GitHub/LineageOS/G12/android_kernel_amlogic_linux-4.9.git
10 years agortlwifi: rtl8723be: disable MSI interrupts mode
Adam Lee [Thu, 24 Apr 2014 03:08:44 +0000 (11:08 +0800)]
rtlwifi: rtl8723be: disable MSI interrupts mode

94010fa0dd07e8b904e7c6b6589f15573008ab15 ("rtlwifi: add MSI interrupts
mode support") introduced MSI interrupts mode support, which seemed
safe enough with RTL8188EE and RTL8723BE as RealTek's testing results,
but some users reported their RTL8188EE modules could not connect to
any wireless network after the MSI mode was enabled by Ubuntu 14.04.

So, let's fallback to pin-based mode until rtlwifi's MSI support get
good compatibility.

BugLink: https://bugs.launchpad.net/bugs/1310512
Signed-off-by: Adam Lee <adam.lee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoRevert "rtlwifi: rtl8188ee: enable MSI interrupts mode"
Adam Lee [Thu, 24 Apr 2014 03:08:43 +0000 (11:08 +0800)]
Revert "rtlwifi: rtl8188ee: enable MSI interrupts mode"

This reverts commit 2a54eb5e1476426ee639bbfbe179b52342a0d82c
("rtlwifi: rtl8188ee: enable MSI interrupts mode").

94010fa0dd07e8b904e7c6b6589f15573008ab15 ("rtlwifi: add MSI interrupts
mode support") introduced MSI interrupts mode support, which seemed
safe enough with RTL8188EE and RTL8723BE as RealTek's testing results,
but some users reported their RTL8188EE modules could not connect to
any wireless network after the MSI mode was enabled by Ubuntu 14.04.

So, let's fallback to pin-based mode until rtlwifi's MSI support get
good compatibility.

BugLink: https://bugs.launchpad.net/bugs/1310512
Signed-off-by: Adam Lee <adam.lee@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: don't pre-set radio_on variable to true
Rafał Miłecki [Tue, 22 Apr 2014 11:54:37 +0000 (13:54 +0200)]
b43: don't pre-set radio_on variable to true

Setting it to true during init doesn't seem to be any workaround while
it can cause problems (not enabling radio due to belief it's enabled).

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: use b43_software_rfkill helper
Rafał Miłecki [Tue, 22 Apr 2014 11:54:36 +0000 (13:54 +0200)]
b43: use b43_software_rfkill helper

This removes dealing with pointers directly and allows tracking radio
state with radio_on variable.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: bcma: respect GMODE (band choice) during core reset
Rafał Miłecki [Tue, 22 Apr 2014 11:54:35 +0000 (13:54 +0200)]
b43: bcma: respect GMODE (band choice) during core reset

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoMerge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac802...
John W. Linville [Wed, 30 Apr 2014 16:04:27 +0000 (12:04 -0400)]
Merge branch 'for-john' of git://git./linux/kernel/git/jberg/mac80211-next

Conflicts:
net/mac80211/chan.c

10 years agoMerge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetoot...
John W. Linville [Wed, 30 Apr 2014 15:56:43 +0000 (11:56 -0400)]
Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next

10 years agomac80211_hwsim: Advertise support for AP mode channel width changes
Jouni Malinen [Mon, 28 Apr 2014 08:22:46 +0000 (11:22 +0300)]
mac80211_hwsim: Advertise support for AP mode channel width changes

mac80211 takes care of all the needed steps for hwsim, so indicate
support for this capability.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: Support dynamic AP mode channel width changes
Jouni Malinen [Mon, 28 Apr 2014 08:22:25 +0000 (11:22 +0300)]
mac80211: Support dynamic AP mode channel width changes

Implement the new cfg80211 capability to enable mac80211-based drivers
to support for dynamic channel bandwidth changes (e.g., HT 20/40 MHz
changes).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: Dynamic channel bandwidth changes in AP mode
Jouni Malinen [Mon, 28 Apr 2014 08:22:08 +0000 (11:22 +0300)]
cfg80211: Dynamic channel bandwidth changes in AP mode

This extends NL80211_CMD_SET_CHANNEL to allow dynamic channel bandwidth
changes in AP mode (including P2P GO) during a lifetime of the BSS. This
can be used to implement, e.g., HT 20/40 MHz co-existence rules on the
2.4 GHz band.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: remove unnecessary assignment
Zhao, Gang [Sat, 26 Apr 2014 01:43:41 +0000 (09:43 +0800)]
mac80211: remove unnecessary assignment

P2P_DEVICE doesn't support ieee80211_bss_info_change_notify() for now,
so it's not needed to set changed flags for P2P_DEVICE.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: avoid calling useless channel context code
Zhao, Gang [Sat, 26 Apr 2014 01:43:40 +0000 (09:43 +0800)]
mac80211: avoid calling useless channel context code

ieee80211_assign_chanctx() checks if local->use_chanctx is true, so
the two code block related to ieee80211_assign_chanctx() can be moved
into above if clause, emphasize that these code are executed only if
local->use_chanctx is true.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
[change subject]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: Use 5MHz bandwidth by default when checking usable channels
Rostislav Lisovy [Tue, 15 Apr 2014 12:37:56 +0000 (14:37 +0200)]
cfg80211: Use 5MHz bandwidth by default when checking usable channels

Current code checks if the 20MHz bandwidth is allowed for
particular channel -- if it is not, the channel is disabled.
Since we need to use 5/10 MHz channels, this code is modified in
the way that the default bandwidth to check is 5MHz. If the
maximum bandwidth allowed by the channel is smaller than 5MHz,
the channel is disabled. Otherwise the channel is used and the
flags are set according to the bandwidth allowed by the channel.

