summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* rtlwifi: btcoex: 23b 1ant: Add rf status notificationPing-Ke Shih2017-05-243-0/+42
| | | | | | | | | | | | If driver announce wifi RF status is off, btc can switch antenna to BT. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: Setup register for BT WHCK testPing-Ke Shih2017-05-242-0/+26
| | | | | | | | | | | | If BT is under WHCK, we enter a special mode. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: parse more BT information from C2HPing-Ke Shih2017-05-242-12/+91
| | | | | | | | | | | | | BT FW provide more BT status as clues, thus we also display them in coex log to help debug in field. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: Add power_on_settingPing-Ke Shih2017-05-242-0/+70
| | | | | | | | | | | | | This change is highly related to init_hwconfig that was decomposed into two parts for better program flow. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: add wifi_only argument to init_hwconfigPing-Ke Shih2017-05-242-59/+47
| | | | | | | | | | | | In case of wifi_only, we can simply switch antenna to wifi. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: adjust wifi duration for bt a2dpPing-Ke Shih2017-05-242-82/+246
| | | | | | | | | | | | | | | | | | The larger the bt a2dp bit pool is, the more time bt needs to receive them. If we do not adjust the wifi duration, the voice quality will be low. Hence we reduce the time that wifi holds, to improve the a2dp service. If the bt is slave, it may receive a packet at any time, so we need to mark them as high priority packets in case of packet loss Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: need these information when scanPing-Ke Shih2017-05-242-2/+29
| | | | | | | | | | | | Log the scan procedure, and update ap_num for future usage when scan done. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: 23b 1ant: Switch antenna to wifi or BT.Ping-Ke Shih2017-05-242-131/+198
| | | | | | | | | | | | | Since wifi and BT share the same physical antenna, we should switch antenna to fit every situation. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Yan-Hsuan Chuang <yhchuang@realtek.com> Cc: Birming Chiu <birming@realtek.com> Cc: Shaofu <shaofu@realtek.com> Cc: Steven Ting <steventing@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: Add device ID for Epson WN7512BEPTom Gaudasinski2017-05-241-0/+2
| | | | | | | | Make Epson WN7512BEP work by adding its device-id to rt2800usb. Device contains a Ralink RT3071L, registers as vendor Accton/Arcadyan. Signed-off-by: Tom Gaudasinski <tomg@records.headdesk.com.au> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ssb: Delete an error message for a failed memory allocation in ↵Markus Elfring2017-05-241-1/+0
| | | | | | | | | | | | | ssb_devices_register() Omit an extra message for a memory allocation failure in this function. This issue was detected by using the Coccinelle software. Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Acked-by: Michael Büsch <m@bues.ch> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2x00_desc_read return typeArnd Bergmann2017-05-249-87/+83
| | | | | | | | | | | | | This is a semi-automated conversion to change rt2x00_desc_read to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(\<rt2x00_desc_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:\(\<_rt2x00_desc_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ drivers/net/wireless/ralink/rt2x00/rt* Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2800_eeprom_read return typeArnd Bergmann2017-05-241-97/+97
| | | | | | | | | | | | | | This is a semi-automated conversion to change rt2800_eeprom_read to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(\<rt2800_eeprom_read\(_from_array\|\)\>(.*, .*\), &\(.*\));:\3 = \1);:' drivers/net/wireless/ralink/rt2x00/rt2800lib.c Some manual tweaking was required here to work around the line wraps. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2x00_eeprom_read return typeArnd Bergmann2017-05-247-68/+62
| | | | | | | | | | | | | This is a semi-automated conversion to change rt2x00_eeprom_read() to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(\<rt2x00_eeprom_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:= _\(rt2x00_eeprom_read\):= \1:' drivers/net/wireless/ralink/rt2x00/* Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2*_bbp_read return typeArnd Bergmann2017-05-246-160/+119
| | | | | | | | | | | | | | This is a semi-automated conversion to change *_bbp_read() to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(\<rt.*_bbp_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:\(\<rt.*_bbp_dcoc_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:= _\(rt.*_bbp_read\):\1:' drivers/net/wireless/ralink/rt2x00/* Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2800_register_read return typeArnd Bergmann2017-05-242-162/+151
| | | | | | | | | | | | | | | | | | This is a semi-automated conversion to change rt2800_register_read to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(rt2800_register_read(.*, .*\), &\(.*\));:\2 = \1);:' \ 's:\(rt2800_register_read_lock(.*, .*\), &\(.*\));:\2 = \1);:' \ drivers/net/wireless/ralink/rt2x00/rt2800lib.c The function itself was modified manually along with the one remaining multi-line caller that was not covered automatically and the indirect reference. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2x00usb_register_read return typeArnd Bergmann2017-05-245-148/+118
