This is a semi-automated conversion to change rt2x00_eeprom_read()
to return the register contents instead of passing them by value,
resulting in much better object code. The majority of the patch
was done using:

sed -i 's:\(\<rt2x00_eeprom_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \
   -i 's:= _\(rt2x00_eeprom_read\):= \1:' drivers/net/wireless/ralink/rt2x00/*
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is a semi-automated conversion to change *_bbp_read()
to return the register contents instead of passing them by value,
resulting in much better object code. The majority of the patch
was done using:

sed -i 's:\(\<rt.*_bbp_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \
    -i 's:\(\<rt.*_bbp_dcoc_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \
    -i 's:= _\(rt.*_bbp_read\):\1:' drivers/net/wireless/ralink/rt2x00/*
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is a semi-automated conversion to change rt2800_register_read
to return the register contents instead of passing them by value,
resulting in much better object code. The majority of the patch
was done using:

sed -i 's:\(rt2800_register_read(.*, .*\), &\(.*\));:\2 = \1);:' \
       's:\(rt2800_register_read_lock(.*, .*\), &\(.*\));:\2 = \1);:' \
	drivers/net/wireless/ralink/rt2x00/rt2800lib.c

The function itself was modified manually along with the one remaining
multi-line caller that was not covered automatically and the indirect
reference.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is a semi-automated conversion to change rt2x00usb_register_read
to return the register contents instead of passing them by value,
resulting in much better object code. The majority of the patch
was done using:

sed -i 's:\(\<rt2x00usb_register_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \
    -i 's:\(\<rt2500usb_register_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \
    -i 's:\(\<rt2500usb_register_read_lock\>(.*, .*\), &\(.*\));:\2 = \1);:' \
	 drivers/net/wireless/ralink/rt2x00/*
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is a semi-automated conversion to change rt2x00mmio_register_read
to return the register contents instead of passing them by value,
resulting in much better object code. The majority of the patch
was done using:

sed -i 's:\(rt2x00mmio_register_read(.*, .*\), &\(.*\));:\2 = \1);:' \
    -i 's:_rt2x00mmio_register_read:rt2x00mmio_register_read:' \
	drivers/net/wireless/ralink/rt2x00/*.c

The function itself was modified manually along with the one remaining
caller that was not covered automatically.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This is a semi-automated conversion to change rt2x00_rf_read()
to return the register contents instead of passing them by value,
resulting in much better object code. The majority of the patch
was done using:

sed -i 's:\(\<rt2x00_rf_read\>(.*, .*\), &\(.*\));:\2 = \1);:' \
	drivers/net/wireless/ralink/rt2x00/rt*
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

With CONFIG_KASAN enabled and gcc-7, we get a warning about rather high
stack usage (with a private patch set I have to turn on this warning,
which I intend to get into the next kernel release):

wireless/ralink/rt2x00/rt2800lib.c: In function 'rt2800_bw_filter_calibration':
wireless/ralink/rt2x00/rt2800lib.c:7990:1: error: the frame size of 2144 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]

The problem is that KASAN inserts a redzone around each local variable
that gets passed by reference, and the newly added function has a lot
of them.

This is a semi-automated conversion to change rt2800_rfcsr_read to return
the register contents instead of passing them by value, resulting in
much better object code. The majority of the patch was done using:

sed -i 's:\(rt2800_rfcsr_read(.*, .*\), &\(.*\));:\2 = \1);:' \
    -i 's:\(rt2800_rfcsr_read_bank(.*, .*\), &\(.*\));:\2 = \1);:' \
        drivers/net/wireless/ralink/rt2x00/rt2800lib.c

Fixes: 41977e86 ("rt2x00: add support for MT7620")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