Signed-off-by: Rostislav Lisovy <rostislav.lisovy@fel.cvut.cz>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: Add attributes describing prohibited channel bandwidth
Rostislav Lisovy [Tue, 15 Apr 2014 12:37:55 +0000 (14:37 +0200)]
cfg80211: Add attributes describing prohibited channel bandwidth

Since there are frequency bands (e.g. 5.9GHz) allowing channels
with only 10 or 5 MHz bandwidth, this patch adds attributes that
allow keeping track about this information.

When channel attributes are reported to user-space, make sure to
not break old tools, i.e. if the 'split wiphy dump' is enabled,
report the extra attributes (if present) describing the bandwidth
restrictions.  If the 'split wiphy dump' is not enabled,
completely omit those channels that have flags set to either
IEEE80211_CHAN_NO_10MHZ or IEEE80211_CHAN_NO_20MHZ.

Add the check for new bandwidth restriction flags in
cfg80211_chandef_usable() to comply with the restrictions.

Signed-off-by: Rostislav Lisovy <rostislav.lisovy@fel.cvut.cz>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: change return value of notifier function
Zhao, Gang [Mon, 21 Apr 2014 04:53:05 +0000 (12:53 +0800)]
mac80211: change return value of notifier function

Return NOTIFY_DONE if we don't care this time's notification, return
NOTIFY_OK if we successfully handled this time's notification. That's
the formal way to do it.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: change return value of notifier function
Zhao, Gang [Mon, 21 Apr 2014 04:53:04 +0000 (12:53 +0800)]
cfg80211: change return value of notifier function

Return NOTIFY_DONE if we don't care this time's notification, return
NOTIFY_OK if we successfully handled this time's notification. That's
the formal way to do it.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: change wiphy_to_dev function name
Zhao, Gang [Mon, 21 Apr 2014 04:53:03 +0000 (12:53 +0800)]
cfg80211: change wiphy_to_dev function name

Name wiphy_to_rdev is more accurate to describe what the function
does, i.e., return a pointer pointing to struct
cfg80211_registered_device.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: change registered device pointer name
Zhao, Gang [Mon, 21 Apr 2014 04:53:02 +0000 (12:53 +0800)]
cfg80211: change registered device pointer name

Name "dev" is too common and ambiguous, let all the pointer name
pointing to struct cfg80211_registered_device be "rdev". This can
improve code readability and consistency(since other places have
already called it rdev).

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: remove unnecessary BUG_ON()
Zhao, Gang [Mon, 21 Apr 2014 04:53:00 +0000 (12:53 +0800)]
mac80211: remove unnecessary BUG_ON()

The BUG_ON(!err) can't be triggered in the code path, so remove
it.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: return bool instead of numbers in yes/no function
Zhao, Gang [Mon, 21 Apr 2014 04:52:59 +0000 (12:52 +0800)]
mac80211: return bool instead of numbers in yes/no function

And some code style changes in the function, and correct a typo in
comment.

Signed-off-by: Zhao, Gang <gamerh2o@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: add option to generate CCMP IVs only for mgmt frames
Marek Kwaczynski [Mon, 14 Apr 2014 09:27:21 +0000 (11:27 +0200)]
mac80211: add option to generate CCMP IVs only for mgmt frames

Some chips can encrypt managment frames in HW, but
require generated IV in the frame. Add a key flag
that allows us to achieve this.

Signed-off-by: Marek Kwaczynski <marek.kwaczynski@tieto.com>
[use BIT(0) to fill that spot, fix indentation]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: compute chanctx refcount on-the-fly
Michal Kazior [Wed, 9 Apr 2014 13:29:33 +0000 (15:29 +0200)]
mac80211: compute chanctx refcount on-the-fly

It doesn't make much sense to store refcount in
the chanctx structure. One still needs to hold
chanctx_mtx to get the value safely. Besides,
refcount isn't on performance critical paths.

This will make implementing chanctx reservation
refcounting a little easier.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: fix racy usage of chanctx->refcount
Michal Kazior [Wed, 9 Apr 2014 13:29:32 +0000 (15:29 +0200)]
mac80211: fix racy usage of chanctx->refcount

Channel context refcount is protected by
chanctx_mtx. Accessing the value without holding
the mutex is racy. RCU section didn't guarantee
anything here.

Theoretically ieee80211_channel_switch() could
fail to see refcount change and read "1" instead
of, e.g. "2". This means mac80211 could accept CSA
even though it shouldn't have.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: split ieee80211_free_chanctx()
Michal Kazior [Wed, 9 Apr 2014 13:29:31 +0000 (15:29 +0200)]
mac80211: split ieee80211_free_chanctx()

The function did a little too much. Split it up so
the code can be easily reused in the future.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: split ieee80211_new_chanctx()
Michal Kazior [Wed, 9 Apr 2014 13:29:30 +0000 (15:29 +0200)]
mac80211: split ieee80211_new_chanctx()

The function did a little too much. Split it up so
the code can be easily reused in the future.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: improve chanctx reservation lookup
Michal Kazior [Wed, 9 Apr 2014 13:29:29 +0000 (15:29 +0200)]
mac80211: improve chanctx reservation lookup

Use a separate function to look for reservation
chanctx. For multi-interface/channel reservation
search sematics differ slightly.

The new routine allows reservations to be merged
with chanctx that are already reserved by other
interface(s).

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: improve find_chanctx() for reservations
Michal Kazior [Wed, 9 Apr 2014 13:29:28 +0000 (15:29 +0200)]
mac80211: improve find_chanctx() for reservations

This allows new vifs to be assigned to a chanctx
as long as chanctx's reservation chandefs (if any)
and chanctx's current chandef (implied by assigned
vifs at the time, if any) and the new vif chandef
are all compatible.

This implies it is impossible to assign a new vif
to an in-place reservation chanctx.

This gives no advantages for single-channel
hardware. It makes sense for multi-channel
hardware only.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: track reserved vifs in chanctx
Michal Kazior [Wed, 9 Apr 2014 13:29:27 +0000 (15:29 +0200)]
mac80211: track reserved vifs in chanctx

This can be useful. Provides a more straghtforward
way to iterate over interfaces taking part in
chanctx reservation and allows tracking chanctx
usage explicitly.

