Changes in 4.9.311 USB: serial: pl2303: add IBM device IDs USB: serial: simple: add Nokia phone driver netdevice: add the case if dev is NULL virtio_console: break out of buf poll on remove ethernet: sun: Free the coherent when failing in probing af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register block: Add a helper to validate the block size virtio-blk: Use blk_validate_block_size() to validate block size USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c coresight: Fix TRCCONFIGR.QE sysfs interface iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: make a best effort on offset calculation clk: uniphier: Fix fixed-rate initialization ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE SUNRPC: avoid race between mod_timer() and del_timer_sync() NFSD: prevent underflow in nfssvc_decode_writeargs() can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_scan_medium mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mempolicy: mbind_range() set_policy() after vma_merge() scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" ALSA: cs4236: fix an incorrect NULL check on list iterator drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() video: fbdev: sm712fb: Fix crash in smtcfb_read() video: fbdev: atari: Atari 2 bpp (STe) palette bugfix ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 carl9170: fix missing bit-wise or operator for tx_params thermal: int340x: Increase bitmap size lib/raid6/test: fix multiple definition linking error DEC: Limit PMAX memory probing to R3k systems media: davinci: vpif: fix unbalanced runtime PM get brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio PCI: pciehp: Clear cmd_busy bit in polling mode crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: mxs-dcp - Fix scatterlist processing spi: tegra114: Add missing IRQ check in tegra_spi_probe selftests/x86: Add validity check and allow field splitting hwmon: (pmbus) Add mutex to regulator ops hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler crypto: vmx - add missing dependencies crypto: ccp - ccp_dmaengine_unregister release dma channels hwmon: (pmbus) Add Vin unit off handling clocksource: acpi_pm: fix return value of __setup handler sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() ARM: dts: qcom: ipq4019: fix sleep clock soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe media: usb: go7007: s2250-board: fix leak in probe() ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() arm64: dts: ns2: Fix spi-cpol and spi-cpha property arm64: dts: broadcom: Fix sata nodename printk: fix return value of printk.devkmsg __setup handler ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable memory: emif: Add check for setup_interrupts memory: emif: check the pointer temp in get_device_details() ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() mtd: onenand: Check for error irq drm/edid: Don't clear formats if using deep color ath9k_htc: fix uninit value bugs ray_cs: Check ioremap return value power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports iwlwifi: Fix -EIO error code that is never returned scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix abort all task initialization TOMOYO: fix __setup handlers return values ext2: correct max file size computing drm/tegra: Fix reference leak in tegra_dsi_ganged_probe KVM: x86: Fix emulation in writing cr8 KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() i2c: xiic: Make bus names unique power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq powerpc/sysdev: fix incorrect use to determine if list is empty mfd: mc13xxx: Add check for mc13xxx_irq_request MIPS: RB532: fix return value of __setup handler USB: storage: ums-realtek: fix error code in rts51x_read_mem() af_netlink: Fix shift out of bounds in group mask calculation i2c: mux: demux-pinctrl: do not deactivate a master that is not active mfd: asic3: Add missing iounmap() on error asic3_mfd_probe mxser: fix xmit_buf leak in activate when LSR == 0xff pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() iio: adc: Add check for devm_request_threaded_irq clk: qcom: clk-rcg2: Update the frac table for pixel clock remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver NFS: remove unneeded check in decode_devicenotify_args() pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler jfs: fix divide error in dbNextAG netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options net: phy: broadcom: Fix brcm_fet_config_init() qlcnic: dcb: default to returning -EOPNOTSUPP net/x25: Fix null-ptr-deref caused by x25_disconnect selinux: use correct type for context length loop: use sysfs_emit() in the sysfs xxx show() Fix incorrect type in assignment of ipv6 port for audit irqchip/nvic: Release nvic_base upon