Changes in 4.9.326 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put ntfs: fix use-after-free in ntfs_ucsncmp() scsi: ufs: host: Hold reference returned by of_parse_phandle() net: ping6: Fix memleak in ipv6_renew_options(). net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() netfilter: nf_queue: do not allow packet truncation below transport header offset ARM: crypto: comment out gcc warning that breaks clang builds mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. ion: Make user_ion_handle_put_nolock() a void function selinux: Minor cleanups proc: Pass file mode to proc_pid_make_inode selinux: Clean up initialization of isec->sclass selinux: Convert isec->lock into a spinlock selinux: fix error initialization in inode_doinit_with_dentry() selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap init/main: Fix double "the" in comment init/main: properly align the multi-line comment init: move stack canary initialization after setup_arch init/main.c: extract early boot entropy from the passed cmdline ACPI: video: Force backlight native for some TongFang devices ACPI: video: Shortening quirk list by identifying Clevo by board_name only random: only call boot_init_stack_canary() once macintosh/adb: fix oob read in do_adb_query() function ALSA: bcd2000: Fix a UAF bug on the error path of probing add barriers to buffer_uptodate and set_buffer_uptodate KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model vfs: Check the truncate maximum size in inode_newsize_ok() usbnet: Fix linkwatch use-after-free on disconnect parisc: Fix device names in /proc/iomem drm/nouveau: fix another off-by-one in nvbios_addr bpf: fix overflow in prog accounting fuse: limit nsec md-raid10: fix KASAN warning ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK USB: HCD: Fix URB giveback issue in tasklet function netfilter: nf_tables: fix null deref due to zeroed list head scsi: zfcp: Fix missing auto port scan and thus missing target ports x86/olpc: fix 'logical not is only applied to the left hand side' spmi: trace: fix stack-out-of-bound access in SPMI tracing functions ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: make sure ext4_append() always allocates new block ext4: fix use-after-free in ext4_xattr_set_entry ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: correct max_inline_xattr_value_size computing dm raid: fix address sanitizer warning in raid_status net_sched: cls_route: remove from list when handle is 0 btrfs: reject log replay if there is unsupported RO compat flag tcp: fix over estimation in sk_forced_mem_schedule() scsi: sg: Allow waiting for commands to complete on removed device Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression nios2: time: Read timer in get_cycles only if initialized net/9p: Initialize the iounit field during fid creation net_sched: cls_route: disallow handle of 0 ALSA: info: Fix llseek return value when using callback rds: add missing barrier to release_refill ata: libata-eh: Add missing command name btrfs: fix lost error handling when looking up extended ref on log replay can: ems_usb: fix clang's -Wunaligned-access warning NFSv4.1: RECLAIM_COMPLETE must handle EACCES SUNRPC: Reinitialise the backchannel request buffers before reuse pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed vsock: Fix memory leak in vsock_connect() xen/xenbus: fix return type in xenbus_file_read() atm: idt77252: fix use-after-free bugs caused by tst_timer nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() netfilter: nf_tables: really skip inactive sets when allocating name fec: Fix timer capture timing in `fec_ptp_enable_pps()` irqchip/tegra: Fix overflow implicit truncation warnings usb: host: ohci-ppc-of: Fix refcount leak bug gadgetfs: ep_io - wait until IRQ finishes cxl: Fix a memory leak in an error handling path drivers:md:fix a potential use-after-free bug ext4: avoid remove directory when directory is corrupted ext4: avoid resizing to a partial cluster size tty: serial: Fix refcount leak bug in ucc_uart.c vfio: Clear the caps->buf to NULL after free mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper powerpc/64: Init jump labels before parse_early_param() video: fbdev: i740fb: Check the argument of i740_calc_vclk() MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Linux 4.9.326 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3ca17af58cd0c61bd81028c496849592cfd22f0f
364 lines
9.3 KiB
C
364 lines
9.3 KiB
C
/*
|
|
* Copyright (C) 2015 Jakub Kicinski <kubakici@wp.pl>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2
|
|
* as published by the Free Software Foundation
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
#include <linux/usb.h>
|
|
|
|
#include "mt7601u.h"
|
|
#include "usb.h"
|
|
#include "trace.h"
|
|
|
|
static struct usb_device_id mt7601u_device_table[] = {
|
|
{ USB_DEVICE(0x0b05, 0x17d3) },
|
|
{ USB_DEVICE(0x0e8d, 0x760a) },
|
|
{ USB_DEVICE(0x0e8d, 0x760b) },
|
|
{ USB_DEVICE(0x13d3, 0x3431) },
|
|
{ USB_DEVICE(0x13d3, 0x3434) },
|
|
{ USB_DEVICE(0x148f, 0x7601) },
|
|
{ USB_DEVICE(0x148f, 0x760a) },
|
|
{ USB_DEVICE(0x148f, 0x760b) },
|
|
{ USB_DEVICE(0x148f, 0x760c) },
|
|
{ USB_DEVICE(0x148f, 0x760d) },
|
|
{ USB_DEVICE(0x2001, 0x3d04) },
|
|
{ USB_DEVICE(0x2717, 0x4106) },
|
|
{ USB_DEVICE(0x2955, 0x0001) },
|
|
{ USB_DEVICE(0x2955, 0x1001) },
|
|
{ USB_DEVICE(0x2955, 0x1003) },
|
|
{ USB_DEVICE(0x2a5f, 0x1000) },
|
|
{ USB_DEVICE(0x7392, 0x7710) },
|
|
{ 0, }
|
|
};
|
|
|
|
bool mt7601u_usb_alloc_buf(struct mt7601u_dev *dev, size_t len,
|
|
struct mt7601u_dma_buf *buf)
|
|
{
|
|
struct usb_device *usb_dev = mt7601u_to_usb_dev(dev);
|
|
|
|
buf->len = len;
|
|
buf->urb = usb_alloc_urb(0, GFP_KERNEL);
|
|
buf->buf = usb_alloc_coherent(usb_dev, buf->len, GFP_KERNEL, &buf->dma);
|
|
|
|
return !buf->urb || !buf->buf;
|
|
}
|
|
|
|
void mt7601u_usb_free_buf(struct mt7601u_dev *dev, struct mt7601u_dma_buf *buf)
|
|
{
|
|
struct usb_device *usb_dev = mt7601u_to_usb_dev(dev);
|
|
|
|
usb_free_coherent(usb_dev, buf->len, buf->buf, buf->dma);
|
|
usb_free_urb(buf->urb);
|
|
}
|
|
|
|
int mt7601u_usb_submit_buf(struct mt7601u_dev *dev, int dir, int ep_idx,
|
|
struct mt7601u_dma_buf *buf, gfp_t gfp,
|
|
usb_complete_t complete_fn, void *context)
|
|
{
|
|
struct usb_device *usb_dev = mt7601u_to_usb_dev(dev);
|
|
unsigned pipe;
|
|
int ret;
|
|
|
|
if (dir == USB_DIR_IN)
|
|
pipe = usb_rcvbulkpipe(usb_dev, dev->in_eps[ep_idx]);
|
|
else
|
|
pipe = usb_sndbulkpipe(usb_dev, dev->out_eps[ep_idx]);
|
|
|
|
usb_fill_bulk_urb(buf->urb, usb_dev, pipe, buf->buf, buf->len,
|
|
complete_fn, context);
|
|
buf->urb->transfer_dma = buf->dma;
|
|
buf->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
|
|
|
|
trace_mt_submit_urb(dev, buf->urb);
|
|
ret = usb_submit_urb(buf->urb, gfp);
|
|
if (ret)
|
|
dev_err(dev->dev, "Error: submit URB dir:%d ep:%d failed:%d\n",
|
|
dir, ep_idx, ret);
|
|
return ret;
|
|
}
|
|
|
|
void mt7601u_complete_urb(struct urb *urb)
|
|
{
|
|
struct completion *cmpl = urb->context;
|
|
|
|
complete(cmpl);
|
|
}
|
|
|
|
int mt7601u_vendor_request(struct mt7601u_dev *dev, const u8 req,
|
|
const u8 direction, const u16 val, const u16 offset,
|
|
void *buf, const size_t buflen)
|
|
{
|
|
int i, ret;
|
|
struct usb_device *usb_dev = mt7601u_to_usb_dev(dev);
|
|
const u8 req_type = direction | USB_TYPE_VENDOR | USB_RECIP_DEVICE;
|
|
const unsigned int pipe = (direction == USB_DIR_IN) ?