The structure is protected by local->chanctx_mtx.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: track assigned vifs in chanctx
Michal Kazior [Wed, 9 Apr 2014 13:29:26 +0000 (15:29 +0200)]
mac80211: track assigned vifs in chanctx

This can be useful. Provides a more straghtforward
way to iterate over interfaces bound to a given
chanctx and allows tracking chanctx usage
explicitly.

The structure is protected by local->chanctx_mtx.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: add support for radar detection for reservations
Michal Kazior [Wed, 9 Apr 2014 13:29:25 +0000 (15:29 +0200)]
mac80211: add support for radar detection for reservations

Initial chanctx reservation code wasn't aware of
radar detection requirements. This is necessary
for chanctx reservations to be used for channel
switching in the future.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: prevent chanctx overcommit
Michal Kazior [Wed, 9 Apr 2014 13:29:24 +0000 (15:29 +0200)]
mac80211: prevent chanctx overcommit

Do not allocate more channel contexts than a
driver is capable for currently matching interface
combination.

This allows the ieee80211_vif_reserve_chanctx() to
act as a guard against breaking interface
combinations.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: add max channel calculation utility function
Michal Kazior [Wed, 9 Apr 2014 13:29:23 +0000 (15:29 +0200)]
mac80211: add max channel calculation utility function

The utility function has no uses yet. It is aimed
at future chanctx reservation management and
channel switching.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: allow drivers to iterate over matching combinations
Michal Kazior [Wed, 9 Apr 2014 13:29:22 +0000 (15:29 +0200)]
cfg80211: allow drivers to iterate over matching combinations

The patch splits cfg80211_check_combinations()
into an iterator function and a simple iteration
user.

This makes it possible for drivers to asses how
many channels can use given iftype setup. This in
turn can be used for future
multi-interface/multi-channel channel switching.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: Fix GO Concurrent relaxation on UNII-3
Ilan Peer [Wed, 23 Apr 2014 06:22:58 +0000 (09:22 +0300)]
cfg80211: Fix GO Concurrent relaxation on UNII-3

At some locations, channels 149-165 are considered a single
bundle, while at some other locations, e.g., Indonesia, channels
149-161 are considered a single bundle, while channel 165 belongs
to a different bundle. This means that:

1. A station interface connection to an AP on channel 165 allows
   the instantiation of a P2P GO on channels 149-165.
2. A station interface connection to an AP on channels 149-161
   does NOT allow the instantiation of a P2P GO on channel 165.

Fix this.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agoRevert "mwifiex: add firmware dump feature for PCIe"
John W. Linville [Fri, 25 Apr 2014 01:33:55 +0000 (21:33 -0400)]
Revert "mwifiex: add firmware dump feature for PCIe"

This reverts commit e050c76fcf49599c5b98e4614392dc87c69123a6.

I'm not sure what crack pipe I was using when I merged this...

Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoBluetooth: Remove hci_h4 unused defines
Poulain, Loic [Tue, 1 Apr 2014 14:56:17 +0000 (14:56 +0000)]
Bluetooth: Remove hci_h4 unused defines

H4 states are not used anymore.

Signed-off-by: Loic Poulain <loic.poulain@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
10 years agoBluetooth: btmrvl: Fix btmrvl_send_module_cfg_cmd()
Petri Gynther [Tue, 15 Apr 2014 20:00:00 +0000 (13:00 -0700)]
Bluetooth: btmrvl: Fix btmrvl_send_module_cfg_cmd()

Change subcmd parameter from int to u8 to match its use:
btmrvl_send_sync_cmd(priv, BT_CMD_MODULE_CFG_REQ, &subcmd, 1);

Signed-off-by: Petri Gynther <pgynther@google.com>
Reviewed-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
10 years agoBluetooth: Return EOPNOTSUPP for HCISETRAW ioctl command
Marcel Holtmann [Thu, 17 Apr 2014 03:04:38 +0000 (20:04 -0700)]
Bluetooth: Return EOPNOTSUPP for HCISETRAW ioctl command

The HCISETRAW ioctl command is not really useful. To utilize raw and
direct access to the HCI controller, the HCI User Channel feature has
been introduced. Return EOPNOTSUPP to indicate missing support for
this command.

For legacy reasons hcidump used to use HCISETRAW for permission check
to return proper error codes to users. To keep backwards compability
return EPERM in case the caller does not have CAP_NET_ADMIN capability.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
10 years agob43: remove list of IEEE 802.11 devices
Rafał Miłecki [Mon, 21 Apr 2014 08:54:29 +0000 (10:54 +0200)]
b43: remove list of IEEE 802.11 devices

This is the first step to remove leftover code.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: ssb: refuse to support more than IEEE 802.11 core
Rafał Miłecki [Sun, 20 Apr 2014 18:30:58 +0000 (20:30 +0200)]
b43: ssb: refuse to support more than IEEE 802.11 core

Some ancient Broadcom devices had one core per band, e.g.:
ssb: Found chip with id 0x4306, rev 0x02 and package 0x00
ssb: Core 0 found: ChipCommon (cc 0x800, rev 0x02, vendor 0x4243)
ssb: Core 1 found: IEEE 802.11 (cc 0x812, rev 0x04, vendor 0x4243)
ssb: Core 2 found: PCMCIA (cc 0x80D, rev 0x01, vendor 0x4243)
ssb: Core 3 found: V90 (cc 0x807, rev 0x01, vendor 0x4243)
ssb: Core 4 found: PCI (cc 0x804, rev 0x07, vendor 0x4243)
ssb: Core 5 found: IEEE 802.11 (cc 0x812, rev 0x04, vendor 0x4243)

This hardware model was dropped for newer devices handled by b43.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: enable forgotten write of hw power adjust table
Rafał Miłecki [Sun, 20 Apr 2014 11:05:51 +0000 (13:05 +0200)]
b43: N-PHY: enable forgotten write of hw power adjust table

We've implemented table calculation, but forgot to enable writing it in
power setup function.
By the way document table layout.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: fix selection of init & calib values
Rafał Miłecki [Sun, 20 Apr 2014 11:05:50 +0000 (13:05 +0200)]
b43: N-PHY: fix selection of init & calib values

Logic in specs and our code was wrong. Init and calibration values for
newer cards depend on radio revision, not PHY revision.
To make code clearer, change tables names to include "radio" or "phy".