failure ACPICA: Avoid walking the ACPI Namespace if it is not there ACPI/APEI: Limit printable size of BERT table data PM: core: keep irq flags in device_pm_check_callbacks() spi: tegra20: Use of_device_get_match_data() ext4: don't BUG if someone dirty pages without asking ext4 first ntfs: add sanity check on allocation size video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow video: fbdev: w100fb: Reset global state video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 ARM: dts: bcm2837: Add the missing L1/L2 cache information video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() ASoC: soc-core: skip zero num_dai component in searching dai name media: cx88-mpeg: clear interrupt status register before streaming video ARM: tegra: tamonten: Fix I2C3 pad setting ARM: mmp: Fix failure to remove sram device video: fbdev: sm712fb: Fix crash in smtcfb_write() media: hdpvr: initialize dev->worker at hdpvr_register_videodev mmc: host: Return an error when ->enable_sdio_irq() ops is missing scsi: qla2xxx: Fix incorrect reporting of task management failure KVM: Prevent module exit until all VMs are freed ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: setflags: Make dirtied_ino_d 8 bytes aligned gfs2: Make sure FITRIM minlen is rounded up to fs block size pinctrl: pinconf-generic: Print arguments for bias-pull-* ACPI: CPPC: Avoid out of bounds access when parsing _CPC data mm/mmap: return 1 from stack_guard_gap __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler ubi: fastmap: Return error code if memory allocation fails in add_aeb() ASoC: topology: Allow TLV control to be either read or write ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties openvswitch: Fixed nd target mask field in the flow dump. KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated rtc: wm8350: Handle error for wm8350_register_irq ARM: 9187/1: JIVE: fix return value of __setup handler KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 ptp: replace snprintf with sysfs_emit powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() iommu/arm-smmu-v3: fix event handling soft lockup dm ioctl: prevent potential spectre v1 gadget scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: aha152x: Fix aha152x_setup() __setup handler return value bnxt_en: Eliminate unintended link toggle during FW reset MIPS: fix fortify panic when copying asm exception handlers scsi: libfc: Fix use after free in fc_exch_abts_resp() usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm xtensa: fix DTC warning unit_address_format Bluetooth: Fix use after free in hci_send_acl init/main.c: return 1 from handled __setup() functions w1: w1_therm: fixes w1_seq for ds28ea00 sensors SUNRPC/call_alloc: async tasks mustn't block waiting for memory serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() virtio_console: eliminate anonymous module_init & module_exit jfs: prevent NULL deref in diFree mm: fix race between MADV_FREE reclaim and blkdev direct IO read scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() net: stmmac: Fix unset max_speed difference between DT and non-DT platforms drm/imx: Fix memory leak in imx_pd_connector_get_modes drbd: Fix five use after free bugs in get_initial_state mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) mm/mempolicy: fix mpol_new leak in shared_policy_replace x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume arm64: patch_text: Fixup last cpu should be master tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" mm: don't skip swap entry even if zap_details specified arm64: module: remove (NOLOAD) from linker script xfrm: policy: match with both mark and mask on user interfaces veth: Ensure eth header is in skb's linear part net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link nfc: nci: add flush_workqueue to prevent uaf cifs: potential buffer overflow in handling symlinks drm/amdkfd: Check for potential null return of kmalloc_array() scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 net: micrel: fix KS8851_MLL Kconfig gpu: ipu-v3: Fix dev_dbg frequency output scsi: mvsas: Add PCI ID of RocketRaid 2640 drivers: net: slip: fix NPD bug in sl_tx_timeout() mm, page_alloc: fix build_zonerefs_node() mm: kmemleak: take a full lowmem check in kmemleak_*_phys() ALSA: pcm: Test for "silence" field in struct "pcm_format_data" ARM: davinci: da850-evm: Avoid NULL pointer dereference smp: Fix offline cpu check in flush_smp_call_function_queue() i2c: pasemi: Wait for write xfers to finish gcc-plugins: latent_entropy: use /dev/urandom Linux 4.9.311 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia8f55c5ae2f0eb71b0893d8271a10dfd3c78b3b8
528 lines
13 KiB
C
528 lines
13 KiB
C
/*
|
|
* Copyright (c) 2010-2011 Atheros Communications Inc.