This prepares the driver for changing all the 'read' register accessors
to return the value instead of passing it by reference. Since a lot
of them are used in callbacks, this takes care of the callbacks first,
adding a couple of helpers that will be removed again one at a time.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In at least one place, the enter/exit debugging was not being correctly
matched. Based on mailing list feedback, it was desired to drop all of
these in favor of using ftrace instead.
Suggested-by: NJoe Perches <joe@perches.com>
Suggested-by: NKalle Valo <kvalo@codeaurora.org>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Using memcpy() from a string that is shorter than the length copied means
the destination buffer is being filled with arbitrary data from the kernel
rodata segment. Instead, redefine the stat strings to be ETH_GSTRING_LEN
sizes, like other drivers. This lets us use a single memcpy that does not
leak rodata contents. Additionally adjust indentation to keep checkpatch.pl
happy.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

iwlegacy firmware can crash when power save is configured. PS was
allowed in "dbdac2b5 iwlegacy: properly enable power saving" with belive
that user who enable PS is aware of that and can relate firmware crahes
with PS. However some distributions seems to enable PS without user
intervention, so warn about that.
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In the stable linux-3.16 branch, I ran into a warning in the
wlcore driver:

drivers/net/wireless/ti/wlcore/spi.c: In function 'wl12xx_spi_raw_write':
drivers/net/wireless/ti/wlcore/spi.c:315:1: error: the frame size of 12848 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]

Newer kernels no longer show the warning, but the bug is still there,
as the allocation is based on the CPU page size rather than the
actual capabilities of the hardware.

This replaces the PAGE_SIZE macro with the SZ_4K macro, i.e. 4096 bytes
per buffer.

Cc: stable@vger.kernel.org
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Use time_after kernel macro for time comparison.
Signed-off-by: NKarim Eshapa <karim.eshapa@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The older firmware loading method is not usable by any Redpine chipset.
Hence removing that part of the code. Older firmware image with
rsi_91x.fw name is deprecated
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The older firmware loading method has been deprecated and not in use
for any chipets. New method is introduced which works based on soft
boot loader. In this method, complete RAM image and FLASH image are
present in the flash. Before loading the functional firmware, host
issues boot loader commands to verify whether firmware to load is
different from the current functional firmware. If not, firmware
upgrade progresses and boot loader will switch to the new functional
firmware.

"rs9113_wlan_qspi.rps" is the firmware filename used in this patch.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Host interface opearation master_reg_read, master_reg_write and
load_data_master_write are added. These functions are needed for the
new firmware loading method. As part of this, the function
master_access_msword is moved from rsi_91x_sdio_ops.c to rsi_91x_sdio.c.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Host interface operations are currently function pointers in rsi_hw
structure. As more host interface operations are going to be introduced,
separate structure is added for these for convenience.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

USB multibyte read will be used in the new firmware loading method
for RS9113 chipset.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

In function usb_write_register_multiple, if any intermediate block transfer
is failed, further operations should be terminated. 'else' is removed, as
there is no significance for it after return.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

For USB vendor read and write operations new macros added to avoid
redundant usage of long or'ed macros. Also for timeouts standard USB
macros are used.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

USB read and write registers maximum size is limited 2^16. More than
this size is not used in the driver.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

RSI_USB_BUF_SIZE macro is used instead of hardcoding a buffer
size to 4096.
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

SDIO read or write maximum size is limited to 2^16. This is done to make
the host interface operations common for SDIO and USB.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

The file rsi_91x_hal.c is going to contain device specific code i.e new
firmware loading method for RS9113 chipset. As the file rsi_91x_pkt.c
contains code to prepare device specific descriptors for transmit packet,
this file is renamed to rsi_91x_hal.c which is more relevant as per it's
functionality.
Signed-off-by: NPrameela Rani Garnepudi <prameela.j04cs@gmail.com>
Signed-off-by: NAmitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

We have the number of longs, but we should be calculating the number of
bytes needed.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Using memcpy() from a buffer that is shorter than the length copied means
the destination buffer is being filled with arbitrary data from the kernel
rodata segment. In this case, the source was made longer, since it did not
match the destination structure size. Additionally removes a needless cast.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: NElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: NHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NDavid Windsor <dwindsor@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: NElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: NHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NDavid Windsor <dwindsor@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Upon stopping an AP interface the driver disable INFRA mode effectively
setting the interface in IBSS mode. However, this may affect other
interfaces running in INFRA mode. For instance, if user creates and stops
hostap daemon on virtual interface, then association cannot work on
primary interface because default BSS has been set to IBSS mode in
firmware side. The IBSS mode should be set when cfg80211 changes the
interface.
Reviewed-by: NWright Feng <wright.feng@cypress.com>
Signed-off-by: NChi-hsien Lin <Chi-Hsien.Lin@cypress.com>
[kvalo@codeaurora.org: rephased commit log based on discussion]
Signed-off-by: NWright Feng <wright.feng@cypress.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

setup_timer.cocci suggested the following improvement:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c:383:1-11: Use
setup_timer function for function on line 384.