|
|
usb_rcvctrlpipe(usb_dev, 0) : usb_sndctrlpipe(usb_dev, 0);
|
|
|
|
for (i = 0; i < MT_VEND_REQ_MAX_RETRY; i++) {
|
|
ret = usb_control_msg(usb_dev, pipe, req, req_type,
|
|
val, offset, buf, buflen,
|
|
MT_VEND_REQ_TOUT_MS);
|
|
trace_mt_vend_req(dev, pipe, req, req_type, val, offset,
|
|
buf, buflen, ret);
|
|
|
|
if (ret == -ENODEV)
|
|
set_bit(MT7601U_STATE_REMOVED, &dev->state);
|
|
if (ret >= 0 || ret == -ENODEV)
|
|
return ret;
|
|
|
|
msleep(5);
|
|
}
|
|
|
|
dev_err(dev->dev, "Vendor request req:%02x off:%04x failed:%d\n",
|
|
req, offset, ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
void mt7601u_vendor_reset(struct mt7601u_dev *dev)
|
|
{
|
|
mt7601u_vendor_request(dev, MT_VEND_DEV_MODE, USB_DIR_OUT,
|
|
MT_VEND_DEV_MODE_RESET, 0, NULL, 0);
|
|
}
|
|
|
|
u32 mt7601u_rr(struct mt7601u_dev *dev, u32 offset)
|
|
{
|
|
int ret;
|
|
u32 val = ~0;
|
|
|
|
WARN_ONCE(offset > USHRT_MAX, "read high off:%08x", offset);
|
|
|
|
mutex_lock(&dev->vendor_req_mutex);
|
|
|
|
ret = mt7601u_vendor_request(dev, MT_VEND_MULTI_READ, USB_DIR_IN,
|
|
0, offset, dev->vend_buf, MT_VEND_BUF);
|
|
if (ret == MT_VEND_BUF)
|
|
val = get_unaligned_le32(dev->vend_buf);
|
|
else if (ret > 0)
|
|
dev_err(dev->dev, "Error: wrong size read:%d off:%08x\n",
|
|
ret, offset);
|
|
|
|
mutex_unlock(&dev->vendor_req_mutex);
|
|
|
|
trace_reg_read(dev, offset, val);
|
|
return val;
|
|
}
|
|
|
|
int mt7601u_vendor_single_wr(struct mt7601u_dev *dev, const u8 req,
|
|
const u16 offset, const u32 val)
|
|
{
|
|
int ret;
|
|
|
|
mutex_lock(&dev->vendor_req_mutex);
|
|
|
|
ret = mt7601u_vendor_request(dev, req, USB_DIR_OUT,
|
|
val & 0xffff, offset, NULL, 0);
|
|
if (!ret)
|
|
ret = mt7601u_vendor_request(dev, req, USB_DIR_OUT,
|
|
val >> 16, offset + 2, NULL, 0);
|
|
|
|
mutex_unlock(&dev->vendor_req_mutex);
|
|
|
|
return ret;
|
|
}
|
|
|
|
void mt7601u_wr(struct mt7601u_dev *dev, u32 offset, u32 val)
|
|
{
|
|
WARN_ONCE(offset > USHRT_MAX, "write high off:%08x", offset);
|
|
|
|
mt7601u_vendor_single_wr(dev, MT_VEND_WRITE, offset, val);
|
|
trace_reg_write(dev, offset, val);
|
|
}
|
|
|
|
u32 mt7601u_rmw(struct mt7601u_dev *dev, u32 offset, u32 mask, u32 val)
|
|
{
|
|
val |= mt7601u_rr(dev, offset) & ~mask;
|
|
mt7601u_wr(dev, offset, val);
|
|
return val;
|
|
}
|
|
|
|
u32 mt7601u_rmc(struct mt7601u_dev *dev, u32 offset, u32 mask, u32 val)
|
|
{
|
|
