summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/ath/ath9k/hif_usb.h
AgeCommit message (Collapse)AuthorFilesLines
2023-10-23wifi: ath9k_htc: fix format-truncation warningKalle Valo1-1/+1
On v6.6-rc4 with GCC 13.2 I see: drivers/net/wireless/ath/ath9k/hif_usb.c:1223:42: warning: '.0.fw' directive output may be truncated writing 5 bytes into a region of size between 4 and 11 [-Wformat-truncation=] drivers/net/wireless/ath/ath9k/hif_usb.c:1222:17: note: 'snprintf' output between 27 and 34 bytes into a destination of size 32 Fix it by increasing the size of the fw_name field to 64 bytes. Compile tested only. Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231012135854.3473332-3-kvalo@kernel.org
2020-04-07ath9k: Fix general protection fault in ath9k_hif_usb_rx_cbQiujun Huang1-0/+5
In ath9k_hif_usb_rx_cb interface number is assumed to be 0. usb_ifnum_to_if(urb->dev, 0) But it isn't always true. The case reported by syzbot: https://lore.kernel.org/linux-usb/000000000000666c9c05a1c05d12@google.com usb 2-1: new high-speed USB device number 2 using dummy_hcd usb 2-1: config 1 has an invalid interface number: 2 but max is 0 usb 2-1: config 1 has no interface number 0 usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0 Call Trace __usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786 __do_softirq+0x21e/0x950 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x178/0x1a0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1146 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 Reported-and-tested-by: syzbot+40d5d2e8a4680952f042@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200404041838.10426-6-hqjagain@gmail.com
2020-04-07ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rxQiujun Huang1-0/+1
Free wmi later after cmd urb has been killed, as urb cb will access wmi. the case reported by syzbot: https://lore.kernel.org/linux-usb/0000000000000002fc05a1d61a68@google.com BUG: KASAN: use-after-free in ath9k_wmi_ctrl_rx+0x416/0x500 drivers/net/wireless/ath/ath9k/wmi.c:215 Read of size 1 at addr ffff8881cef1417c by task swapper/1/0 Call Trace: <IRQ> ath9k_wmi_ctrl_rx+0x416/0x500 drivers/net/wireless/ath/ath9k/wmi.c:215 ath9k_htc_rx_msg+0x2da/0xaf0 drivers/net/wireless/ath/ath9k/htc_hst.c:459 ath9k_hif_usb_reg_in_cb+0x1ba/0x630 drivers/net/wireless/ath/ath9k/hif_usb.c:718 __usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786 Reported-and-tested-by: syzbot+5d338854440137ea0fef@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200404041838.10426-3-hqjagain@gmail.com
2016-12-01ath9k_htc: don't use HZ for usb msg timeoutsAnthony Romano1-0/+2
The usb_*_msg() functions expect a timeout in msecs but are given HZ, which is ticks per second. If HZ=100, firmware download often times out when there is modest USB utilization and the device fails to initialize. Replaces HZ in usb_*_msg timeouts with 1000 msec since HZ is one second for timeouts in jiffies. Signed-off-by: Anthony Romano <anthony.romano@coreos.com> Acked-by: Oleksij Rempel <linux@rempel-privat.de> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-09-18ath9k_htc: introduce support for different fw versionsOleksij Rempel1-1/+20
Current kernel support only one fw name with theoretically only one fw version located in “firmware/htc_[9271|7010].fw”. Which is ok so far we have only one fw version (1.3). After we realised new fw 1.4, we faced compatibility problem which was decided to solve by firmware name and location: - new firmware is located now in firmware/ath9k_htc/htc_[9271|7010]-1.4.0.fw - old version 1.3 should be on old place, so old kernel have no issues with it. - new kernels including this patch should be able to try different supported (min..max) fw version. - new kernel should be able to support old fw location too. At least for now. At same time this patch will add new module option which should allow user to play with development fw version without replacing stable one. If user will set “ath9k_htc use_dev_fw=1” module will try to find firmware/ath9k_htc/htc_[9271|7010]-1.dev.0.fw first and if it fails, use stable version: for example...1.4.0.fw. Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2012-09-07wireless: ath9k-htc: only load firmware in needMing Lei1-1/+3
It is not necessary to hold the firmware memory during the whole driver lifetime, and obviously it does waste memory. Suppose there are 4 ath9k-htc usb dongles working, kernel has to consume about 4*50KBytes RAM to cache firmware for all dongles. After applying the patch, kernel only caches one single firmware image in RAM for all ath9k-htc devices just during system suspend/resume cycle. When system is ready for loading firmware, ath9k-htc can request the loading from usersapce. During system resume, ath9k-htc still can load the firmware which was cached in kernel memory before system suspend. Cc: ath9k-devel@lists.ath9k.org Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com> Cc: Jouni Malinen <jouni@qca.qualcomm.com> Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com> Cc: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2012-01-31ath9k_htc: Load firmware asynchronouslySujith Manoharan1-1/+2
This patch modifies ath9k_htc to load the needed firmware in an asynchronous manner, fixing timeouts that were introduced with the new udev changes. Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-05-19ath9k: Drag the driver to the year 2011Sujith Manoharan1-1/+1