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: add init & calib values for radio 0x2056 rev 11
Rafał Miłecki [Sun, 20 Apr 2014 11:05:49 +0000 (13:05 +0200)]
b43: N-PHY: add init & calib values for radio 0x2056 rev 11

They were extracted from MMIO dumps of 14e4:4353 and wl 6.30.223.141.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: prepare for rev 7+ RSSI calibration
Rafał Miłecki [Sun, 20 Apr 2014 11:05:48 +0000 (13:05 +0200)]
b43: N-PHY: prepare for rev 7+ RSSI calibration

Mostly just add place for future code

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: implement RF control INTC for revs 7+
Rafał Miłecki [Sun, 20 Apr 2014 11:05:47 +0000 (13:05 +0200)]
b43: N-PHY: implement RF control INTC for revs 7+

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: implement reading support for radio 0x2057
Rafał Miłecki [Sun, 20 Apr 2014 11:05:46 +0000 (13:05 +0200)]
b43: N-PHY: implement reading support for radio 0x2057

Bit 0x200 has been noticed in the following log:
 radio_read(0x02ca) -> 0x0000
radio_write(0x00ca) <- 0x0080

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: random updates and typo fixes all around
Rafał Miłecki [Sun, 20 Apr 2014 11:05:45 +0000 (13:05 +0200)]
b43: N-PHY: random updates and typo fixes all around

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: rev3+: complete workarounds
Rafał Miłecki [Sun, 20 Apr 2014 11:05:44 +0000 (13:05 +0200)]
b43: N-PHY: rev3+: complete workarounds

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: N-PHY: drop second noise variance table
Rafał Miłecki [Sun, 20 Apr 2014 11:05:43 +0000 (13:05 +0200)]
b43: N-PHY: drop second noise variance table

New Broadcom drivers don't upload it anymore. It was probably a copy & paste
mistake in early N-PHY rev 3+ days.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agob43: G-PHY: fix random mistakes to match specs
Rafał Miłecki [Sat, 19 Apr 2014 21:10:05 +0000 (23:10 +0200)]
b43: G-PHY: fix random mistakes to match specs

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: enable aggregation for TID 6 and 7 streams
Amitkumar Karwar [Thu, 17 Apr 2014 18:47:03 +0000 (11:47 -0700)]
mwifiex: enable aggregation for TID 6 and 7 streams

Currently AMSDU and AMPDU aggregation is enabled for TID 0 to
TID 5 streams. Lets enable it for remaining two streams also.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: increase tx/rx AMPDU window sizes for STA 11ac mode
Amitkumar Karwar [Thu, 17 Apr 2014 18:47:02 +0000 (11:47 -0700)]
mwifiex: increase tx/rx AMPDU window sizes for STA 11ac mode

This will help to aggregate more packets which yields better
throughput results for 11ac chipsets.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: increase tx/rx AMPDU window sizes for STA 11n mode
Amitkumar Karwar [Thu, 17 Apr 2014 18:47:01 +0000 (11:47 -0700)]
mwifiex: increase tx/rx AMPDU window sizes for STA 11n mode

This will help to aggregate more packets which yields better
throughput results.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: add firmware dump feature for PCIe
Amitkumar Karwar [Thu, 17 Apr 2014 18:47:00 +0000 (11:47 -0700)]
mwifiex: add firmware dump feature for PCIe

Firmware dump feature is added for PCIe based chipsets.
Separate file will be created at /var/log/fw_dump_*
for each memory segment.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: add fw_dump debugfs file
Amitkumar Karwar [Thu, 17 Apr 2014 18:46:59 +0000 (11:46 -0700)]
mwifiex: add fw_dump debugfs file

This option be useful to dump firmware memory for debugging
purpose. Actual code to dump firmware momory for SDIO and PCIe
chipsets will be added later.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agort2x00: restore original beaconing state
Stanislaw Gruszka [Thu, 17 Apr 2014 09:08:48 +0000 (11:08 +0200)]
rt2x00: restore original beaconing state

After changing local per interface beacon setting restore original
global beaconing state.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: don't clear cmd_sent flag in timeout handler
Amitkumar Karwar [Thu, 17 Apr 2014 05:01:54 +0000 (22:01 -0700)]
mwifiex: don't clear cmd_sent flag in timeout handler

When command timeout occurs due to a firmware/hardware bug,
there is no chance of next command being successful. We will
keep cmd_sent flag on so that next command won't be sent to
firmware.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: fix IE parsing issues
Amitkumar Karwar [Thu, 17 Apr 2014 05:01:53 +0000 (22:01 -0700)]
mwifiex: fix IE parsing issues

IE's are parsed from beacon buffer and stored locally using
mwifiex_update_bss_desc_with_ie() function.
Sometimes the local pointers point to the data inside IE, but
while using them it is assumed that they are pointing to the IE
itself.

These issues are fixed in this patch.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: remove redundant 'fw_load' completion structure
Amitkumar Karwar [Mon, 14 Apr 2014 22:32:55 +0000 (15:32 -0700)]
mwifiex: remove redundant 'fw_load' completion structure

'add_remove_card_sem' semaphore already takes care of
synchronization for driver load and unload threads.
Hence there won't be a case when unload thread is waiting on
'wait_for_completion(fw_load)'.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: use USB core's soft_unbind option
Amitkumar Karwar [Mon, 14 Apr 2014 22:32:54 +0000 (15:32 -0700)]
mwifiex: use USB core's soft_unbind option

This option allows driver to finish pending operations in
disconnect handler by not killing URBs after usb_deregister
call.