|
|
*
|
|
* Permission to use, copy, modify, and/or distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include "htc.h"
|
|
|
|
static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
|
|
u16 len, u8 flags, u8 epid)
|
|
|
|
{
|
|
struct htc_frame_hdr *hdr;
|
|
struct htc_endpoint *endpoint = &target->endpoint[epid];
|
|
int status;
|
|
|
|
hdr = (struct htc_frame_hdr *)
|
|
skb_push(skb, sizeof(struct htc_frame_hdr));
|
|
hdr->endpoint_id = epid;
|
|
hdr->flags = flags;
|
|
hdr->payload_len = cpu_to_be16(len);
|
|
memset(hdr->control, 0, sizeof(hdr->control));
|
|
|
|
status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb);
|
|
|
|
return status;
|
|
}
|
|
|
|
static struct htc_endpoint *get_next_avail_ep(struct htc_endpoint *endpoint)
|
|
{
|
|
enum htc_endpoint_id avail_epid;
|
|
|
|
for (avail_epid = (ENDPOINT_MAX - 1); avail_epid > ENDPOINT0; avail_epid--)
|
|
if (endpoint[avail_epid].service_id == 0)
|
|
return &endpoint[avail_epid];
|
|
return NULL;
|
|
}
|
|
|
|
static u8 service_to_ulpipe(u16 service_id)
|
|
{
|
|
switch (service_id) {
|
|
case WMI_CONTROL_SVC:
|
|
return 4;
|
|
case WMI_BEACON_SVC:
|
|
case WMI_CAB_SVC:
|
|
case WMI_UAPSD_SVC:
|
|
case WMI_MGMT_SVC:
|
|
case WMI_DATA_VO_SVC:
|
|
case WMI_DATA_VI_SVC:
|
|
case WMI_DATA_BE_SVC:
|
|
case WMI_DATA_BK_SVC:
|
|
return 1;
|
|
default:
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
static u8 service_to_dlpipe(u16 service_id)
|
|
{
|
|
switch (service_id) {
|
|
case WMI_CONTROL_SVC:
|
|
return 3;
|
|
case WMI_BEACON_SVC:
|
|
case WMI_CAB_SVC:
|
|
case WMI_UAPSD_SVC:
|
|
case WMI_MGMT_SVC:
|
|
case WMI_DATA_VO_SVC:
|
|
case WMI_DATA_VI_SVC:
|
|
case WMI_DATA_BE_SVC:
|
|
case WMI_DATA_BK_SVC:
|
|
return 2;
|
|
default:
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
static void htc_process_target_rdy(struct htc_target *target,
|
|
void *buf)
|
|
{
|
|
struct htc_endpoint *endpoint;
|
|
struct htc_ready_msg *htc_ready_msg = (struct htc_ready_msg *) buf;
|
|
|
|
target->credit_size = be16_to_cpu(htc_ready_msg->credit_size);
|
|
|
|
endpoint = &target->endpoint[ENDPOINT0];
|
|
endpoint->service_id = HTC_CTRL_RSVD_SVC;
|
|
endpoint->max_msglen = HTC_MAX_CONTROL_MESSAGE_LENGTH;
|
|
atomic_inc(&target->tgt_ready);
|
|
complete(&target->target_wait);
|
|
}
|
|
|
|
static void htc_process_conn_rsp(struct htc_target *target,
|
|
struct htc_frame_hdr *htc_hdr)
|
|
{
|
|
struct htc_conn_svc_rspmsg *svc_rspmsg;
|
|
struct htc_endpoint *endpoint, *tmp_endpoint = NULL;
|
|
u16 service_id;
|
|
u16 max_msglen;
|
|
enum htc_endpoint_id epid, tepid;
|
|
|
|
svc_rspmsg = (struct htc_conn_svc_rspmsg *)
|
|
((void *) htc_hdr + sizeof(struct htc_frame_hdr));
|
|
|
|
if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
