When the HDC driver writes the data to the transfer buffers it pollutes the D-cache (unlike DMA drivers where the device writes the data). If the corresponding pages get mapped into user space, there are no additional cache flushing operations performed and this causes random user space faults on architectures with separate I and D caches (Harvard) or those with aliasing D-cache. Signed-off-by: Catalin Marinas <catalin.marinas@xxxxxxx> Cc: Matthew Dharm <mdharm-kernel@xxxxxxxxxxxxxxxxxx> Cc: Greg KH <greg@xxxxxxxxx> Cc: Sebastian Siewior <bigeasy@xxxxxxxxxxxxx> Cc: Oliver Neukum <oliver@xxxxxxxxxx> --- The changes in the third version of this patch include flushing the transfer buffer for all in-pipes except the PIPE_CONTROL ones. drivers/usb/host/isp1760-hcd.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c index 27b8f7c..9f01293 100644 --- a/drivers/usb/host/isp1760-hcd.c +++ b/drivers/usb/host/isp1760-hcd.c @@ -17,7 +17,9 @@ #include <linux/debugfs.h> #include <linux/uaccess.h> #include <linux/io.h> +#include <linux/mm.h> #include <asm/unaligned.h> +#include <asm/cacheflush.h> #include "../core/hcd.h" #include "isp1760-hcd.h" @@ -904,6 +906,14 @@ __acquires(priv->lock) status = 0; } + if (usb_pipein(urb->pipe) && usb_pipetype(urb->pipe) != PIPE_CONTROL) { + void *ptr; + for (ptr = urb->transfer_buffer; + ptr < urb->transfer_buffer + urb->transfer_buffer_length; + ptr += PAGE_SIZE) + flush_dcache_page(virt_to_page(ptr)); + } + /* complete() can reenter this HCD */ usb_hcd_unlink_urb_from_ep(priv_to_hcd(priv), urb); spin_unlock(&priv->lock); -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html