We will get rid of global pointer 'usb_card' by moving code
from cleanup_module() to disconnect(). This will help to match
with our handling for SDIO and PCIe interfaces.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: update timestamp information for aggregation packets
Avinash Patil [Mon, 14 Apr 2014 22:32:53 +0000 (15:32 -0700)]
mwifiex: update timestamp information for aggregation packets

New skbs are allocated at the time of AMSDU aggregation. Setting
up in timestamps for such skbs was missing which would result
into wrong queue delays passed to FW. Fix this by setting
timestamp of skbs created for AMSDU aggregation.

Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: increase the number of nodes in command pool
Amitkumar Karwar [Mon, 14 Apr 2014 22:32:52 +0000 (15:32 -0700)]
mwifiex: increase the number of nodes in command pool

Command nodes are increased from 20 to 50. Now we can always
scan 1 channel per scan command to avoid traffic delay/loss in
connected state. We will get rid of *CHANNEL_PER_SCAN_CMD macros
used due to command node constraints.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: improve AMSDU packet aggregation for PCIe and SDIO
Amitkumar Karwar [Mon, 14 Apr 2014 22:32:51 +0000 (15:32 -0700)]
mwifiex: improve AMSDU packet aggregation for PCIe and SDIO

For PCIe, aggregate more AMSDU packets till PCIe TXBD is full.

For SDIO, aggregation was disabled for AMSDU packets because
AMSDU aggregated packet size is already 4K or 8K, SDIO Multiport
Aggregation feature didn't use to gain much previously.
Now with increased multiport aggregation buffer, we can enable
it for AMSDU packets.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: increase SDIO multiport aggregation buffer sizes
Amitkumar Karwar [Mon, 14 Apr 2014 22:32:50 +0000 (15:32 -0700)]
mwifiex: increase SDIO multiport aggregation buffer sizes

Currently Tx and Rx buffer sizes are 8K and 16K respectively for
all chipsets. We will change them to 32K for SD8897 and 16K for
older chipsets. SD8897 chipset has more SDIO data ports than
older chipsets.
This patch will help to improve throughput numbers.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agomwifiex: change memset to simple assignment for ht_cap.mcs.rx_mask
Maithili Hinge [Mon, 14 Apr 2014 22:32:49 +0000 (15:32 -0700)]
mwifiex: change memset to simple assignment for ht_cap.mcs.rx_mask

WARNING: single byte memset is suspicious.
         Swapped 2nd/3rd argument?

This code happens to work because rx_mcs is the first variable
in mcs structure. We should use 'mcs.rx_mcs' here anyway.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Maithili Hinge <maithili@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agowil6210: Use larger Tx rings
Vladimir Kondratiev [Tue, 8 Apr 2014 08:36:19 +0000 (11:36 +0300)]
wil6210: Use larger Tx rings

When using scatter-gather, more descriptor entries get used.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agowil6210: relaxed check for BACK start sequence
Vladimir Kondratiev [Tue, 8 Apr 2014 08:36:18 +0000 (11:36 +0300)]
wil6210: relaxed check for BACK start sequence

Sometimes, due to the race between Rx path and WMI_BA_STATUS_EVENTID WMI event,
few frames may be passed to the stack before reorder buffer allocated.
Then, after BACK establishment, it start getting frames with sequence number ahead of
SSN, and it get interpreted as missing frames. Then, BACK mechanism will wait
for missing frames; data traffic will be stopped. In case of interface configured
for DHCP, this data delay causes DHCP failure.

Relax checking for sequence number; use sequence of 1-st frame handled by the buffer
as SSN for this buffer.

This is work-around, real fix should be done when proper BACK mechanism implemented.

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agowil6210: sync with the latest FW API
Vladimir Kondratiev [Tue, 8 Apr 2014 08:36:17 +0000 (11:36 +0300)]
wil6210: sync with the latest FW API

- add pcp_max_assoc_sta to the struct wmi_pcp_start_cmd
- enum for the scan ststus

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agowil6210: fix printouts for better readability
Vladimir Kondratiev [Tue, 8 Apr 2014 08:36:16 +0000 (11:36 +0300)]
wil6210: fix printouts for better readability

Reshuffle prints to consolidate firmware/hardware information
report upon card init

Convert print for unhandled MISC ISR bits to "debug" - it is
normal situation and not an "error"

Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoath9k: implement p2p client powersave support
Felix Fietkau [Sat, 5 Apr 2014 22:37:03 +0000 (00:37 +0200)]
ath9k: implement p2p client powersave support

Use generic TSF timers to trigger powersave state changes based
information from the P2P NoA attribute.
Opportunistic Powersave is not handled, because the driver does not
support powersave at the moment.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoath9k: support only one P2P interface
Felix Fietkau [Sat, 5 Apr 2014 22:37:02 +0000 (00:37 +0200)]
ath9k: support only one P2P interface

Preparation for adding P2P powersave and multi-channel support.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoray_cs: replace del_timer by del_timer_sync
Julia Lawall [Tue, 1 Apr 2014 13:49:18 +0000 (15:49 +0200)]
ray_cs: replace del_timer by del_timer_sync

Use del_timer_sync to ensure that the timer is stopped on all CPUs before
the driver exits.

This change was suggested by Thomas Gleixner.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@r@
identifier i,t,ex;
@@
struct t i = { .remove = ex, };

@@
identifier r.ex;
@@
ex(...) {
  <...
- del_timer
+ del_timer_sync
    (...)
  ...>
}
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agortl8180: be paranoid in stopping unused queues.
Andrea Merello [Fri, 4 Apr 2014 16:25:51 +0000 (18:25 +0200)]
rtl8180: be paranoid in stopping unused queues.

HW should never attempt to perform DMA for unused queues.
For rtl8187se this is ensured by setting a dedicated register at
init time, before enabling TX.