The combination of init_timer and setting up the data and function field
manually is equivalent to calling setup_timer(). This is an api
consolidation only and improves readability.
Acked-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: NXie Qirong <cheerx1994@gmail.com>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Some firmware entries were forgotten to be added via MODULE_FIRMWARE(), which
may result in the non-functional state when the driver is loaded in initrd.

Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1037344
Fixes: 15be8e89 ("b43: add more bcma cores")
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

When driver fail to reset card ah->curchan value stay NULL. When
later driver try to update tx power it oops by using ah->curchan
(calltrace is shown below).

This problem were reported at various places and for some it was
fixed by making ath9k_hw_chip_reset() do not fail. I have this bug
report on some oldish RHEL kernel with AR9285, however it's hard to
debug where reset fail when kernel OOPS, so I think this patch
should be applied. Hopefully ah->curchan is not used unconditionally
on other places until is initialized on ath9k_config().

ath: phy0: Chip reset failed
ath: phy0: Unable to reset hardware; reset status -22 (freq 2412 MHz)
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<f8a35585>] ath9k_hw_set_txpowerlimit+0x25/0x80 [ath9k_hw]
Oops: 0000 [#1] SMP
<snip>
Call Trace:
 [<f8aac1aa>] ? ath9k_cmn_update_txpow+0x1a/0x30 [ath9k_common]
 [<f8cf4f4e>] ? ath_complete_reset+0x4e/0x130 [ath9k]
 [<f8cf54d7>] ? ath9k_start+0x127/0x1e0 [ath9k]
 [<f8c2e52f>] ? ieee80211_do_open+0x30f/0x910 [mac80211]
 [<c07bd96d>] ? dev_open+0x8d/0xf0
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The array field eeprom_data in struct th9k_platform_data
is a fixed size array so it can never be NULL.

Addresses-Coverity-ID: 1364903
Cc: Arend Van Spriel <arend.vanspriel@broadcom.com>
Cc: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: NGustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Use memdup_user() helper instead of open-coding to simplify the code.
Signed-off-by: NGeliang Tang <geliangtang@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

The AR5K_EEPROM_READ macro returns with -EIO if a read error
occurs causing a memory leak on the allocated buffer buf. Fix
this by explicitly calling ath5k_hw_nvram_read and exiting on
the via the freebuf label that performs the necessary free'ing
of buf when a read error occurs.

Detected by CoverityScan, CID#1248782 ("Resource Leak")
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

It's spelled hardware, not harware.
Signed-off-by: NAmmly Fredrick <ammlyf@gmail.com>
[kvalo@qca.qualcomm.com: improve commit log]
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

An issue was found brcmfmac driver in which a skbuff in .start_xmit()
callback was actually cloned. So instead of checking for sufficient
headroom it should also be writable. Hence use skb_cow_head() to
check and expand the headroom appropriately.
Signed-off-by: NArend van Spriel <arend.vanspriel@broadcom.com>
Tested-by: NSteve deRosier <derosier@gmail.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>

Add the missing endianness conversions to a debug statement printing
the USB device-descriptor bcdUSB field during probe.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

These are already handled by mwifiex_shutdown_sw() and
mwifiex_reinit_sw(). Ideally, we'll kill the flag entirely eventually,
as I suspect it breeds race conditions.
Signed-off-by: NBrian Norris <briannorris@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>

Signed-off-by: NBrian Norris <briannorris@chromium.org>
Signed-off-by: NKalle Valo <kvalo@codeaurora.org>