|
|
epid = svc_rspmsg->endpoint_id;
|
|
if (epid < 0 || epid >= ENDPOINT_MAX)
|
|
return;
|
|
|
|
service_id = be16_to_cpu(svc_rspmsg->service_id);
|
|
max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len);
|
|
endpoint = &target->endpoint[epid];
|
|
|
|
for (tepid = (ENDPOINT_MAX - 1); tepid > ENDPOINT0; tepid--) {
|
|
tmp_endpoint = &target->endpoint[tepid];
|
|
if (tmp_endpoint->service_id == service_id) {
|
|
tmp_endpoint->service_id = 0;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (tepid == ENDPOINT0)
|
|
return;
|
|
|
|
endpoint->service_id = service_id;
|
|
endpoint->max_txqdepth = tmp_endpoint->max_txqdepth;
|
|
endpoint->ep_callbacks = tmp_endpoint->ep_callbacks;
|
|
endpoint->ul_pipeid = tmp_endpoint->ul_pipeid;
|
|
endpoint->dl_pipeid = tmp_endpoint->dl_pipeid;
|
|
endpoint->max_msglen = max_msglen;
|
|
target->conn_rsp_epid = epid;
|
|
complete(&target->cmd_wait);
|
|
} else {
|
|
target->conn_rsp_epid = ENDPOINT_UNUSED;
|
|
}
|
|
}
|
|
|
|
static int htc_config_pipe_credits(struct htc_target *target)
|
|
{
|
|
struct sk_buff *skb;
|
|
struct htc_config_pipe_msg *cp_msg;
|
|
int ret;
|
|
unsigned long time_left;
|
|
|
|
skb = alloc_skb(50 + sizeof(struct htc_frame_hdr), GFP_ATOMIC);
|
|
if (!skb) {
|
|
dev_err(target->dev, "failed to allocate send buffer\n");
|
|
return -ENOMEM;
|
|
}
|
|
skb_reserve(skb, sizeof(struct htc_frame_hdr));
|
|
|
|
cp_msg = (struct htc_config_pipe_msg *)
|
|
skb_put(skb, sizeof(struct htc_config_pipe_msg));
|
|
|
|
cp_msg->message_id = cpu_to_be16(HTC_MSG_CONFIG_PIPE_ID);
|
|
cp_msg->pipe_id = USB_WLAN_TX_PIPE;
|
|
cp_msg->credits = target->credits;
|
|
|
|
target->htc_flags |= HTC_OP_CONFIG_PIPE_CREDITS;
|
|
|
|
ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
|
|
if (ret)
|
|
goto err;
|
|
|
|
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
|
|
if (!time_left) {
|
|
dev_err(target->dev, "HTC credit config timeout\n");
|
|
kfree_skb(skb);
|
|
return -ETIMEDOUT;
|
|
}
|
|
|
|
return 0;
|
|
err:
|
|
kfree_skb(skb);
|
|
return -EINVAL;
|
|
}
|
|
|
|
static int htc_setup_complete(struct htc_target *target)
|
|
{
|
|
struct sk_buff *skb;
|
|
struct htc_comp_msg *comp_msg;
|
|
int ret = 0;
|
|
unsigned long time_left;
|
|
|
|
skb = alloc_skb(50 + sizeof(struct htc_frame_hdr), GFP_ATOMIC);
|
|
if (!skb) {
|
|
dev_err(target->dev, "failed to allocate send buffer\n");
|
|
return -ENOMEM;
|
|
}
|
|
skb_reserve(skb, sizeof(struct htc_frame_hdr));
|
|
|
|
comp_msg = (struct htc_comp_msg *)
|
|
skb_put(skb, sizeof(struct htc_comp_msg));
|
|
comp_msg->msg_id = cpu_to_be16(HTC_MSG_SETUP_COMPLETE_ID);
|
|
|
|
target->htc_flags |= HTC_OP_START_WAIT;
|
|
|
|
ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