In rtl8180/5 the register is only written at the first TX (because
in rtl8180/5 it serves also to kick DMA for used queues).
This should be enough, but it's worth to add a register write at
init time, before enabling TX.

Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agortl8180: add parentheses to REG_ADDR macros
Andrea Merello [Fri, 4 Apr 2014 16:24:36 +0000 (18:24 +0200)]
rtl8180: add parentheses to REG_ADDR macros

Parentheses are missing around the macro argument, causing the
macro possibly not to work passing certain expressions as
arguments.

This should not cause any issues with current code, however it's
worth to add them, as a good practice, and to eventually avoid
future bugs.

Suggested-by: Dave Kilroy <kilroyd@googlemail.com>
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agortl8180: fix enabled interrupt mask for rtl8187se
Andrea Merello [Fri, 4 Apr 2014 16:21:14 +0000 (18:21 +0200)]
rtl8180: fix enabled interrupt mask for rtl8187se

When preparing the bitfield to write to HW register, the high-priority
queue error interrupt bit is set two times, and the beacon queue
TX-OK interrupt is not enabled.

Currently this have no functional impact because the high-priority
queue is not used at all, and the beacon queue is not used yet.

This patch removes high-priority queue bits and it adds the
beacon queue missing bit.
It removes also the management queue bits because it is not used.

This was found by static code analyzer.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agortl8180: change module name in rtl818x_pci
Larry Finger [ original patch ] [Tue, 8 Apr 2014 18:25:25 +0000 (20:25 +0200)]
rtl8180: change module name in rtl818x_pci

rtl8180 driver can handle also rtl8185 and rtl8187SE cards,
however in userspace tools (network manager) it still appares
as "rtl8180".
This might lead the user to think the wrong driver is in use.

This patch changes module name to "rtl818x_pci" that should be
more explanatory.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> [ original patch ]
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
10 years agoMerge branch 'for-linville' of git://github.com/kvalo/ath
John W. Linville [Tue, 22 Apr 2014 19:02:03 +0000 (15:02 -0400)]
Merge branch 'for-linville' of git://github.com/kvalo/ath

10 years agoMerge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwif...
John W. Linville [Tue, 22 Apr 2014 19:01:24 +0000 (15:01 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/iwlwifi/iwlwifi-next

10 years agomac80211: mesh: always use the latest target_sn
Bob Copeland [Tue, 15 Apr 2014 14:43:08 +0000 (10:43 -0400)]
mac80211: mesh: always use the latest target_sn

When a path target responds to a path request, its response
always contains the most up-to-date information; accordingly,
it should use the latest target_sn, regardless of
net_traversal_jiffies().  Otherwise, only the first path
response is considered when constructing a path, as it will
have the highest target_sn of all replies during that period.

Signed-off-by: Bob Copeland <bob@cozybit.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: fix mesh_add_rsn_ie IE finding loop
Bob Copeland [Tue, 15 Apr 2014 14:43:07 +0000 (10:43 -0400)]
mac80211: fix mesh_add_rsn_ie IE finding loop

Previously, the code to copy the RSN IE from the mesh config
would increment its pointer by one in the loop instead of by
the element length, so there was the potential for mistaking
another IE's data fields as the RSN IE.

cfg80211_find_ie() exists, so just use that.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: mesh: use u16 return type for u16 getter
Bob Copeland [Tue, 15 Apr 2014 14:43:06 +0000 (10:43 -0400)]
mac80211: mesh: use u16 return type for u16 getter

u16_field_get() is a simple wrapper around get_unaligned_le16(),
and it is being assigned to a u16, so there's no need to
promote to u32 in the middle.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agomac80211: Allow HT capa override to add 40 MHz intolerant
Jouni Malinen [Tue, 15 Apr 2014 16:13:56 +0000 (19:13 +0300)]
mac80211: Allow HT capa override to add 40 MHz intolerant

This can be useful for testing purposes to confirm valid AP behavior on
HT 20/40 co-existence functionality.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: fix processing world regdomain when non modular
Luis R. Rodriguez [Tue, 22 Apr 2014 03:39:35 +0000 (20:39 -0700)]
cfg80211: fix processing world regdomain when non modular

This allows processing of the last regulatory request when
we determine its still pending. Without this if a regulatory
request failed to get processed by userspace we wouldn't
be able to re-process it later. An example situation that can
lead to an unprocessed last_request is enabling cfg80211 to
be built-in to the kernel, not enabling CFG80211_INTERNAL_REGDB
and the CRDA binary not being available at the time the udev
rule that kicks of CRDA triggers.

In such a situation we want to let some cfg80211 triggers
eventually kick CRDA for us again. Without this if the first
cycle attempt to kick off CRDA failed we'd be stuck without
the ability to change process any further regulatory domains.

cfg80211 will trigger re-processing of the regulatory queue
whenever schedule_work(&reg_work) is called, currently this
happens when:

  * suspend / resume
  * disconnect
  * a beacon hint gets triggered (non DFS 5 GHz AP found)
  * a regulatory request gets added to the queue

We don't have any specific opportunistic late boot triggers
to address a late mount of where CRDA resides though, adding
that should be done separately through another patch.
Without an opportunistic fix then this fix relies at least
one of the triggeres above to happen.

Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agocfg80211: avoid freeing last_request while in flight
Arik Nemtsov [Tue, 22 Apr 2014 03:39:34 +0000 (20:39 -0700)]
cfg80211: avoid freeing last_request while in flight

Avoid freeing the last request while it is being processed. This can
happen in some cases if reg_work is kicked for some reason while the
currently pending request is in flight.