u32 reg = mt7601u_rr(dev, offset);
|
|
|
|
val |= reg & ~mask;
|
|
if (reg != val)
|
|
mt7601u_wr(dev, offset, val);
|
|
return val;
|
|
}
|
|
|
|
void mt7601u_wr_copy(struct mt7601u_dev *dev, u32 offset,
|
|
const void *data, int len)
|
|
{
|
|
WARN_ONCE(offset & 3, "unaligned write copy off:%08x", offset);
|
|
WARN_ONCE(len & 3, "short write copy off:%08x", offset);
|
|
|
|
mt7601u_burst_write_regs(dev, offset, data, len / 4);
|
|
}
|
|
|
|
void mt7601u_addr_wr(struct mt7601u_dev *dev, const u32 offset, const u8 *addr)
|
|
{
|
|
mt7601u_wr(dev, offset, get_unaligned_le32(addr));
|
|
mt7601u_wr(dev, offset + 4, addr[4] | addr[5] << 8);
|
|
}
|
|
|
|
static int mt7601u_assign_pipes(struct usb_interface *usb_intf,
|
|
struct mt7601u_dev *dev)
|
|
{
|
|
struct usb_endpoint_descriptor *ep_desc;
|
|
struct usb_host_interface *intf_desc = usb_intf->cur_altsetting;
|
|
unsigned i, ep_i = 0, ep_o = 0;
|
|
|
|
BUILD_BUG_ON(sizeof(dev->in_eps) < __MT_EP_IN_MAX);
|
|
BUILD_BUG_ON(sizeof(dev->out_eps) < __MT_EP_OUT_MAX);
|
|
|
|
for (i = 0; i < intf_desc->desc.bNumEndpoints; i++) {
|
|
ep_desc = &intf_desc->endpoint[i].desc;
|
|
|
|
if (usb_endpoint_is_bulk_in(ep_desc) &&
|
|
ep_i++ < __MT_EP_IN_MAX) {
|
|
dev->in_eps[ep_i - 1] = usb_endpoint_num(ep_desc);
|
|
dev->in_max_packet = usb_endpoint_maxp(ep_desc);
|
|
/* Note: this is ignored by usb sub-system but vendor
|
|
* code does it. We can drop this at some point.
|
|
*/
|
|
dev->in_eps[ep_i - 1] |= USB_DIR_IN;
|
|
} else if (usb_endpoint_is_bulk_out(ep_desc) &&
|
|
ep_o++ < __MT_EP_OUT_MAX) {
|
|
dev->out_eps[ep_o - 1] = usb_endpoint_num(ep_desc);
|
|
dev->out_max_packet = usb_endpoint_maxp(ep_desc);
|
|
}
|
|
}
|
|
|
|
if (ep_i != __MT_EP_IN_MAX || ep_o != __MT_EP_OUT_MAX) {
|
|
dev_err(dev->dev, "Error: wrong pipe number in:%d out:%d\n",
|
|
ep_i, ep_o);
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int mt7601u_probe(struct usb_interface *usb_intf,
|
|
const struct usb_device_id *id)
|
|
{
|
|
struct usb_device *usb_dev = interface_to_usbdev(usb_intf);
|
|
struct mt7601u_dev *dev;
|
|
u32 asic_rev, mac_rev;
|
|
int ret;
|
|
|
|
dev = mt7601u_alloc_device(&usb_intf->dev);
|
|
if (!dev)
|
|
return -ENOMEM;
|
|
|
|
usb_dev = usb_get_dev(usb_dev);
|
|
usb_reset_device(usb_dev);
|
|
|
|
usb_set_intfdata(usb_intf, dev);
|
|
|
|
dev->vend_buf = devm_kmalloc(dev->dev, MT_VEND_BUF, GFP_KERNEL);
|
|
if (!dev->vend_buf) {