|
|
if (ret)
|
|
goto err;
|
|
|
|
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
|
|
if (!time_left) {
|
|
dev_err(target->dev, "HTC start timeout\n");
|
|
kfree_skb(skb);
|
|
return -ETIMEDOUT;
|
|
}
|
|
|
|
return 0;
|
|
|
|
err:
|
|
kfree_skb(skb);
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* HTC APIs */
|
|
|
|
int htc_init(struct htc_target *target)
|
|
{
|
|
int ret;
|
|
|
|
ret = htc_config_pipe_credits(target);
|
|
if (ret)
|
|
return ret;
|
|
|
|
return htc_setup_complete(target);
|
|
}
|
|
|
|
int htc_connect_service(struct htc_target *target,
|
|
struct htc_service_connreq *service_connreq,
|
|
enum htc_endpoint_id *conn_rsp_epid)
|
|
{
|
|
struct sk_buff *skb;
|
|
struct htc_endpoint *endpoint;
|
|
struct htc_conn_svc_msg *conn_msg;
|
|
int ret;
|
|
unsigned long time_left;
|
|
|
|
/* Find an available endpoint */
|
|
endpoint = get_next_avail_ep(target->endpoint);
|
|
if (!endpoint) {
|
|
dev_err(target->dev, "Endpoint is not available for"
|
|
"service %d\n", service_connreq->service_id);
|
|
return -EINVAL;
|
|
}
|
|
|
|
endpoint->service_id = service_connreq->service_id;
|
|
endpoint->max_txqdepth = service_connreq->max_send_qdepth;
|
|
endpoint->ul_pipeid = service_to_ulpipe(service_connreq->service_id);
|
|
endpoint->dl_pipeid = service_to_dlpipe(service_connreq->service_id);
|
|
endpoint->ep_callbacks = service_connreq->ep_callbacks;
|
|
|
|
skb = alloc_skb(sizeof(struct htc_conn_svc_msg) +
|
|
sizeof(struct htc_frame_hdr), GFP_ATOMIC);
|
|
if (!skb) {
|
|
dev_err(target->dev, "Failed to allocate buf to send"
|
|
"service connect req\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
skb_reserve(skb, sizeof(struct htc_frame_hdr));
|
|
|
|
conn_msg = (struct htc_conn_svc_msg *)
|
|
skb_put(skb, sizeof(struct htc_conn_svc_msg));
|
|
conn_msg->service_id = cpu_to_be16(service_connreq->service_id);
|
|
conn_msg->msg_id = cpu_to_be16(HTC_MSG_CONNECT_SERVICE_ID);
|
|
conn_msg->con_flags = cpu_to_be16(service_connreq->con_flags);
|
|
conn_msg->dl_pipeid = endpoint->dl_pipeid;
|
|
conn_msg->ul_pipeid = endpoint->ul_pipeid;
|
|
|
|
/* To prevent infoleak */
|
|
conn_msg->svc_meta_len = 0;
|
|
conn_msg->pad = 0;
|
|
|
|
ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
|
|
if (ret)
|
|
goto err;
|
|
|
|
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
|
|
if (!time_left) {
|
|
dev_err(target->dev, "Service connection timeout for: %d\n",
|
|
service_connreq->service_id);
|
|
kfree_skb(skb);
|
|
return -ETIMEDOUT;
|
|
}
|
|
|
|
*conn_rsp_epid = target->conn_rsp_epid;
|
|
return 0;
|
|
err:
|
|
kfree_skb(skb);
|
|
return ret;
|
|
}
|
|
|
|
int htc_send(struct htc_target *target, struct sk_buff *skb)
|
|
{
|
|
struct ath9k_htc_tx_ctl *tx_ctl;