Cc: Sander Eikelenboom <linux@eikelenboom.it>
Tested-by: Eliad Peller <eliad@wizery.com>
Tested-by: Colleen Twitty <colleen@cozybit.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 years agoMerge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
John W. Linville [Thu, 17 Apr 2014 14:34:22 +0000 (10:34 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem

10 years agoseccomp: fix memory leak on filter attach
Kees Cook [Wed, 16 Apr 2014 17:54:34 +0000 (10:54 -0700)]
seccomp: fix memory leak on filter attach

This sets the correct error code when final filter memory is unavailable,
and frees the raw filter no matter what.

unreferenced object 0xffff8800d6ea4000 (size 512):
  comm "sshd", pid 278, jiffies 4294898315 (age 46.653s)
  hex dump (first 32 bytes):
    21 00 00 00 04 00 00 00 15 00 01 00 3e 00 00 c0  !...........>...
    06 00 00 00 00 00 00 00 21 00 00 00 00 00 00 00  ........!.......
  backtrace:
    [<ffffffff8151414e>] kmemleak_alloc+0x4e/0xb0
    [<ffffffff811a3a40>] __kmalloc+0x280/0x320
    [<ffffffff8110842e>] prctl_set_seccomp+0x11e/0x3b0
    [<ffffffff8107bb6b>] SyS_prctl+0x3bb/0x4a0
    [<ffffffff8152ef2d>] system_call_fastpath+0x1a/0x1f
    [<ffffffffffffffff>] 0xffffffffffffffff

Reported-by: Masami Ichikawa <masami256@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Masami Ichikawa <masami256@gmail.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoisdn: icn: buffer overflow in icn_command()
Dan Carpenter [Wed, 16 Apr 2014 11:25:16 +0000 (14:25 +0300)]
isdn: icn: buffer overflow in icn_command()

This buffer over was detected using static analysis:

drivers/isdn/icn/icn.c:1325 icn_command()
error: format string overflow. buf_size: 60 length: 98

The calculation for the length of the string is off because it assumes
that the dial[] buffer holds a 50 character string, but actually it is
at most 31 characters and NUL.  I have removed the dial[] buffer because
it isn't needed.

The maximum length of the string is actually 79 characters and a NUL.  I
have made the cbuf[] array large enough to hold it and changed the
sprintf() to an snprintf() as a further safety enhancement.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoip6_tunnel: use the right netns in ioctl handler
Nicolas Dichtel [Wed, 16 Apr 2014 09:19:34 +0000 (11:19 +0200)]
ip6_tunnel: use the right netns in ioctl handler

Because the netdevice may be in another netns than the i/o netns, we should
use the i/o netns instead of dev_net(dev).

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agosit: use the right netns in ioctl handler
Nicolas Dichtel [Wed, 16 Apr 2014 09:19:33 +0000 (11:19 +0200)]
sit: use the right netns in ioctl handler

Because the netdevice may be in another netns than the i/o netns, we should
use the i/o netns instead of dev_net(dev).

Note that netdev_priv(dev) cannot bu NULL, hence we can remove these useless
checks.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoip_tunnel: use the right netns in ioctl handler
Nicolas Dichtel [Wed, 16 Apr 2014 09:19:32 +0000 (11:19 +0200)]
ip_tunnel: use the right netns in ioctl handler

Because the netdevice may be in another netns than the i/o netns, we should
use the i/o netns instead of dev_net(dev).

The variable 'tunnel' was used only to get 'itn', hence to simplify code I
remove it and use 't' instead.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agonet: use SYSCALL_DEFINEx for sys_recv
Jan Glauber [Wed, 16 Apr 2014 07:32:48 +0000 (09:32 +0200)]
net: use SYSCALL_DEFINEx for sys_recv

Make sys_recv a first class citizen by using the SYSCALL_DEFINEx
macro. Besides being cleaner this will also generate meta data
for the system call so tracing tools like ftrace or LTTng can
resolve this system call.

Signed-off-by: Jan Glauber <jan.glauber@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoMerge branch 'mdio-gpio'
David S. Miller [Wed, 16 Apr 2014 19:10:00 +0000 (15:10 -0400)]
Merge branch 'mdio-gpio'

Guenter Roeck says:

====================
net: mdio-gpio enhancements

The following series of patches adds support for active-low gpio pins
as well as for systems with separate MDI and MDO pins to the mdio-gpio
driver.

A board using those features is based on a COM Express CPU board.
The COM Express standard supports GPIO pins on its connector,
with one caveat: The pins on the connector have fixed direction
and are hard configured either as input or output pins.
The COM Express Design Guide [1] provides additional details.

The hardware uses three of the GPO/GPI pins from the COM Express board
to drive an MDIO bus. Connectivity between GPI/GPO pins and the MDIO bus
is as follows.

GPI2 --------------------+------------ MDIO
                         |
            +--------+   |
GPO2 ---+---G        |   |
        |   |        |   |
       4.7k | 2N7002 D---+
|   |        |
+---S        |
|   +--------+
       GND

GPO1 --------------------------------- MDC

To support this hardware, two extensions to the driver were necessary.

- Due to the FET in the MDO path (GPO2), the MDO signal is inverted.
  The driver therefore has to support active-low GPIO pins.

- The MDIO signal must be separated into MDI and MDO.

Those changes are implemented in patch 2/3 and 3/3.
Patch 1/3 simplifies the error path and thus the subsequent
patches.

[1] http://www.picmg.org/pdf/picmg_comdg_100.pdf
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agonet: mdio-gpio: Add support for separate MDI and MDO gpio pins
Guenter Roeck [Wed, 16 Apr 2014 02:16:42 +0000 (19:16 -0700)]
net: mdio-gpio: Add support for separate MDI and MDO gpio pins

This is for a system with fixed assignments of input and output pins
(various variants of Kontron COMe).

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agonet: mdio-gpio: Add support for active low gpio pins
Guenter Roeck [Wed, 16 Apr 2014 02:16:41 +0000 (19:16 -0700)]
net: mdio-gpio: Add support for active low gpio pins

Some systems using mdio-gpio may use active-low gpio pins
(eg with inverters or FETs connected to all or some of the
gpio pins).