The Times They Are a-Changin'. Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-05-19ath9k_htc: Fix mode selectionSujith Manoharan1-1/+1
Remove all the unsupported modes like FH, TURBO etc. Since this requires a FW update, increase the fw version to 1.3 Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-28ath9k_htc: Increase credit size for AR7010 devicesSujith Manoharan1-1/+1
Bump the firmware version to 1.2 Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-25ath9k_htc: Fix AMPDU subframe handlingSujith Manoharan1-0/+3
* Register the driver's maximum ampdu subframe limit to mac80211. * Cleanup the target capabilities structure and fix an endian issue. * Fix BTCOEX by sending a command to the target when the BT priority changes. * Bump the required firmware version to 1.1 Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-13ath9k_htc: Use separate URB pool for management framesSujith Manoharan1-0/+1
Beacon transmission needs to involve as little latency as possible after receiving a SWBA event from the target. Since packets are buffered to use TX stream mode, beacon frames sometimes gets queued up and are not sent out immediately. Fix this by decoupling management frame transmission from the normal data path and send them out immediately. Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-13ath9k_htc: Increase URB count for REG_IN pipeSujith Manoharan1-2/+2
Using a single URB for receiving WMI events is insufficient, increase it to 64 to not lose WMI events in high throughput situations. Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-13ath9k_htc: Reduce TX queue sizeSujith Manoharan1-1/+1
The current max queue length of 1024 is quite large and unnecessary. 256 suffices well enough even for high throughput situations. Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-01-04ath9k_htc: Handle pending URBs properlySujith Manoharan1-0/+1
When doing a channel change, the pending URBs have to be killed properly on calling htc_stop(). This fixes the probe response timeout seen when sending UDP traffic at a high rate and running background scan at the same time. Cc: stable <stable@kernel.org> Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-12-08ath9k_htc: Cleanup device identificationSujith Manoharan1-0/+2
ath.ko is a common module shared between ath5k, ar9170usb, ath9k and ath9k_htc. Adding driver specific data to the shared structure would impact all the drivers. Handling USB device recognition for devices specific to ath9k_htc can be handled within the driver itself. Also, AR7010 refers to the processor used in both AR9280/AR9287 based devices. Rename the device enumerations accordingly. While at it, check properly for the bus type when choosing the EEPROM base address for UB95. Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-06-05ath9k_htc: Add support for AR7010Sujith1-0/+1
Add the USB device IDs for AR7010 and handle firmware loading properly. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-06-05ath9k: Determine Firmware on probeSujith1-0/+1
Do not assign the FW name to driver_info but determine it dynamically on device probe. This facilitates adding new firmware. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-04-26ath9k_htc: Simplify TX URB managementSujith1-1/+0
This patch simplifies URB management for transmission, by removing the 'FLUSH' variable (which is not needed, since we can determine if the URB has been killed by looking at the URB status), and also handling the STOP case properly. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-04-08ath9k_htc: Use anchors for REGOUT pipeSujith1-0/+1
hif_usb_regout_cb() frees the given URB, which is borked by design. Use an anchor to simplify URB management. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-04-08ath9k_htc: Fix module unloading issueSujith1-0/+1
The maximum number of packets in a single buffer in stream mode is 10. The driver currently uses 8 - which caused stack corruption, in the absence of any kind of OOB checking. Fixing this to the correct value of 10 fixes the module unload issue. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Tested-by: Ming Lei <tom.leiming@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-04-08ath9k_htc: Protect RX stream variablesSujith1-0/+1
Use a spin lock to prevent concurrent access to variables dealing with RX stream mode handling. Currently, no protection is implemented - which causes problems in RX. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-03-31ath9k_htc: Simplify RX URB managementSujith1-5/+2
This patch introduces the usage of URB anchors, thus reducing a large amount of code dealing with URB maintenance within the driver. The RX callback now takes care of freeing the SKB associated with each URB. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2010-03-23ath9k_htc: Support for AR9271 chipset.Sujith1-0/+105
Features: * Station mode * IBSS mode * Monitor mode * Legacy support * HT support * TX/RX 11n Aggregation * HW encryption * LED * Suspend/Resume For more information: http://wireless.kernel.org/en/users/Drivers/ath9k_htc Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com> Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.39.0) at 2024-07-23 23:28:34 +0300