|
|
|
|
tx_ctl = HTC_SKB_CB(skb);
|
|
return htc_issue_send(target, skb, skb->len, 0, tx_ctl->epid);
|
|
}
|
|
|
|
int htc_send_epid(struct htc_target *target, struct sk_buff *skb,
|
|
enum htc_endpoint_id epid)
|
|
{
|
|
return htc_issue_send(target, skb, skb->len, 0, epid);
|
|
}
|
|
|
|
void htc_stop(struct htc_target *target)
|
|
{
|
|
target->hif->stop(target->hif_dev);
|
|
}
|
|
|
|
void htc_start(struct htc_target *target)
|
|
{
|
|
target->hif->start(target->hif_dev);
|
|
}
|
|
|
|
void htc_sta_drain(struct htc_target *target, u8 idx)
|
|
{
|
|
target->hif->sta_drain(target->hif_dev, idx);
|
|
}
|
|
|
|
void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
|
|
struct sk_buff *skb, bool txok)
|
|
{
|
|
struct htc_endpoint *endpoint;
|
|
struct htc_frame_hdr *htc_hdr = NULL;
|
|
|
|
if (htc_handle->htc_flags & HTC_OP_CONFIG_PIPE_CREDITS) {
|
|
complete(&htc_handle->cmd_wait);
|
|
htc_handle->htc_flags &= ~HTC_OP_CONFIG_PIPE_CREDITS;
|
|
goto ret;
|
|
}
|
|
|
|
if (htc_handle->htc_flags & HTC_OP_START_WAIT) {
|
|
complete(&htc_handle->cmd_wait);
|
|
htc_handle->htc_flags &= ~HTC_OP_START_WAIT;
|
|
goto ret;
|
|
}
|
|
|
|
if (skb) {
|
|
htc_hdr = (struct htc_frame_hdr *) skb->data;
|
|
if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint))
|
|
goto ret;
|
|
endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
|
|
skb_pull(skb, sizeof(struct htc_frame_hdr));
|
|
|
|
if (endpoint->ep_callbacks.tx) {
|
|
endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
|
|
skb, htc_hdr->endpoint_id,
|
|
txok);
|
|
} else {
|
|
kfree_skb(skb);
|
|
}
|
|
}
|
|
|
|
return;
|
|
ret:
|
|
kfree_skb(skb);
|
|
}
|
|
|
|
static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
|
|
struct sk_buff *skb)
|
|
{
|
|
uint32_t *pattern = (uint32_t *)skb->data;
|
|
|
|
switch (*pattern) {
|
|
case 0x33221199:
|
|
{
|
|
struct htc_panic_bad_vaddr *htc_panic;
|
|
htc_panic = (struct htc_panic_bad_vaddr *) skb->data;
|
|
dev_err(htc_handle->dev, "ath: firmware panic! "
|
|
"exccause: 0x%08x; pc: 0x%08x; badvaddr: 0x%08x.\n",
|
|
htc_panic->exccause, htc_panic->pc,
|
|
htc_panic->badvaddr);
|
|
break;
|
|
}
|
|
case 0x33221299:
|
|
{
|
|
struct htc_panic_bad_epid *htc_panic;
|
|
htc_panic = (struct htc_panic_bad_epid *) skb->data;
|
|
dev_err(htc_handle->dev, "ath: firmware panic! "
|
|
"bad epid: 0x%08x\n", htc_panic->epid);
|
|
break;
|
|
}
|
|
default:
|
|
dev_err(htc_handle->dev, "ath: uknown panic pattern!\n");
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* HTC Messages are handled directly here and the obtained SKB
|
|
* is freed.
|
|
*
|
|
* Service messages (Data, WMI) passed to the corresponding
|
|
* endpoint RX handlers, which have to free the SKB.
