so the audio driver and gbsim work can avoid having
out-of-tree dependencies.
Signed-off-by: Mark A. Greer <mgreer@animalcreek.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

This adds a proposed sysfs layout for greybus to Documentation to make
it easier for people to discuss / test things.  It includes a module, an
interface, a bundle, and a gpbridge binding to that bundle.

This was discussed on the projectara software mailing list.
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Cut out some comments that are no longer operative.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

These functions showed up in 3.12 or so, and we are stuck on 3.10 for
various reasons, so provide backports in kernel_ver.h so that we can
rely on these functions.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

We should use the attribute groups, not group, for the device, so
add and remove it.  No one should ever be updating a sysfs group for a
device, as that can be pretty dangerous if you don't duplicate _all_
existing attribute for that device, and I don't think we were doing that
here.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

x86 doesn't include SZ_4K somehow so explicitly include <linux/sizes.h>
to fix the build breakage.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add a simple Greybus protocol in order to stress USB and Greybus.
This protocol currently support 2 requests: ping and transfer.

ping request is useful to measure latency.
Kernel send a ping request and firmware should respond with a ping.

The transfer request request is useful to stress Greybus and USB.
Kernel can send data from 0 to 4k and the firmware must send back the data to kernel.

This behaviour of gb-loopback module is controlled via sysfs.
Curently, connection sysfs folder is updated with new entries:
- type: Type of loopback message to send
  * 0 => Don't send message
  * 1 => Send ping message continuously (message without payload)
  * 2 => Send transer message continuously (message with payload)
- size: Size of transfer message payload: 0-4096 bytes
- ms_wait: Time to wait between two messages: 0-1024 ms

Module also export some statistics about connection:
- latency: Time to send and receive one message
- frequency: Number of packet sent per second on this cport
- throughput: Quantity of data sent and received on this cport
- error
All this statistics are cleared everytime type, size or ms_wait entries are updated.
Signed-off-by: Alexandre Bailon <abailon@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

When usb_log_enable() is called, the global apb1_log_task is used to
hold the result of kthread_run().  It is possible for kthread_run()
to return an error pointer, so tests of apb_log_task against NULL
are insufficient to determine its validity.

Note that kthread_run() never returns NULL so we don't have to check
for that.  But apb1_log_task is initially NULL, so that global must
be both non-null and not an error in order to be considered valid.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

When usb_log_enable() is called, the global apb1_log_task is used to
hold the result of kthread_run().  It is possible for kthread_run()
to return an error pointer, so tests of apb_log_task against NULL
are insufficient to determine its validity.

Note that kthread_run() never returns NULL so we don't have to check
for that.  But apb1_log_task is initially NULL, so that global must
be both non-null and not an error in order to be considered valid.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

In identify_descriptor(), the variable desc_size represents the size
of a memory object.  So change its type from int to size_t.

The return value for this function can be desc_size cast to int.
One can verify by inspection this will never exceed INT_MAX.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Send response to incoming requests from the operation request handler
rather than in every protocol request_recv callback.

This simplifies request_recv error handling and allows for further code
reuse.

Note that if we ever get protocols that need to hold off sending
responses we could implement this by letting them return a special
value (after acquiring the necessary operation references) to suppress
the response from being sent by greybus core.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Send response also to incoming requests that cannot be fulfilled.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add minimal verification of incoming report size, before using it to
determine what buffer and size to pass on to HID core.

Add comment about protocol needing to be revisited. If we are going to
be parsing the report data received, then those fields have to be
defined in the Greybus specification at least.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to only send a success response if we did not detect any
errors.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Replace pr_err with dev_err and clean up error messages somewhat.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Send response also to incoming requests that cannot be fulfilled.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix null-pointer dereference on failure to look up irq due to missing
error handling.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Include the operation id as well as the received and expected size
(from header) when reporting incomplete messages.

This information is useful when debugging communication errors.

Also invert the size test to match the error message and increase
readability.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Use dev_err whenever we have a connection for more informative error
messages.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix the payload size of incoming requests, which should not include the
operation message-header size.

When creating requests we pass the sizes of request and response
payloads and greybus core allocates buffers and adds the required
headers. Specifically, the payload sizes do not include the
message-header size.

This is currently not the case for incoming requests however, something
which prevents protocol drivers from implementing appropriate input
verification and could lead to random data being treated as a valid
message in case of a short request.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Incoming operations are created without a response message. If a
protocol driver fails to send a response, or if the operation were to be
cancelled before it has been fully processed, we get a null-pointer
dereference when the operation is released.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Incoming operations are created without a response message. If an
operation were to be cancelled before it has been fully processed (e.g.
on connection destroy), we would get a null-pointer dereference in
gb_operation_cancel.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to return a proper response in case we get a request we do not
recognise.

This fixes an infinite loop and use-after-free bug, where the freed
operations structure would get re-added to the work queue indefinitely.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Make sure to drop the operation reference when sending the request fails
to avoid leaking the operation structures.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix use-after-free when sending responses due to reference imbalance.

Make sure to take a reference to the operation when sending responses.
This reference is dropped in greybus_data_sent when the message has been
sent, while the initial reference is dropped in gb_operation_work after
processing the corresponding request.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>