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agonet: mdio-gpio: Use devm_ functions where possible
Guenter Roeck [Wed, 16 Apr 2014 02:16:40 +0000 (19:16 -0700)]
net: mdio-gpio: Use devm_ functions where possible

This simplifies error path and deinit/removal functions.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Chris Healy <cphealy@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoMerge branch 'fib_validate_loopback'
David S. Miller [Wed, 16 Apr 2014 19:05:39 +0000 (15:05 -0400)]
Merge branch 'fib_validate_loopback'

Cong Wang says:

====================
ipv4: fix flowi4_iif for input routing

This patchset fixes ->flowi4_iif for input routing and rp filter,
based on suggestion from Julian. See per patch for details.

v1 -> v2:
* merge the first two patches into one
* fix fib_check_nh() too
* add this cover letter
====================

Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Reviewed-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoipv4, route: pass 0 instead of LOOPBACK_IFINDEX to fib_validate_source()
Cong Wang [Tue, 15 Apr 2014 23:25:35 +0000 (16:25 -0700)]
ipv4, route: pass 0 instead of LOOPBACK_IFINDEX to fib_validate_source()

In my special case, when a packet is redirected from veth0 to lo,
its skb->dev->ifindex would be LOOPBACK_IFINDEX. Meanwhile we
pass the hard-coded LOOPBACK_IFINDEX to fib_validate_source()
in ip_route_input_slow(). This would cause the following check
in fib_validate_source() fail:

            (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))

when rp_filter is disabeld on loopback. As suggested by Julian,
the caller should pass 0 here so that we will not end up by
calling __fib_validate_source().

Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Julian Anastasov <ja@ssi.bg>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif
Cong Wang [Tue, 15 Apr 2014 23:25:34 +0000 (16:25 -0700)]
ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif

As suggested by Julian:

Simply, flowi4_iif must not contain 0, it does not
look logical to ignore all ip rules with specified iif.

because in fib_rule_match() we do:

        if (rule->iifindex && (rule->iifindex != fl->flowi_iif))
                goto out;

flowi4_iif should be LOOPBACK_IFINDEX by default.

We need to move LOOPBACK_IFINDEX to include/net/flow.h:

1) It is mostly used by flowi_iif

2) Fix the following compile error if we use it in flow.h
by the patches latter:

In file included from include/linux/netfilter.h:277:0,
                 from include/net/netns/netfilter.h:5,
                 from include/net/net_namespace.h:21,
                 from include/linux/netdevice.h:43,
                 from include/linux/icmpv6.h:12,
                 from include/linux/ipv6.h:61,
                 from include/net/ipv6.h:16,
                 from include/linux/sunrpc/clnt.h:27,
                 from include/linux/nfs_fs.h:30,
                 from init/do_mounts.c:32:
include/net/flow.h: In function ‘flowi4_init_output’:
include/net/flow.h:84:32: error: ‘LOOPBACK_IFINDEX’ undeclared (first use in this function)

Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Julian Anastasov <ja@ssi.bg>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agomlx4_en: don't use napi_synchronize inside mlx4_en_netpoll
Chris Mason [Tue, 15 Apr 2014 22:09:24 +0000 (18:09 -0400)]
mlx4_en: don't use napi_synchronize inside mlx4_en_netpoll

The mlx4 driver is triggering schedules while atomic inside
mlx4_en_netpoll:

spin_lock_irqsave(&cq->lock, flags);
napi_synchronize(&cq->napi);
^^^^^ msleep here
mlx4_en_process_rx_cq(dev, cq, 0);
spin_unlock_irqrestore(&cq->lock, flags);

This was part of a patch by Alexander Guller from Mellanox in 2011,
but it still isn't upstream.

Signed-off-by: Chris Mason <clm@fb.com>
cc: stable@vger.kernel.org
Acked-By: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
10 years agoMerge branch 'mvneta_qsgmii'
David S. Miller [Wed, 16 Apr 2014 18:37:13 +0000 (14:37 -0400)]
Merge branch 'mvneta_qsgmii'

Thomas Petazzoni says:

====================
net: mvneta: fix usage as a module, and support QSGMII properly

This set of patches is a new attempt at fixing the operation of the
mvneta driver when built as a module. For the record, the previous
attempt, merged in commit e3a8786c10e75903f1269474e21fe8cb49c3a670
('net: mvneta: fix usage as a module on RGMII configurations') caused
problems for all RGMII configurations.

In fact, it turned out that the MAC to PHY connection on the Armada XP
GP, which was described as using RGMII-ID according to its Device
Tree, is in fact a QSGMII connection. And the RGMII and QSGMII
configurations have to be handled in a different way in the driver,
because the SERDES configuration is different in those two cases.

So, this patch series fixes that by:

 * Adding minimal handling of a "qsgmii" connection type in the PHY
   layer. Mainly to make sure that a "qsgmii" phy-mode in the Device
   Tree is recognized, and handed over to the driver as
   PHY_INTERFACE_QSGMII.

 * Changing the mvneta driver to properly configure the RGMIIEn and
   PCSEn bits in the GMAC_CTRL_2 register, and configure the SERDES
   register, in the three possible cases: RGMII, SGMII and QSGMII.

 * Updating the Device Tree of the Armada XP GP board to reflect the
   fact that it uses a QSGMII MAC/PHY connection.

PATCH 1 and 2 would be merged by David Miller, through the net tree,
while PATCH 3 would be merged by the mach-mvebu maintainers, through
their tree and arm-soc.

This set of patches has been tested on:

 * Armada XP GP (four QSGMII interfaces)
 * Armada XP DB (two RGMII interfaces and two SGMII interfaces)
 * Armada 370 Mirabox (two RGMII interfaces)

I've tested both the driver built-in, and compiled as a module.

Since the last attempt at fixing this was quite a fiasco, I'd like
this new attempt to be tested more widely before being applied. I'll
try to do some testing on other Armada boards I have, but independent
testing from other persons would also be appreciated.

Note that these patches apply after reverting the previous attempt,
obviously.
====================

Tested-by: Arnaud Ebalard <arno@natisbad.org>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>