| | | | | | | | | | | | | | | This is a semi-automated conversion to change rt2x00usb_register_read to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(\<rt2x00usb_register_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:\(\<rt2500usb_register_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:\(\<rt2500usb_register_read_lock\>(.*, .*\), &\(.*\));:\2 = \1);:' \ drivers/net/wireless/ralink/rt2x00/* Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2x00mmio_register_read return typeArnd Bergmann2017-05-248-259/+252
| | | | | | | | | | | | | | | | | This is a semi-automated conversion to change rt2x00mmio_register_read to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(rt2x00mmio_register_read(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:_rt2x00mmio_register_read:rt2x00mmio_register_read:' \ drivers/net/wireless/ralink/rt2x00/*.c The function itself was modified manually along with the one remaining caller that was not covered automatically. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2x00_rf_read return typeArnd Bergmann2017-05-247-25/+18
| | | | | | | | | | | | | This is a semi-automated conversion to change rt2x00_rf_read() to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(\<rt2x00_rf_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \ drivers/net/wireless/ralink/rt2x00/rt* Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: convert rt2800_rfcsr_read return typeArnd Bergmann2017-05-241-164/+158
| | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_KASAN enabled and gcc-7, we get a warning about rather high stack usage (with a private patch set I have to turn on this warning, which I intend to get into the next kernel release): wireless/ralink/rt2x00/rt2800lib.c: In function 'rt2800_bw_filter_calibration': wireless/ralink/rt2x00/rt2800lib.c:7990:1: error: the frame size of 2144 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] The problem is that KASAN inserts a redzone around each local variable that gets passed by reference, and the newly added function has a lot of them. This is a semi-automated conversion to change rt2800_rfcsr_read to return the register contents instead of passing them by value, resulting in much better object code. The majority of the patch was done using: sed -i 's:\(rt2800_rfcsr_read(.*, .*\), &\(.*\));:\2 = \1);:' \ -i 's:\(rt2800_rfcsr_read_bank(.*, .*\), &\(.*\));:\2 = \1);:' \ drivers/net/wireless/ralink/rt2x00/rt2800lib.c Fixes: 41977e86c984 ("rt2x00: add support for MT7620") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: change function pointers for register accessorsArnd Bergmann2017-05-2415-44/+157
| | | | | | | | | | This prepares the driver for changing all the 'read' register accessors to return the value instead of passing it by reference. Since a lot of them are used in callbacks, this takes care of the callbacks first, adding a couple of helpers that will be removed again one at a time. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* libertas: Remove function entry/exit debuggingKees Cook2017-05-2413-502/+24
| | | | | | | | | | | In at least one place, the enter/exit debugging was not being correctly matched. Based on mailing list feedback, it was desired to drop all of these in favor of using ftrace instead. Suggested-by: Joe Perches <joe@perches.com> Suggested-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* libertas: Avoid reading past end of bufferKees Cook2017-05-241-16/+10
| | | | | | | | | | | | | | | Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, redefine the stat strings to be ETH_GSTRING_LEN sizes, like other drivers. This lets us use a single memcpy that does not leak rodata contents. Additionally adjust indentation to keep checkpatch.pl happy. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay <danielmicay@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* iwlegacy: warn when enabling power saveStanislaw Gruszka2017-05-242-0/+3
| | | | | | | | | | | iwlegacy firmware can crash when power save is configured. PS was allowed in "dbdac2b iwlegacy: properly enable power saving" with belive that user who enable PS is aware of that and can relate firmware crahes with PS. However some distributions seems to enable PS without user intervention, so warn about that. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* wlcore: fix 64K page supportArnd Bergmann2017-05-241-3/+3
| | | | | | | | | | | | | | | | | | | In the stable linux-3.16 branch, I ran into a warning in the wlcore driver: drivers/net/wireless/ti/wlcore/spi.c: In function 'wl12xx_spi_raw_write': drivers/net/wireless/ti/wlcore/spi.c:315:1: error: the frame size of 12848 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Newer kernels no longer show the warning, but the bug is still there, as the allocation is based on the CPU page size rather than the actual capabilities of the hardware. This replaces the PAGE_SIZE macro with the SZ_4K macro, i.e. 4096 bytes per buffer. Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: rsi_91x_core: Use time_after time comparisonKarim Eshapa2017-05-241-1/+1