|
|
ret = -ENOMEM;
|
|
goto err;
|
|
}
|
|
|
|
ret = mt7601u_assign_pipes(usb_intf, dev);
|
|
if (ret)
|
|
goto err;
|
|
ret = mt7601u_wait_asic_ready(dev);
|
|
if (ret)
|
|
goto err;
|
|
|
|
asic_rev = mt7601u_rr(dev, MT_ASIC_VERSION);
|
|
mac_rev = mt7601u_rr(dev, MT_MAC_CSR0);
|
|
dev_info(dev->dev, "ASIC revision: %08x MAC revision: %08x\n",
|
|
asic_rev, mac_rev);
|
|
|
|
/* Note: vendor driver skips this check for MT7601U */
|
|
if (!(mt7601u_rr(dev, MT_EFUSE_CTRL) & MT_EFUSE_CTRL_SEL))
|
|
dev_warn(dev->dev, "Warning: eFUSE not present\n");
|
|
|
|
ret = mt7601u_init_hardware(dev);
|
|
if (ret)
|
|
goto err;
|
|
ret = mt7601u_register_device(dev);
|
|
if (ret)
|
|
goto err_hw;
|
|
|
|
set_bit(MT7601U_STATE_INITIALIZED, &dev->state);
|
|
|
|
return 0;
|
|
err_hw:
|
|
mt7601u_cleanup(dev);
|
|
err:
|
|
usb_set_intfdata(usb_intf, NULL);
|
|
usb_put_dev(interface_to_usbdev(usb_intf));
|
|
|
|
destroy_workqueue(dev->stat_wq);
|
|
ieee80211_free_hw(dev->hw);
|
|
return ret;
|
|
}
|
|
|
|
static void mt7601u_disconnect(struct usb_interface *usb_intf)
|
|
{
|
|
struct mt7601u_dev *dev = usb_get_intfdata(usb_intf);
|
|
|
|
ieee80211_unregister_hw(dev->hw);
|
|
mt7601u_cleanup(dev);
|
|
|
|
usb_set_intfdata(usb_intf, NULL);
|
|
usb_put_dev(interface_to_usbdev(usb_intf));
|
|
|
|
destroy_workqueue(dev->stat_wq);
|
|
ieee80211_free_hw(dev->hw);
|
|
}
|
|
|
|
static int mt7601u_suspend(struct usb_interface *usb_intf, pm_message_t state)
|
|
{
|
|
struct mt7601u_dev *dev = usb_get_intfdata(usb_intf);
|
|
|
|
mt7601u_cleanup(dev);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int mt7601u_resume(struct usb_interface *usb_intf)
|
|
{
|
|
struct mt7601u_dev *dev = usb_get_intfdata(usb_intf);
|
|
int ret;
|
|
|
|
ret = mt7601u_init_hardware(dev);
|
|
if (ret)
|
|
return ret;
|
|
|
|
set_bit(MT7601U_STATE_INITIALIZED, &dev->state);
|
|
|
|
return 0;
|
|
}
|
|
|
|
MODULE_DEVICE_TABLE(usb, mt7601u_device_table);
|
|
MODULE_FIRMWARE(MT7601U_FIRMWARE);
|
|
MODULE_LICENSE("GPL");
|
|
|
|
static struct usb_driver mt7601u_driver = {
|
|
.name = KBUILD_MODNAME,
|
|
.id_table = mt7601u_device_table,
|
|
.probe = mt7601u_probe,
|
|
.disconnect = mt7601u_disconnect,
|
|
.suspend = mt7601u_suspend,
|
|
.resume = mt7601u_resume,
|
|
.reset_resume = mt7601u_resume,
|
|
.soft_unbind = 1,
|
|
.disable_hub_initiated_lpm = 1,
|
|
};
|
|
module_usb_driver(mt7601u_driver);
|