|
|
*/
|
|
void ath9k_htc_rx_msg(struct htc_target *htc_handle,
|
|
struct sk_buff *skb, u32 len, u8 pipe_id)
|
|
{
|
|
struct htc_frame_hdr *htc_hdr;
|
|
enum htc_endpoint_id epid;
|
|
struct htc_endpoint *endpoint;
|
|
__be16 *msg_id;
|
|
|
|
if (!htc_handle || !skb)
|
|
return;
|
|
|
|
htc_hdr = (struct htc_frame_hdr *) skb->data;
|
|
epid = htc_hdr->endpoint_id;
|
|
|
|
if (epid == 0x99) {
|
|
ath9k_htc_fw_panic_report(htc_handle, skb);
|
|
kfree_skb(skb);
|
|
return;
|
|
}
|
|
|
|
if (epid < 0 || epid >= ENDPOINT_MAX) {
|
|
if (pipe_id != USB_REG_IN_PIPE)
|
|
dev_kfree_skb_any(skb);
|
|
else
|
|
kfree_skb(skb);
|
|
return;
|
|
}
|
|
|
|
if (epid == ENDPOINT0) {
|
|
|
|
/* Handle trailer */
|
|
if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER) {
|
|
if (be32_to_cpu(*(__be32 *) skb->data) == 0x00C60000)
|
|
/* Move past the Watchdog pattern */
|
|
htc_hdr = (struct htc_frame_hdr *)(skb->data + 4);
|
|
}
|
|
|
|
/* Get the message ID */
|
|
msg_id = (__be16 *) ((void *) htc_hdr +
|
|
sizeof(struct htc_frame_hdr));
|
|
|
|
/* Now process HTC messages */
|
|
switch (be16_to_cpu(*msg_id)) {
|
|
case HTC_MSG_READY_ID:
|
|
htc_process_target_rdy(htc_handle, htc_hdr);
|
|
break;
|
|
case HTC_MSG_CONNECT_SERVICE_RESPONSE_ID:
|
|
htc_process_conn_rsp(htc_handle, htc_hdr);
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
kfree_skb(skb);
|
|
|
|
} else {
|
|
if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER)
|
|
skb_trim(skb, len - htc_hdr->control[0]);
|
|
|
|
skb_pull(skb, sizeof(struct htc_frame_hdr));
|
|
|
|
endpoint = &htc_handle->endpoint[epid];
|
|
if (endpoint->ep_callbacks.rx)
|
|
endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv,
|
|
skb, epid);
|
|
}
|
|
}
|
|
|
|
struct htc_target *ath9k_htc_hw_alloc(void *hif_handle,
|
|
struct ath9k_htc_hif *hif,
|
|
struct device *dev)
|
|
{
|
|
struct htc_endpoint *endpoint;
|
|
struct htc_target *target;
|
|
|
|
target = kzalloc(sizeof(struct htc_target), GFP_KERNEL);
|
|
if (!target)
|
|
return NULL;
|
|
|
|
init_completion(&target->target_wait);
|
|
init_completion(&target->cmd_wait);
|
|
|
|
target->hif = hif;
|
|
target->hif_dev = hif_handle;
|
|
target->dev = dev;
|
|
|
|
/* Assign control endpoint pipe IDs */
|
|
endpoint = &target->endpoint[ENDPOINT0];
|
|
endpoint->ul_pipeid = hif->control_ul_pipe;
|
|
endpoint->dl_pipeid = hif->control_dl_pipe;
|
|
|
|
atomic_set(&target->tgt_ready, 0);
|
|
|
|
return target;
|
|
}
|
|
|
|
void ath9k_htc_hw_free(struct htc_target *htc)
|
|
{
|
|
kfree(htc);
|
|
}
|
|
|
|
int ath9k_htc_hw_init(struct htc_target *target,
|
|
struct device *dev, u16 devid,
|
|
char *product, u32 drv_info)
|
|
{
|
|
if (ath9k_htc_probe_device(target, dev, devid, product, drv_info)) {
|
|
pr_err("Failed to initialize the device\n");
|
|
return -ENODEV;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
void ath9k_htc_hw_deinit(struct htc_target *target, bool hot_unplug)
|
|
{
|
|
if (target)
|
|
ath9k_htc_disconnect_device(target, hot_unplug);
|
|
}
|