| | | | | | | Use time_after kernel macro for time comparison. Signed-off-by: Karim Eshapa <karim.eshapa@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Remove old firmware loading methodPrameela Rani Garnepudi2017-05-246-323/+3
| | | | | | | | | | The older firmware loading method is not usable by any Redpine chipset. Hence removing that part of the code. Older firmware image with rsi_91x.fw name is deprecated Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Add new firmware loading methodPrameela Rani Garnepudi2017-05-245-10/+635
| | | | | | | | | | | | | | | | | The older firmware loading method has been deprecated and not in use for any chipets. New method is introduced which works based on soft boot loader. In this method, complete RAM image and FLASH image are present in the flash. Before loading the functional firmware, host issues boot loader commands to verify whether firmware to load is different from the current functional firmware. If not, firmware upgrade progresses and boot loader will switch to the new functional firmware. "rs9113_wlan_qspi.rps" is the firmware filename used in this patch. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Add new host interface operationsPrameela Rani Garnepudi2017-05-245-2/+254
| | | | | | | | | | | Host interface opearation master_reg_read, master_reg_write and load_data_master_write are added. These functions are needed for the new firmware loading method. As part of this, the function master_access_msword is moved from rsi_91x_sdio_ops.c to rsi_91x_sdio.c. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Add host interface operations as separate structure.Prameela Rani Garnepudi2017-05-244-14/+40
| | | | | | | | | | Host interface operations are currently function pointers in rsi_hw structure. As more host interface operations are going to be introduced, separate structure is added for these for convenience. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Add usb multi-byte read operationPrameela Rani Garnepudi2017-05-241-0/+40
| | | | | | | | | USB multibyte read will be used in the new firmware loading method for RS9113 chipset. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Handle usb multi-byte write failure case properlyPrameela Rani Garnepudi2017-05-241-4/+5
| | | | | | | | | | In function usb_write_register_multiple, if any intermediate block transfer is failed, further operations should be terminated. 'else' is removed, as there is no significance for it after return. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: use macros in USB specific codePrameela Rani Garnepudi2017-05-241-6/+9
| | | | | | | | | | For USB vendor read and write operations new macros added to avoid redundant usage of long or'ed macros. Also for timeouts standard USB macros are used. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Changes in USB read and write operationsPrameela Rani Garnepudi2017-05-243-8/+9
| | | | | | | | | USB read and write registers maximum size is limited 2^16. More than this size is not used in the driver. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: define RSI_USB_BUF_SIZE macroamit karwar2017-05-242-2/+4
| | | | | | | | RSI_USB_BUF_SIZE macro is used instead of hardcoding a buffer size to 4096. Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Changes to sdio reads and writesPrameela Rani Garnepudi2017-05-243-11/+11
| | | | | | | | | SDIO read or write maximum size is limited to 2^16. This is done to make the host interface operations common for SDIO and USB. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rsi: Rename file rsi_91x_pkt.c to rsi_91x_hal.cPrameela Rani Garnepudi2017-05-242-1/+1
| | | | | | | | | | | | The file rsi_91x_hal.c is going to contain device specific code i.e new firmware loading method for RS9113 chipset. As the file rsi_91x_pkt.c contains code to prepare device specific descriptors for transmit packet, this file is renamed to rsi_91x_hal.c which is more relevant as per it's functionality. Signed-off-by: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* p54: allocate enough space for ->used_rxkeysDan Carpenter2017-05-221-2/+3
| | | | | | | | We have the number of longs, but we should be calculating the number of bytes needed. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ray_cs: Avoid reading past end of bufferKees Cook2017-05-221-2/+5
| | | | | | | | | | | | | Using memcpy() from a buffer that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. In this case, the source was made longer, since it did not match the destination structure size. Additionally removes a needless cast. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay <danielmicay@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* orinoco_usb: convert request_context.refcount from atomic_t to refcount_tElena Reshetova2017-05-221-7/+8
| | | | | | | | | | | | | | refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* hostap: convert hostap_cmd_queue.usecnt from atomic_t to refcount_tElena Reshetova2017-05-222-7/+8
| | | | | | | | | | | | | | refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Windsor <dwindsor@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* brcmfmac: remove setting IBSS mode when stopping APChi-hsien Lin2017-05-221-3/+0
| | | | | | | | | | | | | | | | Upon stopping an AP interface the driver disable INFRA mode effectively setting the interface in IBSS mode. However, this may affect other interfaces running in INFRA mode. For instance, if user creates and stops hostap daemon on virtual interface, then association cannot work on primary interface because default BSS has been set to IBSS mode in firmware side. The IBSS mode should be set when cfg80211 changes the interface. Reviewed-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Chi-hsien Lin <Chi-Hsien.Lin@cypress.com> [kvalo@codeaurora.org: rephased commit log based on discussion] Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* brcmfmac: btcoex: replace init_timer with setup_timerXie Qirong2017-05-221-3/+1
| | | | | | | | | | | | | | setup_timer.cocci suggested the following improvement: drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c:383:1-11: Use setup_timer function for function on line 384. The combination of init_timer and setting up the data and function field manually is equivalent to calling setup_timer(). This is an api consolidation only and improves readability. Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Xie Qirong <cheerx1994@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* b43: Add missing MODULE_FIRMWARE()Takashi Iwai2017-05-221-0/+10
| | | | | | | | | | Some firmware entries were forgotten to be added via MODULE_FIRMWARE(), which may result in the non-functional state when the driver is loaded in initrd. Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1037344 Fixes: 15be8e89cdd9 ("b43: add more bcma cores") Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo2017-05-1922-104/+2782
|\ | | | | | | | | | | | | | | ath.git patches for 4.13. Major changes: ath10k * add initial SDIO support (still work in progress)
| * ath9k: check ah->curchan when updating tx powerStanislaw Gruszka2017-05-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When driver fail to reset card ah->curchan value stay NULL. When later driver try to update tx power it oops by using ah->curchan (calltrace is shown below). This problem were reported at various places and for some it was fixed by making ath9k_hw_chip_reset() do not fail. I have this bug report on some oldish RHEL kernel with AR9285, however it's hard to debug where reset fail when kernel OOPS, so I think this patch should be applied. Hopefully ah->curchan is not used unconditionally on other places until is initialized on ath9k_config(). ath: phy0: Chip reset failed ath: phy0: Unable to reset hardware; reset status -22 (freq 2412 MHz) BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<f8a35585>] ath9k_hw_set_txpowerlimit+0x25/0x80 [ath9k_hw] Oops: 0000 [#1] SMP <snip> Call Trace: [<f8aac1aa>] ? ath9k_cmn_update_txpow+0x1a/0x30 [ath9k_common] [<f8cf4f4e>] ? ath_complete_reset+0x4e/0x130 [ath9k] [<f8cf54d7>] ? ath9k_start+0x127/0x1e0 [ath9k] [<f8c2e52f>] ? ieee80211_do_open+0x30f/0x910 [mac80211] [<c07bd96d>] ? dev_open+0x8d/0xf0 Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: remove unnecessary codeGustavo A. R. Silva2017-05-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | The array field eeprom_data in struct th9k_platform_data is a fixed size array so it can never be NULL. Addresses-Coverity-ID: 1364903 Cc: Arend Van Spriel <arend.vanspriel@broadcom.com> Cc: Kalle Valo <kvalo@qca.qualcomm.com> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * wil6210: use memdup_userGeliang Tang2017-05-191-8/+4
| | | | | | | | | | | | | | Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang <geliangtang@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath5k: fix memory leak on buf on failed eeprom readColin Ian King2017-05-191-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | The AR5K_EEPROM_READ macro returns with -EIO if a read error occurs causing a memory leak on the allocated buffer buf. Fix this by explicitly calling ath5k_hw_nvram_read and exiting on the via the freebuf label that performs the necessary free'ing of buf when a read error occurs. Detected by CoverityScan, CID#1248782 ("Resource Leak") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: fix spelling in ath9k_tx99_init()Ammly Fredrick2017-05-191-1/+1
| | | | | | | | | | | | | | | | It's spelled hardware, not harware. Signed-off-by: Ammly Fredrick <ammlyf@gmail.com> [kvalo@qca.qualcomm.com: improve commit log] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath6kl: assure headroom of skbuff is writable in .start_xmit()Arend Van Spriel2017-05-191-9/+4
| | | | | | | | | | | | | | | | | | | | | | An issue was found brcmfmac driver in which a skbuff in .start_xmit() callback was actually cloned. So instead of checking for sufficient headroom it should also be writable. Hence use skb_cow_head() to check and expand the headroom appropriately. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Tested-by: Steve deRosier <derosier@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 06:06:15 +0100